Enum IdSubcommand 

pub enum IdSubcommand {
    Create {
        metadata_file: PathBuf,
        local_key_alias: String,
        preset: LayoutPreset,
    },
    Show,
    List,
    Rotate {

        alias: Option<String>,
        current_key_alias: Option<String>,
        next_key_alias: Option<String>,
        add_witness: Vec<String>,
        remove_witness: Vec<String>,
        witness_threshold: Option<u64>,
        dry_run: bool,
        add_device: Vec<String>,
        remove_device: Vec<u32>,
        signing_threshold: Option<String>,
        rotation_threshold: Option<String>,
        from_device: bool,
        no_qr: bool,
        print_uri: bool,
        no_mdns: bool,
        timeout: u64,
    
},
    ExportBundle {
        alias: String,
        output_file: PathBuf,
        max_age_secs: u64,
    },
    AllowedSigners {
        alias: String,
        principal: Option<String>,
        output_file: Option<PathBuf>,
    },
    Register {
        registry: Option<String>,
    },
    Claim(ClaimCommand),
    Migrate(MigrateCommand),
    BindIdp(BindIdpStubCommand),
    UpdateScope {
        platform: String,
    },
    Agent(AgentCommand),
}

Variants

Create

Create a new signing identity.

Fields

metadata_file: PathBuf

Path to JSON file with arbitrary identity metadata.

local_key_alias: String

Name for the new signing key in secure storage.

preset: LayoutPreset

Storage layout preset for ecosystem compatibility. Use ‘radicle’ for Radicle repositories, ‘gitoxide’ for gitoxide, or ‘default’ for standard Auths layout.

Show

Show primary identity details (identity ID, metadata) from the Git repository.

List

List identities (currently same as show, forward-compatible for future multi-identity support).

Rotate

Rotate identity keys. Stores the new key under a new alias.

Fields

alias: Option<String>

Name of the key to rotate. Defaults to the next rotation key automatically.

current_key_alias: Option<String>

Current signing key name (alternative to –alias).

next_key_alias: Option<String>

Name for the new signing key after rotation.

add_witness: Vec<String>

Add a witness server address (repeatable).

remove_witness: Vec<String>

Remove a witness server address (repeatable).

witness_threshold: Option<u64>

Number of witnesses required to accept this rotation (e.g., 1).

dry_run: bool

Preview actions without making changes.

add_device: Vec<String>

Add a device slot on this rotation (repeatable). Value is the curve for the new slot (P256 or Ed25519).

remove_device: Vec<u32>

Remove a device slot by index on this rotation (repeatable). Currently rejected — requires CESR indexed-signature support.

signing_threshold: Option<String>

New signing threshold (scalar like "2" or fractions like "1/2,1/2,1/2"). Omit to keep the prior kt.

rotation_threshold: Option<String>

New rotation (next) threshold, same format as --signing-threshold. Omit to keep the prior nt.

from_device: bool

Receive the rotation from a paired device over LAN instead of authoring it locally. The device builds and co-signs the shared-KEL rotation; this host only validates it against the registry’s prior key state and appends it. No local key material is touched.

no_qr: bool

Don’t display the QR code for --from-device (only the short code).

print_uri: bool

Print the session token URI for --from-device so scripts can deliver it to the device out of band.

no_mdns: bool

Disable mDNS advertisement for --from-device.

timeout: u64

Session lifetime in seconds for --from-device.

ExportBundle

Export an identity bundle for stateless CI/CD verification.

Creates a portable JSON bundle containing the identity ID, public key, and authorization chain. This bundle can be used in CI pipelines to verify commit signatures without requiring access to the identity repository.

Fields

alias: String

Key alias to include in the bundle.

output_file: PathBuf

Output file path for the JSON bundle.

max_age_secs: u64

TTL in seconds. The bundle will fail verification after this many seconds.

AllowedSigners

Export a KEL-derived allowed_signers file so plain git / ssh can verify this identity’s signatures on machines without auths installed.

Point git at it with: git config gpg.ssh.allowedSignersFile

Fields

alias: String

Key alias whose current public key to export.

principal: Option<String>

Principal to bind the key to (usually the committer email). Defaults to the identity DID. Must match the signer identity git checks.

output_file: Option<PathBuf>

Write to this file instead of stdout.

Register

Publish this identity to a public registry for discovery.

Fields

registry: Option<String>

Registry URL to publish to.

Claim(ClaimCommand)

Add a platform claim to an already-registered identity.

Migrate(MigrateCommand)

Import existing GPG or SSH keys into Auths.

BindIdp(BindIdpStubCommand)

Bind this identity to an enterprise IdP (Okta, Entra ID, Google Workspace, SAML).

Requires the auths-cloud binary on $PATH. If not installed, prints information about Auths Cloud.

UpdateScope

Re-authorize with a platform and optionally upload SSH signing key.

Use this when you need to update OAuth scopes or re-authenticate with a platform (e.g., GitHub). Automatically uploads the SSH signing key if the write:ssh_signing_key scope is included.

Fields

platform: String

Platform to re-authorize with (e.g., github).

Agent(AgentCommand)

Manage AI agents delegated by this identity (KERI delegated identifiers).

Trait Implementations

impl Clone for IdSubcommand

fn clone(&self) -> IdSubcommand

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for IdSubcommand

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl FromArgMatches for IdSubcommand

fn from_arg_matches(__clap_arg_matches: &ArgMatches) -> Result<Self, Error>

Instantiate Self from ArgMatches, parsing the arguments as needed.

fn from_arg_matches_mut( __clap_arg_matches: &mut ArgMatches, ) -> Result<Self, Error>

Instantiate Self from ArgMatches, parsing the arguments as needed.

fn update_from_arg_matches( &mut self, __clap_arg_matches: &ArgMatches, ) -> Result<(), Error>

Assign values from ArgMatches to self.

fn update_from_arg_matches_mut<'b>( &mut self, __clap_arg_matches: &mut ArgMatches, ) -> Result<(), Error>

Assign values from ArgMatches to self.

impl Subcommand for IdSubcommand

fn augment_subcommands<'b>(__clap_app: Command) -> Command

Append to Command so it can instantiate Self via FromArgMatches::from_arg_matches_mut

fn augment_subcommands_for_update<'b>(__clap_app: Command) -> Command

Append to Command so it can instantiate self via FromArgMatches::update_from_arg_matches_mut

fn has_subcommand(__clap_name: &str) -> bool

Test whether Self can parse a specific subcommand