@astrale-os/cli 0.4.0-alpha.13

package/src/commands/domain/publish.ts

@@ -0,0 +1,155 @@
+import chalk from 'chalk'
+
+import type { CommandDefinition } from '../../command'
+import type { KernelCommandOpts } from '../../kernel'
+
+import { withAdminKernelClient } from '../../kernel/client'
+import { ADMIN_DOMAIN, type DomainInfo } from '../../lib/admin-domain'
+import { ADMIN_TARGET_OPTIONS, type AdminTargetCommandOpts } from '../../lib/admin-target'
+import { fatal, withSpinner } from '../../lib/log'
+import { isMachine, output } from '../../lib/output'
+import { promptText } from '../../lib/prompt'
+import { isHttpUrl, validateName, validateUrl } from '../../lib/validation'
+
+type PublishOpts = KernelCommandOpts &
+  AdminTargetCommandOpts & {
+    origin?: string
+    name?: string
+    // `--public-url`, not `--url`: the global `--url` already means "target this
+    // kernel" (KERNEL_PASSTHROUGH_OPTIONS). This is the domain's own public
+    // address the kernel installs from — named for the role, not the substrate.
+    publicUrl?: string
+    description?: string
+    installByDefault?: boolean
+    // Global flags (program.ts) that force non-interactive — mirrors `instance use`.
+    ci?: boolean
+    noPrompt?: boolean
+  }
+
+/** Host of a URL (the natural `origin` default), or undefined if unparseable. */
+function hostOf(url?: string): string | undefined {
+  if (!url) return undefined
+  try {
+    return new URL(url).host
+  } catch {
+    return undefined
+  }
+}
+
+export default {
+  name: 'publish',
+  description: 'Register a deployed domain in the admin catalog (DomainEntry.publish)',
+  afterHelpText: `
+Behavior:
+  Upserts a catalog entry on the configured admin kernel: a domain's addressing
+  \`origin\`, registry \`name\`, and published \`url\` (no bytes, no version — the
+  author deploys the worker independently; publish just points the registry at
+  it). Idempotent: re-publishing the same name updates its url — and a publish
+  that would change nothing is reported as "already up to date" (no write).
+
+  Publishing only makes the domain INSTALLABLE. Mount it on an instance with
+  \`astrale domain install <url>\` (or rely on the admin's install-by-default
+  policy). This is usually invoked for you by \`astrale-domain publish\` (which
+  registers the already-deployed URL — it does NOT deploy) or by
+  \`astrale-domain deploy --publish\` (deploy AND register in one step).
+
+  Run in a terminal with flags omitted and it PROMPTS for origin / name /
+  public-url (origin defaults to the URL host, name to the origin's first
+  label). With no TTY — or \`--ci\` / \`--no-prompt\` — those three are required
+  up front, so piped / CI / agent runs fail fast instead of waiting on input.
+
+Examples:
+  $ astrale domain publish --origin crm.acme.dev --name crm --public-url https://crm.acme.dev
+`,
+  options: [
+    ...ADMIN_TARGET_OPTIONS,
+    { flags: '--origin <origin>', description: 'Domain addressing origin (e.g. crm.acme.dev)' },
+    { flags: '--name <name>', description: 'Registry name / catalog slug (e.g. crm)' },
+    { flags: '--public-url <url>', description: 'Public URL the kernel installs the domain from' },
+    { flags: '--description <text>', description: 'Optional human description for the catalog' },
+    {
+      flags: '--install-by-default',
+      description: 'Mark the domain for install on every new instance (alphaCreate)',
+    },
+  ],
+  // No positional arguments → Commander passes (opts, command); `opts` is first.
+  action: async (opts: PublishOpts) => {
+    try {
+      // Interactive fill (TTY only): a human running this by hand is prompted for
+      // any missing field. The primary caller — `astrale-domain publish` — always
+      // passes every flag, so it never prompts. No TTY / --ci / --no-prompt / CI
+      // env → no prompt: fall straight through to the required-flag error below,
+      // so a piped / agent / LLM run fails fast instead of hanging on a read.
+      const interactive = !!process.stdin.isTTY && !(opts.ci || opts.noPrompt || process.env.CI)
+      let { origin, name, publicUrl } = opts
+      if (interactive) {
+        if (!publicUrl)
+          publicUrl = await promptText('Public URL (https://…)', {
+            validate: (v) => isHttpUrl(v) || 'Enter a valid http(s) URL',
+          })
+        if (!origin)
+          origin = await promptText('Domain origin (e.g. crm.acme.dev)', {
+            default: hostOf(publicUrl),
+          })
+        if (!name) name = await promptText('Registry name', { default: origin?.split('.')[0] })
+      }
+
+      if (!origin || !name || !publicUrl) {
+        throw new Error(
+          'domain publish requires --origin, --name and --public-url, e.g.\n' +
+            '  astrale domain publish --origin crm.acme.dev --name crm --public-url https://crm.acme.dev',
+        )
+      }
+      validateName(origin, 'origin')
+      validateName(name, 'domain')
+      validateUrl(publicUrl)
+
+      const result = await withSpinner(
+        `Publishing ${name} → ${publicUrl}`,
+        !isMachine(opts),
+        () =>
+          withAdminKernelClient(opts, async (ctx) => {
+            // Read the current catalog entry first: a re-publish that would write
+            // the same origin/name/url/description/install flag is a no-op we
+            // report as "already up to date" (and skip the write) rather than
+            // silently bumping `updatedAt`. `info` throws when absent → treat as
+            // a fresh publish.
+            const existing = (await ctx.client
+              .call(`${ADMIN_DOMAIN}/info`, { origin })
+              .catch(() => null)) as DomainInfo | null
+            if (
+              existing &&
+              existing.name === name &&
+              existing.url === publicUrl &&
+              (opts.description === undefined || existing.description === opts.description) &&
+              (opts.installByDefault === undefined ||
+                (existing.installByDefault ?? false) === opts.installByDefault)
+            ) {
+              return { entry: existing, changed: false as const, isNew: false }
+            }
+            const entry = (await ctx.client.call(`${ADMIN_DOMAIN}/publish`, {
+              origin,
+              name,
+              url: publicUrl,
+              ...(opts.description ? { description: opts.description } : {}),
+              ...(opts.installByDefault ? { installByDefault: true } : {}),
+            })) as DomainInfo
+            return { entry, changed: true as const, isNew: !existing }
+          }),
+        {
+          success: ({ entry, changed, isNew }) =>
+            changed
+              ? `${isNew ? 'Published' : 'Updated'}: ${entry.name} ${chalk.dim(`(${entry.origin} → ${entry.url})`)}`
+              : `Already up to date: ${entry.name} ${chalk.dim(`(${entry.origin} → ${entry.url} — no change, already latest)`)}`,
+        },
+      )
+
+      if (isMachine(opts)) {
+        output({ ...result.entry, changed: result.changed }, opts)
+        return
+      }
+    } catch (e) {
+      fatal(e)
+    }
+  },
+} satisfies CommandDefinition

