@astrale-os/cli 0.8.1-alpha.0 → 0.8.1-alpha.3

package/src/commands/domain/install.ts

@@ -1,14 +1,18 @@
-import { K } from '@astrale-os/kernel-core'
+import { Path } from '@astrale-os/sdk/graph/path'
+import { syscalls } from '@astrale-os/sdk/schema/kernel'
 import chalk from 'chalk'
 
-import type { CommandDefinition } from '../../command'
-import type { KernelCommandOpts } from '../../kernel'
+import type { KernelCommandOpts } from '../../connection'
+import type { CommandDefinition } from '../../program/index'
 
+import { createPathCall, runKernelCommand, withAdminClientSession } from '../../connection'
 import { AstraleError } from '../../errors'
-import { runKernelCommand } from '../../kernel'
-import { withAdminKernelClient } from '../../kernel/client'
-import { adminDomainMethod, type DomainInfo } from '../../lib/admin-domain'
-import { callOwnedInstances, type OwnedInstanceInfo } from '../../lib/admin-instance'
+import {
+  installAdminDomainInContext,
+  listAdminDomainsInContext,
+  type DomainInfo,
+} from '../../lib/admin-domain'
+import { listOwnedInstancesInContext, type OwnedInstanceInfo } from '../../lib/admin-instance'
 import { ADMIN_TARGET_OPTIONS, type AdminTargetCommandOpts } from '../../lib/admin-target'
 import { getActive } from '../../lib/instance'
 import { fatal, log, withSpinner } from '../../lib/log'
@@ -16,18 +20,35 @@ import { isMachine, output } from '../../lib/output'
 import { confirmWithInput, promptText, selectFrom } from '../../lib/prompt'
 import { isHttpUrl } from '../../lib/validation'
 
-/** Mirrors the admin worker's `DomainInstallResult` (schema/domains.ts). */
-type DomainInstallResult = {
-  name: string
-  origin: string
-  instanceId: string
-  url: string
-  ok: boolean
-  error?: string | null
+/** Public Kernel install syscall input for one remote URL. */
+export function directInstallCallInput(
+  url: string,
+  token?: string,
+  operation: string = crypto.randomUUID(),
+) {
+  return Object.freeze({
+    operation,
+    domains: [
+      Object.freeze({
+        source: Object.freeze({
+          kind: 'remote' as const,
+          url,
+          ...(token === undefined ? {} : { token }),
+        }),
+      }),
+    ],
+  })
 }
 
-/** Mirrors the kernel's `Domain.install` return. */
-type DirectInstallResult = { domainId: string; origin: string }
+type DirectInstallResult = {
+  readonly operation: string
+  readonly transitions: readonly {
+    readonly intent: {
+      readonly origin: string
+      readonly target?: { readonly schemaRevision?: string } | null
+    }
+  }[]
+}
 
 type InstallOpts = KernelCommandOpts &
   AdminTargetCommandOpts & {
@@ -50,8 +71,8 @@ Behavior:
   interactively. The target instance is the active one, or -i <slug>; it must be
   admin-managed (otherwise the command fails loudly and points you at --direct).
 
-  --direct: installs a url STRAIGHT onto the instance kernel (Domain.install),
-  bypassing the admin/catalog. Works on any instance you can authenticate to
+  --direct: installs a url through the public Kernel install syscall,
+  bypassing the admin catalog. Works on any instance you can authenticate to
   (managed, bookmarked, or local), using your own authority. This is the only
   mode that runs the identity-override consent gate: when the domain's declared
   origin differs from its serving host, it requires explicit consent (an
@@ -108,7 +129,12 @@ Examples:
  * an admin-kernel override). The admin kernel is chosen via --admin/--admin-url
  * or config, exactly like `domain publish`.
  */
-async function installViaAdmin(target: string | undefined, opts: InstallOpts): Promise<void> {
+export async function installViaAdmin(
+  target: string | undefined,
+  opts: InstallOpts,
+  dependencies: Partial<AdminInstallDependencies> = {},
+): Promise<void> {
+  const admin = { ...defaultAdminInstallDependencies, ...dependencies }
   const interactive = !!process.stdin.isTTY && !(opts.ci || opts.noPrompt || process.env.CI)
   if (!target && !interactive) {
     fatal(
@@ -121,13 +147,17 @@ async function installViaAdmin(target: string | undefined, opts: InstallOpts): P
   }
   // Strip the install-target selector so the admin client resolves only the
   // admin kernel (via --admin/--admin-url/config), not the instance under `-i`.
-  const adminOpts: InstallOpts = { ...opts, instance: undefined }
+  const adminOpts = {
+    admin: opts.admin,
+    adminUrl: opts.adminUrl,
+    timeout: opts.timeout,
+    as: opts.as,
+    creds: opts.creds,
+  }
 
