# bash completion for witness                              -*- shell-script -*-

__witness_debug()
{
    if [[ -n ${BASH_COMP_DEBUG_FILE:-} ]]; then
        echo "$*" >> "${BASH_COMP_DEBUG_FILE}"
    fi
}

# Homebrew on Macs have version 1.3 of bash-completion which doesn't include
# _init_completion. This is a very minimal version of that function.
__witness_init_completion()
{
    COMPREPLY=()
    _get_comp_words_by_ref "$@" cur prev words cword
}

__witness_index_of_word()
{
    local w word=$1
    shift
    index=0
    for w in "$@"; do
        [[ $w = "$word" ]] && return
        index=$((index+1))
    done
    index=-1
}

__witness_contains_word()
{
    local w word=$1; shift
    for w in "$@"; do
        [[ $w = "$word" ]] && return
    done
    return 1
}

__witness_handle_go_custom_completion()
{
    __witness_debug "${FUNCNAME[0]}: cur is ${cur}, words[*] is ${words[*]}, #words[@] is ${#words[@]}"

    local shellCompDirectiveError=1
    local shellCompDirectiveNoSpace=2
    local shellCompDirectiveNoFileComp=4
    local shellCompDirectiveFilterFileExt=8
    local shellCompDirectiveFilterDirs=16

    local out requestComp lastParam lastChar comp directive args

    # Prepare the command to request completions for the program.
    # Calling ${words[0]} instead of directly witness allows handling aliases
    args=("${words[@]:1}")
    # Disable ActiveHelp which is not supported for bash completion v1
    requestComp="WITNESS_ACTIVE_HELP=0 ${words[0]} __completeNoDesc ${args[*]}"

    lastParam=${words[$((${#words[@]}-1))]}
    lastChar=${lastParam:$((${#lastParam}-1)):1}
    __witness_debug "${FUNCNAME[0]}: lastParam ${lastParam}, lastChar ${lastChar}"

    if [ -z "${cur}" ] && [ "${lastChar}" != "=" ]; then
        # If the last parameter is complete (there is a space following it)
        # We add an extra empty parameter so we can indicate this to the go method.
        __witness_debug "${FUNCNAME[0]}: Adding extra empty parameter"
        requestComp="${requestComp} \"\""
    fi

    __witness_debug "${FUNCNAME[0]}: calling ${requestComp}"
    # Use eval to handle any environment variables and such
    out=$(eval "${requestComp}" 2>/dev/null)

    # Extract the directive integer at the very end of the output following a colon (:)
    directive=${out##*:}
    # Remove the directive
    out=${out%:*}
    if [ "${directive}" = "${out}" ]; then
        # There is not directive specified
        directive=0
    fi
    __witness_debug "${FUNCNAME[0]}: the completion directive is: ${directive}"
    __witness_debug "${FUNCNAME[0]}: the completions are: ${out}"

    if [ $((directive & shellCompDirectiveError)) -ne 0 ]; then
        # Error code.  No completion.
        __witness_debug "${FUNCNAME[0]}: received error from custom completion go code"
        return
    else
        if [ $((directive & shellCompDirectiveNoSpace)) -ne 0 ]; then
            if [[ $(type -t compopt) = "builtin" ]]; then
                __witness_debug "${FUNCNAME[0]}: activating no space"
                compopt -o nospace
            fi
        fi
        if [ $((directive & shellCompDirectiveNoFileComp)) -ne 0 ]; then
            if [[ $(type -t compopt) = "builtin" ]]; then
                __witness_debug "${FUNCNAME[0]}: activating no file completion"
                compopt +o default
            fi
        fi
    fi

    if [ $((directive & shellCompDirectiveFilterFileExt)) -ne 0 ]; then
        # File extension filtering
        local fullFilter filter filteringCmd
        # Do not use quotes around the $out variable or else newline
        # characters will be kept.
        for filter in ${out}; do
            fullFilter+="$filter|"
        done

        filteringCmd="_filedir $fullFilter"
        __witness_debug "File filtering command: $filteringCmd"
        $filteringCmd
    elif [ $((directive & shellCompDirectiveFilterDirs)) -ne 0 ]; then
        # File completion for directories only
        local subdir
        # Use printf to strip any trailing newline
        subdir=$(printf "%s" "${out}")
        if [ -n "$subdir" ]; then
            __witness_debug "Listing directories in $subdir"
            __witness_handle_subdirs_in_dir_flag "$subdir"
        else
            __witness_debug "Listing directories in ."
            _filedir -d
        fi
    else
        while IFS='' read -r comp; do
            COMPREPLY+=("$comp")
        done < <(compgen -W "${out}" -- "$cur")
    fi
}

__witness_handle_reply()
{
    __witness_debug "${FUNCNAME[0]}"
    local comp
    case $cur in
        -*)
            if [[ $(type -t compopt) = "builtin" ]]; then
                compopt -o nospace
            fi
            local allflags
            if [ ${#must_have_one_flag[@]} -ne 0 ]; then
                allflags=("${must_have_one_flag[@]}")
            else
                allflags=("${flags[*]} ${two_word_flags[*]}")
            fi
            while IFS='' read -r comp; do
                COMPREPLY+=("$comp")
            done < <(compgen -W "${allflags[*]}" -- "$cur")
            if [[ $(type -t compopt) = "builtin" ]]; then
                [[ "${COMPREPLY[0]}" == *= ]] || compopt +o nospace
            fi

            # complete after --flag=abc
            if [[ $cur == *=* ]]; then
                if [[ $(type -t compopt) = "builtin" ]]; then
                    compopt +o nospace
                fi

                local index flag
                flag="${cur%=*}"
                __witness_index_of_word "${flag}" "${flags_with_completion[@]}"
                COMPREPLY=()
                if [[ ${index} -ge 0 ]]; then
                    PREFIX=""
                    cur="${cur#*=}"
                    ${flags_completion[${index}]}
                    if [ -n "${ZSH_VERSION:-}" ]; then
                        # zsh completion needs --flag= prefix
                        eval "COMPREPLY=( \"\${COMPREPLY[@]/#/${flag}=}\" )"
                    fi
                fi
            fi

            if [[ -z "${flag_parsing_disabled}" ]]; then
                # If flag parsing is enabled, we have completed the flags and can return.
                # If flag parsing is disabled, we may not know all (or any) of the flags, so we fallthrough
                # to possibly call handle_go_custom_completion.
                return 0;
            fi
            ;;
    esac

    # check if we are handling a flag with special work handling
    local index
    __witness_index_of_word "${prev}" "${flags_with_completion[@]}"
    if [[ ${index} -ge 0 ]]; then
        ${flags_completion[${index}]}
        return
    fi

    # we are parsing a flag and don't have a special handler, no completion
    if [[ ${cur} != "${words[cword]}" ]]; then
        return
    fi

    local completions
    completions=("${commands[@]}")
    if [[ ${#must_have_one_noun[@]} -ne 0 ]]; then
        completions+=("${must_have_one_noun[@]}")
    elif [[ -n "${has_completion_function}" ]]; then
        # if a go completion function is provided, defer to that function
        __witness_handle_go_custom_completion
    fi
    if [[ ${#must_have_one_flag[@]} -ne 0 ]]; then
        completions+=("${must_have_one_flag[@]}")
    fi
    while IFS='' read -r comp; do
        COMPREPLY+=("$comp")
    done < <(compgen -W "${completions[*]}" -- "$cur")

    if [[ ${#COMPREPLY[@]} -eq 0 && ${#noun_aliases[@]} -gt 0 && ${#must_have_one_noun[@]} -ne 0 ]]; then
        while IFS='' read -r comp; do
            COMPREPLY+=("$comp")
        done < <(compgen -W "${noun_aliases[*]}" -- "$cur")
    fi

    if [[ ${#COMPREPLY[@]} -eq 0 ]]; then
        if declare -F __witness_custom_func >/dev/null; then
            # try command name qualified custom func
            __witness_custom_func
        else
            # otherwise fall back to unqualified for compatibility
            declare -F __custom_func >/dev/null && __custom_func
        fi
    fi

