#compdef sslteam

_sslteam() {
  local state
  local -a _sslteam_saved_words
  local _sslteam_saved_current
  _arguments -C \
    '-h[Show this help message and exit.]' \
    '--help[Show this help message and exit.]' \
    '-V[Print version information and exit.]' \
    '--version[Print version information and exit.]' \
    '1:command:->command' \
    '*::arg:->args'
  case $state in
    command)
      local -a _sslteam_commands=(
        'auth:Authentication commands'
        'ping:Call authenticated ping endpoint using locally stored token session'
        'version:Show the CLI version'
        'config:Manage CLI preferences'
        'completion:Generate Bash or Zsh tab-completion script'
        'tls:Manage origin-scoped TLS trust profiles'
        'ca:Certificate authority operations (local custody + server-managed PKI)'
        'cert:Certificate operations'
      )
      _describe -t commands 'command' _sslteam_commands
      ;;
    args)
      case $words[2] in
        auth) _sslteam_auth ;;
        ping) _sslteam_ping ;;
        version) _sslteam_version ;;
        config) _sslteam_config ;;
        completion) _sslteam_completion ;;
        tls) _sslteam_tls ;;
        ca) _sslteam_ca ;;
        cert) _sslteam_cert ;;
      esac
      ;;
  esac
}

_sslteam_auth() {
  local state
  local -a _sslteam_saved_words
  local _sslteam_saved_current
  _sslteam_saved_words=("${words[@]}")
  _sslteam_saved_current=$CURRENT
  words=("_sslteam" "${words[@]:2}")
  CURRENT=$((CURRENT - 1))
  _arguments -C \
    '1:command:->command' \
    '*::arg:->args'
  case $state in
    command)
      local -a _sslteam_commands=(
        'device:Authenticate using OAuth device flow and store local session'
        'password:Authenticate with username/password and store local session'
        'logout:Revoke the current session and clear local credentials'
        'logout-all:Revoke every server session and clear local credentials'
      )
      _describe -t commands 'command' _sslteam_commands
      ;;
    args)
      case $words[2] in
        device) _sslteam_auth_device ;;
        password) _sslteam_auth_password ;;
        logout) _sslteam_auth_logout ;;
        logout-all) _sslteam_auth_logout_all ;;
      esac
      ;;
  esac
  words=("${_sslteam_saved_words[@]}")
  CURRENT=$_sslteam_saved_current
}

_sslteam_auth_device() {
  local state
  local -a _sslteam_saved_words
  local _sslteam_saved_current
  _sslteam_saved_words=("${words[@]}")
  _sslteam_saved_current=$CURRENT
  words=("_sslteam" "${words[@]:2}")
  CURRENT=$((CURRENT - 1))
  _arguments -C \
    '--base-url[Override backend URL for this command]:<baseUrl>:' \
    '--diag[Enable JWT diagnostics for this command run]'
  words=("${_sslteam_saved_words[@]}")
  CURRENT=$_sslteam_saved_current
}

_sslteam_auth_password() {
  local state
  local -a _sslteam_saved_words
  local _sslteam_saved_current
  _sslteam_saved_words=("${words[@]}")
  _sslteam_saved_current=$CURRENT
  words=("_sslteam" "${words[@]:2}")
  CURRENT=$((CURRENT - 1))
  _arguments -C \
    '--base-url[Override backend URL for this command]:<baseUrl>:' \
    '--username[Username for direct login]:<username>:' \
    '--password[Password for direct login]:<password>:' \
    '--password-file[Path to a file containing the current password]:<passwordFile>:' \
    '--new-password-file[Path to a file containing the replacement password for initial password change]:<newPasswordFile>:' \
    '--diag[Enable JWT diagnostics for this command run]'
  words=("${_sslteam_saved_words[@]}")
  CURRENT=$_sslteam_saved_current
}

_sslteam_auth_logout() {
  local state
  local -a _sslteam_saved_words
  local _sslteam_saved_current
  _sslteam_saved_words=("${words[@]}")
  _sslteam_saved_current=$CURRENT
  words=("_sslteam" "${words[@]:2}")
  CURRENT=$((CURRENT - 1))
  _arguments -C \
    '--base-url[Override backend URL for this command]:<baseUrl>:'
  words=("${_sslteam_saved_words[@]}")
  CURRENT=$_sslteam_saved_current
}

_sslteam_auth_logout_all() {
  local state
  local -a _sslteam_saved_words
  local _sslteam_saved_current
  _sslteam_saved_words=("${words[@]}")
  _sslteam_saved_current=$CURRENT
  words=("_sslteam" "${words[@]:2}")
  CURRENT=$((CURRENT - 1))
  _arguments -C \
    '--base-url[Override backend URL for this command]:<baseUrl>:'
  words=("${_sslteam_saved_words[@]}")
  CURRENT=$_sslteam_saved_current
}

_sslteam_ping() {
  local state
  local -a _sslteam_saved_words
  local _sslteam_saved_current
  _sslteam_saved_words=("${words[@]}")
  _sslteam_saved_current=$CURRENT
  words=("_sslteam" "${words[@]:2}")
  CURRENT=$((CURRENT - 1))
  _arguments -C \
    '--base-url[Override backend URL for this command]:<baseUrl>:' \
    '--diag[Enable JWT diagnostics for this command run]'
  words=("${_sslteam_saved_words[@]}")
  CURRENT=$_sslteam_saved_current
}

_sslteam_version() {
  local state
  local -a _sslteam_saved_words
  local _sslteam_saved_current
  _sslteam_saved_words=("${words[@]}")
  _sslteam_saved_current=$CURRENT
  words=("_sslteam" "${words[@]:2}")
  CURRENT=$((CURRENT - 1))
  _arguments -C \
    '*::arg:'
  words=("${_sslteam_saved_words[@]}")
  CURRENT=$_sslteam_saved_current
}

_sslteam_config() {
  local state
  local -a _sslteam_saved_words
  local _sslteam_saved_current
  _sslteam_saved_words=("${words[@]}")
  _sslteam_saved_current=$CURRENT
  words=("_sslteam" "${words[@]:2}")
  CURRENT=$((CURRENT - 1))
  _arguments -C \
    '1:command:->command' \
    '*::arg:->args'
  case $state in
    command)
      local -a _sslteam_commands=(
        'set:Save CLI backend and scope preferences'
        'show:Show stored and effective CLI preferences'
      )
      _describe -t commands 'command' _sslteam_commands
      ;;
    args)
      case $words[2] in
        set) _sslteam_config_set ;;
        show) _sslteam_config_show ;;
      esac
      ;;
  esac
  words=("${_sslteam_saved_words[@]}")
  CURRENT=$_sslteam_saved_current
}

