//! A shadow of `fnox.usage.kdl` in usage's vocabulary, generated by
//! `cargo run -p xtask -- gen-shadow`.
//!
//! Do not edit: regenerate it. It exists to be compiled and parsed against, so
//! that the parser can be measured at a real CLI's scale rather than a toy one.
#![allow(dead_code, unused_imports)]

use usage_derive::{Args, Cli, Subcommands, ValueEnum};

/// Output shell activation code to enable automatic secret loading
#[derive(Args)]
pub struct ActivateArgs {
    /// Don't automatically invoke hook-env (for testing)
    #[usage(long = "no-hook-env")]
    pub no_hook_env: bool,
    /// Shell to generate activation code for (bash, zsh, fish, nu, pwsh)
    #[usage(arg, name = "SHELL")]
    pub shell: ::std::option::Option<::std::string::String>,
}

/// Check if all required secrets are defined and configured
#[derive(Args)]
pub struct CheckArgs {
    /// Check all secrets including those with if_missing=warn or if_missing=ignore
    #[usage(long = "all", short = 'a')]
    pub all: bool,
}

/// Redact secrets in CI/CD output (GitHub Actions mask)
#[derive(Args)]
pub struct CiRedactArgs {}

/// Generate shell completions
#[derive(Args)]
pub struct CompletionArgs {
    /// Shell type to generate completions for
    #[usage(arg, name = "SHELL")]
    pub shell: ::std::string::String,
}

/// List all config files that would be loaded
#[derive(Args)]
pub struct ConfigFilesArgs {}

/// Clear all running daemon caches
#[derive(Args)]
pub struct DaemonClearArgs {}

/// Run the daemon server in the foreground
#[derive(Args)]
pub struct DaemonServeArgs {}

/// Start the per-user daemon in the background
#[derive(Args)]
pub struct DaemonStartArgs {}

/// Show daemon status
#[derive(Args)]
pub struct DaemonStatusArgs {}

/// Stop the daemon
#[derive(Args)]
pub struct DaemonStopArgs {}

/// Manage the per-user daemon
#[derive(Args)]
pub struct DaemonArgs {
    #[usage(subcommand)]
    pub command: DaemonCommands,
}

#[derive(Subcommands)]
pub enum DaemonCommands {
    /// Clear all running daemon caches
    #[usage(name = "clear")]
    Clear(Box<DaemonClearArgs>),
    /// Run the daemon server in the foreground
    #[usage(name = "serve", hide)]
    Serve(Box<DaemonServeArgs>),
    /// Start the per-user daemon in the background
    #[usage(name = "start")]
    Start(Box<DaemonStartArgs>),
    /// Show daemon status
    #[usage(name = "status")]
    Status(Box<DaemonStatusArgs>),
    /// Stop the daemon
    #[usage(name = "stop")]
    Stop(Box<DaemonStopArgs>),
}

/// Disable fnox shell integration in the current shell session
///
/// This removes the hook that automatically loads secrets when entering directories with fnox.toml files. It also restores environment variables to their state before fnox was activated.
///
/// Note: This only affects the current shell session. To re-enable fnox, run the activation command again for your shell.
#[derive(Args)]
pub struct DeactivateArgs {}

/// Show diagnostic information about the current fnox state
#[derive(Args)]
pub struct DoctorArgs {}

/// Edit the configuration file
#[derive(Args)]
pub struct EditArgs {}

/// Execute a command with secrets as environment variables
#[derive(Args)]
pub struct ExecArgs {
    #[usage(
        help = "Run the command in fnox's process, keeping the same PID and receiving signals directly; supports environment-only secrets without leases and does not inherit ambient FNOX_AGE_KEY or FNOX_AGE_KEY_FILE values. Available on Linux, macOS, and other Unix-like systems",
        long_help = "Run the command in fnox's process, keeping the same PID and receiving signals\ndirectly; supports environment-only secrets without leases and does not inherit\nambient FNOX_AGE_KEY or FNOX_AGE_KEY_FILE values. Available on Linux,\nmacOS, and other Unix-like systems",
        long = "replace"
    )]
    pub replace: bool,
    /// Command to run
    #[usage(arg, name = "COMMAND", double_dash = "automatic")]
    pub command: ::std::vec::Vec<::std::string::String>,
}

