@astrale-os/cli 0.8.1-alpha.0 → 0.8.1-alpha.2

package/src/commands/identity/import.ts

@@ -1,30 +1,15 @@
-import { compactDecrypt, importJWK } from 'jose'
-import { readFile, writeFile, mkdir } from 'node:fs/promises'
-import { dirname } from 'node:path'
+import { readFile } from 'node:fs/promises'
 
-import type { CommandDefinition } from '../../command'
-import type { RegistryMode } from '../../lib/validation'
+import type { CommandDefinition } from '../../program/index'
 
-import { createIdentity, upsertKeyIdentity } from '../../lib/identity'
-import { keypairPaths } from '../../lib/keys'
+import {
+  decodeIdentityExport,
+  importIdentity,
+  isEncryptedIdentityExport,
+} from '../../identity/index'
 import { fatal, log } from '../../lib/log'
 import { readPassphrase } from '../../lib/prompt'
 
-type ExportEnvelope = {
-  version?: number
-  subject: string
-  mode?: RegistryMode
-  kid?: string
-  issuer?: string
-  privateJwk: Record<string, unknown>
-  publicJwk: Record<string, unknown>
-}
-
-function looksEncrypted(raw: string): boolean {
-  // JOSE compact JWE is 5 base64 segments separated by `.`.
-  return raw.trim().split('.').length === 5 && !raw.trim().startsWith('{')
-}
-
 export default {
   name: 'import',
   description: 'Import an identity keypair envelope (auto-detects JWE)',
@@ -46,54 +31,20 @@ export default {
   action: async (path: string, opts: { name?: string; issuer?: string; replace?: boolean }) => {
     try {
       const raw = await readFile(path, 'utf-8')
-
-      let envelopeJson: string
-      if (looksEncrypted(raw)) {
-        const passphrase = await readPassphrase('Passphrase: ')
-        const { plaintext } = await compactDecrypt(
-          raw.trim(),
-          new TextEncoder().encode(passphrase),
-          {
-            keyManagementAlgorithms: ['PBES2-HS256+A128KW'],
-          },
-        )
-        envelopeJson = new TextDecoder().decode(plaintext)
-      } else {
-        envelopeJson = raw
-      }
-
-      const env = JSON.parse(envelopeJson) as ExportEnvelope
-      if (!env?.subject || !env?.privateJwk || !env?.publicJwk) {
-        fatal(new Error('Invalid envelope: missing subject / privateJwk / publicJwk'))
-      }
-
-      // Validate the keypair parses before touching the registry.
-      await importJWK(env.privateJwk as never, 'ES256')
-
-      const name = opts.name ?? env.subject
-      // Create registry entry (without regenerating keys — we'll write the imported ones).
-      if (opts.replace) {
-        await upsertKeyIdentity(name, {
-          subject: env.subject,
-          mode: env.mode ?? 'local',
-          issuer: opts.issuer ?? env.issuer,
-          kid: env.kid,
-        })
-      } else {
-        await createIdentity(name, {
-          subject: env.subject,
-          mode: env.mode ?? 'local',
-          issuer: opts.issuer ?? env.issuer,
-          kid: env.kid,
-          skipKeygen: true,
-        })
-      }
-      const { privatePath, publicPath } = keypairPaths(env.subject)
-      await mkdir(dirname(privatePath), { recursive: true })
-      await writeFile(privatePath, JSON.stringify(env.privateJwk, null, 2), { mode: 0o600 })
-      await writeFile(publicPath, JSON.stringify(env.publicJwk, null, 2), { mode: 0o600 })
-
-      log.success(`Imported identity "${name}" (subject=${env.subject}, kid=${env.kid ?? '?'})`)
+      const passphrase = isEncryptedIdentityExport(raw)
+        ? await readPassphrase('Passphrase: ')
+        : undefined
+      const envelope = await decodeIdentityExport(raw, passphrase)
+      const name = opts.name ?? envelope.subject
+      const identity = await importIdentity(envelope, {
+        name,
+        issuer: opts.issuer,
+        replace: opts.replace,
+      })
+
+      log.success(
+        `Imported identity "${name}" (subject=${identity.subject}, kid=${identity.kid ?? '?'})`,
+      )
     } catch (e) {
       fatal(e)
     }

package/src/commands/identity/list.ts

@@ -1,9 +1,9 @@
 import chalk from 'chalk'
 
-import type { CommandDefinition } from '../../command'
 import type { ListOpts, ListProjection } from '../../lib/output'
+import type { CommandDefinition } from '../../program/index'
 
