@astrale-os/cli 0.8.1-alpha.4 → 0.8.1-alpha.6

package/dist/public/connect-core.js

@@ -52281,17 +52281,10 @@ async function readDecoded(options) {
 function hasVersion(input) {
   return typeof input === "object" && input !== null && Object.hasOwn(input, "version");
 }
-function seed(now) {
+function seed(_now) {
   return {
-    default: "manager",
-    identities: {
-      manager: {
-        subject: "manager",
-        createdAt: now.toISOString(),
-        source: "key",
-        mode: "local"
-      }
-    }
+    default: "",
+    identities: {}
   };
 }
 function encodeV1(store) {
@@ -54096,10 +54089,10 @@ async function readIdentities() {
 }
 async function getDefault() {
   const store = await readIdentities();
-  const identity3 = store.identities[store.default];
-  if (!identity3) {
-    throw new Error(`Default identity "${store.default}" not found. Run: astrale identity create ${store.default}`);
+  if (store.default === "" || store.identities[store.default] === undefined) {
+    throw new AstraleError("NO_IDENTITY", "No default identity.", "Run: astrale identity create <name>");
   }
+  const identity3 = store.identities[store.default];
   return { ...identity3, name: store.default };
 }
 async function getIdentity(name) {
@@ -54492,9 +54485,9 @@ async function resolveNamedInstanceTarget(identifier, opts) {
   try {
     managed = await opts.managed(identifier);
   } catch (e) {
-    if (!isManagedInstanceNotFound(e))
-      throw e;
-    throw notFound;
+    if (isManagedInstanceNotFound(e) || isAdminDiscoveryFailure(e))
+      throw notFound;
+    throw e;
   }
   const url3 = normalizeInstanceKernelUrl(managed.url);
   return {
@@ -54560,6 +54553,19 @@ function adminTargetToInstance(target) {
     ...target.caFile ? { caFile: target.caFile } : {}
   };
 }
+var ADMIN_DISCOVERY_CODES = new Set([
+  "TOKEN_EXCHANGE_SOURCE_INVALID",
+  "TOKEN_EXCHANGE_SOURCE_EXPIRED",
+  "TOKEN_EXCHANGE_UNSUPPORTED",
+  "TOKEN_EXCHANGE_DISCOVERY_FAILED",
+  "TOKEN_EXCHANGE_PROTOCOL_ERROR",
+  "TOKEN_EXCHANGE_INSECURE",
+  "ADMIN_DOMAIN_ISSUER_MISSING",
+  "ADMIN_INVENTORY_UNAVAILABLE"
+]);
+function isAdminDiscoveryFailure(error51) {
+  return error51 instanceof AstraleError && ADMIN_DISCOVERY_CODES.has(error51.code);
+}
 function isManagedInstanceNotFound(error51) {
   if (error51 instanceof AstraleError && error51.code === "INSTANCE_NOT_FOUND")
     return true;

package/dist/public/keys/index.js

@@ -45340,17 +45340,10 @@ async function readDecoded(options) {
 function hasVersion(input) {
   return typeof input === "object" && input !== null && Object.hasOwn(input, "version");
 }
-function seed(now) {
+function seed(_now) {
   return {
-    default: "manager",
-    identities: {
-      manager: {
-        subject: "manager",
-        createdAt: now.toISOString(),
-        source: "key",
-        mode: "local"
-      }
-    }
+    default: "",
+    identities: {}
   };
 }
 function encodeV1(store) {

package/dist/public/paths/index.js

@@ -43940,17 +43940,10 @@ async function readDecoded(options) {
 function hasVersion(input) {
   return typeof input === "object" && input !== null && Object.hasOwn(input, "version");
 }
-function seed(now) {
+function seed(_now) {
   return {
-    default: "manager",
-    identities: {
-      manager: {
-        subject: "manager",
-        createdAt: now.toISOString(),
-        source: "key",
-        mode: "local"
-      }
-    }
+    default: "",
+    identities: {}
   };
 }
 function encodeV1(store) {