_sslteam_config_set() {
  local state
  local -a _sslteam_saved_words
  local _sslteam_saved_current
  _sslteam_saved_words=("${words[@]}")
  _sslteam_saved_current=$CURRENT
  words=("_sslteam" "${words[@]:2}")
  CURRENT=$((CURRENT - 1))
  _arguments -C \
    '--base-url[Backend base URL]:<baseUrl>:' \
    '--team-code[Default team code]:<teamCode>:' \
    '--environment[Default environment code]:<environment>:'
  words=("${_sslteam_saved_words[@]}")
  CURRENT=$_sslteam_saved_current
}

_sslteam_config_show() {
  local state
  local -a _sslteam_saved_words
  local _sslteam_saved_current
  _sslteam_saved_words=("${words[@]}")
  _sslteam_saved_current=$CURRENT
  words=("_sslteam" "${words[@]:2}")
  CURRENT=$((CURRENT - 1))
  _arguments -C \
    '*::arg:'
  words=("${_sslteam_saved_words[@]}")
  CURRENT=$_sslteam_saved_current
}

_sslteam_completion() {
  local state
  local -a _sslteam_saved_words
  local _sslteam_saved_current
  _sslteam_saved_words=("${words[@]}")
  _sslteam_saved_current=$CURRENT
  words=("_sslteam" "${words[@]:2}")
  CURRENT=$((CURRENT - 1))
  _arguments -C \
    '0:<shell>:'
  words=("${_sslteam_saved_words[@]}")
  CURRENT=$_sslteam_saved_current
}

_sslteam_tls() {
  local state
  local -a _sslteam_saved_words
  local _sslteam_saved_current
  _sslteam_saved_words=("${words[@]}")
  _sslteam_saved_current=$CURRENT
  words=("_sslteam" "${words[@]:2}")
  CURRENT=$((CURRENT - 1))
  _arguments -C \
    '1:command:->command' \
    '*::arg:->args'
  case $state in
    command)
      local -a _sslteam_commands=(
        'tofu:Discover a certificate and explicitly approve its fingerprint'
        'trust-store:Use a public PEM trust store for an HTTPS origin'
        'show:Show persisted TLS trust profiles'
        'replace:Explicitly replace an existing TOFU fingerprint'
        'forget:Forget persisted TLS trust for an origin'
      )
      _describe -t commands 'command' _sslteam_commands
      ;;
    args)
      case $words[2] in
        tofu) _sslteam_tls_tofu ;;
        trust-store) _sslteam_tls_trust_store ;;
        show) _sslteam_tls_show ;;
        replace) _sslteam_tls_replace ;;
        forget) _sslteam_tls_forget ;;
      esac
      ;;
  esac
  words=("${_sslteam_saved_words[@]}")
  CURRENT=$_sslteam_saved_current
}

_sslteam_tls_tofu() {
  local state
  local -a _sslteam_saved_words
  local _sslteam_saved_current
  _sslteam_saved_words=("${words[@]}")
  _sslteam_saved_current=$CURRENT
  words=("_sslteam" "${words[@]:2}")
  CURRENT=$((CURRENT - 1))
  _arguments -C \
    '--origin[HTTPS origin, including optional port]:<originValue>:' \
    '--fingerprint[Complete SHA-256 fingerprint to approve]:<fingerprint>:'
  words=("${_sslteam_saved_words[@]}")
  CURRENT=$_sslteam_saved_current
}

_sslteam_tls_trust_store() {
  local state
  local -a _sslteam_saved_words
  local _sslteam_saved_current
  _sslteam_saved_words=("${words[@]}")
  _sslteam_saved_current=$CURRENT
  words=("_sslteam" "${words[@]:2}")
  CURRENT=$((CURRENT - 1))
  _arguments -C \
    '--origin[HTTPS origin, including optional port]:<originValue>:' \
    '--path[Public X.509 PEM trust-store path]:<pathValue>:'
  words=("${_sslteam_saved_words[@]}")
  CURRENT=$_sslteam_saved_current
}

_sslteam_tls_show() {
  local state
  local -a _sslteam_saved_words
  local _sslteam_saved_current
  _sslteam_saved_words=("${words[@]}")
  _sslteam_saved_current=$CURRENT
  words=("_sslteam" "${words[@]:2}")
  CURRENT=$((CURRENT - 1))
  _arguments -C \
    '--origin[Show only this HTTPS origin]:<originValue>:'
  words=("${_sslteam_saved_words[@]}")
  CURRENT=$_sslteam_saved_current
}

_sslteam_tls_replace() {
  local state
  local -a _sslteam_saved_words
  local _sslteam_saved_current
  _sslteam_saved_words=("${words[@]}")
  _sslteam_saved_current=$CURRENT
  words=("_sslteam" "${words[@]:2}")
  CURRENT=$((CURRENT - 1))
  _arguments -C \
    '--origin[HTTPS origin, including optional port]:<originValue>:' \
    '--fingerprint[Freshly discovered SHA-256 fingerprint to approve]:<fingerprint>:'
  words=("${_sslteam_saved_words[@]}")
  CURRENT=$_sslteam_saved_current
}

_sslteam_tls_forget() {
  local state
  local -a _sslteam_saved_words
  local _sslteam_saved_current
  _sslteam_saved_words=("${words[@]}")
  _sslteam_saved_current=$CURRENT
  words=("_sslteam" "${words[@]:2}")
  CURRENT=$((CURRENT - 1))
  _arguments -C \
    '--origin[HTTPS origin, including optional port]:<originValue>:' \
    '--yes[Confirm removal of the persisted trust profile]'
  words=("${_sslteam_saved_words[@]}")
  CURRENT=$_sslteam_saved_current
}

_sslteam_ca() {
  local state
  local -a _sslteam_saved_words
  local _sslteam_saved_current
  _sslteam_saved_words=("${words[@]}")
  _sslteam_saved_current=$CURRENT
  words=("_sslteam" "${words[@]:2}")
  CURRENT=$((CURRENT - 1))
  _arguments -C \
    '1:command:->command' \
    '*::arg:->args'
  case $state in
    command)
      local -a _sslteam_commands=(
        'status:Show root and intermediate CA status overview'
        'root:Manage local offline roots and server application Root lifecycle'
        'intermediate:Intermediate certificate authority commands'
        'trust:List, install, verify, or remove a CA from a platform trust store'
      )
      _describe -t commands 'command' _sslteam_commands
      ;;
    args)
      case $words[2] in
        status) _sslteam_ca_status ;;
        root) _sslteam_ca_root ;;
        intermediate) _sslteam_ca_intermediate ;;
        trust) _sslteam_ca_trust ;;
      esac
      ;;
  esac
  words=("${_sslteam_saved_words[@]}")
  CURRENT=$_sslteam_saved_current
}

