skarbiec acquisition read

Invocation#

skarbiec acquisition read <consumer> <item> <field> --token-file <path>

Purpose#

Consume one acquisition token and return only its bound field.

Required inputs and options#

• Requires the exact consumer, item, field, and --token-file: the absolute path of an owner-only regular file holding the token acquisition request returned. A token is never taken from argv.

Output and state effects#

• Atomically removes the token hash before returning value, then appends acquisition-consumed; output carries the bound value, the request identifiers, and the item's declared provider when the item declares one. The provider key is absent rather than null when it does not, so absence cannot be read as a declaration.

Refusals#

• --token is refused naming --token-file, and an unsafe or missing token file is refused by name. An expired, replayed, mismatched, or unknown token fails with exit status 1 and 'acquisition read: unauthorized: …'; hidden/unconfirmed lifecycle candidates are refused without spending them.