Function signKiloToken

packages/worker-utils/src/kilo-token.ts:58–91

(params: {
  userId: string;
  pepper: string | null;
  secret: string;
  expiresInSeconds: number;
  audience?: string;
  env?: string;
  extra?: SignKiloTokenExtra;
})

export type SignKiloTokenExtra = Pick<
  KiloTokenPayload,
  | 'isAdmin'
  | 'gastownAccess'
  | 'botId'
  | 'organizationId'
  | 'organizationRole'
  | 'internalApiUse'
  | 'createdOnPlatform'
  | 'tokenSource'
  | 'deviceAuthRequestCode'
  | 'deviceSessionId'
  | 'orgMemberships'
  | 'runtimeAdmission'
  | 'runtimeAuthorization'
>;

export async function signKiloToken(params: {
  userId: string;
  /**
   * Omit (or pass `undefined`) to mint an internal-service token with no
   * `apiTokenPepper` claim at all — verifiers treat an absent claim as
   * "skip pepper comparison", unlike an explicit `null`, which is compared
   * against the account's current pepper.
   */
  pepper?: string | null;
  secret: string;
  expiresInSeconds: number;
  audience?: string;
  env?: string;
  extra?: SignKiloTokenExtra;
}): Promise<{ token: string; expiresAt: string }> {
  const now = Math.floor(Date.now() / 1000);
  const exp = now + params.expiresInSeconds;

  const payload: Record<string, unknown> = {
    kiloUserId: params.userId,
    apiTokenPepper: params.pepper,
    version: KILO_TOKEN_VERSION,