#compdef lw
# zsh completion for lw. Generated by make completion from lw's own tables: edit cmd/lw, not this file.

local -a described
case ${words[2]}:$CURRENT in
auth:2) ;;
auth:3)
	described=(
		'add-user:Add a user to a credentials file, or replace its password'
		'remove-user:Remove a user from a credentials file'
		'token:Log in to an http sink or http_chain source and print a bearer token'
		'stream:Log in to a tcp sink and copy its stream to stdout until interrupted'
	)
	_describe -t commands 'lw auth command' described
	return ;;
auth:*)
	shift 2 words
	(( CURRENT -= 2 ))
	case ${words[1]} in
	add-user) _arguments -S \
		'--credentials=[credentials file, created when missing]:value:_default' \
		'--generate[generate a new password, replacing any --password-file; needed to rotate without one]' \
		'--password-file=[read the password from file when it exists, else write a generated one there]:value:_default' \
		'(-u --user)'{-u=,--user=}'[user name]:value:_default' \
		'(-h --help)'{-h,--help}'[print the flags]' ;;
	remove-user) _arguments -S \
		'--credentials=[credentials file]:value:_default' \
		'(-u --user)'{-u=,--user=}'[user name]:value:_default' \
		'(-h --help)'{-h,--help}'[print the flags]' ;;
	token) _arguments -S \
		'--ca-file=[CA file that verifies the server (default: system roots)]:value:_default' \
		'--cert-file=[client certificate file, for listeners with tls.client_auth]:value:_default' \
		'--key-file=[client key file]:value:_default' \
		'--password-file=[file holding the password]:value:_default' \
		'--pin-sha256=[sha256//BASE64 pin of the server key, in place of --ca-file (a self_signed listener logs it)]:value:_default' \
		'--server-name=[name the server certificate must carry (default: the host)]:value:_default' \
		'--unbound[log in without channel binding, to an http sink behind a TLS-terminating proxy (auth.trusted_proxies)]' \
		'--url=[listener URL, https://HOST:PORT or https://[IPV6\]:PORT (with --unbound, a proxy'\''s mount URL may carry a path)]:value:_default' \
		'(-u --user)'{-u=,--user=}'[user name]:value:_default' \
		'(-h --help)'{-h,--help}'[print the flags]' ;;
	stream) _arguments -S \
		'--addr=[tcp sink address, HOST:PORT or [IPV6\]:PORT]:value:_default' \
		'--ca-file=[CA file that verifies the server (default: system roots)]:value:_default' \
		'--cert-file=[client certificate file, for listeners with tls.client_auth]:value:_default' \
		'--key-file=[client key file]:value:_default' \
		'--password-file=[file holding the password]:value:_default' \
		'--pin-sha256=[sha256//BASE64 pin of the server key, in place of --ca-file (a self_signed listener logs it)]:value:_default' \
		'--server-name=[name the server certificate must carry (default: the host)]:value:_default' \
		'(-u --user)'{-u=,--user=}'[user name]:value:_default' \
		'(-h --help)'{-h,--help}'[print the flags]' ;;
	esac
	return ;;
tls:2) ;;
tls:3)
	described=(
		'ca:Create a certificate authority, DIR/ca.crt and DIR/ca.key, that signs certificates only'
		'cert:Issue a certificate and key, OUT/NAME.crt and OUT/NAME.key, from DIR/ca.crt and DIR/ca.key'
	)
	_describe -t commands 'lw tls command' described
	return ;;
tls:*)
	shift 2 words
	(( CURRENT -= 2 ))
	case ${words[1]} in
	ca) _arguments -S \
		'--days=[validity in n days]:value:_default' \
		'--dir=[directory to write ca.crt and ca.key in, created when missing]:directory:_files -/' \
		'--name=[subject common name]:value:_default' \
		'(-h --help)'{-h,--help}'[print the flags]' ;;
	cert) _arguments -S \
