@astrale-os/cli 0.8.1-alpha.5 → 0.8.1-alpha.6

package/dist/astrale.js

@@ -2571,127 +2571,6 @@ var init_source = __esm(() => {
   source_default = chalk;
 });
 
-// package.json
-var package_default;
-var init_package = __esm(() => {
-  package_default = {
-    name: "@astrale-os/cli",
-    version: "0.8.1-alpha.5",
-    description: "Astrale CLI — connect to existing Astrale kernels",
-    keywords: [
-      "astrale",
-      "cli"
-    ],
-    license: "Apache-2.0",
-    author: "Astrale",
-    repository: {
-      type: "git",
-      url: "git+https://github.com/astrale-os/cli.git"
-    },
-    bin: {
-      astrale: "./dist/astrale.js"
-    },
-    files: [
-      "dist",
-      "src",
-      "tsconfig.json",
-      ".check-workspace.cjs",
-      "studio/server",
-      "studio/shared",
-      "studio/client/dist",
-      "studio/package.json",
-      "viewer/dist",
-      "THIRD-PARTY-NOTICES.md"
-    ],
-    type: "module",
-    exports: {
-      "./connect-core": {
-        types: "./dist/types/connect-core.d.ts",
-        import: "./dist/public/connect-core.js",
-        default: "./dist/public/connect-core.js"
-      },
-      "./keys": {
-        types: "./dist/types/keys/index.d.ts",
-        import: "./dist/public/keys/index.js",
-        default: "./dist/public/keys/index.js"
-      },
-      "./paths": {
-        types: "./dist/types/paths/index.d.ts",
-        import: "./dist/public/paths/index.js",
-        default: "./dist/public/paths/index.js"
-      },
-      "./identity-export-v1.schema.json": "./src/identity/.spec/schemas/identity-export-v1.schema.json"
-    },
-    publishConfig: {
-      access: "public",
-      registry: "https://registry.npmjs.org"
-    },
-    scripts: {
-      preinstall: "node .check-workspace.cjs",
-      prepare: "husky",
-      build: "bun scripts/build.ts",
-      prepack: "pnpm run package:check",
-      "package:check": "pnpm run typecheck && pnpm run test && pnpm run build && node scripts/verify-public-exports.mjs",
-      typecheck: "tsgo --noEmit && tsgo --noEmit -p tsconfig.tests.json && tsgo --noEmit -p viewer && tsgo --noEmit -p studio",
-      lint: "oxlint .",
-      "lint:fix": "oxlint --fix .",
-      format: "pnpm exec oxfmt --write .",
-      "format:check": "pnpm exec oxfmt --check .",
-      test: "bun test src",
-      "test:watch": "bun test --watch src"
-    },
-    dependencies: {
-      "@inquirer/prompts": "^8.5.2",
-      chalk: "^5.6.2",
-      chokidar: "^4.0.3",
-      commander: ">=13.0.0 <14.0.0",
-      jose: "^6.1.3",
-      ora: "^9.0.0",
-      "ts-morph": "^25.0.1",
-      yaml: "^2.8.2",
-      zod: "^3.25.0"
-    },
-    devDependencies: {
-      "@astrale-os/kernel-client": "0.6.0-beta.1",
-      "@astrale-os/ox": ">=0.1.0 <1.0.0",
-      "@astrale-os/sdk": "0.5.0-beta.1",
-      "@astrale-os/shell": "0.3.8-beta.1",
-      "@astrale/commitlint-config": "jsr:~2.0.1",
-      "@commitlint/cli": "~20.3.1",
-      "@commitlint/config-conventional": "~20.3.1",
-      "@types/bun": "^1.1.16",
-      "@types/node": "^22.0.0",
-      "@typescript/native-preview": "latest",
-      husky: "~9.1.7",
-      "lint-staged": "~16.2.7",
-      msgpackr: "^1.12.1",
-      oxfmt: "0.52.0",
-      oxlint: "latest",
-      typescript: "~6.0.1-rc"
-    },
-    "lint-staged": {
-      "*.{js,cjs,mjs,ts,tsx}": [
-        "oxlint --fix --no-error-on-unmatched-pattern",
-        "oxfmt --write"
-      ],
-      "*.{json,yml,yaml}": [
-        "oxfmt --write"
-      ]
-    },
-    devEngines: {
-      runtime: {
-        name: "node",
-        version: ">=24 <25",
-        onFail: "error"
-      }
-    },
-    engines: {
-      node: ">=22"
-    },
-    packageManager: "pnpm@11.13.1"
-  };
-});
-
 // node_modules/.pnpm/yaml@2.9.0/node_modules/yaml/dist/nodes/identity.js
 var require_identity = __commonJS((exports) => {
   var ALIAS = Symbol.for("yaml.alias");
@@ -9682,6 +9561,12 @@ var init_dist = __esm(() => {
   $visitAsync = visit.visitAsync;
 });
 
+// src/lib/invocation.ts
+function invocationWantsMachine() {
+  return argvMachine;
+}
+var argvMachine = false;
+
 // src/lib/table.ts
 function visibleWidth(s) {
   return s.replace(ANSI, "").length;
@@ -9720,7 +9605,7 @@ var init_table = __esm(() => {
 
 // src/lib/output.ts
 function isMachine(opts) {
-  return !!(opts?.raw || opts?.json) || !(process.stdout.isTTY ?? false);
+  return !!(opts?.raw || opts?.json || opts?.ci) || invocationWantsMachine() || !(process.stdout.isTTY ?? false);
 }
 function output(data, opts) {
   if (data === undefined)
@@ -9768,13 +9653,21 @@ function highlightJson(data) {
   const json = JSON.stringify(data, null, 2);
   return json.replace(/"([^"]+)"(?=\s*:)/g, (_, key) => source_default.cyan(`"${key}"`)).replace(/: "([^"]*)"(?=[,\n\r\]}])/g, (_, val) => `: ${source_default.green(`"${val}"`)}`).replace(/: (-?\d+\.?\d*(?:e[+-]?\d+)?)\b/gi, (_, num) => `: ${source_default.yellow(num)}`).replace(/: (true|false)\b/g, (_, bool) => `: ${source_default.magenta(bool)}`).replace(/: (null)\b/g, () => `: ${source_default.dim("null")}`);
 }
+function isNoiseKey(key) {
+  if (NOISE_KEYS.has(key))
+    return true;
+  const dot = key.lastIndexOf(".");
+  const colon = key.lastIndexOf(":");
+  const split = Math.max(dot, colon);
+  return split >= 0 && NOISE_KEYS.has(key.slice(split + 1));
+}
 function denoise(value) {
   if (Array.isArray(value))
     return value.map(denoise);
   if (value && typeof value === "object") {
     const out = {};
     for (const [k, v] of Object.entries(value)) {
-      if (NOISE_KEYS.has(k))
+      if (isNoiseKey(k))
         continue;
       out[k] = v && typeof v === "object" ? denoise(v) : v;
     }
@@ -9838,6 +9731,127 @@ var init_output = __esm(() => {
   NOISE_KEYS = new Set(["schema", "icon", "code", "inputSchema", "outputSchema"]);
 });
 