/// Export secrets in various formats
#[derive(Args)]
pub struct ExportArgs {
    /// Export format
    #[usage(
        long = "format",
        short = 'f',
        value_name = "FORMAT",
        value_enum,
        default = "env"
    )]
    pub format: ::std::option::Option<ExportFormatValue>,
    /// Show what would be exported without writing to file
    #[usage(long = "dry-run", short = 'n')]
    pub dry_run: bool,
    /// Output file (default: stdout)
    #[usage(long = "output", short = 'o', value_name = "OUTPUT")]
    pub output: ::std::option::Option<::std::string::String>,
    /// Include secrets with env = false or env = "exec" (excluded by default)
    #[usage(long = "all")]
    pub all: bool,
    /// Include metadata comments in env and shell output
    #[usage(long = "header")]
    pub header: bool,
}

#[derive(ValueEnum)]
pub enum ExportFormatValue {
    /// Environment variable format (KEY=value)
    #[usage(name = "env")]
    Env,
    /// POSIX shell format (export KEY=value)
    #[usage(name = "shell")]
    Shell,
    /// JSON format
    #[usage(name = "json")]
    Json,
    /// YAML format
    #[usage(name = "yaml")]
    Yaml,
    /// TOML format
    #[usage(name = "toml")]
    Toml,
}

/// Get a secret value
#[derive(Args)]
pub struct GetArgs {
    /// Base64 decode the secret
    #[usage(long = "base64-decode")]
    pub base64_decode: bool,
    /// Secret key to retrieve
    #[usage(arg, name = "KEY")]
    pub key: ::std::string::String,
}

/// Internal command used by shell hooks to load secrets
#[derive(Args)]
pub struct HookEnvArgs {
    /// Shell type (bash, zsh, fish, nu, pwsh)
    #[usage(long = "shell", short = 's', value_name = "SHELL")]
    pub shell: ::std::option::Option<::std::string::String>,
}

/// Import secrets from various sources
#[derive(Args)]
pub struct ImportArgs {
    /// Skip confirmation prompts
    #[usage(long = "force", short = 'f')]
    pub force: bool,
    /// Import to the global config file (~/.config/fnox/config.toml)
    #[usage(long = "global", short = 'g')]
    pub global: bool,
    /// Source file or path to import from (default: stdin)
    #[usage(long = "input", short = 'i', value_name = "INPUT")]
    pub input: ::std::option::Option<::std::string::String>,
    /// Show what would be imported without making changes
    #[usage(long = "dry-run", short = 'n')]
    pub dry_run: bool,
    /// Provider to use for encrypting/storing imported secrets (required)
    #[usage(long = "provider", short = 'p', value_name = "PROVIDER")]
    pub provider: ::std::string::String,
    /// Only import matching secrets (regex pattern)
    #[usage(long = "filter", value_name = "FILTER")]
    pub filter: ::std::option::Option<::std::string::String>,
    /// Prefix to add to imported secret names
    #[usage(long = "prefix", value_name = "PREFIX")]
    pub prefix: ::std::option::Option<::std::string::String>,
    /// Import source format
    #[usage(arg, name = "FORMAT", value_enum, default = "env")]
    pub format: ::std::option::Option<ImportFormatValue>,
}

#[derive(ValueEnum)]
pub enum ImportFormatValue {
    /// Environment variable format (KEY=value)
    #[usage(name = "env")]
    Env,
    /// JSON format
    #[usage(name = "json")]
    Json,
    /// YAML format
    #[usage(name = "yaml")]
    Yaml,
    /// TOML format
    #[usage(name = "toml")]
    Toml,
}