package/dist/types/lib/instance-target.d.ts

@@ -33,4 +33,6 @@ export type ResolveInstanceTargetOpts = {
 export declare function resolveInstanceTarget(request: InstanceTargetRequest, opts: ResolveInstanceTargetOpts): Promise<ResolvedInstanceTarget>;
 export declare function couldBeConfiguredAdminInstance(identifier: string, config: AstraleConfig): boolean;
 export declare function adminTargetToInstance(target: ResolvedAdminTarget): ResolvedInstanceTarget;
+/** Admin lookup failed before it could say whether the slug exists. */
+export declare function isAdminDiscoveryFailure(error: unknown): boolean;
 export declare function isManagedInstanceNotFound(error: unknown): boolean;

package/dist/types/lib/invocation.d.ts

@@ -0,0 +1,3 @@
+/** Process-wide machine mode from argv (`--json` / `--raw` / `--ci`). */
+export declare function configureInvocation(argv: readonly string[]): void;
+export declare function invocationWantsMachine(): boolean;

package/dist/types/lib/log.d.ts

@@ -1,5 +1,5 @@
 import { type Ora } from 'ora';
-import { type RawOutputOpts } from './output';
+import { type MachineOpts } from './output';
 export declare const log: {
     info: (msg: string) => void;
     success: (msg: string) => void;
@@ -8,10 +8,11 @@ export declare const log: {
     step: (msg: string) => void;
     dim: (msg: string) => void;
 };
-/** Report an error with hint (when present) and exit. Commands that carry
- *  RawOutputOpts should pass them so machine consumers (--json/--raw/piped)
- *  get one structured JSON line on stderr instead of the pretty ✖ view. */
-export declare function fatal(e: unknown, opts?: RawOutputOpts): never;
+/** Report an error with hint (when present) and exit. `--json` / `--ci` / a
+ *  non-TTY stdout always get one structured JSON line on stderr. */
+export declare function fatal(e: unknown, opts?: MachineOpts): never;
+/** Admit expected invalid input and exit through {@link fatal}. */
+export declare function failClosed(error: unknown, opts?: MachineOpts): never;
 /** Shortcut for stub commands that aren't wired in v1 (§15). */
 export declare function fatalNotImplemented(feature: string, hint?: string): never;
 /**

package/dist/types/lib/output.d.ts

@@ -6,6 +6,9 @@ export type OutputOpts = {
     format?: 'yaml' | 'json';
 };
 export type RawOutputOpts = Pick<OutputOpts, 'raw' | 'json'>;
+export type MachineOpts = RawOutputOpts & {
+    readonly ci?: boolean;
+};
 export declare const RAW_OUTPUT_OPTIONS: readonly [{
     readonly flags: '--json';
     readonly description: 'Always-valid JSON (for jq)';
@@ -15,9 +18,10 @@ export declare const RAW_OUTPUT_OPTIONS: readonly [{
 }];
 /**
  * Is the consumer a machine (emit structured data, not a pretty view)?
- * True for `--json`, `--raw`, or any non-TTY stdout (pipe, redirect, CI, agent).
+ * True for `--json`, `--raw`, `--ci`, a process-wide `--ci/--json/--raw` on argv,
+ * or any non-TTY stdout (pipe, redirect, agent).
  */
-export declare function isMachine(opts?: RawOutputOpts): boolean;
+export declare function isMachine(opts?: MachineOpts): boolean;
 /**
  * `--raw` = the *unwrapped* value (bare scalar, raw bytes). The raw-vs-json
  * distinction only manifests for scalars and binary; objects/arrays fall back

