@astrale-os/cli 0.8.1-alpha.5 → 0.8.1-alpha.7

package/dist/types/connection/auth.d.ts

@@ -1,5 +1,7 @@
 import type { AstraleConfig } from '../lib/config';
 import { type Identity } from '../identity/registry';
+import { IdpAudienceMismatchError } from '../lib/idp';
+import { IdpSessionNoRefreshTokenError } from '../lib/idp-session';
 export type KeyIdentityAuthOptions = {
     issuer: string;
     subject?: string;
@@ -23,6 +25,7 @@ export declare function resolveCredential(opts: {
     defaultIdentity?: string;
 }, config: AstraleConfig, audience?: string, registrationKey?: string): Promise<string>;
 export declare function resolveKeyIdentityAuthOptions(identity: Identity, config: AstraleConfig, audience?: string, registrationKey?: string): KeyIdentityAuthOptions;
+export declare function classifyNoRefreshTokenError(requestedAudience: string, sourceAudience: string | undefined, error: IdpSessionNoRefreshTokenError): IdpSessionNoRefreshTokenError | IdpAudienceMismatchError;
 /** A refresh attempt failed for a reason that re-login will NOT fix. */
 export declare class IdpRefreshTransientError extends Error {
     constructor(message: string);

package/dist/types/lib/instance-target.d.ts

@@ -33,4 +33,6 @@ export type ResolveInstanceTargetOpts = {
 export declare function resolveInstanceTarget(request: InstanceTargetRequest, opts: ResolveInstanceTargetOpts): Promise<ResolvedInstanceTarget>;
 export declare function couldBeConfiguredAdminInstance(identifier: string, config: AstraleConfig): boolean;
 export declare function adminTargetToInstance(target: ResolvedAdminTarget): ResolvedInstanceTarget;
+/** Admin lookup failed before it could say whether the slug exists. */
+export declare function isAdminDiscoveryFailure(error: unknown): boolean;
 export declare function isManagedInstanceNotFound(error: unknown): boolean;

package/dist/types/lib/instance.d.ts

@@ -136,6 +136,10 @@ export type ResolvedInstance = {
     mode?: RegistryMode;
     status?: string;
 };
+export type BookmarkTrustConflict = {
+    readonly name: string;
+    readonly caFile: string | null;
+};
 export declare function sanitizeStore(store: InstanceStore): {
     store: InstanceStore;
     changed: boolean;
@@ -152,6 +156,12 @@ export declare function readInstances(_config?: AstraleConfig, opts?: {
 export declare function writeInstances(store: InstanceStore): Promise<void>;
 export declare function assertNoCollision(store: InstanceStore, identifiers: string[], ignoreKey?: string): void;
 export declare function resolveInstanceKey(store: InstanceStore, identifier: string): string | null;
+/**
+ * Find other bookmarks for the same normalized Kernel URL whose TLS trust
+ * configuration differs. System trust (`undefined`) is a configuration too:
+ * mixing it with a custom CA is exactly as significant as mixing two CA files.
+ */
+export declare function findBookmarkTrustConflicts(store: InstanceStore, name: string, url: string, caFile?: string): BookmarkTrustConflict[];
 export declare function addInstance(key: string, opts?: AddInstanceOpts): Promise<InstanceEntry>;
 export declare function upsertInstance(key: string, opts?: AddInstanceOpts): Promise<{
     entry: InstanceEntry;

package/dist/types/lib/invocation.d.ts

@@ -0,0 +1,3 @@
+/** Process-wide machine mode from argv (`--json` / `--raw` / `--ci`). */
+export declare function configureInvocation(argv: readonly string[]): void;
+export declare function invocationWantsMachine(): boolean;

