"""Operator hints for vault-backed signing without manual token paste."""

from __future__ import annotations

BROKER_CATALOG_ID = "ops-warden-warden-sign-token"

BROKER_EXEC_TEMPLATE = (
    "cd ~/railiance-platform && scripts/credential.py exec "
    "--grant ops-warden/warden-sign --ttl 15m -- "
    "warden sign <actor> --pubkey <path>"
)


def missing_vault_token_message(token_env: str) -> str:
    """Structured hint when vault backend lacks a scoped token."""
    return (
        f"Vault token not found. Set {token_env!r} for the current shell only, "
        f"or use the railiance-platform credential broker (preferred):\n"
        f"  warden route show {BROKER_CATALOG_ID}\n"
        f"  {BROKER_EXEC_TEMPLATE}\n"
        f"See wiki/playbooks/ops-warden-warden-sign-token.md"
    )