func getUserMachineAddrAndOpts(cfg *config.Config) (string, []Option, error) {
	// 1) PACHD_ADDRESS environment variable (shell-local) overrides global config
	if envAddr, ok := os.LookupEnv("PACHD_ADDRESS"); ok {
		if !strings.Contains(envAddr, ":") {
			envAddr = fmt.Sprintf("%s:%s", envAddr, DefaultPachdNodePort)
		}
		options, err := getCertOptionsFromEnv()
		if err != nil {
			return "", nil, err
		}
		return envAddr, options, nil
	}

	// 2) Get target address from global config if possible
	if cfg != nil && cfg.V1 != nil && cfg.V1.PachdAddress != "" {
		// Also get cert info from config (if set)
		if cfg.V1.ServerCAs != "" {
			pemBytes, err := base64.StdEncoding.DecodeString(cfg.V1.ServerCAs)
			if err != nil {
				return "", nil, fmt.Errorf("could not decode server CA certs in config: %v", err)
			}
			return cfg.V1.PachdAddress, []Option{WithAdditionalRootCAs(pemBytes)}, nil
		}
		return cfg.V1.PachdAddress, nil, nil
	}

	// 3) Use default address (broadcast) if nothing else works
	options, err := getCertOptionsFromEnv()
	if err != nil {
		return "", nil, err
	}
	return "", options, nil
}
func getUserMachineAddrAndOpts(cfg *config.Config) (string, []Option, error) {
	// 1) PACHD_ADDRESS environment variable (shell-local) overrides global config
	if envAddr, ok := os.LookupEnv("PACHD_ADDRESS"); ok {
		if !strings.Contains(envAddr, ":") {
			envAddr = fmt.Sprintf("%s:%s", envAddr, DefaultPachdNodePort)
		}
		options, err := getCertOptionsFromEnv()
		if err != nil {
			return "", nil, err
		}
		return envAddr, options, nil
	}

	// 2) Get target address from global config if possible
	if cfg != nil && cfg.V1 != nil && cfg.V1.PachdAddress != "" {
		// Also get cert info from config (if set)
		if cfg.V1.ServerCAs != "" {
			pemBytes, err := base64.StdEncoding.DecodeString(cfg.V1.ServerCAs)
			if err != nil {
				return "", nil, fmt.Errorf("could not decode server CA certs in config: %v", err)
			}
			return cfg.V1.PachdAddress, []Option{WithAdditionalRootCAs(pemBytes)}, nil
		}
		return cfg.V1.PachdAddress, nil, nil
	}

	// 3) Use default address (broadcast) if nothing else works
	options, err := getCertOptionsFromEnv()
	if err != nil {
		return "", nil, err
	}
	return "", options, nil
}
// getUserMachineAddrAndOpts is a helper for NewOnUserMachine that uses
// environment variables, config files, etc to figure out which address a user
// running a command should connect to.