    # available in bash-completion >= 2, not always present on macOS
    if declare -F __ltrim_colon_completions >/dev/null; then
        __ltrim_colon_completions "$cur"
    fi

    # If there is only 1 completion and it is a flag with an = it will be completed
    # but we don't want a space after the =
    if [[ "${#COMPREPLY[@]}" -eq "1" ]] && [[ $(type -t compopt) = "builtin" ]] && [[ "${COMPREPLY[0]}" == --*= ]]; then
       compopt -o nospace
    fi
}

# The arguments should be in the form "ext1|ext2|extn"
__witness_handle_filename_extension_flag()
{
    local ext="$1"
    _filedir "@(${ext})"
}

__witness_handle_subdirs_in_dir_flag()
{
    local dir="$1"
    pushd "${dir}" >/dev/null 2>&1 && _filedir -d && popd >/dev/null 2>&1 || return
}

__witness_handle_flag()
{
    __witness_debug "${FUNCNAME[0]}: c is $c words[c] is ${words[c]}"

    # if a command required a flag, and we found it, unset must_have_one_flag()
    local flagname=${words[c]}
    local flagvalue=""
    # if the word contained an =
    if [[ ${words[c]} == *"="* ]]; then
        flagvalue=${flagname#*=} # take in as flagvalue after the =
        flagname=${flagname%=*} # strip everything after the =
        flagname="${flagname}=" # but put the = back
    fi
    __witness_debug "${FUNCNAME[0]}: looking for ${flagname}"
    if __witness_contains_word "${flagname}" "${must_have_one_flag[@]}"; then
        must_have_one_flag=()
    fi

    # if you set a flag which only applies to this command, don't show subcommands
    if __witness_contains_word "${flagname}" "${local_nonpersistent_flags[@]}"; then
      commands=()
    fi

    # keep flag value with flagname as flaghash
    # flaghash variable is an associative array which is only supported in bash > 3.
    if [[ -z "${BASH_VERSION:-}" || "${BASH_VERSINFO[0]:-}" -gt 3 ]]; then
        if [ -n "${flagvalue}" ] ; then
            flaghash[${flagname}]=${flagvalue}
        elif [ -n "${words[ $((c+1)) ]}" ] ; then
            flaghash[${flagname}]=${words[ $((c+1)) ]}
        else
            flaghash[${flagname}]="true" # pad "true" for bool flag
        fi
    fi

    # skip the argument to a two word flag
    if [[ ${words[c]} != *"="* ]] && __witness_contains_word "${words[c]}" "${two_word_flags[@]}"; then
        __witness_debug "${FUNCNAME[0]}: found a flag ${words[c]}, skip the next argument"
        c=$((c+1))
        # if we are looking for a flags value, don't show commands
        if [[ $c -eq $cword ]]; then
            commands=()
        fi
    fi

    c=$((c+1))

}

__witness_handle_noun()
{
    __witness_debug "${FUNCNAME[0]}: c is $c words[c] is ${words[c]}"

    if __witness_contains_word "${words[c]}" "${must_have_one_noun[@]}"; then
        must_have_one_noun=()
    elif __witness_contains_word "${words[c]}" "${noun_aliases[@]}"; then
        must_have_one_noun=()
    fi

    nouns+=("${words[c]}")
    c=$((c+1))
}

__witness_handle_command()
{
    __witness_debug "${FUNCNAME[0]}: c is $c words[c] is ${words[c]}"

    local next_command
    if [[ -n ${last_command} ]]; then
        next_command="_${last_command}_${words[c]//:/__}"
    else
        if [[ $c -eq 0 ]]; then
            next_command="_witness_root_command"
        else
            next_command="_${words[c]//:/__}"
        fi
    fi
    c=$((c+1))
    __witness_debug "${FUNCNAME[0]}: looking for ${next_command}"
    declare -F "$next_command" >/dev/null && $next_command
}

__witness_handle_word()
{
    if [[ $c -ge $cword ]]; then
        __witness_handle_reply
        return
    fi
    __witness_debug "${FUNCNAME[0]}: c is $c words[c] is ${words[c]}"
    if [[ "${words[c]}" == -* ]]; then
        __witness_handle_flag
    elif __witness_contains_word "${words[c]}" "${commands[@]}"; then
        __witness_handle_command
    elif [[ $c -eq 0 ]]; then
        __witness_handle_command
    elif __witness_contains_word "${words[c]}" "${command_aliases[@]}"; then
        # aliashash variable is an associative array which is only supported in bash > 3.
        if [[ -z "${BASH_VERSION:-}" || "${BASH_VERSINFO[0]:-}" -gt 3 ]]; then
            words[c]=${aliashash[${words[c]}]}
            __witness_handle_command
        else
            __witness_handle_noun
        fi
    else
        __witness_handle_noun
    fi
    __witness_handle_word
}

_witness_attestors_list()
{
    last_command="witness_attestors_list"

    command_aliases=()

    commands=()

    flags=()
    two_word_flags=()
    local_nonpersistent_flags=()
    flags_with_completion=()
    flags_completion=()

    flags+=("--config=")
    two_word_flags+=("--config")
    two_word_flags+=("-c")
    flags+=("--debug-cpu-profile-file=")
    two_word_flags+=("--debug-cpu-profile-file")
    flags+=("--debug-mem-profile-file=")
    two_word_flags+=("--debug-mem-profile-file")
    flags+=("--log-level=")
    two_word_flags+=("--log-level")
    two_word_flags+=("-l")

    must_have_one_flag=()
    must_have_one_noun=()
    noun_aliases=()
}

_witness_attestors_schema()
{
    last_command="witness_attestors_schema"

    command_aliases=()

    commands=()

    flags=()
    two_word_flags=()
    local_nonpersistent_flags=()
    flags_with_completion=()
    flags_completion=()

    flags+=("--config=")
    two_word_flags+=("--config")
    two_word_flags+=("-c")
    flags+=("--debug-cpu-profile-file=")
    two_word_flags+=("--debug-cpu-profile-file")
    flags+=("--debug-mem-profile-file=")
    two_word_flags+=("--debug-mem-profile-file")
    flags+=("--log-level=")
    two_word_flags+=("--log-level")
    two_word_flags+=("-l")

    must_have_one_flag=()
    must_have_one_noun=()
    noun_aliases=()
}

_witness_attestors()
{
    last_command="witness_attestors"

    command_aliases=()

    commands=()
    commands+=("list")
    commands+=("schema")

    flags=()
    two_word_flags=()
    local_nonpersistent_flags=()
    flags_with_completion=()
    flags_completion=()

    flags+=("--config=")
    two_word_flags+=("--config")
    two_word_flags+=("-c")
    flags+=("--debug-cpu-profile-file=")
    two_word_flags+=("--debug-cpu-profile-file")
    flags+=("--debug-mem-profile-file=")
    two_word_flags+=("--debug-mem-profile-file")
    flags+=("--log-level=")
    two_word_flags+=("--log-level")
    two_word_flags+=("-l")

    must_have_one_flag=()
    must_have_one_noun=()
    noun_aliases=()
}

_witness_completion()
{
    last_command="witness_completion"

    command_aliases=()

    commands=()

    flags=()
    two_word_flags=()
    local_nonpersistent_flags=()
    flags_with_completion=()
    flags_completion=()

    flags+=("--help")
    flags+=("-h")
    local_nonpersistent_flags+=("--help")
    local_nonpersistent_flags+=("-h")
    flags+=("--config=")
    two_word_flags+=("--config")
    two_word_flags+=("-c")
    flags+=("--debug-cpu-profile-file=")
    two_word_flags+=("--debug-cpu-profile-file")
    flags+=("--debug-mem-profile-file=")
    two_word_flags+=("--debug-mem-profile-file")
    flags+=("--log-level=")
    two_word_flags+=("--log-level")
    two_word_flags+=("-l")

    must_have_one_flag=()
    must_have_one_noun=()
    must_have_one_noun+=("bash")
    must_have_one_noun+=("fish")
    must_have_one_noun+=("powershell")
    must_have_one_noun+=("zsh")
    noun_aliases=()
}

