# Cracked, for your AI

Cracked pays creators to make short song ads for small online shops. You (an AI) can do the work a creator does on
its pages: find and take shops, make or upload ads, send them for a check, read what the reviewer said, read the
DM draft and the earnings. Your person keeps the parts that are a person's: sending every DM, paying, payouts.

BASE is this site: https://v2-walk-1.cracked.app.
The same guide as a skill file (frontmatter, for an agent's skills folder): $BASE/skill.md

## If you're a shop's AI

This site is for creators. A shop that wants an ad asks on Cracked's site for shops, https://go.cracked.app (its own guide:
https://go.cracked.app/llms.txt):
- Its home page takes the shop's store link and an email (the form posts `d`, the link, and `email` to
  https://go.cracked.app/request). Cracked's studio makes the ad, a person checks it, and it's in that inbox within
  48 hours, free, with the "Made with Cracked" tag.
- $49 once keeps it clean (no watermark), with a 7-day refund; then 4 ads a month: $50 the first month after a $49
  keep, $99 a month after that. Every price as JSON: https://go.cracked.app/pricing.json
- Already have the shop's pitch link ($BASE/p/...)? Read it, compare its ads and get the keep's checkout for a person to
  pay: $BASE/brand-skill.md
- Nothing on this site makes a shop its own ad: here an ad reaches a shop only through a creator's DM, and
  sending to shops is closed until launch.

## Before launch

Launch has no date yet. Until it opens: sending to shops is closed (no DM goes out, so no shop sees an ad and no shop
money comes in), and view pay on Cracked's own ads and the challenge's 30 days haven't started. Everything before
that works now: taking shops, making ads, a person's check, the course. GET /shops/<id> data.sending and GET /challenge
data.launch say where it stands.

## The key

Your person makes a key in Settings (Agent access) and gives it to you. Send it on every call:

    curl -s -H "Authorization: Bearer $CRACKED_KEY" $BASE/shops

A key spends at most its credits a day (your person sets it), works 90 days, and can be revoked at any time.
A wrong, revoked or old key gets 401, and so does a call with no key. Never put it in a URL.

A key opens the site it was made on, nothing else. To practice, make one on a walk environment (v2-walk-N.cracked.app,
seeded for a walk): its makes are Cracked's sample videos, its payments Stripe test mode, its test shops never
messaged. There your AI can walk the whole journey (make, check, fix, the shop's page, the $49 keep, earnings) while a
person plays the reviewer and the owner.

## Read: the same pages your person sees, as JSON

Every GET answers { ok, page, data, version }. `data` is the page's own view model: its fields are the screen's
words, so they can change when a page changes. `version` names the build.

    GET /shops                 your shops by stage, the house brand, the brand library (a count until you're vetted)
    GET /shops/new             the take-a-shop form's limits
    GET /shops/<id>            one shop: data.step is its one next step (Make, Ad, Wait, Dm, Reply, Link, Bought);
                               data.sending: whether DMs to shops can go out yet (closed until launch)
    GET /shops/<id>/preview    what the shop's owner will see once your ad is approved
    GET /ads                   your ads, each with the one thing it needs (a make that failed before it had a
                               video isn't listed: its own GET /ads/<id> says why)
    GET /ads/skills           the ad skills: beats, an example, engines and cost, approval rate. Name the
                               one you use as "skill" in making_of
    GET /ads/<id>              one ad: data.state, data.version, data.notes (what the reviewer asked), data.file,
                               data.failed (a make that didn't render: what the maker said, and what came back),
                               data.lyric (the lyric a song make was sung from, as Cracked sings it, with its hook
                               and, once rendered, where the hook was found: a review or the product page),
                               data.unchecked (Cracked's picture check didn't run on it: a person checks every picture),
                               data.queue (at the check: how many ads sent before it still wait)
    GET /ads/<id>/ready        plain text: rendering, ready or failed. Poll every 30 seconds, no faster
    GET /make?brand=<id>       (or GET /make, for Cracked's own) read it before every song make. data.writer: when it
                               isn't "", Cracked's song writer is out (it says until when): send your own `lyric`
                               (below) or upload; a song make without a lyric is refused then (422, nothing spent).
                               Also what a make costs you now (data.cost), your credit
                               balance (data.balance), and data.key: your key's credits a day, what it has left today,
                               how many makes that is, and when it opens again (a failed make doesn't count), and
                               data.running: your make still being checked or rendered ({ad, retryAfter, no}), or null
    GET /money                 data.lines (each earning and where it is, held to paid), data.payouts (paid),
                               data.credits (your balance and the packs)
    GET /challenge             the $80 challenge: its bar, your progress, data.launch (launch has no date yet)
    GET /learn, /learn/<id>    the course's lessons, where your person has them open (data.lesson.html)

## Write: the same forms, as JSON

POST form fields (multipart for a file, else multipart or urlencoded: a body that isn't a form gets 422 "Send it as
a form"). Every answer is { ok, said | no, at, version }: ok true with `said`, what
happened, and `at`, the page it lands on (it carries the new id: /ads/<id>, /shops/<id>, or Stripe's checkout link);
or ok false (HTTP 422) with `no`, the reason in plain words. `make`, `bring-shop` and `bring-shops` need a `nonce` you
make up per write: send the same one on a retry and you get the same ad or shop back, never a second spend. The same
nonce with other fields is a 409. The buys take no nonce: a buy of the same thing within 10 minutes is the same Stripe
checkout.

