import { readFileSync } from "fs";

export function load_secrets(file_path) {
	if (!file_path) {
		throw new Error("--secrets <path> is required");
	}
	let raw;
	try {
		raw = readFileSync(file_path, "utf8");
	} catch (err) {
		throw new Error(`Cannot read secrets file at ${file_path}: ${err.message}`);
	}
	let parsed;
	try {
		parsed = JSON.parse(raw);
	} catch (err) {
		throw new Error(`Secrets file is not valid JSON: ${err.message}`);
	}
	if (!parsed.users || typeof parsed.users !== 'object') {
		throw new Error("Secrets file must have a top-level 'users' object");
	}
	return parsed; // callers destructure { users, smtp }
}