#!/usr/bin/env node
/**
 * Generate Ed25519 key pair for license manifest signing.
 * Public key is safe to commit; private key must stay offline.
 */
'use strict';

const fs = require('fs');
const path = require('path');
const { generateKeyPairPem } = require('../src/api/lib/licenseManifest');

const outDir = process.argv[2] || path.join(__dirname, '../delivery');
fs.mkdirSync(outDir, { recursive: true });

const { publicKeyPem, privateKeyPem } = generateKeyPairPem();
const pubPath = path.join(outDir, 'sovereign-license-root.pub.pem');
const privPath = path.join(outDir, 'sovereign-license-root.pem');

fs.writeFileSync(pubPath, publicKeyPem, { mode: 0o644 });
fs.writeFileSync(privPath, privateKeyPem, { mode: 0o600 });

console.log('Public key:  ', pubPath);
console.log('Private key: ', privPath);
console.log('Keep private key offline. Commit public key only.');
