Every database command

Every stado database command of stado-database, with its refusals.

Each command takes --json for a machine-readable answer and --help for its own usage. A request refused for its form exits 2; a refusal of the work itself exits 1.

command	what it does
stado database list [--json]	Lists every declared database and whether the service directory places it on a host.
stado database resolve <name> --consumer <consumer> [--json]	Answers where an authorized consumer reaches the database and which vault item holds its credential.
stado database declare <name> --engine <engine> --consumer <consumer>... [--scope read|write]... [--json]	Writes database_api.databases.<name> through the validated, atomic configuration write. The engine is any lowercase URL scheme (postgres, sqlite, mysql, mongodb, redis, ...). The credential item <name>-database is implied.
stado database create <name> --consumer <consumer> [--engine] [--provider] [--host] [--json]	Creates the database, then declares it; see Creating a database.
stado database adopt [<name>] [--project-ref <ref>] [--password-file <path>] [--check] [--json]	Rewrites <name>-database from the Supabase management API: coordinates, pooler (pooler_url and session_url), API keys and an active custom hostname. Fields another owner wrote stay. Without a name, every declared Supabase-backed database is adopted again so a rotated key lands. Runs from any host with this machine's declarations: off the vault owner each item is read and written by the owner's own Skarbiec through the host channel, and a declared database whose item the owner lacks is a row no item in the owner vault on <host>. --check writes nothing and exits 1 when an item differs.
stado database push <host> --service <unit> [--check] [--json]	Makes HOST's database_api block equal to this machine's through host config set, then reconciles the named unit so the running process reads it. --check writes nothing and exits 1 on a difference.
stado database remove <name> [--json]	Withdraws the declaration and nothing else: right for a hosted database Stado does not run.
stado database destroy <name> [--host <host>] [--delete-project] [--json]	Undoes create for the provider the credential item records. A fleet database: removes the managed unit <name>-database that serves a postgres database; its data directory ~/.stado/databases/<name>/ on the host is left in place and named. A Supabase database: deletes the hosted project with every row in it through the management API, and only with --delete-project; without it the command refuses and names remove as the way to keep the project. An external database is refused: Stado does not run that server, and remove withdraws its declaration. Then the credential item is deleted from the owner vault (restorably, as Skarbiec deletes) and the declaration is withdrawn last, so a run that stops part-way is run again and continues; a part already gone reads already absent.
stado database grant <name> --consumer <consumer>... [--json]	Adds consumers to the declaration and grants each one read of <name>-database in Skarbiec.
stado database client <name> [--json]	Widens <name>-database-client's grant on the vault owner to the fields stado_database reads for the engine, keeping its bearer. Refused for an undeclared database (unknown database "<name>"; declared: ...) and, with Skarbiec's answer, for a client the owner holds no bearer for.
stado database revoke <name> --consumer <consumer>... [--json]	Removes consumers from the declaration. Their Skarbiec grant on the item is left as it is.

destroy reads the credential item's provider metadata with owner authority when run on the registry's vault owner, just as creation and item deletion do. It does not require a separate workload bearer on that host. From another host it uses the delegated credential read and reports a missing or refused grant; deleting a hosted project still requires its provider authorization.

The registry created by stado config init has no service directory yet. list still reports its declarations with placed: false and active_host: null. An authorized resolve returns the engine and credential coordinate with placed: false, without inventing an endpoint. A directory that is present but malformed, or a registry read that fails, remains an error; neither is treated as an empty placement list. Stado Desktop's Databases screen uses the same listing and retains the reported error when a refresh fails.

Refusals, word for word:

• NAME must be lowercase letters, digits and dashes.
• engine "<engine>" is not an engine name: the lowercase scheme of its connection URL, such as postgres, mysql or mongodb.
• scope "<scope>" is not one of ["read", "write"].
• consumer "<consumer>" must be lowercase letters, digits and dashes.
• unknown database "<name>"; declared: <every declared name>: resolve or destroy was given a name nothing declares.
• consumer "<consumer>" is not authorized for database "<name>": grant it with stado database grant.
• <name> is not destroyed (<parts> already removed): <what failed>; run destroy again once that is repaired: destroy stopped part-way and says which parts are already gone.
• database "<name>" is not declared: remove, grant or revoke named an undeclared database.
• cannot revoke the last consumer of "<name>"; remove the declaration instead.
• rejected, config unchanged: <problems>: the change would leave a configuration the parser refuses; nothing was written.
• no config file exists; run: stado config init.
• WC_DATABASE_API_DATABASES cannot be read: <cause>: the one-process override of the declarations (a JSON object in place of database_api.databases) is set to something that is not text; it is refused rather than read as unset, which put the config file's declarations in place of the ones the process was given.
• <config path> declares no database_api: push found nothing to push on this machine.
• <host>'s config file did not arrive intact: <integrity>.
• <host>'s database_api differs from this machine's (exit 1): push --check found a difference.
• the declaration changed, but Skarbiec still refuses: <each refusal>: grant wrote the declaration but a consumer's Skarbiec read grant did not follow; run grant again once the named refusal is repaired.
• <item> holds <fields|context> that is not an object, so it is not rewritten: <value>: adopt found a stored credential item whose fields or context are not an object; rewriting it from nothing would drop what it holds.
• <item> records a provider <value> Stado does not know: <cause>: adopt found a provider word on the item that is none of Stado's database providers, so whether it is a Supabase item cannot be told.
• <items> differ from their Supabase projects (exit 1): adopt --check names every item that would be rewritten.