/// Initialize a new fnox configuration file
#[derive(Args)]
pub struct InitArgs {
    /// Overwrite existing configuration file
    #[usage(long = "force", short = 'f')]
    pub force: bool,
    /// Initialize the global config file (~/.config/fnox/config.toml)
    #[usage(long = "global", short = 'g')]
    pub global: bool,
    /// Skip the interactive wizard and create a minimal config
    #[usage(long = "skip-wizard")]
    pub skip_wizard: bool,
}

/// Revoke all expired leases that need manual cleanup
#[derive(Args)]
pub struct LeaseCleanupArgs {}

/// Create a short-lived credential lease from a secret
#[derive(Args)]
pub struct LeaseCreateArgs {
    /// Create leases for all configured backends
    #[usage(long = "all", short = 'a')]
    pub all: bool,
    /// Lease duration (e.g., "15m", "1h", "2h30m"); overrides config duration
    #[usage(long = "duration", short = 'd', value_name = "DURATION")]
    pub duration: ::std::option::Option<::std::string::String>,
    /// Output format
    #[usage(
        long = "format",
        short = 'f',
        value_name = "FORMAT",
        value_enum,
        default = "shell"
    )]
    pub format: ::std::option::Option<LeaseCreateFormatValue>,
    /// Prompt interactively for missing credentials
    #[usage(long = "interactive", short = 'i')]
    pub interactive: bool,
    /// Label for the lease (e.g., session purpose)
    #[usage(
        long = "label",
        short = 'l',
        value_name = "LABEL",
        default = "fnox-lease"
    )]
    pub label: ::std::option::Option<::std::string::String>,
    /// Lease backend name (from `[leases.<name>]` config). Creates all backends if omitted.
    #[usage(arg, name = "BACKEND_NAME")]
    pub backend_name: ::std::option::Option<::std::string::String>,
}

#[derive(ValueEnum)]
pub enum LeaseCreateFormatValue {
    #[usage(name = "shell")]
    Shell,
    #[usage(name = "json")]
    Json,
    #[usage(name = "env")]
    Env,
}

/// List tracked leases
#[derive(Args)]
pub struct LeaseListArgs {
    /// Show only active (non-expired, non-revoked) leases
    #[usage(long = "active")]
    pub active: bool,
    /// Show only expired leases
    #[usage(long = "expired")]
    pub expired: bool,
}

/// Revoke a lease by ID
#[derive(Args)]
pub struct LeaseRevokeArgs {
    /// Lease ID to revoke
    #[usage(arg, name = "LEASE_ID")]
    pub lease_id: ::std::string::String,
}

/// Manage ephemeral credential leases
#[derive(Args)]
pub struct LeaseArgs {
    #[usage(subcommand)]
    pub command: ::std::option::Option<LeaseCommands>,
}

#[derive(Subcommands)]
pub enum LeaseCommands {
    /// Revoke all expired leases that need manual cleanup
    #[usage(name = "cleanup")]
    Cleanup(Box<LeaseCleanupArgs>),
    /// Create a short-lived credential lease from a secret
    #[usage(name = "create")]
    Create(Box<LeaseCreateArgs>),
    /// List tracked leases
    #[usage(name = "list")]
    List(Box<LeaseListArgs>),
    /// Revoke a lease by ID
    #[usage(name = "revoke")]
    Revoke(Box<LeaseRevokeArgs>),
}

/// List all secrets
#[derive(Args)]
pub struct ListArgs {
    /// Show full provider keys without truncation
    #[usage(long = "full", short = 'f')]
    pub full: bool,
    /// Show source file paths where secrets are defined
    #[usage(long = "sources", short = 's')]
    pub sources: bool,
    /// Show secret values (if available)
    #[usage(long = "values", short = 'V')]
    pub values: bool,
    /// Output secret keys for shell completion (one per line)
    #[usage(long = "complete", hide)]
    pub complete: bool,
}