package/dist/types/lib/log.d.ts

@@ -1,5 +1,5 @@
 import { type Ora } from 'ora';
-import { type RawOutputOpts } from './output';
+import { type MachineOpts } from './output';
 export declare const log: {
     info: (msg: string) => void;
     success: (msg: string) => void;
@@ -8,10 +8,11 @@ export declare const log: {
     step: (msg: string) => void;
     dim: (msg: string) => void;
 };
-/** Report an error with hint (when present) and exit. Commands that carry
- *  RawOutputOpts should pass them so machine consumers (--json/--raw/piped)
- *  get one structured JSON line on stderr instead of the pretty ✖ view. */
-export declare function fatal(e: unknown, opts?: RawOutputOpts): never;
+/** Report an error with hint (when present) and exit. `--json` / `--ci` / a
+ *  non-TTY stdout always get one structured JSON line on stderr. */
+export declare function fatal(e: unknown, opts?: MachineOpts): never;
+/** Admit expected invalid input and exit through {@link fatal}. */
+export declare function failClosed(error: unknown, opts?: MachineOpts): never;
 /** Shortcut for stub commands that aren't wired in v1 (§15). */
 export declare function fatalNotImplemented(feature: string, hint?: string): never;
 /**

package/dist/types/lib/output.d.ts

@@ -6,6 +6,9 @@ export type OutputOpts = {
     format?: 'yaml' | 'json';
 };
 export type RawOutputOpts = Pick<OutputOpts, 'raw' | 'json'>;
+export type MachineOpts = RawOutputOpts & {
+    readonly ci?: boolean;
+};
 export declare const RAW_OUTPUT_OPTIONS: readonly [{
     readonly flags: '--json';
     readonly description: 'Always-valid JSON (for jq)';
@@ -15,9 +18,10 @@ export declare const RAW_OUTPUT_OPTIONS: readonly [{
 }];
 /**
  * Is the consumer a machine (emit structured data, not a pretty view)?
- * True for `--json`, `--raw`, or any non-TTY stdout (pipe, redirect, CI, agent).
+ * True for `--json`, `--raw`, `--ci`, a process-wide `--ci/--json/--raw` on argv,
+ * or any non-TTY stdout (pipe, redirect, agent).
  */
-export declare function isMachine(opts?: RawOutputOpts): boolean;
+export declare function isMachine(opts?: MachineOpts): boolean;
 /**
  * `--raw` = the *unwrapped* value (bare scalar, raw bytes). The raw-vs-json
  * distinction only manifests for scalars and binary; objects/arrays fall back

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrale-os/cli",
-  "version": "0.8.1-alpha.5",
+  "version": "0.8.1-alpha.7",
   "description": "Astrale CLI — connect to existing Astrale kernels",
   "keywords": [
     "astrale",
@@ -62,10 +62,10 @@
     "zod": "^3.25.0"
   },
   "devDependencies": {
-    "@astrale-os/kernel-client": "0.6.0-beta.1",
+    "@astrale-os/kernel-client": "0.6.0-beta.3",
     "@astrale-os/ox": ">=0.1.0 <1.0.0",
-    "@astrale-os/sdk": "0.5.0-beta.1",
-    "@astrale-os/shell": "0.3.8-beta.1",
+    "@astrale-os/sdk": "0.5.0-beta.3",
+    "@astrale-os/shell": "0.3.8-beta.2",
     "@astrale/commitlint-config": "npm:@jsr/astrale__commitlint-config@~2.0.1",
     "@commitlint/cli": "~20.3.1",
     "@commitlint/config-conventional": "~20.3.1",
@@ -82,16 +82,16 @@
   "lint-staged": {
     "*.{js,cjs,mjs,ts,tsx}": [
       "oxlint --fix --no-error-on-unmatched-pattern",
-      "oxfmt --write"
+      "oxfmt --write --no-error-on-unmatched-pattern"
     ],
     "*.{json,yml,yaml}": [
-      "oxfmt --write"
+      "oxfmt --write --no-error-on-unmatched-pattern"
     ]
   },
   "devEngines": {
     "runtime": {
       "name": "node",
-      "version": ">=24 <25",
+      "version": ">=24 <25 || >=26 <27",
       "onFail": "error"
     }
   },
@@ -101,7 +101,7 @@
   "scripts": {
     "preinstall": "node .check-workspace.cjs",
     "build": "bun scripts/build.ts",
-    "package:check": "pnpm run typecheck && pnpm run test && pnpm run build && node scripts/verify-public-exports.mjs",
+    "package:check": "pnpm run typecheck && pnpm run test && pnpm run build && node scripts/verify-public-exports.mjs && node scripts/verify-private-ports-boundary.mjs",
     "typecheck": "tsgo --noEmit && tsgo --noEmit -p tsconfig.tests.json && tsgo --noEmit -p viewer && tsgo --noEmit -p studio",
     "lint": "oxlint .",
     "lint:fix": "oxlint --fix .",

