@astrale-os/cli 1.0.0-beta.1 → 1.0.0-beta.11

package/src/commands/domain/list.ts

@@ -6,6 +6,7 @@ import type { CommandDefinition } from '../../program/index'
 
 import { listAdminDomains, type DomainInfo } from '../../lib/admin-domain'
 import { ADMIN_TARGET_OPTIONS, type AdminTargetCommandOpts } from '../../lib/admin-target'
+import { fetchDomainPublication } from '../../lib/domain-publication'
 import { fatal, withSpinner } from '../../lib/log'
 import { isMachine, presentList } from '../../lib/output'
 
@@ -23,7 +24,7 @@ type ListOpts = KernelCommandOpts &
 /** A catalog entry, optionally enriched with a live `--check` probe. */
 export type DomainRow = DomainInfo & {
   reachable?: boolean
-  schemaHash?: string
+  schemaRevision?: string
   checkError?: string | null
 }
 
@@ -72,9 +73,9 @@ Behavior:
   or with --json/--raw (agent-friendly — full DomainInfo objects). -q prints
   one install URL per line (pipeable into \`domain install\`); --count prints
   only the number. --default-only keeps the install-by-default entries (what
-  every new instance gets via alphaCreate). --check probes each published URL's
-  /meta and adds a live/unreachable STATUS column (+ reachable/schemaHash in
-  machine output).
+  every new instance receives during Admin-managed provisioning). --check probes each published URL's
+  canonical Publication and adds a live/unreachable STATUS column
+  (+ reachable/schemaRevision in machine output).
 
   The admin kernel is selected like every admin op — the configured default,
   or --admin <bookmark> / --admin-url <url>.
@@ -87,7 +88,10 @@ Examples:
 `,
   options: [
     ...ADMIN_TARGET_OPTIONS,
-    { flags: '--check', description: "Probe each domain's URL for reachability + schema hash" },
+    {
+      flags: '--check',
+      description: "Probe each domain's canonical Publication + schema revision",
+    },
     { flags: '--default-only', description: 'Only show install-by-default domains' },
     { flags: '-q, --quiet', description: 'One install URL per line (unix-pipeable)' },
     { flags: '--count', description: 'Print only the number of published domains' },
@@ -103,7 +107,7 @@ Examples:
           const filtered = opts.defaultOnly ? list.filter((d) => d.installByDefault) : list
           filtered.sort(byDefaultThenName)
           if (!opts.check) return filtered as DomainRow[]
-          // Reachability is a direct client-side /meta fetch per entry, in
+          // Reachability is a direct client-side Publication fetch per entry, in
           // parallel — no admin round-trip, and version-independent of the
           // admin worker (mirrors `domain install`'s probeDeclaredOrigin).
           return Promise.all(filtered.map(probe))
@@ -129,19 +133,20 @@ export function byDefaultThenName(a: DomainInfo, b: DomainInfo): number {
 
 /**
  * Enrich one entry with a reachability probe: fetch the published worker's
- * `/meta` (the same endpoint the admin `DomainEntry.check` hits) and read its
- * schema hash. A dead / missing url is itself a result, not a throw.
+ * canonical Publication and read its schema revision. A dead or missing URL is
+ * itself a result, not a throw.
  */
-async function probe(d: DomainInfo): Promise<DomainRow> {
+export async function probe(d: DomainInfo): Promise<DomainRow> {
   if (!d.url) return { ...d, reachable: false, checkError: 'no url published' }
   try {
-    const res = await fetch(new URL('/meta', d.url), { signal: AbortSignal.timeout(10_000) })
-    if (!res.ok) return { ...d, reachable: false, checkError: `meta HTTP ${res.status}` }
-    const meta = (await res.json()) as { schemaHash?: unknown }
+    const deployed = await fetchDomainPublication(d.url, AbortSignal.timeout(10_000))
+    if (deployed.origin !== d.origin) {
+      throw new Error(`Domain origin mismatch: deployed=${deployed.origin} expected=${d.origin}`)
+    }
     return {
       ...d,
       reachable: true,
-      ...(typeof meta.schemaHash === 'string' ? { schemaHash: meta.schemaHash } : {}),
+      schemaRevision: deployed.schema.revision,
       checkError: null,
     }
   } catch (err) {

package/src/commands/domain/publish.ts

@@ -3,9 +3,11 @@ import chalk from 'chalk'
 import type { KernelCommandOpts } from '../../connection'
 import type { CommandDefinition } from '../../program/index'
 