package/src/commands/get.ts

@@ -0,0 +1,60 @@
+import type { CommandDefinition } from '../command'
+import type { KernelCommandOpts } from '../kernel'
+
+import { expandSelfInPath, runKernelCommand, withSelfHint } from '../kernel'
+import { log } from '../lib/log'
+import { output } from '../lib/output'
+
+type GetOpts = KernelCommandOpts & { long?: boolean }
+
+const INTERNAL_KEYS = new Set(['__labels', 'classId'])
+
+export async function getCommand(path: string, opts: GetOpts): Promise<void> {
+  let expandedPath: string
+  let meta
+  try {
+    ;({ path: expandedPath, meta } = await expandSelfInPath(path, opts))
+  } catch (e) {
+    log.error(e instanceof Error ? e.message : 'Invalid @self expansion')
+    process.exit(1)
+  }
+  await runKernelCommand({
+    opts,
+    label: `Node ${expandedPath}`,
+    fn: (ctx) => withSelfHint(() => ctx.client.call(`${expandedPath}::get`, {}), meta),
+    format: (result, fmtOpts) => {
+      output(opts.long ? result : cleanNode(result), fmtOpts)
+    },
+  })
+}
+
+function cleanNode(data: unknown): unknown {
+  if (!data || typeof data !== 'object') return data
+  const result: Record<string, unknown> = {}
+  for (const [k, v] of Object.entries(data as Record<string, unknown>)) {
+    if (INTERNAL_KEYS.has(k)) continue
+    result[k] = v
+  }
+  return result
+}
+
+export default {
+  name: 'get',
+  description: 'Get a node by path or ID',
+  afterHelpText: `
+Behavior:
+  Accepts a tree path (/domain/class.Name) or an id (@nodeId). -l adds
+  the internal fields (__labels, classId) hidden in the summary view.
+
+Examples:
+  $ astrale get /kernel.astrale.ai/class.Root
+  $ astrale get @abc123 -l
+`,
+  arguments: [{ name: 'path', description: 'Node path (/domain/Class) or ID (@nodeId)' }],
+  options: [
+    { flags: '-l, --long', description: 'Include all internal fields (__labels, classId)' },
+  ],
+  action: async (path, opts) => {
+    await getCommand(path as string, opts as Parameters<typeof getCommand>[1])
+  },
+} satisfies CommandDefinition