+// package.json
+var package_default;
+var init_package = __esm(() => {
+  package_default = {
+    name: "@astrale-os/cli",
+    version: "0.8.1-alpha.6",
+    description: "Astrale CLI — connect to existing Astrale kernels",
+    keywords: [
+      "astrale",
+      "cli"
+    ],
+    license: "Apache-2.0",
+    author: "Astrale",
+    repository: {
+      type: "git",
+      url: "git+https://github.com/astrale-os/cli.git"
+    },
+    bin: {
+      astrale: "./dist/astrale.js"
+    },
+    files: [
+      "dist",
+      "src",
+      "tsconfig.json",
+      ".check-workspace.cjs",
+      "studio/server",
+      "studio/shared",
+      "studio/client/dist",
+      "studio/package.json",
+      "viewer/dist",
+      "THIRD-PARTY-NOTICES.md"
+    ],
+    type: "module",
+    exports: {
+      "./connect-core": {
+        types: "./dist/types/connect-core.d.ts",
+        import: "./dist/public/connect-core.js",
+        default: "./dist/public/connect-core.js"
+      },
+      "./keys": {
+        types: "./dist/types/keys/index.d.ts",
+        import: "./dist/public/keys/index.js",
+        default: "./dist/public/keys/index.js"
+      },
+      "./paths": {
+        types: "./dist/types/paths/index.d.ts",
+        import: "./dist/public/paths/index.js",
+        default: "./dist/public/paths/index.js"
+      },
+      "./identity-export-v1.schema.json": "./src/identity/.spec/schemas/identity-export-v1.schema.json"
+    },
+    publishConfig: {
+      access: "public",
+      registry: "https://registry.npmjs.org"
+    },
+    scripts: {
+      preinstall: "node .check-workspace.cjs",
+      prepare: "husky",
+      build: "bun scripts/build.ts",
+      prepack: "pnpm run package:check",
+      "package:check": "pnpm run typecheck && pnpm run test && pnpm run build && node scripts/verify-public-exports.mjs",
+      typecheck: "tsgo --noEmit && tsgo --noEmit -p tsconfig.tests.json && tsgo --noEmit -p viewer && tsgo --noEmit -p studio",
+      lint: "oxlint .",
+      "lint:fix": "oxlint --fix .",
+      format: "pnpm exec oxfmt --write .",
+      "format:check": "pnpm exec oxfmt --check .",
+      test: "bun test src",
+      "test:watch": "bun test --watch src"
+    },
+    dependencies: {
+      "@inquirer/prompts": "^8.5.2",
+      chalk: "^5.6.2",
+      chokidar: "^4.0.3",
+      commander: ">=13.0.0 <14.0.0",
+      jose: "^6.1.3",
+      ora: "^9.0.0",
+      "ts-morph": "^25.0.1",
+      yaml: "^2.8.2",
+      zod: "^3.25.0"
+    },
+    devDependencies: {
+      "@astrale-os/kernel-client": "0.6.0-beta.1",
+      "@astrale-os/ox": ">=0.1.0 <1.0.0",
+      "@astrale-os/sdk": "0.5.0-beta.1",
+      "@astrale-os/shell": "0.3.8-beta.1",
+      "@astrale/commitlint-config": "jsr:~2.0.1",
+      "@commitlint/cli": "~20.3.1",
+      "@commitlint/config-conventional": "~20.3.1",
+      "@types/bun": "^1.1.16",
+      "@types/node": "^22.0.0",
+      "@typescript/native-preview": "latest",
+      husky: "~9.1.7",
+      "lint-staged": "~16.2.7",
+      msgpackr: "^1.12.1",
+      oxfmt: "0.52.0",
+      oxlint: "latest",
+      typescript: "~6.0.1-rc"
+    },
+    "lint-staged": {
+      "*.{js,cjs,mjs,ts,tsx}": [
+        "oxlint --fix --no-error-on-unmatched-pattern",
+        "oxfmt --write"
+      ],
+      "*.{json,yml,yaml}": [
+        "oxfmt --write"
+      ]
+    },
+    devEngines: {
+      runtime: {
+        name: "node",
+        version: ">=24 <25",
+        onFail: "error"
+      }
+    },
+    engines: {
+      node: ">=22"
+    },
+    packageManager: "pnpm@11.13.1"
+  };
+});
+
 // node_modules/.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/lib/buffer_utils.js
 function concat(...buffers) {
   const size = buffers.reduce((acc, { length }) => acc + length, 0);
@@ -63337,17 +63351,10 @@ async function readDecoded(options) {
 function hasVersion(input) {
   return typeof input === "object" && input !== null && Object.hasOwn(input, "version");
 }
-function seed(now) {
+function seed(_now) {
   return {
-    default: "manager",
-    identities: {
-      manager: {
-        subject: "manager",
-        createdAt: now.toISOString(),
-        source: "key",
-        mode: "local"
-      }
-    }
+    default: "",
+    identities: {}
   };
 }
 function encodeV1(store) {
@@ -66574,20 +66581,25 @@ function fatal(e, opts) {
   if (e instanceof Error && e.name === "ExitPromptError")
     process.exit(130);
   const msg = e instanceof Error ? e.message : String(e);
-  if (opts && isMachine(opts)) {
-    const error52 = e instanceof AstraleError ? e.code : e instanceof Error ? e.name : "Error";
-    const payload = { error: error52, message: msg };
+  const code = e instanceof AstraleError ? e.code : e instanceof Error ? e.name : "Error";
+  if (isMachine(opts)) {
+    const payload = { error: code, message: msg };
     if (e instanceof AstraleError && e.hint)
       payload.hint = e.hint;
     process.stderr.write(JSON.stringify(payload) + `
 `);
     process.exit(1);
   }
-  log.error(msg);
+  log.error(e instanceof AstraleError ? `${code}: ${msg}` : msg);
   if (e instanceof AstraleError && e.hint)
     log.dim(`  hint: ${e.hint}`);
   process.exit(1);
 }
+function failClosed(error52, opts) {
+  if (error52 instanceof AstraleError)
+    fatal(error52, opts);
+  fatal(new AstraleError("INVALID_INPUT", error52 instanceof Error ? error52.message : String(error52)), opts);
+}
 function fatalNotImplemented(feature, hint) {
   fatal(new NotImplementedError(feature, hint));
 }
@@ -67869,8 +67881,12 @@ async function createIdentity(name, options = {}) {
       kid: generated.kid,
       issuer: options.issuer
     };
+    const hasDefault = store.default !== "" && store.identities[store.default] !== undefined;
     return {
-      next: { ...store, identities: { ...store.identities, [name]: identity3 } },
+      next: {
+        default: hasDefault ? store.default : name,
+        identities: { ...store.identities, [name]: identity3 }
+      },
       value: identity3
     };
   });
@@ -67904,10 +67920,10 @@ async function setDefault(name) {
 }
 async function getDefault() {
   const store = await readIdentities();
-  const identity3 = store.identities[store.default];
-  if (!identity3) {
-    throw new Error(`Default identity "${store.default}" not found. Run: astrale identity create ${store.default}`);
+  if (store.default === "" || store.identities[store.default] === undefined) {
+    throw new AstraleError("NO_IDENTITY", "No default identity.", "Run: astrale identity create <name>");
   }
+  const identity3 = store.identities[store.default];
   return { ...identity3, name: store.default };
 }
 async function getIdentity(name) {
@@ -67974,6 +67990,7 @@ async function setIdentityMode(name, mode) {
   });
 }
 var init_registry = __esm(() => {
+  init_errors2();
   init_keys2();
   init_idp();
   init_validation2();
@@ -71523,7 +71540,7 @@ var init_utils2 = __esm(() => {
 });
 
 // node_modules/.pnpm/fast-string-truncated-width@3.0.3/node_modules/fast-string-truncated-width/dist/index.js
-var ANSI_RE, CONTROL_RE, CJKT_WIDE_RE, TAB_RE, EMOJI_RE, LATIN_RE, MODIFIER_RE, NO_TRUNCATION, getStringTruncatedWidth = (input, truncationOptions = {}, widthOptions = {}) => {
+var ANSI_RE2, CONTROL_RE, CJKT_WIDE_RE, TAB_RE, EMOJI_RE, LATIN_RE, MODIFIER_RE, NO_TRUNCATION, getStringTruncatedWidth = (input, truncationOptions = {}, widthOptions = {}) => {
   const LIMIT = truncationOptions.limit ?? Infinity;
   const ELLIPSIS = truncationOptions.ellipsis ?? "";
   const ELLIPSIS_WIDTH = truncationOptions?.ellipsisWidth ?? (ELLIPSIS ? getStringTruncatedWidth(ELLIPSIS, NO_TRUNCATION, widthOptions).width : 0);
@@ -71536,7 +71553,7 @@ var ANSI_RE, CONTROL_RE, CJKT_WIDE_RE, TAB_RE, EMOJI_RE, LATIN_RE, MODIFIER_RE,
   const WIDE_WIDTH = widthOptions.wideWidth ?? FULL_WIDTH_WIDTH;
   const PARSE_BLOCKS = [
     [LATIN_RE, REGULAR_WIDTH],
-    [ANSI_RE, ANSI_WIDTH],
+    [ANSI_RE2, ANSI_WIDTH],
     [CONTROL_RE, CONTROL_WIDTH],
     [TAB_RE, TAB_WIDTH],
     [EMOJI_RE, EMOJI_WIDTH],
@@ -71613,7 +71630,7 @@ var ANSI_RE, CONTROL_RE, CJKT_WIDE_RE, TAB_RE, EMOJI_RE, LATIN_RE, MODIFIER_RE,
 }, dist_default2;
 var init_dist6 = __esm(() => {
   init_utils2();
-  ANSI_RE = /[\u001b\u009b][[()#;?]*(?:[0-9]{1,4}(?:;[0-9]{0,4})*)?[0-9A-ORZcf-nqry=><]|\u001b\]8;[^;]*;.*?(?:\u0007|\u001b\u005c)/y;
+  ANSI_RE2 = /[\u001b\u009b][[()#;?]*(?:[0-9]{1,4}(?:;[0-9]{0,4})*)?[0-9A-ORZcf-nqry=><]|\u001b\]8;[^;]*;.*?(?:\u0007|\u001b\u005c)/y;
   CONTROL_RE = /[\x00-\x08\x0A-\x1F\x7F-\x9F]{1,1000}/y;
   CJKT_WIDE_RE = /(?:(?![\uFF61-\uFF9F\uFF00-\uFFEF])[\p{Script=Han}\p{Script=Hiragana}\p{Script=Katakana}\p{Script=Hangul}\p{Script=Tangut}]){1,1000}/yu;
   TAB_RE = /\t{1,1000}/y;
@@ -87405,7 +87422,7 @@ async function formatKernelError(error52, isRaw, urlArg = "", debug = false, opt
         } else {
           console.log(source_default.red(`  ${error52.message}`));
         }
-        log.dim("  Use `astrale call <path> --describe` to see the expected schema");
+        log.dim("  Use `astrale introspect <path>` to see the expected schema");
       }
       break;
     }
@@ -87426,18 +87443,22 @@ async function formatKernelError(error52, isRaw, urlArg = "", debug = false, opt
     case "ResponseError": {
       const code = error52.code;
       const reason = error52.reason;
+      const reasonCode = reason !== null && typeof reason === "object" && typeof reason.code === "string" ? reason.code : undefined;
+      const hint = reasonCode === "FUNCTION_INPUT_INVALID" ? "Use `astrale introspect <path>` to see the callable input." : undefined;
       if (isRaw) {
         writeRaw({
           error: "RESPONSE_ERROR",
           ...code === undefined ? {} : { code },
           message: error52.message,
-          ...reason === undefined ? {} : { reason }
+          ...reason === undefined ? {} : { reason },
+          ...hint === undefined ? {} : { hint }
         });
       } else {
         log.error(`${source_default.bold(code === undefined ? "RESPONSE_ERROR" : `RESPONSE_ERROR(${String(code)})`)}: ${error52.message}`);
-        if (reason !== null && typeof reason === "object" && typeof reason.code === "string") {
-          log.dim(`  reason: ${reason.code}`);
-        }
+        if (reasonCode !== undefined)
+          log.dim(`  reason: ${reasonCode}`);
+        if (hint !== undefined)
+          log.dim(`  ${hint}`);
       }
       break;
     }
@@ -87450,11 +87471,21 @@ async function formatKernelError(error52, isRaw, urlArg = "", debug = false, opt
         log.error(`${source_default.bold(`${type}(${code})`)}: ${error52.message}`);
       break;
     }
-    default:
-      if (isRaw)
-        writeRaw({ error: name || "UNKNOWN", message: error52.message });
-      else
-        log.error(`${source_default.bold(name || "Error")}: ${error52.message}`);
+    default: {
+      const mapped = mapPublicError(error52);
+      if (isRaw) {
+        writeRaw({
+          error: mapped.code,
+          message: mapped.message,
+          ...mapped.hint === undefined ? {} : { hint: mapped.hint },
+          ...mapped.timeoutMs === undefined ? {} : { timeoutMs: mapped.timeoutMs }
+        });
+      } else {
+        log.error(`${source_default.bold(mapped.code)}: ${mapped.message}`);
+        if (mapped.hint)
+          log.dim(`  ${mapped.hint}`);
+      }
+    }
   }
   if (debug)
     printDebug(error52, url3);
@@ -87462,6 +87493,46 @@ async function formatKernelError(error52, isRaw, urlArg = "", debug = false, opt
 function stripMethodSuffix(msg) {
   return msg.replace(/(\/[^"\s:]+)::([a-zA-Z]\w*)/g, "$1");
 }
+function mapPublicError(error52) {
+  const name = error52.name;
+  if (name === "PathError") {
+    return { code: "PATH_INVALID", message: error52.message };
+  }
+  if (name === "NodeUnavailableError") {
+    return {
+      code: "NODE_UNAVAILABLE",
+      message: error52.message,
+      hint: "If this is a callable Path, use `astrale call` or `astrale introspect`."
+    };
+  }
+  if (name === "AuthValueError") {
+    return { code: "AUTH_VALUE_INVALID", message: error52.message };
+  }
+  if (name === "ClientError" && /timed out/i.test(error52.message)) {
+    const timeoutMs = error52.timeoutMs;
+    return {
+      code: "TIMEOUT",
+      message: error52.message,
+      hint: "Try increasing with --timeout",
+      ...timeoutMs === undefined ? {} : { timeoutMs }
+    };
+  }
+  if (name === "ClientError" && /Publication discovery returned HTTP/i.test(error52.message)) {
+    return {
+      code: "KERNEL_DISCOVERY_FAILED",
+      message: error52.message,
+      hint: "Pass the Kernel issuer URL (no /invoke suffix), e.g. https://host/kernel/host"
+    };
+  }
+  if (name === "Error" && /unable to connect/i.test(error52.message)) {
+    return {
+      code: "CONNECTION_ERROR",
+      message: error52.message,
+      hint: "Check --url / -i and that the Kernel is reachable. Try: astrale status"
+    };
+  }
+  return { code: name && name !== "Error" ? name : "UNKNOWN", message: error52.message };
+}
 function writeRaw(payload) {
   process.stderr.write(JSON.stringify(payload) + `
 `);
@@ -88498,9 +88569,9 @@ async function resolveNamedInstanceTarget(identifier, opts) {
   try {
     managed = await opts.managed(identifier);
   } catch (e) {
-    if (!isManagedInstanceNotFound(e))
-      throw e;
-    throw notFound;
+    if (isManagedInstanceNotFound(e) || isAdminDiscoveryFailure(e))
+      throw notFound;
+    throw e;
   }
   const url3 = normalizeInstanceKernelUrl(managed.url);
   return {
@@ -88566,6 +88637,9 @@ function adminTargetToInstance(target2) {
     ...target2.caFile ? { caFile: target2.caFile } : {}
   };
 }
+function isAdminDiscoveryFailure(error52) {
+  return error52 instanceof AstraleError && ADMIN_DISCOVERY_CODES.has(error52.code);
+}
 function isManagedInstanceNotFound(error52) {
   if (error52 instanceof AstraleError && error52.code === "INSTANCE_NOT_FOUND")
     return true;
@@ -88578,11 +88652,22 @@ function isManagedInstanceNotFound(error52) {
   const data4 = error52.data;
   return error52.name === "KernelError" && !!data4 && typeof data4 === "object" && data4.type === "NotFoundError";
 }
+var ADMIN_DISCOVERY_CODES;
 var init_instance_target = __esm(() => {
   init_errors2();
   init_admin_target();
   init_instance2();
   init_validation2();
+  ADMIN_DISCOVERY_CODES = new Set([
+    "TOKEN_EXCHANGE_SOURCE_INVALID",
+    "TOKEN_EXCHANGE_SOURCE_EXPIRED",
+    "TOKEN_EXCHANGE_UNSUPPORTED",
+    "TOKEN_EXCHANGE_DISCOVERY_FAILED",
+    "TOKEN_EXCHANGE_PROTOCOL_ERROR",
+    "TOKEN_EXCHANGE_INSECURE",
+    "ADMIN_DOMAIN_ISSUER_MISSING",
+    "ADMIN_INVENTORY_UNAVAILABLE"
+  ]);
 });
 
