# Website & Domain Intelligence Skill

## Description
Audits domain DNS, SSL/TLS certificates, HTTP security headers (including weak HSTS), SPF/DKIM/DMARC email authentication (including dangerous SPF `+all` and DMARC `pct`), live Google PageSpeed metrics, domain overview/security dossiers, site screenshots/change-diff, and AI audit reports.

## Pricing & Supported Payments
- **Monetization scheme**: pay-per-request via x402 v2
- **Supported Network**: Base mainnet (`eip155:8453`)
- **Accepted Token**: USDC (`0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913`)
- **Auth header**: `PAYMENT-SIGNATURE` (base64 payment payload). Legacy `X-Payment` also accepted.
- **Challenge header**: `Payment-Required` on HTTP 402 (base64 `{x402Version:2, accepts:[...]}`)

### Pricing Tiers

1. **Micro Checks** ($0.02 USDC):
   - `POST /v1/dmarc-check` — Policy, pct, alignment, rua/ruf.
   - `POST /v1/ssl-check` — Issuer, expiry, SANs, hostname match.
   - `POST /v1/headers-check` — Header presence grade + weak HSTS / XFO checks.
   - `POST /v1/domain/subdomains` — Likely subdomain enumeration.
   - `POST /v1/site/screenshot` — Screenshot metadata for a URL.
2. **Core Audits**:
   - `POST /v1/email-security-check` ($0.05) — SPF/DKIM/DMARC with subscores.
   - `POST /v1/domain/security` ($0.05) — Focused security posture + grade.
   - `POST /v1/site/change-diff` ($0.05) — Structured page diff vs snapshot.
   - `POST /v1/domain/audit` ($0.10) — Weighted DNS + SSL + headers + email.
   - `POST /v1/domain/overview` ($0.15) — RDAP, DNS, SSL, hosting/tech hints, risk flags.
3. **Premium**:
   - `POST /v1/website/performance` — Live PageSpeed Insights.
     - **basic** ($0.10): Mobile metrics.
     - **fixes** ($0.25): Mobile + recommendations.
     - **combined** ($0.50): Mobile + desktop + recommendations.
     - Response includes `pagespeed_available` and `warnings` (no fabricated scores).
   - `POST /v1/website/ai-audit-report` ($0.50 / $1.00) — AI multi-check report.
   - `POST /v1/website/ai-seo-readiness` ($0.75) — AI SEO readiness.
   - `POST /v1/website/ai-change-advisor` ($1.00) — AI change/regression advisor.

---

## Response Metadata (Common Parameters)
All paid endpoints return these universal metadata tracking parameters:
- `scan_id`: Unique database record ID tracking this request execution.
- `request_id`: Unique tracking ID generated by the API gateway.
- `cached`: Boolean indicating if response was loaded from the ~10-minute per-tool cache.

---

## Standardized Error Envelope
When validation or payment fails, responses use this machine-readable envelope:
```json
{
  "error": {
    "code": "PAYMENT_REQUIRED",
    "message": "Payment signature required",
    "request_id": "019d854d92a014902b4d249f05a96860",
    "details": {
      "x402Version": 2,
      "accepts": [...]
    }
  }
}
```

Empty `domain` / `url` with a payment signature returns `422 VALIDATION_ERROR` before settle.

---

## Usage Examples

### 1. Website Performance Audit (Premium)
`POST /v1/website/performance`

**Request:**
```json
{
  "domain": "example.com",
  "tier": "fixes"
}
```

**Response (PSI available):**
```json
{
  "domain": "example.com",
  "tier": "fixes",
  "mobile": {
    "score": 85,
    "lcp": "2.4s",
    "inp": "80ms",
    "cls": 0.05,
    "speed_index": "1.9s",
    "interactive": "2.2s"
  },
  "desktop": null,
  "recommendations": [
    "Reduce unused JavaScript modules to improve Interaction to Next Paint.",
    "Serve static assets with an efficient Cache-Control policy."
  ],
  "pagespeed_available": true,
  "warnings": [],
  "cached": false,
  "scan_id": "890283c48011f0a1d489b02cc4319a01",
  "request_id": "019d854d92a014902b4d249f05a96860",
  "audited_at": "2026-07-18T22:30:00Z"
}
```

**Response (PSI rate-limited):** metrics may be `null`, `pagespeed_available: false`, and `warnings` explains the upstream limit.

### 2. Domain Audit
`POST /v1/domain/audit`

**Request:**
```json
{
  "domain": "example.com"
}
```

**Response:**
```json
{
  "domain": "example.com",
  "score": 88,
  "subscores": {
    "dns": 100,
    "ssl": 100,
    "headers": 50,
    "email": 80
  },
  "issues": [
    {
      "severity": "medium",
      "type": "missing_security_headers",
      "headers": ["content-security-policy", "permissions-policy"],
      "impact": "Your domain is missing content security policy headers.",
      "fix": "Publish headers on your server."
    }
  ],
  "checks": {
    "dns_a": ["93.184.215.14"],
    "ssl_valid": true,
    "spf_valid": true,
    "dmarc_valid": true
  },
  "cached": false,
  "scan_id": "890283c48011f0a1d489b02cc4319a01",
  "request_id": "019d854d92a014902b4d249f05a96860",
  "audited_at": "2026-07-18T22:30:00Z"
}
```