    # take one shop: its store link is the product page of the one product the ad sells (Cracked reads that page and
    # its reviews, and your hook must be on that page; a home-page link gets a page Cracked picks), and its Instagram
    curl -s -H "Authorization: Bearer $CRACKED_KEY" -F name="Sunny Paws" -F store=sunnypaws.com/products/fish-bag -F handle=sunnypaws -F nonce=n1 $BASE/do/bring-shop
    # paste up to 20 at once, one shop a line (name, store link, Instagram; tabs, pipes or commas)
    curl -s -H "Authorization: Bearer $CRACKED_KEY" --data-urlencode list@shops.txt -d nonce=n2 $BASE/do/bring-shops
    # upload your own ad for a shop you hold, with up to 3 lines on why, each pointing at the shop's own review or photo
    curl -s -H "Authorization: Bearer $CRACKED_KEY" -F brand=b_... -F title="What's in the bag" -F file=@ad.mp4 \
      -F why1="Reviews keep saying the bag smells like real fish" -F src1="https://shop.example/reviews/123" -F nonce=n3 $BASE/do/make
    # or let Cracked's maker make a song ad (costs credits): -F engine=song instead of -F file. Without a lyric it
    # writes the song from the shop's own store page. With -F "lyric=<lyric.json" (below) it sings the one you wrote.
    # (A lyric on an upload is refused: an upload is your finished cut.)
    # A make that fails gives its credits back and says why on GET /ads/<id> (data.failed); a store-read refusal names
    # the page Cracked read and the reviews, photos and videos it found there
    # One song make at a time: while your last one is still being checked or rendered, the next answers HTTP 409 with
    # `no` ("Your last make is still being checked; send the next when it's back, about 15 seconds"), data.retryAfter
    # (seconds to wait) and data.ad (the one still going); send the same make again after that many seconds
    # send it for a person's check (the version from GET /ads/<id>)
    curl -s -H "Authorization: Bearer $CRACKED_KEY" -F ad=a_... -F version=v_... $BASE/do/send-for-check
    # a fix the reviewer asked for: a new file as the next version
    curl -s -H "Authorization: Bearer $CRACKED_KEY" -F ad=a_... -F version=v_... -F file=@fixed.mp4 $BASE/do/resubmit

## Write the song yourself: the `lyric` field

You can write the song, and Cracked only sings it and cuts it to the shop's own photos and videos. Read the shop
first (its product page and its reviews), find the one true thing about the product that a stranger didn't know, and
write a 30-40 second jingle around it: a 3-line chorus (the shop's name, the setup, the turn), a 2-4 line verse, then
the chorus again (added for you). A lead singer sings each `sing`; backing singers answer with its `answer`.

    {
      "chorus": [
        { "sing": "Naoki Matcha, Naoki Matcha", "answer": "Naoki!" },
        { "sing": "Low bitterness with some umami", "answer": "" },
        { "sing": "Now my mornings taste like Kyoto", "answer": "Kyoto!" }
      ],
      "verse": [
        { "sing": "Whisk it up before the train", "answer": "" },
        { "sing": "One scoop and the day is yours", "answer": "yours!" }
      ],
      "style": "bright city pop, 120 bpm, handclaps, backing singers",
      "voice": "female",
      "hook": { "quote": "low bitterness with some umami" },
      "brand_sung": "Naoki Matcha",
      "brand_said": "now key matcha"
    }

    curl -s -H "Authorization: Bearer $CRACKED_KEY" -F brand=b_... -F title="Low bitterness" -F engine=song \
      -F "lyric=<lyric.json" -F nonce=n4 $BASE/do/make

- `chorus`: exactly 3 lines. Line 1 opens on the shop's name. Lines 2 and 3 are 7 words or fewer (about 3.5 s each:
  the free preview is these three lines, so line 3 is the turn).
- `verse`: 2 to 4 lines of 10 words or fewer. Every `sing` is 60 characters or fewer; an `answer` 5 words or fewer
  (or "").
- `hook.quote`: the few words a chorus line sings that are word for word in one of the shop's reviews on its own store
  (else its product page). The shop is told the ad was made from its reviews only when that's true.
- `style`: genre, tempo and voices (200 characters or fewer). `voice`: female or male.
- `brand_sung` (optional): the name spelled as it should be sung. `brand_said` (optional): how it's said, in plain
  words, for the spoken name at the end (left out, Cracked says it as `brand_sung` reads). Both are the shop's own
  name and nothing else: its letters ("e.l.f." as "elf", "H&M" as "H and M"), or a respelling that keeps its sounds
  ("Now-key Matcha" for "Naoki Matcha"). A slogan or a sentence there is refused.
- Letters (with the usual accents), numbers, spaces and basic punctuation only: no emoji (the singer can't sing one
  and the captions can't show one) and no look-alike letters from other alphabets. Invisible characters (zero-width
  spaces, direction marks) are dropped, and data.lyric shows the lyric as it is sung.
- Every line is sung exactly as you sent it, `answer` included: Cracked adds no echo of its own.
- Nothing else goes in the lyric.

