@astrale-os/cli 0.8.1-alpha.5 → 0.8.1-alpha.7

package/src/commands/call.ts

@@ -4,15 +4,12 @@ import type { ConnectionContext, KernelCommandOpts } from '../connection'
 import type { CommandDefinition } from '../program/index'
 
 import { createPathCall, expandSelfInCall, runKernelCommand, withSelfHint } from '../connection'
-import { nodeProperty } from '../graph/index'
 import { presentBinary } from '../lib/binary'
-import { log } from '../lib/log'
+import { failClosed, log } from '../lib/log'
 import { output, present } from '../lib/output'
-import { describeCallableFromSchema, missingCallableDescription } from './call-describe'
 
 type CallOpts = KernelCommandOpts & {
   data?: string
-  describe?: boolean
   dryRun?: boolean
   output?: string
 }
@@ -32,15 +29,13 @@ export async function callCommand(
   try {
     expanded = await expandSelfInCall(path, rawParams, opts)
   } catch (error) {
-    log.error(error instanceof Error ? error.message : 'Invalid @self expansion')
-    process.exit(1)
+    failClosed(error, opts)
   }
   const expandedPath = expanded.path
-
-  // ── Describe mode: show schema without executing ────────
-  // Runs AFTER expansion so `astrale call @self::m --describe` works.
-  if (opts.describe) {
-    return describeOperation(expandedPath, opts)
+  try {
+    Path.parse(expandedPath)
+  } catch (error) {
+    failClosed(error, opts)
   }
 
   // ── Parse params ────────────────────────────────────────
@@ -48,8 +43,7 @@ export async function callCommand(
   try {
     params = await parseParams([...expanded.parameters], opts.data)
   } catch (e) {
-    log.error(e instanceof Error ? e.message : 'Invalid params')
-    process.exit(1)
+    failClosed(e, opts)
   }
 
   // ── Dry-run: show what would be sent ─────────────────────
@@ -94,24 +88,6 @@ export async function materializeCallResult(result: CallResult): Promise<Materia
   return Object.freeze({ kind: 'stream', values: Object.freeze(values) })
 }
 
-async function describeOperation(path: string, opts: CallOpts): Promise<void> {
-  await runKernelCommand({
-    opts,
-    label: `Schema for ${path}`,
-    fn: async ({ graph }) => {
-      const parsed = Path.parse(path)
-      if (parsed.ast.anchor.kind !== 'domain') {
-        throw missingCallableDescription(path)
-      }
-      const domain = await graph.getOrThrow(Path.parse(`/:${parsed.ast.anchor.origin}`))
-      const described = describeCallableFromSchema(parsed, nodeProperty(domain, 'schema'))
-      if (described === undefined) throw missingCallableDescription(path)
-      return described
-    },
-    format: (schema, fmtOpts) => output(schema, fmtOpts),
-  })
-}
-
 // ── Param parsing ───────────────────────────────────────────
 
 export async function parseParams(
@@ -129,6 +105,10 @@ export async function parseParams(
     }
   }
 
+  if (rawParams.length > 0) {
+    return parseKeyValue(rawParams)
+  }
+
   const stdin = await readStdin()
   if (stdin) {
     try {
@@ -138,10 +118,6 @@ export async function parseParams(
     }
   }
 
-  if (rawParams.length > 0) {
-    return parseKeyValue(rawParams)
-  }
-
   return {}
 }
 
@@ -201,11 +177,12 @@ export default {
   description: 'Call a kernel operation',
   afterHelpText: `
 Behavior:
-  Param priority (highest wins): --data > stdin > key=value > {}. If
+  Param priority (highest wins): --data > key=value > stdin > {}. If
   both --data and key=value are given, key=value is ignored (warned).
-  Stdin is read only when piped (ignored on a TTY). --describe and
-  --dry-run short-circuit (no execution). Remote-bound functions
-  auto-mint a worker-scoped credential; --creds overrides it.
+  Stdin is read only when piped and no --data/key=value is present
+  (ignored on a TTY). --dry-run admits the Path and prints the call
+  input without executing. Remote-bound functions auto-mint a
+  worker-scoped credential; --creds overrides it.
 