package/src/commands/identity/create.ts

@@ -0,0 +1,26 @@
+import type { CommandDefinition } from '../../command'
+
+import { createIdentity } from '../../lib/identity'
+import { fatal, log } from '../../lib/log'
+
+export default {
+  name: 'create',
+  description: 'Create a new identity',
+  arguments: [{ name: 'name', description: 'Identity name', required: true }],
+  options: [
+    { flags: '--subject <sub>', description: 'Custom subject (defaults to name)' },
+    { flags: '--local', description: 'Local-only identity (default)' },
+    { flags: '--remote', description: 'Remote (cloud-synced) identity — requires cloud login' },
+  ],
+  action: async (name: string, opts: { subject?: string; local?: boolean; remote?: boolean }) => {
+    try {
+      const mode = opts.remote ? 'remote' : 'local'
+      const identity = await createIdentity(name, { subject: opts.subject, mode })
+      log.success(
+        `Created identity "${name}" (subject: ${identity.subject}, mode: ${identity.mode})`,
+      )
+    } catch (e) {
+      fatal(e)
+    }
+  },
+} satisfies CommandDefinition

package/src/commands/identity/delete.ts

@@ -0,0 +1,18 @@
+import type { CommandDefinition } from '../../command'
+
+import { deleteIdentity } from '../../lib/identity'
+import { fatal, log } from '../../lib/log'
+
+export default {
+  name: 'delete',
+  description: 'Delete an identity',
+  arguments: [{ name: 'name', description: 'Identity name', required: true }],
+  action: async (name: string) => {
+    try {
+      await deleteIdentity(name)
+      log.success(`Deleted identity "${name}"`)
+    } catch (e) {
+      fatal(e)
+    }
+  },
+} satisfies CommandDefinition

package/src/commands/identity/export.ts

@@ -0,0 +1,66 @@
+import { CompactEncrypt } from 'jose'
+import { chmod, readFile, writeFile } from 'node:fs/promises'
+
+import type { CommandDefinition } from '../../command'
+
+import { getIdentity } from '../../lib/identity'
+import { keypairPaths } from '../../lib/keys'
+import { fatal, log } from '../../lib/log'
+import { readPassphrase } from '../../lib/prompt'
+
+/**
+ * Export the per-identity keypair as a plaintext JWK envelope by default.
+ * With `--encrypt`, wrap it in a JOSE JWE (PBES2-HS256+A128KW / A256GCM)
+ * using a passphrase prompted from the TTY.
+ */
+export default {
+  name: 'export',
+  description: 'Export an identity keypair to disk (optional --encrypt)',
+  arguments: [
+    { name: 'name', description: 'Identity name', required: true },
+    { name: 'path', description: 'Output file path', required: true },
+  ],
+  options: [
+    { flags: '--encrypt', description: 'Encrypt the envelope with a passphrase (JOSE JWE)' },
+  ],
+  action: async (name: string, path: string, opts: { encrypt?: boolean }) => {
+    try {
+      const identity = await getIdentity(name)
+      const { privatePath, publicPath } = keypairPaths(identity.subject)
+      const [privateJwk, publicJwk] = await Promise.all([
+        readFile(privatePath, 'utf-8').then(JSON.parse),
+        readFile(publicPath, 'utf-8').then(JSON.parse),
+      ])
+      const envelope = {
+        version: 1,
+        subject: identity.subject,
+        mode: identity.mode ?? 'local',
+        kid: identity.kid,
+        issuer: identity.issuer,
+        privateJwk,
+        publicJwk,
+      }
+      const plain = JSON.stringify(envelope, null, 2)
+
+      if (opts.encrypt) {
+        const passphrase = await readPassphrase('Passphrase (min 8 chars): ', { minLength: 8 })
+        const enc = await new CompactEncrypt(new TextEncoder().encode(plain))
+          .setProtectedHeader({ alg: 'PBES2-HS256+A128KW', enc: 'A256GCM' })
+          .encrypt(new TextEncoder().encode(passphrase))
+        await writeFile(path, enc)
+      } else {
+        await writeFile(path, plain)
+      }
+      await chmod(path, 0o600)
+
+      log.success(`Exported identity "${name}" → ${path}${opts.encrypt ? ' (encrypted)' : ''}`)
+      if (!opts.encrypt) {
+        log.warn(
+          '  Plaintext private JWK — keep this file secure. Use --encrypt for passphrase wrapping.',
+        )
+      }
+    } catch (e) {
+      fatal(e)
+    }
+  },
+} satisfies CommandDefinition