 // src/connection/target.ts
@@ -88678,6 +88763,9 @@ function createCliCredential(target2, options, config2, fetch2 = globalThis.fetc
   return createConnectionCredential(target2.kernelIssuer, effective);
 }
 function validateCredentialSelection(options) {
+  if (options.as !== undefined && options.creds !== undefined) {
+    throw new AstraleError("INVALID_FLAG", "--as cannot be combined with --creds.");
+  }
   if (options.anonymous !== true)
     return;
   const conflicting = [
@@ -88703,6 +88791,13 @@ var init_credential6 = __esm(() => {
 });
 
 // src/connection/session.ts
+function warnMissingExplicitTarget(options, target2) {
+  if (options.instance !== undefined || options.url !== undefined)
+    return;
+  if (!isMachine(options))
+    return;
+  log.warn(`No -i/--url; using ${target2.slug ?? target2.url}`);
+}
 async function withClientSession(options, action) {
   validateCredentialSelection(options);
   const timeoutMs = resolveTimeoutMs(options.timeout);
@@ -88710,6 +88805,7 @@ async function withClientSession(options, action) {
   const target2 = await resolveConnectionTarget(options, config2, {
     managed: (slug) => lookupManagedInstance(slug, options)
   });
+  warnMissingExplicitTarget(options, target2);
   return runResolvedClientSession(target2, timeoutMs, options, config2, action, openConnection);
 }
 async function withAdminClientSession(options, action) {
@@ -88787,6 +88883,8 @@ var init_session3 = __esm(() => {
   init_errors2();
   init_ca_fetch();
   init_config();
+  init_log();
+  init_output();
   init_credential6();
   init_target3();
   MAXIMUM_ROUTE_AGE_MS = 5 * 60000;
@@ -89384,7 +89482,7 @@ var init_whoami3 = __esm(() => {
         }
         console.log(`${source_default.bold(result.name)} (subject: ${result.subject})`);
       } catch (e) {
-        fatal(e);
+        fatal(e, opts);
       }
     }
   };
@@ -89972,26 +90070,46 @@ async function refreshSdkDeps(check3, assumeYes = false) {
   return true;
 }
 async function cliStale(opts) {
+  const running = package_default.version;
+  const latest = await fetchNpmLatestVersion().catch(() => {
+    return;
+  });
   try {
     const r = await updateAstrale({
       check: true,
       channel: opts.channel,
       version: opts.version,
-      currentVersion: package_default.version
+      currentVersion: running
     });
-    if (r.status === "updated")
-      return { stale: false, managed: false, current: r.currentVersion };
+    if (r.status === "updated") {
+      return { stale: false, managed: false, current: running, latest: latest ?? running };
+    }
     return {
-      stale: r.status === "available",
+      stale: latest !== undefined ? latest !== running : r.status === "available",
       managed: false,
-      current: r.currentVersion,
-      latest: r.latestVersion,
-      channel: r.channel
+      current: running,
+      latest: latest ?? r.latestVersion,
+      channel: latest !== undefined ? "npm" : r.channel
     };
   } catch {
-    return { stale: false, managed: true };
+    return {
+      stale: latest !== undefined && latest !== running,
+      managed: true,
+      current: running,
+      ...latest === undefined ? {} : { latest, channel: "npm" }
+    };
   }
 }
+async function fetchNpmLatestVersion() {
+  const response2 = await fetch("https://registry.npmjs.org/@astrale-os/cli/latest");
+  if (!response2.ok)
+    throw new Error(`npm registry HTTP ${response2.status}`);
+  const body = await response2.json();
+  if (body === null || typeof body !== "object" || typeof body.version !== "string") {
+    throw new Error("npm registry latest document is missing version");
+  }
+  return body.version;
+}
 async function sdkStale() {
   if (!inDomainProject() || foreignPackageManager()) {
     return { stale: false, inProject: inDomainProject(), outdated: [] };
@@ -90109,140 +90227,6 @@ Examples:
     }
   };
 });
-// node_modules/.pnpm/@astrale-os+sdk@file+vendor+astrale-os-sdk-0.5.0-beta.1.tgz_@astrale-os+ox@0.1.2_oxfmt@_72b33f8043e5d121b8114f4a315f9796/node_modules/@astrale-os/sdk/dist/mutation/errors.js
-var UNKNOWN_OUTCOME_CODES;
-var init_errors14 = __esm(() => {
-  UNKNOWN_OUTCOME_CODES = new Set(["MUTATION_OUTCOME_UNKNOWN"]);
-});
-
-// node_modules/.pnpm/@astrale-os+sdk@file+vendor+astrale-os-sdk-0.5.0-beta.1.tgz_@astrale-os+ox@0.1.2_oxfmt@_72b33f8043e5d121b8114f4a315f9796/node_modules/@astrale-os/sdk/dist/mutation/rich.js
-var init_rich = __esm(() => {
-  init_class();
-  init_path4();
-  init_v1();
-});
-
-// node_modules/.pnpm/@astrale-os+sdk@file+vendor+astrale-os-sdk-0.5.0-beta.1.tgz_@astrale-os+ox@0.1.2_oxfmt@_72b33f8043e5d121b8114f4a315f9796/node_modules/@astrale-os/sdk/dist/mutation/execute.js
-var init_execute2 = __esm(() => {
-  init_mutate();
-  init_errors14();
-  init_rich();
-});
-
-// node_modules/.pnpm/@astrale-os+sdk@file+vendor+astrale-os-sdk-0.5.0-beta.1.tgz_@astrale-os+ox@0.1.2_oxfmt@_72b33f8043e5d121b8114f4a315f9796/node_modules/@astrale-os/sdk/dist/mutation/index.js
-var init_mutation2 = __esm(() => {
-  init_execute2();
-  init_mutate();
-});
-
-// src/graph/mutation.ts
-function prepareMutation(input) {
-  if (isLegacyPatchData(input)) {
-    throw new TypeError("Legacy PatchData { nodes, edges } is not Mutation V3. Author { preconditions, operations } or a canonical astrale.graph.mutation/v3 document.");
-  }
-  if (isCanonicalCandidate(input))
-    return MutationAST.decode(input);
-  return MutationAST.create(input);
-}
-function isCanonicalCandidate(input) {
-  return input !== null && typeof input === "object" && !Array.isArray(input) && (Object.hasOwn(input, "format") || Object.hasOwn(input, "version"));
-}
-function isLegacyPatchData(input) {
-  return input !== null && typeof input === "object" && !Array.isArray(input) && !Object.hasOwn(input, "operations") && (Object.hasOwn(input, "nodes") || Object.hasOwn(input, "edges"));
-}
-var init_mutation3 = __esm(() => {
-  init_mutation2();
-});
-
-// src/graph/projection.ts
-function unqualifyProperty(key) {
-  const property2 = key.lastIndexOf(".property.");
-  if (property2 >= 0)
-    return key.slice(property2 + ".property.".length);
-  const slash = key.lastIndexOf("/");
-  return slash >= 0 ? key.slice(slash + 1) : key;
-}
-function nodeProperty(node4, name) {
-  const props4 = node4?.props;
-  if (props4 === undefined)
-    return;
-  if (Object.hasOwn(props4, name))
-    return props4[name];
-  for (const [key, value2] of Object.entries(props4)) {
-    if (unqualifyProperty(key) === name)
-      return value2;
-  }
-  return;
-}
-
-// src/graph/query.ts
-function prepareQuery(input) {
-  const limit = positiveInteger2(input.limit, "--limit", DEFAULT_LIMIT);
-  if (input.ast !== undefined) {
-    if (input.sources.length > 0 || input.definition !== undefined || input.edge !== undefined || input.direction !== undefined) {
-      throw new TypeError("--ast/--file cannot be combined with sources, --definition, --edge, or --direction");
-    }
-    return withPage(QueryAST.decode(input.ast), limit, input.cursor);
-  }
-  if (input.sources.length === 0 && input.definition === undefined) {
-    throw new TypeError("query requires a Path source, --definition, or a canonical Query V6 document");
-  }
-  if (input.direction !== undefined && input.edge === undefined) {
-    throw new TypeError("--direction requires --edge");
-  }
-  const paths4 = input.sources.map((source2) => Path.parse(source2));
-  const definition3 = input.definition === undefined ? undefined : definitionRef(input.definition);
-  const query3 = paths4.length > 0 ? Query2.from({
-    kind: "node",
-    paths: paths4,
-    ...definition3 === undefined ? {} : { definitions: [definition3] }
-  }) : Query2.from({ kind: "node", definitions: [definition3] });
-  const ast = input.edge === undefined ? query3.select({ kind: "graph" }) : query3.expand({
-    via: [definitionRef(input.edge)],
-    direction: input.direction ?? "outgoing"
-  }).select({ kind: "graph" });
-  return withPage(ast, limit, input.cursor);
-}
-function definitionRef(input) {
-  const path5 = Path.parse(input);
-  const step = path5.ast.steps[0];
-  if (path5.ast.anchor.kind !== "domain" || path5.ast.steps.length !== 1 || step?.kind !== "projection" || step.projection.kind !== "class" && step.projection.kind !== "interface") {
-    throw new TypeError("--definition must be one canonical Class or Interface Path");
-  }
-  return Object.freeze({
-    origin: path5.ast.anchor.origin,
-    kind: step.projection.kind,
-    name: step.projection.name
-  });
-}
-function positiveInteger2(raw2, name, fallback) {
-  if (raw2 === undefined)
-    return fallback;
-  if (!/^\d+$/.test(raw2))
-    throw new TypeError(`${name} must be a positive integer`);
-  const value2 = Number.parseInt(raw2, 10);
-  if (!Number.isSafeInteger(value2) || value2 <= 0) {
-    throw new TypeError(`${name} must be a positive integer`);
-  }
-  return value2;
-}
-function withPage(ast, size, cursor) {
-  return Object.freeze({
-    ast,
-    page: Object.freeze({ size, ...cursor === undefined ? {} : { after: cursor } })
-  });
-}
-var DEFAULT_LIMIT = 100;
-var init_query6 = __esm(() => {
-  init_path5();
-  init_query4();
-});
-
-// src/graph/index.ts
-var init_graph6 = __esm(() => {
-  init_mutation3();
-  init_query6();
-});
 