_witness_help()
{
    last_command="witness_help"

    command_aliases=()

    commands=()

    flags=()
    two_word_flags=()
    local_nonpersistent_flags=()
    flags_with_completion=()
    flags_completion=()

    flags+=("--config=")
    two_word_flags+=("--config")
    two_word_flags+=("-c")
    flags+=("--debug-cpu-profile-file=")
    two_word_flags+=("--debug-cpu-profile-file")
    flags+=("--debug-mem-profile-file=")
    two_word_flags+=("--debug-mem-profile-file")
    flags+=("--log-level=")
    two_word_flags+=("--log-level")
    two_word_flags+=("-l")

    must_have_one_flag=()
    must_have_one_noun=()
    has_completion_function=1
    noun_aliases=()
}

_witness_policy_check()
{
    last_command="witness_policy_check"

    command_aliases=()

    commands=()

    flags=()
    two_word_flags=()
    local_nonpersistent_flags=()
    flags_with_completion=()
    flags_completion=()

    flags+=("--json")
    local_nonpersistent_flags+=("--json")
    flags+=("--quiet")
    flags+=("-q")
    local_nonpersistent_flags+=("--quiet")
    local_nonpersistent_flags+=("-q")
    flags+=("--verbose")
    flags+=("-v")
    local_nonpersistent_flags+=("--verbose")
    local_nonpersistent_flags+=("-v")
    flags+=("--config=")
    two_word_flags+=("--config")
    two_word_flags+=("-c")
    flags+=("--debug-cpu-profile-file=")
    two_word_flags+=("--debug-cpu-profile-file")
    flags+=("--debug-mem-profile-file=")
    two_word_flags+=("--debug-mem-profile-file")
    flags+=("--log-level=")
    two_word_flags+=("--log-level")
    two_word_flags+=("-l")

    must_have_one_flag=()
    must_have_one_noun=()
    noun_aliases=()
}

_witness_policy()
{
    last_command="witness_policy"

    command_aliases=()

    commands=()
    commands+=("check")

    flags=()
    two_word_flags=()
    local_nonpersistent_flags=()
    flags_with_completion=()
    flags_completion=()

    flags+=("--config=")
    two_word_flags+=("--config")
    two_word_flags+=("-c")
    flags+=("--debug-cpu-profile-file=")
    two_word_flags+=("--debug-cpu-profile-file")
    flags+=("--debug-mem-profile-file=")
    two_word_flags+=("--debug-mem-profile-file")
    flags+=("--log-level=")
    two_word_flags+=("--log-level")
    two_word_flags+=("-l")

    must_have_one_flag=()
    must_have_one_noun=()
    noun_aliases=()
}

_witness_run()
{
    last_command="witness_run"

    command_aliases=()

    commands=()

    flags=()
    two_word_flags=()
    local_nonpersistent_flags=()
    flags_with_completion=()
    flags_completion=()

