id       = "bws"
name     = "Bitwarden Secrets Manager CLI"
homepage = "https://bitwarden.com/help/secrets-manager-cli/"
description = "A Rust CLI for interacting with the Bitwarden Secrets Manager."
icon     = "SimpleIcons:bitwarden"
executables   = ["bws"]

[dotfiles]

# crates/bws/src/cli.rs: DEFAULT_CONFIG_DIRECTORY = ".config/bws",
# DEFAULT_CONFIG_FILENAME = "config", and crates/bws/src/config.rs joins them
# onto the home directory (overridable with --config-file / $BWS_CONFIG_FILE).
# The same file is parsed and written with `toml`, so it is TOML with a
# [profiles.<name>] table per profile.
paths = ["~/.config/bws/config"]

# crates/bws/src/state.rs: the state directory defaults to ~/.config/bws/state
# and holds one file per access token with "authentication tokens and additional
# relevant data" (Bitwarden's Secrets Manager CLI help). Machine-bound session
# state, never something to copy to another machine.
exclude = ["~/.config/bws/state/"]

# The access token comes from $BWS_ACCESS_TOKEN or --access-token, never from
# this file; the config file holds server URLs and profile settings only.
secret = []

# Read at the start of each command.
side_effect = false

# state_dir is an absolute path to a directory on this machine (the CLI docs
# require an absolute path), so it must not follow the profile elsewhere. The
# user typed it into the profile, so it is part of how this machine is set up
# and is kept for a rebuild: backup.
[[dotfiles.machine_lines]]
file   = "~/.config/bws/config"
format = "toml"
match  = { key_path = ["profiles.*.state_dir"] }
scope  = "backup"

[commands]
format = 1
label = "Bitwarden Secrets Manager"
description = "Read secrets and projects. Creating, editing and deleting secrets, config and access tokens are left out; pass the token through BWS_ACCESS_TOKEN rather than a flag."
quality = "ai-draft"
base = "fig:bws"
parser = { end_of_options = "--", interleave = "permute", long_equals = true, short_attached = true, short_bundles = false }

[[commands.source]]
id = "fig"
kind = "completion"
url = "https://github.com/withfig/autocomplete/blob/master/src/bws.ts"
license = "MIT"

[[commands.subcommand]]
path = ["secret", "list"]
label = "List secrets"
description = "List the secrets this service account can access, optionally for one project."

[[commands.subcommand.source]]
id = "fig"
kind = "completion"
url = "https://github.com/withfig/autocomplete/blob/master/src/bws.ts"
license = "MIT"

[[commands.subcommand.field]]
id = "project"
label = "Project ID"
description = "Limit to this project identifier."
type = "string"
position = 0
sources = ["fig"]

[[commands.subcommand.field]]
id = "output"
label = "Output format"
description = "Output format (default json)."
type = "string"
option = ["--output", "-o"]
suggestions = [{ value = "json", label = "json" }, { value = "yaml", label = "yaml" }, { value = "env", label = "env" }, { value = "table", label = "table" }, { value = "tsv", label = "tsv" }, { value = "none", label = "none" }]
sources = ["fig"]

[[commands.subcommand.task]]
id = "all"
label = "All secrets as a table"
set = { output = ["table"] }
fields = ["output"]
required = []

[[commands.subcommand.group]]
id = "basic"
label = "Basic"
fields = ["project", "output"]

[[commands.subcommand]]
path = ["secret", "get"]
label = "Get a secret"
description = "Retrieve one secret by its ID."

[[commands.subcommand.source]]
id = "fig"
kind = "completion"
url = "https://github.com/withfig/autocomplete/blob/master/src/bws.ts"
license = "MIT"

[[commands.subcommand.field]]
id = "secret_id"
label = "Secret ID"
description = "ID of the secret to retrieve."
type = "string"
position = 0
min = 1
sources = ["fig"]

[[commands.subcommand.field]]
id = "output"
label = "Output format"
description = "Output format (default json)."
type = "string"
option = ["--output", "-o"]
suggestions = [{ value = "json", label = "json" }, { value = "yaml", label = "yaml" }, { value = "env", label = "env" }, { value = "table", label = "table" }, { value = "tsv", label = "tsv" }, { value = "none", label = "none" }]
sources = ["fig"]

[[commands.subcommand.task]]
id = "get"
label = "Get as env line"
set = { output = ["env"] }
fields = ["secret_id", "output"]
required = ["secret_id"]

[[commands.subcommand.group]]
id = "basic"
label = "Basic"
fields = ["secret_id", "output"]

[[commands.subcommand]]
path = ["project", "list"]
label = "List projects"
description = "List the projects this service account can access."

[[commands.subcommand.source]]
id = "fig"
kind = "completion"
url = "https://github.com/withfig/autocomplete/blob/master/src/bws.ts"
license = "MIT"

[[commands.subcommand.field]]
id = "output"
label = "Output format"
description = "Output format (default json)."
type = "string"
option = ["--output", "-o"]
suggestions = [{ value = "json", label = "json" }, { value = "yaml", label = "yaml" }, { value = "env", label = "env" }, { value = "table", label = "table" }, { value = "tsv", label = "tsv" }, { value = "none", label = "none" }]
sources = ["fig"]

[[commands.subcommand.task]]
id = "table"
label = "As a table"
set = { output = ["table"] }
fields = ["output"]
required = []

[[commands.subcommand.group]]
id = "basic"
label = "Basic"
fields = ["output"]