What Cracked still checks itself, by script. The first is checked the moment you send it, before anything is
made or spent: a refusal answers HTTP 422 with `no` (what to change) and `field` ("lyric"), leaves no ad and doesn't
count toward the day's limit, so fix it and send again. The ones that need the shop's store read come back on
GET /ads/<id> data.failed a few seconds later; those give the credits back and don't count toward the day either:
- the shape and lengths above, and that no line or answer has a link, a handle, a word we don't put in an ad, a
  promise we can't check ("guaranteed", "#1", "best ever"), a money amount or percentage ("500 a week", "five hundred
  bucks", "50%": prices come from the shop's own offer card), a character outside the set above, or a [ ] { } < >;
- the same words disguised are refused too: accents ("Guarantéed"), digits for letters ("Gu4ranteed"), a word spelt
  out a letter at a time ("S e x y", "G-u-a-r-a-n-t-e-e-d"), a link said aloud ("cracked dot app", "at cracked app"),
  also when it runs across two lines, and a line break or tab inside a line. The style gets the same checks;
- `brand_sung` and `brand_said` are the shop's name;
- (from here on, at the store read) line 1 opens on the shop's name (in its own spelling on screen);
- the hook is word for word in one of the reviews Cracked reads from the store (or its page) and sung in the chorus;
- no line says what the product does to a body or health;
- a shop with no reviews: no line is sung as a customer ("I", "me", "my"), because no customer said it.
What a script can't judge is flagged, never refused: a line that looks like an earnings promise ("five hundred a
week", "quit your job", "pays you"), a price or discount ("half off", "free"), a promised result ("viral by Friday",
"every single time"), a claim about what the product does outside the hook's own words ("keeps it dry"), a word cut in
two, or a style that asks for spoken words. The person who checks the ad sees each flagged line and ticks it before it
can pass; data.lyric marks those lines `check: true` ("a person will check this line"). A flagged line that isn't
true to the shop, or promises money or results, is sent back.
Then the render looks at the shop's photos and videos for claims and other people's posts (when that look can't run,
the ad says so in data.unchecked and the person checks every picture by eye), and a person at Cracked checks the finished
ad before any shop sees it. Every fact you sing must be true to the shop's page and reviews: Cracked doesn't fact-check
your lines with a model, the person check does.

Also: `link-post` (ad, link, handle: a Cracked ad your person posted), `buy-credits` (pack) and
`buy-challenge`. The two buys only answer Stripe's checkout link in `at`: your person opens it and pays. No money
moves without them. Until view pay opens at launch, the challenge's 30 days start at launch, not at the payment
(Stripe's line says "30 days from launch").

GET /shops/<id>/preview is the shop's page as its owner will see it once an ad is approved: data.ad is null until
then. data.monthOne there is the monthly price today ($99); once the shop keeps an ad for $49, its first month is $50
(its own page then says so).

## Signed in without a key

A key is the way in for an AI. A script that signs in with the email code and posts with the cookie instead must send
the site's own Origin header on every POST (`-H "Origin: https://v2-walk-1.cracked.app"`, or a Referer on the site), as a
browser does: a cookie POST from anywhere else gets 403 "That form came from another site". A key's POST needs no Origin.

## What only your person does (a key gets 403)

Sending a DM and tapping "I sent it", sending the pitch link, pasting the shop's reply, paying, connecting payouts,
saying they're 18, proving their bio, Settings, making or revoking keys, any review, any admin act.

## The rules you'll meet

- One creator per shop. In the challenge your person holds 3 shops at a time; vetted, 10 it hasn't DMed yet.
- A person at Cracked checks every ad before anything reaches a shop. 3 of your ads at the check at once.
- 20 uploads a day. Song makes spend credits, at most your key's credits a day.
- The DM's words and Instagram link (data.step on a shop) appear only once your person may send it: after the shop's
  ad is approved and once Cracked opens sending to shops at launch (no date yet; data.sending). Until then there's
  nothing to send. Never message, email or
  follow a shop yourself, with Cracked's name or any bot: the DM is always your person's own tap.
- 60 calls a minute per key, 5 a minute of bring-shops and buy-* (429 past it). A hold with no first DM lapses in 7 days.

Practice: GET /practice; POST /do/practice-pitch (existing bearer key).
See /skill.md for fields. Fictional simulation, recommended not required, ten coached
attempts per creator per UTC day. A human alone decides ad quality.