skarbiec expiry

Invocation#

skarbiec expiry set <id> --on <iso8601>
skarbiec expiry set --tag <tag> --on <iso8601>
skarbiec expiry clear <id>
skarbiec expiry clear --tag <tag>
skarbiec expiry list [--before <iso8601>]

Purpose#

Record the day an item stops being good — a card, a passport, a licence key, a password the provider makes you change, or a contractor's whole set by its tag — and see what runs out first.

Required inputs and options#

• set takes one live owner-controlled item, or --tag naming the tag every live item of a set carries, and --on, a UTC time of the vault's stamp form; a moment already past is accepted, since recording a lapse is how it is seen. clear takes one item, or --tag. list takes an optional --before of the same form. POST /v1/operator/items/expiry reads the list with before; POST /v1/operator/items/expiry/set takes id or tag, and on, and /items/expiry/clear takes id or tag.

Output and state effects#

• The date is vault metadata in the item_expiry section, beside share_until, so nothing is decrypted to list it. set saves it and appends expiry-set, answering ok, item and expires_at; with --tag every live item carrying the tag is checked first, then all get the date in one save, an expiry-set-by-tag entry names them, and the answer carries ok, tag, items and expires_at. clear removes it and appends expiry-cleared, answering cleared false when the item recorded none and writing nothing then; clear --tag checks every live item carrying the tag, forgets the dates the ones that had one recorded, appends expiry-cleared-by-tag naming them, and answers ok, tag and cleared, the ids whose date went (empty, with nothing written, when none had one). list prints every recorded date soonest first, or only the ones before --before, each with item, expires_at, expired and live (false for an item in the trash). rename carries an item's date to the new id, purge forgets it with the item, and review lists them under items_expiring_before.

Refusals#

• Another arrangement exits 2 with `usage: expiry set <id> --on <iso8601> | expiry set --tag <tag> --on <iso8601> | expiry clear <id> | expiry clear --tag <tag> | expiry list [--before <iso8601>]`, and an --on or --before of another shape with `--<flag> <value> is not a UTC time of the form <now>`. set refuses an item that does not exist, a tag no live item carries with `no live item carries the tag <tag>, so no expiry was recorded` (clear --tag: `... so no expiry was cleared`), and set and clear refuse a lifecycle-controlled item or a vault that replicates another, as every direct owner change is refused — with --tag, one such item refuses the whole set before any date is written.