package/src/commands/identity/import.ts

@@ -0,0 +1,101 @@
+import { compactDecrypt, importJWK } from 'jose'
+import { readFile, writeFile, mkdir } from 'node:fs/promises'
+import { dirname } from 'node:path'
+
+import type { CommandDefinition } from '../../command'
+import type { RegistryMode } from '../../lib/validation'
+
+import { createIdentity, upsertKeyIdentity } from '../../lib/identity'
+import { keypairPaths } from '../../lib/keys'
+import { fatal, log } from '../../lib/log'
+import { readPassphrase } from '../../lib/prompt'
+
+type ExportEnvelope = {
+  version?: number
+  subject: string
+  mode?: RegistryMode
+  kid?: string
+  issuer?: string
+  privateJwk: Record<string, unknown>
+  publicJwk: Record<string, unknown>
+}
+
+function looksEncrypted(raw: string): boolean {
+  // JOSE compact JWE is 5 base64 segments separated by `.`.
+  return raw.trim().split('.').length === 5 && !raw.trim().startsWith('{')
+}
+
+export default {
+  name: 'import',
+  description: 'Import an identity keypair envelope (auto-detects JWE)',
+  arguments: [{ name: 'path', description: 'Envelope file path', required: true }],
+  options: [
+    {
+      flags: '--name <name>',
+      description: 'Override identity name (defaults to envelope subject)',
+    },
+    {
+      flags: '--issuer <url>',
+      description: 'Default issuer for credentials signed with this imported key',
+    },
+    {
+      flags: '--replace',
+      description: 'Replace an existing key-backed identity with the imported keypair',
+    },
+  ],
+  action: async (path: string, opts: { name?: string; issuer?: string; replace?: boolean }) => {
+    try {
+      const raw = await readFile(path, 'utf-8')
+
+      let envelopeJson: string
+      if (looksEncrypted(raw)) {
+        const passphrase = await readPassphrase('Passphrase: ')
+        const { plaintext } = await compactDecrypt(
+          raw.trim(),
+          new TextEncoder().encode(passphrase),
+          {
+            keyManagementAlgorithms: ['PBES2-HS256+A128KW'],
+          },
+        )
+        envelopeJson = new TextDecoder().decode(plaintext)
+      } else {
+        envelopeJson = raw
+      }
+
+      const env = JSON.parse(envelopeJson) as ExportEnvelope
+      if (!env?.subject || !env?.privateJwk || !env?.publicJwk) {
+        fatal(new Error('Invalid envelope: missing subject / privateJwk / publicJwk'))
+      }
+
+      // Validate the keypair parses before touching the registry.
+      await importJWK(env.privateJwk as never, 'ES256')
+
+      const name = opts.name ?? env.subject
+      // Create registry entry (without regenerating keys — we'll write the imported ones).
+      if (opts.replace) {
+        await upsertKeyIdentity(name, {
+          subject: env.subject,
+          mode: env.mode ?? 'local',
+          issuer: opts.issuer ?? env.issuer,
+          kid: env.kid,
+        })
+      } else {
+        await createIdentity(name, {
+          subject: env.subject,
+          mode: env.mode ?? 'local',
+          issuer: opts.issuer ?? env.issuer,
+          kid: env.kid,
+          skipKeygen: true,
+        })
+      }
+      const { privatePath, publicPath } = keypairPaths(env.subject)
+      await mkdir(dirname(privatePath), { recursive: true })
+      await writeFile(privatePath, JSON.stringify(env.privateJwk, null, 2), { mode: 0o600 })
+      await writeFile(publicPath, JSON.stringify(env.publicJwk, null, 2), { mode: 0o600 })
+
+      log.success(`Imported identity "${name}" (subject=${env.subject}, kid=${env.kid ?? '?'})`)
+    } catch (e) {
+      fatal(e)
+    }
+  },
+} satisfies CommandDefinition