-import { readIdentities } from '../../lib/identity'
+import { readIdentities } from '../../identity/index'
 import { log } from '../../lib/log'
 import { isMachine, presentList, RAW_OUTPUT_OPTIONS } from '../../lib/output'
 

package/src/commands/identity/register.ts

@@ -1,164 +1,195 @@
-import { importJWK, SignJWT, type JWK } from 'jose'
+import type { IssuerId, JsonWebKey, ProvisionRequest } from '@astrale-os/sdk/auth'
+import type { JWK } from 'jose'
+
+import { provision, jwk } from '@astrale-os/sdk/auth'
+import { ClassPath } from '@astrale-os/sdk/graph/class'
+import { LocalBinding } from '@astrale-os/sdk/graph/model'
+import { normalizeProperties } from '@astrale-os/sdk/graph/properties'
+import { MutationAST } from '@astrale-os/sdk/mutation'
+import { importJWK, SignJWT } from 'jose'
 import { readFile } from 'node:fs/promises'
 
-import type { CommandDefinition } from '../../command'
-import type { ClientContext, KernelCommandOpts } from '../../kernel'
+import type { KernelCommandOpts } from '../../connection'
+import type { IdentityRegistrationResult } from '../../identity/index'
+import type { CommandDefinition } from '../../program/index'
 
-import { bindGraph, runKernelCommand } from '../../kernel'
-import { KERNEL_PASSTHROUGH_OPTIONS } from '../../kernel/options'
-import { getIdentity, setRegistration } from '../../lib/identity'
-import { getActive } from '../../lib/instance'
-import { fileExists, keypairPaths } from '../../lib/keys'
+import { registrationKeyForTarget, runKernelCommand } from '../../connection'
+import { getIdentity, setRegistration, submitIdentityProvision } from '../../identity/index'
+import { fileExists, keypairPaths } from '../../keys/index'
 import { fatal, log } from '../../lib/log'
 import { output } from '../../lib/output'
 
-type RegisterIdentityResult = { iss: string; sub: string }
-
 type RegisterOpts = KernelCommandOpts & {
   class?: string
-  path?: string
   props?: string
+  via?: string
 }
 
 async function readJwk(path: string): Promise<JWK> {
-  const raw = await readFile(path, 'utf-8')
-  return JSON.parse(raw) as JWK
-}
-
-/**
- * Discover the identity-bearer class on the target instance: find the
- * installed domain that owns a `User` class (workspace on managed instances)
- * and address it semantically.
- * The bearer class must exist before a non-root identity can be registered;
- * failing here names the real problem instead of surfacing as a confusing
- * permission error on a hardcoded origin.
- */
-async function resolveUserClassPath(ctx: ClientContext): Promise<string> {
-  const graph = bindGraph(ctx)
-  // Root's direct children are the installed Domain nodes.
-  const result = await graph.children('/')
-  const domains = result.nodes
-    .filter((n) => n.class.className === 'Domain')
-    .map((n) => n.path.raw.replace(/^\//, ''))
-    .filter(Boolean)
-  for (const origin of domains) {
-    // The class materializes as a `class.User` Folder under the domain mount;
-    // a resolving node means the domain declares it (null when absent).
-    if (await graph.get(`/${origin}/class.User`)) {
-      return `/:${origin}:class.User`
-    }
-  }
-  throw new Error(
-    'No installed domain declares a `User` class on this instance — registering a ' +
-      'non-root identity needs an identity-bearer class (install workspace or another ' +
-      'domain, or pass --class <classPath> explicitly).',
-  )
-}
-
-async function mintBootstrapJwt(privateJwk: JWK): Promise<string> {
-  const kid = (privateJwk.kid as string | undefined) ?? 'bootstrap'
-  const key = await importJWK(privateJwk, 'ES256')
-  return new SignJWT({})
-    .setProtectedHeader({ alg: 'ES256', kid })
-    .setIssuer('self')
-    .setSubject('bootstrap')
-    .setAudience('bootstrap')
-    .setIssuedAt()
-    .setExpirationTime('5m')
-    .sign(key)
+  return JSON.parse(await readFile(path, 'utf8')) as JWK
 }
 
