# @kentcdodds/origin — agent notes

Human setup and intent live in [`README.md`](./README.md). This file is for
agents: imports, smoke checks, snippets, and edge cases. Secrets by **name**
only — never paste private key or token values. Do not disable live webhooks or
jobs.

## Secrets / storage

| Name | Kind | Notes |
| --- | --- | --- |
| `originAppPrivateKey` | user secret | PKCS#8 Ed25519 PEM; used only via `secret_jwt_sign` |
| `originAppId` | package storage | `app_01…` |
| `originInstallationId` | package storage | `i_01…`; optional — first installation used when omitted |

Host: `api.cursor.com`. Algorithm: `EdDSA`. Cloud Agents API keys
(`cursorApiKey`) are **not** Origin credentials.

Setup guide: `coding_guide_get({ guide: "provider_origin" })`.

## Import paths

| Export | Import |
| --- | --- |
| overview | `kody:@kentcdodds/origin` |
| auth | `kody:@kentcdodds/origin/auth` |
| installations | `kody:@kentcdodds/origin/installations` |
| pulls | `kody:@kentcdodds/origin/pulls` |
| rate-limit | `kody:@kentcdodds/origin/rate-limit` |
| repos | `kody:@kentcdodds/origin/repos` |
| request | `kody:@kentcdodds/origin/request` |
| migrate-from-values | `kody:@kentcdodds/origin/migrate-from-values` |
| settings | `kody:@kentcdodds/origin/settings` |

Prefer static `kody:@kentcdodds/origin/...` imports from `execute`. Do not lead
with `packages.invoke`.

## Smoke test (read-only)

```js
import getOriginRateLimit from 'kody:@kentcdodds/origin/rate-limit'

export default async function main() {
	return await getOriginRateLimit()
	// => { limit, remaining, used, reset }
}
```

Optional: `describeOriginPackage` from `kody:@kentcdodds/origin` (no network).

## Common snippets

List installations:

```js
import listOriginInstallations from 'kody:@kentcdodds/origin/installations'

export default async function main() {
	const { items } = await listOriginInstallations()
	return { items }
}
```

List repos for an owner:

```js
import listOriginRepos from 'kody:@kentcdodds/origin/repos'

export default async function main() {
	return await listOriginRepos({ ownerSlug: 'kentcdodds', pageSize: 5 })
}
```

List pulls:

```js
import listOriginPulls from 'kody:@kentcdodds/origin/pulls'

export default async function main() {
	return await listOriginPulls({
		ownerSlug: 'kentcdodds',
		repoName: 'kody',
	})
}
```

Raw escape hatch (defaults to installation auth):

```js
import originRequest from 'kody:@kentcdodds/origin/request'

export default async function main() {
	return await originRequest({ path: '/rate_limit', auth: 'app' })
}
```

Persist ids (no republish):

```js
import settings from 'kody:@kentcdodds/origin/settings'

export default async function main() {
	return await settings({
		appId: 'app_01…',
		installationId: 'i_01…',
	})
}
```

## Edge cases

- Origin tokens last at most 15 minutes; this package mints them per call.
- `./auth` returns installation id + expiry only — never the token secret.
- Repositories Origin mirrors in from GitHub are outside the installation.
- Artifacts remains the durable home for Kody package source; this package talks
  to Origin and does not back Kody repos.
- `./migrate-from-values` copies leftover `originAppId` /
  `originInstallationId` values into package storage; safe to repeat.
- Never paste `originAppPrivateKey` or installation token values into chat.