Command reference

This chapter lists every corium command. Run corium <command> --help for the authoritative flag list of a build.

Global

corium [--log-format human|json] <command>

--log-format comes before the subcommand. corium tui writes no tracing output, because it owns the terminal.

Shared flag groups

Connection flags apply to peer-server, postgres-server, every db subcommand, schema update, every authz subcommand, every keys subcommand, console, tui, and sql.

Flag	Environment	Default
`--transactor <url>`		`http://127.0.0.1:4334`
`--token <secret>`	`CORIUM_TOKEN`	Shared development token
`--ca <pem>`		None
`--tls-domain <name>`		None
`--peer-bootstrap`		Off

Serving flags apply to transactor, peer-server, and postgres-server.

Flag	Environment
`--serve-token <secret>`	`CORIUM_SERVE_TOKEN`
`--require-auth`
`--serve-open`
`--oidc-issuer <url>`
`--oidc-audience <aud>`
`--oidc-jwks-file <path>`
`--authz-db <name>`	`CORIUM_AUTHZ_DB`
`--authz-fresh-writes`
`--authz-break-glass-role <role>`
`--authz-max-depth <n>`
`--key-policy strict\|server-wide`
`--tls-cert <pem>`
`--tls-key <pem>`

--key-policy decides which protection class keys a caller can use. Only peer-server and postgres-server act on it. postgres-server rejects --tls-cert and --tls-key, because it does not terminate TLS.

Key flags apply to transactor, peer-server, postgres-server, gc, and log.

Flag	Environment
`--storage-key <uri>`	`CORIUM_STORAGE_KEY`

One keyring serves both purposes. It resolves key-encryption keys and protection class keys. The flag is repeatable, and the environment variable takes a comma-separated list.

Servers

`corium transactor`

Runs a transactor over a data directory. See the transactor.

Storage flags: --config, --store, --store-plugin, --plugin-store, --plugin-read-only-config, --data-dir, --turso-path, --postgres-url, --postgres-read-only-url, --s3-bucket, --s3-prefix, --s3-region, --s3-endpoint-url, --s3-read-only-access-key-id, --s3-read-only-secret-access-key, --s3-read-only-session-token, --s3-read-only-role-arn, --s3-read-only-role-session-name, --s3-read-only-role-duration-seconds, --s3-read-only-role-external-id.

Process flags: --listen, --owner, --advertise, --metrics-listen.

Lease flags: --ha, --lease-ttl-ms, --lease-wait-ms, --heartbeat-ms.

Index flags: --index-interval-ms, --index-backoff, --index-tail-threshold, --index-tail-deadline-ms.

Collection flags: --gc-interval, --gc-window.

Function flags: --db-fn-fuel, --db-fn-memory-bytes.

`corium peer-server`

Hosts one database for thin clients. See peer server and thin clients.

Flags: --db, --listen, --max-fuel, --metrics-listen, --segment-cache-dir, --segment-cache-capacity, --segment-cache-memory.

`corium postgres-server`

Serves the catalog over the PostgreSQL wire protocol. See SQL shell and PostgreSQL server.

Flags: --database (repeatable), --listen, --password, --allow-writes.

Storage administration

`corium store verify <kind> <config>`

Runs the blob and root conformance suite against a live backend. <config> is the JSON configuration object of the backend. Flag: --store-plugin (repeatable). See storage backends.

Use a disposable namespace. The command writes and deletes objects.

Catalog

`corium db create <name>`

Creates a database. Flags: --schema <path>, --storage-key <uri>.

`corium db delete <name>`

Deletes a database. It asks for no confirmation.

`corium db list`

Lists the databases that the transactor serves.

`corium db stats <name>`

Connects a peer and prints statistics.

`corium db fork <name> <target>`

Duplicates a database at a basis. Flag: --as-of <t>. See forking a database.

`corium db request-index <name>`

Publishes the indexes now, bypassing pacing.

`corium db index-policy <name>`

Reads or overrides the pacing of one database. Flags: --interval-ms, --backoff, --tail-threshold, --tail-deadline-ms. With no flags it prints the current policy.

Schema

`corium schema update <db> --schema <path>`

Compares a schema file with the schema installed in a database and prints the plan. It writes nothing without --apply. See schema management.

Flags: --schema, --prune, --json, --detailed-exit-code, --apply, --plan, --allow (repeatable), --ack (repeatable).

Authorization

See authorization.

Command	Effect
`corium authz init`	Creates the policy database with schema, permissions, and a first administrator. Flags: `--db`, `--admin`, `--provider`, `--no-admin`.
`corium authz grant <subject> <relation> <object>`	Asserts a relationship tuple. Flag: `--db`.
`corium authz revoke <subject> <relation> <object>`	Retracts a relationship tuple. Flag: `--db`.
`corium authz check <subject> <action>`	Prints what the policy decides. Flags: `--database`, `--provider`, `--role`, `--claim`, `--db`.
`corium authz status`	Prints the compiled basis and entity counts. Flag: `--db`.

Keys

See encryption at rest.

Command	Effect
`corium keys status <db>`	Prints the KEK, the epochs, and the nonce budget.
`corium keys rotate <db>`	Opens a new storage-key epoch.
`corium keys rewrap <db> --kek <uri>`	Re-wraps the data keys under another KEK.

Command	Effect
`corium console <db>`	Datalog console. See query console.
`corium tui <db>`	Dashboard. Flag: `--refresh-ms`. See terminal dashboard.
`corium sql <db>`	SQL shell. Flags: `-c/--command`, `-f/--file`. See SQL.

Offline inspection

`corium log`

Prints committed transactions from a filesystem data directory. The transactor does not need to be running.

Flags: --data-dir, --db, --from, --to, --storage-key.

--from is inclusive. --to is exclusive, and 0 means open-ended.

Commands that do not exist

Not implemented. There is no corium transact command. Writes come from a client library, or from corium postgres-server --allow-writes.

Not implemented. There is no corium dump command. Human, JSON, and EDN export are deferred.

Not implemented. corium schema has only the update subcommand. status, history, and job inspection are planned and absent.

Not implemented. There is no corium keys protect, corium keys unprotect, or corium keys audit. Protection changes go through corium schema update. See attribute protection.

Corium Operator Manual