    flags+=("--archivista-headers=")
    two_word_flags+=("--archivista-headers")
    local_nonpersistent_flags+=("--archivista-headers")
    local_nonpersistent_flags+=("--archivista-headers=")
    flags+=("--archivista-server=")
    two_word_flags+=("--archivista-server")
    local_nonpersistent_flags+=("--archivista-server")
    local_nonpersistent_flags+=("--archivista-server=")
    flags+=("--attestations=")
    two_word_flags+=("--attestations")
    two_word_flags+=("-a")
    local_nonpersistent_flags+=("--attestations")
    local_nonpersistent_flags+=("--attestations=")
    local_nonpersistent_flags+=("-a")
    flags+=("--attestor-aws-region-cert=")
    two_word_flags+=("--attestor-aws-region-cert")
    local_nonpersistent_flags+=("--attestor-aws-region-cert")
    local_nonpersistent_flags+=("--attestor-aws-region-cert=")
    flags+=("--attestor-k8smanifest-context=")
    two_word_flags+=("--attestor-k8smanifest-context")
    local_nonpersistent_flags+=("--attestor-k8smanifest-context")
    local_nonpersistent_flags+=("--attestor-k8smanifest-context=")
    flags+=("--attestor-k8smanifest-ignore-annotations=")
    two_word_flags+=("--attestor-k8smanifest-ignore-annotations")
    local_nonpersistent_flags+=("--attestor-k8smanifest-ignore-annotations")
    local_nonpersistent_flags+=("--attestor-k8smanifest-ignore-annotations=")
    flags+=("--attestor-k8smanifest-ignore-fields=")
    two_word_flags+=("--attestor-k8smanifest-ignore-fields")
    local_nonpersistent_flags+=("--attestor-k8smanifest-ignore-fields")
    local_nonpersistent_flags+=("--attestor-k8smanifest-ignore-fields=")
    flags+=("--attestor-k8smanifest-kubeconfig=")
    two_word_flags+=("--attestor-k8smanifest-kubeconfig")
    local_nonpersistent_flags+=("--attestor-k8smanifest-kubeconfig")
    local_nonpersistent_flags+=("--attestor-k8smanifest-kubeconfig=")
    flags+=("--attestor-k8smanifest-record-cluster-information")
    local_nonpersistent_flags+=("--attestor-k8smanifest-record-cluster-information")
    flags+=("--attestor-k8smanifest-server-side-dry-run")
    local_nonpersistent_flags+=("--attestor-k8smanifest-server-side-dry-run")
    flags+=("--attestor-link-export")
    local_nonpersistent_flags+=("--attestor-link-export")
    flags+=("--attestor-maven-pom-path=")
    two_word_flags+=("--attestor-maven-pom-path")
    local_nonpersistent_flags+=("--attestor-maven-pom-path")
    local_nonpersistent_flags+=("--attestor-maven-pom-path=")
    flags+=("--attestor-product-exclude-glob=")
    two_word_flags+=("--attestor-product-exclude-glob")
    local_nonpersistent_flags+=("--attestor-product-exclude-glob")
    local_nonpersistent_flags+=("--attestor-product-exclude-glob=")
    flags+=("--attestor-product-include-glob=")
    two_word_flags+=("--attestor-product-include-glob")
    local_nonpersistent_flags+=("--attestor-product-include-glob")
    local_nonpersistent_flags+=("--attestor-product-include-glob=")
    flags+=("--attestor-sbom-export")
    local_nonpersistent_flags+=("--attestor-sbom-export")
    flags+=("--attestor-secretscan-allowlist-regex=")
    two_word_flags+=("--attestor-secretscan-allowlist-regex")
    local_nonpersistent_flags+=("--attestor-secretscan-allowlist-regex")
    local_nonpersistent_flags+=("--attestor-secretscan-allowlist-regex=")
    flags+=("--attestor-secretscan-allowlist-stopword=")
    two_word_flags+=("--attestor-secretscan-allowlist-stopword")
    local_nonpersistent_flags+=("--attestor-secretscan-allowlist-stopword")
    local_nonpersistent_flags+=("--attestor-secretscan-allowlist-stopword=")
    flags+=("--attestor-secretscan-config-path=")
    two_word_flags+=("--attestor-secretscan-config-path")
    local_nonpersistent_flags+=("--attestor-secretscan-config-path")
    local_nonpersistent_flags+=("--attestor-secretscan-config-path=")
    flags+=("--attestor-secretscan-fail-on-detection")
    local_nonpersistent_flags+=("--attestor-secretscan-fail-on-detection")
    flags+=("--attestor-secretscan-max-decode-layers=")
    two_word_flags+=("--attestor-secretscan-max-decode-layers")
    local_nonpersistent_flags+=("--attestor-secretscan-max-decode-layers")
    local_nonpersistent_flags+=("--attestor-secretscan-max-decode-layers=")
    flags+=("--attestor-secretscan-max-file-size-mb=")
    two_word_flags+=("--attestor-secretscan-max-file-size-mb")
    local_nonpersistent_flags+=("--attestor-secretscan-max-file-size-mb")
    local_nonpersistent_flags+=("--attestor-secretscan-max-file-size-mb=")
    flags+=("--attestor-slsa-export")
    local_nonpersistent_flags+=("--attestor-slsa-export")
    flags+=("--dirhash-glob=")
    two_word_flags+=("--dirhash-glob")
    local_nonpersistent_flags+=("--dirhash-glob")
    local_nonpersistent_flags+=("--dirhash-glob=")
    flags+=("--enable-archivista")
    local_nonpersistent_flags+=("--enable-archivista")
    flags+=("--env-add-sensitive-key=")
    two_word_flags+=("--env-add-sensitive-key")
    local_nonpersistent_flags+=("--env-add-sensitive-key")
    local_nonpersistent_flags+=("--env-add-sensitive-key=")
    flags+=("--env-allow-sensitive-key=")
    two_word_flags+=("--env-allow-sensitive-key")
    local_nonpersistent_flags+=("--env-allow-sensitive-key")
    local_nonpersistent_flags+=("--env-allow-sensitive-key=")
    flags+=("--env-disable-default-sensitive-vars")
    local_nonpersistent_flags+=("--env-disable-default-sensitive-vars")
    flags+=("--env-filter-sensitive-vars")
    local_nonpersistent_flags+=("--env-filter-sensitive-vars")
    flags+=("--hashes=")
    two_word_flags+=("--hashes")
    local_nonpersistent_flags+=("--hashes")
    local_nonpersistent_flags+=("--hashes=")
    flags+=("--outfile=")
    two_word_flags+=("--outfile")
    two_word_flags+=("-o")
    local_nonpersistent_flags+=("--outfile")
    local_nonpersistent_flags+=("--outfile=")
    local_nonpersistent_flags+=("-o")
    flags+=("--signer-file-cert-path=")
    two_word_flags+=("--signer-file-cert-path")
    local_nonpersistent_flags+=("--signer-file-cert-path")
    local_nonpersistent_flags+=("--signer-file-cert-path=")
    flags+=("--signer-file-intermediate-paths=")
    two_word_flags+=("--signer-file-intermediate-paths")
    local_nonpersistent_flags+=("--signer-file-intermediate-paths")
    local_nonpersistent_flags+=("--signer-file-intermediate-paths=")
    flags+=("--signer-file-key-passphrase-path=")
    two_word_flags+=("--signer-file-key-passphrase-path")
    local_nonpersistent_flags+=("--signer-file-key-passphrase-path")
    local_nonpersistent_flags+=("--signer-file-key-passphrase-path=")
    flags+=("--signer-file-key-path=")
    two_word_flags+=("--signer-file-key-path")
    two_word_flags+=("-k")
    local_nonpersistent_flags+=("--signer-file-key-path")
    local_nonpersistent_flags+=("--signer-file-key-path=")
    local_nonpersistent_flags+=("-k")
    flags+=("--signer-fulcio-oidc-client-id=")
    two_word_flags+=("--signer-fulcio-oidc-client-id")
    local_nonpersistent_flags+=("--signer-fulcio-oidc-client-id")
    local_nonpersistent_flags+=("--signer-fulcio-oidc-client-id=")
    flags+=("--signer-fulcio-oidc-issuer=")
    two_word_flags+=("--signer-fulcio-oidc-issuer")
    local_nonpersistent_flags+=("--signer-fulcio-oidc-issuer")
    local_nonpersistent_flags+=("--signer-fulcio-oidc-issuer=")
    flags+=("--signer-fulcio-oidc-redirect-url=")
    two_word_flags+=("--signer-fulcio-oidc-redirect-url")
    local_nonpersistent_flags+=("--signer-fulcio-oidc-redirect-url")
    local_nonpersistent_flags+=("--signer-fulcio-oidc-redirect-url=")
    flags+=("--signer-fulcio-token=")
    two_word_flags+=("--signer-fulcio-token")
