skarbiec grant register

Invocation#

skarbiec grant register <absolute-catalog> --workload-public-key-file <path> --ttl-seconds <N> [--replace-capabilities]

Purpose#

Declare one workload-bound acquire grant for every row of an acquisition catalog at once, all answering one workload key for one lifetime.

Required inputs and options#

• The catalog's absolute path, whose rows name a consumer, an item and a field; --workload-public-key-file, the Ed25519 public key every row's acquisition must be signed with; --ttl-seconds, the grants' lifetime in whole seconds, required because Skarbiec states no lifetime of its own. --replace-capabilities lets a row change a consumer that already holds other capabilities or another key.

Output and state effects#

• Writes, for each row, a grant holding exactly acquire:<item>#<field> with no bearer, bound to the key and ending after the lifetime; saves the vault once, appends one journal record of the token-register-acquisitions operation naming the consumers and the end, and prints ok, registered and expires_at.

Refusals#

• No catalog exits 2 with `usage: grant register <absolute-catalog> --workload-public-key-file PATH --ttl-seconds N [--replace-capabilities]`; a flag outside those three is refused with `unsupported grant register flag`; a missing key file with `--workload-public-key-file is required`; a missing or non-positive lifetime with `grant register requires --ttl-seconds: the grants' lifetime in whole seconds` or `--ttl-seconds must be a positive integer`; and a consumer whose grant differs, without --replace-capabilities, with `<consumer> differs from the acquisition catalog; pass --replace-capabilities`. Nothing is written when any row is refused.