/**
 * Helpers for `olam auth issue-anthropic-token` (g4.1) cloud-mode UX.
 *
 * Extracted from auth.ts so the file-write + label-default logic is unit
 * testable without driving the commander action (which blocks on a stdin
 * cookie prompt). auth.ts delegates here; tests target this module directly
 * — same pattern as `auth-refresh-kubernetes.ts`.
 */
import * as fs from 'node:fs';
import * as os from 'node:os';
import * as path from 'node:path';
/**
 * Resolve the friendly token label. The label is just a handle for
 * `list-anthropic-tokens` + revocation, so it is optional: when omitted we
 * default to `<hostname>-<timestamp>`, unique per mint on a single laptop.
 */
export function resolveTokenLabel(label) {
    if (label && label.trim().length > 0)
        return label;
    return `${os.hostname()}-${Date.now()}`;
}
/**
 * Persist the cloud-mode bearer URL where auth-client's `resolveCloudUrl()`
 * expects it: `<home>/.olam/anthropic-base-url`, a single BARE trimmed URL
 * plus a trailing newline, chmod 600.
 *
 * Bare URL only — NO `export X='...'` shell wrapper and no quotes. The
 * resolver reads the file verbatim, `.trim()`s it, and parses one URL per
 * file; a shell-assignment line would break that contract.
 *
 * Returns `{ wrote: false }` (no filesystem touch) when `opts.write === false`
 * — the `--no-write-file` opt-out path.
 */
export function writeAnthropicBaseUrlFile(url, opts = {}) {
    const homeDir = opts.homeDir ?? os.homedir();
    const filePath = path.join(homeDir, '.olam', 'anthropic-base-url');
    if (opts.write === false) {
        return { wrote: false, path: filePath };
    }
    fs.mkdirSync(path.dirname(filePath), { recursive: true });
    // mode on writeFileSync is masked by umask; chmod after to guarantee 600.
    fs.writeFileSync(filePath, `${url}\n`, { mode: 0o600 });
    fs.chmodSync(filePath, 0o600);
    return { wrote: true, path: filePath };
}
//# sourceMappingURL=anthropic-base-url-file.js.map