skarbiec revoke

Invocation#

skarbiec revoke <item-id> <uid>

Purpose#

Remove one recipient from one item's encrypted recipient set.

Required inputs and options#

• Requires one item id and recipient uid.

Output and state effects#

• Decrypts and re-encrypts the item for the remaining recipients, preserves kind/tags, appends audit, and prints the final recipient list.

Refusals#

• Fails rather than narrowing access when the item cannot be opened or safely rewritten; owner and recovery invariants remain enforced by the vault writer.