{
  config,
  lib,
  ...
}: {
  imports = [
    ../../../../../agenix/age/identityPaths
    ../../../../../home-manager/nixpkgs/config/allowUnfree
  ];

  options.dotfiles.inputs.nixvim.programs.nixvim.plugins.codeium-vim.enable =
    lib.dotfiles.mkEnableOption;

  config =
    lib.mkIf
    config.dotfiles.inputs.nixvim.programs.nixvim.plugins.codeium-vim.enable
    {
      dotfiles.inputs = {
        agenix.age.identityPaths.enable = true;
        home-manager.nixpkgs.config.allowUnfree.enable = true;
      };

      age.secrets.modulesProgramsNixvimPluginsCodeiumApiKey = {
        file = ../codeium_api_key.age;
      };

      # Unlike codeium.nvim [1], codeium.vim [2] does not interface the path to
      # the configuration file containing the API key. This activation script
      # symlinks the decrypted agenix file to the expected location.
      #
      # TODO: Replace this activation script with an upstream codeium.vim [2]
      # option interfacing the path to the configuration file containing the API
      # key. [3]
      #
      # [1]: https://github.com/Exafunction/codeium.nvim
      # [2]: https://github.com/Exafunction/codeium.vim
      # [3]: https://github.com/Exafunction/codeium.vim/issues/303
      home.activation = let
        directory = "${config.xdg.dataHome}/.codeium";
        module = "dotfiles.inputs.nixvim.programs.nixvim.plugins.codeium-vim";
      in {
        ${module} = lib.hm.dag.entryAfter ["writeBoundary"] ''
          run mkdir --parents "${directory}"

          run \
            ln \
            --force \
            --symbolic \
            "${config.age.secrets.modulesProgramsNixvimPluginsCodeiumApiKey.path}" \
            "${directory}/config.json"
        '';
      };

      programs.nixvim.plugins.codeium-vim.enable = true;
    };
}
