skarbiec grant issue

Invocation#

skarbiec grant issue <consumer> --capabilities <action:item[#field],...> [--workload-public-key-file <path>] [--token-file <path>] [--ttl-seconds <N>] [--audience <name>] [--replace-capabilities]

Purpose#

Write one consumer declaration and rotate its bearer.

Required inputs and options#

• Requires an exact consumer and --capabilities. Acquire grants require --workload-public-key-file and return no bearer; direct grants may use an owner-only --token-file or receive a generated bearer once. TTL defaults to 30 days.

Output and state effects#

• Stores only the bearer hash, exact capabilities, audience, expiry, and optional workload public key; prints registration metadata, a generated direct token once when applicable, and for a workload-bound grant the acquisition redemption contract for every exact coordinate it names.

Refusals#

• Refuses wildcard or invalid capabilities, a silent scope change without --replace-capabilities, mixed acquire and direct grants, mixed lifecycle and read grants, acquire without a workload key, a workload key with nothing to acquire, and unsafe token files.