#!/usr/bin/env bash
# List + fetch AI transcripts from a CodeB tenant.
# European Digital Identity Wallet-enabled tenants use the same key surface.
# [compliance-archive-cookbook 2026-07-23]
#
# Auth: Bearer ak_... or admin OIDC bearer (Bearer only - HMAC not accepted here).
# Endpoints (live-verified in signal.ashx):
#   GET /signal.ashx?list-transcripts=1                 (JSON envelope; add &format=csv for CSV)
#   GET /signal.ashx?get-transcript=<basename>.json     (raw JSON incl. _transcriptTurns)
set -euo pipefail

: "${CODEB_TENANT:?export CODEB_TENANT=https://phone.example.tld}"
: "${CODEB_API_KEY:?export CODEB_API_KEY=ak_...}"
OUT_DIR="${OUT_DIR:-./codeb-transcripts}"
mkdir -p "$OUT_DIR"

curl -sSf -H "Authorization: Bearer ${CODEB_API_KEY}" \
  "${CODEB_TENANT}/signal.ashx?list-transcripts=1" -o "$OUT_DIR/index.json"

jq -r '.items[].file // empty' "$OUT_DIR/index.json" | while read -r F; do
  [ -n "$F" ] || continue
  echo "[fetch] $F"
  curl -sSf -H "Authorization: Bearer ${CODEB_API_KEY}" \
    "${CODEB_TENANT}/signal.ashx?get-transcript=${F}" -o "$OUT_DIR/$F"
done
echo "[done] transcripts in $OUT_DIR"