+import { formatKernelError } from '../../connection/errors'
 import { publishAdminDomain } from '../../lib/admin-domain'
 import { ADMIN_TARGET_OPTIONS, type AdminTargetCommandOpts } from '../../lib/admin-target'
-import { fatal, withSpinner } from '../../lib/log'
+import { domainPublicationUrl } from '../../lib/domain-publication'
+import { withSpinner } from '../../lib/log'
 import { isMachine, output } from '../../lib/output'
 import { promptText } from '../../lib/prompt'
 import { isHttpUrl, validateName, validateUrl } from '../../lib/validation'
@@ -48,9 +50,9 @@ Behavior:
 
   Publishing only makes the domain INSTALLABLE. Mount it on an instance with
   \`astrale domain install <url>\` (or rely on the admin's install-by-default
-  policy). This is usually invoked for you by \`astrale-domain publish\` (which
-  registers the already-deployed URL — it does NOT deploy) or by
-  \`astrale-domain deploy --publish\` (deploy AND register in one step).
+  policy). Deployment and catalog publication are separate owners: run the
+  project's \`astrale-domain deploy <environment>\`, then publish its observed
+  public URL with this command.
 
   Run in a terminal with flags omitted and it PROMPTS for origin / name /
   public-url (origin defaults to the URL host, name to the origin's first
@@ -68,17 +70,16 @@ Examples:
     { flags: '--description <text>', description: 'Optional human description for the catalog' },
     {
       flags: '--install-by-default',
-      description: 'Mark the domain for install on every new instance (alphaCreate)',
+      description: 'Mark the domain for install on every new instance',
     },
   ],
   // No positional arguments → Commander passes (opts, command); `opts` is first.
   action: async (opts: PublishOpts) => {
     try {
       // Interactive fill (TTY only): a human running this by hand is prompted for
-      // any missing field. The primary caller — `astrale-domain publish` — always
-      // passes every flag, so it never prompts. No TTY / --ci / --no-prompt / CI
-      // env → no prompt: fall straight through to the required-flag error below,
-      // so a piped / agent / LLM run fails fast instead of hanging on a read.
+      // any missing field. Automation passes every flag. No TTY / --ci /
+      // --no-prompt / CI env means no prompt: fall straight through to the
+      // required-flag error below so a piped or agent run fails fast.
       const interactive = !!process.stdin.isTTY && !(opts.ci || opts.noPrompt || process.env.CI)
       let { origin, name, publicUrl } = opts
       if (interactive) {
@@ -102,6 +103,7 @@ Examples:
       validateName(origin, 'origin')
       validateName(name, 'domain')
       validateUrl(publicUrl)
+      const discoveryUrl = domainPublicationUrl(publicUrl).href
 
       const result = await withSpinner(
         `Publishing ${name} → ${publicUrl}`,
@@ -110,7 +112,7 @@ Examples:
           publishAdminDomain(opts, {
             origin,
             name,
-            url: publicUrl,
+            url: discoveryUrl,
             ...(opts.description ? { description: opts.description } : {}),
             ...(opts.installByDefault ? { installByDefault: true } : {}),
           }),
@@ -127,7 +129,8 @@ Examples:
         return
       }
     } catch (e) {
-      fatal(e)
+      await formatKernelError(e, isMachine(opts), undefined, opts.debug)
+      process.exit(1)
     }
   },
 } satisfies CommandDefinition

package/src/commands/domain/uninstall.ts

@@ -1,5 +1,5 @@
 import { Path } from '@astrale-os/sdk/graph/path'
-import { syscalls } from '@astrale-os/sdk/schema/kernel'
+import { K } from '@astrale-os/sdk/schema'
 import chalk from 'chalk'
 
 import type { KernelCommandOpts } from '../../connection'
@@ -77,7 +77,7 @@ Examples:
       label: `Uninstalling domain ${origin}`,
       fn: async ({ session }) =>
         (await session.call(
-          createPathCall(Path.project(syscalls.uninstall.ref).raw, uninstallCallInput(origin)),
+          createPathCall(Path.project(K.functions.uninstall.ref).raw, uninstallCallInput(origin)),
         )) as UninstallResult,
       format: (result, formatOpts, machine) => {
         if (machine) {