_sslteam_ca_status() {
  local state
  local -a _sslteam_saved_words
  local _sslteam_saved_current
  _sslteam_saved_words=("${words[@]}")
  _sslteam_saved_current=$CURRENT
  words=("_sslteam" "${words[@]:2}")
  CURRENT=$((CURRENT - 1))
  _arguments -C \
    '--base-url[Override backend URL for this command]:<baseUrl>:' \
    '--team-code[Team code owning the local PKI custody scope]:<teamCode>:' \
    '--environment[Environment code for local PKI custody]:<environment>:' \
    '--storage-implementation[Storage implementation id (default: fs)]:<storageImplementation>:' \
    '--storage-location[Implementation-specific storage location (for fs default: configured CLI home/ca)]:<storageLocation>:' \
    '--storage-param[Implementation-specific key=value storage parameter. Repeat as needed.]:<storageParams>:'
  words=("${_sslteam_saved_words[@]}")
  CURRENT=$_sslteam_saved_current
}

_sslteam_ca_root() {
  local state
  local -a _sslteam_saved_words
  local _sslteam_saved_current
  _sslteam_saved_words=("${words[@]}")
  _sslteam_saved_current=$CURRENT
  words=("_sslteam" "${words[@]:2}")
  CURRENT=$((CURRENT - 1))
  _arguments -C \
    '1:command:->command' \
    '*::arg:->args'
  case $state in
    command)
      local -a _sslteam_commands=(
        'list:List server Root authority and local Root custody'
        'create:Create a local offline root CA'
        'import:Import existing root CA material into local store'
        'show:Show local CA metadata and certificate/key details'
        'remove:Remove local root CA certificate and private key material'
        'setup:Create the server application Root and initial Intermediate in a one-time ceremony'
        'download:Download public server Root material'
        'retire:Retire the server-managed application Root'
        'revoke:Revoke the server-managed application Root'
      )
      _describe -t commands 'command' _sslteam_commands
      ;;
    args)
      case $words[2] in
        list) _sslteam_ca_root_list ;;
        create) _sslteam_ca_root_create ;;
        import) _sslteam_ca_root_import ;;
        show) _sslteam_ca_root_show ;;
        remove) _sslteam_ca_root_remove ;;
        setup) _sslteam_ca_root_setup ;;
        download) _sslteam_ca_root_download ;;
        retire) _sslteam_ca_root_retire ;;
        revoke) _sslteam_ca_root_revoke ;;
      esac
      ;;
  esac
  words=("${_sslteam_saved_words[@]}")
  CURRENT=$_sslteam_saved_current
}

_sslteam_ca_root_list() {
  local state
  local -a _sslteam_saved_words
  local _sslteam_saved_current
  _sslteam_saved_words=("${words[@]}")
  _sslteam_saved_current=$CURRENT
  words=("_sslteam" "${words[@]:2}")
  CURRENT=$((CURRENT - 1))
  _arguments -C \
    '--base-url[Override backend URL for this command]:<baseUrl>:' \
    '--team-code[Team code owning the local PKI custody scope]:<teamCode>:' \
    '--environment[Environment code for local PKI custody]:<environment>:' \
    '--storage-implementation[Storage implementation id (default: fs)]:<storageImplementation>:' \
    '--storage-location[Implementation-specific storage location (for fs default: configured CLI home/ca)]:<storageLocation>:' \
    '--storage-param[Implementation-specific key=value storage parameter. Repeat as needed.]:<storageParams>:'
  words=("${_sslteam_saved_words[@]}")
  CURRENT=$_sslteam_saved_current
}

_sslteam_ca_root_create() {
  local state
  local -a _sslteam_saved_words
  local _sslteam_saved_current
  _sslteam_saved_words=("${words[@]}")
  _sslteam_saved_current=$CURRENT
  words=("_sslteam" "${words[@]:2}")
  CURRENT=$((CURRENT - 1))
  _arguments -C \
    '--base-url[Override backend URL for this command]:<baseUrl>:' \
    '--name[Local CA name (lowercase, 3-64 chars)]:<name>:' \
    '--algo[CA key algorithm: ecdsa-p256 or rsa-3072]:<algorithm>:' \
    '--team-code[Team code owning the local PKI custody scope]:<teamCode>:' \
    '--environment[Environment code for local PKI custody]:<environment>:' \
    '--storage-implementation[Storage implementation id (default: fs)]:<storageImplementation>:' \
    '--storage-location[Implementation-specific storage location (for fs default: configured CLI home/ca)]:<storageLocation>:' \
    '--storage-param[Implementation-specific key=value storage parameter. Repeat as needed.]:<storageParams>:' \
    '--passphrase[Passphrase for encrypting the CA private key]:<passphrase>:'
  words=("${_sslteam_saved_words[@]}")
  CURRENT=$_sslteam_saved_current
}

_sslteam_ca_root_import() {
  local state
  local -a _sslteam_saved_words
  local _sslteam_saved_current
  _sslteam_saved_words=("${words[@]}")
  _sslteam_saved_current=$CURRENT
  words=("_sslteam" "${words[@]:2}")
  CURRENT=$((CURRENT - 1))
  _arguments -C \
    '--base-url[Override backend URL for this command]:<baseUrl>:' \
    '--name[Local alias for imported CA]:<name>:' \
    '--root-cert[Path to root CA certificate PEM]:<rootCertificatePath>:' \
    '--root-key[Path to root CA private key PEM]:<rootPrivateKeyPath>:' \
    '--team-code[Team code owning the local PKI custody scope]:<teamCode>:' \
    '--environment[Environment code for local PKI custody]:<environment>:' \
    '--storage-implementation[Storage implementation id (default: fs)]:<storageImplementation>:' \
    '--storage-location[Implementation-specific storage location (for fs default: configured CLI home/ca)]:<storageLocation>:' \
    '--storage-param[Implementation-specific key=value storage parameter. Repeat as needed.]:<storageParams>:' \
    '--passphrase[Passphrase to decrypt and re-encrypt imported private key]:<passphrase>:'
  words=("${_sslteam_saved_words[@]}")
  CURRENT=$_sslteam_saved_current
}