   try {
-    await withAdminKernelClient(adminOpts, async (ctx) => {
-      const instances = await callOwnedInstances(ctx.client)
-
-      const ref = await resolveDomainRef(ctx, target, interactive)
+    await withAdminClientSession(adminOpts, async (ctx) => {
+      const instances = await admin.listInstances(ctx)
       const slug = await resolveTargetSlug(opts, target, interactive, instances)
 
       const match = instances.find((i) => i.slug === slug)
@@ -141,15 +171,14 @@ async function installViaAdmin(target: string | undefined, opts: InstallOpts): P
       }
       assertInstallTargetReady(match)
 
-      const label = ref.origin ?? ref.url ?? 'domain'
+      const domains = await admin.listDomains(ctx)
+      const domain = await resolveDomain(domains, target, interactive)
+
+      const label = domain.origin
       const result = await withSpinner(
         `Installing ${label} on ${match.slug}`,
         !isMachine(opts),
-        () =>
-          ctx.client.call(adminDomainMethod('install'), {
-            instanceId: match.slug,
-            ...ref,
-          }) as Promise<DomainInstallResult>,
+        () => admin.install(ctx, match, domain),
         { success: (r) => `Installed ${r.origin} on ${match.slug}` },
       )
 
@@ -193,15 +222,25 @@ export function domainRefFromTarget(target: string): { origin?: string; url?: st
 }
 
 /** Resolve the domain to install: the positional `target`, or an interactive pick. */
-async function resolveDomainRef(
-  ctx: { client: { call: (path: string, params: unknown) => Promise<unknown> } },
+async function resolveDomain(
+  catalog: readonly DomainInfo[],
   target: string | undefined,
   interactive: boolean,
-): Promise<{ origin?: string; url?: string }> {
-  if (target) return domainRefFromTarget(target)
+): Promise<DomainInfo> {
+  if (target) {
+    const ref = domainRefFromTarget(target)
+    const found = catalog.find((domain) =>
+      ref.origin === undefined ? domain.url === ref.url : domain.origin === ref.origin,
+    )
+    if (found !== undefined) return found
+    throw new AstraleError(
+      'DOMAIN_NOT_FOUND',
+      `No published domain matches "${target}".`,
+      'Run `astrale domain list` to see the Admin catalog.',
+    )
+  }
   if (!interactive) throw new AstraleError('MISSING_ARG', 'No domain given.')
 
-  const catalog = (await ctx.client.call(adminDomainMethod('list'), {})) as DomainInfo[]
   const installable = catalog.filter((d) => d.url)
   if (installable.length === 0) {
     throw new AstraleError(
@@ -218,9 +257,21 @@ async function resolveDomainRef(
     })),
   )
   if (!origin) throw new AstraleError('CANCELLED', 'No domain selected.')
-  return { origin }
+  return catalog.find((domain) => domain.origin === origin)!
 }
 
+interface AdminInstallDependencies {
+  readonly listInstances: typeof listOwnedInstancesInContext
+  readonly listDomains: typeof listAdminDomainsInContext
+  readonly install: typeof installAdminDomainInContext
+}
+
+const defaultAdminInstallDependencies: AdminInstallDependencies = Object.freeze({
+  listInstances: listOwnedInstancesInContext,
+  listDomains: listAdminDomainsInContext,
+  install: installAdminDomainInContext,
+})
+
 /**
  * Resolve the target instance slug: `-i`, else the active instance. When run
  * bare (no positional) in a TTY, prompt for it with the active instance
@@ -271,8 +322,8 @@ async function activeSlug(): Promise<string | undefined> {
 // ── Direct path (--direct) ────────────────────────────────────────────────────
 