/// Start an MCP server for secret-gated AI agent access
#[derive(Args)]
pub struct McpArgs {}

/// List available profiles
#[derive(Args)]
pub struct ProfilesArgs {
    /// Output profile names for shell completion (one per line)
    #[usage(long = "complete", hide)]
    pub complete: bool,
}

/// Add a new provider
#[derive(Args)]
pub struct ProviderAddArgs {
    /// Add to the global config file (~/.config/fnox/config.toml)
    #[usage(long = "global", short = 'g')]
    pub global: bool,
    /// Default Proton Pass vault name (only valid with provider type proton-pass)
    #[usage(long = "vault", value_name = "VAULT")]
    pub vault: ::std::option::Option<::std::string::String>,
    /// Provider name
    #[usage(arg, name = "PROVIDER")]
    pub provider: ::std::string::String,
    /// Provider type
    #[usage(arg, name = "PROVIDER_TYPE", value_enum)]
    pub provider_type: ProviderAddProviderTypeValue,
}

#[derive(ValueEnum)]
pub enum ProviderAddProviderTypeValue {
    /// 1Password
    #[usage(name = "1password")]
    Value1,
    /// Age encryption
    #[usage(name = "age")]
    Age,
    /// AWS Secrets Manager
    #[usage(name = "aws")]
    Aws,
    /// AWS KMS
    #[usage(name = "aws-kms")]
    AwsKms,
    /// AWS Parameter Store
    #[usage(name = "aws-ps")]
    AwsPs,
    /// Azure App Configuration
    #[usage(name = "azure-ac")]
    AzureAc,
    /// Azure Key Vault KMS
    #[usage(name = "azure-kms")]
    AzureKms,
    /// Azure Key Vault Secrets Manager
    #[usage(name = "azure-sm")]
    AzureSm,
    /// Google Cloud Secret Manager
    #[usage(name = "gcp")]
    Gcp,
    /// Google Cloud KMS
    #[usage(name = "gcp-kms")]
    GcpKms,
    /// FIDO2 hmac-secret hardware-backed encryption
    #[usage(name = "fido2")]
    Fido2,
    /// Bitwarden Password Manager
    #[usage(name = "bitwarden")]
    Bitwarden,
    /// Doppler secrets manager
    #[usage(name = "doppler")]
    Doppler,
    /// FOKS (Federated Open Key Service)
    #[usage(name = "foks")]
    Foks,
    /// Bitwarden Secrets Manager
    #[usage(name = "bitwarden-sm")]
    BitwardenSm,
    /// Infisical
    #[usage(name = "infisical")]
    Infisical,
    /// KeePass
    #[usage(name = "keepass")]
    Keepass,
    /// Keeper Secrets Manager
    #[usage(name = "keeper-sm")]
    KeeperSm,
    /// OS Keychain
    #[usage(name = "keychain")]
    Keychain,
    /// password-store (pass)
    #[usage(name = "password-store")]
    PasswordStore,
    /// Click Studios Passwordstate
    #[usage(name = "passwordstate")]
    Passwordstate,
    /// Plain text provider
    #[usage(name = "plain")]
    Plain,
    /// Proton Pass
    #[usage(name = "proton-pass")]
    ProtonPass,
    /// HashiCorp Vault
    #[usage(name = "vault")]
    Vault,
    /// YubiKey HMAC-SHA1 hardware-backed encryption
    #[usage(name = "yubikey")]
    Yubikey,
}

/// List available providers
#[derive(Args)]
pub struct ProviderListArgs {
    /// Output provider names for shell completion (one per line)
    #[usage(long = "complete", hide)]
    pub complete: bool,
}

/// Remove a provider
#[derive(Args)]
pub struct ProviderRemoveArgs {
    /// Remove from the global config file (~/.config/fnox/config.toml)
    #[usage(long = "global", short = 'g')]
    pub global: bool,
    /// Provider name
    #[usage(arg, name = "PROVIDER")]
    pub provider: ::std::string::String,
}

