stado credentials item

Invocation

stado credentials item <COMMAND>

Credential item operations on the host that owns the vault

This command has no command-specific inputs or options.

This command group selects one of the subcommands listed below; use its exact child invocation to perform an operation.

Before dispatch, Stado refuses a missing required token shown in the invocation, an unknown option, or a value outside a listed value set; argument-usage failures exit with code 2.

put — Store the secret that plays one role in a host's declared owner vault: the item carrying stado:role:<ROLE> is rotated, or created under a random id with that tag
show — Report one host-vault item without revealing its values
retag — Replace one host-vault item's tags, or read them when --tags is omitted
delete — Delete one owner-controlled item from a host's vault, for items whose product or role is retired; Skarbiec keeps the deletion restorable
restore — Return one deleted item from a host vault's trash, undoing delete
reclaim — Return one host-vault item from the consumer that wrote it to the vault owner's control, so retag, rename and delete may change it. Only control moves; Skarbiec refuses lifecycle- and Weles-managed items
rename — Give one host-vault item a new id, keeping its payload, history and tags; grants naming the old id must be reissued
upgrade — Bring the owner vault to Skarbiec's current schema: the v2 envelope, an item_uid on every item and a payload fingerprint on every active item, so the duplicate report and the duplicate refusal cover every row
summarize — Host primitive used by `show`: read a `skarbiec get --json` document on stdin and print each field's length and SHA-256, never a value