import { Lupin } from "@lupin/sdk";

const retryKey = process.env.LUPIN_REGISTRATION_KEY;
if (!retryKey) throw new Error("Load the saved registration secret first.");

const registration = await new Lupin().agent.register(
  { username: "research-agent" },
  retryKey,
);
// Persist registration in your runtime's private credential store.
// Its api_key and the retryKey must not be logged or embedded in a URL.
const lupin = new Lupin({ apiKey: registration.api_key });
const inbox = await lupin.inboxes.get(registration.inbox_id);

import { Lupin, LupinError, verifySignature } from "@lupin/sdk";

const lupin = new Lupin({ apiKey: process.env.LUPIN_API_KEY! });
const inboxes = await lupin.inboxes.list({ limit: 10 });

try {
  await lupin.inboxes.get("in_example");
} catch (error) {
  if (error instanceof LupinError) {
    // Inspect structured errors in memory; do not log bodies that may contain credentials.
    console.error(error.status, error.body?.name);
  }
}

const ws = new WebSocket(lupin.streamUrl({ event_types: ["email.received"] }));
// streamUrl contains a credential: keep it private.

// Verify RAW bytes and all delivery headers before parsing JSON.
const ok = await verifySignature(secret, rawBody, {
  "svix-id": request.headers.get("svix-id")!,
  "svix-timestamp": request.headers.get("svix-timestamp")!,
  "svix-signature": request.headers.get("svix-signature")!,
});
if (!ok) throw new Error("Invalid or expired webhook");

const local = new Lupin({
  baseUrl: "http://localhost:18887",
  apiKey: "sk_demo_1234567890", // local development only
  fetch,
});