#!/usr/bin/env node
/**
 * Mint a pd1 invite from SERVER_SEED without starting the full server process.
 *
 * Usage:
 *   node scripts/mint-invite.js [role=operator] [ttlMs]
 */
import dotenv from 'dotenv'
import { loadOrCreateKeyPair } from '../server/core/keys.js'
import { signCapability, encodeInvite } from '../shared/crypto-auth.js'

dotenv.config()
const { publicKeyHex, seedHex } = loadOrCreateKeyPair()
const role = process.argv[2] || 'operator'
const ttlArg = process.argv[3]
const ttlMs = ttlArg === undefined ? null : Number(ttlArg)

const { token, payload } = signCapability(seedHex, {
  role,
  ttlMs,
  forever: ttlMs == null || ttlMs === 0,
})

const invite = encodeInvite({
  publicKeyHex,
  capability: token,
  role: payload.role,
  jti: payload.jti,
  expiresAt: payload.exp,
})

console.log(invite)
console.error(`# role=${payload.role} jti=${payload.jti} exp=${payload.exp ?? 'never'}`)