package/src/commands/__tests__/domain-uninstall.test.ts

@@ -0,0 +1,53 @@
+import { describe, expect, test } from 'bun:test'
+import { join } from 'node:path'
+
+import { uninstallCallInput } from '../domain/uninstall'
+
+const cliRoot = join(import.meta.dir, '../../..')
+
+describe('domain uninstall', () => {
+  test('sends the public Kernel uninstall request', () => {
+    expect(uninstallCallInput('grc.example', 'op-1')).toEqual({
+      operation: 'op-1',
+      origin: 'grc.example',
+    })
+  })
+
+  test('requires --yes outside a TTY before connecting to a Kernel', async () => {
+    const proc = Bun.spawn({
+      cmd: ['bun', join(cliRoot, 'bin/astrale.ts'), 'domain', 'uninstall', 'grc.example', '--json'],
+      stdout: 'pipe',
+      stderr: 'pipe',
+    })
+    const [stdout, stderr, exitCode] = await Promise.all([
+      new Response(proc.stdout).text(),
+      new Response(proc.stderr).text(),
+      proc.exited,
+    ])
+
+    expect(exitCode).toBe(1)
+    expect(stdout).toBe('')
+    expect(JSON.parse(stderr)).toMatchObject({
+      error: 'CONFIRMATION_REQUIRED',
+      message: 'Uninstalling Domain "grc.example" requires explicit confirmation.',
+    })
+  })
+
+  test('states that uninstall never deletes business data', async () => {
+    const proc = Bun.spawn({
+      cmd: ['bun', join(cliRoot, 'bin/astrale.ts'), 'domain', 'uninstall', '--help'],
+      stdout: 'pipe',
+      stderr: 'pipe',
+    })
+    const [stdout, stderr, exitCode] = await Promise.all([
+      new Response(proc.stdout).text(),
+      new Response(proc.stderr).text(),
+      proc.exited,
+    ])
+
+    expect(exitCode).toBe(0)
+    expect(stderr).toBe('')
+    expect(stdout).toContain('Uninstall never deletes business data.')
+    expect(stdout).toContain('business data still uses its schema')
+  })
+})

package/src/commands/__tests__/install-identity-override.test.ts

@@ -41,16 +41,27 @@ describe('declared-origin probe (/meta)', () => {
     return `http://localhost:${server.port}`
   }
 
-  test('reads domainName from a well-formed /meta', async () => {
+  test('reads origin from a well-formed /meta', async () => {
+    // The exact shape SDK workers serve (adapter-cloudflare worker `/meta`).
     const url = serveMeta((req) =>
       new URL(req.url).pathname === '/meta'
-        ? Response.json({ iss: 'https://x', domainName: 'crm.acme.dev' })
+        ? Response.json({
+            origin: 'crm.acme.dev',
+            issuer: 'https://crm.acme.dev',
+            schemaRevision: 'sha256:abc',
+            deploymentVersion: 'v1',
+          })
         : new Response('nope', { status: 404 }),
     )
     expect(await probeDeclaredOrigin(url)).toBe('crm.acme.dev')
   })
 
