id       = "sops"
name     = "SOPS"
homepage = "https://github.com/getsops/sops"
description = "Simple and flexible tool for managing secrets."
executables   = ["sops"]

[dotfiles]

# https://github.com/getsops/sops (README, "age key file") and
# age/keysource.go document sops/age/keys.txt below the user config directory.
# Linux uses XDG_CONFIG_HOME with ~/.config fallback; macOS uses that variable
# when set and otherwise ~/Library/Application Support; Windows uses %APPDATA%.
# The three spellings preserve both macOS fallback and Windows explicitly.
paths = []
secret = [
  "[configHome]/sops/age/keys.txt",
  "[appData]/sops/age/keys.txt",
  "%APPDATA%/sops/age/keys.txt",
]
side_effect = false

[commands]
format = 1
label = "SOPS"
description = "Encrypt or decrypt a file with sops. Editing, key rotation, key groups, publish and key-service options are left out."
quality = "ai-draft"
parser = { end_of_options = "--", interleave = "permute", long_equals = true, short_attached = true, short_bundles = false }

[[commands.subcommand]]
path = ["decrypt"]
label = "Decrypt a file"
description = "Decrypt a file and print it to stdout, or write it elsewhere."

[[commands.subcommand.source]]
id = "help"
kind = "help"
url = "https://github.com/getsops/sops/blob/main/cmd/sops/main.go"
evidence = """decrypt [file]: decrypt a file, and output the results to stdout. If no filename is provided, stdin will be used.
--in-place, -i  write output back to the same file instead of stdout
--extract  extract a specific key or branch from the input document.
--output  Save the output after decryption to the file specified
--input-type  currently json, yaml, dotenv, ini and binary are supported.
--output-type  currently json, yaml, dotenv, ini and binary are supported."""

[[commands.subcommand.field]]
id = "file"
label = "Encrypted file"
type = "path"
position = 0
path = { kind = "file", role = "input" }
sources = ["help"]

[[commands.subcommand.field]]
id = "in_place"
label = "Decrypt in place"
type = "boolean"
option = ["--in-place", "-i"]
effect = "overwrite"
sources = ["help"]

[[commands.subcommand.field]]
id = "output"
label = "Output file"
type = "path"
option = ["--output"]
path = { kind = "file", role = "output" }
effect = "overwrite"
sources = ["help"]

[[commands.subcommand.field]]
id = "extract"
label = "Extract key"
type = "string"
option = ["--extract"]
sources = ["help"]

[[commands.subcommand.field]]
id = "input_type"
label = "Input type"
type = "enum"
option = ["--input-type"]
choices = [{ value = "json", label = "JSON" }, { value = "yaml", label = "YAML" }, { value = "dotenv", label = "dotenv" }, { value = "ini", label = "INI" }, { value = "binary", label = "Binary" }]
sources = ["help"]

[[commands.subcommand.field]]
id = "output_type"
label = "Output type"
type = "enum"
option = ["--output-type"]
choices = [{ value = "json", label = "JSON" }, { value = "yaml", label = "YAML" }, { value = "dotenv", label = "dotenv" }, { value = "ini", label = "INI" }, { value = "binary", label = "Binary" }]
sources = ["help"]

[[commands.subcommand.task]]
id = "show"
label = "Print decrypted"
fields = ["file", "extract", "output_type"]
required = ["file"]

[[commands.subcommand.task]]
id = "to-file"
label = "Decrypt to a file"
fields = ["file", "output", "output_type"]
required = ["file", "output"]

[[commands.subcommand.group]]
id = "basic"
label = "Basic"
fields = ["file", "output", "in_place", "extract"]

[[commands.subcommand.group]]
id = "advanced"
label = "Advanced"
fields = ["input_type", "output_type"]

[[commands.subcommand]]
path = ["encrypt"]
label = "Encrypt a file"
description = "Encrypt a file for age, PGP or cloud KMS recipients and print it to stdout, or write it elsewhere."