/// Test a provider connection
#[derive(Args)]
pub struct ProviderTestArgs {
    /// Test all configured providers
    #[usage(long = "all", short = 'a')]
    pub all: bool,
    /// Provider name (optional when using --all)
    #[usage(arg, name = "PROVIDER")]
    pub provider: ::std::option::Option<::std::string::String>,
}

/// Manage providers (defaults to list)
#[derive(Args)]
pub struct ProviderArgs {
    #[usage(subcommand)]
    pub command: ::std::option::Option<ProviderCommands>,
}

#[derive(Subcommands)]
pub enum ProviderCommands {
    /// Add a new provider
    #[usage(name = "add", alias("a", "set"))]
    Add(Box<ProviderAddArgs>),
    /// List available providers
    #[usage(name = "list", alias = "ls")]
    List(Box<ProviderListArgs>),
    /// Remove a provider
    #[usage(name = "remove", alias("rm", "delete"))]
    Remove(Box<ProviderRemoveArgs>),
    /// Test a provider connection
    #[usage(name = "test", alias = "t")]
    Test(Box<ProviderTestArgs>),
}

/// Show the effective credential proxy rules
#[derive(Args)]
pub struct ProxyRulesArgs {}

/// Run a command with placeholder credentials through the local proxy
#[derive(Args)]
pub struct ProxyRunArgs {
    /// Command to run
    #[usage(arg, name = "COMMAND", double_dash = "automatic")]
    pub command: ::std::vec::Vec<::std::string::String>,
}

/// Broker credentials into destination-scoped HTTPS requests
#[derive(Args)]
pub struct ProxyArgs {
    #[usage(subcommand)]
    pub command: ProxyCommands,
}

#[derive(Subcommands)]
pub enum ProxyCommands {
    /// Show the effective credential proxy rules
    #[usage(name = "rules")]
    Rules(Box<ProxyRulesArgs>),
    /// Run a command with placeholder credentials through the local proxy
    #[usage(name = "run")]
    Run(Box<ProxyRunArgs>),
}

/// Re-encrypt secrets with current provider configuration
///
/// When you add or remove recipients from an encryption provider (e.g. age), existing secrets remain encrypted with the old recipient set. This command decrypts and re-encrypts all matching secrets with the current provider configuration.
#[derive(Args)]
pub struct ReencryptArgs {
    /// Skip confirmation prompt
    #[usage(long = "force", short = 'f')]
    pub force: bool,
    /// Show what would be done without making changes
    #[usage(long = "dry-run", short = 'n')]
    pub dry_run: bool,
    /// Only re-encrypt secrets from this provider
    #[usage(long = "provider", short = 'p', value_name = "PROVIDER")]
    pub provider: ::std::option::Option<::std::string::String>,
    /// Only re-encrypt matching secrets (regex pattern)
    #[usage(long = "filter", value_name = "FILTER")]
    pub filter: ::std::option::Option<::std::string::String>,
    /// Only re-encrypt these specific secret keys
    #[usage(arg, name = "KEYS")]
    pub keys: ::std::vec::Vec<::std::string::String>,
}

/// Remove a secret
#[derive(Args)]
pub struct RemoveArgs {
    /// Remove from the global config file (~/.config/fnox/config.toml)
    #[usage(long = "global", short = 'g')]
    pub global: bool,
    /// Show what would be removed without making changes
    #[usage(long = "dry-run", short = 'n')]
    pub dry_run: bool,
    /// Secret key to remove
    #[usage(arg, name = "KEY")]
    pub key: ::std::string::String,
}