package/src/commands/get.ts

@@ -4,40 +4,39 @@ import type { KernelCommandOpts } from '../connection'
 import type { CommandDefinition } from '../program/index'
 
 import { expandSelfInPath, runKernelCommand, withSelfHint } from '../connection'
-import { formatKernelError } from '../connection/errors'
 import { AstraleError } from '../errors'
-import { denoise, isMachine, output } from '../lib/output'
+import { failInput, fatal } from '../lib/log'
+import { denoise, output } from '../lib/output'
 
 type GetOpts = KernelCommandOpts & { schema?: boolean }
 
 /** Read one exact canonical Node. The caller's Path is not fabricated into the Node value. */
 export async function getCommand(target: string, opts: GetOpts): Promise<void> {
-  let path: string
-  let meta
   let parsed
   try {
-    ;({ path, meta } = await expandSelfInPath(target, opts))
-    parsed = Path.parse(path)
+    parsed = Path.parse(target)
   } catch (error) {
-    await formatKernelError(error, isMachine(opts), undefined, opts.debug)
-    process.exit(1)
+    failInput(error, opts)
   }
 
   const last = parsed.ast.steps.at(-1)
   if (last?.kind === 'method') {
     const error = new AstraleError(
       'NOT_A_NODE',
-      `${path} is a callable Path, not a Node.`,
-      `Use \`astrale call ${path}\` or \`astrale introspect ${path}\`.`,
+      `${target} is a callable Path, not a Node.`,
+      `Use \`astrale call ${target}\` or \`astrale introspect ${target}\`.`,
     )
-    await formatKernelError(error, isMachine(opts), undefined, opts.debug)
-    process.exit(1)
+    fatal(error, opts)
   }
 
   await runKernelCommand({
     opts,
-    label: `Node ${path}`,
-    fn: ({ graph }) => withSelfHint(() => graph.getOrThrow(parsed), meta),
+    label: `Node ${target}`,
+    fn: async (context) => {
+      const { path, meta } = await expandSelfInPath(target, context)
+      const resolved = meta === undefined ? parsed : Path.parse(path)
+      return withSelfHint(() => context.graph.getOrThrow(resolved), meta)
+    },
     format: (node, format) => output(opts.schema === true ? node : denoise(node), format),
   })
 }
@@ -60,7 +59,7 @@ Examples:
   $ astrale get /:notes.example.dev:class.Note
   $ astrale get @abc123 --json
   $ astrale get @self
-  $ astrale get /:host.astrale.ai --schema
+  $ astrale get /:kernel.astrale.ai --schema
 `,
   arguments: [{ name: 'target', description: 'Canonical Node Path or @id' }],
   options: [{ flags: '--schema', description: 'Include schema-valued properties' }],

package/src/commands/identity/__tests__/register.test.ts

@@ -1,9 +1,9 @@
 import { issuer, jwk, provision } from '@astrale-os/sdk/auth'
-import { ClassPath } from '@astrale-os/sdk/graph/class'
 import { normalizeProperties } from '@astrale-os/sdk/graph/properties'
 import { expect, mock, test } from 'bun:test'
 import { exportJWK, generateKeyPair, jwtVerify } from 'jose'
 
+import { classKey } from '../../../graph'
 import { formatIdentityRegistration, prepareIdentityProvision } from '../register'
 
 /** @evidence TEST-CLI-IDENTITY-REGISTER-JSON-EXACT */
@@ -46,7 +46,7 @@ test('builds one exact Mutation V3 identity birth bound to a self proof', async
     kid: 'alice-key',
   })
   const kernelIssuer = issuer.accept('https://kernel.example')
-  const classPath = ClassPath.parse('/:accounts.example:class.User')
+  const classPath = classKey('/:accounts.example:class.User', '--class')
   const properties = normalizeProperties({
     'accounts.example:class.User.property.name': 'Alice',
   })
@@ -70,7 +70,7 @@ test('builds one exact Mutation V3 identity birth bound to a self proof', async
       {
         op: 'node.create',
         as: 'identity',
-        class: '/:accounts.example:class.User',
+        class: 'accounts.example:class.User',
         props: { 'accounts.example:class.User.property.name': 'Alice' },
       },
     ],

