@astrale-os/cli 1.0.0-beta.0 → 1.0.0-beta.10

package/src/lib/command-dx.ts

@@ -2,8 +2,6 @@ import type { Command, CommanderError } from 'commander'
 
 import chalk from 'chalk'
 
-import { isMachine } from './output'
-
 export type CommandCatalogEntry = {
   path: string[]
   usage: string
@@ -30,27 +28,27 @@ export function renderCommanderError(
   program: Command,
   error: CommanderError,
   argv = process.argv.slice(2),
+  machine = argv.some((token) => token === '--ci' || token === '--json' || token === '--raw') ||
+    !(process.stdout.isTTY ?? false),
 ): string {
   const tokens = stripOptions(argv)
   const catalog = collectCommandCatalog(program)
   const matched = matchRegisteredPrefix(program, tokens)
 
   if (matched.path.length === 0 && tokens.length > 0) {
-    return maybeMachine(renderUnknownCommand(tokens, catalog))
+    return maybeMachine(renderUnknownCommand(tokens, catalog), machine)
   }
 
   if (error.code === 'commander.missingArgument') {
     const usage = usageFor(matched.path, matched.command)
-    const argName = error.message.match(/'([^']+)'/)?.[1]
     return maybeMachine(
       [
-        `Missing required argument${argName ? ` ${chalk.bold(`<${argName}>`)}` : ''} for ${chalk.bold(
-          `astrale ${matched.path.join(' ')}`,
-        )}`,
+        `Missing required argument for ${chalk.bold(`astrale ${matched.path.join(' ')}`)}`,
         '',
         'Usage:',
         `  astrale ${usage}`,
       ].join('\n'),
+      machine,
     )
   }
 
@@ -66,6 +64,7 @@ export function renderCommanderError(
         'Usage:',
         `  astrale ${usage}`,
       ].join('\n'),
+      machine,
     )
   }
 
@@ -77,6 +76,7 @@ export function renderCommanderError(
         ? ['', 'Did you mean:', ...suggestions.map((s) => `  astrale ${s}`)]
         : []),
     ].join('\n'),
+    machine,
   )
 }
 
@@ -143,8 +143,8 @@ function usageFor(path: string[], command: Command): string {
 
 const ANSI_RE = new RegExp(String.fromCharCode(27) + '\\[[0-9;]*m', 'g')
 
-function maybeMachine(text: string): string {
-  if (!isMachine()) return text
+function maybeMachine(text: string, machine: boolean): string {
+  if (!machine) return text
   const plain = text.replace(ANSI_RE, '')
   const first = plain.split('\n').find((line) => line.trim().length > 0) ?? plain
   return JSON.stringify({ error: 'USAGE_ERROR', message: first, detail: plain })