 // src/lib/binary.ts
 import { writeFile as writeFile5 } from "node:fs/promises";
@@ -90314,99 +90298,6 @@ var init_binary4 = __esm(() => {
   init_output();
 });
 
-// src/commands/call-describe.ts
-function describeCallableFromSchema(path5, schema2) {
-  if (path5.ast.anchor.kind !== "domain")
-    return;
-  const origin = path5.ast.anchor.origin;
-  const last = path5.ast.steps.at(-1);
-  const document = asRecord2(schema2);
-  if (document === undefined || last === undefined)
-    return;
-  if (last.kind === "method") {
-    const owner = path5.ast.steps.at(-2);
-    if (owner?.kind === "projection" && (owner.projection.kind === "class" || owner.projection.kind === "interface")) {
-      const bag = asRecord2(owner.projection.kind === "class" ? document.classes : document.interfaces);
-      const definition3 = asRecord2(bag?.[owner.projection.name]);
-      const method = asRecord2(asRecord2(definition3?.methods)?.[last.name]);
-      if (method !== undefined) {
-        return Object.freeze({
-          path: path5.raw,
-          origin,
-          class: owner.projection.name,
-          method: last.name,
-          dispatch: last.dispatch,
-          ...callableFields(method)
-        });
-      }
-    }
-    const matches3 = findNamedMethods(document, origin, path5.raw, last.name, last.dispatch);
-    if (matches3.length === 1)
-      return matches3[0];
-    if (matches3.length > 1) {
-      return Object.freeze({
-        path: path5.raw,
-        origin,
-        method: last.name,
-        dispatch: last.dispatch,
-        candidates: Object.freeze(matches3)
-      });
-    }
-    return;
-  }
-  if (last.kind === "projection" && last.projection.kind === "function") {
-    const fn2 = asRecord2(asRecord2(document.functions)?.[last.projection.name]);
-    if (fn2 === undefined)
-      return;
-    return Object.freeze({
-      path: path5.raw,
-      origin,
-      function: last.projection.name,
-      ...callableFields(fn2)
-    });
-  }
-  return;
-}
-function missingCallableDescription(path5) {
-  return new AstraleError("CALL_DESCRIBE_UNAVAILABLE", `No callable schema is installed for ${path5}.`, "Use a Domain-rooted Path such as /:host.astrale.ai:class.Manager:createInstance. Method Paths are not Function nodes.");
-}
-function findNamedMethods(schema2, origin, path5, method, dispatch) {
-  const matches3 = [];
-  for (const bag of [schema2.classes, schema2.interfaces]) {
-    const definitions2 = asRecord2(bag);
-    if (definitions2 === undefined)
-      continue;
-    for (const [className, definition3] of Object.entries(definitions2)) {
-      const methodDef = asRecord2(asRecord2(asRecord2(definition3)?.methods)?.[method]);
-      if (methodDef === undefined)
-        continue;
-      matches3.push(Object.freeze({
-        path: path5,
-        origin,
-        class: className,
-        method,
-        dispatch,
-        ...callableFields(methodDef)
-      }));
-    }
-  }
-  return matches3;
-}
-function callableFields(value2) {
-  return {
-    ...typeof value2.description === "string" ? { description: value2.description } : {},
-    ...value2.auth === undefined ? {} : { auth: value2.auth },
-    ...value2.input === undefined ? {} : { input: value2.input },
-    ...value2.output === undefined ? {} : { output: value2.output }
-  };
-}
-function asRecord2(input) {
-  return input !== null && typeof input === "object" && !Array.isArray(input) ? input : undefined;
-}
-var init_call_describe = __esm(() => {
-  init_errors2();
-});
-
 // src/commands/call.ts
 var exports_call = {};
 __export(exports_call, {
@@ -90422,19 +90313,19 @@ async function callCommand(path5, rawParams, opts) {
   try {
     expanded = await expandSelfInCall(path5, rawParams, opts);
   } catch (error52) {
-    log.error(error52 instanceof Error ? error52.message : "Invalid @self expansion");
-    process.exit(1);
+    failClosed(error52, opts);
   }
   const expandedPath = expanded.path;
-  if (opts.describe) {
-    return describeOperation(expandedPath, opts);
+  try {
+    Path.parse(expandedPath);
+  } catch (error52) {
+    failClosed(error52, opts);
   }
   let params;
   try {
     params = await parseParams([...expanded.parameters], opts.data);
   } catch (e) {
-    log.error(e instanceof Error ? e.message : "Invalid params");
-    process.exit(1);
+    failClosed(e, opts);
   }
   if (opts.dryRun) {
     output({ method: expandedPath, params }, opts);
@@ -90469,24 +90360,6 @@ async function materializeCallResult(result) {
     values.push(value2);
   return Object.freeze({ kind: "stream", values: Object.freeze(values) });
 }
-async function describeOperation(path5, opts) {
-  await runKernelCommand({
-    opts,
-    label: `Schema for ${path5}`,
-    fn: async ({ graph }) => {
-      const parsed = Path.parse(path5);
-      if (parsed.ast.anchor.kind !== "domain") {
-        throw missingCallableDescription(path5);
-      }
-      const domain3 = await graph.getOrThrow(Path.parse(`/:${parsed.ast.anchor.origin}`));
-      const described = describeCallableFromSchema(parsed, nodeProperty(domain3, "schema"));
-      if (described === undefined)
-        throw missingCallableDescription(path5);
-      return described;
-    },
-    format: (schema2, fmtOpts) => output(schema2, fmtOpts)
-  });
-}
 async function parseParams(rawParams, dataFlag) {
   if (dataFlag) {
     if (rawParams.length > 0) {
@@ -90498,6 +90371,9 @@ async function parseParams(rawParams, dataFlag) {
       throw new Error(`Invalid JSON in --data: ${dataFlag}`);
     }
   }
+  if (rawParams.length > 0) {
+    return parseKeyValue(rawParams);
+  }
   const stdin = await readStdin();
   if (stdin) {
     try {
@@ -90506,9 +90382,6 @@ async function parseParams(rawParams, dataFlag) {
       throw new Error("Invalid JSON from stdin");
     }
   }
-  if (rawParams.length > 0) {
-    return parseKeyValue(rawParams);
-  }
   return {};
 }
 async function readStdin() {
@@ -90558,22 +90431,21 @@ var PARAM_KEY_RE, call_default;
 var init_call2 = __esm(() => {
   init_path5();
   init_connection2();
-  init_graph6();
   init_binary4();
   init_log();
   init_output();
-  init_call_describe();
   PARAM_KEY_RE = /^[A-Za-z_][A-Za-z0-9_-]*$/;
   call_default = {
     name: "call",
     description: "Call a kernel operation",
     afterHelpText: `
 Behavior:
-  Param priority (highest wins): --data > stdin > key=value > {}. If
+  Param priority (highest wins): --data > key=value > stdin > {}. If
   both --data and key=value are given, key=value is ignored (warned).
-  Stdin is read only when piped (ignored on a TTY). --describe and
-  --dry-run short-circuit (no execution). Remote-bound functions
-  auto-mint a worker-scoped credential; --creds overrides it.
+  Stdin is read only when piped and no --data/key=value is present
+  (ignored on a TTY). --dry-run admits the Path and prints the call
+  input without executing. Remote-bound functions auto-mint a
+  worker-scoped credential; --creds overrides it.
 
 Self-reference:
   @self expands to your nodeId on the active instance (path head or
@@ -90582,11 +90454,10 @@ Self-reference:
   (e.g. via 'astrale get @self --json'). Resolution authenticates to
   the selected Kernel and never trusts a local registration or JWT sub.
 
-  --describe reads the callable's input/output from the installed Domain
-  schema. Method Paths are not Function nodes.
+  Callable input/output lives on astrale introspect <path>.
 