 /**
- * Install a url straight onto the instance kernel (`Domain.install`),
- * bypassing the admin/catalog — the classic path, with the §5 identity-override
+ * Install a url through the public Kernel install syscall,
+ * bypassing the admin catalog, with the identity-override
  * consent gate. Works on any instance the caller can authenticate to.
  */
 async function installDirect(target: string | undefined, opts: InstallOpts): Promise<void> {
@@ -300,26 +351,32 @@ async function installDirect(target: string | undefined, opts: InstallOpts): Pro
   await runKernelCommand<DirectInstallResult>({
     opts,
     label: `Installing domain from ${url}`,
-    fn: async (ctx) =>
-      (await ctx.client.call(K.Domain.install.path.method.raw, {
-        url,
-        ...(opts.token ? { token: opts.token } : {}),
-      })) as DirectInstallResult,
+    fn: async ({ session }) =>
+      (await session.call(
+        createPathCall(
+          Path.project(syscalls.install.ref).raw,
+          directInstallCallInput(url, opts.token),
+        ),
+      )) as DirectInstallResult,
     format: (result, fmtOpts, isRaw) => {
       if (isRaw) {
         output(result, fmtOpts)
         return
       }
-      log.success(`Domain installed: ${result.origin}`)
-      log.dim(`  domainId: ${result.domainId}`)
+      const installed = result.transitions[0]?.intent
+      if (installed === undefined) {
+        throw new Error('Kernel install returned no committed Domain transition.')
+      }
+      const revision = installed.target?.schemaRevision ?? result.operation
+      log.success(`Domain installed: ${installed.origin}@${revision}`)
       // Belt-and-braces: the kernel-confirmed origin is authoritative. If it
       // aliases the host and the pre-install gate never consented to THAT
       // origin (lying or absent `/meta`), say so loudly after the fact.
-      if (isIdentityOverride(result.origin, host) && result.origin !== consentedOrigin) {
+      if (isIdentityOverride(installed.origin, host) && installed.origin !== consentedOrigin) {
         log.warn(
-          `Installed origin "${result.origin}" differs from the serving host "${host}" ` +
+          `Installed origin "${installed.origin}" differs from the serving host "${host}" ` +
             `and was not confirmed before install (the worker's /meta did not declare it). ` +
-            `Every ${result.origin}/* call on this instance now routes to ${host}.`,
+            `Every ${installed.origin}/* call on this instance now routes to ${host}.`,
         )
       }
     },

package/src/commands/domain/list.ts

@@ -1,11 +1,10 @@
 import chalk from 'chalk'
 
-import type { CommandDefinition } from '../../command'
-import type { KernelCommandOpts } from '../../kernel'
+import type { KernelCommandOpts } from '../../connection'
 import type { ListProjection, RawOutputOpts } from '../../lib/output'
+import type { CommandDefinition } from '../../program/index'
 
-import { withAdminKernelClient } from '../../kernel/client'
-import { adminDomainMethod, type DomainInfo } from '../../lib/admin-domain'
+import { listAdminDomains, type DomainInfo } from '../../lib/admin-domain'
 import { ADMIN_TARGET_OPTIONS, type AdminTargetCommandOpts } from '../../lib/admin-target'
 import { fatal, withSpinner } from '../../lib/log'
 import { isMachine, presentList } from '../../lib/output'
@@ -100,10 +99,7 @@ Examples:
         'Fetching domains',
         !isMachine(opts),
         async (): Promise<DomainRow[]> => {
-          const list = await withAdminKernelClient(
-            opts,
-            async (ctx) => (await ctx.client.call(adminDomainMethod('list'), {})) as DomainInfo[],
-          )
+          const list = await listAdminDomains(opts)
           const filtered = opts.defaultOnly ? list.filter((d) => d.installByDefault) : list
           filtered.sort(byDefaultThenName)
           if (!opts.check) return filtered as DomainRow[]

package/src/commands/domain/publish.ts

@@ -1,10 +1,9 @@
 import chalk from 'chalk'
 
-import type { CommandDefinition } from '../../command'
-import type { KernelCommandOpts } from '../../kernel'
+import type { KernelCommandOpts } from '../../connection'
+import type { CommandDefinition } from '../../program/index'
 