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrale-os/cli",
-  "version": "0.8.1-alpha.4",
+  "version": "0.8.1-alpha.6",
   "description": "Astrale CLI — connect to existing Astrale kernels",
   "keywords": [
     "astrale",

package/src/commands/__tests__/introspect-parse.test.ts

@@ -0,0 +1,21 @@
+import { describe, expect, test } from 'bun:test'
+
+import { parseIntrospectTarget } from '../introspect'
+
+describe('parseIntrospectTarget', () => {
+  test('accepts a bare origin', () => {
+    const parsed = parseIntrospectTarget('host.astrale.ai')
+    expect(parsed.origin).toBe('host.astrale.ai')
+    expect(parsed.path.ast.steps).toEqual([])
+  })
+
+  test('accepts a Domain-rooted method Path', () => {
+    const parsed = parseIntrospectTarget('/:host.astrale.ai:class.Manager:createInstance')
+    expect(parsed.origin).toBe('host.astrale.ai')
+    expect(parsed.path.ast.steps.at(-1)?.kind).toBe('method')
+  })
+
+  test('rejects an @id', () => {
+    expect(() => parseIntrospectTarget('@abc')).toThrow('not an @id')
+  })
+})

package/src/commands/__tests__/logs.test.ts

@@ -29,6 +29,11 @@ describe('buildJournalInput', () => {
     expect(buildJournalInput({})).toEqual({ limit: 200 })
     expect(() => buildJournalInput({ limit: '0' })).toThrow('--limit')
     expect(() => buildJournalInput({ limit: 'all' })).toThrow('--limit')
+    expect(() => buildJournalInput({ since: 'not-a-date' })).toThrow('--since')
+    expect(() =>
+      buildJournalInput({ since: '2026-01-01T00:00:00Z', until: '1999-01-01T00:00:00Z' }),
+    ).toThrow('--since')
+    expect(() => buildJournalInput({ cursor: 'junk' })).toThrow('--cursor')
   })
 })
 

package/src/commands/__tests__/read-commands.test.ts

@@ -27,6 +27,7 @@ class ExitError extends Error {
 let stdout = ''
 let errors: string[] = []
 let originalStdoutWrite: typeof process.stdout.write
+let originalStderrWrite: typeof process.stderr.write
 let originalConsoleError: typeof console.error
 let originalExit: typeof process.exit
 let queryCalls: Array<{ ast: unknown; options: unknown }> = []
@@ -95,12 +96,17 @@ beforeEach(() => {
   runKernelCommandMock.mockClear()
 
   originalStdoutWrite = process.stdout.write
+  originalStderrWrite = process.stderr.write
   originalConsoleError = console.error
   originalExit = process.exit
   process.stdout.write = ((chunk: string | Uint8Array) => {
     stdout += typeof chunk === 'string' ? chunk : Buffer.from(chunk).toString('utf8')
     return true
   }) as typeof process.stdout.write
+  process.stderr.write = ((chunk: string | Uint8Array) => {
+    errors.push(typeof chunk === 'string' ? chunk : Buffer.from(chunk).toString('utf8'))
+    return true
+  }) as typeof process.stderr.write
   console.error = ((...values: unknown[]) => {
     errors.push(values.map(String).join(' '))
   }) as typeof console.error
@@ -111,6 +117,7 @@ beforeEach(() => {
 
 afterEach(() => {
   process.stdout.write = originalStdoutWrite
+  process.stderr.write = originalStderrWrite
   console.error = originalConsoleError
   process.exit = originalExit
 })
@@ -195,7 +202,10 @@ describe('query command', () => {
     ).rejects.toEqual(new ExitError(1))
 
     expect(runKernelCommandMock).not.toHaveBeenCalled()
-    expect(errors.join('\n')).toContain('expected "astrale.graph.query" at /format')
+    expect(JSON.parse(errors.join('\n'))).toMatchObject({
+      error: 'INVALID_INPUT',
+      message: 'Invalid input: expected "astrale.graph.query" at /format.',
+    })
   })
 })
 