package/src/lib/domain-publication.ts

@@ -0,0 +1,104 @@
+import { publication } from '@astrale-os/sdk/publication'
+
+const MAXIMUM_PUBLICATION_BYTES = 1024 * 1024
+type FetchLike = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>
+
+/** Fetch and admit one canonical Domain Publication without following its bundle. */
+export async function fetchDomainPublication(
+  input: string,
+  signal?: AbortSignal,
+  fetchImpl: FetchLike = globalThis.fetch,
+): Promise<publication.Publication> {
+  const url = domainPublicationUrl(input)
+  const response = await fetchImpl(url, {
+    redirect: 'error',
+    ...(signal === undefined ? {} : { signal }),
+  })
+  if (!response.ok) {
+    await cancel(response.body)
+    throw new Error(`GET ${url.href} → ${response.status}`)
+  }
+  const bytes = await readBounded(response, url)
+  try {
+    const source = new TextDecoder('utf-8', { fatal: true }).decode(bytes)
+    return publication.accept(JSON.parse(source) as unknown)
+  } catch (cause) {
+    throw new Error(`GET ${url.href} returned an invalid Domain Publication`, { cause })
+  }
+}
+
+async function readBounded(response: Response, url: URL): Promise<Uint8Array> {
+  const declared = response.headers.get('content-length')
+  if (
+    declared !== null &&
+    (!/^\d+$/u.test(declared) ||
+      !Number.isSafeInteger(Number(declared)) ||
+      Number(declared) > MAXIMUM_PUBLICATION_BYTES)
+  ) {
+    await cancel(response.body)
+    throw sizeError(url)
+  }
+  if (response.body === null) return new Uint8Array()
+
+  const reader = response.body.getReader()
+  const chunks: Uint8Array[] = []
+  let size = 0
+  let complete = false
+  try {
+    for (;;) {
+      const next = await reader.read()
+      if (next.done) {
+        complete = true
+        break
+      }
+      if (next.value.byteLength === 0) continue
+      if (next.value.byteLength > MAXIMUM_PUBLICATION_BYTES - size) {
+        throw sizeError(url)
+      }
+      chunks.push(next.value)
+      size += next.value.byteLength
+    }
+  } finally {
+    if (!complete) await reader.cancel().catch(() => undefined)
+    reader.releaseLock()
+  }
+
+  const bytes = new Uint8Array(size)
+  let offset = 0
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset)
+    offset += chunk.byteLength
+  }
+  return bytes
+}
+
+function sizeError(url: URL): Error {
+  return new Error(`GET ${url.href} exceeded ${MAXIMUM_PUBLICATION_BYTES} bytes`)
+}
+
+async function cancel(body: ReadableStream<Uint8Array> | null): Promise<void> {
+  if (body !== null) await body.cancel().catch(() => undefined)
+}
+
+/** Canonical discovery document for a Domain origin or exact Publication URL. */
+export function domainPublicationUrl(input: string): URL {
+  let url: URL
+  try {
+    url = new URL(input)
+  } catch {
+    throw new TypeError(`Domain deployment URL is invalid: ${input}`)
+  }
+  if (
+    !['http:', 'https:'].includes(url.protocol) ||
+    url.username !== '' ||
+    url.password !== '' ||
+    url.search !== '' ||
+    url.hash !== '' ||
+    !['', '/', publication.PATH].includes(url.pathname)
+  ) {
+    throw new TypeError(
+      `Domain deployment URL must be an HTTP(S) origin or canonical Publication URL: ${input}`,
+    )
+  }
+  return new URL(publication.PATH, url.origin)
+}

package/src/lib/failure-debug.ts

@@ -0,0 +1,26 @@
+import chalk from 'chalk'
+
+const MAXIMUM_DEBUG_FAILURES = 32
+
+export function printFailureDebug(error: unknown, url: string): void {
+  process.stderr.write(`\n${chalk.dim('── debug ─────────────────')}\n`)
+  if (url) process.stderr.write(`${chalk.dim(`url:   ${url}`)}\n`)
+  const seen = new Set<unknown>()
+  const pending: Array<{ value: unknown; relation: string }> = [{ value: error, relation: 'error' }]
+  while (pending.length > 0 && seen.size < MAXIMUM_DEBUG_FAILURES) {
+    const { value, relation } = pending.shift()!
+    if (seen.has(value)) continue
+    seen.add(value)
+    if (!(value instanceof Error)) {
+      process.stderr.write(`${chalk.dim(`${relation}: ${String(value)}`)}\n`)
+      continue
+    }
+    process.stderr.write(
+      `${chalk.dim(`${relation}: ${value.constructor.name}: ${value.message}`)}\n`,
+    )
+    if (value.stack) process.stderr.write(`${chalk.dim(value.stack)}\n`)
+    if (value.cause !== undefined) pending.push({ value: value.cause, relation: 'caused by' })
+    if (value instanceof AggregateError)
+      for (const child of value.errors) pending.push({ value: child, relation: 'aggregate' })
+  }
+}

package/src/lib/idp.ts

@@ -145,6 +145,8 @@ export const IdpSessionSchema = z
     idp: z.string(),
     issuer: z.string().url(),
     subject: z.string(),
+    /** OAuth client that issued this session's refresh token. */
+    clientId: z.string().optional(),
     audience: z.string().optional(),
     organizationId: z.string().optional(),
     access_token: z.string(),
@@ -212,6 +214,8 @@ export type IdpConfig = {
 