_sslteam_ca_root_show() {
  local state
  local -a _sslteam_saved_words
  local _sslteam_saved_current
  _sslteam_saved_words=("${words[@]}")
  _sslteam_saved_current=$CURRENT
  words=("_sslteam" "${words[@]:2}")
  CURRENT=$((CURRENT - 1))
  _arguments -C \
    '--base-url[Override backend URL for this command]:<baseUrl>:' \
    '--name[Local CA name]:<name>:' \
    '--team-code[Team code owning the local PKI custody scope]:<teamCode>:' \
    '--environment[Environment code for local PKI custody]:<environment>:' \
    '--storage-implementation[Storage implementation id (default: fs)]:<storageImplementation>:' \
    '--storage-location[Implementation-specific storage location (for fs default: configured CLI home/ca)]:<storageLocation>:' \
    '--storage-param[Implementation-specific key=value storage parameter. Repeat as needed.]:<storageParams>:' \
    '--passphrase[Optional passphrase to verify private key matches certificate]:<passphrase>:'
  words=("${_sslteam_saved_words[@]}")
  CURRENT=$_sslteam_saved_current
}

_sslteam_ca_root_remove() {
  local state
  local -a _sslteam_saved_words
  local _sslteam_saved_current
  _sslteam_saved_words=("${words[@]}")
  _sslteam_saved_current=$CURRENT
  words=("_sslteam" "${words[@]:2}")
  CURRENT=$((CURRENT - 1))
  _arguments -C \
    '--base-url[Override backend URL for this command]:<baseUrl>:' \
    '--name[Local CA name to clear]:<name>:' \
    '--team-code[Team code owning the local PKI custody scope]:<teamCode>:' \
    '--environment[Environment code for local PKI custody]:<environment>:' \
    '--storage-implementation[Storage implementation id (default: fs)]:<storageImplementation>:' \
    '--storage-location[Implementation-specific storage location (for fs default: configured CLI home/ca)]:<storageLocation>:' \
    '--storage-param[Implementation-specific key=value storage parameter. Repeat as needed.]:<storageParams>:' \
    '--confirm[Destructive-operation token. Run once without this option to get required token.]:<confirm>:'
  words=("${_sslteam_saved_words[@]}")
  CURRENT=$_sslteam_saved_current
}

_sslteam_ca_root_setup() {
  local state
  local -a _sslteam_saved_words
  local _sslteam_saved_current
  _sslteam_saved_words=("${words[@]}")
  _sslteam_saved_current=$CURRENT
  words=("_sslteam" "${words[@]:2}")
  CURRENT=$((CURRENT - 1))
  _arguments -C \
    '--base-url[Override backend URL for this command]:<baseUrl>:' \
    '--team-code[Team code owning the PKI family]:<teamCode>:' \
    '--environment[Environment code]:<environment>:' \
    '--common-name[Root certificate common name]:<commonName>:' \
    '--organization[Root certificate organization]:<organization>:' \
    '--organizational-unit[Root certificate organizational unit]:<organizationalUnit>:' \
    '--out-dir[Directory for the encrypted Root backup]:<outDir>:'
  words=("${_sslteam_saved_words[@]}")
  CURRENT=$_sslteam_saved_current
}

_sslteam_ca_root_download() {
  local state
  local -a _sslteam_saved_words
  local _sslteam_saved_current
  _sslteam_saved_words=("${words[@]}")
  _sslteam_saved_current=$CURRENT
  words=("_sslteam" "${words[@]:2}")
  CURRENT=$((CURRENT - 1))
  _arguments -C \
    '1:command:->command' \
    '*::arg:->args'
  case $state in
    command)
      local -a _sslteam_commands=(
        'certificate:Download the public server-managed application Root certificate'
      )
      _describe -t commands 'command' _sslteam_commands
      ;;
    args)
      case $words[2] in
        certificate) _sslteam_ca_root_download_certificate ;;
      esac
      ;;
  esac
  words=("${_sslteam_saved_words[@]}")
  CURRENT=$_sslteam_saved_current
}

_sslteam_ca_root_download_certificate() {
  local state
  local -a _sslteam_saved_words
  local _sslteam_saved_current
  _sslteam_saved_words=("${words[@]}")
  _sslteam_saved_current=$CURRENT
  words=("_sslteam" "${words[@]:2}")
  CURRENT=$((CURRENT - 1))
  _arguments -C \
    '--base-url[Override backend URL for this command]:<baseUrl>:' \
    '--team-code[Team code owning the PKI family]:<teamCode>:' \
    '--environment[Environment code]:<environment>:' \
    '--out-dir[Directory for the public certificate]:<outDir>:' \
    '--force[Replace an existing public certificate after validation]'
  words=("${_sslteam_saved_words[@]}")
  CURRENT=$_sslteam_saved_current
}

_sslteam_ca_root_retire() {
  local state
  local -a _sslteam_saved_words
  local _sslteam_saved_current
  _sslteam_saved_words=("${words[@]}")
  _sslteam_saved_current=$CURRENT
  words=("_sslteam" "${words[@]:2}")
  CURRENT=$((CURRENT - 1))
  _arguments -C \
    '--base-url[Override backend URL for this command]:<baseUrl>:' \
    '--team-code[Team code owning the PKI family]:<teamCode>:' \
    '--environment[Environment code]:<environment>:' \
    '--root-id[Server-managed Root ID]:<rootId>:' \
    '--confirm[Must exactly match --root-id]:<confirmation>:' \
    '--reason[Audit reason]:<reason>:'
  words=("${_sslteam_saved_words[@]}")
  CURRENT=$_sslteam_saved_current
}

_sslteam_ca_root_revoke() {
  local state
  local -a _sslteam_saved_words
  local _sslteam_saved_current
  _sslteam_saved_words=("${words[@]}")
  _sslteam_saved_current=$CURRENT
  words=("_sslteam" "${words[@]:2}")
  CURRENT=$((CURRENT - 1))
  _arguments -C \
    '--base-url[Override backend URL for this command]:<baseUrl>:' \
    '--team-code[Team code owning the PKI family]:<teamCode>:' \
    '--environment[Environment code]:<environment>:' \
    '--root-id[Server-managed Root ID]:<rootId>:' \
    '--confirm[Must exactly match --root-id]:<confirmation>:' \
    '--reason[Audit reason]:<reason>:'
  words=("${_sslteam_saved_words[@]}")
  CURRENT=$_sslteam_saved_current
}

