1import fs from 'fs'
2import { pathDownJoin } from '../pathF.mts'
3import { secretsDir } from '../secretsDirF.mts'
4import { randomUrlSafeBytes } from '../../sharedF/randomBytesF.mts'
5import { assertExists } from '../assertsF/assertExistsF.mts'
6
7export const getGenPlainSec = (secretName: string, genLength = 32) => {
8  const secPath = pathDownJoin(secretsDir, secretName)
9  if (fs.existsSync(secPath)) {
10    return fs.readFileSync(secPath, 'utf-8')
11  }
12  // Don't auto-generate if secretsDir doesn't exist (e.g., on server without secrets)
13  // This prevents confusing ENOENT errors and makes it clear secrets need to be synced
14  assertExists(secretsDir, {secretName})
15  const genVal = randomUrlSafeBytes(genLength)
16  fs.writeFileSync(secPath, genVal)
17  return genVal
18}
19