/// Scan repository for potential secrets
#[derive(Args)]
pub struct ScanArgs {
    /// Skip files matching this glob pattern (can be used multiple times)
    #[usage(long = "ignore", short = 'i', value_name = "IGNORE", var)]
    pub ignore: ::std::vec::Vec<::std::string::String>,
    /// Output format
    #[usage(long = "format", value_name = "FORMAT", value_enum, default = "human")]
    pub format: ::std::option::Option<ScanFormatValue>,
    /// Show only files with potential secrets
    #[usage(long = "quiet", short = 'q')]
    pub quiet: bool,
    /// Directory to scan (default: current directory)
    #[usage(arg, name = "DIR", default = ".")]
    pub dir: ::std::option::Option<::std::string::String>,
}

#[derive(ValueEnum)]
pub enum ScanFormatValue {
    #[usage(name = "human")]
    Human,
    #[usage(name = "json")]
    Json,
}

/// Generate JSON Schema for fnox configuration
#[derive(Args)]
pub struct SchemaArgs {}

/// Set a secret value
#[derive(Args)]
pub struct SetArgs {
    /// Description of the secret
    #[usage(long = "description", short = 'd', value_name = "DESCRIPTION")]
    pub description: ::std::option::Option<::std::string::String>,
    /// Save to the global config file (~/.config/fnox/config.toml)
    #[usage(long = "global", short = 'g')]
    pub global: bool,
    /// Key name in the provider (if different from env var name)
    #[usage(long = "key-name", short = 'k', value_name = "KEY_NAME")]
    pub key_name: ::std::option::Option<::std::string::String>,
    /// Show what would be done without making changes
    #[usage(long = "dry-run", short = 'n')]
    pub dry_run: bool,
    /// Provider to fetch from
    #[usage(long = "provider", short = 'p', value_name = "PROVIDER")]
    pub provider: ::std::option::Option<::std::string::String>,
    /// Base64 encode the secret
    #[usage(long = "base64-encode")]
    pub base64_encode: bool,
    /// Default value to use if secret is not found
    #[usage(long = "default", value_name = "DEFAULT")]
    pub default: ::std::option::Option<::std::string::String>,
    /// Read the secret value verbatim from a UTF-8 file
    #[usage(long = "from-file", conflicts = "VALUE", value_name = "FROM_FILE")]
    pub from_file: ::std::option::Option<::std::string::String>,
    /// What to do if the secret is missing (error, warn, ignore)
    #[usage(long = "if-missing", value_name = "IF_MISSING", value_enum)]
    pub if_missing: ::std::option::Option<SetIfMissingValue>,
    /// Secret key (environment variable name)
    #[usage(arg, name = "KEY")]
    pub key: ::std::string::String,
    /// Secret value to store.
    ///
    /// If omitted: reads from stdin when piped (`echo "x" | fnox set KEY`), or prompts interactively with hidden input.
    ///
    /// Passing secrets as arguments exposes them in shell history and `ps` output. For sensitive values, prefer stdin or the interactive prompt.
    #[usage(arg, name = "VALUE")]
    pub value: ::std::option::Option<::std::string::String>,
}

#[derive(ValueEnum)]
pub enum SetIfMissingValue {
    #[usage(name = "error")]
    Error,
    #[usage(name = "warn")]
    Warn,
    #[usage(name = "ignore")]
    Ignore,
}

/// Show the companies sponsoring fnox and the jdx.dev open source tools
#[derive(Args)]
pub struct SponsorsArgs {}