_sslteam_ca_intermediate() {
  local state
  local -a _sslteam_saved_words
  local _sslteam_saved_current
  _sslteam_saved_words=("${words[@]}")
  _sslteam_saved_current=$CURRENT
  words=("_sslteam" "${words[@]:2}")
  CURRENT=$((CURRENT - 1))
  _arguments -C \
    '1:command:->command' \
    '*::arg:->args'
  case $state in
    command)
      local -a _sslteam_commands=(
        'status:Show intermediate status snapshot (active + pending)'
        'download:Download public active Intermediate material'
        'create:Create server-side intermediate request and CSR'
        'setup:Create, sign, and activate an intermediate'
        'sign:Sign one server-generated Intermediate CSR from an encrypted Root backup'
        'activate:Activate a signed intermediate certificate on server'
        'retire:Retire an issued Intermediate certificate'
        'revoke:Revoke an issued Intermediate certificate'
      )
      _describe -t commands 'command' _sslteam_commands
      ;;
    args)
      case $words[2] in
        status) _sslteam_ca_intermediate_status ;;
        download) _sslteam_ca_intermediate_download ;;
        create) _sslteam_ca_intermediate_create ;;
        setup) _sslteam_ca_intermediate_setup ;;
        sign) _sslteam_ca_intermediate_sign ;;
        activate) _sslteam_ca_intermediate_activate ;;
        retire) _sslteam_ca_intermediate_retire ;;
        revoke) _sslteam_ca_intermediate_revoke ;;
      esac
      ;;
  esac
  words=("${_sslteam_saved_words[@]}")
  CURRENT=$_sslteam_saved_current
}

_sslteam_ca_intermediate_status() {
  local state
  local -a _sslteam_saved_words
  local _sslteam_saved_current
  _sslteam_saved_words=("${words[@]}")
  _sslteam_saved_current=$CURRENT
  words=("_sslteam" "${words[@]:2}")
  CURRENT=$((CURRENT - 1))
  _arguments -C \
    '--base-url[Override backend URL for this command]:<baseUrl>:' \
    '--team-code[Team code owning the PKI family]:<teamCode>:' \
    '--environment[Environment code]:<environment>:'
  words=("${_sslteam_saved_words[@]}")
  CURRENT=$_sslteam_saved_current
}

_sslteam_ca_intermediate_download() {
  local state
  local -a _sslteam_saved_words
  local _sslteam_saved_current
  _sslteam_saved_words=("${words[@]}")
  _sslteam_saved_current=$CURRENT
  words=("_sslteam" "${words[@]:2}")
  CURRENT=$((CURRENT - 1))
  _arguments -C \
    '1:command:->command' \
    '*::arg:->args'
  case $state in
    command)
      local -a _sslteam_commands=(
        'certificate:Download the public active Intermediate certificate'
        'chain:Download the public active Intermediate chain'
      )
      _describe -t commands 'command' _sslteam_commands
      ;;
    args)
      case $words[2] in
        certificate) _sslteam_ca_intermediate_download_certificate ;;
        chain) _sslteam_ca_intermediate_download_chain ;;
      esac
      ;;
  esac
  words=("${_sslteam_saved_words[@]}")
  CURRENT=$_sslteam_saved_current
}

_sslteam_ca_intermediate_download_certificate() {
  local state
  local -a _sslteam_saved_words
  local _sslteam_saved_current
  _sslteam_saved_words=("${words[@]}")
  _sslteam_saved_current=$CURRENT
  words=("_sslteam" "${words[@]:2}")
  CURRENT=$((CURRENT - 1))
  _arguments -C \
    '--base-url[Override backend URL for this command]:<baseUrl>:' \
    '--team-code[Team code owning the PKI family]:<teamCode>:' \
    '--environment[Environment code]:<environment>:' \
    '--out-dir[Directory for the public certificate]:<outDir>:' \
    '--force[Replace an existing public certificate after validation]'
  words=("${_sslteam_saved_words[@]}")
  CURRENT=$_sslteam_saved_current
}

_sslteam_ca_intermediate_download_chain() {
  local state
  local -a _sslteam_saved_words
  local _sslteam_saved_current
  _sslteam_saved_words=("${words[@]}")
  _sslteam_saved_current=$CURRENT
  words=("_sslteam" "${words[@]:2}")
  CURRENT=$((CURRENT - 1))
  _arguments -C \
    '--base-url[Override backend URL for this command]:<baseUrl>:' \
    '--team-code[Team code owning the PKI family]:<teamCode>:' \
    '--environment[Environment code]:<environment>:' \
    '--out-dir[Directory for the public chain]:<outDir>:' \
    '--force[Replace an existing public chain after validation]'
  words=("${_sslteam_saved_words[@]}")
  CURRENT=$_sslteam_saved_current
}

_sslteam_ca_intermediate_create() {
  local state
  local -a _sslteam_saved_words
  local _sslteam_saved_current
  _sslteam_saved_words=("${words[@]}")
  _sslteam_saved_current=$CURRENT
  words=("_sslteam" "${words[@]:2}")
  CURRENT=$((CURRENT - 1))
  _arguments -C \
    '--base-url[Override backend URL for this command]:<baseUrl>:' \
    '--team-code[Team code owning the PKI family]:<teamCode>:' \
    '--environment[Environment code]:<environment>:' \
    '--name[Intermediate name]:<name>:' \
    '--algorithm[Intermediate key algorithm: ecdsa-p256 or rsa-3072]:<algorithm>:' \
    '--subject-dn[CSR subject DN, e.g. CN=sslteam-int-dev]:<subjectDn>:' \
    '--replace-active[Explicitly allow replacement of the currently active Intermediate]' \
    '--csr-out[Optional file path to persist returned CSR PEM]:<csrOut>:' \
    '--manifest-out[Optional file path; defaults to a request-specific manifest in the current directory]:<manifestOut>:'
  words=("${_sslteam_saved_words[@]}")
  CURRENT=$_sslteam_saved_current
}