-  test('degrades to undefined on missing domainName, non-200, bad JSON, or dead host', async () => {
+  test('falls back to the pre-Kernel-V2 domainName field', async () => {
+    const legacy = serveMeta(() => Response.json({ iss: 'https://x', domainName: 'crm.acme.dev' }))
+    expect(await probeDeclaredOrigin(legacy)).toBe('crm.acme.dev')
+  })
+
+  test('degrades to undefined on missing origin, non-200, bad JSON, or dead host', async () => {
     const noName = serveMeta(() => Response.json({ iss: 'https://x' }))
     expect(await probeDeclaredOrigin(noName)).toBeUndefined()
 

package/src/commands/__tests__/instance-bookmark.test.ts

@@ -72,6 +72,63 @@ describe('instance bookmark command', () => {
     expect(store.instances.testmarc.caFile).toBe('/tmp/ca.pem')
     expect(store.instances.testmarc.createdAt).toBe('2026-06-10T00:00:00.000Z')
   })
+
+  test('warns when another bookmark uses different TLS trust for the same URL', async () => {
+    await writeFile(
+      join(tmp, 'instances.json'),
+      JSON.stringify({
+        active: 'stable',
+        instances: {
+          stable: {
+            url: 'https://local.example/kernel',
+            caFile: '/certs/stable.pem',
+          },
+        },
+      }),
+    )
+
+    const result = await runBookmark(
+      'stale',
+      '--url',
+      'https://local.example/kernel/',
+      '--ca',
+      '/certs/old.pem',
+      '--skip-probe',
+    )
+
+    expect(result.exitCode).toBe(0)
+    expect(result.stderr).toContain('TLS trust differs for the same Kernel URL')
+    expect(result.stderr).toContain('"stable" uses CA /certs/stable.pem')
+  })
+
+  test('active --json exposes the TLS and identity configuration', async () => {
+    await writeFile(
+      join(tmp, 'instances.json'),
+      JSON.stringify({
+        active: 'stable',
+        instances: {
+          stable: {
+            url: 'https://local.example/kernel',
+            issuer: 'https://issuer.example',
+            defaultIdentity: 'marc',
+            caFile: '/certs/stable.pem',
+            createdAt: '2026-08-20T00:00:00.000Z',
+          },
+        },
+      }),
+    )
+
+    const result = await runCli('instance', 'active', '--json')
+    expect(result.exitCode).toBe(0)
+    expect(JSON.parse(result.stdout)).toEqual({
+      name: 'stable',
+      url: 'https://local.example/kernel',
+      issuer: 'https://issuer.example',
+      defaultIdentity: 'marc',
+      caFile: '/certs/stable.pem',
+      createdAt: '2026-08-20T00:00:00.000Z',
+    })
+  })
 })
 
 async function readInstances(): Promise<{
@@ -85,9 +142,17 @@ async function runBookmark(...args: string[]): Promise<{
   exitCode: number
   stdout: string
   stderr: string
+}> {
+  return runCli('instance', 'bookmark', ...args)
+}
+
+async function runCli(...args: string[]): Promise<{
+  exitCode: number
+  stdout: string
+  stderr: string
 }> {
   const proc = Bun.spawn({
-    cmd: ['bun', join(cliRoot, 'bin/astrale.ts'), 'instance', 'bookmark', ...args],
+    cmd: ['bun', join(cliRoot, 'bin/astrale.ts'), ...args],
     env: { ...process.env, ASTRALE_HOME: tmp },
     stdout: 'pipe',
     stderr: 'pipe',

package/src/commands/__tests__/instance-list-rows.test.ts

@@ -15,6 +15,7 @@ function bookmark(overrides: Partial<Bookmark> = {}): Bookmark {
     issuer: null,
     active: false,
     defaultIdentity: null,
+    caFile: null,
     createdAt: null,
     ...overrides,
   }