 Examples:
-  $ astrale call /:host.astrale.ai:class.Manager:createInstance --describe
+  $ astrale introspect /:host.astrale.ai:class.Manager:createInstance
   $ astrale call /:blog.acme.com:class.Author:list limit=10
   $ astrale call '@self::deactivate'
   $ astrale call /:kernel.astrale.ai:function.journal --data '{"limit":5}' --json
@@ -90601,7 +90472,6 @@ Examples:
     options: [
       { flags: "-d, --data <json>", description: "Params as JSON string" },
       { flags: "-o, --output <file>", description: "Write binary/raw output to a file" },
-      { flags: "--describe", description: "Show operation schema without executing" },
       { flags: "--dry-run", description: "Show what would be sent without executing" }
     ],
     action: async (path5, params, opts) => {
@@ -90614,17 +90484,17 @@ Examples:
 var exports_token = {};
 __export(exports_token, {
   tokenCommand: () => tokenCommand,
+  parseTtl: () => parseTtl,
   default: () => token_default
 });
 async function tokenCommand(opts) {
   const commandOpts = opts.for && !opts.as ? { ...opts, as: opts.for } : opts;
+  const ttl = parseTtl(commandOpts.ttl);
   await runKernelCommand({
     opts: commandOpts,
     label: "Minting delegation token",
     fn: async (ctx) => {
       const audience = commandOpts.audience === undefined ? ctx.target.kernelIssuer : exports_issuer.accept(commandOpts.audience);
-      const parsedTtl = Number(commandOpts.ttl);
-      const ttl = Number.isFinite(parsedTtl) && parsedTtl > 0 ? parsedTtl : 3600;
       const self4 = await ctx.auth.whoami();
       return ctx.auth.delegate(self4.id, {
         audience,
@@ -90632,23 +90502,39 @@ async function tokenCommand(opts) {
         attenuation: { kind: "identity", self: true }
       });
     },
-    format: (token, fmtOpts, isRaw) => {
-      if (isRaw) {
-        process.stdout.write(token + `
-`);
+    format: (token, fmtOpts) => {
+      if (fmtOpts.json || fmtOpts.format !== undefined) {
+        output({ token, expiresAt: decodeJwtExpiration(token)?.expiresAt ?? null }, fmtOpts);
         return;
       }
-      log.dim("  (delegation token — ES256, self-identity)");
+      if (!fmtOpts.raw && (process.stdout.isTTY ?? false)) {
+        log.dim("  (delegation token — ES256, self-identity)");
+      }
       process.stdout.write(`${token}
 `);
     }
   });
 }
+function parseTtl(raw2) {
+  if (raw2 === undefined)
+    return 3600;
+  if (!/^\d+$/.test(raw2)) {
+    throw new AstraleError("INVALID_FLAG", `Invalid --ttl value "${raw2}" — expected a positive integer (seconds)`);
+  }
+  const value2 = Number.parseInt(raw2, 10);
+  if (!Number.isSafeInteger(value2) || value2 <= 0) {
+    throw new AstraleError("INVALID_FLAG", `Invalid --ttl value "${raw2}" — must be a positive integer`);
+  }
+  return value2;
+}
 var token_default;
 var init_token = __esm(() => {
   init_auth2();
   init_connection2();
+  init_errors2();
+  init_local_status();
   init_log();
+  init_output();
   token_default = {
     name: "token",
     description: "Mint a fresh delegation token for the active instance + identity",
@@ -90664,6 +90550,7 @@ Behavior:
 
 Examples:
   $ export TOKEN=$(astrale token --audience shell.astrale.ai --raw)
+  $ astrale token --json -i staging
   $ astrale token --audience worker.example.com --for alice -i staging
 `,
     options: [
@@ -90675,7 +90562,11 @@ Examples:
       { flags: "--for <identity>", description: "Mint the token for this identity (alias of --as)" }
     ],
     action: async (opts) => {
-      await tokenCommand(opts);
+      try {
+        await tokenCommand(opts);
+      } catch (error52) {
+        failClosed(error52, opts);
+      }
     }
   };
 });
@@ -90689,17 +90580,25 @@ __export(exports_get, {
 async function getCommand(target2, opts) {
   let path5;
   let meta3;
+  let parsed;
   try {
     ({ path: path5, meta: meta3 } = await expandSelfInPath(target2, opts));
+    parsed = Path.parse(path5);
   } catch (error52) {
     await formatKernelError(error52, isMachine(opts), undefined, opts.debug);
     process.exit(1);
   }
+  const last = parsed.ast.steps.at(-1);
+  if (last?.kind === "method") {
+    const error52 = new AstraleError("NOT_A_NODE", `${path5} is a callable Path, not a Node.`, `Use \`astrale call ${path5}\` or \`astrale introspect ${path5}\`.`);
+    await formatKernelError(error52, isMachine(opts), undefined, opts.debug);
+    process.exit(1);
+  }
   await runKernelCommand({
     opts,
     label: `Node ${path5}`,
-    fn: ({ graph }) => withSelfHint(() => graph.getOrThrow(Path.parse(path5)), meta3),
-    format: (node4, format3) => output(node4, format3)
+    fn: ({ graph }) => withSelfHint(() => graph.getOrThrow(parsed), meta3),
+    format: (node4, format3) => output(opts.schema === true ? node4 : denoise(node4), format3)
   });
 }
 var get_default;
@@ -90707,6 +90606,7 @@ var init_get = __esm(() => {
   init_path5();
   init_connection2();
   init_errors12();
+  init_errors2();
   init_output();
   get_default = {
     name: "get",
@@ -90718,19 +90618,141 @@ Behavior:
   intentionally indistinguishable. @self is expanded before dispatch.
 
   A Node does not contain a synthetic path, labels, or backend class ID.
-  Use astrale query for graph-shaped reads.
+  Method Paths are not Nodes — use call / introspect. Schema-valued
+  properties are omitted unless --schema is passed. Use query for
+  graph-shaped reads.
 
 Examples:
   $ astrale get /:notes.example.dev:class.Note
   $ astrale get @abc123 --json
   $ astrale get @self
+  $ astrale get /:host.astrale.ai --schema
 `,
     arguments: [{ name: "target", description: "Canonical Node Path or @id" }],
+    options: [{ flags: "--schema", description: "Include schema-valued properties" }],
     action: async (target2, opts) => {
       await getCommand(target2, opts);
     }
   };
 });
+// node_modules/.pnpm/@astrale-os+sdk@file+vendor+astrale-os-sdk-0.5.0-beta.1.tgz_@astrale-os+ox@0.1.2_oxfmt@_72b33f8043e5d121b8114f4a315f9796/node_modules/@astrale-os/sdk/dist/mutation/errors.js
+var UNKNOWN_OUTCOME_CODES;
+var init_errors14 = __esm(() => {
+  UNKNOWN_OUTCOME_CODES = new Set(["MUTATION_OUTCOME_UNKNOWN"]);
+});
+
+// node_modules/.pnpm/@astrale-os+sdk@file+vendor+astrale-os-sdk-0.5.0-beta.1.tgz_@astrale-os+ox@0.1.2_oxfmt@_72b33f8043e5d121b8114f4a315f9796/node_modules/@astrale-os/sdk/dist/mutation/rich.js
+var init_rich = __esm(() => {
+  init_class();
+  init_path4();
+  init_v1();
+});
+
+// node_modules/.pnpm/@astrale-os+sdk@file+vendor+astrale-os-sdk-0.5.0-beta.1.tgz_@astrale-os+ox@0.1.2_oxfmt@_72b33f8043e5d121b8114f4a315f9796/node_modules/@astrale-os/sdk/dist/mutation/execute.js
+var init_execute2 = __esm(() => {
+  init_mutate();
+  init_errors14();
+  init_rich();
+});
+
+// node_modules/.pnpm/@astrale-os+sdk@file+vendor+astrale-os-sdk-0.5.0-beta.1.tgz_@astrale-os+ox@0.1.2_oxfmt@_72b33f8043e5d121b8114f4a315f9796/node_modules/@astrale-os/sdk/dist/mutation/index.js
+var init_mutation2 = __esm(() => {
+  init_execute2();
+  init_mutate();
+});
+
+// src/graph/mutation.ts
+function prepareMutation(input) {
+  if (isLegacyPatchData(input)) {
+    throw new TypeError("Legacy PatchData { nodes, edges } is not Mutation V3. Author { preconditions, operations } or a canonical astrale.graph.mutation/v3 document.");
+  }
+  if (hasEmptyOperations(input)) {
+    throw new TypeError("Mutation V3 requires at least one operation");
+  }
+  if (isCanonicalCandidate(input))
+    return MutationAST.decode(input);
+  return MutationAST.create(input);
+}
+function hasEmptyOperations(input) {
+  return input !== null && typeof input === "object" && !Array.isArray(input) && Array.isArray(input.operations) && input.operations.length === 0;
+}
+function isCanonicalCandidate(input) {
+  return input !== null && typeof input === "object" && !Array.isArray(input) && (Object.hasOwn(input, "format") || Object.hasOwn(input, "version"));
+}
+function isLegacyPatchData(input) {
+  return input !== null && typeof input === "object" && !Array.isArray(input) && !Object.hasOwn(input, "operations") && (Object.hasOwn(input, "nodes") || Object.hasOwn(input, "edges"));
+}
+var init_mutation3 = __esm(() => {
+  init_mutation2();
+});
+// src/graph/query.ts
+function prepareQuery(input) {
+  const limit = positiveInteger2(input.limit, "--limit", DEFAULT_LIMIT);
+  if (input.ast !== undefined) {
+    if (input.sources.length > 0 || input.definition !== undefined || input.edge !== undefined || input.direction !== undefined) {
+      throw new TypeError("--ast/--file cannot be combined with sources, --definition, --edge, or --direction");
+    }
+    return withPage(QueryAST.decode(input.ast), limit, input.cursor);
+  }
+  if (input.sources.length === 0 && input.definition === undefined) {
+    throw new TypeError("query requires a Path source, --definition, or a canonical Query V6 document");
+  }
+  if (input.direction !== undefined && input.edge === undefined) {
+    throw new TypeError("--direction requires --edge");
+  }
+  const paths4 = input.sources.map((source2) => Path.parse(source2));
+  const definition3 = input.definition === undefined ? undefined : definitionRef(input.definition);
+  const query3 = paths4.length > 0 ? Query2.from({
+    kind: "node",
+    paths: paths4,
+    ...definition3 === undefined ? {} : { definitions: [definition3] }
+  }) : Query2.from({ kind: "node", definitions: [definition3] });
+  const ast = input.edge === undefined ? query3.select({ kind: "graph" }) : query3.expand({
+    via: [definitionRef(input.edge)],
+    direction: input.direction ?? "outgoing"
+  }).select({ kind: "graph" });
+  return withPage(ast, limit, input.cursor);
+}
+function definitionRef(input) {
+  const path5 = Path.parse(input);
+  const step = path5.ast.steps[0];
+  if (path5.ast.anchor.kind !== "domain" || path5.ast.steps.length !== 1 || step?.kind !== "projection" || step.projection.kind !== "class" && step.projection.kind !== "interface") {
+    throw new TypeError("--definition must be one canonical Class or Interface Path");
+  }
+  return Object.freeze({
+    origin: path5.ast.anchor.origin,
+    kind: step.projection.kind,
+    name: step.projection.name
+  });
+}
+function positiveInteger2(raw2, name, fallback) {
+  if (raw2 === undefined)
+    return fallback;
+  if (!/^\d+$/.test(raw2))
+    throw new TypeError(`${name} must be a positive integer`);
+  const value2 = Number.parseInt(raw2, 10);
+  if (!Number.isSafeInteger(value2) || value2 <= 0) {
+    throw new TypeError(`${name} must be a positive integer`);
+  }
+  return value2;
+}
+function withPage(ast, size, cursor) {
+  return Object.freeze({
+    ast,
+    page: Object.freeze({ size, ...cursor === undefined ? {} : { after: cursor } })
+  });
+}
+var DEFAULT_LIMIT = 100;
+var init_query6 = __esm(() => {
+  init_path5();
+  init_query4();
+});
+
+// src/graph/index.ts
+var init_graph6 = __esm(() => {
+  init_mutation3();
+  init_query6();
+});
 