-import { withAdminKernelClient } from '../../kernel/client'
-import { adminDomainMethod, type DomainInfo } from '../../lib/admin-domain'
+import { publishAdminDomain } from '../../lib/admin-domain'
 import { ADMIN_TARGET_OPTIONS, type AdminTargetCommandOpts } from '../../lib/admin-target'
 import { fatal, withSpinner } from '../../lib/log'
 import { isMachine, output } from '../../lib/output'
@@ -108,33 +107,12 @@ Examples:
         `Publishing ${name} → ${publicUrl}`,
         !isMachine(opts),
         () =>
-          withAdminKernelClient(opts, async (ctx) => {
-            // Read the current catalog entry first: a re-publish that would write
-            // the same origin/name/url/description/install flag is a no-op we
-            // report as "already up to date" (and skip the write) rather than
-            // silently bumping `updatedAt`. `info` throws when absent → treat as
-            // a fresh publish.
-            const existing = (await ctx.client
-              .call(adminDomainMethod('info'), { origin })
-              .catch(() => null)) as DomainInfo | null
-            if (
-              existing &&
-              existing.name === name &&
-              existing.url === publicUrl &&
-              (opts.description === undefined || existing.description === opts.description) &&
-              (opts.installByDefault === undefined ||
-                (existing.installByDefault ?? false) === opts.installByDefault)
-            ) {
-              return { entry: existing, changed: false as const, isNew: false }
-            }
-            const entry = (await ctx.client.call(adminDomainMethod('publish'), {
-              origin,
-              name,
-              url: publicUrl,
-              ...(opts.description ? { description: opts.description } : {}),
-              ...(opts.installByDefault ? { installByDefault: true } : {}),
-            })) as DomainInfo
-            return { entry, changed: true as const, isNew: !existing }
+          publishAdminDomain(opts, {
+            origin,
+            name,
+            url: publicUrl,
+            ...(opts.description ? { description: opts.description } : {}),
+            ...(opts.installByDefault ? { installByDefault: true } : {}),
           }),
         {
           success: ({ entry, changed, isNew }) =>

package/src/commands/get.ts

@@ -1,85 +1,52 @@
-import type { CommandDefinition } from '../command'
-import type { KernelCommandOpts } from '../kernel'
+import { Path } from '@astrale-os/sdk/graph/path'
 
-import { bindGraph, expandSelfInPath, runKernelCommand, withSelfHint } from '../kernel'
-import { log } from '../lib/log'
-import { output } from '../lib/output'
+import type { KernelCommandOpts } from '../connection'
+import type { CommandDefinition } from '../program/index'
 
-type GetOpts = KernelCommandOpts & {
-  long?: boolean
-}
-
-const INTERNAL_KEYS = new Set(['__labels', 'classId'])
+import { expandSelfInPath, runKernelCommand, withSelfHint } from '../connection'
+import { formatKernelError } from '../connection/errors'
+import { isMachine, output } from '../lib/output'
 
-export async function getCommand(pathArg: string, opts: GetOpts): Promise<void> {
-  if (!pathArg) {
-    log.error('Usage: astrale get <path>')
-    process.exit(1)
-    return
-  }
+type GetOpts = KernelCommandOpts
 
+/** Read one exact canonical Node. The caller's Path is not fabricated into the Node value. */
+export async function getCommand(target: string, opts: GetOpts): Promise<void> {
   let path: string
   let meta
   try {
-    ;({ path, meta } = await expandSelfInPath(pathArg, opts))
-  } catch (e) {
-    log.error(e instanceof Error ? e.message : 'Invalid @self expansion')
+    ;({ path, meta } = await expandSelfInPath(target, opts))
+  } catch (error) {
+    await formatKernelError(error, isMachine(opts), undefined, opts.debug)
     process.exit(1)
-    return
   }
 
   await runKernelCommand({
     opts,
-    label: 'Node ' + path,
-    fn: async (ctx) => {
-      const node = await withSelfHint(() => bindGraph(ctx).get(path), meta)
-      if (node === null) {
-        log.error('node "' + path + '" not found or not visible')
-        process.exit(1)
-      }
-      return node
-    },
-    format: (node, fmtOpts) => {
-      output(opts.long ? node : cleanNode(node), fmtOpts)
-    },
+    label: `Node ${path}`,
+    fn: ({ graph }) => withSelfHint(() => graph.getOrThrow(Path.parse(path)), meta),
+    format: (node, format) => output(node, format),
   })
 }
 