 export const BUILTIN_WORKOS_IDP_NAME = 'workos'
 const DEFAULT_WORKOS_API_HOST = 'https://api.workos.com'
+const DEFAULT_WORKOS_CLIENT_ID = 'client_01KC29HET5F3QAQ8GNTPZ7F320'
+const LEGACY_WORKOS_CLIENT_ID = 'client_01KC29HEGD7B40TV2C4QZ436BG'
 const WORKOS_CLIENT_ID_ENV_NAMES = ['WORKOS_CLIENT_ID', 'VITE_WORKOS_CLIENT_ID'] as const
 
 export function idpDir(name: string): string {
@@ -278,7 +282,17 @@ export async function readIdpConfigOrBuiltin(
   validateName(name, 'IdP')
   const store = await readIdpStore()
   if (store.idps[name]) {
-    return await readIdpConfig(name)
+    const existing = await readIdpConfig(name)
+    const replacement = opts.persist
+      ? legacyBuiltinWorkosReplacement(existing, opts.clientId)
+      : undefined
+    if (!replacement) return existing
+    return upsertIdpConfig({
+      name: replacement.name,
+      metadata: replacement.metadata,
+      client: replacement.client,
+      builtIn: true,
+    })
   }
 
   const builtin = builtinIdpConfig(name, opts.clientId)
@@ -411,11 +425,30 @@ export function builtinIdpConfig(
 }
 
 export function workosClientIdFromEnv(env: NodeJS.ProcessEnv = process.env): string | undefined {
-  return WORKOS_CLIENT_ID_ENV_NAMES.map((name) => env[name]?.trim()).find(
-    (value): value is string => typeof value === 'string' && value.length > 0,
+  return (
+    WORKOS_CLIENT_ID_ENV_NAMES.map((name) => env[name]?.trim()).find(
+      (value): value is string => typeof value === 'string' && value.length > 0,
+    ) ?? DEFAULT_WORKOS_CLIENT_ID
   )
 }
 
+export function legacyBuiltinWorkosReplacement(
+  existing: IdpConfig,
+  clientIdOverride?: string,
+  env: NodeJS.ProcessEnv = process.env,
+): IdpConfig | undefined {
+  if (
+    existing.name !== BUILTIN_WORKOS_IDP_NAME ||
+    !existing.entry.builtIn ||
+    existing.client.client_id !== LEGACY_WORKOS_CLIENT_ID
+  ) {
+    return undefined
+  }
+  const replacement = builtinIdpConfig(existing.name, clientIdOverride, env)
+  if (!replacement || replacement.client.client_id === LEGACY_WORKOS_CLIENT_ID) return undefined
+  return replacement
+}
+
 async function fetchOAuthAuthorizationServerMetadata(
   issuer: string,
 ): Promise<Partial<OidcMetadata> | undefined> {
@@ -644,10 +677,11 @@ export async function refreshSession(
   if (!session.refresh_token)
     throw new Error(`IdP session for "${identityName}" has no refresh token`)
   const idp = await readIdpConfig(session.idp)
+  const clientId = requireClientId(idp, session.clientId)
   const params = new URLSearchParams({
     grant_type: 'refresh_token',
     refresh_token: session.refresh_token,
-    client_id: requireClientId(idp),
+    client_id: clientId,
   })
   const audience = opts.audience ?? session.audience
   if (audience) params.set('audience', audience)
@@ -674,6 +708,7 @@ export async function refreshSession(
   const expiresAt = tokenExpiresAt(token)
   const next: IdpSession = {
     ...session,
+    clientId,
     access_token: token.access_token,
     id_token: token.id_token ?? session.id_token,
     refresh_token: token.refresh_token ?? session.refresh_token,

package/src/lib/instance-candidates.ts

@@ -1,6 +1,6 @@
 import type { InstanceEntry, InstanceStore } from './instance'
 
-import { formatInstanceLocation, type OwnedInstanceInfo } from './admin-instance'
+import { formatInstanceState, type OwnedInstanceInfo } from './admin-instance'
 import { normalizeInstanceKernelUrl, resolveInstanceKey } from './instance'
 
 export type InstanceCandidate =
@@ -44,6 +44,6 @@ export function describeInstanceCandidate(candidate: InstanceCandidate): string
   if (candidate.source === 'bookmark') {
     return `${candidate.key} (bookmark) ${candidate.url}`
   }
-  const extra = formatInstanceLocation(candidate.info)
+  const extra = formatInstanceState(candidate.info)
   return `${candidate.key} (managed) ${candidate.url}${extra ? ` — ${extra}` : ''}`
 }

package/src/lib/instance-target.ts

@@ -1,6 +1,6 @@
-import type { InstanceInfo } from '../admin/instance/model'
 import type { AstraleConfig } from './config'
 