 // src/commands/mutate.ts
 var exports_mutate = {};
@@ -90744,8 +90766,7 @@ async function mutateCommand(opts) {
   try {
     mutation = prepareMutation(await readDocument(opts));
   } catch (error52) {
-    log.error(error52 instanceof Error ? error52.message : "Invalid Mutation V3 document");
-    process.exit(1);
+    failClosed(error52, opts);
   }
   if (opts.dry) {
     output(mutation, opts);
@@ -90882,15 +90903,13 @@ async function queryCommand(sources2, opts) {
       };
     }
   } catch (error52) {
-    log.error(error52 instanceof Error ? error52.message : "Invalid query");
-    process.exit(1);
+    failClosed(error52, opts);
   }
   let prepared;
   try {
     prepared = prepareQuery(input);
   } catch (error52) {
-    log.error(error52 instanceof Error ? error52.message : "Invalid Query V6 document");
-    process.exit(1);
+    failClosed(error52, opts);
   }
   await runKernelCommand({
     opts,
@@ -90977,6 +90996,208 @@ Examples:
   };
 });
 
+// src/commands/call-describe.ts
+function describeCallableFromSchema(path5, schema2) {
+  if (path5.ast.anchor.kind !== "domain")
+    return;
+  const origin = path5.ast.anchor.origin;
+  const last = path5.ast.steps.at(-1);
+  const document = asRecord2(schema2);
+  if (document === undefined || last === undefined)
+    return;
+  if (last.kind === "method") {
+    const owner = path5.ast.steps.at(-2);
+    if (owner?.kind === "projection" && (owner.projection.kind === "class" || owner.projection.kind === "interface")) {
+      const bag = asRecord2(owner.projection.kind === "class" ? document.classes : document.interfaces);
+      const definition3 = asRecord2(bag?.[owner.projection.name]);
+      const method = asRecord2(asRecord2(definition3?.methods)?.[last.name]);
+      if (method !== undefined) {
+        return Object.freeze({
+          path: path5.raw,
+          origin,
+          class: owner.projection.name,
+          method: last.name,
+          dispatch: last.dispatch,
+          ...callableFields(method)
+        });
+      }
+    }
+    const matches3 = findNamedMethods(document, origin, path5.raw, last.name, last.dispatch);
+    if (matches3.length === 1)
+      return matches3[0];
+    if (matches3.length > 1) {
+      return Object.freeze({
+        path: path5.raw,
+        origin,
+        method: last.name,
+        dispatch: last.dispatch,
+        candidates: Object.freeze(matches3)
+      });
+    }
+    return;
+  }
+  if (last.kind === "projection" && last.projection.kind === "function") {
+    const fn2 = asRecord2(asRecord2(document.functions)?.[last.projection.name]);
+    if (fn2 === undefined)
+      return;
+    return Object.freeze({
+      path: path5.raw,
+      origin,
+      function: last.projection.name,
+      ...callableFields(fn2)
+    });
+  }
+  return;
+}
+function missingCallableDescription(path5) {
+  return new AstraleError("CALL_DESCRIBE_UNAVAILABLE", `No callable schema is installed for ${path5}.`, "Use a Domain-rooted Path such as /:host.astrale.ai:class.Manager:createInstance. Method Paths are not Function nodes.");
+}
+function findNamedMethods(schema2, origin, path5, method, dispatch) {
+  const matches3 = [];
+  for (const bag of [schema2.classes, schema2.interfaces]) {
+    const definitions2 = asRecord2(bag);
+    if (definitions2 === undefined)
+      continue;
+    for (const [className, definition3] of Object.entries(definitions2)) {
+      const methodDef = asRecord2(asRecord2(asRecord2(definition3)?.methods)?.[method]);
+      if (methodDef === undefined)
+        continue;
+      matches3.push(Object.freeze({
+        path: path5,
+        origin,
+        class: className,
+        method,
+        dispatch,
+        ...callableFields(methodDef)
+      }));
+    }
+  }
+  return matches3;
+}
+function callableFields(value2) {
+  return {
+    ...typeof value2.description === "string" ? { description: value2.description } : {},
+    ...value2.auth === undefined ? {} : { auth: value2.auth },
+    ...value2.input === undefined ? {} : { input: value2.input },
+    ...value2.output === undefined ? {} : { output: value2.output }
+  };
+}
+function asRecord2(input) {
+  return input !== null && typeof input === "object" && !Array.isArray(input) ? input : undefined;
+}
+var init_call_describe = __esm(() => {
+  init_errors2();
+});
+
+// src/commands/introspect.ts
+var exports_introspect = {};
+__export(exports_introspect, {
+  parseIntrospectTarget: () => parseIntrospectTarget,
+  introspectCommand: () => introspectCommand,
+  default: () => introspect_default
+});
+async function introspectCommand(target2, opts) {
+  let origin;
+  let path5;
+  try {
+    ({ origin, path: path5 } = parseIntrospectTarget(target2));
+  } catch (error52) {
+    failClosed(error52, opts);
+  }
+  const wantsCallable = isCallablePath(path5);
+  await runKernelCommand({
+    opts,
+    label: `Introspect ${origin}`,
+    fn: async ({ session }) => {
+      const includeBundle = wantsCallable || opts.bundle === true;
+      const result = await session.schema.introspect({
+        from: { kind: "installation", origin },
+        select: {
+          state: true,
+          target: true,
+          source: true,
+          readiness: true,
+          capabilities: true,
+          ...includeBundle ? { bundle: true } : {}
+        }
+      });
+      if (result === null) {
+        throw new AstraleError("DOMAIN_NOT_INSTALLED", `Domain ${origin} is not installed on this Kernel.`);
+      }
+      if (wantsCallable) {
+        const described = describeCallableFromSchema(path5, bundleRoot(result.bundle));
+        if (described === undefined)
+          throw missingCallableDescription(path5.raw);
+        return described;
+      }
+      return result;
+    },
+    format: (value2, format3) => output(value2, format3)
+  });
+}
+function parseIntrospectTarget(target2) {
+  if (target2.startsWith("@")) {
+    throw new AstraleError("NOT_A_DOMAIN", "introspect requires a Domain origin or Path, not an @id.", "Example: astrale introspect host.astrale.ai  or  /:host.astrale.ai:class.Manager:createInstance");
+  }
+  const raw2 = target2.startsWith("/") ? target2 : `/:${target2}`;
+  let path5;
+  try {
+    path5 = Path.parse(raw2);
+  } catch (error52) {
+    throw new AstraleError("PATH_INVALID", error52 instanceof Error ? error52.message : "Invalid introspect target");
+  }
+  if (path5.ast.anchor.kind !== "domain") {
+    throw new AstraleError("NOT_A_DOMAIN", "introspect requires a Domain-rooted Path or origin.");
+  }
+  return { origin: path5.ast.anchor.origin, path: path5 };
+}
+function isCallablePath(path5) {
+  const last = path5.ast.steps.at(-1);
+  if (last === undefined)
+    return false;
+  if (last.kind === "method")
+    return true;
+  return last.kind === "projection" && last.projection.kind === "function";
+}
+function bundleRoot(bundle) {
+  if (bundle !== null && typeof bundle === "object" && "root" in bundle) {
+    return bundle.root;
+  }
+  return bundle;
+}
+var introspect_default;
+var init_introspect3 = __esm(() => {
+  init_path5();
+  init_connection2();
+  init_errors2();
+  init_log();
+  init_output();
+  init_call_describe();
+  introspect_default = {
+    name: "introspect",
+    description: "Read installed Domain schema from the Kernel Schema syscall",
+    afterHelpText: `
+Behavior:
+  Calls the public Kernel introspect syscall for one installed Domain.
+  A bare origin (host.astrale.ai or /:host.astrale.ai) prints installation
+  state, target, source, readiness, and capabilities. --bundle includes the
+  schema bundle. A method or Function Path projects that callable's
+  input/output from the installed bundle.
+
+Examples:
+  $ astrale introspect host.astrale.ai
+  $ astrale introspect /:host.astrale.ai --bundle
+  $ astrale introspect /:host.astrale.ai:class.Manager:createInstance
+  $ astrale introspect /:kernel.astrale.ai:function.journal
+`,
+    arguments: [{ name: "target", description: "Domain origin or canonical Path" }],
+    options: [{ flags: "--bundle", description: "Include the installed schema bundle" }],
+    action: async (target2, opts) => {
+      await introspectCommand(target2, opts);
+    }
+  };
+});
+
 // node_modules/.pnpm/@astrale-os+sdk@file+vendor+astrale-os-sdk-0.5.0-beta.1.tgz_@astrale-os+ox@0.1.2_oxfmt@_72b33f8043e5d121b8114f4a315f9796/node_modules/@astrale-os/sdk/dist/schema/kernel/index.js
 var init_kernel2 = __esm(() => {
   init_schema7();
@@ -90992,6 +91213,11 @@ __export(exports_logs, {
 function buildJournalInput(opts) {
   const exact10 = nonEmpty4(opts.topic);
   const prefix = nonEmpty4(opts.topicPrefix);
+  const since = timestampFlag("--since", opts.since);
+  const until = timestampFlag("--until", opts.until);
+  if (since !== undefined && until !== undefined && Date.parse(since) > Date.parse(until)) {
+    throw new TypeError("--since must be earlier than or equal to --until");
+  }
   return {
     ...exact10 === undefined && prefix === undefined ? {} : {
       topics: {
@@ -91000,12 +91226,28 @@ function buildJournalInput(opts) {
       }
     },
     ...nonEmpty4(opts.principal) === undefined ? {} : { principal: opts.principal },
-    ...nonEmpty4(opts.since) === undefined ? {} : { since: opts.since },
-    ...nonEmpty4(opts.until) === undefined ? {} : { until: opts.until },
-    ...nonEmpty4(opts.cursor) === undefined ? {} : { cursor: opts.cursor },
+    ...since === undefined ? {} : { since },
+    ...until === undefined ? {} : { until },
+    ...opts.cursor === undefined ? {} : { cursor: cursorFlag(opts.cursor) },
     limit: opts.limit === undefined ? DEFAULT_LIMIT2 : positiveInteger3("--limit", opts.limit)
   };
 }
+function timestampFlag(name, raw2) {
+  const value2 = nonEmpty4(raw2);
+  if (value2 === undefined)
+    return;
+  if (!ISO_TIMESTAMP.test(value2) || Number.isNaN(Date.parse(value2))) {
+    throw new TypeError(`${name} must be an ISO-8601 timestamp (e.g. 2026-08-19T16:51:10.049Z)`);
+  }
+  return value2;
+}
+function cursorFlag(raw2) {
+  const value2 = raw2.trim();
+  if (!CURSOR_TOKEN.test(value2)) {
+    throw new TypeError("--cursor must be an opaque journal resume token (at least 8 characters)");
+  }
+  return value2;
+}
 function acceptJournalPage(input) {
   if (!isRecord8(input) || !Array.isArray(input.records)) {
     throw new TypeError("Kernel journal response must contain a records array");
@@ -91114,6 +91356,14 @@ function positiveInteger3(flag, raw2) {
   }
   return value2;
 }
+async function prepareLogsOpts(opts) {
+  buildJournalInput(opts);
+  const principal = nonEmpty4(opts.principal);
+  if (principal !== "@self")
+    return opts;
+  const { path: path5 } = await expandSelfInPath("@self", opts);
+  return { ...opts, principal: path5.startsWith("@") ? path5.slice(1) : path5 };
+}
 function nonEmpty4(input) {
   const value2 = input?.trim();
   return value2 ? value2 : undefined;
@@ -91121,14 +91371,17 @@ function nonEmpty4(input) {
 function isRecord8(input) {
   return input !== null && typeof input === "object" && !Array.isArray(input);
 }
-var JOURNAL_PATH, DEFAULT_LIMIT2 = 200, FOLLOW_INTERVAL_MS = 2000, logs_default;
+var JOURNAL_PATH, DEFAULT_LIMIT2 = 200, FOLLOW_INTERVAL_MS = 2000, ISO_TIMESTAMP, CURSOR_TOKEN, logs_default;
 var init_logs = __esm(() => {
   init_path5();
   init_kernel2();
   init_source();
   init_connection2();
+  init_log();
   init_output();
   JOURNAL_PATH = Path.project(exports_syscalls.journal.ref).raw;
+  ISO_TIMESTAMP = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/;
+  CURSOR_TOKEN = /^[A-Za-z0-9._:+=/-]{8,}$/;
   logs_default = {
     name: "logs",
     description: "Read or follow the authorized Kernel journal",
@@ -91158,10 +91411,15 @@ Examples:
       { flags: "--follow", description: "Poll using returned cursors until interrupted" }
     ],
     action: async (opts) => {
-      if (opts.follow)
-        await follow(opts);
-      else
-        await runOnce(opts);
+      try {
+        const prepared = await prepareLogsOpts(opts);
+        if (prepared.follow)
+          await follow(prepared);
+        else
+          await runOnce(prepared);
+      } catch (error52) {
+        failClosed(error52, opts);
+      }
     }
   };
 });
@@ -92043,10 +92301,11 @@ What it does:
   an audience-bound credential for shell mounts, and the kernel endpoint.
 
