"""
BizNode License Keypair Generator
===================================
Run this ONCE to generate your server Ed25519 signing keypair.

    python scripts/generate_license_keypair.py

Output:
    Private key (Base64) → paste into provision.py as SERVER_PRIVATE_KEY_B64
    Public key  (Base64) → paste into services/license_validator.py as SERVER_PUBLIC_KEY_B64

KEEP THE PRIVATE KEY SECRET. Never commit it to git.
Store it only on your provisioning machine (your PC used to write USBs).
"""

import base64
from nacl.signing import SigningKey

def generate():
    signing_key  = SigningKey.generate()
    verify_key   = signing_key.verify_key

    private_b64  = base64.b64encode(bytes(signing_key)).decode()
    public_b64   = base64.b64encode(bytes(verify_key)).decode()

    print("=" * 60)
    print("  BizNode License Keypair — GENERATED ONCE, STORE SAFELY")
    print("=" * 60)
    print()
    print("PRIVATE KEY (for provision.py — keep SECRET, never commit):")
    print(f"  SERVER_PRIVATE_KEY_B64 = \"{private_b64}\"")
    print()
    print("PUBLIC KEY (for services/license_validator.py — safe to ship):")
    print(f"  SERVER_PUBLIC_KEY_B64 = \"{public_b64}\"")
    print()
    print("=" * 60)
    print("Next steps:")
    print("  1. Copy the PRIVATE KEY into your provision.py script")
    print("  2. Copy the PUBLIC KEY into services/license_validator.py")
    print("  3. Rebuild the EXE: python build_exe.py")
    print("  4. Never regenerate — all existing licenses will break")
    print("=" * 60)

if __name__ == "__main__":
    generate()
