skarbiec credential seal-directory

Invocation#

skarbiec credential seal-directory <item-id> --provider <provider> --tenant <uuid> --object-id <uuid> --account-upn <email> --local

Purpose#

Seal the immutable provider directory identity used by later credential lifecycle operations.

Required inputs and options#

• Requires item id, provider, lowercase tenant/object UUIDs, account UPN, and --local.

Output and state effects#

• Writes the sealed directory contract as a lifecycle-owned record carrying its own canonical kind, credential-directory-seal, and prints its metadata; future operations read this identity instead of accepting replacements.

Refusals#

• Refuses remote mode, invalid identifiers, and an item that already carries a directory contract; changing one requires reseal.