skarbiec migrate

Invocation#

skarbiec migrate --from <source-vault> --to <target-vault> [--force | --reconcile]

Purpose#

Copy live items between vaults by decrypting locally and re-encrypting to the target's recipients; with --reconcile, join a second file of one owner into the vault that is declared, so the host holds one file of its owner.

Required inputs and options#

• Requires different --from and --to vault files. --force permits replacing eligible ids already in the target; otherwise they are skipped. --reconcile replaces an id the target already holds only when both vaults hold the same item (one item_uid) and the source's current revision was written later; it requires both vaults to have one owner. --force and --reconcile cannot be combined.

Output and state effects#

• Writes target-owned revisions and prints from, to, force, reconcile, migrated metadata, skipped ids, kept (ids whose target value is the same or later, with why), unreconciled (ids whose current copy cannot be told, with why) and retired, all without values. A reconcile run that leaves nothing unreconciled sets the source file aside as <source>.reconciled.<stamp>, its trashed items and history with it, and names that path in retired; otherwise retired is null and the source is left in place.

Refusals#

• Refuses the same source and target, --force with --reconcile (exit 2), --reconcile across vaults of different owners, unreadable source items, a vault without an items object, a source item whose tags are not a list of text or whose payload holds no fields object (rather than copying it without them), and replacement of credential-lifecycle, Weles-managed, or otherwise non-owner-controlled target items even with --force. Under --reconcile an id without an item_uid in either vault (run skarbiec upgrade --apply on both), with a different item_uid on each side, or whose values differ with write times that cannot be ordered is listed under unreconciled and not written. A name the set-aside copy would take that already exists is refused before the source is moved.