id          = "stoken"
name        = "stoken"
homepage    = "https://github.com/stoken-dev/stoken"
description = "RSA SecurID-compatible software token for Linux/UNIX systems."
executables      = ["stoken"]

[dotfiles]

# stoken's upstream README documents ~/.stokenrc as the file where a PIN may
# be cached; its man page also documents the token seed and password there.
# Treat the whole file as a credential because the seed can generate codes.
# https://github.com/stoken-dev/stoken#usage
paths  = []
secret = ["~/.stokenrc"]
side_effect = false

[commands]
format = 1
label = "Software token"
description = "Show an RSA SecurID-compatible tokencode or import a token into ~/.stokenrc. PIN and password prompts stay interactive; export, show and issue are left out."
quality = "ai-draft"
parser = { end_of_options = "--", interleave = "permute", long_equals = true, short_attached = true, short_bundles = false }

[[commands.subcommand]]
path = ["tokencode"]
label = "Show tokencode"
description = "Print the current or next tokencode of the imported token."

[[commands.subcommand.source]]
id = "manual"
kind = "manual"
url = "https://github.com/stoken-dev/stoken/blob/master/stoken.1"
revision = "2026-10-27"
evidence = """
stoken [tokencode] [--stdin] [--force]
[--next] [opts]
stoken tokencode --next
--next
Generate the next tokencode instead of the current tokencode.  For a 60-second
--stdin, -s
read the password or PIN as single line from standard input.
--force, -f
Override token expiration date checks (for tokencode) or token
"""

[[commands.subcommand.field]]
id = "next"
label = "Next tokencode"
description = "Generate the next tokencode instead of the current one."
type = "boolean"
option = ["--next"]
sources = ["manual"]

[[commands.subcommand.field]]
id = "stdin"
label = "Read password or PIN from stdin"
type = "boolean"
option = ["--stdin", "-s"]
sources = ["manual"]

[[commands.subcommand.field]]
id = "force"
label = "Ignore token expiration"
type = "boolean"
option = ["--force", "-f"]
effect = "overwrite"
sources = ["manual"]

[[commands.subcommand.task]]
id = "current"
label = "Current tokencode"
fields = []

[[commands.subcommand.task]]
id = "next"
label = "Next tokencode"
fields = ["next"]
required = ["next"]
set = { next = [true] }

[[commands.subcommand.group]]
id = "basic"
label = "Basic"
fields = ["next"]

[[commands.subcommand.group]]
id = "advanced"
label = "Advanced"
fields = ["stdin", "force"]

[[commands.subcommand]]
path = ["import"]
label = "Import token"
description = "Decode a token string or sdtid file and write it to ~/.stokenrc. Token strings are secrets; prefer a file."

[[commands.subcommand.source]]
id = "manual"
kind = "manual"
url = "https://github.com/stoken-dev/stoken/blob/master/stoken.1"
revision = "2026-10-27"
evidence = """
stoken import
{--file=file | --token=token_string}
[--force] [opts]
stoken import --file mytoken.sdtid
By default, stoken import will refuse to overwrite an existing token in
~/.stokenrc.  The --force switch overrides this check.
"""

[[commands.subcommand.field]]
id = "file"
label = "Token file (sdtid)"
type = "path"
option = ["--file"]
path = { kind = "file", role = "input", must_exist = true }
sources = ["manual"]

[[commands.subcommand.field]]
id = "token"
label = "Token string"
description = "Appears in shell history; prefer a file."
type = "string"
option = ["--token"]
sources = ["manual"]

[[commands.subcommand.field]]
id = "force"
label = "Overwrite existing token"
type = "boolean"
option = ["--force"]
effect = "overwrite"
sources = ["manual"]

[[commands.subcommand.task]]
id = "from-file"
label = "Import from file"
fields = ["file", "force"]
required = ["file"]

[[commands.subcommand.group]]
id = "basic"
label = "Basic"
fields = ["file", "token", "force"]