skarbiec route declare

Invocation#

skarbiec route declare --resource <resource> (--item <item> | --tag <tag>) --field <field> --reason <text>

Purpose#

State the one route a vault item cannot declare for itself, such as a sign-in form's origin:<page origin>/<field class>. A route names either the item or, with --tag, the tag its one answering item carries, such as stado:role:<role>; a tag route names no item, so renaming the item changes nothing.

Required inputs and options#

• Requires exact non-empty --resource, --field and --reason values and exactly one of --item or --tag.

Output and state effects#

• Serializes concurrent declarations under the shared table's file lock, preserving other consumers' routes. Idempotently writes a mode-0600 table, records the item's item_uid on an item row when the item carries one, keeps a timestamped previous-table backup, appends adjacent and hash-chained audit records, and prints declared plus backup. An existing item row becomes the tag row when exactly that item carries the tag and the field is the same, because the answer does not move. When no live item carries the tag yet, the item the existing row answers with is tagged with it in the same step (capability-route-role-adopted in the hash-chained journal) and the row becomes the tag row, so a consumer moving its routes from items to roles never stops at an unheld role. Resolution of a tag row serves the one live item carrying the tag.

Refusals#

• Refuses missing or malformed values, both or neither of --item and --tag, a backup without a timestamp, repointing an existing resource to a different coordinate (including a tag another item already carries: capability route <resource> already maps <item>#<field>: repointing a live route is not a declaration), an adoption on a replica vault or on an item under a lifecycle controller, and any resource a vault item already declares -- a provider:, agent: or login: name, or an exact coordinate -- because a hand row beside a declaration is a second answer to one question. Resolving a tag row refuses with the tag named when no live item carries it, and with every carrier named when more than one does.