stado service grant mint
Invocation
stado service grant mint [OPTIONS] <NAME>Purpose
Mint every grant this service's consumers declare, through the same path `grant sync` uses, so a product's credential need is written where the service is declared instead of remembered as flags. A grant declared for Stado's own consumer is not minted, because a mint replaces every capability Stado holds: each `read:<item>#<field>` it names is added to that grant on the vault owner, keeping the bearer in the declared token file there; any capability other than a read is refused for that row
Required inputs and options
| Input or option | Contract |
|---|---|
<NAME> | Service whose consumers' grants are minted |
--consumer <CONSUMER> | Only this authorized consumer's grants |
--vault-file <VAULT_FILE> | Authoritative Skarbiec vault on the target, absolute or rooted at $HOME [default: $HOME/.stado/skarbiec.vault.json] |
--ttl-seconds <TTL_SECONDS> | Lifetime of each minted grant in seconds; without it each grant lives until `skarbiec grant revoke` withdraws it |
--json | Command option; required or optional as shown in the invocation. |
Output and state effect
It performs the operation described above and emits its operator result on standard output or standard error. Any state change is limited to the resources and records named by the purpose and options on this page.
Refusals
- Before dispatch, Stado refuses a missing required token shown in the invocation, an unknown option, or a value outside a listed value set; argument-usage failures exit with code 2.