Enum Command 

pub enum Command {
    NewKey {
        key_id: String,
        key_type: KeyTypeArg,
    },
    Import {
        key_id: String,
        key_type: KeyTypeArg,
        seed_hex: Option<String>,
        pkcs8_file: Option<PathBuf>,
        check: bool,
    },
    ImportSet {
        file: PathBuf,
        check: bool,
    },
    Sign {
        key_id: String,
        payload: String,
    },
    Verify {
        key_id: String,
        signature: String,
        payload: String,
    },
    Encrypt {
        key_id: String,
        algorithm: AeadAlg,
        aad_hex: Option<String>,
        plaintext: String,
    },
    Decrypt {
        key_id: String,
        algorithm: AeadAlg,
        version: u32,
        nonce: String,
        ciphertext: String,
        aad_hex: Option<String>,
    },
    Get {
        key_id: String,
        version: Option<u32>,
        raw: bool,
        format: Option<GetOutputFormatArg>,
        out_file: Option<PathBuf>,
    },
    IssueNatsCreds {
        jwt: Option<String>,
        jwt_file: Option<PathBuf>,
        seed: Option<String>,
        seed_file: Option<PathBuf>,
        out_file: PathBuf,
        mode: SecretFileModeArg,
    },
    Set {
        key_id: String,
        hex: bool,
        value: String,
    },
    Rotate {
        key_id: String,
    },
    List {
        prefix: Option<String>,
    },
    MintJwt {
        key_id: String,
        sub: String,
        ttl_secs: Option<u64>,
        claims_json: String,
    },
    MintNatsUser {
        key_id: String,
        user_nkey: String,
        issuer_account: Option<String>,
        name: String,
        ttl_secs: Option<u64>,
        pub_allow: Vec<String>,
        pub_deny: Vec<String>,
        sub_allow: Vec<String>,
        sub_deny: Vec<String>,
    },
    SignNatsJwt {
        key_id: String,
        claims_json: Option<String>,
        claims_file: Option<PathBuf>,
        expect_type: Option<NatsJwtTypeArg>,
        ttl_secs: Option<u64>,
        expires_at_unix: Option<u64>,
        issued_at_unix: Option<u64>,
        rewrite_jti: bool,
    },
    IssueCert {
        key_id: String,
        common_name: String,
        dns_san: Vec<String>,
        ip_san: Vec<String>,
        ttl_secs: u64,
    },
    Status,
    Health {
        json: bool,
    },
    Ready {
        json: bool,
    },
    Reload {
        check: bool,
        json: bool,
    },
    Explain {
        subject: String,
        op: String,
        key: String,
        json: bool,
    },
    Revoke {
        trust_domain: String,
        jti: String,
        expires_at_unix: u64,
        json: bool,
    },
}

Variants

NewKey

Create a new asymmetric key.

Fields

key_id: String

Dotted catalog name for the new key.

key_type: KeyTypeArg

Key type to create.

Import

Import caller-provided (BYOK) key material into a catalog key. The broker fetches the backend transit wrapping_key, wraps the material with RSA-OAEP + AES-KWP in place, and POSTs it to keys/<k>/import; the raw material never lands on the backend unwrapped. Supply exactly one material source: --seed-hex (64 hex chars = a 32-byte Ed25519 seed; Ed25519-only) or --pkcs8-file (a PKCS#8 DER private key for Ed25519/RSA/P-256). Prints the key_id + public_key hex.

Fields

key_id: String

Dotted catalog name to import the key under.

key_type: KeyTypeArg

Key type of the imported material.

seed_hex: Option<String>

32-byte raw Ed25519 seed as 64 hex chars.

pkcs8_file: Option<PathBuf>

Path to a PKCS#8 DER private key file.

check: bool

Validate local inputs without contacting the agent or importing.

ImportSet

Import several keys from a JSON manifest in one all-or-nothing call. The broker authorizes import on EVERY entry before importing ANY, so an unauthorized entry rejects the whole batch and creates no keys. The manifest is a JSON array of objects: {"key_id": "...", "key_type": "ed25519", "seed_hex": "<64 hex>"} or with "pkcs8_file": "<path>" instead of "seed_hex". Raw seeds are Ed25519-only; RSA/P-256 use PKCS#8 DER. key_type defaults to ed25519 when omitted. Prints one key_id/public_key pair per imported key.