package/src/commands/identity/register.ts

@@ -1,9 +1,9 @@
 import type { IssuerId, JsonWebKey, ProvisionRequest } from '@astrale-os/sdk/auth'
+import type { ClassKey as ClassKeyValue } from '@astrale-os/sdk/graph/class'
 import type { JWK } from 'jose'
 
 import { provision, jwk } from '@astrale-os/sdk/auth'
-import { ClassPath } from '@astrale-os/sdk/graph/class'
-import { LocalBinding } from '@astrale-os/sdk/graph/model'
+import { LocalBinding } from '@astrale-os/sdk/graph'
 import { normalizeProperties } from '@astrale-os/sdk/graph/properties'
 import { MutationAST } from '@astrale-os/sdk/mutation'
 import { importJWK, SignJWT } from 'jose'
@@ -14,6 +14,7 @@ import type { IdentityRegistrationResult } from '../../identity/index'
 import type { CommandDefinition } from '../../program/index'
 
 import { registrationKeyForTarget, runKernelCommand } from '../../connection'
+import { classKey } from '../../graph'
 import { getIdentity, setRegistration, submitIdentityProvision } from '../../identity/index'
 import { fileExists, keypairPaths } from '../../keys/index'
 import { fatal, log } from '../../lib/log'
@@ -83,7 +84,7 @@ Example:
 
       const privateKey = await readJwk(privatePath)
       const publicKey = jwk.acceptPublic(await readJwk(publicPath))
-      const classPath = ClassPath.parse(opts.class)
+      const classPath = classKey(opts.class, '--class')
       const properties = normalizeProperties(opts.props ? JSON.parse(opts.props) : {})
 
       await runKernelCommand<IdentityRegistrationResult>({
@@ -142,7 +143,7 @@ export function formatIdentityRegistration(
 /** Build and self-prove one exact canonical provision request for the target Kernel. */
 export async function prepareIdentityProvision(input: {
   readonly name: string
-  readonly classPath: ReturnType<typeof ClassPath.parse>
+  readonly classPath: ClassKeyValue
   readonly properties: ReturnType<typeof normalizeProperties>
   readonly privateKey: JWK
   readonly publicKey: JsonWebKey

package/src/commands/instance/create.ts

@@ -1,15 +1,12 @@
 import type { CommandDefinition } from '../../program/index'
 
+import { formatKernelError } from '../../connection/errors'
 import { ADMIN_TARGET_OPTIONS } from '../../lib/admin-target'
-import { fatal } from '../../lib/log'
 import { isMachine, output } from '../../lib/output'
 import { promptText } from '../../lib/prompt'
 import { provisionInstance, type ProvisionOpts } from '../../lib/provision-instance'
 import { validateSlug } from '../../lib/validation'
 
-// Re-exported for tests + `astrale setup`, which share the provisioning saga.
-export { assertAlphaCreateIdentity, parseEligibleHostIds } from '../../lib/provision-instance'
-
 /** inquirer `validate` for a slug: true when valid, else the human message. */
 function slugError(value: string): true | string {
   try {
@@ -22,12 +19,12 @@ function slugError(value: string): true | string {
 
 export default {
   name: 'create',
-  description: 'Provision an alpha instance through the admin kernel (Instance.alphaCreate)',
+  description: 'Provision an instance through the Admin control plane',
   afterHelpText: `
 Behavior:
-  Calls Instance.alphaCreate on the configured admin kernel. The caller must be
-  logged in with WorkOS. When --host-id is omitted, the admin kernel chooses the
-  caller's single eligible host. The new instance becomes the active instance.
+  Requests a new Instance from the configured Admin Domain. The caller must be
+  logged in with WorkOS. Admin owns infrastructure placement. The new instance
+  becomes the active instance.
 
   Run with no slug in a terminal and it prompts for one (validated live). With
   no TTY — or --ci / --no-prompt — the slug argument is required up front, so
@@ -38,13 +35,7 @@ Examples:
   $ astrale instance create demo
 `,
   arguments: [{ name: 'id', description: 'Instance slug', required: false }],
-  options: [
-    ...ADMIN_TARGET_OPTIONS,
-    {
-      flags: '--host-id <id>',
-      description: 'Advanced: host node id to provision on when multiple hosts are available',
-    },
-  ],
+  options: [...ADMIN_TARGET_OPTIONS],
   action: async (id: string | undefined, opts: ProvisionOpts) => {
     try {
       // Interactive (TTY only): prompt for the slug when omitted, with live
@@ -63,7 +54,8 @@ Examples:
         return
       }
     } catch (e) {
-      fatal(e, opts)
+      await formatKernelError(e, isMachine(opts), undefined, opts.debug)
+      process.exit(1)
     }
   },
 } satisfies CommandDefinition

package/src/commands/instance/delete.ts

@@ -1,10 +1,12 @@
 import type { KernelCommandOpts } from '../../connection'
 import type { CommandDefinition } from '../../program/index'
 
