# @kentcdodds/origin

## Intent

Give Kody agents a durable, secret-safe way to call the Cursor Origin REST API
(repos, pull requests, installation discovery, and a raw request escape hatch)
using an Origin App. Cloud Agents API keys are not Origin credentials.

This package mints short-lived app JWTs through `secret_jwt_sign` (`EdDSA`) and
exchanges them for installation tokens. The Ed25519 private key never enters
package or execute code.

## What it does

- List Origin App installations and installation-visible repositories
- List pull requests for Origin repos the installation can see
- Mint installation access tokens (token value never returned)
- Raw authenticated requests to any `/v1/origin` path
- Cheap rate-limit check as a credential smoke test
- Persist `originAppId` / `originInstallationId` in package storage

## Prerequisites / setup

Follow `coding_guide_get({ guide: "provider_origin" })`. Defaults this package
reads:

1. User secret **`originAppPrivateKey`** — PKCS#8 Ed25519 PEM, with
   `secret_jwt_sign` and host `api.cursor.com` approved.
2. Package storage **`originAppId`** — `app_01…`.
3. Package storage **`originInstallationId`** — `i_01…` (optional; the first
   installation is used when omitted).

Agents: see [`AGENTS.md`](./AGENTS.md) for import paths and smoke checks.

## Done when

- `originAppPrivateKey` is saved; JWT sign and `api.cursor.com` are approved
- `originAppId` (and optionally `originInstallationId`) are in package storage
- `./rate-limit` returns limit/remaining (app JWT works)
- You can list installations / repos / pulls for an owner the app can see