/// Sync secrets from remote providers to a local encryption provider
#[derive(Args)]
pub struct SyncArgs {
    /// Skip confirmation prompt
    #[usage(long = "force", short = 'f')]
    pub force: bool,
    /// Write to global config (~/.config/fnox/config.toml)
    #[usage(long = "global", short = 'g')]
    pub global: bool,
    /// Show what would be done without making changes
    #[usage(long = "dry-run", short = 'n')]
    pub dry_run: bool,
    /// Target encryption provider (defaults to default_provider)
    #[usage(long = "provider", short = 'p', value_name = "PROVIDER")]
    pub provider: ::std::option::Option<::std::string::String>,
    /// Only sync secrets from this source provider
    #[usage(long = "source", short = 's', value_name = "SOURCE")]
    pub source: ::std::option::Option<::std::string::String>,
    /// Only sync matching secrets (regex pattern)
    #[usage(long = "filter", value_name = "FILTER")]
    pub filter: ::std::option::Option<::std::string::String>,
    /// Write sync overrides to the local override file next to the config file
    #[usage(long = "local-file", conflicts = "--global")]
    pub local_file: bool,
    /// Only sync these specific secret keys
    #[usage(arg, name = "KEYS")]
    pub keys: ::std::vec::Vec<::std::string::String>,
}

/// Interactive TUI dashboard for managing secrets
#[derive(Args)]
pub struct TuiArgs {}

/// Generate usage specification
#[derive(Args)]
pub struct UsageArgs {}

/// Show version information
#[derive(Args)]
pub struct VersionArgs {}

/// A flexible secret management tool by @jdx
#[derive(Cli)]
#[usage(
    bin = "fnox",
    name = "fnox",
    version = "1.33.1",
    unknown_flags = "error"
)]
pub struct Cli {
    /// Path to the configuration file (default: fnox.toml, searches parent directories)
    #[usage(
        long = "config",
        short = 'c',
        global,
        value_name = "CONFIG",
        default = "fnox.toml"
    )]
    pub config: ::std::option::Option<::std::string::String>,
    #[usage(
        help = "Profile to use (default: default, or FNOX_PROFILE env var). Supports multiple profiles separated by commas or repeated flags; later profiles overlay earlier ones.",
        long_help = "Profile to use (default: default, or FNOX_PROFILE env var). Supports multiple\nprofiles separated by commas or repeated flags; later profiles overlay earlier ones.",
        long = "profile",
        short = 'P',
        global,
        value_name = "PROFILE",
        var
    )]
    pub profile: ::std::vec::Vec<::std::string::String>,
    /// Enable verbose logging
    #[usage(long = "verbose", short = 'v', global)]
    pub verbose: bool,
    /// Path to age key file for decryption (deprecated: use provider config instead)
    #[usage(long = "age-key-file", global, hide, value_name = "AGE_KEY_FILE")]
    pub age_key_file: ::std::option::Option<::std::string::String>,
    /// What to do if a secret is missing (error, warn, ignore)
    #[usage(long = "if-missing", global, value_name = "IF_MISSING")]
    pub if_missing: ::std::option::Option<::std::string::String>,
    /// Disable colored output
    #[usage(long = "no-color", global)]
    pub no_color: bool,
    /// Disable daemon-backed resolution for this invocation
    #[usage(long = "no-daemon", global)]
    pub no_daemon: bool,
    /// Do not merge top-level secrets into the selected profile
    #[usage(long = "no-defaults", global)]
    pub no_defaults: bool,
    /// Disable prompts and browser-based auth flows; use cached/non-interactive auth only (env: FNOX_NON_INTERACTIVE)
    #[usage(long = "non-interactive", global, env = "FNOX_NON_INTERACTIVE")]
    pub non_interactive: bool,
    #[usage(
        help = "Target profile for write commands (set, remove, import, sync, provider add/remove). Required when multiple profiles are active; defaults to the single active profile otherwise.",
        long_help = "Target profile for write commands (set, remove, import, sync, provider add/remove).\nRequired when multiple profiles are active; defaults to the single active profile otherwise.",
        long = "write-profile",
        global,
        value_name = "WRITE_PROFILE"
    )]
    pub write_profile: ::std::option::Option<::std::string::String>,
    #[usage(subcommand)]
    pub command: Commands,
}