+import { AdminInstanceNotFoundError } from '../../admin/instance'
+import { formatKernelError } from '../../connection/errors'
 import { deleteOwnedInstance } from '../../lib/admin-instance'
 import { ADMIN_TARGET_OPTIONS, type AdminTargetCommandOpts } from '../../lib/admin-target'
 import { clearActive, readInstances, removeInstance, resolveInstanceKey } from '../../lib/instance'
-import { fatal, log, withSpinner } from '../../lib/log'
+import { log, withSpinner } from '../../lib/log'
 import { isMachine, output } from '../../lib/output'
 
 type DeleteOpts = KernelCommandOpts &
@@ -18,10 +20,9 @@ export default {
   afterHelpText: `
 Behavior:
   Calls Instance.delete on the configured admin kernel: best-effort decommission
-  of the instance's routing-registry entry + WorkOS org (frees the slug), then
-  removes the Instance record. The host kernel itself is NOT deregistered (the
-  deprovisioning saga is a follow-up). A same-name local bookmark is removed
-  after the delete succeeds unless --keep-bookmark is passed.
+  of the instance's route and tenant reservation, then removes the Instance
+  projection. A same-name local bookmark is removed after the delete succeeds
+  unless --keep-bookmark is passed.
 `,
   arguments: [{ name: 'id', description: 'Instance slug', required: true }],
   options: [
@@ -53,14 +54,16 @@ Behavior:
     } catch (e) {
       // Bookmark-only id → no admin Instance → kernel NOT_FOUND. Point to
       // `forget` (local drop) instead of surfacing the raw path error.
-      const notManaged =
-        e instanceof Error && (e.name === 'NotFoundError' || e.message.startsWith('Path not found'))
-      if (notManaged && resolveInstanceKey(await readInstances(), id)) {
+      if (
+        e instanceof AdminInstanceNotFoundError &&
+        resolveInstanceKey(await readInstances(), id)
+      ) {
         log.error(`No admin-managed instance "${id}".`)
         log.dim(`  hint: it's a local bookmark — drop it with: astrale instance forget ${id}`)
         process.exit(1)
       }
-      fatal(e, opts)
+      await formatKernelError(e, isMachine(opts), undefined, opts.debug)
+      process.exit(1)
     }
   },
 } satisfies CommandDefinition

package/src/commands/instance/list.ts

@@ -7,7 +7,7 @@ import type { CommandDefinition } from '../../program/index'
 import { AstraleError } from '../../errors'
 import { listOwnedInstances } from '../../lib/admin-instance'
 import {
-  formatInstanceLocation,
+  formatInstanceState,
   type InstanceInfo,
   type OwnedInstanceInfo,
 } from '../../lib/admin-instance'
@@ -136,7 +136,7 @@ export function buildInstanceRows(
         name: twin?.active ? `${item.slug} ${chalk.green('*')}` : item.slug,
         kind: 'managed',
         url: item.url ?? '',
-        extra: [formatInstanceLocation(item), twin ? formatBookmarkConnection(twin) : '']
+        extra: [formatInstanceState(item), twin ? formatBookmarkConnection(twin) : '']
           .filter(Boolean)
           .join(' · '),
       })

package/src/commands/instance/status.ts

@@ -3,44 +3,90 @@ import chalk from 'chalk'
 import type { KernelCommandOpts } from '../../connection'
 import type { CommandDefinition } from '../../program/index'
 
+import { formatKernelError } from '../../connection/errors'
 import { AstraleError } from '../../errors'
-import { statusOwnedInstance } from '../../lib/admin-instance'
+import { statusOwnedInstance, type InstanceInfo } from '../../lib/admin-instance'
 import { ADMIN_TARGET_OPTIONS, type AdminTargetCommandOpts } from '../../lib/admin-target'
-import { fatal, log, withSpinner } from '../../lib/log'
+import { resolveInstance } from '../../lib/instance'
+import { log, withSpinner } from '../../lib/log'
 import { isMachine, output, type RawOutputOpts } from '../../lib/output'
+import { probeBookmark } from './use'
 
