//! Mint a real JCP-grant-backed OAuth access token and print it + the issuer
//! public key, so an independent verifier (any RFC 7515/9068 JWT stack) can
//! check it. Used to prove the binding interoperates outside Rust.

use ed25519_dalek::SigningKey;
use jcp_bridge::oauth::grant_to_access_token;
use jcp_grant::issue;
use jcp_schema::{Capability, ContentId, Did, Grant};

fn main() {
    let sk = SigningKey::from_bytes(&[9u8; 32]);
    let issuer = Did::from_verifying_key(&sk.verifying_key());
    let subject = Did::from_verifying_key(&SigningKey::from_bytes(&[2u8; 32]).verifying_key());
    let grant = Grant {
        issuer,
        subject,
        capability: Capability::new(ContentId::of_bytes(b"resource"), ["read", "write"]),
        budget_uj: 5_000_000,
        budget_funds: None,
        caveats: Vec::new(),
        expiry: 0,
        parent: None,
        delegate_depth: Some(3),
        nonce: [7u8; 16],
    };
    let sg = issue(&sk, grant).expect("issue");
    let token = grant_to_access_token(&sg, &sk, 1_000_000, 3600).expect("mint");
    let hex: String = sk.verifying_key().to_bytes().iter().map(|b| format!("{b:02x}")).collect();
    println!("TOKEN {token}");
    println!("PUBKEY {hex}");
}