#compdef bugwarden

autoload -U is-at-least

_bugwarden() {
    typeset -A opt_args
    typeset -a _arguments_options
    local ret=1

    if is-at-least 5.2; then
        _arguments_options=(-s -S -C)
    else
        _arguments_options=(-s -C)
    fi

    local context curcontext="$curcontext" state line
    _arguments "${_arguments_options[@]}" : \
'--bugzilla-server=[Base URL of the Bugzilla server (e.g., '\''https\://bugzilla.example.com'\''). Environment variable BUGZILLA_SERVER is used if the argument is not provided]:BUGZILLA_SERVER:_default' \
'--transport=[Transport for the MCP server\: '\''http'\'' (default) or '\''stdio'\''. Environment variable MCP_TRANSPORT can also be used]:TRANSPORT:((http\:"Streamable HTTP transport (default). Clients send the Bugzilla API key per-request via the API key header, unless \`--api-key-file\` selects server-held key mode (then the header is not consulted at all)"
stdio\:"Stdio transport. The API key comes from \`--api-key\` / \`BUGZILLA_API_KEY\` or \`--api-key-file\` at startup"))' \
'--host=[Host address for the MCP server to listen on (http transport only). Defaults to 127.0.0.1 or the MCP_HOST environment variable]:HOST:_default' \
'--port=[Port for the MCP server to listen on (http transport only). Defaults to 8000 or the MCP_PORT environment variable]:PORT:_default' \
'*--allowed-hosts=[Hostname or '\''host\:port'\'' authority accepted in an inbound Host header (http transport only). Repeat the flag, or separate entries with commas; environment variable MCP_ALLOWED_HOSTS can also be used. Empty entries are dropped, so \`MCP_ALLOWED_HOSTS=\` is an unset (like \`BUGZILLA_API_KEY_FILE=\`); without a host, Host validation stays off and any Host header is served. An entry that is not a hostname or host\:port (for example '\''*'\'', a URL, or a space-containing typo) is a startup error]:HOST:_default' \
'--api-key-header=[HTTP header for clients to send the Bugzilla API key. Defaults to '\''ApiKey'\'' or the MCP_API_KEY_HEADER environment variable. Not consulted in server-held key mode (--api-key-file over http)]:API_KEY_HEADER:_default' \
'--api-key=[Bugzilla API key. Required for --transport stdio (no HTTP headers exist there) unless --api-key-file provides it. Environment variable BUGZILLA_API_KEY can also be used. Ignored for --transport http (clients send the key per-request via the API key header; use --api-key-file for a server-held key)]:API_KEY:_default' \
'--api-key-file=[Path to a file holding the Bugzilla API key (e.g. a container secret or systemd LoadCredential path). Mutually exclusive with --api-key. Over http this selects server-held key mode\: every request is served with this key and the per-request API key header is not consulted. An empty value counts as absent, like --api-key (so \`BUGZILLA_API_KEY_FILE=\` is an unset, not an error)]:API_KEY_FILE:_files' \
'--policy=[Path to the guard policy TOML file. Environment variable BUGWARDEN_POLICY can also be used. Without it an allow-all default policy is used]:POLICY:_files' \
'--audit-config=[Path to the audit configuration TOML file (see examples/audit.toml). Environment variable BUGWARDEN_AUDIT_CONFIG can also be used. The exact value \`none\` disables the audit file (OTLP-only when an endpoint is set). Without it, and with no OTLP endpoint, no audit stream is written. An endpoint with no file decision, or \`none\` with no endpoint, is a startup error]:AUDIT_CONFIG:_files' \
'--use-auth-header[Use '\''Authorization\: Bearer'\'' header instead of the api_key query parameter (required for some Bugzilla instances). Environment variable BUGZILLA_USE_AUTH_HEADER=true can also be used]' \
'--read-only[Disables all tools which modify the state of a bug. Environment variable MCP_READ_ONLY=true can also be used. Can only tighten the guard policy, never loosen it]' \
'--insecure-no-auth[Serve the http transport without bearer authentication. Only for a trusted, isolated network\: every caller that reaches the port gets the full write scope. Command line only, with no environment variable, so no ambient value can turn authentication off. Tokens are never taken from the command line either (argv is world-readable)\: set BUGWARDEN_HTTP_TOKEN / BUGWARDEN_HTTP_READ_TOKEN in the environment]' \
'-h[Print help (see more with '\''--help'\'')]' \
'--help[Print help (see more with '\''--help'\'')]' \
'-V[Print version]' \
'--version[Print version]' \
&& ret=0
}

(( $+functions[_bugwarden_commands] )) ||
_bugwarden_commands() {
    local commands; commands=()
    _describe -t commands 'bugwarden commands' commands "$@"
}

if [ "$funcstack[1]" = "_bugwarden" ]; then
    _bugwarden "$@"
else
    compdef _bugwarden bugwarden
fi
