<?php
// PHP 8.3+, ext-curl. Key remains in server environment; full replies are not logged.
$base = rtrim(getenv('TURBOPULSA_API_URL') ?: 'https://api.turbopulsa.com/sandbox/v1', '/');
$parts = parse_url($base);
if (!(($parts['scheme'] ?? '') === 'https' && ($parts['host'] ?? '') === 'api.turbopulsa.com') && !(getenv('TURBOPULSA_FIXTURE') === '1' && ($parts['scheme'] ?? '') === 'http' && in_array($parts['host'] ?? '', ['127.0.0.1','localhost'], true))) throw new RuntimeException('Use branded HTTPS API; HTTP is fixture-only.');
function api(string $path, string $method='GET', ?array $body=null, ?string $uuid=null): array {
    global $base;
    $headers = ['Authorization: Bearer '.getenv('TURBOPULSA_API_KEY'), 'Accept: application/json'];
    if ($uuid) $headers = [...$headers, 'Idempotency-Key: '.$uuid, 'Content-Type: application/json'];
    $ch = curl_init($base.$path);
    curl_setopt_array($ch, [CURLOPT_RETURNTRANSFER=>true, CURLOPT_CUSTOMREQUEST=>$method, CURLOPT_HTTPHEADER=>$headers, CURLOPT_CONNECTTIMEOUT=>5, CURLOPT_TIMEOUT=>15]);
    if ($body !== null) curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($body, JSON_THROW_ON_ERROR));
    $raw = curl_exec($ch); $status = curl_getinfo($ch,CURLINFO_HTTP_CODE); curl_close($ch);
    if ($raw === false) throw new RuntimeException('network_unknown');
    $result = json_decode($raw,true,flags:JSON_THROW_ON_ERROR);
    if ($status < 200 || $status >= 300) throw new RuntimeException($result['error']['code'] ?? 'request_failed');
    return $result;
}
try {
    foreach (['TURBOPULSA_CLIENT_REFERENCE','TURBOPULSA_QUOTE_UUID','TURBOPULSA_CONFIRM_UUID'] as $required) if (!getenv($required)) throw new RuntimeException('Persist reference and UUIDs first.');
    $postpaid = getenv('TURBOPULSA_KIND') === 'postpaid';
    $catalog = api(($postpaid ? '/postpaid/catalog' : '/catalog').'?per_page=50');
    $body = ['product_code'=>getenv('TURBOPULSA_PRODUCT_CODE') ?: $catalog['data'][0]['code'], 'client_reference'=>getenv('TURBOPULSA_CLIENT_REFERENCE')];
    if ($postpaid) $body['customer_no'] = getenv('TURBOPULSA_CUSTOMER_NO') ?: '001234567890';
    else $body['destination'] = json_decode(getenv('TURBOPULSA_DESTINATION_JSON') ?: '{"phone":"081200000000"}', true, flags:JSON_THROW_ON_ERROR);
    $prepared = api($postpaid ? '/postpaid/inquiries' : '/quotes','POST',$body,getenv('TURBOPULSA_QUOTE_UUID'));
    for ($attempt=0; $postpaid && empty($prepared['data']) && !empty($prepared['inquiry']['id']) && $attempt<5; $attempt++) { sleep(1); $prepared = api('/postpaid/inquiries/'.$prepared['inquiry']['id']); }
    $quote = $prepared['data'] ?? null;
    if (!$quote || empty($quote['id'])) throw new RuntimeException('inquiry_pending_check_same_reference');
    echo json_encode(array_intersect_key($quote,array_flip(['id','name','price','currency','status']))).PHP_EOL;
    echo 'Periksa tujuan lokal dan total. Ketik BAYAR untuk konfirmasi: ';
    if (trim(fgets(STDIN)) !== 'BAYAR') exit(0);
    try { $result = api('/orders/'.$quote['id'].'/confirm','POST',['confirmation_token'=>$quote['confirmation_token']],getenv('TURBOPULSA_CONFIRM_UUID')); }
    catch (RuntimeException $e) { if ($e->getMessage() !== 'network_unknown') throw $e; $result = api('/orders/'.$quote['id']); }
    $current = api('/orders/'.$result['data']['id'])['data'];
    echo json_encode(array_intersect_key($current,array_flip(['id','status','charged','currency']))).PHP_EOL;
} catch (Throwable $e) { fwrite(STDERR,'Request belum selesai; periksa referensi yang sama.'.PHP_EOL); exit(1); }