<?php
// PHP server only; requires ext-curl. No token in frontend or logs.
function savdolar(string $path, string $method = 'GET', ?array $body = null, ?string $key = null): array {
    $token = getenv('SAVDOLAR_API_TOKEN');
    if (!$token) throw new RuntimeException('Set server SAVDOLAR_API_TOKEN');
    $base = getenv('SAVDOLAR_API_URL') ?: 'https://apishop.nexa.uz';
    $headers = ['Authorization: Bearer '.$token, 'Content-Type: application/json'];
    if ($key !== null) $headers[] = 'Idempotency-Key: '.$key;
    $ch = curl_init($base.'/v1'.$path);
    curl_setopt_array($ch, [CURLOPT_CUSTOMREQUEST=>$method, CURLOPT_RETURNTRANSFER=>true,
        CURLOPT_HTTPHEADER=>$headers, CURLOPT_CONNECTTIMEOUT=>5, CURLOPT_TIMEOUT=>20]);
    if ($body !== null) curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($body, JSON_THROW_ON_ERROR));
    $response = curl_exec($ch); $status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
    curl_close($ch);
    if ($response === false) throw new RuntimeException('Outcome uncertain: recover the SAME stored order key');
    $result = json_decode($response, true, 512, JSON_THROW_ON_ERROR);
    if ($status >= 400 || !($result['ok'] ?? false)) {
        throw new RuntimeException(($result['error']['code'] ?? 'API_ERROR').': '.($result['error']['description'] ?? 'Uncertain').'; request_id='.($result['request_id'] ?? ''));
    }
    return $result;
}
// 1. $quote = savdolar('/quotes','POST',['product_id'=>$currentProductId,'quantity'=>1]);
// 2. Show price, get your customer's confirmation; persist key and EXACT body in your DB.
// 3. $order = savdolar('/orders','POST',$exactStoredBody,$storedKey);
// 4. On timeout, GET /orders/lookup?idempotency_key=rawurlencode($storedKey).
//    Retry the same body/key, never create a second key for one business purchase.
// 5. Poll /orders/{id} every 5s; only completed allows /orders/{id}/delivery.
// Authenticate your own customer and check order ownership before exposing any delivery.