import { generateKeyPairSync } from "node:crypto"

/** WireGuard Curve25519 keypair as RouterOS/wg-quick base64 (32 bytes). */
export function generateWireGuardKeyPair(): { publicKey: string; privateKey: string } {
  const { publicKey, privateKey } = generateKeyPairSync("x25519")
  const pubDer = publicKey.export({ type: "spki", format: "der" })
  const privDer = privateKey.export({ type: "pkcs8", format: "der" })
  return {
    publicKey: Buffer.from(pubDer.subarray(-32)).toString("base64"),
    privateKey: Buffer.from(privDer.subarray(-32)).toString("base64"),
  }
}