 export default {
   name: 'register',
-  description:
-    "Register a local identity with the target instance's kernel — publishes the public " +
-    'key under a thumbprint-derived issuer and caches the resolved (iss, sub) for future calls',
-  arguments: [{ name: 'name', description: 'Identity name', required: true }],
+  description: 'Atomically provision a local key identity and its V2 graph Node',
+  afterHelpText: `
+Behavior:
+  Creates one Node through Mutation V3 and designates it as a self-proven
+  Identity in the same atomic Auth.provision request. --class is required;
+  --props must use fully-qualified Property keys owned by that Class.
+
+  By default the authenticated caller submits the request directly to Kernel
+  Auth.provision. Use --via for an application-owned identity Class: the CLI
+  sends the exact self-proven request through that Domain callable, then admits
+  its result and stores the same target-bound registration. The callable owns
+  authorization; the CLI never receives installed Domain authority.
+
+  Kernel V2 Nodes have opaque identity and no caller-assigned storage path, so
+  the historical --path option no longer exists. The CLI binds the key proof
+  to the exact provision fingerprint and target Kernel audience, then caches
+  the returned (issuer, subject) for subsequent calls.
+
+Example:
+  $ astrale identity register alice --class /:accounts.example:class.User \
+      --props '{"accounts.example:class.User.property.name":"Alice"}' -i staging
+  $ astrale identity register responder --class /:ops.example:class.Operator \
+      --via /:ops.example:function.provisionOperator -i staging
+`,
+  arguments: [{ name: 'name', description: 'Local identity name', required: true }],
   options: [
     {
       flags: '--class <classPath>',
-      description:
-        'Class path of the identity node to create (default: the installed domain that declares class.User)',
+      description: 'Exact Class of the identity-bearing Node (required)',
     },
     {
-      flags: '--path <nodePath>',
-      description: 'Path of the new identity node (default: /workspace/users/<name>)',
+      flags: '--props <json>',
+      description: 'Fully-qualified canonical properties for the new Node',
     },
     {
-      flags: '--props <json>',
-      description:
-        'Extra props for the identity node (JSON). A User-class node defaults ' +
-        'firstName/lastName to the identity name when omitted.',
+      flags: '--via <callablePath>',
+      description: 'Submit the self-proven request through an authorizing Domain callable',
     },
-    ...KERNEL_PASSTHROUGH_OPTIONS,
   ],
   action: async (name: string, opts: RegisterOpts) => {
     try {
+      if (!opts.class) throw new TypeError('Missing required flag: --class <classPath>')
       const identity = await getIdentity(name)
       const { privatePath, publicPath } = keypairPaths(identity.subject)
       if (!(await fileExists(privatePath)) || !(await fileExists(publicPath))) {
-        fatal(
-          new Error(
-            `No keypair on disk for "${name}" (expected ${privatePath}). Recreate via \`astrale identity create ${name}\`.`,
-          ),
+        throw new Error(
+          `No keypair on disk for "${name}" (expected ${privatePath}). Recreate it with \`astrale identity create ${name}\`.`,
         )
       }
-      const privateJwk = await readJwk(privatePath)
-      const publicJwk = await readJwk(publicPath)
-      const nodePath = opts.path ?? `/workspace/users/${name}`
 
-      await runKernelCommand({
+      const privateKey = await readJwk(privatePath)
+      const publicKey = jwk.acceptPublic(await readJwk(publicPath))
+      const classPath = ClassPath.parse(opts.class)
+      const properties = normalizeProperties(opts.props ? JSON.parse(opts.props) : {})
+
+      await runKernelCommand<IdentityRegistrationResult>({
         opts,
         label: `Register "${name}"`,
-        fn: async (ctx) => {
-          const instanceSlug = opts.instance ?? opts.url ?? (await getActive(ctx.config)).name
-          const existing = identity.registrations?.[instanceSlug]
+        fn: async ({ auth, session, target }) => {
+          const registrationKey = registrationKeyForTarget(target)
+          const existing = identity.registrations?.[registrationKey]
           if (existing) {
-            log.warn(`"${name}" already registered on "${instanceSlug}"`)
+            log.warn(`"${name}" is already registered on "${registrationKey}"`)
             return existing
           }
 
