skarbiec route resolve

Invocation#

skarbiec route resolve [<name>...] [--consumer <consumer> --token <bearer>] [--emit --out <directory>] [--template <file> --out <file>]

Purpose#

Answer which vault item and field a resource name resolves to, reading what the item declares rather than how it is named, and optionally materialize the values behind it.

Required inputs and options#

• No required input: with no name it walks every route this vault answers. A name is provider:<provider>, provider:<provider>:<id>, agent:<agent>, login:<item>, <item>#<field>, or a hand-declared resource. --consumer filters a metadata-only inventory without a bearer; the graphical operator route uses this form and never accepts value materialization. A named consumer materializing values must present its bearer. --emit writes one owner-only <item>.env per item reached under --out; --template fills a caller-named file of skarbiec:// references.

Output and state effects#

• Prints the table path and one row per coordinate with resource, item, field, declared_by, item_present and field_present; a whole-surface walk also reports the items whose declaration is too ambiguous to act on and the hand-declared rows a declaration has made redundant. Materialization creates an owner-only temporary file beside each destination, syncs it and replaces the destination atomically; values are never first written with the process's default permissions. Output-path, write, permission and synchronization failures retain their actual cause. Relative output paths are resolved against the calling directory. The audit records only variable names and values never reach stdout.

Refusals#

• A name nothing declares and no route names is an error rather than a status, and so is a name two items declare, a login: name whose item is another kind, a named consumer materializing without its bearer, and --emit or --template without --out. A coordinate that resolves but holds an empty value, an uppercase placeholder, a missing field, a trashed item or an item that will not open is reported in the vault's own words on its row. Materialization with no readable coordinate fails rather than returning a successful blocked result. Authorization evaluation, decryption and text-field extraction errors during materialization retain their actual cause rather than silently omitting the affected field; the scoped HTTP route reports a service failure rather than misclassifying those errors as a missing grant.