 Self-reference:
   @self expands to your nodeId on the active instance (path head or
@@ -214,11 +191,10 @@ Self-reference:
   (e.g. via 'astrale get @self --json'). Resolution authenticates to
   the selected Kernel and never trusts a local registration or JWT sub.
 
-  --describe reads the callable's input/output from the installed Domain
-  schema. Method Paths are not Function nodes.
+  Callable input/output lives on astrale introspect <path>.
 
 Examples:
-  $ astrale call /:host.astrale.ai:class.Manager:createInstance --describe
+  $ astrale introspect /:host.astrale.ai:class.Manager:createInstance
   $ astrale call /:blog.acme.com:class.Author:list limit=10
   $ astrale call '@self::deactivate'
   $ astrale call /:kernel.astrale.ai:function.journal --data '{"limit":5}' --json
@@ -234,7 +210,6 @@ Examples:
   options: [
     { flags: '-d, --data <json>', description: 'Params as JSON string' },
     { flags: '-o, --output <file>', description: 'Write binary/raw output to a file' },
-    { flags: '--describe', description: 'Show operation schema without executing' },
     { flags: '--dry-run', description: 'Show what would be sent without executing' },
   ],
   action: async (path, params, opts) => {

package/src/commands/domain/install.ts

@@ -415,7 +415,7 @@ export function isIdentityOverride(origin: string, host: string): boolean {
  * Claiming an origin that differs from the serving host is an explicit actAs
  * and needs typed consent (or `--allow-identity-override` in scripts).
  *
- * The pre-install check reads the worker's self-reported `/meta.domainName`,
+ * The pre-install check reads the worker's self-reported `/meta.origin`,
  * so it is consent UX, not enforcement — a hostile worker can lie here, and
  * the kernel anchors the cryptographic identity (`iss`) on the real URL
  * regardless. When `/meta` is unreachable or silent on the origin, the gate
@@ -476,10 +476,11 @@ export async function probeDeclaredOrigin(url: string): Promise<string | undefin
   try {
     const res = await fetch(new URL('/meta', url), { signal: AbortSignal.timeout(10_000) })
     if (!res.ok) return undefined
-    const body = (await res.json()) as { domainName?: unknown }
-    return typeof body.domainName === 'string' && body.domainName.length > 0
-      ? body.domainName
-      : undefined
+    // SDK workers serve `origin`; `domainName` is the pre-Kernel-V2 name, kept
+    // as a fallback for workers deployed before the rename.
+    const body = (await res.json()) as { origin?: unknown; domainName?: unknown }
+    const declared = body.origin ?? body.domainName
+    return typeof declared === 'string' && declared.length > 0 ? declared : undefined
   } catch {
     // Unreachable /meta is not fatal here: the caller warns and the install
     // itself will surface a dead worker with its own error.

