skarbiec credential reseal

Invocation#

skarbiec credential reseal <item-id> --provider <provider> --tenant <uuid> --object-id <uuid> --account-upn <email> --as <consumer> --token-file <path> --local

Purpose#

Replace a sealed directory identity under an exact reseal capability.

Required inputs and options#

• Requires the complete new directory identity, authenticated --as consumer, owner-only --token-file, and --local.

Output and state effects#

• Validates the reseal grant and replaces the sealed record while retaining explicit audit/provenance. Sealing and resealing are the only two writers of a seal, so a contract sealed before the seal's own kind existed takes that kind here; nothing is backfilled.

Refusals#

• Refuses remote mode, malformed directory fields, unsafe/mismatched token files, or a consumer without reseal:item capability.