+import { AdminInstanceNotFoundError, type InstanceInfo } from '../admin/instance/model'
 import { AstraleError } from '../errors'
 import {
   DEFAULT_ADMIN_TARGET_NAME,
@@ -190,19 +190,8 @@ export function isAdminDiscoveryFailure(error: unknown): boolean {
 }
 
 export function isManagedInstanceNotFound(error: unknown): boolean {
-  if (error instanceof AstraleError && error.code === 'INSTANCE_NOT_FOUND') return true
-  if (!(error instanceof Error)) return false
-  if (error.name === 'NotFoundError') return true
-  // The admin kernel reports a missing instance node as InternalKernelError
-  // with a NOT_FOUND-prefixed message. In this lookup that's an instance
-  // miss (config problem), not a kernel fault — map it so callers get the
-  // typed INSTANCE_NOT_FOUND with remediation instead of a raw kernel error.
-  if (error.name === 'InternalKernelError' && /^NOT_FOUND\b/.test(error.message)) return true
-  const data = (error as Error & { data?: unknown }).data
   return (
-    error.name === 'KernelError' &&
-    !!data &&
-    typeof data === 'object' &&
-    (data as { type?: unknown }).type === 'NotFoundError'
+    error instanceof AdminInstanceNotFoundError ||
+    (error instanceof AstraleError && error.code === 'INSTANCE_NOT_FOUND')
   )
 }

package/src/lib/instance.ts

@@ -297,22 +297,26 @@ export async function upsertInstance(
  * bookmark was repointed to a different kernel so callers can warn.
  */
 export async function upsertManagedBookmark(
-  key: string,
-  slug: string,
-  rawUrl: string,
-  organizationId?: string,
+  input: Readonly<{
+    key: string
+    slug: string
+    url: string
+    organizationId?: string
+    defaultIdentity?: string
+  }>,
 ): Promise<{ entry: InstanceEntry; repointedFrom?: string }> {
   const store = await readInstances()
-  const previousUrl = store.instances[key]?.url
-  const url = normalizeInstanceKernelUrl(rawUrl)
-  const { entry } = await upsertInstance(key, {
+  const previousUrl = store.instances[input.key]?.url
+  const url = normalizeInstanceKernelUrl(input.url)
+  const { entry } = await upsertInstance(input.key, {
     url,
     issuer: url,
-    slug,
-    name: slug,
+    slug: input.slug,
+    name: input.slug,
     kind: 'bookmark',
     mode: 'remote',
-    ...(organizationId ? { organizationId } : {}),
+    ...(input.organizationId ? { organizationId: input.organizationId } : {}),
+    ...(input.defaultIdentity ? { defaultIdentity: input.defaultIdentity } : {}),
   })
   return {
     entry,
@@ -362,8 +366,9 @@ export async function getActive(config?: AstraleConfig): Promise<InstanceEntry &
 export async function resolveInstance(
   identifier: string,
   config?: AstraleConfig,
+  opts: { persist?: boolean } = {},
 ): Promise<ResolvedInstance> {
-  const store = await readInstances(config)
+  const store = await readInstances(config, opts)
   const key = resolveInstanceKey(store, identifier)
   const entry = key ? store.instances[key] : undefined
   if (!key || !entry?.url) {
@@ -448,7 +453,12 @@ function isRegionRoutedInstanceRoot(url: URL): boolean {
   if (url.search || url.hash) return false
 
   const labels = url.hostname.toLowerCase().split('.')
-  return labels.length === 4 && labels[2] === 'astrale' && labels[3] === 'ai'
+  return (
+    (labels.length === 4 || labels.length === 5) &&
+    /^[a-z]{2}(?:-[a-z0-9]+)*$/u.test(labels[1] ?? '') &&
+    labels.at(-2) === 'astrale' &&
+    labels.at(-1) === 'ai'
+  )
 }
 
 function definedEntry(entry: AddInstanceOpts): AddInstanceOpts {

package/src/lib/log.ts

@@ -2,6 +2,7 @@ import chalk from 'chalk'
 import ora, { type Ora } from 'ora'
 
 import { AstraleError, NotImplementedError } from '../errors'
+import { printFailureDebug } from './failure-debug'
 import { formatElapsed } from './format'
 import { isMachine, type MachineOpts } from './output'
 