package/src/commands/__tests__/instance-use.test.ts

@@ -0,0 +1,67 @@
+import { describe, expect, test } from 'bun:test'
+
+import { IssuerUnreachableError } from '../../errors'
+import { InstanceStoreSchema, type ResolvedInstance } from '../../lib/instance'
+import { probeBookmark } from '../instance/use'
+
+const resolved: ResolvedInstance = {
+  name: 'stable',
+  kind: 'bookmark',
+  url: 'https://local.example/kernel',
+  issuer: 'https://issuer.example',
+  caFile: '/certs/stable.pem',
+}
+
+describe('instance use bookmark probe', () => {
+  test('uses the CA stored on the selected bookmark', async () => {
+    const scopedFetch = globalThis.fetch
+
+    await expect(
+      probeBookmark(resolved, {
+        readInstances: async () =>
+          InstanceStoreSchema.parse({
+            active: 'stable',
+            instances: {
+              stable: { url: resolved.url, caFile: resolved.caFile },
+            },
+          }),
+        fetchWithCaFile: (path) => {
+          expect(path).toBe('/certs/stable.pem')
+          return scopedFetch
+        },
+        checkIssuerReachability: async (url, issuer, fetchImpl) => {
+          expect(url).toBe(resolved.url)
+          expect(issuer).toBe(resolved.issuer)
+          expect(fetchImpl).toBe(scopedFetch)
+          return { issuer: resolved.issuer!, keys: [{ kid: 'key-1' }] }
+        },
+      }),
+    ).resolves.toBeUndefined()
+  })
+
+  test('names conflicting bookmark CAs in a failed TLS probe', async () => {
+    const failure = probeBookmark(resolved, {
+      readInstances: async () =>
+        InstanceStoreSchema.parse({
+          active: 'stable',
+          instances: {
+            stable: { url: resolved.url, caFile: resolved.caFile },
+            stale: { url: resolved.url, caFile: '/certs/old.pem' },
+          },
+        }),
+      fetchWithCaFile: () => fetch,
+      checkIssuerReachability: async () => {
+        throw new IssuerUnreachableError(resolved.url, 'certificate verify failed')
+      },
+    })
+
+    await expect(failure).rejects.toMatchObject({
+      code: 'ISSUER_UNREACHABLE',
+      message: `Issuer/JWKS probe failed for bookmark "stable" at ${resolved.url}.`,
+    })
+    await expect(failure).rejects.toHaveProperty(
+      'hint',
+      expect.stringContaining('"stale" (CA /certs/old.pem)'),
+    )
+  })
+})

package/src/commands/__tests__/introspect-parse.test.ts

@@ -0,0 +1,21 @@
+import { describe, expect, test } from 'bun:test'
+
+import { parseIntrospectTarget } from '../introspect'
+
+describe('parseIntrospectTarget', () => {
+  test('accepts a bare origin', () => {
+    const parsed = parseIntrospectTarget('host.astrale.ai')
+    expect(parsed.origin).toBe('host.astrale.ai')
+    expect(parsed.path.ast.steps).toEqual([])
+  })
+
+  test('accepts a Domain-rooted method Path', () => {
+    const parsed = parseIntrospectTarget('/:host.astrale.ai:class.Manager:createInstance')
+    expect(parsed.origin).toBe('host.astrale.ai')
+    expect(parsed.path.ast.steps.at(-1)?.kind).toBe('method')
+  })
+
+  test('rejects an @id', () => {
+    expect(() => parseIntrospectTarget('@abc')).toThrow('not an @id')
+  })
+})

package/src/commands/__tests__/logs.test.ts

@@ -29,6 +29,11 @@ describe('buildJournalInput', () => {
     expect(buildJournalInput({})).toEqual({ limit: 200 })
     expect(() => buildJournalInput({ limit: '0' })).toThrow('--limit')
     expect(() => buildJournalInput({ limit: 'all' })).toThrow('--limit')
+    expect(() => buildJournalInput({ since: 'not-a-date' })).toThrow('--since')
+    expect(() =>
+      buildJournalInput({ since: '2026-01-01T00:00:00Z', until: '1999-01-01T00:00:00Z' }),
+    ).toThrow('--since')
+    expect(() => buildJournalInput({ cursor: 'junk' })).toThrow('--cursor')
   })
 })
 

