skarbiec login new

Invocation#

skarbiec login new <id> --username <name> [--sites <domain,...>] [--name <display name>] [--tags <tag,...>] (--length <N> [--lower] [--upper] [--digits] [--symbols | --symbols-from <chars>] [--unambiguous] | --passphrase --words <N> --separator <text> [--capitalize] [--with-digit] | --rules '<password rules>')

Purpose#

Sign up for an account with a password nobody typed or saw: the vault makes it, checks it against the policy and stores the login in one step.

Required inputs and options#

• The new item id, --username, and the generator's options exactly as generate takes them: --length with at least one character class, --passphrase with --words and --separator, or --rules with the site's password rules in the Password Rules language, which are also kept as the login's password_rules so generate --rules-of <id> follows them at the next rotation. --sites names the bare hosts autofill offers the login on, as sites --set takes them; --name is the display name; --tags the item's tags, as set takes them. Desktop's New login sheet takes the rules in The site's password rules.

Output and state effects#

• Generates the password, checks it against the vault policy, writes a login item (username, password, context.domains and context.display_name, the member an import records a name in) to the vault owner and recovery, appends a login-created journal record naming the item, its sites and revision, and prints ok, item, username, sites, revision and autofill. When browser autofill is connected on the machine that runs it, the browser host's grant is widened to the new login's context, username and password with grant ensure, proving possession with the token file browser install wrote and keeping its bearer, so the extension offers the login at once; autofill answers covered, fields and refused (each field grant ensure would not add, with its reason), or covered false with the reason when autofill is not connected there. The login is created either way. The password is never printed; get <id> --field password reads it when you need it. POST /v1/operator/items/new-login takes id and the same options by name; Desktop's Items → New login with a generated password calls it.

Refusals#

• A missing id or --username exits 2 with the usage, and --into exits 2 because the login being created is where the password goes. A domain that is not a bare host exits 2 with `--sites <domain> is not a bare host; name it as <host>`. An id that exists, live or trashed, is refused with `<id> already exists; login new creates an item and never replaces one (generate --into <id> --field password replaces its password)`. The generator's refusals apply as they do to generate, a reserved or unregistered tag is refused as set refuses it, and a password that does not clear the policy is refused naming the rules, with nothing created.