_sslteam_ca_intermediate_setup() {
  local state
  local -a _sslteam_saved_words
  local _sslteam_saved_current
  _sslteam_saved_words=("${words[@]}")
  _sslteam_saved_current=$CURRENT
  words=("_sslteam" "${words[@]:2}")
  CURRENT=$((CURRENT - 1))
  _arguments -C \
    '--base-url[Override backend URL for this command]:<baseUrl>:' \
    '--team-code[Team code owning the PKI family]:<teamCode>:' \
    '--environment[Environment code]:<environment>:' \
    '--name[Intermediate name: 3-64 lowercase letters, digits, '\''.'\'', '\''_'\'' or '\''-'\''; e.g. int-dev]:<name>:' \
    '--subject-dn[CSR subject DN, e.g. CN=sslteam-int-dev]:<subjectDn>:' \
    '--replace-active[Explicitly allow replacement of the currently active Intermediate]' \
    '--algorithm[Intermediate key algorithm: ecdsa-p256 or rsa-3072]:<algorithm>:' \
    '--backup[Encrypted OpenPGP Root CA backup (.asc)]:<backup>:' \
    '--csr-out[Optional CSR output path]:<csrOut>:' \
    '--cert-out[Optional signed certificate output path]:<certOut>:' \
    '--chain-out[Optional certificate chain output path]:<chainOut>:'
  words=("${_sslteam_saved_words[@]}")
  CURRENT=$_sslteam_saved_current
}

_sslteam_ca_intermediate_sign() {
  local state
  local -a _sslteam_saved_words
  local _sslteam_saved_current
  _sslteam_saved_words=("${words[@]}")
  _sslteam_saved_current=$CURRENT
  words=("_sslteam" "${words[@]:2}")
  CURRENT=$((CURRENT - 1))
  _arguments -C \
    '--base-url[Override backend URL for this command]:<baseUrl>:' \
    '--backup[Encrypted OpenPGP Root CA backup (.asc)]:<backup>:' \
    '--manifest[Versioned Intermediate signing manifest JSON]:<manifest>:' \
    '--upload[Upload and activate the signed entry after signing]' \
    '--replace-active[Explicitly allow replacement of the currently active Intermediate]'
  words=("${_sslteam_saved_words[@]}")
  CURRENT=$_sslteam_saved_current
}

_sslteam_ca_intermediate_activate() {
  local state
  local -a _sslteam_saved_words
  local _sslteam_saved_current
  _sslteam_saved_words=("${words[@]}")
  _sslteam_saved_current=$CURRENT
  words=("_sslteam" "${words[@]:2}")
  CURRENT=$((CURRENT - 1))
  _arguments -C \
    '--base-url[Override backend URL for this command]:<baseUrl>:' \
    '--team-code[Team code owning the PKI family]:<teamCode>:' \
    '--environment[Environment code]:<environment>:' \
    '--name[Intermediate name]:<name>:' \
    '--request-id[Optional advanced request ID override]:<requestId>:' \
    '--intermediate-cert[Path to signed intermediate certificate PEM]:<intermediateCert>:' \
    '--chain[Path to the issuer chain PEM produced during offline signing]:<chain>:' \
    '--replace-active[Explicitly allow replacement of the currently active Intermediate]'
  words=("${_sslteam_saved_words[@]}")
  CURRENT=$_sslteam_saved_current
}

_sslteam_ca_intermediate_retire() {
  local state
  local -a _sslteam_saved_words
  local _sslteam_saved_current
  _sslteam_saved_words=("${words[@]}")
  _sslteam_saved_current=$CURRENT
  words=("_sslteam" "${words[@]:2}")
  CURRENT=$((CURRENT - 1))
  _arguments -C \
    '--base-url[Override backend URL for this command]:<baseUrl>:' \
    '--team-code[Team code owning the PKI family]:<teamCode>:' \
    '--environment[Environment code]:<environment>:' \
    '--intermediate-id[Intermediate certificate ID]:<intermediateId>:' \
    '--confirm[Must exactly match --intermediate-id]:<confirmation>:' \
    '--reason[Audit reason]:<reason>:'
  words=("${_sslteam_saved_words[@]}")
  CURRENT=$_sslteam_saved_current
}

_sslteam_ca_intermediate_revoke() {
  local state
  local -a _sslteam_saved_words
  local _sslteam_saved_current
  _sslteam_saved_words=("${words[@]}")
  _sslteam_saved_current=$CURRENT
  words=("_sslteam" "${words[@]:2}")
  CURRENT=$((CURRENT - 1))
  _arguments -C \
    '--base-url[Override backend URL for this command]:<baseUrl>:' \
    '--team-code[Team code owning the PKI family]:<teamCode>:' \
    '--environment[Environment code]:<environment>:' \
    '--intermediate-id[Intermediate certificate ID]:<intermediateId>:' \
    '--confirm[Must exactly match --intermediate-id]:<confirmation>:' \
    '--reason[Audit reason]:<reason>:'
  words=("${_sslteam_saved_words[@]}")
  CURRENT=$_sslteam_saved_current
}

_sslteam_ca_trust() {
  local state
  local -a _sslteam_saved_words
  local _sslteam_saved_current
  _sslteam_saved_words=("${words[@]}")
  _sslteam_saved_current=$CURRENT
  words=("_sslteam" "${words[@]:2}")
  CURRENT=$((CURRENT - 1))
  _arguments -C \
    '1:command:->command' \
    '*::arg:->args'
  case $state in
    command)
      local -a _sslteam_commands=(
        'install:Install a CA into a platform trust store'
        'verify:Verify a CA in a platform trust store'
        'remove:Remove a CA from a platform trust store'
        'list:Inventory local CA trust stores and match them to server fingerprints'
      )
      _describe -t commands 'command' _sslteam_commands
      ;;
    args)
      case $words[2] in
        install) _sslteam_ca_trust_install ;;
        verify) _sslteam_ca_trust_verify ;;
        remove) _sslteam_ca_trust_remove ;;
        list) _sslteam_ca_trust_list ;;
      esac
      ;;
  esac
  words=("${_sslteam_saved_words[@]}")
  CURRENT=$_sslteam_saved_current
}

_sslteam_ca_trust_install() {
  local state
  local -a _sslteam_saved_words
  local _sslteam_saved_current
  _sslteam_saved_words=("${words[@]}")
  _sslteam_saved_current=$CURRENT
  words=("_sslteam" "${words[@]:2}")
  CURRENT=$((CURRENT - 1))
  _arguments -C \
    '--target[Optional non-native trust target: auto, java, or firefox (native OS trust is automatic)]:<targetOption>:' \
    '--java[Also install, verify, or remove the CA in the Java cacerts trust store]' \
    '--certificate[Path to the CA certificate PEM]:<certificatePath>:' \
    '--confirm-fingerprint[Exact SHA-256 fingerprint confirmation for the certificate]:<confirmationFingerprint>:' \
    '--profile[Firefox profile directory; required with --target firefox]:<profile>:'
  words=("${_sslteam_saved_words[@]}")
  CURRENT=$_sslteam_saved_current
}