package/src/commands/identity/list.ts

@@ -0,0 +1,56 @@
+import chalk from 'chalk'
+
+import type { CommandDefinition } from '../../command'
+import type { ListOpts, ListProjection } from '../../lib/output'
+
+import { readIdentities } from '../../lib/identity'
+import { log } from '../../lib/log'
+import { isMachine, presentList, RAW_OUTPUT_OPTIONS } from '../../lib/output'
+
+type IdentityRow = {
+  name: string
+  subject: string
+  source: string
+  idp?: string
+  default: boolean
+  createdAt?: string
+}
+
+function projection(items: IdentityRow[]): ListProjection {
+  return {
+    columns: [
+      { key: 'name', header: 'NAME', color: chalk.bold },
+      { key: 'subject', header: 'SUBJECT', color: chalk.dim },
+      { key: 'source', header: 'SOURCE', color: chalk.dim },
+    ],
+    rows: items.map((i) => ({
+      name: i.default ? `${i.name} ${chalk.green('*')}` : i.name,
+      subject: i.subject !== i.name ? i.subject : '',
+      source: i.source === 'idp' ? `idp:${i.idp ?? '?'}` : 'key',
+    })),
+    paths: items.map((i) => i.name),
+  }
+}
+
+export default {
+  name: 'list',
+  description: 'List all identities',
+  options: [...RAW_OUTPUT_OPTIONS],
+  action: async (opts: ListOpts) => {
+    const store = await readIdentities()
+    const items: IdentityRow[] = Object.entries(store.identities).map(([name, id]) => ({
+      name,
+      subject: id.subject,
+      source: id.source ?? 'key',
+      idp: id.idp,
+      default: name === store.default,
+      createdAt: id.createdAt,
+    }))
+
+    if (items.length === 0 && !isMachine(opts)) {
+      log.dim('  No identities. Run: astrale identity create <name>')
+      return
+    }
+    presentList(items, opts, projection)
+  },
+} satisfies CommandDefinition

