"""**Development-only** Ed25519 keypair embedded in the source tree.

This pair lets developers run / test / sign locally without needing
the production private key. Both values are deterministic from a
seed string (``hashlib.sha256(SEED).digest()``) so any contributor
checking out the source gets the same keys — which is exactly what
makes this keypair unsafe for production.

============================================================
DO NOT SHIP THIS KEYPAIR.
============================================================

For shipped builds:

1. Run ``scripts/generate_keypair.py`` to produce a fresh production
   keypair.
2. Stash the **private** key in your password manager / KMS.
3. In the PyInstaller build pipeline, set the env var
   ``DATATOOLS_LICENSE_PUBKEY=<production-pubkey-hex>`` so the
   shipped binary verifies against the production key, not this dev
   key.
4. The production-safe runtime check (``assert_production_safe``)
   refuses to start a frozen build that's still verifying against
   this dev key — that's the tripwire that catches a missing build
   step.

The matching seed phrase below is in source on purpose; rotating
the dev key means changing it here AND regenerating every test
fixture that hard-codes a blob. The seed includes the words
"DEV-seed-NOT-FOR-PRODUCTION" specifically so a string-grep against
a shipped binary would flag a missing build override immediately.
"""

from __future__ import annotations

import hashlib

# The seed phrase. Hashed to 32 bytes → Ed25519 private-key seed.
DEV_SEED_PHRASE: bytes = (
    b"datatools-license-v2-DEV-seed-NOT-FOR-PRODUCTION"
)

# Derived constants. Computed once at import for self-test
# (``test_dev_keypair_matches_seed`` in ``tests/test_license.py``)
# without doing crypto work on every import.
DEV_PRIVATE_KEY_HEX: str = (
    "0bdc196f098b84ed155bacbd00061d4fff2cb68e10109f94332f1fc7de194cdb"
)
DEV_PUBLIC_KEY_HEX: str = (
    "1cbef16b7826dd364ac0c7187d42c2ee00d76486e42389db05efa45dd1ade78a"
)


def _derive_from_seed() -> tuple[str, str]:
    """Re-derive the dev keypair from the seed phrase. Used by the
    unit test that pins the constants above to the seed."""
    from cryptography.hazmat.primitives.asymmetric.ed25519 import (
        Ed25519PrivateKey,
    )
    from cryptography.hazmat.primitives import serialization

    seed = hashlib.sha256(DEV_SEED_PHRASE).digest()
    priv = Ed25519PrivateKey.from_private_bytes(seed)
    priv_hex = priv.private_bytes(
        encoding=serialization.Encoding.Raw,
        format=serialization.PrivateFormat.Raw,
        encryption_algorithm=serialization.NoEncryption(),
    ).hex()
    pub_hex = priv.public_key().public_bytes(
        encoding=serialization.Encoding.Raw,
        format=serialization.PublicFormat.Raw,
    ).hex()
    return priv_hex, pub_hex