package/src/commands/domain/uninstall.ts

@@ -0,0 +1,128 @@
+import { Path } from '@astrale-os/sdk/graph/path'
+import { syscalls } from '@astrale-os/sdk/schema/kernel'
+import chalk from 'chalk'
+
+import type { KernelCommandOpts } from '../../connection'
+import type { CommandDefinition } from '../../program/index'
+
+import { createPathCall, runKernelCommand } from '../../connection'
+import { AstraleError } from '../../errors'
+import { fatal, log } from '../../lib/log'
+import { output } from '../../lib/output'
+import { confirmWithInput } from '../../lib/prompt'
+
+type UninstallOpts = KernelCommandOpts & {
+  readonly yes?: boolean
+  readonly ci?: boolean
+  readonly noPrompt?: boolean
+}
+
+type UninstallResult = {
+  readonly operation: string
+  readonly transition: {
+    readonly intent: {
+      readonly origin: string
+    }
+  }
+}
+
+/** Public Kernel uninstall syscall input for one installed Domain origin. */
+export function uninstallCallInput(
+  origin: string,
+  operation: string = crypto.randomUUID(),
+): Readonly<{ operation: string; origin: string }> {
+  return Object.freeze({ operation, origin })
+}
+
+export default {
+  name: 'uninstall',
+  description: 'Uninstall a domain from an instance through the public Kernel syscall',
+  afterHelpText: `
+Behavior:
+  Removes one installed Domain origin from the target instance. The Kernel
+  refuses the operation while another installed Domain depends on it or while
+  business data still uses its schema. Uninstall never deletes business data.
+  Type the exact origin to confirm, or pass --yes in automation.
+
+  Use this before reinstalling only when an immutable Domain property (such as
+  its issuer) intentionally changed. Ordinary compatible upgrades should use
+  domain install directly and preserve the existing Domain identity.
+
+Examples:
+  $ astrale domain uninstall grc.example -i staging
+  $ astrale domain uninstall grc.example -i staging --yes --json
+`,
+  arguments: [
+    {
+      name: 'origin',
+      description: 'Installed Domain origin to remove',
+      required: true,
+    },
+  ],
+  options: [
+    {
+      flags: '--yes',
+      description: 'Confirm Domain uninstall without prompting',
+    },
+  ],
+  action: async (origin: string, opts: UninstallOpts) => {
+    try {
+      await confirmUninstall(origin, opts)
+    } catch (error) {
+      fatal(error, opts)
+    }
+
+    await runKernelCommand<UninstallResult>({
+      opts,
+      label: `Uninstalling domain ${origin}`,
+      fn: async ({ session }) =>
+        (await session.call(
+          createPathCall(Path.project(syscalls.uninstall.ref).raw, uninstallCallInput(origin)),
+        )) as UninstallResult,
+      format: (result, formatOpts, machine) => {
+        if (machine) {
+          output(result, formatOpts)
+          return
+        }
+        log.success(`Domain uninstalled: ${result.transition.intent.origin}`)
+        log.dim(`  operation: ${result.operation}`)
+      },
+    })
+  },
+} satisfies CommandDefinition
+
+async function confirmUninstall(origin: string, opts: UninstallOpts): Promise<void> {
+  if (opts.yes) return
+
+  const nonInteractive =
+    opts.ci ||
+    opts.noPrompt ||
+    process.env.CI ||
+    process.argv.includes('--ci') ||
+    process.argv.includes('--no-prompt') ||
+    !process.stdin.isTTY
+  if (nonInteractive) {
+    throw new AstraleError(
+      'CONFIRMATION_REQUIRED',
+      `Uninstalling Domain "${origin}" requires explicit confirmation.`,
+      `Re-run with --yes: astrale domain uninstall ${origin} --yes`,
+    )
+  }
+
+  const warning =
+    chalk.red.bold('⚠  DANGER — DOMAIN UNINSTALL') +
+    '\n' +
+    chalk.dim('│') +
+    `  origin     ${chalk.bold(origin)}\n` +
+    chalk.dim('│') +
+    '\n' +
+    chalk.dim('│') +
+    '  This removes the installed Domain from the target instance.\n' +
+    chalk.dim('│') +
+    '  This command never deletes business data.\n' +
+    chalk.dim('│') +
+    '  The Kernel refuses removal while dependents or business data remain.'
+  if (!(await confirmWithInput(warning, origin))) {
+    throw new AstraleError('UNINSTALL_CANCELLED', `Domain uninstall cancelled for "${origin}".`)
+  }
+}

package/src/commands/get.ts

@@ -5,26 +5,40 @@ import type { CommandDefinition } from '../program/index'
 
 import { expandSelfInPath, runKernelCommand, withSelfHint } from '../connection'
 import { formatKernelError } from '../connection/errors'
-import { isMachine, output } from '../lib/output'
+import { AstraleError } from '../errors'
+import { denoise, isMachine, output } from '../lib/output'
 
-type GetOpts = KernelCommandOpts
+type GetOpts = KernelCommandOpts & { schema?: boolean }
 
 /** Read one exact canonical Node. The caller's Path is not fabricated into the Node value. */
 export async function getCommand(target: string, opts: GetOpts): Promise<void> {
   let path: string
   let meta
+  let parsed
   try {
     ;({ path, meta } = await expandSelfInPath(target, opts))
+    parsed = Path.parse(path)
   } catch (error) {
     await formatKernelError(error, isMachine(opts), undefined, opts.debug)
     process.exit(1)
   }
 