-function cleanNode(data: unknown): unknown {
-  if (!data || typeof data !== 'object') return data
-  const result: Record<string, unknown> = {}
-  for (const [k, v] of Object.entries(data as Record<string, unknown>)) {
-    if (INTERNAL_KEYS.has(k)) continue
-    result[k] = v
-  }
-  return result
-}
-
 export default {
   name: 'get',
-  description: 'Get one node by path or id',
-  afterHelpText: [
-    '',
-    'Behavior:',
-    '  Point read through the kernel-client GraphApi.get shorthand. Accepts exactly',
-    '  one node path (tree path /domain/class.Name, or an id @nodeId). @self is',
-    '  expanded before dispatch. Missing and masked nodes share one opaque error:',
-    '  node "<path>" not found or not visible.',
-    '',
-    '  Output is the historical flat wire node projection { id, class, path, props }.',
-    '  Add -l to keep the internal fields (__labels, classId). Richer reads -',
-    '  multiple roots, child expansion, edge expansion, cursors, or full GraphData -',
-    '  live on astrale query.',
-    '',
-    'Examples:',
-    '  $ astrale get /kernel.astrale.ai/class.Root',
-    '  $ astrale get @abc123 -l',
-    '  $ astrale get @self --json',
-    '',
-  ].join('\n'),
-  arguments: [{ name: 'path', description: 'Node path (/domain/Class) or ID (@nodeId)' }],
-  options: [{ flags: '-l, --long', description: 'Include internal fields (__labels, classId)' }],
-  action: async (path, opts) => {
-    await getCommand(path as string, opts as GetOpts)
+  description: 'Get one canonical node by Path or ID',
+  afterHelpText: `
+Behavior:
+  Resolves one exact Kernel V2 Path and prints the canonical Node
+  { id, class, props }. Missing and authorization-masked nodes remain
+  intentionally indistinguishable. @self is expanded before dispatch.
+
+  A Node does not contain a synthetic path, labels, or backend class ID.
+  Use astrale query for graph-shaped reads.
+
+Examples:
+  $ astrale get /:notes.example.dev:class.Note
+  $ astrale get @abc123 --json
+  $ astrale get @self
+`,
+  arguments: [{ name: 'target', description: 'Canonical Node Path or @id' }],
+  action: async (target, opts) => {
+    await getCommand(target as string, opts as GetOpts)
   },
 } satisfies CommandDefinition

package/src/commands/identity/__tests__/register.test.ts

@@ -0,0 +1,93 @@
+import { issuer, jwk, provision } from '@astrale-os/sdk/auth'
+import { ClassPath } from '@astrale-os/sdk/graph/class'
+import { normalizeProperties } from '@astrale-os/sdk/graph/properties'
+import { expect, mock, test } from 'bun:test'
+import { exportJWK, generateKeyPair, jwtVerify } from 'jose'
+
+import { formatIdentityRegistration, prepareIdentityProvision } from '../register'
+
+/** @evidence TEST-CLI-IDENTITY-REGISTER-JSON-EXACT */
+test('emits exactly one structured value for machine registration output', () => {
+  const writes: string[] = []
+  const logs: string[] = []
+  const originalWrite = process.stdout.write
+  const originalLog = console.log
+  process.stdout.write = mock((chunk: string | Uint8Array) => {
+    writes.push(typeof chunk === 'string' ? chunk : new TextDecoder().decode(chunk))
+    return true
+  }) as typeof process.stdout.write
+  console.log = mock((...values: unknown[]) => logs.push(values.map(String).join(' ')))
+
+  try {
+    formatIdentityRegistration(
+      { iss: 'https://identity.example', sub: 'self', nodeId: 'operator-node' },
+      { json: true },
+      true,
+    )
+  } finally {
+    process.stdout.write = originalWrite
+    console.log = originalLog
+  }
+
+  expect(JSON.parse(writes.join(''))).toEqual({
+    iss: 'https://identity.example',
+    sub: 'self',
+    nodeId: 'operator-node',
+  })
+  expect(logs).toEqual([])
+})
+
+test('builds one exact Mutation V3 identity birth bound to a self proof', async () => {
+  const { privateKey, publicKey } = await generateKeyPair('ES256', { extractable: true })
+  const privateJwk = { ...(await exportJWK(privateKey)), alg: 'ES256', kid: 'alice-key' }
+  const publicJwk = jwk.acceptPublic({
+    ...(await exportJWK(publicKey)),
+    alg: 'ES256',
+    kid: 'alice-key',
+  })
+  const kernelIssuer = issuer.accept('https://kernel.example')
+  const classPath = ClassPath.parse('/:accounts.example:class.User')
+  const properties = normalizeProperties({
+    'accounts.example:class.User.property.name': 'Alice',
+  })
+
+  const prepared = await prepareIdentityProvision({
+    name: 'alice',
+    classPath,
+    properties,
+    privateKey: privateJwk,
+    publicKey: publicJwk,
+    kernelIssuer,
+  })
+
+  expect(String(prepared.binding)).toBe('identity')
+  expect(prepared.request.idempotencyKey).toBe('identity-register:alice')
+  expect(JSON.parse(JSON.stringify(prepared.request.mutation))).toEqual({
+    format: 'astrale.graph.mutation',
+    version: 'v3',
+    preconditions: [],
+    operations: [
+      {
+        op: 'node.create',
+        as: 'identity',
+        class: '/:accounts.example:class.User',
+        props: { 'accounts.example:class.User.property.name': 'Alice' },
+      },
+    ],
+  })
+
+  const credentials = prepared.request.identities[prepared.binding]?.credentials
+  expect(credentials?.publicKey).toEqual(publicJwk)
+  expect(typeof credentials?.proof).toBe('string')
+  if (typeof credentials?.proof !== 'string') throw new TypeError('Expected compact JWT proof')
+
+  const expectedFingerprint = await provision.fingerprint(prepared.request)
+  const expectedIssuer = await provision.selfIssuer(kernelIssuer, publicJwk)
+  const verified = await jwtVerify(credentials.proof, publicKey, {
+    algorithms: ['ES256'],
+    issuer: expectedIssuer,
+    subject: 'self',
+    audience: kernelIssuer,
+  })
+  expect(verified.payload.provision).toBe(expectedFingerprint)
+})

