curl -X POST "$INTENDED_API_URL/v1/physical/actors" \
  -H "Authorization: Bearer $INTENDED_API_KEY" \
  -H "x-tenant-id: $INTENDED_TENANT_ID" \
  -H "Content-Type: application/json" \
  -d '{"actorIdentity": "axis-station-7", "actorKind": "robot"}'

#include <curl/curl.h>
#include <nlohmann/json.hpp>
#include <chrono>
#include <cstdint>
#include <stdexcept>
#include <string>
#include <vector>

using nlohmann::json;

namespace intended {

struct StructuredGoal {
    std::string schema;            // e.g. "opc-ua:1.04:method"
    std::string verb;              // e.g. "move-axis"
    std::string object;            // optional target ("" = omit)
    json        parameters = json::object();
    std::string actor_kind;        // "robot" | "cobot" | "agv" | …
    std::string actor_identifier;  // must be registered
};

struct PhysicalDagNode {
    std::string node_id;
    std::string oi_code;           // "OI-" + 3-4 digits
    int         deadline_ms;       // == the token's lifetime (max 300000)
    std::string safe_default;      // "stop" | "hold-position" | …
    std::string real_time_tier;    // "best-effort" | "rt-soft" | "rt-hard"
};

// Fields of the 200 response body of POST /v1/physical/authority-tokens.
struct AuthorityResult {
    std::string decision;          // "ALLOW" | "ESCALATE" (DENY arrives as 422/423)
    std::string token;             // ALLOW only
    std::string token_jti;         // ALLOW only
    int64_t     expires_at_ms = 0; // ALLOW: issuedAt + deadlineMs; ESCALATE: ticket expiry
    std::string oi_code;           // ALLOW only
    bool        safety_bit = false;
    std::vector<std::string> safety_citations;
    std::string safe_default;      // ESCALATE only
    std::string escalation_ticket_id; // ESCALATE only
};

inline json to_payload(const StructuredGoal& g) {
    json j = {
        {"schema", g.schema},
        {"verb", g.verb},
        {"parameters", g.parameters},
        {"actor", {{"kind", g.actor_kind}, {"identifier", g.actor_identifier}}},
    };
    if (!g.object.empty()) j["object"] = g.object;
    return j;
}

inline json to_payload(const PhysicalDagNode& n) {
    return {
        {"nodeId", n.node_id},
        {"oiCode", n.oi_code},
        {"deadlineMs", n.deadline_ms},
        {"safeDefault", n.safe_default},
        {"realTimeTier", n.real_time_tier},
    };
}

class Client {
public:
    Client(std::string base_url, std::string api_key, std::string tenant_id)
        : base_url_(std::move(base_url)), api_key_(std::move(api_key)),
          tenant_id_(std::move(tenant_id)) {}

    AuthorityResult classify_and_issue(
        const StructuredGoal& goal, const PhysicalDagNode& dag,
        const json& physical_state, const std::string& mission_id,
        const std::string& idempotency_key)
    {
        json payload = {
            {"intent", {{"structuredGoal", to_payload(goal)}}},
            {"dagNode", to_payload(dag)},
            {"missionId", mission_id},
            {"claims", {
                {"actorIdentity", goal.actor_identifier},
                {"deadlineMs",    dag.deadline_ms},
                {"safeDefault",   dag.safe_default},
                {"safetyBit",     true},
            }},
        };
        // physicalState is optional; omit it rather than sending null.
        if (physical_state.is_object()) payload["physicalState"] = physical_state;
        return post("/v1/physical/authority-tokens", payload, idempotency_key);
    }

private:
    AuthorityResult post(const std::string& path, const json& body,
                         const std::string& idempotency_key);
    // … see the libcurl appendix; sets Authorization, x-tenant-id,
    //   Idempotency-Key, Content-Type, and CURLOPT_TIMEOUT_MS.

    std::string base_url_, api_key_, tenant_id_;
};

}  // namespace intended