safe-chains 0.222.0

[[command]]
name = "vault"
description = "HashiCorp Vault CLI — secrets management. Most subcommands contact a Vault server (network). Read-side: `read`, `list`, `kv get/list/metadata get`, `policy read/list`, `auth list`, `secrets list`, `token lookup`, `version`, `status`. Write-side: `write`, `kv put/patch/delete`, `policy write/delete`, `secrets enable/disable`, `auth enable/disable`, `login`, `logout`, `token create/revoke/renew`, `unwrap`, `delegate`, `seal`, `unseal`, `operator init/raft/migrate`."
url = "https://developer.hashicorp.com/vault/docs/commands"
researched_version = "Vault 1.x"
bare_flags = ["--help", "--version", "-h", "-v"]

[[command.sub]]
name = "version"
standalone = ["--help", "-h"]

[[command.sub]]
name = "status"
level = "SafeRead"
bare = true
standalone = ["--format", "--help", "-h"]
valued = ["--address", "--format"]

[[command.sub]]
name = "read"
profile = "credential-read"
fact = "Reads the secret/data at a Vault path and prints it to stdout — Vault paths hold secret material (tokens, keys, credentials), which enters the caller's context."
source = "https://developer.hashicorp.com/vault/docs/commands/read"
judgment = "`vault read` is the secret-fetch command of a secrets manager; even where a path holds config, the conservative classification is credential exposure."
standalone = ["--help", "-h"]

[[command.sub]]
name = "list"
level = "SafeRead"
bare = false
tolerate_unknown_short = true
standalone = ["--detailed", "--help", "--mount", "-h"]
valued = ["--address", "--format", "--namespace"]

[[command.sub]]
name = "kv"
nested_bare = false

[[command.sub.sub]]
name = "get"
profile = "credential-read"
fact = "`vault kv get` reads and prints the secret at a KV-v2 path — the same secret material as `vault read`, just the KV-v2 sugar; the value enters the caller's context."
source = "https://developer.hashicorp.com/vault/docs/commands/kv/get"
judgment = "KV get is the secret-fetch of a secrets manager (`--field` extracts a single secret value); conservative classification is credential exposure, matching `vault read`."
standalone = ["--field", "--help", "--mount", "-h"]
valued = ["--address", "--field", "--format", "--namespace", "--version"]

[[command.sub.sub]]
name = "list"
standalone = ["--help", "--mount", "-h"]
valued = ["--address", "--format", "--namespace"]

[[command.sub.sub]]
name = "metadata"
nested_bare = false

[[command.sub.sub]]
name = "patch"
candidate = true

[[command.sub.sub]]
name = "put"
candidate = true

[[command.sub.sub]]
name = "delete"
candidate = true

[[command.sub.sub]]
name = "destroy"
candidate = true

[[command.sub.sub]]
name = "rollback"
candidate = true

[[command.sub.sub]]
name = "undelete"
candidate = true

[[command.sub.sub]]
name = "enable-versioning"
candidate = true

[[command.sub]]
name = "help"
allow_all = true

[[command.sub]]
name = "write"
candidate = true

[[command.sub]]
name = "delete"
candidate = true

[[command.sub]]
name = "auth"
candidate = true

[[command.sub]]
name = "secrets"
candidate = true

[[command.sub]]
name = "policy"
candidate = true

[[command.sub]]
name = "login"
candidate = true

[[command.sub]]
name = "logout"
candidate = true

[[command.sub]]
name = "token"
candidate = true

[[command.sub]]
name = "lease"
candidate = true

[[command.sub]]
name = "operator"
candidate = true

[[command.sub]]
name = "audit"
candidate = true

[[command.sub]]
name = "namespace"
candidate = true

[[command.sub]]
name = "ssh"
candidate = true

[[command.sub]]
name = "transit"
candidate = true

[[command.sub]]
name = "unwrap"
candidate = true

[[command.sub]]
name = "wrap"
candidate = true

[[command.sub]]
name = "agent"
candidate = true

[[command.sub]]
name = "server"
candidate = true

[[command.sub]]
name = "events"
candidate = true

[[command.sub]]
name = "monitor"
candidate = true

[[command.sub]]
name = "debug"
candidate = true

[[command.sub]]
name = "patch"
candidate = true

[[command.sub]]
name = "path-help"
candidate = true

[[command.sub]]
name = "pki"
candidate = true

[[command.sub]]
name = "plugin"
candidate = true

[[command.sub]]
name = "print"
candidate = true

[[command.sub]]
name = "proxy"
candidate = true