@@ -18,28 +19,34 @@ export const log = {
 
 /** Report an error with hint (when present) and exit. `--json` / `--ci` / a
  *  non-TTY stdout always get one structured JSON line on stderr. */
-export function fatal(e: unknown, opts?: MachineOpts): never {
+export function fatal(e: unknown, opts?: MachineOpts & { readonly debug?: boolean }): never {
   // Ctrl-C at an interactive (@inquirer/prompts) prompt — exit quietly with the
   // SIGINT convention, not a red error line.
   if (e instanceof Error && e.name === 'ExitPromptError') process.exit(130)
-  const msg = e instanceof Error ? e.message : String(e)
-  const code = e instanceof AstraleError ? e.code : e instanceof Error ? e.name : 'Error'
+  const msg =
+    e instanceof AstraleError ? e.message : 'The CLI encountered an unexpected internal failure.'
+  const code = e instanceof AstraleError ? e.code : 'UNEXPECTED_ERROR'
   if (isMachine(opts)) {
     const payload: Record<string, unknown> = { error: code, message: msg }
     if (e instanceof AstraleError && e.hint) payload.hint = e.hint
     process.stderr.write(JSON.stringify(payload) + '\n')
-    process.exit(1)
+  } else {
+    log.error(`${code}: ${msg}`)
+    if (e instanceof AstraleError && e.hint) log.dim(`  hint: ${e.hint}`)
   }
-  log.error(e instanceof AstraleError ? `${code}: ${msg}` : msg)
-  if (e instanceof AstraleError && e.hint) log.dim(`  hint: ${e.hint}`)
+  if (opts?.debug) printFailureDebug(e, '')
   process.exit(1)
 }
 
-/** Admit expected invalid input and exit through {@link fatal}. */
-export function failClosed(error: unknown, opts?: MachineOpts): never {
+/** Project only a caller-authored admission failure into the CLI input family. */
+export function failInput(error: unknown, opts?: MachineOpts): never {
   if (error instanceof AstraleError) fatal(error, opts)
+  if (!(error instanceof TypeError)) fatal(error, opts)
   fatal(
-    new AstraleError('INVALID_INPUT', error instanceof Error ? error.message : String(error)),
+    new AstraleError(
+      'INVALID_INPUT',
+      error.message.trim() ? error.message : 'CLI input is invalid.',
+    ),
     opts,
   )
 }

package/src/lib/login-flow.ts

@@ -7,7 +7,9 @@ import {
   normalizeTokenResponse,
   pollDeviceToken,
   readIdpConfigOrBuiltin,
+  readIdpSession,
   readIdpStore,
+  requireClientId,
   requestClientCredentials,
   requestDeviceAuthorization,
   saveIdpSession,
@@ -71,10 +73,17 @@ export type LoginResult = {
  */
 export async function loginViaIdp(opts: LoginFlowOpts): Promise<LoginResult> {
   const idpName = await resolveIdpName(opts.idp)
-  const idp = await readIdpConfigOrBuiltin(idpName, { clientId: opts.clientId, persist: true })
+  const previous = opts.name && !opts.clientId ? await readIdpSession(opts.name) : null
+  const savedClientId = previous?.idp === idpName ? previous.clientId : undefined
+  const requestedClientId = opts.clientId ?? savedClientId
+  const idp = await readIdpConfigOrBuiltin(idpName, {
+    clientId: requestedClientId,
+    persist: true,
+  })
+  const clientId = requireClientId(idp, requestedClientId)
   const scope = opts.scope ?? idp.client.scope ?? 'openid profile email offline_access'
 