#[derive(Subcommands)]
pub enum Commands {
    /// Output shell activation code to enable automatic secret loading
    #[usage(name = "activate")]
    Activate(Box<ActivateArgs>),
    /// Check if all required secrets are defined and configured
    #[usage(name = "check", alias = "c")]
    Check(Box<CheckArgs>),
    /// Redact secrets in CI/CD output (GitHub Actions mask)
    #[usage(name = "ci-redact", hide)]
    CiRedact(Box<CiRedactArgs>),
    /// Generate shell completions
    #[usage(name = "completion", alias_hidden("complete", "completions"))]
    Completion(Box<CompletionArgs>),
    /// List all config files that would be loaded
    #[usage(name = "config-files")]
    ConfigFiles(Box<ConfigFilesArgs>),
    /// Manage the per-user daemon
    #[usage(name = "daemon")]
    Daemon(Box<DaemonArgs>),
    /// Disable fnox shell integration in the current shell session
    #[usage(name = "deactivate")]
    Deactivate(Box<DeactivateArgs>),
    /// Show diagnostic information about the current fnox state
    #[usage(name = "doctor", alias = "dr")]
    Doctor(Box<DoctorArgs>),
    /// Edit the configuration file
    #[usage(name = "edit")]
    Edit(Box<EditArgs>),
    /// Execute a command with secrets as environment variables
    #[usage(name = "exec", alias = "x", alias_hidden = "run")]
    Exec(Box<ExecArgs>),
    /// Export secrets in various formats
    #[usage(name = "export", alias = "ex")]
    Export(Box<ExportArgs>),
    /// Get a secret value
    #[usage(name = "get")]
    Get(Box<GetArgs>),
    /// Internal command used by shell hooks to load secrets
    #[usage(name = "hook-env", hide)]
    HookEnv(Box<HookEnvArgs>),
    /// Import secrets from various sources
    #[usage(name = "import", alias = "im")]
    Import(Box<ImportArgs>),
    /// Initialize a new fnox configuration file
    #[usage(name = "init", alias = "i")]
    Init(Box<InitArgs>),
    /// Manage ephemeral credential leases
    #[usage(name = "lease")]
    Lease(Box<LeaseArgs>),
    /// List all secrets
    #[usage(name = "list", alias("ls", "secrets"))]
    List(Box<ListArgs>),
    /// Start an MCP server for secret-gated AI agent access
    #[usage(name = "mcp")]
    Mcp(Box<McpArgs>),
    /// List available profiles
    #[usage(name = "profiles", alias = "profile")]
    Profiles(Box<ProfilesArgs>),
    /// Manage providers (defaults to list)
    #[usage(name = "provider")]
    Provider(Box<ProviderArgs>),
    /// Broker credentials into destination-scoped HTTPS requests
    #[usage(name = "proxy")]
    Proxy(Box<ProxyArgs>),
    /// Re-encrypt secrets with current provider configuration
    #[usage(name = "reencrypt")]
    Reencrypt(Box<ReencryptArgs>),
    /// Remove a secret
    #[usage(name = "remove", alias("rm", "delete"))]
    Remove(Box<RemoveArgs>),
    /// Scan repository for potential secrets
    #[usage(name = "scan")]
    Scan(Box<ScanArgs>),
    /// Generate JSON Schema for fnox configuration
    #[usage(name = "schema", hide)]
    Schema(Box<SchemaArgs>),
    /// Set a secret value
    #[usage(name = "set", alias = "s")]
    Set(Box<SetArgs>),
    /// Show the companies sponsoring fnox and the jdx.dev open source tools
    #[usage(name = "sponsors")]
    Sponsors(Box<SponsorsArgs>),
    /// Sync secrets from remote providers to a local encryption provider
    #[usage(name = "sync")]
    Sync(Box<SyncArgs>),
    /// Interactive TUI dashboard for managing secrets
    #[usage(name = "tui")]
    Tui(Box<TuiArgs>),
    /// Generate usage specification
    #[usage(name = "usage", hide)]
    Usage(Box<UsageArgs>),
    /// Show version information
    #[usage(name = "version", alias = "v")]
    Version(Box<VersionArgs>),
}