+  const last = parsed.ast.steps.at(-1)
+  if (last?.kind === 'method') {
+    const error = new AstraleError(
+      'NOT_A_NODE',
+      `${path} is a callable Path, not a Node.`,
+      `Use \`astrale call ${path}\` or \`astrale introspect ${path}\`.`,
+    )
+    await formatKernelError(error, isMachine(opts), undefined, opts.debug)
+    process.exit(1)
+  }
+
   await runKernelCommand({
     opts,
     label: `Node ${path}`,
-    fn: ({ graph }) => withSelfHint(() => graph.getOrThrow(Path.parse(path)), meta),
-    format: (node, format) => output(node, format),
+    fn: ({ graph }) => withSelfHint(() => graph.getOrThrow(parsed), meta),
+    format: (node, format) => output(opts.schema === true ? node : denoise(node), format),
   })
 }
 
@@ -38,14 +52,18 @@ Behavior:
   intentionally indistinguishable. @self is expanded before dispatch.
 
   A Node does not contain a synthetic path, labels, or backend class ID.
-  Use astrale query for graph-shaped reads.
+  Method Paths are not Nodes — use call / introspect. Schema-valued
+  properties are omitted unless --schema is passed. Use query for
+  graph-shaped reads.
 
 Examples:
   $ astrale get /:notes.example.dev:class.Note
   $ astrale get @abc123 --json
   $ astrale get @self
+  $ astrale get /:host.astrale.ai --schema
 `,
   arguments: [{ name: 'target', description: 'Canonical Node Path or @id' }],
+  options: [{ flags: '--schema', description: 'Include schema-valued properties' }],
   action: async (target, opts) => {
     await getCommand(target as string, opts as GetOpts)
   },

package/src/commands/identity/create.ts

@@ -2,6 +2,7 @@ import type { CommandDefinition } from '../../program/index'
 
 import { createIdentity } from '../../identity/index'
 import { fatal, log } from '../../lib/log'
+import { isMachine, output, RAW_OUTPUT_OPTIONS, type RawOutputOpts } from '../../lib/output'
 
 export default {
   name: 'create',
@@ -11,16 +12,24 @@ export default {
     { flags: '--subject <sub>', description: 'Custom subject (defaults to name)' },
     { flags: '--local', description: 'Local-only identity (default)' },
     { flags: '--remote', description: 'Remote (cloud-synced) identity — requires cloud login' },
+    ...RAW_OUTPUT_OPTIONS,
   ],
-  action: async (name: string, opts: { subject?: string; local?: boolean; remote?: boolean }) => {
+  action: async (
+    name: string,
+    opts: { subject?: string; local?: boolean; remote?: boolean } & RawOutputOpts,
+  ) => {
     try {
       const mode = opts.remote ? 'remote' : 'local'
       const identity = await createIdentity(name, { subject: opts.subject, mode })
+      if (isMachine(opts)) {
+        output({ name, ...identity }, opts)
+        return
+      }
       log.success(
         `Created identity "${name}" (subject: ${identity.subject}, mode: ${identity.mode})`,
       )
     } catch (e) {
-      fatal(e)
+      fatal(e, opts)
     }
   },
 } satisfies CommandDefinition

package/src/commands/identity/delete.ts

@@ -2,17 +2,23 @@ import type { CommandDefinition } from '../../program/index'
 
 import { deleteIdentity } from '../../identity/index'
 import { fatal, log } from '../../lib/log'
+import { isMachine, output, RAW_OUTPUT_OPTIONS, type RawOutputOpts } from '../../lib/output'
 
 export default {
   name: 'delete',
   description: 'Delete an identity',
   arguments: [{ name: 'name', description: 'Identity name', required: true }],
-  action: async (name: string) => {
+  options: [...RAW_OUTPUT_OPTIONS],
+  action: async (name: string, opts: RawOutputOpts) => {
     try {
       await deleteIdentity(name)
+      if (isMachine(opts)) {
+        output({ deleted: name }, opts)
+        return
+      }
       log.success(`Deleted identity "${name}"`)
     } catch (e) {
-      fatal(e)
+      fatal(e, opts)
     }
   },
 } satisfies CommandDefinition

package/src/commands/identity/export.ts

@@ -2,6 +2,7 @@ import type { CommandDefinition } from '../../program/index'
 
 import { encodeIdentityExport, exportIdentity, writeIdentityExport } from '../../identity/index'
 import { fatal, log } from '../../lib/log'
+import { isMachine, output, RAW_OUTPUT_OPTIONS, type RawOutputOpts } from '../../lib/output'
 import { readPassphrase } from '../../lib/prompt'
 