package/src/commands/__tests__/read-commands.test.ts

@@ -27,6 +27,7 @@ class ExitError extends Error {
 let stdout = ''
 let errors: string[] = []
 let originalStdoutWrite: typeof process.stdout.write
+let originalStderrWrite: typeof process.stderr.write
 let originalConsoleError: typeof console.error
 let originalExit: typeof process.exit
 let queryCalls: Array<{ ast: unknown; options: unknown }> = []
@@ -95,12 +96,17 @@ beforeEach(() => {
   runKernelCommandMock.mockClear()
 
   originalStdoutWrite = process.stdout.write
+  originalStderrWrite = process.stderr.write
   originalConsoleError = console.error
   originalExit = process.exit
   process.stdout.write = ((chunk: string | Uint8Array) => {
     stdout += typeof chunk === 'string' ? chunk : Buffer.from(chunk).toString('utf8')
     return true
   }) as typeof process.stdout.write
+  process.stderr.write = ((chunk: string | Uint8Array) => {
+    errors.push(typeof chunk === 'string' ? chunk : Buffer.from(chunk).toString('utf8'))
+    return true
+  }) as typeof process.stderr.write
   console.error = ((...values: unknown[]) => {
     errors.push(values.map(String).join(' '))
   }) as typeof console.error
@@ -111,6 +117,7 @@ beforeEach(() => {
 
 afterEach(() => {
   process.stdout.write = originalStdoutWrite
+  process.stderr.write = originalStderrWrite
   console.error = originalConsoleError
   process.exit = originalExit
 })
@@ -195,7 +202,10 @@ describe('query command', () => {
     ).rejects.toEqual(new ExitError(1))
 
     expect(runKernelCommandMock).not.toHaveBeenCalled()
-    expect(errors.join('\n')).toContain('expected "astrale.graph.query" at /format')
+    expect(JSON.parse(errors.join('\n'))).toMatchObject({
+      error: 'INVALID_INPUT',
+      message: 'Invalid input: expected "astrale.graph.query" at /format.',
+    })
   })
 })
 

package/src/commands/__tests__/token-ttl.test.ts

@@ -0,0 +1,21 @@
+import { describe, expect, test } from 'bun:test'
+
+import { AstraleError } from '../../errors'
+import { parseTtl } from '../token'
+
+describe('parseTtl', () => {
+  test('defaults to 3600 seconds', () => {
+    expect(parseTtl(undefined)).toBe(3600)
+  })
+
+  test('rejects non-positive and non-integer values', () => {
+    expect(() => parseTtl('abc')).toThrow(AstraleError)
+    expect(() => parseTtl('0')).toThrow(AstraleError)
+    expect(() => parseTtl('-5')).toThrow(AstraleError)
+    expect(() => parseTtl('1.5')).toThrow(AstraleError)
+  })
+
+  test('admits a positive integer', () => {
+    expect(parseTtl('90')).toBe(90)
+  })
+})

package/src/commands/__tests__/view-build.test.ts

@@ -0,0 +1,58 @@
+import { afterEach, describe, expect, test } from 'bun:test'
+import { mkdir, mkdtemp, rm, utimes, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+
+import { devDistIsStale } from '../view'
+
+const temporaryDirectories: string[] = []
+
+afterEach(async () => {
+  await Promise.all(
+    temporaryDirectories.splice(0).map((path) => rm(path, { recursive: true, force: true })),
+  )
+})
+
+describe('view development runtime build', () => {
+  test('reuses a current official build and detects every runtime build input', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'astrale-view-build-'))
+    temporaryDirectories.push(root)
+    const entry = join(root, 'bin', 'astrale.ts')
+    const source = join(root, 'src', 'command.ts')
+    const vendor = join(root, 'vendor', 'dependency.tgz')
+    const buildScript = join(root, 'scripts', 'build.ts')
+    const packageJson = join(root, 'package.json')
+    const lockfile = join(root, 'pnpm-lock.yaml')
+    const dist = join(root, 'dist', 'astrale.js')
+
+    await Promise.all(
+      ['bin', 'src', 'vendor', 'scripts', 'dist'].map((directory) =>
+        mkdir(join(root, directory), { recursive: true }),
+      ),
+    )
+    const inputs = [entry, source, vendor, buildScript, packageJson, lockfile]
+    await Promise.all(inputs.map((file) => writeFile(file, 'input')))
+    await writeFile(dist, 'built')
+    const past = new Date(Date.now() - 2_000)
+    const present = new Date()
+    await Promise.all(inputs.map((file) => utimes(file, past, past)))
+    await utimes(dist, present, present)
+
+    expect(await devDistIsStale(entry, dist)).toBe(false)
+
+    for (const input of inputs) {
+      await utimes(input, new Date(Date.now() + 2_000), new Date(Date.now() + 2_000))
+      expect(await devDistIsStale(entry, dist)).toBe(true)
+      await utimes(input, past, past)
+    }
+  })
+
+  test('requires a build when dist/astrale.js is missing', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'astrale-view-build-missing-'))
+    temporaryDirectories.push(root)
+
+    expect(
+      await devDistIsStale(join(root, 'bin', 'astrale.ts'), join(root, 'dist', 'astrale.js')),
+    ).toBe(true)
+  })
+})

