# Agent-safe: report whether an encrypted token exists. Never prints it.

$ErrorActionPreference = 'Stop'
. (Join-Path $PSScriptRoot 'common.ps1')

if (-not (Test-Path -LiteralPath $script:TokenPath)) {
    Write-StatusLine -Key 'token' -Value 'missing'
    exit 0
}

$info = Get-Item -LiteralPath $script:TokenPath
if ($info.Length -lt 1) {
    Write-StatusLine -Key 'token' -Value 'invalid'
    exit 0
}

try {
    $data = [System.IO.File]::ReadAllBytes($script:TokenPath)
    $plain = Unprotect-SecretBytes -Data $data
    if ([string]::IsNullOrWhiteSpace($plain)) {
        Write-StatusLine -Key 'token' -Value 'invalid'
        exit 0
    }
}
catch {
    Write-StatusLine -Key 'token' -Value 'invalid'
    exit 0
}
finally {
    $plain = $null
    $data = $null
}

Write-StatusLine -Key 'token' -Value 'present'