#!/usr/bin/env bash
# SAFE DEFENSIVE VALIDATOR — CLOUD CLI / CRED SURFACE (whoami style)
#
# Purpose: Checks for presence and identity of cloud CLIs (aws, gcloud, az, doctl)
#          using safe version and identity calls. Read-only, no actions.
#
# Safety: Only version and whoami / sts get-caller-identity etc.
#
# Generated by Vigil safe-poc-generator (next iteration).

set -euo pipefail

STARTED=$(date -u +%Y-%m-%dT%H:%M:%SZ)

echo '{
  "validator": "cloud-cli-validator",
  "schemaVersion": "1.0.0",
  "generatedBy": "Vigil safe-poc-generator (next iteration)",
  "startedAt": "'"$STARTED"'",
  "checks": {},'

for cli in aws gcloud az doctl; do
  if command -v "$cli" >/dev/null 2>&1; then
    VER=$($cli --version 2>/dev/null | head -1 | tr -d '\n' | sed 's/"/\\"/g' || echo "present")
    echo '  "'"$cli"'": { "present": true, "version": "'"$VER"'" },'
  else
    echo '  "'"$cli"'": { "present": false },'
  fi
done

echo '  "completedAt": "'$(date -u +%Y-%m-%dT%H:%M:%SZ)'",
  "conclusion": "Cloud CLI presence and versions captured. Check for leaked creds separately."
}'
exit 0