-  const token = normalizeTokenResponse(await obtainToken(idp, opts, scope))
+  const token = normalizeTokenResponse(await obtainToken(idp, { ...opts, clientId }, scope))
   if (!token.access_token) throw new Error('IdP response did not include access_token')
   if (opts.audience && !tokenAudienceMatches(token.access_token, opts.audience)) {
     throw new Error(
@@ -83,7 +92,7 @@ export async function loginViaIdp(opts: LoginFlowOpts): Promise<LoginResult> {
   }
 
   const claims = decodeTokenClaims(token.id_token ?? token.access_token)
-  const subject = subjectFromToken(token, opts.clientId ?? idp.client.client_id ?? idpName)
+  const subject = subjectFromToken(token, clientId)
   const issuer = issuerFromToken(token, idp.metadata.issuer)
   const identityName = opts.name ?? identityNameFromClaims(claims, idpName)
   const session: IdpSession = {
@@ -91,6 +100,7 @@ export async function loginViaIdp(opts: LoginFlowOpts): Promise<LoginResult> {
     idp: idpName,
     issuer,
     subject,
+    clientId,
     audience: opts.audience,
     access_token: token.access_token,
     id_token: token.id_token,

package/src/lib/meta.ts

@@ -6,8 +6,8 @@
  * `jwks_uri`) and JWKS at `/.well-known/jwks.json`. These helpers probe
  * both to verify the issuer is alive and publishes at least one key.
  *
- * Domain workers may expose `/meta` for deployment drift detection; that is
- * outside this connect-only CLI surface.
+ * Domain deployment readiness uses the canonical Domain Publication; that is
+ * outside this issuer-connectivity helper.
  */
 
 import { IssuerUnreachableError } from '../errors'

package/src/lib/provision-instance.ts

@@ -9,12 +9,10 @@ import { createOwnedInstance } from './admin-instance'
 import { setActive, upsertManagedBookmark } from './instance'
 import { withSpinner } from './log'
 import { isMachine } from './output'
-import { promptSelect } from './prompt'
 import { validateSlug } from './validation'
 
 export type ProvisionOpts = KernelCommandOpts &
   AdminTargetCommandOpts & {
-    hostId?: string
     // Global flags (program.ts) that force non-interactive — mirrors `instance use`.
     ci?: boolean
     noPrompt?: boolean
@@ -35,10 +33,10 @@ export type ProvisionResult = {
 const SAGA_TIMEOUT_MS = '240000'
 
 /**
- * Provision an alpha instance through the admin kernel, then bookmark it and
+ * Provision an instance through the admin kernel, then bookmark it and
  * make it the active target. Extracted from `instance create` so `astrale
- * setup` provisions through the exact same saga (auth assertion → alphaCreate →
- * bookmark → set-active), including the interactive multi-host picker.
+ * setup` provisions through the exact same saga (auth assertion → create →
+ * bookmark → set-active).
  *
  * Presentation is deliberately minimal here (a spinner + a one-line success);
  * the caller renders anything richer — `setup` follows this with a hero panel.
@@ -48,15 +46,10 @@ export async function provisionInstance(
   opts: ProvisionOpts,
 ): Promise<ProvisionResult> {
   validateSlug(slug)
-  await assertAlphaCreateAuth(opts)
-  // The created instance must belong to the LOGGED-IN identity — never to an
-  // identity pinned on the admin bookmark (that mismatch silently made a fresh
-  // user's instance unusable). `--as` still wins.
-  if (!opts.as) opts = { ...opts, as: (await readIdentities()).default }
+  const authentication = await instanceCreateAuthentication(opts)
+  opts = authentication.opts
 
   const machine = isMachine(opts)
-  const interactive = !!process.stdin.isTTY && !(opts.ci || opts.noPrompt || process.env.CI)
-
   let repointedFrom: string | undefined
   let selectionError: unknown = null
   // The global 30s default doesn't just fail the CLIENT: the disconnect kills
@@ -65,21 +58,24 @@ export async function provisionInstance(
   // timeout; an explicit --timeout still wins.
   const createOpts = { ...opts, timeout: opts.timeout ?? SAGA_TIMEOUT_MS }
 