		'--ca-dir=[directory holding ca.crt and ca.key (lw tls ca)]:directory:_files -/' \
		'--client[for dialers presenting a certificate (TLS client authentication)]' \
		'--days=[validity in n days, at most the CA'\''s]:value:_default' \
		'--hosts=[DNS names and IP addresses, '\'','\'' between them (default with --server: --name)]:value:_default' \
		'--name=[subject common name, the mtls identity, and the file names]:value:_default' \
		'--out=[directory to write in (default: --ca-dir)]:directory:_files -/' \
		'--server[for listeners (TLS server authentication)]' \
		'(-h --help)'{-h,--help}'[print the flags]' ;;
	esac
	return ;;
preset:2) ;;
preset:3)
	described=(
		'pipe:Standard input to standard output, line for line: lw without a file'
		'tail:Follow files to standard output, like tail -F'
		'serve:Serve files or standard input live: a browser viewer at /, SSE at /stream'
		'edge:Forward files or standard input to an aggregator over TLS, authenticated'
		'aggregator:Receive from edges over TLS, authenticated, to files or standard output'
	)
	_describe -t commands 'lw preset command' described
	return ;;
preset:*)
	shift 2 words
	(( CURRENT -= 2 ))
	case ${words[1]} in
	pipe) _arguments -S \
		'--format=[raw|txt|json]:value:_default' \
		'(-h --help)'{-h,--help}'[print the flags]' ;;
	tail) _arguments -S \
		'--format=[raw|txt|json]:value:_default' \
		'--from=[start|end: where reading a file starts]:value:_default' \
		'--path=[file, directory (its files) or glob to follow]:value:_default' \
		'(-h --help)'{-h,--help}'[print the flags]' ;;
	serve) _arguments -S \
		'--allow=[addresses or CIDRs that may connect, of listen'\''s family (either behind proxy=); default: all; '\'','\'' between them]:value:_default' \
		'--cert=[certificate file, for tls=files]:value:_default' \
		'--deny=[addresses or CIDRs refused, allow or not; '\'','\'' between them]:value:_default' \
		'--format=[raw|txt|json]:value:_default' \
		'--from=[start|end: where reading a file starts]:value:_default' \
		'--hosts=[names and addresses, beyond this host'\''s, of a self or issuer certificate; '\'','\'' between them]:value:_default' \
		'--issuer_cert=[CA certificate file (lw tls ca), for tls=issuer]:value:_default' \
		'--issuer_key=[CA key file, for tls=issuer]:value:_default' \
		'--key=[key file, for tls=files]:value:_default' \
		'--listen=[HOST:PORT; [IPV6\]:PORT]:value:_default' \
		'--path=[file, directory (its files) or glob to follow; default: standard input]:value:_default' \
		'--proxy=[addresses or CIDRs of the TLS-terminating proxies browsers come through; '\'','\'' between them]:value:_default' \
		'--tls=[off|self|issuer|files: a certificate made at startup (self-signed or from issuer_*), or files]:value:_default' \
		'--users=[credentials file (lw auth add-user): readers log in with SCRAM]:value:_default' \
		'--viewer=[true: the login page and viewer for users, behind proxy; without users the viewer is always on]:value:_default' \
		'(-h --help)'{-h,--help}'[print the flags]' ;;
	edge) _arguments -S \
		'--ca=[CA file that verifies the aggregator; default: system roots]:value:_default' \
		'--cert=[client certificate file, for an aggregator with client_ca]:value:_default' \
		'--from=[start|end: where reading a file starts]:value:_default' \
		'--key=[client key file]:value:_default' \
		'--node=[origin label; default: this host'\''s name]:value:_default' \
		'--password_file=[file holding the SCRAM password]:value:_default' \
		'--path=[file, directory (its files) or glob to follow; default: standard input]:value:_default' \
