setup-keys.sh

#!/usr/bin/env bash
set -euo pipefail

# setup-keys.sh — derives all local-dev role keypairs from a single master seed.
#
# Run ONCE after up.sh, before any setup-* script. The keypairs are stable
# across down/up cycles (derived from the same master secret).
#
# Master secret:
#   - Default: hardcoded local-dev-only secret (same as the old ADMIN_SECRET)
#   - Override: MASTER_SECRET=S... env var (for mainnet or custom setups)
#
# Roles derived:
#   ADMIN       — deploys contracts, creates council, adds providers
#   PP          — PP operator, registers PP, signs bundles
#   OPEX        — PP treasury / OpEx, pays network fees
#   PAY_ADMIN   — pay-platform admin
#   PAY_SERVICE — pay-platform service identity (inter-service auth)
#   ALICE       — test user A (deposit, send)
#   BOB         — test user B (receive, withdraw)
#
# Output: .local-dev-keys file consumed by up.sh and setup-* scripts.

SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
SHARED_FILE="$SCRIPT_DIR/.local-dev-keys"
DENO_BIN="${DENO_BIN:-$(command -v deno 2>/dev/null || echo "$HOME/.deno/bin/deno")}"

GREEN='\033[0;32m'
NC='\033[0m'
info() { echo -e "${GREEN}[INFO]${NC} $*"; }

export MASTER_SECRET="${MASTER_SECRET:-}"

cd "$SCRIPT_DIR"

"$DENO_BIN" eval "
import { masterSeedFromSecret, deriveKeypair, ROLES, LOCAL_DEV_MASTER_SECRET } from './lib/master-seed.ts';

const masterSecret = Deno.env.get('MASTER_SECRET') || LOCAL_DEV_MASTER_SECRET;
const masterSeed = await masterSeedFromSecret(masterSecret);

const keys = {};
for (const [key, role] of Object.entries(ROLES)) {
  const kp = await deriveKeypair(masterSeed, role, 0);
  keys[key] = { pk: kp.publicKey(), sk: kp.secret() };
}

const lines = [
  '# Generated by setup-keys.sh — all keys derived from a single master seed.',
  '# Stable across down/up cycles. Consumed by up.sh and setup-* scripts.',
  '# Created: ' + new Date().toISOString(),
  '',
  '# Council admin / contract deployer',
  'ADMIN_PK=' + keys.ADMIN.pk,
  'ADMIN_SK=' + keys.ADMIN.sk,
  '',
  '# PP operator',
  'PP_PK=' + keys.PP.pk,
  'PP_SK=' + keys.PP.sk,
  '',
  '# Standin PP operator (Rust provider-stack on a separate port)',
  'STANDIN_PP_PK=' + keys.STANDIN_PP.pk,
  'STANDIN_PP_SK=' + keys.STANDIN_PP.sk,
  '',
  '# PP treasury / OpEx',
  'OPEX_PK=' + keys.OPEX.pk,
  'OPEX_SK=' + keys.OPEX.sk,
  '',
  '# Pay-platform admin',
  'PAY_ADMIN_PK=' + keys.PAY_ADMIN.pk,
  'PAY_ADMIN_SK=' + keys.PAY_ADMIN.sk,
  '',
  '# Pay-platform service keypair',
  'PAY_SERVICE_PK=' + keys.PAY_SERVICE.pk,
  'PAY_SERVICE_SK=' + keys.PAY_SERVICE.sk,
  '',
  '# Test user A',
  'ALICE_PK=' + keys.ALICE.pk,
  'ALICE_SK=' + keys.ALICE.sk,
  '',
  '# Test user B',
  'BOB_PK=' + keys.BOB.pk,
  'BOB_SK=' + keys.BOB.sk,
];

console.log(lines.join('\n'));
" > "$SHARED_FILE"

info "Shared keypairs written to $SHARED_FILE"
cat "$SHARED_FILE" | grep "_PK=" | while IFS= read -r line; do
  info "  $line"
done