skarbiec route resolve

Invocation#

skarbiec route resolve [<name>...] [--consumer <consumer> --token <bearer>] [--emit --out <directory>] [--template <file> --out <file>]

Purpose#

Answer which vault item and field a resource name resolves to, reading what the item declares rather than how it is named, and optionally materialize the values behind it.

Required inputs and options#

• No required input: with no name it walks every route this vault answers. A name is provider:<provider>, provider:<provider>:<id>, agent:<agent>, login:<item>, <item>#<field>, or a hand-declared resource. --consumer requires --token and filters every field through exact read grants; --emit writes one owner-only <item>.env per item reached under --out; --template fills a caller-named file of skarbiec:// references.

Output and state effects#

• Prints the table path and one row per coordinate with resource, item, field, declared_by, item_present and field_present; a whole-surface walk also reports the items whose declaration is too ambiguous to act on and the hand-declared rows a declaration has made redundant. Materialization writes mode-0600 files, appends a non-secret audit record naming only variables, and never prints a value.

Refusals#

• A name nothing declares and no route names is an error rather than a status, and so is a name two items declare, a login: name whose item is another kind, --consumer without --token, and --emit or --template without --out. A coordinate that resolves but holds an empty value, an uppercase placeholder, a missing field, a trashed item or an item that will not open is reported in the vault's own words on its row.