package/src/commands/auth/token.ts

@@ -1,9 +1,10 @@
 import type { CommandDefinition } from '../../program/index'
 
+import { AstraleError } from '../../errors'
 import { getDefault, getIdentity, readIdentities } from '../../identity/index'
 import { isSessionExpired, readIdpSession, type IdpSession } from '../../lib/idp'
 import { ensureFreshSession } from '../../lib/idp-session'
-import { log } from '../../lib/log'
+import { fatal, log } from '../../lib/log'
 import { output } from '../../lib/output'
 
 type AuthTokenType = 'access' | 'id'
@@ -66,7 +67,12 @@ Examples:
   $ astrale auth token --name alice --type id --json
 `,
   action: async (opts: AuthTokenOpts) => {
-    const result = await resolveAuthToken(opts)
+    let result: AuthTokenResult
+    try {
+      result = await resolveAuthToken(opts)
+    } catch (error) {
+      fatal(error, opts)
+    }
 
     if (opts.raw) {
       process.stdout.write(result.token + '\n')
@@ -118,10 +124,11 @@ async function resolveIdentityName(opts: AuthTokenOpts): Promise<string> {
   if (opts.name) {
     const identity = await getIdentity(opts.name)
     if ((identity.source ?? 'key') !== 'idp') {
-      throw new Error(`Identity "${opts.name}" is not IdP-backed`)
+      throw new AstraleError('AUTH_ERROR', `Identity "${opts.name}" is not IdP-backed`)
     }
     if (opts.idp && identity.idp !== opts.idp) {
-      throw new Error(
+      throw new AstraleError(
+        'AUTH_ERROR',
         `Identity "${opts.name}" is backed by IdP "${identity.idp ?? '?'}", not "${opts.idp}"`,
       )
     }
@@ -135,20 +142,25 @@ async function resolveIdentityName(opts: AuthTokenOpts): Promise<string> {
       .map(([name]) => name)
 
     if (matches.length === 0) {
-      throw new Error(
+      throw new AstraleError(
+        'AUTH_ERROR',
         `No IdP-backed identities found for IdP "${opts.idp}". Run: astrale auth login --idp ${opts.idp}`,
       )
     }
     if (matches.includes(store.default)) return store.default
     if (matches.length === 1) return matches[0]
-    throw new Error(
+    throw new AstraleError(
+      'AUTH_ERROR',
       `Multiple IdP-backed identities found for IdP "${opts.idp}": ${matches.join(', ')}. Pass --name.`,
     )
   }
 
   const identity = await getDefault()
   if ((identity.source ?? 'key') !== 'idp') {
-    throw new Error('Default identity is not IdP-backed. Pass --name or --idp.')
+    throw new AstraleError(
+      'AUTH_ERROR',
+      'Default identity is not IdP-backed. Pass --name or --idp.',
+    )
   }
   return identity.name
 }