package/src/commands/__tests__/token-ttl.test.ts

@@ -0,0 +1,21 @@
+import { describe, expect, test } from 'bun:test'
+
+import { AstraleError } from '../../errors'
+import { parseTtl } from '../token'
+
+describe('parseTtl', () => {
+  test('defaults to 3600 seconds', () => {
+    expect(parseTtl(undefined)).toBe(3600)
+  })
+
+  test('rejects non-positive and non-integer values', () => {
+    expect(() => parseTtl('abc')).toThrow(AstraleError)
+    expect(() => parseTtl('0')).toThrow(AstraleError)
+    expect(() => parseTtl('-5')).toThrow(AstraleError)
+    expect(() => parseTtl('1.5')).toThrow(AstraleError)
+  })
+
+  test('admits a positive integer', () => {
+    expect(parseTtl('90')).toBe(90)
+  })
+})

package/src/commands/auth/token.ts

@@ -1,9 +1,10 @@
 import type { CommandDefinition } from '../../program/index'
 
+import { AstraleError } from '../../errors'
 import { getDefault, getIdentity, readIdentities } from '../../identity/index'
 import { isSessionExpired, readIdpSession, type IdpSession } from '../../lib/idp'
 import { ensureFreshSession } from '../../lib/idp-session'
-import { log } from '../../lib/log'
+import { fatal, log } from '../../lib/log'
 import { output } from '../../lib/output'
 
 type AuthTokenType = 'access' | 'id'
@@ -66,7 +67,12 @@ Examples:
   $ astrale auth token --name alice --type id --json
 `,
   action: async (opts: AuthTokenOpts) => {
-    const result = await resolveAuthToken(opts)
+    let result: AuthTokenResult
+    try {
+      result = await resolveAuthToken(opts)
+    } catch (error) {
+      fatal(error, opts)
+    }
 
     if (opts.raw) {
       process.stdout.write(result.token + '\n')
@@ -118,10 +124,11 @@ async function resolveIdentityName(opts: AuthTokenOpts): Promise<string> {
   if (opts.name) {
     const identity = await getIdentity(opts.name)
     if ((identity.source ?? 'key') !== 'idp') {
-      throw new Error(`Identity "${opts.name}" is not IdP-backed`)
+      throw new AstraleError('AUTH_ERROR', `Identity "${opts.name}" is not IdP-backed`)
     }
     if (opts.idp && identity.idp !== opts.idp) {
-      throw new Error(
+      throw new AstraleError(
+        'AUTH_ERROR',
         `Identity "${opts.name}" is backed by IdP "${identity.idp ?? '?'}", not "${opts.idp}"`,
       )
     }
@@ -135,20 +142,25 @@ async function resolveIdentityName(opts: AuthTokenOpts): Promise<string> {
       .map(([name]) => name)
 
     if (matches.length === 0) {
-      throw new Error(
+      throw new AstraleError(
+        'AUTH_ERROR',
         `No IdP-backed identities found for IdP "${opts.idp}". Run: astrale auth login --idp ${opts.idp}`,
       )
     }
     if (matches.includes(store.default)) return store.default
     if (matches.length === 1) return matches[0]
-    throw new Error(
+    throw new AstraleError(
+      'AUTH_ERROR',
       `Multiple IdP-backed identities found for IdP "${opts.idp}": ${matches.join(', ')}. Pass --name.`,
     )
   }
 
   const identity = await getDefault()
   if ((identity.source ?? 'key') !== 'idp') {
-    throw new Error('Default identity is not IdP-backed. Pass --name or --idp.')
+    throw new AstraleError(
+      'AUTH_ERROR',
+      'Default identity is not IdP-backed. Pass --name or --idp.',
+    )
   }
   return identity.name
 }

package/src/commands/call.ts

@@ -4,15 +4,12 @@ import type { ConnectionContext, KernelCommandOpts } from '../connection'
 import type { CommandDefinition } from '../program/index'
 
