skarbiec grant issue

Invocation#

skarbiec grant issue <consumer> --capabilities <action:item[#field],...> (--ttl-seconds <N> | --until-revoked) [--workload-public-key-file <path>] [--token-file <path>] [--audience <name>] [--replace-capabilities]

Purpose#

Write one consumer declaration and rotate its bearer.

Required inputs and options#

• Requires an exact consumer, --capabilities and exactly one lifetime: --ttl-seconds <N> ends the grant N seconds from now, --until-revoked keeps it until `grant revoke` withdraws it. No lifetime is assumed: without either the call is refused with `grant issue requires --ttl-seconds <N> (the grant's lifetime in whole seconds) or --until-revoked (it lives until `grant revoke`)`, and both together are refused as exclusive. Acquire grants require --workload-public-key-file, return no bearer and require --ttl-seconds, because every acquisition bearer they mint inherits their lifetime. Direct grants may use an owner-only --token-file or receive a generated bearer once. An item-scoped lifecycle capability can name a future item so credential acquire can create it; the declaration creates no credential and grants no value access.

Output and state effects#

• Stores only the bearer hash, exact capabilities, audience, expiry, and optional workload public key; a grant issued --until-revoked stores the largest expiry (18446744073709551615), which no clock reaches, and answers `until_revoked: true`. Prints registration metadata, a generated direct token once when applicable, and for a workload-bound grant the acquisition redemption contract for every exact coordinate it names. A typed concurrent-generation conflict reopens the winning vault generation and reapplies the request without a fixed retry ceiling; every other failure is returned unchanged.

Refusals#

• Refuses a missing lifetime, --ttl-seconds together with --until-revoked, --until-revoked on an acquire grant, wildcard or invalid capabilities, a silent scope change without --replace-capabilities, mixed acquire and direct grants, mixed lifecycle and read grants, acquire without a workload key, a workload key with nothing to acquire, and unsafe token files.