    local_nonpersistent_flags+=("--signer-fulcio-token")
    local_nonpersistent_flags+=("--signer-fulcio-token=")
    flags+=("--signer-fulcio-token-path=")
    two_word_flags+=("--signer-fulcio-token-path")
    local_nonpersistent_flags+=("--signer-fulcio-token-path")
    local_nonpersistent_flags+=("--signer-fulcio-token-path=")
    flags+=("--signer-fulcio-url=")
    two_word_flags+=("--signer-fulcio-url")
    local_nonpersistent_flags+=("--signer-fulcio-url")
    local_nonpersistent_flags+=("--signer-fulcio-url=")
    flags+=("--signer-fulcio-use-http")
    local_nonpersistent_flags+=("--signer-fulcio-use-http")
    flags+=("--signer-kms-aws-config-file=")
    two_word_flags+=("--signer-kms-aws-config-file")
    local_nonpersistent_flags+=("--signer-kms-aws-config-file")
    local_nonpersistent_flags+=("--signer-kms-aws-config-file=")
    flags+=("--signer-kms-aws-credentials-file=")
    two_word_flags+=("--signer-kms-aws-credentials-file")
    local_nonpersistent_flags+=("--signer-kms-aws-credentials-file")
    local_nonpersistent_flags+=("--signer-kms-aws-credentials-file=")
    flags+=("--signer-kms-aws-insecure-skip-verify")
    local_nonpersistent_flags+=("--signer-kms-aws-insecure-skip-verify")
    flags+=("--signer-kms-aws-profile=")
    two_word_flags+=("--signer-kms-aws-profile")
    local_nonpersistent_flags+=("--signer-kms-aws-profile")
    local_nonpersistent_flags+=("--signer-kms-aws-profile=")
    flags+=("--signer-kms-aws-remote-verify")
    local_nonpersistent_flags+=("--signer-kms-aws-remote-verify")
    flags+=("--signer-kms-gcp-authorized-user")
    local_nonpersistent_flags+=("--signer-kms-gcp-authorized-user")
    flags+=("--signer-kms-gcp-credentials-file=")
    two_word_flags+=("--signer-kms-gcp-credentials-file")
    local_nonpersistent_flags+=("--signer-kms-gcp-credentials-file")
    local_nonpersistent_flags+=("--signer-kms-gcp-credentials-file=")
    flags+=("--signer-kms-gcp-service-account")
    local_nonpersistent_flags+=("--signer-kms-gcp-service-account")
    flags+=("--signer-kms-hashType=")
    two_word_flags+=("--signer-kms-hashType")
    local_nonpersistent_flags+=("--signer-kms-hashType")
    local_nonpersistent_flags+=("--signer-kms-hashType=")
    flags+=("--signer-kms-hashivault-addr=")
    two_word_flags+=("--signer-kms-hashivault-addr")
    local_nonpersistent_flags+=("--signer-kms-hashivault-addr")
    local_nonpersistent_flags+=("--signer-kms-hashivault-addr=")
    flags+=("--signer-kms-hashivault-auth-method=")
    two_word_flags+=("--signer-kms-hashivault-auth-method")
    local_nonpersistent_flags+=("--signer-kms-hashivault-auth-method")
    local_nonpersistent_flags+=("--signer-kms-hashivault-auth-method=")
    flags+=("--signer-kms-hashivault-kubernetes-auth-mount-path=")
    two_word_flags+=("--signer-kms-hashivault-kubernetes-auth-mount-path")
    local_nonpersistent_flags+=("--signer-kms-hashivault-kubernetes-auth-mount-path")
    local_nonpersistent_flags+=("--signer-kms-hashivault-kubernetes-auth-mount-path=")
    flags+=("--signer-kms-hashivault-kubernetes-service-account-token-path=")
    two_word_flags+=("--signer-kms-hashivault-kubernetes-service-account-token-path")
    local_nonpersistent_flags+=("--signer-kms-hashivault-kubernetes-service-account-token-path")
    local_nonpersistent_flags+=("--signer-kms-hashivault-kubernetes-service-account-token-path=")
    flags+=("--signer-kms-hashivault-role=")
    two_word_flags+=("--signer-kms-hashivault-role")
    local_nonpersistent_flags+=("--signer-kms-hashivault-role")
    local_nonpersistent_flags+=("--signer-kms-hashivault-role=")
    flags+=("--signer-kms-hashivault-token-file=")
    two_word_flags+=("--signer-kms-hashivault-token-file")
    local_nonpersistent_flags+=("--signer-kms-hashivault-token-file")
    local_nonpersistent_flags+=("--signer-kms-hashivault-token-file=")
    flags+=("--signer-kms-hashivault-transit-secret-engine-path=")
    two_word_flags+=("--signer-kms-hashivault-transit-secret-engine-path")
    local_nonpersistent_flags+=("--signer-kms-hashivault-transit-secret-engine-path")
    local_nonpersistent_flags+=("--signer-kms-hashivault-transit-secret-engine-path=")
    flags+=("--signer-kms-keyVersion=")
    two_word_flags+=("--signer-kms-keyVersion")
    local_nonpersistent_flags+=("--signer-kms-keyVersion")
    local_nonpersistent_flags+=("--signer-kms-keyVersion=")
    flags+=("--signer-kms-ref=")
    two_word_flags+=("--signer-kms-ref")
    local_nonpersistent_flags+=("--signer-kms-ref")
    local_nonpersistent_flags+=("--signer-kms-ref=")
    flags+=("--signer-spiffe-socket-path=")
    two_word_flags+=("--signer-spiffe-socket-path")
    local_nonpersistent_flags+=("--signer-spiffe-socket-path")
    local_nonpersistent_flags+=("--signer-spiffe-socket-path=")
    flags+=("--signer-vault-altnames=")
    two_word_flags+=("--signer-vault-altnames")
    local_nonpersistent_flags+=("--signer-vault-altnames")
    local_nonpersistent_flags+=("--signer-vault-altnames=")
    flags+=("--signer-vault-commonname=")
    two_word_flags+=("--signer-vault-commonname")
    local_nonpersistent_flags+=("--signer-vault-commonname")
    local_nonpersistent_flags+=("--signer-vault-commonname=")
    flags+=("--signer-vault-namespace=")
    two_word_flags+=("--signer-vault-namespace")
    local_nonpersistent_flags+=("--signer-vault-namespace")
    local_nonpersistent_flags+=("--signer-vault-namespace=")
    flags+=("--signer-vault-pki-secrets-engine-path=")
    two_word_flags+=("--signer-vault-pki-secrets-engine-path")
    local_nonpersistent_flags+=("--signer-vault-pki-secrets-engine-path")
    local_nonpersistent_flags+=("--signer-vault-pki-secrets-engine-path=")
    flags+=("--signer-vault-role=")
    two_word_flags+=("--signer-vault-role")
    local_nonpersistent_flags+=("--signer-vault-role")
    local_nonpersistent_flags+=("--signer-vault-role=")
    flags+=("--signer-vault-token=")
    two_word_flags+=("--signer-vault-token")
    local_nonpersistent_flags+=("--signer-vault-token")
    local_nonpersistent_flags+=("--signer-vault-token=")
    flags+=("--signer-vault-ttl=")
    two_word_flags+=("--signer-vault-ttl")
    local_nonpersistent_flags+=("--signer-vault-ttl")
    local_nonpersistent_flags+=("--signer-vault-ttl=")
    flags+=("--signer-vault-url=")
    two_word_flags+=("--signer-vault-url")
    local_nonpersistent_flags+=("--signer-vault-url")
    local_nonpersistent_flags+=("--signer-vault-url=")
    flags+=("--step=")
    two_word_flags+=("--step")
    two_word_flags+=("-s")
    local_nonpersistent_flags+=("--step")
    local_nonpersistent_flags+=("--step=")
    local_nonpersistent_flags+=("-s")
    flags+=("--timestamp-servers=")
    two_word_flags+=("--timestamp-servers")
    two_word_flags+=("-t")
    local_nonpersistent_flags+=("--timestamp-servers")
    local_nonpersistent_flags+=("--timestamp-servers=")
    local_nonpersistent_flags+=("-t")
    flags+=("--trace")
    flags+=("-r")
    local_nonpersistent_flags+=("--trace")
    local_nonpersistent_flags+=("-r")
    flags+=("--workingdir=")
    two_word_flags+=("--workingdir")
    two_word_flags+=("-d")
    local_nonpersistent_flags+=("--workingdir")
    local_nonpersistent_flags+=("--workingdir=")
    local_nonpersistent_flags+=("-d")
    flags+=("--config=")
    two_word_flags+=("--config")
    two_word_flags+=("-c")
    flags+=("--debug-cpu-profile-file=")
    two_word_flags+=("--debug-cpu-profile-file")
    flags+=("--debug-mem-profile-file=")
    two_word_flags+=("--debug-mem-profile-file")
    flags+=("--log-level=")
    two_word_flags+=("--log-level")
    two_word_flags+=("-l")

