"""One-time ops bootstrap: generate and encrypt the server's master xprv.

Usage:
    python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
    # put that value in XPRV_ENCRYPTION_KEY (.env), then:
    python scripts/generate_master_key.py
"""

from app.config import settings
from app.wallet.hd import generate_master_key
from app.wallet.verify import load_sample

if __name__ == "__main__":
    if not settings.xprv_encryption_key:
        raise SystemExit("XPRV_ENCRYPTION_KEY is not set")
    sample = load_sample()
    if sample.users or sample.rounds or sample.seeds:
        # SEC-50: a new key cannot reproduce the addresses the database already holds.
        raise SystemExit("the database already has users or rounds: a new key would not reproduce their addresses")
    generate_master_key()
    print(f"Master key written (encrypted) to {settings.master_key_path}")