		'--pin=[sha256//BASE64 of the aggregator'\''s key, which it logs with tls=self]:value:_default' \
		'--server_name=[name the aggregator'\''s certificate carries; default: to'\''s host]:value:_default' \
		'--to=[the aggregator'\''s HOST:PORT; [IPV6\]:PORT]:value:_default' \
		'--transport=[tcp|http: tcp_chain or http_chain]:value:_default' \
		'(-u --user)'{-u=,--user=}'[SCRAM user (lw auth add-user on the aggregator)]:value:_default' \
		'(-h --help)'{-h,--help}'[print the flags]' ;;
	aggregator) _arguments -S \
		'--allow=[addresses or CIDRs that may connect, of listen'\''s family (either behind proxy=); default: all; '\'','\'' between them]:value:_default' \
		'--cert=[certificate file, for tls=files]:value:_default' \
		'--client_ca=[CA file that verifies edge certificates (mTLS)]:value:_default' \
		'--deny=[addresses or CIDRs refused, allow or not; '\'','\'' between them]:value:_default' \
		'--format=[raw|txt|json]:value:_default' \
		'--hosts=[names and addresses, beyond this host'\''s, of a self or issuer certificate; '\'','\'' between them]:value:_default' \
		'--issuer_cert=[CA certificate file (lw tls ca), for tls=issuer]:value:_default' \
		'--issuer_key=[CA key file, for tls=issuer]:value:_default' \
		'--key=[key file, for tls=files]:value:_default' \
		'--listen=[HOST:PORT; [IPV6\]:PORT; [::\] for IPv6 only]:value:_default' \
		'--out=[directory for the received entries; default: standard output]:value:_default' \
		'--tls=[self|issuer|files: a certificate made at startup (self-signed or from issuer_*), or files]:value:_default' \
		'--transport=[tcp|http: tcp_chain or http_chain]:value:_default' \
		'--users=[credentials file (lw auth add-user): edges log in with SCRAM]:value:_default' \
		'(-h --help)'{-h,--help}'[print the flags]' ;;
	esac
	return ;;
config:2) ;;
config:3)
	described=(
		'init:Write the annotated default configuration, to edit and run'
	)
	_describe -t commands 'lw config command' described
	return ;;
config:*)
	shift 2 words
	(( CURRENT -= 2 ))
	case ${words[1]} in
	init) _arguments -S \
		'--out=[file to write (default: ~/.config/logwisp/logwisp.toml)]:value:_default' \
		'(-h --help)'{-h,--help}'[print the flags]' ;;
	esac
	return ;;
esac
if (( CURRENT == 2 )) && [[ $PREFIX != -* ]]; then
	described=(
		'auth:SCRAM users, bearer tokens, tcp sink viewing'
		'tls:A CA and certificates for TLS and mTLS'
		'preset:Show the pipeline a preset makes, as TOML'
		'config:Place the annotated default configuration'
		'help:Print the help and exit'
	)
	_describe -t commands 'lw command' described
	return
fi
_arguments -S \
	'--auto_reload' \
	'(-t --check)'{-t,--check} \
	'--color' \
	'(-c --config)'{-c=,--config=}':value:_default' \
	'--dump' \
	'*--filter=:value:_default' \
	'*--format=:value:_default' \
	'*--heartbeat=:value:_default' \
	'(-h --help)'{-h,--help} \
	'--logging.console.target=:value:_default' \
	'--logging.file.directory=:directory:_files -/' \
	'--logging.file.max_size_mb=:value:_default' \
	'--logging.file.max_total_size_mb=:value:_default' \
	'--logging.file.name=:value:_default' \
	'--logging.file.retention_hours=:value:_default' \
	'--logging.format=:value:_default' \
	'--logging.level=:value:_default' \
	'--logging.output=:value:_default' \
	'--logging.sanitization=:value:_default' \
	'*--pipeline=:value:_default' \
	'*'{-p=,--preset=}':preset:(pipe tail serve edge aggregator)' \
	'(-q --quiet)'{-q,--quiet} \
	'*--rate-limit=:value:_default' \
	'*--sink=:value:_default' \
	'*--source=:value:_default' \
	'--status_reporter' \
	'(-V --version)'{-V,--version}