package/src/commands/identity/register.ts

@@ -0,0 +1,170 @@
+import { K } from '@astrale-os/kernel-core'
+import { importJWK, SignJWT, type JWK } from 'jose'
+import { readFile } from 'node:fs/promises'
+
+import type { CommandDefinition } from '../../command'
+import type { KernelCommandOpts } from '../../kernel'
+
+import { runKernelCommand } from '../../kernel'
+import { KERNEL_PASSTHROUGH_OPTIONS } from '../../kernel/options'
+import { getIdentity, setRegistration } from '../../lib/identity'
+import { getActive } from '../../lib/instance'
+import { fileExists, keypairPaths } from '../../lib/keys'
+import { fatal, log } from '../../lib/log'
+import { output } from '../../lib/output'
+
+type CreateNodeResult = { id: string; path: string }
+type RegisterIdentityResult = { iss: string; sub: string }
+
+type RegisterOpts = KernelCommandOpts & {
+  class?: string
+  path?: string
+  props?: string
+}
+
+async function readJwk(path: string): Promise<JWK> {
+  const raw = await readFile(path, 'utf-8')
+  return JSON.parse(raw) as JWK
+}
+
+type ChildNode = { class?: string; path?: string }
+
+/**
+ * Discover the identity-bearer class on the target instance: find the
+ * installed distribution domain (whatever its origin — `dist.astrale.ai` in
+ * prod, `dist.localhost` locally) and address its `User` class semantically.
+ * The bearer class must exist before a non-root identity can be registered;
+ * failing here names the real problem instead of surfacing as a confusing
+ * permission error on a hardcoded prod origin.
+ */
+async function resolveUserClassPath(ctx: {
+  client: { call(path: string, params: unknown): Promise<unknown> }
+}): Promise<string> {
+  const children = (await ctx.client.call('/::listChildren', {})) as ChildNode[]
+  const domains = children
+    .filter((c) => typeof c.class === 'string' && c.class.endsWith(':class.Domain'))
+    .map((c) => (c.path ?? '').replace(/^\//, ''))
+    .filter(Boolean)
+  for (const origin of domains) {
+    try {
+      // The class materializes as a `class.User` Folder under the domain mount;
+      // a resolvable read means the domain declares it.
+      await ctx.client.call(`/${origin}/class.User::get`, {})
+      return `/:${origin}:class.User`
+    } catch {
+      // This domain has no User class — try the next one.
+    }
+  }
+  throw new Error(
+    'No installed domain declares a `User` class on this instance — registering a ' +
+      'non-root identity needs an identity-bearer class (install the distribution ' +
+      'domain, or pass --class <classPath> explicitly).',
+  )
+}
+
+async function mintBootstrapJwt(privateJwk: JWK): Promise<string> {
+  const kid = (privateJwk.kid as string | undefined) ?? 'bootstrap'
+  const key = await importJWK(privateJwk, 'ES256')
+  return new SignJWT({})
+    .setProtectedHeader({ alg: 'ES256', kid })
+    .setIssuer('self')
+    .setSubject('bootstrap')
+    .setAudience('bootstrap')
+    .setIssuedAt()
+    .setExpirationTime('5m')
+    .sign(key)
+}
+
+export default {
+  name: 'register',
+  description:
+    "Register a local identity with the target instance's kernel — publishes the public " +
+    'key under a thumbprint-derived issuer and caches the resolved (iss, sub) for future calls',
+  arguments: [{ name: 'name', description: 'Identity name', required: true }],
+  options: [
+    {
+      flags: '--class <classPath>',
+      description:
+        'Class path of the identity node to create (default: /:dist.<origin>:class.User when distribution is installed)',
+    },
+    {
+      flags: '--path <nodePath>',
+      description: 'Path of the new identity node (default: /workspace/users/<name>)',
+    },
+    {
+      flags: '--props <json>',
+      description:
+        'Extra props for the identity node (JSON). A User-class node defaults ' +
+        'firstName/lastName to the identity name when omitted.',
+    },
+    ...KERNEL_PASSTHROUGH_OPTIONS,
+  ],
+  action: async (name: string, opts: RegisterOpts) => {
+    try {
+      const identity = await getIdentity(name)
+      const { privatePath, publicPath } = keypairPaths(identity.subject)
+      if (!(await fileExists(privatePath)) || !(await fileExists(publicPath))) {
+        fatal(
+          new Error(
+            `No keypair on disk for "${name}" (expected ${privatePath}). Recreate via \`astrale identity create ${name}\`.`,
+          ),
+        )
+      }
+      const privateJwk = await readJwk(privatePath)
+      const publicJwk = await readJwk(publicPath)
+      const nodePath = opts.path ?? `/workspace/users/${name}`
+
+      await runKernelCommand({
+        opts,
+        label: `Register "${name}"`,
+        fn: async (ctx) => {
+          const instanceSlug = opts.instance ?? opts.url ?? (await getActive(ctx.config)).name
+          const existing = identity.registrations?.[instanceSlug]
+          if (existing) {
+            log.warn(`"${name}" already registered on "${instanceSlug}"`)
+            return existing
+          }
+
+          const classPath = opts.class ?? (await resolveUserClassPath(ctx))
+
+          // A bare `astrale identity create <name>` carries no profile, but the
+          // bearer class may require one (distribution's User wants
+          // firstName/lastName) — default both to the identity name so a dev
+          // registration works out of the box; `--props` overrides.
+          const extraProps = opts.props ? (JSON.parse(opts.props) as Record<string, unknown>) : {}
+          const userDefaults = classPath.endsWith(':class.User')
+            ? { firstName: name, lastName: name }
+            : {}
+
+          const node = (await ctx.client.call(K.Node.createNode.path.method.raw, {
+            class: classPath,
+            path: nodePath,
+            props: { 'Statused.status': 'creating', ...userDefaults, ...extraProps },
+          })) as CreateNodeResult
+
+          const bootstrap = await mintBootstrapJwt(privateJwk)
+          const result = (await ctx.client.call(`@${node.id}::registerIdentity`, {
+            signingKey: {
+              publicKey: { jwk: publicJwk },
+              credential: bootstrap,
+            },
+          })) as RegisterIdentityResult
+
+          await setRegistration(name, instanceSlug, {
+            iss: result.iss,
+            sub: result.sub,
+            registeredAt: new Date().toISOString(),
+          })
+          return result
+        },
+        format: (result, fmtOpts) => {
+          output(result, fmtOpts)
+          log.dim(`  iss=${result.iss}`)
+          log.dim(`  sub=${result.sub}`)
+        },
+      })
+    } catch (e) {
+      fatal(e)
+    }
+  },
+} satisfies CommandDefinition