#!/usr/bin/env node
// Generate an Ed25519 keypair for signing add-on updates.
//
//   node scripts/generate-update-keypair.mjs <out-dir>
//
// Writes:
//   <out-dir>/addon-update-key.pem       — PKCS#8 PEM private key (keep secret)
// Prints:
//   <64-char hex pubkey>                 — copy into addon-update-pubkeys.js
//
// The out-dir MUST NOT be inside the repo. Recommended: a machine-local
// ops folder outside git, e.g. `%USERPROFILE%\.silentmode\ops`.

import fs from "node:fs";
import path from "node:path";
import crypto from "node:crypto";
import process from "node:process";

const outDir = process.argv[2];
if (!outDir) {
  console.error("usage: node scripts/generate-update-keypair.mjs <out-dir>");
  process.exit(2);
}
fs.mkdirSync(outDir, { recursive: true });
const keyPath = path.join(outDir, "addon-update-key.pem");
if (fs.existsSync(keyPath)) {
  console.error(`refuse to overwrite existing key at ${keyPath}`);
  process.exit(1);
}

const { publicKey, privateKey } = crypto.generateKeyPairSync("ed25519");
fs.writeFileSync(keyPath, privateKey.export({ type: "pkcs8", format: "pem" }), { mode: 0o600 });

// Extract the 32-byte raw pubkey from the SPKI DER.
const der = publicKey.export({ type: "spki", format: "der" });
const raw = der.subarray(der.length - 32);
const hex = raw.toString("hex");

console.log(`private key written to ${keyPath}`);
console.log(`public key (paste into addon-update-pubkeys.js PUBKEYS_HEX):`);
console.log(`  "${hex}"`);