-  const runProvision = (hostId: string | undefined) =>
+  const runProvision = () =>
     withSpinner(
       `Provisioning instance ${slug}`,
       !machine,
       async () => {
-        const created = await createOwnedInstance(createOpts, slug, hostId)
+        const created = await createOwnedInstance(createOpts, slug)
         try {
           // Org id from the create response — authoritative for token scoping
           // (the router's /auth/org is eventually consistent).
-          const bookmarked = await upsertManagedBookmark(
-            slug,
+          const bookmarked = await upsertManagedBookmark({
+            key: slug,
             slug,
-            created.url,
-            created.organizationId,
-          )
+            url: created.url,
+            ...(created.organizationId ? { organizationId: created.organizationId } : {}),
+            ...(authentication.defaultIdentity
+              ? { defaultIdentity: authentication.defaultIdentity }
+              : {}),
+          })
           repointedFrom = bookmarked.repointedFrom
           await setActive(slug)
         } catch (e) {
@@ -93,23 +89,7 @@ export async function provisionInstance(
       },
     )
 
-  // Host placement is chosen SERVER-side (the caller's ready + USE-granted
-  // hosts). We recover ONLY from its multi-host ambiguity: pop a picker and
-  // retry with the chosen host_id — the ambiguity error throws before any
-  // provisioning side effect, so the retry is clean. No host / permission /
-  // capacity / a non-interactive run all reject through to the caller's `fatal`,
-  // surfacing the server's own message plus the listed ids. An explicit
-  // `--host-id` skips all of this.
-  const created = await runProvision(opts.hostId).catch(async (e: unknown) => {
-    const hostIds = !opts.hostId && interactive ? parseEligibleHostIds(e) : null
-    if (!hostIds) throw e
-    const chosen = await promptSelect(
-      `${hostIds.length} hosts available — pick one to provision on`,
-      hostIds.map((hid) => ({ name: hid, value: hid })),
-    )
-    if (!chosen) throw e
-    return runProvision(chosen)
-  })
+  const created = await runProvision()
 
   // Warnings go to stderr so machine-readable stdout stays clean.
   const warn = (msg: string) => console.error(chalk.yellow('⚠'), msg)
@@ -124,31 +104,28 @@ export async function provisionInstance(
   return { created, slug, repointedFrom, ...(selectionError ? { selectionError } : {}) }
 }
 
-/**
- * Recover the eligible host ids from alphaCreate's multi-host error
- * ("N ready hosts are assigned (id1, id2). Specify host_id…") — only when
- * there's a real choice (>1). Returns null for any other error (no host,
- * permission, capacity). Deliberately coupled to that message wording (Option
- * B: no admin-side change); if it ever drifts we simply stop offering the
- * picker and the raw error is shown instead — no worse than before.
- */
-export function parseEligibleHostIds(error: unknown): string[] | null {
-  const text = error instanceof Error ? error.message : String(error)
-  const match = /ready hosts are assigned \(([^)]+)\)/.exec(text)
-  if (!match) return null
-  const ids = match[1]!
-    .split(',')
-    .map((s) => s.trim())
-    .filter(Boolean)
-  return ids.length > 1 ? ids : null
+async function instanceCreateAuthentication(opts: ProvisionOpts): Promise<{
+  readonly opts: ProvisionOpts
+  readonly defaultIdentity?: string
+}> {
+  if (opts.creds) return { opts }
+  const store = await readIdentities()
+  const defaultIdentity = selectInstanceCreateIdentity(store, opts)
+  return {
+    opts: opts.as ? opts : { ...opts, as: defaultIdentity },
+    defaultIdentity,
+  }
 }
 
-async function assertAlphaCreateAuth(opts: Pick<ProvisionOpts, 'as' | 'creds'>): Promise<void> {
-  if (opts.creds) return
-  assertAlphaCreateIdentity(await readIdentities(), opts)
+export function selectInstanceCreateIdentity(
+  store: IdentityStore,
+  opts: Pick<ProvisionOpts, 'as'> = {},
+): string {
+  assertInstanceCreateIdentity(store, opts)
+  return opts.as ?? store.default
 }
 
-export function assertAlphaCreateIdentity(
+export function assertInstanceCreateIdentity(
   store: IdentityStore,
   opts: Pick<ProvisionOpts, 'as'> = {},
 ): void {