-          const classPath = opts.class ?? (await resolveUserClassPath(ctx))
-
-          // A bare `astrale identity create <name>` carries no profile, but a
-          // User bearer class may require one. Default both names so a dev
-          // registration works out of the box; `--props` overrides.
-          const extraProps = opts.props ? (JSON.parse(opts.props) as Record<string, unknown>) : {}
-          const userDefaults = classPath.endsWith(':class.User')
-            ? { firstName: name, lastName: name }
-            : {}
-
-          // One-arm create through function.mutate; the minted node id comes
-          // back in createdNodes (keyed by the `at` path).
-          const nodeId = await bindGraph(ctx).createNode(classPath, nodePath, {
-            'Statused.status': 'creating',
-            ...userDefaults,
-            ...extraProps,
+          const prepared = await prepareIdentityProvision({
+            name,
+            classPath,
+            properties,
+            privateKey,
+            publicKey,
+            kernelIssuer: target.kernelIssuer,
           })
-
-          const bootstrap = await mintBootstrapJwt(privateJwk)
-          const result = (await ctx.client.call(`@${nodeId}::registerIdentity`, {
-            signingKey: {
-              publicKey: { jwk: publicJwk },
-              credential: bootstrap,
-            },
-          })) as RegisterIdentityResult
-
-          await setRegistration(name, instanceSlug, {
-            iss: result.iss,
-            sub: result.sub,
+          const registered = await submitIdentityProvision({
+            request: prepared.request,
+            binding: prepared.binding,
+            ...(opts.via === undefined ? {} : { via: opts.via }),
+            direct: auth,
+            callable: session,
+          })
+          await setRegistration(name, registrationKey, {
+            iss: registered.iss,
+            sub: registered.sub,
             registeredAt: new Date().toISOString(),
           })
-          return result
-        },
-        format: (result, fmtOpts) => {
-          output(result, fmtOpts)
-          log.dim(`  iss=${result.iss}`)
-          log.dim(`  sub=${result.sub}`)
+          return registered
         },
+        format: formatIdentityRegistration,
       })
-    } catch (e) {
-      fatal(e)
+    } catch (error) {
+      fatal(error, opts)
     }
   },
 } satisfies CommandDefinition
+
+/** Preserve one structured stdout value while retaining useful detail in the human view. */
+export function formatIdentityRegistration(
+  result: IdentityRegistrationResult,
+  format: KernelCommandOpts,
+  machine: boolean,
+): void {
+  output(result, format)
+  if (machine) return
+  log.dim(`  iss=${result.iss}`)
+  log.dim(`  sub=${result.sub}`)
+}
+
+/** Build and self-prove one exact canonical provision request for the target Kernel. */
+export async function prepareIdentityProvision(input: {
+  readonly name: string
+  readonly classPath: ReturnType<typeof ClassPath.parse>
+  readonly properties: ReturnType<typeof normalizeProperties>
+  readonly privateKey: JWK
+  readonly publicKey: JsonWebKey
+  readonly kernelIssuer: IssuerId
+}): Promise<{
+  readonly binding: ReturnType<typeof LocalBinding>
+  readonly request: ProvisionRequest
+}> {
+  const binding = LocalBinding('identity')
+  const mutation = MutationAST.build((builder) => {
+    builder.createNode({ as: binding, class: input.classPath, props: input.properties })
+    return undefined
+  })
+  const idempotencyKey = `identity-register:${input.name}`
+  const unsigned = provision.accept({
+    idempotencyKey,
+    mutation,
+    identities: {
+      [binding]: { credentials: { publicKey: input.publicKey, proof: 'pending-proof' } },
+    },
+  })
+  const fingerprint = await provision.fingerprint(unsigned)
+  const issuer = await provision.selfIssuer(input.kernelIssuer, input.publicKey)
+  const proof = await mintProvisionProof(input.privateKey, issuer, input.kernelIssuer, fingerprint)
+  return {
+    binding,
+    request: provision.accept({
+      idempotencyKey,
+      mutation,
+      identities: { [binding]: { credentials: { publicKey: input.publicKey, proof } } },
+    }),
+  }
+}
+
+async function mintProvisionProof(
+  privateKey: JWK,
+  issuer: string,
+  audience: string,
+  fingerprint: string,
+): Promise<string> {
+  const key = await importJWK(privateKey, 'ES256')
+  return new SignJWT({ provision: fingerprint })
+    .setProtectedHeader({ alg: 'ES256', ...(privateKey.kid ? { kid: privateKey.kid } : {}) })
+    .setIssuer(issuer)
+    .setSubject('self')
+    .setAudience(audience)
+    .setIssuedAt()
+    .setExpirationTime('5m')
+    .sign(key)
+}

package/src/commands/identity/sync.ts

@@ -1,6 +1,6 @@
-import type { CommandDefinition } from '../../command'
+import type { CommandDefinition } from '../../program/index'
 
