/**
 * The relay's two questions to the PHP API (#429), asked with the key from `data/mcp-relay.key`:
 * whose is this agent token, whose was this ticket. See `routeRelay` in api/index.php.
 */
export function phpApi(endpoint, key) {
  const ask = async (route, body) => {
    const res = await fetch(`${endpoint}?r=${route}`, {
      method: 'POST',
      headers: { 'Content-Type': 'application/json', 'X-Relay-Key': key },
      body: JSON.stringify(body),
      signal: AbortSignal.timeout(10_000),
    });
    const data = await res.json().catch(() => null);
    return {
      status: res.status,
      user: data?.user,
      role: data?.role,
      error: data?.error,
      retryAfter: res.headers.get('retry-after'),
    };
  };
  return {
    verifyToken: (token, address) => ask('agent/verify', { token, address }),
    redeemTicket: (ticket) => ask('agent/redeem', { ticket }),
  };
}