 import { createPathCall, expandSelfInCall, runKernelCommand, withSelfHint } from '../connection'
-import { nodeProperty } from '../graph/index'
 import { presentBinary } from '../lib/binary'
-import { log } from '../lib/log'
+import { failClosed, log } from '../lib/log'
 import { output, present } from '../lib/output'
-import { describeCallableFromSchema, missingCallableDescription } from './call-describe'
 
 type CallOpts = KernelCommandOpts & {
   data?: string
-  describe?: boolean
   dryRun?: boolean
   output?: string
 }
@@ -32,15 +29,13 @@ export async function callCommand(
   try {
     expanded = await expandSelfInCall(path, rawParams, opts)
   } catch (error) {
-    log.error(error instanceof Error ? error.message : 'Invalid @self expansion')
-    process.exit(1)
+    failClosed(error, opts)
   }
   const expandedPath = expanded.path
-
-  // ── Describe mode: show schema without executing ────────
-  // Runs AFTER expansion so `astrale call @self::m --describe` works.
-  if (opts.describe) {
-    return describeOperation(expandedPath, opts)
+  try {
+    Path.parse(expandedPath)
+  } catch (error) {
+    failClosed(error, opts)
   }
 
   // ── Parse params ────────────────────────────────────────
@@ -48,8 +43,7 @@ export async function callCommand(
   try {
     params = await parseParams([...expanded.parameters], opts.data)
   } catch (e) {
-    log.error(e instanceof Error ? e.message : 'Invalid params')
-    process.exit(1)
+    failClosed(e, opts)
   }
 
   // ── Dry-run: show what would be sent ─────────────────────
@@ -94,24 +88,6 @@ export async function materializeCallResult(result: CallResult): Promise<Materia
   return Object.freeze({ kind: 'stream', values: Object.freeze(values) })
 }
 
-async function describeOperation(path: string, opts: CallOpts): Promise<void> {
-  await runKernelCommand({
-    opts,
-    label: `Schema for ${path}`,
-    fn: async ({ graph }) => {
-      const parsed = Path.parse(path)
-      if (parsed.ast.anchor.kind !== 'domain') {
-        throw missingCallableDescription(path)
-      }
-      const domain = await graph.getOrThrow(Path.parse(`/:${parsed.ast.anchor.origin}`))
-      const described = describeCallableFromSchema(parsed, nodeProperty(domain, 'schema'))
-      if (described === undefined) throw missingCallableDescription(path)
-      return described
-    },
-    format: (schema, fmtOpts) => output(schema, fmtOpts),
-  })
-}
-
 // ── Param parsing ───────────────────────────────────────────
 
 export async function parseParams(
@@ -129,6 +105,10 @@ export async function parseParams(
     }
   }
 
+  if (rawParams.length > 0) {
+    return parseKeyValue(rawParams)
+  }
+
   const stdin = await readStdin()
   if (stdin) {
     try {
@@ -138,10 +118,6 @@ export async function parseParams(
     }
   }
 
-  if (rawParams.length > 0) {
-    return parseKeyValue(rawParams)
-  }
-
   return {}
 }
 
@@ -201,11 +177,12 @@ export default {
   description: 'Call a kernel operation',
   afterHelpText: `
 Behavior:
-  Param priority (highest wins): --data > stdin > key=value > {}. If
+  Param priority (highest wins): --data > key=value > stdin > {}. If
   both --data and key=value are given, key=value is ignored (warned).
-  Stdin is read only when piped (ignored on a TTY). --describe and
-  --dry-run short-circuit (no execution). Remote-bound functions
-  auto-mint a worker-scoped credential; --creds overrides it.
+  Stdin is read only when piped and no --data/key=value is present
+  (ignored on a TTY). --dry-run admits the Path and prints the call
+  input without executing. Remote-bound functions auto-mint a
+  worker-scoped credential; --creds overrides it.
 
 Self-reference:
   @self expands to your nodeId on the active instance (path head or
@@ -214,11 +191,10 @@ Self-reference:
   (e.g. via 'astrale get @self --json'). Resolution authenticates to
   the selected Kernel and never trusts a local registration or JWT sub.
 
