#!/usr/bin/env sh
set -eu

# Connector-owned formatter for structured Bot credential bundles imported by a
# Platform Skill. Host injects the selected JSON only into this process; it is
# never accepted in argv or read from a platform CLI's private current profile.
case "${1:-}" in
  credential-json)
    [ -n "${CTENO_CONNECTOR_CREDENTIAL_JSON:-}" ] || {
      printf '%s\n' '[cteno-connector-credential] credential JSON is missing' >&2
      exit 1
    }
    if command -v jq >/dev/null 2>&1; then
      printf '%s' "$CTENO_CONNECTOR_CREDENTIAL_JSON" | jq -ce 'select(type == "object")'
    else
      # Gateway performs JSON parsing too, but without jq we cannot safely prove
      # this is an object without echoing malformed secret material.
      printf '%s\n' '[cteno-connector-credential] jq is required' >&2
      exit 1
    fi
    ;;
  no-credential)
    # Sources whose login lives somewhere the Host already owns (e.g. the
    # browser engine profile for the generic web-watch driver) have no bundle.
    printf '%s' '{}'
    ;;
  *)
    printf '%s\n' 'usage: cteno-connector-credential credential-json|no-credential' >&2
    exit 2
    ;;
esac
