import { generateKeyPair, exportPKCS8, exportJWK } from 'jose';
import { randomBytes } from 'node:crypto';
import { writeFile } from 'node:fs/promises';
const { privateKey, publicKey } = await generateKeyPair('RS256', { extractable: true, modulusLength: 2048 });
const publicJwk = { ...await exportJWK(publicKey), kid: 'app-v1', alg: 'RS256', use: 'sig' };
const values = {
  TOKEN_ENCRYPTION_KEY: randomBytes(32).toString('base64'),
  CONVEX_BRIDGE_SECRET: randomBytes(32).toString('base64url'),
  CONVEX_SYNC_WORKER_SECRET: randomBytes(32).toString('base64url'),
  APP_AUTH_PRIVATE_KEY: Buffer.from(await exportPKCS8(privateKey)).toString('base64'),
  APP_AUTH_JWKS: `data:application/json;base64,${Buffer.from(JSON.stringify({ keys: [publicJwk] })).toString('base64')}`
};
await writeFile('.env.keys', Object.entries(values).map(([k, v]) => `${k}='${v}'`).join('\n') + '\n', { flag: 'wx', mode: 0o600 });
console.log('Wrote .env.keys (0600). Import its five values into your Infisical project (dev, /), or a private .env for standalone setup. Never commit it. Existing files are not overwritten.');