    must_have_one_flag=()
    must_have_one_noun=()
    noun_aliases=()
}

_witness_sign()
{
    last_command="witness_sign"

    command_aliases=()

    commands=()

    flags=()
    two_word_flags=()
    local_nonpersistent_flags=()
    flags_with_completion=()
    flags_completion=()

    flags+=("--datatype=")
    two_word_flags+=("--datatype")
    two_word_flags+=("-t")
    local_nonpersistent_flags+=("--datatype")
    local_nonpersistent_flags+=("--datatype=")
    local_nonpersistent_flags+=("-t")
    flags+=("--infile=")
    two_word_flags+=("--infile")
    two_word_flags+=("-f")
    local_nonpersistent_flags+=("--infile")
    local_nonpersistent_flags+=("--infile=")
    local_nonpersistent_flags+=("-f")
    flags+=("--outfile=")
    two_word_flags+=("--outfile")
    two_word_flags+=("-o")
    local_nonpersistent_flags+=("--outfile")
    local_nonpersistent_flags+=("--outfile=")
    local_nonpersistent_flags+=("-o")
    flags+=("--signer-file-cert-path=")
    two_word_flags+=("--signer-file-cert-path")
    local_nonpersistent_flags+=("--signer-file-cert-path")
    local_nonpersistent_flags+=("--signer-file-cert-path=")
    flags+=("--signer-file-intermediate-paths=")
    two_word_flags+=("--signer-file-intermediate-paths")
    local_nonpersistent_flags+=("--signer-file-intermediate-paths")
    local_nonpersistent_flags+=("--signer-file-intermediate-paths=")
    flags+=("--signer-file-key-passphrase-path=")
    two_word_flags+=("--signer-file-key-passphrase-path")
    local_nonpersistent_flags+=("--signer-file-key-passphrase-path")
    local_nonpersistent_flags+=("--signer-file-key-passphrase-path=")
    flags+=("--signer-file-key-path=")
    two_word_flags+=("--signer-file-key-path")
    two_word_flags+=("-k")
    local_nonpersistent_flags+=("--signer-file-key-path")
    local_nonpersistent_flags+=("--signer-file-key-path=")
    local_nonpersistent_flags+=("-k")
    flags+=("--signer-fulcio-oidc-client-id=")
    two_word_flags+=("--signer-fulcio-oidc-client-id")
    local_nonpersistent_flags+=("--signer-fulcio-oidc-client-id")
    local_nonpersistent_flags+=("--signer-fulcio-oidc-client-id=")
    flags+=("--signer-fulcio-oidc-issuer=")
    two_word_flags+=("--signer-fulcio-oidc-issuer")
    local_nonpersistent_flags+=("--signer-fulcio-oidc-issuer")
    local_nonpersistent_flags+=("--signer-fulcio-oidc-issuer=")
    flags+=("--signer-fulcio-oidc-redirect-url=")
    two_word_flags+=("--signer-fulcio-oidc-redirect-url")
    local_nonpersistent_flags+=("--signer-fulcio-oidc-redirect-url")
    local_nonpersistent_flags+=("--signer-fulcio-oidc-redirect-url=")
    flags+=("--signer-fulcio-token=")
    two_word_flags+=("--signer-fulcio-token")
    local_nonpersistent_flags+=("--signer-fulcio-token")
    local_nonpersistent_flags+=("--signer-fulcio-token=")
    flags+=("--signer-fulcio-token-path=")
    two_word_flags+=("--signer-fulcio-token-path")
    local_nonpersistent_flags+=("--signer-fulcio-token-path")
    local_nonpersistent_flags+=("--signer-fulcio-token-path=")
    flags+=("--signer-fulcio-url=")
    two_word_flags+=("--signer-fulcio-url")
    local_nonpersistent_flags+=("--signer-fulcio-url")
    local_nonpersistent_flags+=("--signer-fulcio-url=")
    flags+=("--signer-fulcio-use-http")
    local_nonpersistent_flags+=("--signer-fulcio-use-http")
    flags+=("--signer-kms-aws-config-file=")
    two_word_flags+=("--signer-kms-aws-config-file")
    local_nonpersistent_flags+=("--signer-kms-aws-config-file")
    local_nonpersistent_flags+=("--signer-kms-aws-config-file=")
    flags+=("--signer-kms-aws-credentials-file=")
    two_word_flags+=("--signer-kms-aws-credentials-file")
    local_nonpersistent_flags+=("--signer-kms-aws-credentials-file")
    local_nonpersistent_flags+=("--signer-kms-aws-credentials-file=")
    flags+=("--signer-kms-aws-insecure-skip-verify")
    local_nonpersistent_flags+=("--signer-kms-aws-insecure-skip-verify")
    flags+=("--signer-kms-aws-profile=")
    two_word_flags+=("--signer-kms-aws-profile")
    local_nonpersistent_flags+=("--signer-kms-aws-profile")
    local_nonpersistent_flags+=("--signer-kms-aws-profile=")
    flags+=("--signer-kms-aws-remote-verify")
    local_nonpersistent_flags+=("--signer-kms-aws-remote-verify")
    flags+=("--signer-kms-gcp-authorized-user")
    local_nonpersistent_flags+=("--signer-kms-gcp-authorized-user")
    flags+=("--signer-kms-gcp-credentials-file=")
    two_word_flags+=("--signer-kms-gcp-credentials-file")
    local_nonpersistent_flags+=("--signer-kms-gcp-credentials-file")
    local_nonpersistent_flags+=("--signer-kms-gcp-credentials-file=")
    flags+=("--signer-kms-gcp-service-account")
    local_nonpersistent_flags+=("--signer-kms-gcp-service-account")
    flags+=("--signer-kms-hashType=")
    two_word_flags+=("--signer-kms-hashType")
    local_nonpersistent_flags+=("--signer-kms-hashType")
    local_nonpersistent_flags+=("--signer-kms-hashType=")
    flags+=("--signer-kms-hashivault-addr=")
    two_word_flags+=("--signer-kms-hashivault-addr")
    local_nonpersistent_flags+=("--signer-kms-hashivault-addr")
    local_nonpersistent_flags+=("--signer-kms-hashivault-addr=")
    flags+=("--signer-kms-hashivault-auth-method=")
    two_word_flags+=("--signer-kms-hashivault-auth-method")
    local_nonpersistent_flags+=("--signer-kms-hashivault-auth-method")
    local_nonpersistent_flags+=("--signer-kms-hashivault-auth-method=")
    flags+=("--signer-kms-hashivault-kubernetes-auth-mount-path=")
    two_word_flags+=("--signer-kms-hashivault-kubernetes-auth-mount-path")
    local_nonpersistent_flags+=("--signer-kms-hashivault-kubernetes-auth-mount-path")
    local_nonpersistent_flags+=("--signer-kms-hashivault-kubernetes-auth-mount-path=")
    flags+=("--signer-kms-hashivault-kubernetes-service-account-token-path=")
    two_word_flags+=("--signer-kms-hashivault-kubernetes-service-account-token-path")
    local_nonpersistent_flags+=("--signer-kms-hashivault-kubernetes-service-account-token-path")
    local_nonpersistent_flags+=("--signer-kms-hashivault-kubernetes-service-account-token-path=")
    flags+=("--signer-kms-hashivault-role=")
    two_word_flags+=("--signer-kms-hashivault-role")
    local_nonpersistent_flags+=("--signer-kms-hashivault-role")
    local_nonpersistent_flags+=("--signer-kms-hashivault-role=")
    flags+=("--signer-kms-hashivault-token-file=")
    two_word_flags+=("--signer-kms-hashivault-token-file")
    local_nonpersistent_flags+=("--signer-kms-hashivault-token-file")
    local_nonpersistent_flags+=("--signer-kms-hashivault-token-file=")
    flags+=("--signer-kms-hashivault-transit-secret-engine-path=")
    two_word_flags+=("--signer-kms-hashivault-transit-secret-engine-path")
    local_nonpersistent_flags+=("--signer-kms-hashivault-transit-secret-engine-path")
    local_nonpersistent_flags+=("--signer-kms-hashivault-transit-secret-engine-path=")
    flags+=("--signer-kms-keyVersion=")
    two_word_flags+=("--signer-kms-keyVersion")
    local_nonpersistent_flags+=("--signer-kms-keyVersion")
    local_nonpersistent_flags+=("--signer-kms-keyVersion=")
    flags+=("--signer-kms-ref=")
    two_word_flags+=("--signer-kms-ref")
    local_nonpersistent_flags+=("--signer-kms-ref")
    local_nonpersistent_flags+=("--signer-kms-ref=")
    flags+=("--signer-spiffe-socket-path=")
    two_word_flags+=("--signer-spiffe-socket-path")
    local_nonpersistent_flags+=("--signer-spiffe-socket-path")
    local_nonpersistent_flags+=("--signer-spiffe-socket-path=")
    flags+=("--signer-vault-altnames=")
    two_word_flags+=("--signer-vault-altnames")
    local_nonpersistent_flags+=("--signer-vault-altnames")
    local_nonpersistent_flags+=("--signer-vault-altnames=")
    flags+=("--signer-vault-commonname=")
    two_word_flags+=("--signer-vault-commonname")
    local_nonpersistent_flags+=("--signer-vault-commonname")
    local_nonpersistent_flags+=("--signer-vault-commonname=")
    flags+=("--signer-vault-namespace=")
    two_word_flags+=("--signer-vault-namespace")
    local_nonpersistent_flags+=("--signer-vault-namespace")
    local_nonpersistent_flags+=("--signer-vault-namespace=")
    flags+=("--signer-vault-pki-secrets-engine-path=")
    two_word_flags+=("--signer-vault-pki-secrets-engine-path")
    local_nonpersistent_flags+=("--signer-vault-pki-secrets-engine-path")
    local_nonpersistent_flags+=("--signer-vault-pki-secrets-engine-path=")
    flags+=("--signer-vault-role=")
    two_word_flags+=("--signer-vault-role")
    local_nonpersistent_flags+=("--signer-vault-role")
    local_nonpersistent_flags+=("--signer-vault-role=")
    flags+=("--signer-vault-token=")
    two_word_flags+=("--signer-vault-token")
    local_nonpersistent_flags+=("--signer-vault-token")
    local_nonpersistent_flags+=("--signer-vault-token=")
    flags+=("--signer-vault-ttl=")
    two_word_flags+=("--signer-vault-ttl")
    local_nonpersistent_flags+=("--signer-vault-ttl")
    local_nonpersistent_flags+=("--signer-vault-ttl=")
    flags+=("--signer-vault-url=")
    two_word_flags+=("--signer-vault-url")
    local_nonpersistent_flags+=("--signer-vault-url")
    local_nonpersistent_flags+=("--signer-vault-url=")
    flags+=("--timestamp-servers=")
    two_word_flags+=("--timestamp-servers")
    local_nonpersistent_flags+=("--timestamp-servers")
    local_nonpersistent_flags+=("--timestamp-servers=")
    flags+=("--config=")
    two_word_flags+=("--config")
    two_word_flags+=("-c")
    flags+=("--debug-cpu-profile-file=")
    two_word_flags+=("--debug-cpu-profile-file")
    flags+=("--debug-mem-profile-file=")
    two_word_flags+=("--debug-mem-profile-file")
    flags+=("--log-level=")
    two_word_flags+=("--log-level")
    two_word_flags+=("-l")