Fields

file: PathBuf

Path to the JSON manifest of keys to import.

check: bool

Validate the manifest without contacting the agent or importing.

Sign

Sign a payload and print the signature as hex.

Fields

key_id: String

payload: String

Verify

Verify a payload signature.

Fields

key_id: String

signature: String

payload: String

Encrypt

Encrypt a payload and print envelope fields.

Fields

key_id: String

algorithm: AeadAlg

aad_hex: Option<String>

plaintext: String

Decrypt

Decrypt an envelope and print plaintext as hex.

Fields

key_id: String

algorithm: AeadAlg

version: u32

nonce: String

ciphertext: String

aad_hex: Option<String>

Get

Fetch a value key. Prints version + hex value by default; --raw writes the bytes to stdout and --out-file writes them to a 0600 file. Use --format base64 when materializing secrets for consumers that require standard padded Base64.

Basil attests the caller by its kernel SO_PEERCRED uid/gid, so to fetch a secret as a particular service, run this CLI under that service’s identity (systemd User=/Group=, or runuser -u <svc>); the CLI cannot impersonate.

Fields

key_id: String

version: Option<u32>

raw: bool

Write the raw secret bytes to stdout (no hex, no version: line).

format: Option<GetOutputFormatArg>

Encode the value as raw, hex, standard padded base64, or URL-safe unpadded Base64. When set, stdout prints only the value and --out-file writes the encoded value instead of raw bytes.

out_file: Option<PathBuf>

Write the raw secret bytes to this file, created/truncated mode 0600.

IssueNatsCreds

Assemble a local NATS user .creds file from a signed user JWT and user NKey seed. This is local file plumbing: mint/sign the JWT first, then call this command to render the canonical credentials document.

Fields

jwt: Option<String>

Signed compact NATS user JWT. Prefer --jwt-file for automation so secrets do not appear in argv.

jwt_file: Option<PathBuf>

File containing the signed compact NATS user JWT.

seed: Option<String>

User NKey seed. Prefer --seed-file so the seed does not appear in argv.

seed_file: Option<PathBuf>

File containing the user NKey seed.

out_file: PathBuf

Destination .creds path.

mode: SecretFileModeArg

Destination file mode.

Set

Store a value key from text or hex.

Fields

key_id: String

hex: bool

value: String

Rotate

Rotate a key and print the new version.

Fields

key_id: String

List

List visible catalog keys.

Fields

prefix: Option<String>

MintJwt

Mint a generic JWT.

Fields

key_id: String

sub: String

ttl_secs: Option<u64>

claims_json: String

MintNatsUser

Mint a NATS user JWT signed by an account key held by Basil.

When --key-id is an account signing key (not the account identity key), pass --issuer-account with the owning account’s identity public NKey (A…); otherwise the minted user carries no issuer_account and nats-server rejects the connection with an authorization violation. Omit --issuer-account when --key-id is the account identity key itself.

Fields

key_id: String

user_nkey: String

issuer_account: Option<String>

Owning account identity public NKey (A…); required when --key-id is an account signing key.

name: String

ttl_secs: Option<u64>

pub_allow: Vec<String>

pub_deny: Vec<String>

sub_allow: Vec<String>

sub_deny: Vec<String>

SignNatsJwt

Validate and sign a caller-supplied NATS JWT claim document.

Fields

key_id: String

claims_json: Option<String>

claims_file: Option<PathBuf>

expect_type: Option<NatsJwtTypeArg>

ttl_secs: Option<u64>

expires_at_unix: Option<u64>

issued_at_unix: Option<u64>

rewrite_jti: bool

IssueCert

Issue a DNS/IP-SAN X.509 leaf (TLS cert) from a backend PKI engine, signed by the issuer CA the broker holds in place. Prints the leaf+chain and the issuing-CA chain as CERTIFICATE PEM blocks and the leaf key as a PRIVATE KEY PEM block, so the output pipes into openssl x509/openssl pkey. The issuing CA key never leaves the backend.

