#!/bin/sh
# Make the Ed25519 key for MCP Registry HTTP auth (docs: registry authentication.mdx, "HTTP Authentication").
# Private key stays in .registry-key/ (mode 600, never served). The public part goes to /.well-known/mcp-registry-auth via build-site.js.
set -e
cd "$(dirname "$0")/.."
mkdir -p .registry-key && chmod 700 .registry-key
[ -f .registry-key/key.pem ] || openssl genpkey -algorithm Ed25519 -out .registry-key/key.pem
chmod 600 .registry-key/key.pem
openssl pkey -in .registry-key/key.pem -pubout -outform DER | tail -c 32 | base64 > .registry-key/public.b64
echo "public key written to .registry-key/public.b64; for mcp-publisher use the hex seed from: openssl pkey -in .registry-key/key.pem -noout -text"