@kentcdodds/origin

import {
	listOriginInstallations,
	mintInstallationAccessTokenInternal,
	resolveOriginAppId,
	resolveOriginInstallationId,
	signOriginAppJwt,
} from './token.ts'

export {
	listOriginInstallations,
	resolveOriginAppId,
	resolveOriginInstallationId,
	signOriginAppJwt,
}

/**
 * Sign an Origin App JWT and mint an installation access token.
 *
 * Use this before raw Origin calls that need installation auth. The token
 * value is never returned — only the installation id and expiry.
 *
 * @param input.installationId - Optional installation id; defaults to package storage.
 * @param input.scopes - Optional scope list for the minted token.
 * @returns Installation id and token expiry. Token secret stays on the host.
 * @example
 * import mintInstallationAccessToken from 'kody:@kentcdodds/origin/auth'
 * const minted = await mintInstallationAccessToken()
 * // => { installationId: 'ins_01...', expiresAt: '2026-08-28T19:00:00.000Z' }
 */
export async function mintInstallationAccessToken(input: {
	installationId?: string
	scopes?: Array<string>
} = {}): Promise<{ installationId: string; expiresAt: string | null }> {
	const minted = await mintInstallationAccessTokenInternal(input)
	return {
		installationId: minted.installationId,
		expiresAt: minted.expiresAt,
	}
}

export default mintInstallationAccessToken