_sslteam_ca_trust_verify() {
  local state
  local -a _sslteam_saved_words
  local _sslteam_saved_current
  _sslteam_saved_words=("${words[@]}")
  _sslteam_saved_current=$CURRENT
  words=("_sslteam" "${words[@]:2}")
  CURRENT=$((CURRENT - 1))
  _arguments -C \
    '--target[Optional non-native trust target: auto, java, or firefox (native OS trust is automatic)]:<targetOption>:' \
    '--java[Also install, verify, or remove the CA in the Java cacerts trust store]' \
    '--certificate[Path to the CA certificate PEM]:<certificatePath>:' \
    '--confirm-fingerprint[Exact SHA-256 fingerprint confirmation for the certificate]:<confirmationFingerprint>:' \
    '--profile[Firefox profile directory; required with --target firefox]:<profile>:'
  words=("${_sslteam_saved_words[@]}")
  CURRENT=$_sslteam_saved_current
}

_sslteam_ca_trust_remove() {
  local state
  local -a _sslteam_saved_words
  local _sslteam_saved_current
  _sslteam_saved_words=("${words[@]}")
  _sslteam_saved_current=$CURRENT
  words=("_sslteam" "${words[@]:2}")
  CURRENT=$((CURRENT - 1))
  _arguments -C \
    '--target[Optional non-native trust target: auto, java, or firefox (native OS trust is automatic)]:<targetOption>:' \
    '--java[Also install, verify, or remove the CA in the Java cacerts trust store]' \
    '--certificate[Path to the CA certificate PEM]:<certificatePath>:' \
    '--confirm-fingerprint[Exact SHA-256 fingerprint confirmation for the certificate]:<confirmationFingerprint>:' \
    '--profile[Firefox profile directory; required with --target firefox]:<profile>:'
  words=("${_sslteam_saved_words[@]}")
  CURRENT=$_sslteam_saved_current
}

_sslteam_ca_trust_list() {
  local state
  local -a _sslteam_saved_words
  local _sslteam_saved_current
  _sslteam_saved_words=("${words[@]}")
  _sslteam_saved_current=$CURRENT
  words=("_sslteam" "${words[@]:2}")
  CURRENT=$((CURRENT - 1))
  _arguments -C \
    '--base-url[Override backend URL for this command]:<baseUrl>:' \
    '--team-code[Team code owning the PKI family]:<teamCode>:' \
    '--environment[Environment code]:<environment>:' \
    '--target[Trust target: auto, java, or firefox]:<targetOption>:' \
    '--java[Also inventory the Java cacerts trust store]' \
    '--profile[Firefox profile directory; required with --target firefox]:<profile>:' \
    '--sslteam[Show only certificates carrying the signed SSLTeam certificate marker]'
  words=("${_sslteam_saved_words[@]}")
  CURRENT=$_sslteam_saved_current
}

_sslteam_cert() {
  local state
  local -a _sslteam_saved_words
  local _sslteam_saved_current
  _sslteam_saved_words=("${words[@]}")
  _sslteam_saved_current=$CURRENT
  words=("_sslteam" "${words[@]:2}")
  CURRENT=$((CURRENT - 1))
  _arguments -C \
    '1:command:->command' \
    '*::arg:->args'
  case $state in
    command)
      local -a _sslteam_commands=(
        'generate:Issue a server leaf and download its complete artifact ZIP'
        'inspect:Inspect a certificate and its SSLTeam identity marker'
        'list:List active leaf certificates for a team and environment'
        'show:Show scoped leaf certificate detail'
        'download:Download public leaf certificate material'
        'artifact:Download a leaf artifact ZIP for an existing issuance'
        'revoke:Revoke a leaf certificate'
        'revocations:List certificate revocation audit events'
      )
      _describe -t commands 'command' _sslteam_commands
      ;;
    args)
      case $words[2] in
        generate) _sslteam_cert_generate ;;
        inspect) _sslteam_cert_inspect ;;
        list) _sslteam_cert_list ;;
        show) _sslteam_cert_show ;;
        download) _sslteam_cert_download ;;
        artifact) _sslteam_cert_artifact ;;
        revoke) _sslteam_cert_revoke ;;
        revocations) _sslteam_cert_revocations ;;
      esac
      ;;
  esac
  words=("${_sslteam_saved_words[@]}")
  CURRENT=$_sslteam_saved_current
}

_sslteam_cert_generate() {
  local state
  local -a _sslteam_saved_words
  local _sslteam_saved_current
  _sslteam_saved_words=("${words[@]}")
  _sslteam_saved_current=$CURRENT
  words=("_sslteam" "${words[@]:2}")
  CURRENT=$((CURRENT - 1))
  _arguments -C \
    '--base-url[Override backend URL for this command]:<baseUrl>:' \
    '--team-code[Team code owning the PKI family]:<teamCode>:' \
    '--environment[Environment code]:<environment>:' \
    '--name[Human-readable certificate name]:<name>:' \
    '--common-name[Certificate subject common name (DNS name)]:<commonName>:' \
    '--san[Subject alternative name as TYPE=value; repeat for DNS or IP identities (default: DNS=localhost)]:<sanValues>:' \
    '--days[Leaf validity in days]:<days>:' \
    '--output-profile[ZIP output profile: BOTH, PKCS12_ONLY, or PEM_ONLY]:<outputProfile>:' \
    '--algorithm[Certificate key algorithm, for example ecdsa-p256 or rsa-3072]:<algorithm>:' \
    '--out-dir[Directory where the artifact files are written]:<outDir>:' \
    '--generate-password[Generate the PKCS#12 password locally and save it beside the keystore]' \
    '--show-generated-password[Display a locally generated PKCS#12 password once]'
  words=("${_sslteam_saved_words[@]}")
  CURRENT=$_sslteam_saved_current
}

_sslteam_cert_inspect() {
  local state
  local -a _sslteam_saved_words
  local _sslteam_saved_current
  _sslteam_saved_words=("${words[@]}")
  _sslteam_saved_current=$CURRENT
  words=("_sslteam" "${words[@]:2}")
  CURRENT=$((CURRENT - 1))
  _arguments -C \
    '--certificate[PEM or DER certificate path]:<certificatePath>:' \
    '--sslteam[Require the exact signed SSLTeam certificate marker]'
  words=("${_sslteam_saved_words[@]}")
  CURRENT=$_sslteam_saved_current
}

