#!/usr/bin/env python3
"""Create a new local secret without displaying it; never replace existing .env."""
import os
from pathlib import Path
import re
import secrets
root=Path(__file__).resolve().parent
image=(root/'image-id.txt').read_text().strip()
assert re.fullmatch(r'sha256:[0-9a-f]{64}', image), 'Invalid immutable image ID'
path=root/'.env'
fd=os.open(path, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
with os.fdopen(fd,'w') as stream:
    stream.write(f'ASR_IMAGE={image}\nASR_API_KEY={secrets.token_urlsafe(48)}\nASR_GPU_MEMORY_UTILIZATION=0.15\n')
print('ENV_CREATED mode=0600 secret=not-displayed image='+image)