    must_have_one_flag=()
    must_have_one_noun=()
    noun_aliases=()
}

_witness_verify()
{
    last_command="witness_verify"

    command_aliases=()

    commands=()

    flags=()
    two_word_flags=()
    local_nonpersistent_flags=()
    flags_with_completion=()
    flags_completion=()

    flags+=("--archivista-headers=")
    two_word_flags+=("--archivista-headers")
    local_nonpersistent_flags+=("--archivista-headers")
    local_nonpersistent_flags+=("--archivista-headers=")
    flags+=("--archivista-server=")
    two_word_flags+=("--archivista-server")
    local_nonpersistent_flags+=("--archivista-server")
    local_nonpersistent_flags+=("--archivista-server=")
    flags+=("--artifactfile=")
    two_word_flags+=("--artifactfile")
    two_word_flags+=("-f")
    local_nonpersistent_flags+=("--artifactfile")
    local_nonpersistent_flags+=("--artifactfile=")
    local_nonpersistent_flags+=("-f")
    flags+=("--attestations=")
    two_word_flags+=("--attestations")
    two_word_flags+=("-a")
    local_nonpersistent_flags+=("--attestations")
    local_nonpersistent_flags+=("--attestations=")
    local_nonpersistent_flags+=("-a")
    flags+=("--directory-path=")
    two_word_flags+=("--directory-path")
    local_nonpersistent_flags+=("--directory-path")
    local_nonpersistent_flags+=("--directory-path=")
    flags+=("--enable-archivista")
    local_nonpersistent_flags+=("--enable-archivista")
    flags+=("--policy=")
    two_word_flags+=("--policy")
    two_word_flags+=("-p")
    local_nonpersistent_flags+=("--policy")
    local_nonpersistent_flags+=("--policy=")
    local_nonpersistent_flags+=("-p")
    flags+=("--policy-ca=")
    two_word_flags+=("--policy-ca")
    local_nonpersistent_flags+=("--policy-ca")
    local_nonpersistent_flags+=("--policy-ca=")
    flags+=("--policy-ca-intermediates=")
    two_word_flags+=("--policy-ca-intermediates")
    local_nonpersistent_flags+=("--policy-ca-intermediates")
    local_nonpersistent_flags+=("--policy-ca-intermediates=")
    flags+=("--policy-ca-roots=")
    two_word_flags+=("--policy-ca-roots")
    local_nonpersistent_flags+=("--policy-ca-roots")
    local_nonpersistent_flags+=("--policy-ca-roots=")
    flags+=("--policy-commonname=")
    two_word_flags+=("--policy-commonname")
    local_nonpersistent_flags+=("--policy-commonname")
    local_nonpersistent_flags+=("--policy-commonname=")
    flags+=("--policy-dns-names=")
    two_word_flags+=("--policy-dns-names")
    local_nonpersistent_flags+=("--policy-dns-names")
    local_nonpersistent_flags+=("--policy-dns-names=")
    flags+=("--policy-emails=")
    two_word_flags+=("--policy-emails")
    local_nonpersistent_flags+=("--policy-emails")
    local_nonpersistent_flags+=("--policy-emails=")
    flags+=("--policy-fulcio-build-trigger=")
    two_word_flags+=("--policy-fulcio-build-trigger")
    local_nonpersistent_flags+=("--policy-fulcio-build-trigger")
    local_nonpersistent_flags+=("--policy-fulcio-build-trigger=")
    flags+=("--policy-fulcio-oidc-issuer=")
    two_word_flags+=("--policy-fulcio-oidc-issuer")
    local_nonpersistent_flags+=("--policy-fulcio-oidc-issuer")
    local_nonpersistent_flags+=("--policy-fulcio-oidc-issuer=")
    flags+=("--policy-fulcio-run-invocation-uri=")
    two_word_flags+=("--policy-fulcio-run-invocation-uri")
    local_nonpersistent_flags+=("--policy-fulcio-run-invocation-uri")
    local_nonpersistent_flags+=("--policy-fulcio-run-invocation-uri=")
    flags+=("--policy-fulcio-source-repository-digest=")
    two_word_flags+=("--policy-fulcio-source-repository-digest")
    local_nonpersistent_flags+=("--policy-fulcio-source-repository-digest")
    local_nonpersistent_flags+=("--policy-fulcio-source-repository-digest=")
    flags+=("--policy-fulcio-source-repository-identifier=")
    two_word_flags+=("--policy-fulcio-source-repository-identifier")
    local_nonpersistent_flags+=("--policy-fulcio-source-repository-identifier")
    local_nonpersistent_flags+=("--policy-fulcio-source-repository-identifier=")
    flags+=("--policy-fulcio-source-repository-ref=")
    two_word_flags+=("--policy-fulcio-source-repository-ref")
    local_nonpersistent_flags+=("--policy-fulcio-source-repository-ref")
    local_nonpersistent_flags+=("--policy-fulcio-source-repository-ref=")
    flags+=("--policy-organizations=")
    two_word_flags+=("--policy-organizations")
    local_nonpersistent_flags+=("--policy-organizations")
    local_nonpersistent_flags+=("--policy-organizations=")
    flags+=("--policy-timestamp-servers=")
    two_word_flags+=("--policy-timestamp-servers")
    local_nonpersistent_flags+=("--policy-timestamp-servers")
    local_nonpersistent_flags+=("--policy-timestamp-servers=")
    flags+=("--policy-uris=")
    two_word_flags+=("--policy-uris")
    local_nonpersistent_flags+=("--policy-uris")
    local_nonpersistent_flags+=("--policy-uris=")
    flags+=("--publickey=")
    two_word_flags+=("--publickey")
    two_word_flags+=("-k")
    local_nonpersistent_flags+=("--publickey")
    local_nonpersistent_flags+=("--publickey=")
    local_nonpersistent_flags+=("-k")
    flags+=("--subjects=")
    two_word_flags+=("--subjects")
    two_word_flags+=("-s")
    local_nonpersistent_flags+=("--subjects")
    local_nonpersistent_flags+=("--subjects=")
    local_nonpersistent_flags+=("-s")
    flags+=("--verifier-kms-aws-config-file=")
    two_word_flags+=("--verifier-kms-aws-config-file")
    local_nonpersistent_flags+=("--verifier-kms-aws-config-file")
    local_nonpersistent_flags+=("--verifier-kms-aws-config-file=")
    flags+=("--verifier-kms-aws-credentials-file=")
    two_word_flags+=("--verifier-kms-aws-credentials-file")
    local_nonpersistent_flags+=("--verifier-kms-aws-credentials-file")
    local_nonpersistent_flags+=("--verifier-kms-aws-credentials-file=")
    flags+=("--verifier-kms-aws-insecure-skip-verify")
    local_nonpersistent_flags+=("--verifier-kms-aws-insecure-skip-verify")
    flags+=("--verifier-kms-aws-profile=")
    two_word_flags+=("--verifier-kms-aws-profile")
    local_nonpersistent_flags+=("--verifier-kms-aws-profile")
    local_nonpersistent_flags+=("--verifier-kms-aws-profile=")
    flags+=("--verifier-kms-aws-remote-verify")
    local_nonpersistent_flags+=("--verifier-kms-aws-remote-verify")
    flags+=("--verifier-kms-gcp-authorized-user")
    local_nonpersistent_flags+=("--verifier-kms-gcp-authorized-user")
    flags+=("--verifier-kms-gcp-credentials-file=")
    two_word_flags+=("--verifier-kms-gcp-credentials-file")
    local_nonpersistent_flags+=("--verifier-kms-gcp-credentials-file")
    local_nonpersistent_flags+=("--verifier-kms-gcp-credentials-file=")
    flags+=("--verifier-kms-gcp-service-account")
    local_nonpersistent_flags+=("--verifier-kms-gcp-service-account")
    flags+=("--verifier-kms-hashType=")
    two_word_flags+=("--verifier-kms-hashType")
    local_nonpersistent_flags+=("--verifier-kms-hashType")
    local_nonpersistent_flags+=("--verifier-kms-hashType=")
    flags+=("--verifier-kms-hashivault-addr=")
    two_word_flags+=("--verifier-kms-hashivault-addr")
    local_nonpersistent_flags+=("--verifier-kms-hashivault-addr")
    local_nonpersistent_flags+=("--verifier-kms-hashivault-addr=")
    flags+=("--verifier-kms-hashivault-auth-method=")
    two_word_flags+=("--verifier-kms-hashivault-auth-method")
    local_nonpersistent_flags+=("--verifier-kms-hashivault-auth-method")
    local_nonpersistent_flags+=("--verifier-kms-hashivault-auth-method=")
    flags+=("--verifier-kms-hashivault-kubernetes-auth-mount-path=")
    two_word_flags+=("--verifier-kms-hashivault-kubernetes-auth-mount-path")
    local_nonpersistent_flags+=("--verifier-kms-hashivault-kubernetes-auth-mount-path")
    local_nonpersistent_flags+=("--verifier-kms-hashivault-kubernetes-auth-mount-path=")
    flags+=("--verifier-kms-hashivault-kubernetes-service-account-token-path=")
    two_word_flags+=("--verifier-kms-hashivault-kubernetes-service-account-token-path")
    local_nonpersistent_flags+=("--verifier-kms-hashivault-kubernetes-service-account-token-path")
    local_nonpersistent_flags+=("--verifier-kms-hashivault-kubernetes-service-account-token-path=")
    flags+=("--verifier-kms-hashivault-role=")
    two_word_flags+=("--verifier-kms-hashivault-role")
    local_nonpersistent_flags+=("--verifier-kms-hashivault-role")
    local_nonpersistent_flags+=("--verifier-kms-hashivault-role=")
    flags+=("--verifier-kms-hashivault-token-file=")
    two_word_flags+=("--verifier-kms-hashivault-token-file")
    local_nonpersistent_flags+=("--verifier-kms-hashivault-token-file")
    local_nonpersistent_flags+=("--verifier-kms-hashivault-token-file=")
    flags+=("--verifier-kms-hashivault-transit-secret-engine-path=")
    two_word_flags+=("--verifier-kms-hashivault-transit-secret-engine-path")
    local_nonpersistent_flags+=("--verifier-kms-hashivault-transit-secret-engine-path")
    local_nonpersistent_flags+=("--verifier-kms-hashivault-transit-secret-engine-path=")
    flags+=("--verifier-kms-keyVersion=")
    two_word_flags+=("--verifier-kms-keyVersion")
    local_nonpersistent_flags+=("--verifier-kms-keyVersion")
    local_nonpersistent_flags+=("--verifier-kms-keyVersion=")
    flags+=("--verifier-kms-ref=")
    two_word_flags+=("--verifier-kms-ref")
    local_nonpersistent_flags+=("--verifier-kms-ref")
    local_nonpersistent_flags+=("--verifier-kms-ref=")
    flags+=("--config=")
    two_word_flags+=("--config")
    two_word_flags+=("-c")
    flags+=("--debug-cpu-profile-file=")
    two_word_flags+=("--debug-cpu-profile-file")
    flags+=("--debug-mem-profile-file=")
    two_word_flags+=("--debug-mem-profile-file")
    flags+=("--log-level=")
    two_word_flags+=("--log-level")
    two_word_flags+=("-l")