 /**
@@ -18,8 +19,9 @@ export default {
   ],
   options: [
     { flags: '--encrypt', description: 'Encrypt the envelope with a passphrase (JOSE JWE)' },
+    ...RAW_OUTPUT_OPTIONS,
   ],
-  action: async (name: string, path: string, opts: { encrypt?: boolean }) => {
+  action: async (name: string, path: string, opts: { encrypt?: boolean } & RawOutputOpts) => {
     try {
       const envelope = await exportIdentity(name)
       const passphrase = opts.encrypt
@@ -27,6 +29,10 @@ export default {
         : undefined
       await writeIdentityExport(path, await encodeIdentityExport(envelope, passphrase))
 
+      if (isMachine(opts)) {
+        output({ name, path, encrypted: Boolean(opts.encrypt) }, opts)
+        return
+      }
       log.success(`Exported identity "${name}" → ${path}${opts.encrypt ? ' (encrypted)' : ''}`)
       if (!opts.encrypt) {
         log.warn(
@@ -34,7 +40,7 @@ export default {
         )
       }
     } catch (e) {
-      fatal(e)
+      fatal(e, opts)
     }
   },
 } satisfies CommandDefinition

package/src/commands/identity/import.ts

@@ -8,6 +8,7 @@ import {
   isEncryptedIdentityExport,
 } from '../../identity/index'
 import { fatal, log } from '../../lib/log'
+import { isMachine, output, RAW_OUTPUT_OPTIONS, type RawOutputOpts } from '../../lib/output'
 import { readPassphrase } from '../../lib/prompt'
 
 export default {
@@ -27,8 +28,12 @@ export default {
       flags: '--replace',
       description: 'Replace an existing key-backed identity with the imported keypair',
     },
+    ...RAW_OUTPUT_OPTIONS,
   ],
-  action: async (path: string, opts: { name?: string; issuer?: string; replace?: boolean }) => {
+  action: async (
+    path: string,
+    opts: { name?: string; issuer?: string; replace?: boolean } & RawOutputOpts,
+  ) => {
     try {
       const raw = await readFile(path, 'utf-8')
       const passphrase = isEncryptedIdentityExport(raw)
@@ -42,11 +47,15 @@ export default {
         replace: opts.replace,
       })
 
+      if (isMachine(opts)) {
+        output({ name, ...identity }, opts)
+        return
+      }
       log.success(
         `Imported identity "${name}" (subject=${identity.subject}, kid=${identity.kid ?? '?'})`,
       )
     } catch (e) {
-      fatal(e)
+      fatal(e, opts)
     }
   },
 } satisfies CommandDefinition

package/src/commands/identity/sync.ts

@@ -2,6 +2,7 @@ import type { CommandDefinition } from '../../program/index'
 
 import { getIdentity, setIdentityMode } from '../../identity/index'
 import { fatal, fatalNotImplemented, log } from '../../lib/log'
+import { isMachine, output, RAW_OUTPUT_OPTIONS, type RawOutputOpts } from '../../lib/output'
 
 export default {
   name: 'sync',
@@ -12,8 +13,9 @@ export default {
       flags: '--force',
       description: 'Tag as remote in the local registry even without cloud login',
     },
+    ...RAW_OUTPUT_OPTIONS,
   ],
-  action: async (name: string, opts: { force?: boolean }) => {
+  action: async (name: string, opts: { force?: boolean } & RawOutputOpts) => {
     try {
       const identity = await getIdentity(name)
       if (!opts.force) {
@@ -23,10 +25,14 @@ export default {
         )
       }
       await setIdentityMode(name, 'remote')
+      if (isMachine(opts)) {
+        output({ name, mode: 'remote', subject: identity.subject }, opts)
+        return
+      }
       log.warn(`Tagged "${name}" as remote locally (cloud sync stubbed in v1)`)
       log.dim(`  subject=${identity.subject}`)
     } catch (e) {
-      fatal(e)
+      fatal(e, opts)
     }
   },
 } satisfies CommandDefinition

package/src/commands/identity/unsync.ts

@@ -2,23 +2,33 @@ import type { CommandDefinition } from '../../program/index'
 
 import { getIdentity, setIdentityMode } from '../../identity/index'
 import { fatal, log } from '../../lib/log'
+import { isMachine, output, RAW_OUTPUT_OPTIONS, type RawOutputOpts } from '../../lib/output'
 
