#!/usr/bin/env bash
# Resolve the PyPI token for `uv publish` without ever printing it.
#
# Order: an already exported UV_PUBLISH_TOKEN, then .env in the repo root, then
# the password-store entry passed as $1. The repo intentionally ships no .env,
# so the password-store path is the normal one on a dev machine.

load_pypi_token() {
  local entry="${1:-}"

  if [ -z "${UV_PUBLISH_TOKEN:-}" ] && [ -f .env ]; then
    set -a
    # shellcheck disable=SC1091
    source .env
    set +a
  fi

  if [ -z "${UV_PUBLISH_TOKEN:-}" ] && [ -n "$entry" ] && command -v pass >/dev/null 2>&1; then
    UV_PUBLISH_TOKEN="$(pass "$entry" 2>/dev/null | head -1 || true)"
  fi

  if [ -z "${UV_PUBLISH_TOKEN:-}" ]; then
    echo "error: no PyPI token found." >&2
    echo "  export UV_PUBLISH_TOKEN=..., put it in .env, or store it in: pass ${entry:-<entry>}" >&2
    return 1
  fi

  export UV_PUBLISH_TOKEN
  echo "Using PyPI token (${#UV_PUBLISH_TOKEN} chars) for upload."
}