From ffaeae38299783dc7826c19dbdc9c8b33ed8bed5 Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Fri, 11 Sep 2026 13:51:50 +0200
Subject: [PATCH] idunn-provision prints the derived identity id of an enrolled
 store

provider-health-identity-id and host-actuator-identity-id are read-only.
The id is what a binding names as expected_signer_identity_id and what
a host is keyed by; deriving it here closes the gap where an operator
had to decode an anchor by hand to fill a binding.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 src/provisioning.rs | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/src/provisioning.rs b/src/provisioning.rs
index 0bf4cd7..1c74a83 100644
--- a/src/provisioning.rs
+++ b/src/provisioning.rs
@@ -49,6 +49,18 @@ pub fn run(args: impl IntoIterator<Item = String>) -> Result<()> {
             let public_key = provider_health_public_key(&options)?;
             println!("{public_key}");
         }
+        "provider-health-identity-id" => {
+            println!(
+                "{}",
+                identity_id::<GameCultProviderHealthIdentity>(&options)?
+            );
+        }
+        "host-actuator-identity-id" => {
+            println!(
+                "{}",
+                identity_id::<crate::host_actuator::IdunnHostActuatorIdentity>(&options)?
+            );
+        }
         "export-provider-health-public-anchor" => export_identity_anchor::<
             GameCultProviderHealthIdentity,
         >(
@@ -127,6 +139,15 @@ fn enroll_provider_health_identity(options: &BTreeMap<String, String>) -> Result
     encode_public_key(&signer.entry().public_key)
 }
 
+/// The profile-derived identity id of an enrolled private store, read-only.
+/// This is the value an operator binding names as `expected_signer_identity_id`
+/// or that a host binding is keyed by; it is derived, never typed.
+fn identity_id<P: ServiceIdentityProfile>(options: &BTreeMap<String, String>) -> Result<String> {
+    require_only(options, &["private-store"])?;
+    let signer = open_service_identity_at::<P>(&path(options, "private-store")?)?;
+    Ok(signer.entry().identity_id.clone())
+}
+
 fn provider_health_public_key(options: &BTreeMap<String, String>) -> Result<String> {
     require_only(options, &["private-store"])?;
     let signer = open_service_identity_at::<GameCultProviderHealthIdentity>(&path(