stado service grant-sync
Invocation
stado service grant-sync [OPTIONS] --host <HOST> --consumer <CONSUMER> --capability <CAPABILITIES> --token-file <TOKEN_FILE> <NAME>Purpose
Reconcile one Skarbiec consumer grant with an existing owner-only token file. The bearer never leaves the managed host: its local Skarbiec reads the raw file and records only its hash while replacing the declared grant.
Required inputs and options
| Input or option | Contract |
|---|---|
<NAME> | Service whose host-local deployer uses the grant |
--host <HOST> | The single registry host to update |
--consumer <CONSUMER> | Exact Skarbiec consumer name |
--capability <CAPABILITIES> | One complete grant capability; repeat for every capability |
--token-file <TOKEN_FILE> | Existing raw bearer file on the target, absolute or rooted at $HOME |
--vault-file <VAULT_FILE> | Authoritative Skarbiec vault on the target, absolute or rooted at $HOME [default: $HOME/.stado/skarbiec.vault.json] |
--ttl-seconds <TTL_SECONDS> | Lifetime of the replacement grant [default: 2592000] |
--audience <AUDIENCE> | Grant audience; defaults to the consumer |
--json | Command option; required or optional as shown in the invocation. |
Output and state effect
It performs the operation described above and emits its operator result on standard output or standard error. Any state change is limited to the resources and records named by the purpose and options on this page.
Refusals
- Before dispatch, Stado refuses a missing required token shown in the invocation, an unknown option, or a value outside a listed value set; argument-usage failures exit with code 2.