-import { getIdentity, setIdentityMode } from '../../lib/identity'
+import { getIdentity, setIdentityMode } from '../../identity/index'
 import { fatal, fatalNotImplemented, log } from '../../lib/log'
 
 export default {

package/src/commands/identity/unsync.ts

@@ -1,6 +1,6 @@
-import type { CommandDefinition } from '../../command'
+import type { CommandDefinition } from '../../program/index'
 
-import { getIdentity, setIdentityMode } from '../../lib/identity'
+import { getIdentity, setIdentityMode } from '../../identity/index'
 import { fatal, log } from '../../lib/log'
 
 /** Metadata-only flip remote → local until cloud sync ships (§2.7). */

package/src/commands/identity/use.ts

@@ -1,6 +1,6 @@
-import type { CommandDefinition } from '../../command'
+import type { CommandDefinition } from '../../program/index'
 
-import { setDefault } from '../../lib/identity'
+import { setDefault } from '../../identity/index'
 import { fatal, log } from '../../lib/log'
 
 export default {

package/src/commands/identity/whoami.ts

@@ -1,8 +1,8 @@
 import chalk from 'chalk'
 
-import type { CommandDefinition } from '../../command'
+import type { CommandDefinition } from '../../program/index'
 
-import { getDefault } from '../../lib/identity'
+import { getDefault } from '../../identity/index'
 import { fatal } from '../../lib/log'
 import { isMachine, output, RAW_OUTPUT_OPTIONS, type RawOutputOpts } from '../../lib/output'
 

package/src/commands/idp/add.ts

@@ -1,6 +1,6 @@
 import { readFile } from 'node:fs/promises'
 
-import type { CommandDefinition } from '../../command'
+import type { CommandDefinition } from '../../program/index'
 
 import {
   fetchOidcMetadata,

package/src/commands/idp/list.ts

@@ -1,7 +1,7 @@
 import chalk from 'chalk'
 
-import type { CommandDefinition } from '../../command'
 import type { ListOpts, ListProjection } from '../../lib/output'
+import type { CommandDefinition } from '../../program/index'
 
 import { listIdpConfigs } from '../../lib/idp'
 import { log } from '../../lib/log'

package/src/commands/idp/refresh.ts

@@ -1,4 +1,4 @@
-import type { CommandDefinition } from '../../command'
+import type { CommandDefinition } from '../../program/index'
 
 import {
   fetchOidcMetadata,

package/src/commands/idp/remove.ts

@@ -1,6 +1,6 @@
-import type { CommandDefinition } from '../../command'
+import type { CommandDefinition } from '../../program/index'
 
-import { readIdentities } from '../../lib/identity'
+import { readIdentities } from '../../identity/index'
 import { removeIdpConfig } from '../../lib/idp'
 import { log } from '../../lib/log'
 import { output, RAW_OUTPUT_OPTIONS } from '../../lib/output'

package/src/commands/idp/show.ts

@@ -1,4 +1,4 @@
-import type { CommandDefinition } from '../../command'
+import type { CommandDefinition } from '../../program/index'
 
 import { readIdpConfigOrBuiltin } from '../../lib/idp'
 import { output, RAW_OUTPUT_OPTIONS } from '../../lib/output'

package/src/commands/instance/active.ts

@@ -1,8 +1,8 @@
 import chalk from 'chalk'
 
-import type { CommandDefinition } from '../../command'
+import type { CommandDefinition } from '../../program/index'
 
-import { listOwnedInstances } from '../../kernel/client'
+import { listOwnedInstances } from '../../lib/admin-instance'
 import { findOwnedInstance } from '../../lib/admin-instance'
 import { getActive, normalizeInstanceKernelUrl } from '../../lib/instance'
 import { log } from '../../lib/log'

package/src/commands/instance/bookmark.ts

@@ -1,6 +1,6 @@
-import type { CommandDefinition } from '../../command'
+import type { CommandDefinition } from '../../program/index'
 
-import { fetchWithCaFile } from '../../kernel/ca-fetch'
+import { fetchWithCaFile } from '../../lib/ca-fetch'
 import { normalizeInstanceKernelUrl, setActive, upsertInstance } from '../../lib/instance'
 import { fatal, log } from '../../lib/log'
 import { checkIssuerReachability } from '../../lib/meta'
@@ -12,6 +12,10 @@ export default {
   options: [
     { flags: '--url <url>', description: 'URL of the remote instance (required)' },
     { flags: '--issuer <url>', description: 'Kernel issuer/audience if different from URL' },
+    {
+      flags: '--domain-issuer <url>',
+      description: 'Product Domain issuer for standard token exchange',
+    },
     { flags: '--ca <path>', description: 'CA certificate file to trust for this bookmark' },
     {
       flags: '--as <identity>',
@@ -25,6 +29,7 @@ export default {
     opts: {
       url?: string
       issuer?: string
+      domainIssuer?: string
       ca?: string
       as?: string
       use?: boolean
@@ -53,6 +58,7 @@ export default {
       const { entry, created } = await upsertInstance(name, {
         url,
         issuer: expectedIssuer,
+        domainIssuer: opts.domainIssuer,
         caFile: opts.ca,
         name,
         kind: 'bookmark',

