// mint-visitor-token — admin-side mint of a signed visitor token bound to
// a known :Person elementId. The agent appends `&v=<token>` to listing-click
// URLs in outbound marketing surfaces (morning-round, lead-nurturing,
// vendor-updates). Verification stays in the UI server; this tool only mints.

import { mintVisitorToken } from "../lib/visitor-token.js";

export interface MintParams {
  accountId: string;
  personId: string;
  ttlDays?: number;
}

export interface MintResult {
  token: string;
  expiryMs: number;
  expiresAt: string;
}

const DEFAULT_TTL_DAYS = 30;
const MAX_TTL_DAYS = 365;

export async function mintVisitorTokenTool(p: MintParams): Promise<MintResult> {
  if (!p.personId || typeof p.personId !== "string") {
    throw new Error("personId required");
  }
  const ttlDays = Math.max(1, Math.min(p.ttlDays ?? DEFAULT_TTL_DAYS, MAX_TTL_DAYS));
  const expiryMs = Date.now() + ttlDays * 24 * 60 * 60 * 1000;
  const minted = mintVisitorToken({ personId: p.personId, expiryMs });
  return {
    token: minted.token,
    expiryMs: minted.expiryMs,
    expiresAt: new Date(minted.expiryMs).toISOString(),
  };
}