Fields

key_id: String

Catalog key of the issuer (a pki/issue/<role> engine key).

common_name: String

Subject common name for the leaf certificate.

dns_san: Vec<String>

DNS SAN to bind (repeatable).

ip_san: Vec<String>

IP SAN to bind (repeatable).

ttl_secs: u64

Requested certificate lifetime in seconds.

Status

Print the agent backend, version, and protocol.

Health

Liveness probe: is the agent process up and serving the socket? Cheap; the agent does no backend I/O. Exits 0 when alive, nonzero on a connect/RPC failure. With --json, prints a stable one-line JSON object for automation (systemd WatchdogSec companion, container liveness check).

Fields

json: bool

Emit a machine-readable JSON object instead of human lines.

Ready

Readiness probe: can the agent actually serve data-plane ops? The agent probes every backend and catalog key and returns a non-secret summary. Exits 0 when ready, 1 when not ready (and nonzero on a connect/RPC failure). With --json, prints a stable one-line JSON object for automation (systemd ExecStartPost, container HEALTHCHECK, k8s readiness probe). Never prints key names or secret material.

Fields

json: bool

Emit a machine-readable JSON object instead of human lines.

Reload

Hot-reload the agent’s catalog/policy generation FROM DISK. The agent re-reads the catalog/policy from the paths it was started with (the request carries NO config: config can never be supplied over the wire), validates the candidate, and atomically swaps in a new generation on success. Prints the old->new generation id + key/grant counts. Requires the dedicated reload permission (not implied by any data-plane grant); a caller lacking it is denied. Exits 0 on success, nonzero on rejection or permission-denied. With --check, validates the candidate WITHOUT swapping (dry-run).

Fields

check: bool

Dry-run: validate the on-disk candidate without swapping the serving generation. Exits nonzero if the candidate would be rejected.

json: bool

Emit a machine-readable JSON object instead of human lines.

Explain

Ask the running agent why a subject would be allowed or denied for a given operation and key. Requires the dedicated explain admin permission.

Fields

subject: String

Subject name to evaluate.

op: String

Policy op token to evaluate (get, sign, set, …).

key: String

Catalog key/target to evaluate.

json: bool

Emit a machine-readable JSON object instead of human lines.

Revoke

Revoke a JWT-SVID by trust-domain and jti. Requires the dedicated revoke admin permission over broker.revoke and a configured persistent revocation_store=jwt-svid value key.

Fields

trust_domain: String

SPIFFE trust domain for the token issuer, without spiffe://.

jti: String

JWT ID (jti) to deny.

expires_at_unix: u64

Unix expiry of the credential; the deny-list entry expires then.

json: bool

Emit a machine-readable JSON object instead of human lines.

Trait Implementations

impl Debug for Command

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl FromArgMatches for Command

fn from_arg_matches(__clap_arg_matches: &ArgMatches) -> Result<Self, Error>

Instantiate Self from ArgMatches, parsing the arguments as needed.

fn from_arg_matches_mut( __clap_arg_matches: &mut ArgMatches, ) -> Result<Self, Error>

Instantiate Self from ArgMatches, parsing the arguments as needed.

fn update_from_arg_matches( &mut self, __clap_arg_matches: &ArgMatches, ) -> Result<(), Error>

Assign values from ArgMatches to self.

fn update_from_arg_matches_mut<'b>( &mut self, __clap_arg_matches: &mut ArgMatches, ) -> Result<(), Error>

Assign values from ArgMatches to self.

impl Subcommand for Command

fn augment_subcommands<'b>(__clap_app: Command) -> Command

Append to Command so it can instantiate Self via FromArgMatches::from_arg_matches_mut

fn augment_subcommands_for_update<'b>(__clap_app: Command) -> Command

Append to Command so it can instantiate self via FromArgMatches::update_from_arg_matches_mut

fn has_subcommand(__clap_name: &str) -> bool

Test whether Self can parse a specific subcommand