 Examples:
-  $ astrale view /crm/customers/ada                      # views on a node
-  $ astrale view /:crm.acme.dev:view.dashboard           # explicit ViewPath
+  $ astrale view @customer
+  $ astrale view /:crm.example.dev:view.dashboard
   $ astrale view /:agents.astrale.ai:view.agent --target @f00d1234 --as alice
-  $ astrale view /crm/customers/ada --snapshot           # open + show it
+  $ astrale view @customer --snapshot
+  $ astrale view --list
   $ astrale view --sessions ; astrale view --close --all
 `,
     action: async (spec, opts) => {
@@ -92054,6 +92313,8 @@ Examples:
         return closeCommand(opts);
       if (opts.sessions)
         return sessionsCommand(opts);
+      if (opts.list && !spec)
+        return sessionsCommand(opts);
       rejectUnrepresentableOverrides(opts);
       if (!spec)
         return fatal(new Error("Nothing to open — pass a ViewPath or target node."));
@@ -93959,6 +94220,7 @@ var create_default2;
 var init_create3 = __esm(() => {
   init_identity8();
   init_log();
+  init_output();
   create_default2 = {
     name: "create",
     description: "Create a new identity",
@@ -93966,15 +94228,20 @@ var init_create3 = __esm(() => {
     options: [
       { flags: "--subject <sub>", description: "Custom subject (defaults to name)" },
       { flags: "--local", description: "Local-only identity (default)" },
-      { flags: "--remote", description: "Remote (cloud-synced) identity — requires cloud login" }
+      { flags: "--remote", description: "Remote (cloud-synced) identity — requires cloud login" },
+      ...RAW_OUTPUT_OPTIONS
     ],
     action: async (name, opts) => {
       try {
         const mode = opts.remote ? "remote" : "local";
         const identity3 = await createIdentity(name, { subject: opts.subject, mode });
+        if (isMachine(opts)) {
+          output({ name, ...identity3 }, opts);
+          return;
+        }
         log.success(`Created identity "${name}" (subject: ${identity3.subject}, mode: ${identity3.mode})`);
       } catch (e) {
-        fatal(e);
+        fatal(e, opts);
       }
     }
   };
@@ -94207,16 +94474,22 @@ var use_default4;
 var init_use4 = __esm(() => {
   init_identity8();
   init_log();
+  init_output();
   use_default4 = {
     name: "use",
     description: "Set the active CLI identity",
     arguments: [{ name: "name", description: "Identity name", required: true }],
-    action: async (name) => {
+    options: [...RAW_OUTPUT_OPTIONS],
+    action: async (name, opts) => {
       try {
         await setDefault(name);
+        if (isMachine(opts)) {
+          output({ default: name }, opts);
+          return;
+        }
         log.success(`Active identity set to "${name}"`);
       } catch (e) {
-        fatal(e);
+        fatal(e, opts);
       }
     }
   };
@@ -94231,16 +94504,22 @@ var delete_default2;
 var init_delete2 = __esm(() => {
   init_identity8();
   init_log();
+  init_output();
   delete_default2 = {
     name: "delete",
     description: "Delete an identity",
     arguments: [{ name: "name", description: "Identity name", required: true }],
-    action: async (name) => {
+    options: [...RAW_OUTPUT_OPTIONS],
+    action: async (name, opts) => {
       try {
         await deleteIdentity(name);
+        if (isMachine(opts)) {
+          output({ deleted: name }, opts);
+          return;
+        }
         log.success(`Deleted identity "${name}"`);
       } catch (e) {
-        fatal(e);
+        fatal(e, opts);
       }
     }
   };
@@ -94255,6 +94534,7 @@ var sync_default;
 var init_sync = __esm(() => {
   init_identity8();
   init_log();
+  init_output();
   sync_default = {
     name: "sync",
     description: "Migrate an identity local → remote (astrale cloud)",
@@ -94263,7 +94543,8 @@ var init_sync = __esm(() => {
       {
         flags: "--force",
         description: "Tag as remote in the local registry even without cloud login"
-      }
+      },
+      ...RAW_OUTPUT_OPTIONS
     ],
     action: async (name, opts) => {
       try {
@@ -94272,10 +94553,14 @@ var init_sync = __esm(() => {
           fatalNotImplemented("identity sync (remote)", "Cloud adapter is stubbed in v1. Use --force to pre-tag the identity locally.");
         }
         await setIdentityMode(name, "remote");
+        if (isMachine(opts)) {
+          output({ name, mode: "remote", subject: identity3.subject }, opts);
+          return;
+        }
         log.warn(`Tagged "${name}" as remote locally (cloud sync stubbed in v1)`);
         log.dim(`  subject=${identity3.subject}`);
       } catch (e) {
-        fatal(e);
+        fatal(e, opts);
       }
     }
   };
@@ -94290,21 +94575,31 @@ var unsync_default;
 var init_unsync = __esm(() => {
   init_identity8();
   init_log();
+  init_output();
   unsync_default = {
     name: "unsync",
     description: "Migrate an identity remote → local",
     arguments: [{ name: "name", description: "Identity name", required: true }],
-    action: async (name) => {
+    options: [...RAW_OUTPUT_OPTIONS],
+    action: async (name, opts) => {
       try {
         const identity3 = await getIdentity(name);
         if (identity3.mode !== "remote") {
+          if (isMachine(opts)) {
+            output({ name, mode: identity3.mode ?? "local", unchanged: true }, opts);
+            return;
+          }
           log.warn(`Identity "${name}" is already ${identity3.mode ?? "local"}`);
           return;
         }
         await setIdentityMode(name, "local");
+        if (isMachine(opts)) {
+          output({ name, mode: "local" }, opts);
+          return;
+        }
         log.success(`Identity "${name}" → local`);
       } catch (e) {
-        fatal(e);
+        fatal(e, opts);
       }
     }
   };
@@ -94319,6 +94614,7 @@ var export_default;
 var init_export2 = __esm(() => {
   init_identity8();
   init_log();
+  init_output();
   init_prompt();
   export_default = {
     name: "export",
@@ -94328,19 +94624,24 @@ var init_export2 = __esm(() => {
       { name: "path", description: "Output file path", required: true }
     ],
     options: [
-      { flags: "--encrypt", description: "Encrypt the envelope with a passphrase (JOSE JWE)" }
+      { flags: "--encrypt", description: "Encrypt the envelope with a passphrase (JOSE JWE)" },
+      ...RAW_OUTPUT_OPTIONS
     ],
     action: async (name, path5, opts) => {
       try {
         const envelope2 = await exportIdentity(name);
         const passphrase = opts.encrypt ? await readPassphrase("Passphrase (min 8 chars): ", { minLength: 8 }) : undefined;
         await writeIdentityExport(path5, await encodeIdentityExport(envelope2, passphrase));
+        if (isMachine(opts)) {
+          output({ name, path: path5, encrypted: Boolean(opts.encrypt) }, opts);
+          return;
+        }
         log.success(`Exported identity "${name}" → ${path5}${opts.encrypt ? " (encrypted)" : ""}`);
         if (!opts.encrypt) {
           log.warn("  Plaintext private JWK — keep this file secure. Use --encrypt for passphrase wrapping.");
         }
       } catch (e) {
-        fatal(e);
+        fatal(e, opts);
       }
     }
   };
@@ -94356,6 +94657,7 @@ var import_default;
 var init_import2 = __esm(() => {
   init_identity8();
   init_log();
+  init_output();
   init_prompt();
   import_default = {
     name: "import",
@@ -94373,7 +94675,8 @@ var init_import2 = __esm(() => {
       {
         flags: "--replace",
         description: "Replace an existing key-backed identity with the imported keypair"
-      }
+      },
+      ...RAW_OUTPUT_OPTIONS
     ],
     action: async (path5, opts) => {
       try {
@@ -94386,9 +94689,13 @@ var init_import2 = __esm(() => {
           issuer: opts.issuer,
           replace: opts.replace
         });
+        if (isMachine(opts)) {
+          output({ name, ...identity3 }, opts);
+          return;
+        }
         log.success(`Imported identity "${name}" (subject=${identity3.subject}, kid=${identity3.kid ?? "?"})`);
       } catch (e) {
-        fatal(e);
+        fatal(e, opts);
       }
     }
   };
@@ -94508,10 +94815,10 @@ async function resolveIdentityName(opts) {
   if (opts.name) {
     const identity4 = await getIdentity(opts.name);
     if ((identity4.source ?? "key") !== "idp") {
-      throw new Error(`Identity "${opts.name}" is not IdP-backed`);
+      throw new AstraleError("AUTH_ERROR", `Identity "${opts.name}" is not IdP-backed`);
     }
     if (opts.idp && identity4.idp !== opts.idp) {
-      throw new Error(`Identity "${opts.name}" is backed by IdP "${identity4.idp ?? "?"}", not "${opts.idp}"`);
+      throw new AstraleError("AUTH_ERROR", `Identity "${opts.name}" is backed by IdP "${identity4.idp ?? "?"}", not "${opts.idp}"`);
     }
     return opts.name;
   }
@@ -94519,17 +94826,17 @@ async function resolveIdentityName(opts) {
     const store = await readIdentities();
     const matches3 = Object.entries(store.identities).filter(([, identity4]) => identity4.source === "idp" && identity4.idp === opts.idp).map(([name]) => name);
     if (matches3.length === 0) {
-      throw new Error(`No IdP-backed identities found for IdP "${opts.idp}". Run: astrale auth login --idp ${opts.idp}`);
+      throw new AstraleError("AUTH_ERROR", `No IdP-backed identities found for IdP "${opts.idp}". Run: astrale auth login --idp ${opts.idp}`);
     }
     if (matches3.includes(store.default))
       return store.default;
     if (matches3.length === 1)
       return matches3[0];
-    throw new Error(`Multiple IdP-backed identities found for IdP "${opts.idp}": ${matches3.join(", ")}. Pass --name.`);
+    throw new AstraleError("AUTH_ERROR", `Multiple IdP-backed identities found for IdP "${opts.idp}": ${matches3.join(", ")}. Pass --name.`);
   }
   const identity3 = await getDefault();
   if ((identity3.source ?? "key") !== "idp") {
-    throw new Error("Default identity is not IdP-backed. Pass --name or --idp.");
+    throw new AstraleError("AUTH_ERROR", "Default identity is not IdP-backed. Pass --name or --idp.");
   }
   return identity3.name;
 }
@@ -94542,6 +94849,7 @@ function tokenFromSession(session, type) {
 }
 var token_default2;
 var init_token2 = __esm(() => {
+  init_errors2();
   init_identity8();
   init_idp();
   init_idp_session();
@@ -94581,7 +94889,12 @@ Examples:
   $ astrale auth token --name alice --type id --json
 `,
     action: async (opts) => {
-      const result = await resolveAuthToken(opts);
+      let result;
+      try {
+        result = await resolveAuthToken(opts);
+      } catch (error52) {
+        fatal(error52, opts);
+      }
       if (opts.raw) {
         process.stdout.write(result.token + `
 `);
@@ -95665,6 +95978,7 @@ var {
 
