usage: secrets-engine [-h] [--version]
                      {catalog,decision,plan,apply,provision,rotate,verify,handoff,wrap,exec,policy,route,revoke,session,lifecycle,state,secret-use,audit,evidence,service-auth}
                      ...

secrets-engine command-line interface.

positional arguments:
  {catalog,decision,plan,apply,provision,rotate,verify,handoff,wrap,exec,policy,route,revoke,session,lifecycle,state,secret-use,audit,evidence,service-auth}
    catalog             catalog operations
    decision            decision operations
    plan                render a guarded plan (no mutation)
    apply               apply approved metadata to OpenBao
    provision           provision a value without printing it
    rotate              replace a declared KV field without printing it
    verify              positive/negative verification (no value printed)
    handoff             write AppRole role_id/secret_id handoff files
    wrap                write a single-use OpenBao wrap token to a file (never
                        printed)
    exec                run a command with the secret injected for the child
                        only
    policy              inspect secrets-engine policies
    route               ops-warden routing pointer for a lane
    revoke              deactivate native policy/AppRole access (preserves KV
                        custody)
    session             issued-session operator commands
    lifecycle           explicit lane lifecycle operations
    state               show persistent non-secret lane lifecycle state
    secret-use          read-only secret-use evidence surface
    audit               summarize non-secret local lane evidence
    evidence            load-bearing evidence heartbeat and outbox
    service-auth        KeyCape service-auth consumer checks

options:
  -h, --help            show this help message and exit
  --version             show program's version number and exit