-  --describe reads the callable's input/output from the installed Domain
-  schema. Method Paths are not Function nodes.
+  Callable input/output lives on astrale introspect <path>.
 
 Examples:
-  $ astrale call /:host.astrale.ai:class.Manager:createInstance --describe
+  $ astrale introspect /:host.astrale.ai:class.Manager:createInstance
   $ astrale call /:blog.acme.com:class.Author:list limit=10
   $ astrale call '@self::deactivate'
   $ astrale call /:kernel.astrale.ai:function.journal --data '{"limit":5}' --json
@@ -234,7 +210,6 @@ Examples:
   options: [
     { flags: '-d, --data <json>', description: 'Params as JSON string' },
     { flags: '-o, --output <file>', description: 'Write binary/raw output to a file' },
-    { flags: '--describe', description: 'Show operation schema without executing' },
     { flags: '--dry-run', description: 'Show what would be sent without executing' },
   ],
   action: async (path, params, opts) => {

package/src/commands/get.ts

@@ -5,26 +5,40 @@ import type { CommandDefinition } from '../program/index'
 
 import { expandSelfInPath, runKernelCommand, withSelfHint } from '../connection'
 import { formatKernelError } from '../connection/errors'
-import { isMachine, output } from '../lib/output'
+import { AstraleError } from '../errors'
+import { denoise, isMachine, output } from '../lib/output'
 
-type GetOpts = KernelCommandOpts
+type GetOpts = KernelCommandOpts & { schema?: boolean }
 
 /** Read one exact canonical Node. The caller's Path is not fabricated into the Node value. */
 export async function getCommand(target: string, opts: GetOpts): Promise<void> {
   let path: string
   let meta
+  let parsed
   try {
     ;({ path, meta } = await expandSelfInPath(target, opts))
+    parsed = Path.parse(path)
   } catch (error) {
     await formatKernelError(error, isMachine(opts), undefined, opts.debug)
     process.exit(1)
   }
 
+  const last = parsed.ast.steps.at(-1)
+  if (last?.kind === 'method') {
+    const error = new AstraleError(
+      'NOT_A_NODE',
+      `${path} is a callable Path, not a Node.`,
+      `Use \`astrale call ${path}\` or \`astrale introspect ${path}\`.`,
+    )
+    await formatKernelError(error, isMachine(opts), undefined, opts.debug)
+    process.exit(1)
+  }
+
   await runKernelCommand({
     opts,
     label: `Node ${path}`,
-    fn: ({ graph }) => withSelfHint(() => graph.getOrThrow(Path.parse(path)), meta),
-    format: (node, format) => output(node, format),
+    fn: ({ graph }) => withSelfHint(() => graph.getOrThrow(parsed), meta),
+    format: (node, format) => output(opts.schema === true ? node : denoise(node), format),
   })
 }
 
@@ -38,14 +52,18 @@ Behavior:
   intentionally indistinguishable. @self is expanded before dispatch.
 
   A Node does not contain a synthetic path, labels, or backend class ID.
-  Use astrale query for graph-shaped reads.
+  Method Paths are not Nodes — use call / introspect. Schema-valued
+  properties are omitted unless --schema is passed. Use query for
+  graph-shaped reads.
 
 Examples:
   $ astrale get /:notes.example.dev:class.Note
   $ astrale get @abc123 --json
   $ astrale get @self
+  $ astrale get /:host.astrale.ai --schema
 `,
   arguments: [{ name: 'target', description: 'Canonical Node Path or @id' }],
+  options: [{ flags: '--schema', description: 'Include schema-valued properties' }],
   action: async (target, opts) => {
     await getCommand(target as string, opts as GetOpts)
   },

package/src/commands/identity/create.ts

@@ -2,6 +2,7 @@ import type { CommandDefinition } from '../../program/index'
 