    must_have_one_flag=()
    must_have_one_noun=()
    noun_aliases=()
}

_witness_version()
{
    last_command="witness_version"

    command_aliases=()

    commands=()

    flags=()
    two_word_flags=()
    local_nonpersistent_flags=()
    flags_with_completion=()
    flags_completion=()

    flags+=("--config=")
    two_word_flags+=("--config")
    two_word_flags+=("-c")
    flags+=("--debug-cpu-profile-file=")
    two_word_flags+=("--debug-cpu-profile-file")
    flags+=("--debug-mem-profile-file=")
    two_word_flags+=("--debug-mem-profile-file")
    flags+=("--log-level=")
    two_word_flags+=("--log-level")
    two_word_flags+=("-l")

    must_have_one_flag=()
    must_have_one_noun=()
    noun_aliases=()
}

_witness_root_command()
{
    last_command="witness"

    command_aliases=()

    commands=()
    commands+=("attestors")
    commands+=("completion")
    commands+=("help")
    commands+=("policy")
    commands+=("run")
    commands+=("sign")
    commands+=("verify")
    commands+=("version")

    flags=()
    two_word_flags=()
    local_nonpersistent_flags=()
    flags_with_completion=()
    flags_completion=()

    flags+=("--config=")
    two_word_flags+=("--config")
    two_word_flags+=("-c")
    flags+=("--debug-cpu-profile-file=")
    two_word_flags+=("--debug-cpu-profile-file")
    flags+=("--debug-mem-profile-file=")
    two_word_flags+=("--debug-mem-profile-file")
    flags+=("--log-level=")
    two_word_flags+=("--log-level")
    two_word_flags+=("-l")

    must_have_one_flag=()
    must_have_one_noun=()
    noun_aliases=()
}

__start_witness()
{
    local cur prev words cword split
    declare -A flaghash 2>/dev/null || :
    declare -A aliashash 2>/dev/null || :
    if declare -F _init_completion >/dev/null 2>&1; then
        _init_completion -s || return
    else
        __witness_init_completion -n "=" || return
    fi

    local c=0
    local flag_parsing_disabled=
    local flags=()
    local two_word_flags=()
    local local_nonpersistent_flags=()
    local flags_with_completion=()
    local flags_completion=()
    local commands=("witness")
    local command_aliases=()
    local must_have_one_flag=()
    local must_have_one_noun=()
    local has_completion_function=""
    local last_command=""
    local nouns=()
    local noun_aliases=()

    __witness_handle_word
}

if [[ $(type -t compopt) = "builtin" ]]; then
    complete -o default -F __start_witness witness
else
    complete -o default -o nospace -F __start_witness witness
fi

# ex: ts=4 sw=4 et filetype=sh