[[commands.subcommand.source]]
id = "help"
kind = "help"
url = "https://github.com/getsops/sops/blob/main/cmd/sops/main.go"
evidence = """encrypt [file]: encrypt a file, and output the results to stdout. If no filename is provided, stdin will be used.
--in-place, -i  write output back to the same file instead of stdout
--output  Save the output after encryption to the file specified
--age, -a  comma separated list of age recipients
--pgp, -p  comma separated list of PGP fingerprints
--kms, -k  comma separated list of KMS ARNs
--encrypted-regex  set the encrypted key regex. When specified, only keys matching the regex will be encrypted.
--unencrypted-regex  set the unencrypted key regex. When specified, only keys matching the regex will be left unencrypted.
--input-type  currently json, yaml, dotenv, ini and binary are supported.
--output-type  currently json, yaml, dotenv, ini and binary are supported."""

[[commands.subcommand.field]]
id = "file"
label = "Plaintext file"
type = "path"
position = 0
path = { kind = "file", role = "input" }
sources = ["help"]

[[commands.subcommand.field]]
id = "in_place"
label = "Encrypt in place"
type = "boolean"
option = ["--in-place", "-i"]
effect = "overwrite"
sources = ["help"]

[[commands.subcommand.field]]
id = "output"
label = "Output file"
type = "path"
option = ["--output"]
path = { kind = "file", role = "output" }
effect = "overwrite"
sources = ["help"]

[[commands.subcommand.field]]
id = "age"
label = "age recipients"
description = "Comma separated list of age recipients."
type = "string"
option = ["--age", "-a"]
sources = ["help"]

[[commands.subcommand.field]]
id = "pgp"
label = "PGP fingerprints"
description = "Comma separated list of PGP fingerprints."
type = "string"
option = ["--pgp", "-p"]
sources = ["help"]

[[commands.subcommand.field]]
id = "kms"
label = "KMS ARNs"
description = "Comma separated list of KMS ARNs."
type = "string"
option = ["--kms", "-k"]
sources = ["help"]

[[commands.subcommand.field]]
id = "encrypted_regex"
label = "Encrypted key regex"
type = "string"
option = ["--encrypted-regex"]
sources = ["help"]

[[commands.subcommand.field]]
id = "unencrypted_regex"
label = "Unencrypted key regex"
type = "string"
option = ["--unencrypted-regex"]
sources = ["help"]

[[commands.subcommand.field]]
id = "input_type"
label = "Input type"
type = "enum"
option = ["--input-type"]
choices = [{ value = "json", label = "JSON" }, { value = "yaml", label = "YAML" }, { value = "dotenv", label = "dotenv" }, { value = "ini", label = "INI" }, { value = "binary", label = "Binary" }]
sources = ["help"]

[[commands.subcommand.field]]
id = "output_type"
label = "Output type"
type = "enum"
option = ["--output-type"]
choices = [{ value = "json", label = "JSON" }, { value = "yaml", label = "YAML" }, { value = "dotenv", label = "dotenv" }, { value = "ini", label = "INI" }, { value = "binary", label = "Binary" }]
sources = ["help"]

[[commands.subcommand.task]]
id = "age"
label = "Encrypt for age"
fields = ["file", "age", "output", "encrypted_regex"]
required = ["file", "age"]

[[commands.subcommand.task]]
id = "in-place"
label = "Encrypt in place"
set = { in_place = [true] }
lock = ["in_place"]
fields = ["file", "in_place", "age", "pgp", "kms"]
required = ["file"]

[[commands.subcommand.group]]
id = "basic"
label = "Basic"
fields = ["file", "age", "pgp", "kms", "output", "in_place"]

[[commands.subcommand.group]]
id = "advanced"
label = "Advanced"
fields = ["encrypted_regex", "unencrypted_regex", "input_type", "output_type"]