skarbiec grant narrow

Invocation#

skarbiec grant narrow <consumer> <item> --field <field>

Purpose#

Take one exact field read out of a consumer's grant without rotating its bearer: the inverse of grant ensure.

Required inputs and options#

• Requires exactly a consumer and an item and --field naming the field whose read:<item>#<field> capability goes. No token file is needed: the owner withdraws, nothing is proven by the consumer.

Output and state effects#

• Removes that one capability, saves the vault, appends a grant-narrowed-read journal record naming consumer, item and field, and prints ok, consumer, capability, status removed and decided_against_vault. A grant that does not hold the capability is answered status absent and the vault is not written, so a repeat changes nothing. The bearer, the other capabilities and the lifetime stay as they were. POST /v1/operator/grants/narrow takes consumer, item and field; Desktop's Stop reading <field> on an item's consumer list calls it. Only a typed concurrent-generation conflict causes a fresh read and reapplication.

Refusals#

• A consumer or item missing or followed by another positional exits 2 with `usage: grant narrow <consumer> <item> --field <field>`, and a missing --field with `--field is required`. Refuses names that are not exact with `grant narrow requires exact consumer, item, and field names`, a consumer with no grant with `consumer <name> has no grant in <vault>`, and a legacy grant with `existing grant is not v2; run `skarbiec upgrade --apply` first`.