package/src/commands/identity/create.ts

@@ -1,6 +1,6 @@
-import type { CommandDefinition } from '../../command'
+import type { CommandDefinition } from '../../program/index'
 
-import { createIdentity } from '../../lib/identity'
+import { createIdentity } from '../../identity/index'
 import { fatal, log } from '../../lib/log'
 
 export default {

package/src/commands/identity/delete.ts

@@ -1,6 +1,6 @@
-import type { CommandDefinition } from '../../command'
+import type { CommandDefinition } from '../../program/index'
 
-import { deleteIdentity } from '../../lib/identity'
+import { deleteIdentity } from '../../identity/index'
 import { fatal, log } from '../../lib/log'
 
 export default {

package/src/commands/identity/export.ts

@@ -1,10 +1,6 @@
-import { CompactEncrypt } from 'jose'
-import { chmod, readFile, writeFile } from 'node:fs/promises'
+import type { CommandDefinition } from '../../program/index'
 
-import type { CommandDefinition } from '../../command'
-
-import { getIdentity } from '../../lib/identity'
-import { keypairPaths } from '../../lib/keys'
+import { encodeIdentityExport, exportIdentity, writeIdentityExport } from '../../identity/index'
 import { fatal, log } from '../../lib/log'
 import { readPassphrase } from '../../lib/prompt'
 
@@ -25,33 +21,11 @@ export default {
   ],
   action: async (name: string, path: string, opts: { encrypt?: boolean }) => {
     try {
-      const identity = await getIdentity(name)
-      const { privatePath, publicPath } = keypairPaths(identity.subject)
-      const [privateJwk, publicJwk] = await Promise.all([
-        readFile(privatePath, 'utf-8').then(JSON.parse),
-        readFile(publicPath, 'utf-8').then(JSON.parse),
-      ])
-      const envelope = {
-        version: 1,
-        subject: identity.subject,
-        mode: identity.mode ?? 'local',
-        kid: identity.kid,
-        issuer: identity.issuer,
-        privateJwk,
-        publicJwk,
-      }
-      const plain = JSON.stringify(envelope, null, 2)
-
-      if (opts.encrypt) {
-        const passphrase = await readPassphrase('Passphrase (min 8 chars): ', { minLength: 8 })
-        const enc = await new CompactEncrypt(new TextEncoder().encode(plain))
-          .setProtectedHeader({ alg: 'PBES2-HS256+A128KW', enc: 'A256GCM' })
-          .encrypt(new TextEncoder().encode(passphrase))
-        await writeFile(path, enc)
-      } else {
-        await writeFile(path, plain)
-      }
-      await chmod(path, 0o600)
+      const envelope = await exportIdentity(name)
+      const passphrase = opts.encrypt
+        ? await readPassphrase('Passphrase (min 8 chars): ', { minLength: 8 })
+        : undefined
+      await writeIdentityExport(path, await encodeIdentityExport(envelope, passphrase))
 
       log.success(`Exported identity "${name}" → ${path}${opts.encrypt ? ' (encrypted)' : ''}`)
       if (!opts.encrypt) {