 import { createIdentity } from '../../identity/index'
 import { fatal, log } from '../../lib/log'
+import { isMachine, output, RAW_OUTPUT_OPTIONS, type RawOutputOpts } from '../../lib/output'
 
 export default {
   name: 'create',
@@ -11,16 +12,24 @@ export default {
     { flags: '--subject <sub>', description: 'Custom subject (defaults to name)' },
     { flags: '--local', description: 'Local-only identity (default)' },
     { flags: '--remote', description: 'Remote (cloud-synced) identity — requires cloud login' },
+    ...RAW_OUTPUT_OPTIONS,
   ],
-  action: async (name: string, opts: { subject?: string; local?: boolean; remote?: boolean }) => {
+  action: async (
+    name: string,
+    opts: { subject?: string; local?: boolean; remote?: boolean } & RawOutputOpts,
+  ) => {
     try {
       const mode = opts.remote ? 'remote' : 'local'
       const identity = await createIdentity(name, { subject: opts.subject, mode })
+      if (isMachine(opts)) {
+        output({ name, ...identity }, opts)
+        return
+      }
       log.success(
         `Created identity "${name}" (subject: ${identity.subject}, mode: ${identity.mode})`,
       )
     } catch (e) {
-      fatal(e)
+      fatal(e, opts)
     }
   },
 } satisfies CommandDefinition

package/src/commands/identity/delete.ts

@@ -2,17 +2,23 @@ import type { CommandDefinition } from '../../program/index'
 
 import { deleteIdentity } from '../../identity/index'
 import { fatal, log } from '../../lib/log'
+import { isMachine, output, RAW_OUTPUT_OPTIONS, type RawOutputOpts } from '../../lib/output'
 
 export default {
   name: 'delete',
   description: 'Delete an identity',
   arguments: [{ name: 'name', description: 'Identity name', required: true }],
-  action: async (name: string) => {
+  options: [...RAW_OUTPUT_OPTIONS],
+  action: async (name: string, opts: RawOutputOpts) => {
     try {
       await deleteIdentity(name)
+      if (isMachine(opts)) {
+        output({ deleted: name }, opts)
+        return
+      }
       log.success(`Deleted identity "${name}"`)
     } catch (e) {
-      fatal(e)
+      fatal(e, opts)
     }
   },
 } satisfies CommandDefinition

package/src/commands/identity/export.ts

@@ -2,6 +2,7 @@ import type { CommandDefinition } from '../../program/index'
 
 import { encodeIdentityExport, exportIdentity, writeIdentityExport } from '../../identity/index'
 import { fatal, log } from '../../lib/log'
+import { isMachine, output, RAW_OUTPUT_OPTIONS, type RawOutputOpts } from '../../lib/output'
 import { readPassphrase } from '../../lib/prompt'
 
 /**
@@ -18,8 +19,9 @@ export default {
   ],
   options: [
     { flags: '--encrypt', description: 'Encrypt the envelope with a passphrase (JOSE JWE)' },
+    ...RAW_OUTPUT_OPTIONS,
   ],
-  action: async (name: string, path: string, opts: { encrypt?: boolean }) => {
+  action: async (name: string, path: string, opts: { encrypt?: boolean } & RawOutputOpts) => {
     try {
       const envelope = await exportIdentity(name)
       const passphrase = opts.encrypt
@@ -27,6 +29,10 @@ export default {
         : undefined
       await writeIdentityExport(path, await encodeIdentityExport(envelope, passphrase))
 
+      if (isMachine(opts)) {
+        output({ name, path, encrypted: Boolean(opts.encrypt) }, opts)
+        return
+      }
       log.success(`Exported identity "${name}" → ${path}${opts.encrypt ? ' (encrypted)' : ''}`)
       if (!opts.encrypt) {
         log.warn(
@@ -34,7 +40,7 @@ export default {
         )
       }
     } catch (e) {
-      fatal(e)
+      fatal(e, opts)
     }
   },
 } satisfies CommandDefinition