import { mkdir, writeFile } from 'node:fs/promises';
import path from 'node:path';

// Normalize + pretty-print an auth JSON blob before writing it with owner-only
// permissions. Shared by the credential-writing adapters (Claude, and available
// to Codex/OpenCode). `label` names the source in the parse-error message.
export const writeJsonFile = async (
  filePath: string,
  content: string,
  label = 'auth',
) => {
  let normalized = content.trim();
  try {
    normalized = `${JSON.stringify(JSON.parse(normalized), null, 2)}\n`;
  } catch {
    throw new Error(`${label} JSON is not valid JSON.`);
  }
  await mkdir(path.dirname(filePath), { recursive: true });
  await writeFile(filePath, normalized, { mode: 0o600 });
};