 /** Metadata-only flip remote → local until cloud sync ships (§2.7). */
 export default {
   name: 'unsync',
   description: 'Migrate an identity remote → local',
   arguments: [{ name: 'name', description: 'Identity name', required: true }],
-  action: async (name: string) => {
+  options: [...RAW_OUTPUT_OPTIONS],
+  action: async (name: string, opts: RawOutputOpts) => {
     try {
       const identity = await getIdentity(name)
       if (identity.mode !== 'remote') {
+        if (isMachine(opts)) {
+          output({ name, mode: identity.mode ?? 'local', unchanged: true }, opts)
+          return
+        }
         log.warn(`Identity "${name}" is already ${identity.mode ?? 'local'}`)
         return
       }
       await setIdentityMode(name, 'local')
+      if (isMachine(opts)) {
+        output({ name, mode: 'local' }, opts)
+        return
+      }
       log.success(`Identity "${name}" → local`)
     } catch (e) {
-      fatal(e)
+      fatal(e, opts)
     }
   },
 } satisfies CommandDefinition

package/src/commands/identity/use.ts

@@ -2,17 +2,23 @@ import type { CommandDefinition } from '../../program/index'
 
 import { setDefault } from '../../identity/index'
 import { fatal, log } from '../../lib/log'
+import { isMachine, output, RAW_OUTPUT_OPTIONS, type RawOutputOpts } from '../../lib/output'
 
 export default {
   name: 'use',
   description: 'Set the active CLI identity',
   arguments: [{ name: 'name', description: 'Identity name', required: true }],
-  action: async (name: string) => {
+  options: [...RAW_OUTPUT_OPTIONS],
+  action: async (name: string, opts: RawOutputOpts) => {
     try {
       await setDefault(name)
+      if (isMachine(opts)) {
+        output({ default: name }, opts)
+        return
+      }
       log.success(`Active identity set to "${name}"`)
     } catch (e) {
-      fatal(e)
+      fatal(e, opts)
     }
   },
 } satisfies CommandDefinition

package/src/commands/identity/whoami.ts

@@ -28,7 +28,7 @@ export default {
       }
       console.log(`${chalk.bold(result.name)} (subject: ${result.subject})`)
     } catch (e) {
-      fatal(e)
+      fatal(e, opts)
     }
   },
 } satisfies CommandDefinition

package/src/commands/instance/active.ts

@@ -19,13 +19,19 @@ export default {
       const { name } = active
       const url = active.url ?? null
       const createdAt = active.createdAt ?? null
+      const issuer = active.issuer ?? null
+      const defaultIdentity = active.defaultIdentity ?? null
+      const caFile = active.caFile ?? null
 
       if (isRaw) {
-        output({ name, url, createdAt }, opts)
+        output({ name, url, issuer, defaultIdentity, caFile, createdAt }, opts)
         return
       }
 
       console.log(`${chalk.bold(name)} (${url ?? 'local'})`)
+      if (issuer && issuer !== url) log.dim(`  issuer:   ${issuer}`)
+      if (defaultIdentity) log.dim(`  identity: ${defaultIdentity}`)
+      if (caFile) log.dim(`  ca:       ${caFile}`)
     } catch (e) {
       log.error(e instanceof Error ? e.message : String(e))
       process.exit(1)
@@ -36,6 +42,9 @@ export default {
 async function resolveActiveForDisplay(): Promise<{
   name: string
   url?: string
+  issuer?: string
+  defaultIdentity?: string
+  caFile?: string
   createdAt?: string
 }> {
   const active = await getActive()
@@ -43,6 +52,9 @@ async function resolveActiveForDisplay(): Promise<{
     return {
       name: active.name,
       url: active.url,
+      issuer: active.issuer,
+      defaultIdentity: active.defaultIdentity,
+      caFile: active.caFile,
       createdAt: active.createdAt,
     }
   }