_sslteam_cert_list() {
  local state
  local -a _sslteam_saved_words
  local _sslteam_saved_current
  _sslteam_saved_words=("${words[@]}")
  _sslteam_saved_current=$CURRENT
  words=("_sslteam" "${words[@]:2}")
  CURRENT=$((CURRENT - 1))
  _arguments -C \
    '--base-url[Override backend URL for this command]:<baseUrl>:' \
    '--team-code[Team code owning the PKI family]:<teamCode>:' \
    '--environment[Environment code]:<environment>:'
  words=("${_sslteam_saved_words[@]}")
  CURRENT=$_sslteam_saved_current
}

_sslteam_cert_show() {
  local state
  local -a _sslteam_saved_words
  local _sslteam_saved_current
  _sslteam_saved_words=("${words[@]}")
  _sslteam_saved_current=$CURRENT
  words=("_sslteam" "${words[@]:2}")
  CURRENT=$((CURRENT - 1))
  _arguments -C \
    '--base-url[Override backend URL for this command]:<baseUrl>:' \
    '--team-code[Team code owning the PKI family]:<teamCode>:' \
    '--environment[Environment code]:<environment>:' \
    '--issuance-id[Leaf issuance ID]:<issuanceId>:'
  words=("${_sslteam_saved_words[@]}")
  CURRENT=$_sslteam_saved_current
}

_sslteam_cert_download() {
  local state
  local -a _sslteam_saved_words
  local _sslteam_saved_current
  _sslteam_saved_words=("${words[@]}")
  _sslteam_saved_current=$CURRENT
  words=("_sslteam" "${words[@]:2}")
  CURRENT=$((CURRENT - 1))
  _arguments -C \
    '1:command:->command' \
    '*::arg:->args'
  case $state in
    command)
      local -a _sslteam_commands=(
        'certificate:Download a public leaf certificate'
        'chain:Download a public leaf certificate chain'
      )
      _describe -t commands 'command' _sslteam_commands
      ;;
    args)
      case $words[2] in
        certificate) _sslteam_cert_download_certificate ;;
        chain) _sslteam_cert_download_chain ;;
      esac
      ;;
  esac
  words=("${_sslteam_saved_words[@]}")
  CURRENT=$_sslteam_saved_current
}

_sslteam_cert_download_certificate() {
  local state
  local -a _sslteam_saved_words
  local _sslteam_saved_current
  _sslteam_saved_words=("${words[@]}")
  _sslteam_saved_current=$CURRENT
  words=("_sslteam" "${words[@]:2}")
  CURRENT=$((CURRENT - 1))
  _arguments -C \
    '--base-url[Override backend URL for this command]:<baseUrl>:' \
    '--team-code[Team code owning the PKI family]:<teamCode>:' \
    '--environment[Environment code]:<environment>:' \
    '--issuance-id[Leaf issuance ID]:<issuanceId>:' \
    '--out-dir[Directory for the public certificate]:<outDir>:' \
    '--force[Replace an existing public certificate after validation]'
  words=("${_sslteam_saved_words[@]}")
  CURRENT=$_sslteam_saved_current
}

_sslteam_cert_download_chain() {
  local state
  local -a _sslteam_saved_words
  local _sslteam_saved_current
  _sslteam_saved_words=("${words[@]}")
  _sslteam_saved_current=$CURRENT
  words=("_sslteam" "${words[@]:2}")
  CURRENT=$((CURRENT - 1))
  _arguments -C \
    '--base-url[Override backend URL for this command]:<baseUrl>:' \
    '--team-code[Team code owning the PKI family]:<teamCode>:' \
    '--environment[Environment code]:<environment>:' \
    '--issuance-id[Leaf issuance ID]:<issuanceId>:' \
    '--out-dir[Directory for the public chain]:<outDir>:' \
    '--force[Replace an existing public chain after validation]'
  words=("${_sslteam_saved_words[@]}")
  CURRENT=$_sslteam_saved_current
}

_sslteam_cert_artifact() {
  local state
  local -a _sslteam_saved_words
  local _sslteam_saved_current
  _sslteam_saved_words=("${words[@]}")
  _sslteam_saved_current=$CURRENT
  words=("_sslteam" "${words[@]:2}")
  CURRENT=$((CURRENT - 1))
  _arguments -C \
    '--base-url[Override backend URL for this command]:<baseUrl>:' \
    '--team-code[Team code owning the PKI family]:<teamCode>:' \
    '--environment[Environment code]:<environment>:' \
    '--issuance-id[Leaf issuance ID]:<issuanceId>:' \
    '--output-profile[ZIP output profile: BOTH, PKCS12_ONLY, or PEM_ONLY]:<outputProfile>:' \
    '--out-dir[Directory where the artifact files are written]:<outDir>:' \
    '--generate-password[Generate the PKCS#12 password locally and save it beside the keystore]' \
    '--show-generated-password[Display a locally generated PKCS#12 password once]'
  words=("${_sslteam_saved_words[@]}")
  CURRENT=$_sslteam_saved_current
}

_sslteam_cert_revoke() {
  local state
  local -a _sslteam_saved_words
  local _sslteam_saved_current
  _sslteam_saved_words=("${words[@]}")
  _sslteam_saved_current=$CURRENT
  words=("_sslteam" "${words[@]:2}")
  CURRENT=$((CURRENT - 1))
  _arguments -C \
    '--base-url[Override backend URL for this command]:<baseUrl>:' \
    '--team-code[Team code owning the PKI family]:<teamCode>:' \
    '--environment[Environment code]:<environment>:' \
    '--issuance-id[Leaf issuance ID]:<issuanceId>:' \
    '--confirm[Must exactly match --issuance-id]:<confirmation>:' \
    '--reason[Audit reason]:<reason>:' \
    '--purge-local[After server revocation, remove the matching local artifact directory]' \
    '--out-dir[Parent directory containing issuance artifact directories]:<outDir>:'
  words=("${_sslteam_saved_words[@]}")
  CURRENT=$_sslteam_saved_current
}

_sslteam_cert_revocations() {
  local state
  local -a _sslteam_saved_words
  local _sslteam_saved_current
  _sslteam_saved_words=("${words[@]}")
  _sslteam_saved_current=$CURRENT
  words=("_sslteam" "${words[@]:2}")
  CURRENT=$((CURRENT - 1))
  _arguments -C \
    '--base-url[Override backend URL for this command]:<baseUrl>:' \
    '--team-code[Team code owning the PKI family]:<teamCode>:' \
    '--environment[Environment code]:<environment>:' \
    '--limit[Maximum events to return (1-100)]:<limit>:'
  words=("${_sslteam_saved_words[@]}")
  CURRENT=$_sslteam_saved_current
}