package/src/commands/instance/create.ts

@@ -1,4 +1,4 @@
-import type { CommandDefinition } from '../../command'
+import type { CommandDefinition } from '../../program/index'
 
 import { ADMIN_TARGET_OPTIONS } from '../../lib/admin-target'
 import { fatal } from '../../lib/log'

package/src/commands/instance/delete.ts

@@ -1,8 +1,7 @@
-import type { CommandDefinition } from '../../command'
-import type { KernelCommandOpts } from '../../kernel'
+import type { KernelCommandOpts } from '../../connection'
+import type { CommandDefinition } from '../../program/index'
 
-import { withAdminKernelClient } from '../../kernel/client'
-import { adminInstanceMethod, type InstanceInfo } from '../../lib/admin-instance'
+import { deleteOwnedInstance } from '../../lib/admin-instance'
 import { ADMIN_TARGET_OPTIONS, type AdminTargetCommandOpts } from '../../lib/admin-target'
 import { clearActive, readInstances, removeInstance, resolveInstanceKey } from '../../lib/instance'
 import { fatal, log, withSpinner } from '../../lib/log'
@@ -36,12 +35,7 @@ Behavior:
       const result = await withSpinner(
         `Deleting instance ${id}`,
         !isMachine(opts),
-        () =>
-          withAdminKernelClient(
-            opts,
-            async (ctx) =>
-              (await ctx.client.call(adminInstanceMethod('delete'), { id })) as InstanceInfo,
-          ),
+        () => deleteOwnedInstance(opts, id),
         { success: (deleted) => `Deleted instance: ${deleted.slug}` },
       )
 

package/src/commands/instance/forget.ts

@@ -1,4 +1,4 @@
-import type { CommandDefinition } from '../../command'
+import type { CommandDefinition } from '../../program/index'
 
 import { readInstances, removeInstance, resolveInstanceKey } from '../../lib/instance'
 import { fatal, log } from '../../lib/log'

package/src/commands/instance/list.ts

@@ -1,10 +1,10 @@
 import chalk from 'chalk'
 
-import type { CommandDefinition } from '../../command'
-import type { KernelCommandOpts } from '../../kernel'
+import type { KernelCommandOpts } from '../../connection'
 import type { Column } from '../../lib/output'
+import type { CommandDefinition } from '../../program/index'
 
-import { listOwnedInstances } from '../../kernel/client'
+import { listOwnedInstances } from '../../lib/admin-instance'
 import {
   formatInstanceLocation,
   type InstanceInfo,

package/src/commands/instance/status.ts

@@ -1,11 +1,10 @@
 import chalk from 'chalk'
 
-import type { CommandDefinition } from '../../command'
-import type { KernelCommandOpts } from '../../kernel'
+import type { KernelCommandOpts } from '../../connection'
+import type { CommandDefinition } from '../../program/index'
 
 import { AstraleError } from '../../errors'
-import { listOwnedInstances } from '../../kernel/client'
-import { findOwnedInstance } from '../../lib/admin-instance'
+import { statusOwnedInstance } from '../../lib/admin-instance'
 import { ADMIN_TARGET_OPTIONS, type AdminTargetCommandOpts } from '../../lib/admin-target'
 import { fatal, log, withSpinner } from '../../lib/log'
 import { isMachine, output, type RawOutputOpts } from '../../lib/output'
@@ -20,9 +19,8 @@ export default {
   action: async (id: string, opts: StatusOpts) => {
     try {
       const result = await withSpinner(`Fetching instance ${id}`, !isMachine(opts), () =>
-        listOwnedInstances(opts).then((instances) => {
-          const match = findOwnedInstance(instances, id)
-          if (match) return match
+        statusOwnedInstance(opts, id).catch((error) => {
+          if (!(error instanceof Error) || error.name !== 'NotFoundError') throw error
           throw new AstraleError(
             'INSTANCE_NOT_FOUND',
             `No owned instance matches "${id}".`,