id       = "vault"
name     = "Vault"
homepage = "https://developer.hashicorp.com/vault"
description = "Vault is a tool for securely accessing secrets."
icon     = "SimpleIcons:vault"
executables   = ["vault"]

[dotfiles]

# hashicorp/vault, api/cliconfig/config.go:
#   // defaultConfigPath is the default path to the configuration file
#   defaultConfigPath = "~/.vault"
#   // Config is the CLI configuration for Vault that can be specified via
#   // a `$HOME/.vault` file which is HCL-formatted (therefore HCL or JSON).
# VAULT_CONFIG_PATH overrides it. The file has exactly one field, token_helper.
paths = ["~/.vault"]

exclude = []

# https://developer.hashicorp.com/vault/docs/commands/token-helper — "the Vault
# CLI includes a token helper that caches tokens from any enabled
# authentication backend in a ~/.vault-token file". The whole file is the
# token.
secret = ["~/.vault-token"]

# Read once per command by a process that then exits.
side_effect = false

# api/cliconfig/config.go on token_helper: "the executable/command that is
# executed for storing and retrieving the authentication token for the Vault
# CLI". It is a path to a program installed on this machine, so it does not
# travel — and pointing it at a path that does not exist on the other machine
# breaks every `vault login` there.
# The helper is one the user pointed Vault at on this box, so the path is kept
# for rebuilding it and applied to no other.
[[dotfiles.machine_lines]]
file  = "~/.vault"
match = { prefix = ["token_helper"] }
scope = "backup"

[commands]
format = 1
label = "Vault"
description = "HashiCorp Vault CLI. Forms cover read, kv get, kv put and status; auth and server options are left out."
quality = "ai-draft"
base = "fig:vault"
parser = { end_of_options = "--", interleave = "permute", long_equals = true, short_attached = true, short_bundles = false }

[[commands.source]]
id = "fig"
kind = "completion"
url = "https://github.com/withfig/autocomplete/blob/master/src/vault.ts"
license = "MIT"

[[commands.subcommand]]
path = ["read"]
label = "Read path"
description = "Read data from a Vault path."

[[commands.subcommand.source]]
id = "fig"
kind = "completion"
url = "https://github.com/withfig/autocomplete/blob/master/src/vault.ts"
license = "MIT"

[[commands.subcommand.field]]
id = "path"
label = "Path"
type = "string"
position = 0
min = 1
suggestions = [{ value = "secret/foo", label = "secret/foo" }]
sources = ["fig"]

[[commands.subcommand.field]]
id = "field"
label = "Only this field"
type = "string"
option = ["-field"]
sources = ["fig"]

[[commands.subcommand.field]]
id = "format"
label = "Output format"
type = "enum"
option = ["-format"]
choices = [{ value = "table", label = "table" }, { value = "json", label = "json" }, { value = "yaml", label = "yaml" }, { value = "pretty", label = "pretty" }]
sources = ["fig"]

[[commands.subcommand.task]]
id = "read"
label = "Read"
fields = ["path", "field", "format"]
required = ["path"]

[[commands.subcommand.group]]
id = "basic"
label = "Basic"
fields = ["path", "field", "format"]

[[commands.subcommand]]
path = ["kv", "get"]
label = "KV get"
description = "Get a secret from the key-value store."

[[commands.subcommand.source]]
id = "fig"
kind = "completion"
url = "https://github.com/withfig/autocomplete/blob/master/src/vault.ts"
license = "MIT"

[[commands.subcommand.field]]
id = "path"
label = "Path"
type = "string"
position = 0
min = 1
suggestions = [{ value = "secret/foo", label = "secret/foo" }]
sources = ["fig"]

[[commands.subcommand.field]]
id = "format"
label = "Output format"
type = "enum"
option = ["-format"]
choices = [{ value = "table", label = "table" }, { value = "json", label = "json" }, { value = "yaml", label = "yaml" }, { value = "pretty", label = "pretty" }]
sources = ["fig"]

[[commands.subcommand.task]]
id = "get"
label = "Get secret"
fields = ["path", "format"]
required = ["path"]

[[commands.subcommand.group]]
id = "basic"
label = "Basic"
fields = ["path", "format"]

[[commands.subcommand]]
path = ["kv", "put"]
label = "KV put"
description = "Write key=value pairs to a secret. Values appear in shell history; prefer K=@file.json for sensitive data."

[[commands.subcommand.source]]
id = "fig"
kind = "completion"
url = "https://github.com/withfig/autocomplete/blob/master/src/vault.ts"
license = "MIT"

[[commands.subcommand.field]]
id = "key"
label = "Path"
type = "string"
position = 0
min = 1
suggestions = [{ value = "secret/foo", label = "secret/foo" }]
sources = ["fig"]

[[commands.subcommand.field]]
id = "data"
label = "Data (K=V)"
description = "Pairs like name=value or name=@file.json."
type = "string"
position = 1
multiple = true
min = 1
sources = ["fig"]

[[commands.subcommand.field]]
id = "cas"
label = "Check-and-set version"
type = "string"
option = ["-cas"]
sources = ["fig"]

[[commands.subcommand.task]]
id = "put"
label = "Write secret"
fields = ["key", "data"]
required = ["key", "data"]

[[commands.subcommand.group]]
id = "basic"
label = "Basic"
fields = ["key", "data", "cas"]

[[commands.subcommand]]
path = ["status"]
label = "Status"
description = "Print the seal and HA state of the Vault server."

[[commands.subcommand.source]]
id = "fig"
kind = "completion"
url = "https://github.com/withfig/autocomplete/blob/master/src/vault.ts"
license = "MIT"

[[commands.subcommand.field]]
id = "format"
label = "Output format"
type = "enum"
option = ["-format"]
choices = [{ value = "table", label = "table" }, { value = "json", label = "json" }, { value = "yaml", label = "yaml" }, { value = "pretty", label = "pretty" }]
sources = ["fig"]

[[commands.subcommand.task]]
id = "status"
label = "Status"
fields = ["format"]
required = []

[[commands.subcommand.group]]
id = "basic"
label = "Basic"
fields = ["format"]