 // src/lib/command-dx.ts
 init_source();
+init_output();
 function collectCommandCatalog(program2) {
   const out = [];
   function walk(command, path) {
@@ -95684,36 +95998,36 @@ function renderCommanderError(program2, error, argv = process.argv.slice(2)) {
   const catalog = collectCommandCatalog(program2);
   const matched = matchRegisteredPrefix(program2, tokens);
   if (matched.path.length === 0 && tokens.length > 0) {
-    return renderUnknownCommand(tokens, catalog);
+    return maybeMachine(renderUnknownCommand(tokens, catalog));
   }
   if (error.code === "commander.missingArgument") {
     const usage = usageFor(matched.path, matched.command);
     const argName = error.message.match(/'([^']+)'/)?.[1];
-    return [
+    return maybeMachine([
       `Missing required argument${argName ? ` ${source_default.bold(`<${argName}>`)}` : ""} for ${source_default.bold(`astrale ${matched.path.join(" ")}`)}`,
       "",
       "Usage:",
       `  astrale ${usage}`
     ].join(`
-`);
+`));
   }
   if (error.code === "commander.excessArguments") {
     const usage = usageFor(matched.path, matched.command);
     const extra = tokens.slice(matched.path.length).join(" ");
-    return [
+    return maybeMachine([
       `Unexpected argument${extra.includes(" ") ? "s" : ""} for ${source_default.bold(`astrale ${matched.path.join(" ")}`)}${extra ? `: ${extra}` : ""}`,
       "",
       "Usage:",
       `  astrale ${usage}`
     ].join(`
-`);
+`));
   }
   const suggestions = nearestCommands(tokens.join(" "), catalog);
-  return [
+  return maybeMachine([
     error.message,
     ...suggestions.length > 0 ? ["", "Did you mean:", ...suggestions.map((s) => `  astrale ${s}`)] : []
   ].join(`
-`);
+`));
 }
 var RETIRED_COMMANDS = {
   ls: "astrale query <source> --edge <class>",
@@ -95764,6 +96078,15 @@ function usageFor(path, command) {
   const suffix = command.usage().replace(/\[options\]\s*/g, "").replace(/\s+/g, " ").trim();
   return [path.join(" "), suffix].filter(Boolean).join(" ");
 }
+var ANSI_RE = new RegExp(String.fromCharCode(27) + "\\[[0-9;]*m", "g");
+function maybeMachine(text) {
+  if (!isMachine())
+    return text;
+  const plain = text.replace(ANSI_RE, "");
+  const first = plain.split(`
+`).find((line) => line.trim().length > 0) ?? plain;
+  return JSON.stringify({ error: "USAGE_ERROR", message: first, detail: plain });
+}
 function stripOptions(argv) {
   const out = [];
   for (const token of argv) {
@@ -95800,6 +96123,12 @@ function levenshtein(a, b) {
   return prev[b.length] ?? 0;
 }
 
+// src/lib/invocation.ts
+var argvMachine2 = false;
+function configureInvocation(argv) {
+  argvMachine2 = argv.some((token) => token === "--json" || token === "--raw" || token === "--ci");
+}
+
 // node_modules/.pnpm/commander@13.1.0/node_modules/commander/esm.mjs
 var import__2 = __toESM(require_commander(), 1);
 var {
@@ -95835,7 +96164,7 @@ var KERNEL_PASSTHROUGH_OPTIONS = Object.freeze([
   { flags: "--creds <token>", description: "Use a pre-signed credential (e.g. delegation token)" },
   {
     flags: "--anonymous",
-    description: "Send no credential (cannot be combined with --as or --creds)"
+    description: "Send no credential (cannot be combined with --as or --creds; --as and --creds are mutually exclusive)"
   },
   { flags: "--debug", description: "Print full error diagnostics on failure" }
 ]);
@@ -95906,7 +96235,7 @@ function registerGroup(parent, group) {
 // src/program/build.ts
 async function buildProgram() {
   const program3 = new Command2;
-  program3.name("astrale").description("Astrale CLI — connect to existing Astrale kernels").version(package_default.version).showSuggestionAfterError(true).addOption(new Option2("--ci", "Machine mode: no prompts, structured errors on stderr")).addOption(new Option2("--no-prompt", "Disable interactive prompts")).addOption(new Option2("--offline-ok", "Tolerate offline state for commands that can operate locally")).addOption(new Option2("--log-level <level>", "Log level").choices(["debug", "info", "warn", "error"])).addOption(new Option2("--log-format <format>", "Log output format").choices(["text", "json"])).action(async () => {
+  program3.name("astrale").description("Astrale CLI — connect to existing Astrale kernels").version(package_default.version).showSuggestionAfterError(true).addOption(new Option2("--ci", "Machine mode: no prompts, structured errors on stderr")).addOption(new Option2("--no-prompt", "Disable interactive prompts")).action(async () => {
     if (process.stdin.isTTY && process.stdout.isTTY) {
       const { shouldAutostartSetup: shouldAutostartSetup2 } = await Promise.resolve().then(() => (init_engine(), exports_engine));
       if (await shouldAutostartSetup2()) {
@@ -95931,6 +96260,7 @@ async function buildProgram() {
   registerCommand(program3, withKernelOptions((await Promise.resolve().then(() => (init_get(), exports_get))).default));
   registerCommand(program3, withKernelOptions((await Promise.resolve().then(() => (init_mutate4(), exports_mutate))).default));
   registerCommand(program3, withKernelOptions((await Promise.resolve().then(() => (init_query7(), exports_query))).default));
+  registerCommand(program3, withKernelOptions((await Promise.resolve().then(() => (init_introspect3(), exports_introspect))).default));
   registerCommand(program3, withKernelOptions((await Promise.resolve().then(() => (init_logs(), exports_logs))).default));
   registerCommand(program3, withKernelOptions((await Promise.resolve().then(() => (init_view6(), exports_view2))).default));
   registerCommand(program3, (await Promise.resolve().then(() => (init_status(), exports_status))).default);
@@ -96016,7 +96346,7 @@ async function buildProgram() {
   program3.addHelpText("after", `
 Command groups:
   Getting started  setup     (sign in, pick an instance, equip your workspace)
-  Kernel        get, mutate, call, query, token
+  Kernel        get, mutate, call, query, introspect, logs, view, token
   Management    admin, instance, domain, identity, auth, idp, update
   Agent         browser   (drive the GUI via agent-browser)
   Studio        studio    (launch the local Domain Studio GUI for a workspace)
@@ -96038,6 +96368,7 @@ Examples:
   $ astrale instance status staging
   $ astrale token --audience shell.astrale.ai --ttl 3600
   $ astrale query /:notes.example.dev:class.Note --limit 50
+  $ astrale introspect /:host.astrale.ai:class.Manager:createInstance
   $ astrale query --file query.v6.json --cursor "$CURSOR"
 `);
   return program3;
@@ -96279,6 +96610,7 @@ var errorName;
 if (finalize2)
   process.on("exit", (code) => finalize2(code ?? 0, errorName));
 maybeTriggerAnalysis(process.argv);
+configureInvocation(process.argv);
 var program3 = await buildProgram();
 overrideExits(program3);
 program3.configureOutput({ writeErr: () => {