-type StatusOpts = KernelCommandOpts & AdminTargetCommandOpts & RawOutputOpts
+type StatusOpts = KernelCommandOpts &
+  AdminTargetCommandOpts &
+  RawOutputOpts & { bookmarked?: boolean }
+
+interface BookmarkStatus {
+  readonly slug: string
+  readonly url: string
+  readonly issuer: string
+  readonly kind: 'bookmark'
+  readonly state: 'ready'
+}
 
 export default {
   name: 'status',
-  description: 'Show admin instance status',
+  description: 'Show managed instance status or probe a bookmark',
   arguments: [{ name: 'id', description: 'Instance slug', required: true }],
-  options: [...ADMIN_TARGET_OPTIONS],
+  options: [
+    ...ADMIN_TARGET_OPTIONS,
+    { flags: '--bookmarked', description: 'Probe a locally bookmarked kernel connection' },
+  ],
   action: async (id: string, opts: StatusOpts) => {
     try {
       const result = await withSpinner(`Fetching instance ${id}`, !isMachine(opts), () =>
-        statusOwnedInstance(opts, id).catch((error) => {
-          if (!(error instanceof Error) || error.name !== 'NotFoundError') throw error
-          throw new AstraleError(
-            'INSTANCE_NOT_FOUND',
-            `No owned instance matches "${id}".`,
-            'Run `astrale instance list` to see your instances.',
-          )
-        }),
+        resolveStatus(id, opts),
       )
       if (isMachine(opts)) {
         output(result, opts)
         return
       }
       console.log(`${chalk.bold(result.slug)} ${chalk.dim(result.url)}`)
-      log.dim(`  state: ${result.state}${result.phase ? ` (${result.phase})` : ''}`)
-      if (result.error) log.dim(`  error: ${result.error}`)
-      if (result.region) log.dim(`  region: ${result.region}`)
-      if (result.hostId) log.dim(`  host: ${result.hostId}`)
-      if (result.organizationId) log.dim(`  organization: ${result.organizationId}`)
-      if (result.createdAt) log.dim(`  created: ${result.createdAt}`)
+      const phase = 'phase' in result ? result.phase : undefined
+      log.dim(`  state: ${result.state}${phase ? ` (${phase})` : ''}`)
+      if ('error' in result && result.error) log.dim(`  error: ${result.error}`)
+      if ('organizationId' in result && result.organizationId)
+        log.dim(`  organization: ${result.organizationId}`)
+      if ('createdAt' in result && result.createdAt) log.dim(`  created: ${result.createdAt}`)
     } catch (e) {
-      fatal(e, opts)
+      await formatKernelError(e, isMachine(opts), undefined, opts.debug)
+      process.exit(1)
     }
   },
 } satisfies CommandDefinition
+
+export interface StatusDependencies {
+  readonly statusOwnedInstance: typeof statusOwnedInstance
+  readonly resolveInstance: typeof resolveInstance
+  readonly probeBookmark: typeof probeBookmark
+}
+
+const defaultStatusDependencies: StatusDependencies = Object.freeze({
+  statusOwnedInstance,
+  resolveInstance,
+  probeBookmark,
+})
+
+export async function resolveStatus(
+  id: string,
+  opts: StatusOpts,
+  dependencies: StatusDependencies = defaultStatusDependencies,
+): Promise<InstanceInfo | BookmarkStatus> {
+  if (!opts.bookmarked) return dependencies.statusOwnedInstance(opts, id)
+  if (opts.admin !== undefined || opts.adminUrl !== undefined || opts.domainIssuer !== undefined) {
+    throw new AstraleError(
+      'INVALID_FLAG',
+      '--bookmarked cannot be combined with Admin target options.',
+      'Remove --bookmarked to inspect managed lifecycle, or remove the Admin options to probe a local bookmark.',
+    )
+  }
+  const bookmark = await dependencies.resolveInstance(id, undefined, { persist: false })
+  await dependencies.probeBookmark(bookmark)
+  return Object.freeze({
+    slug: bookmark.name,
+    url: bookmark.url,
+    issuer: bookmark.issuer ?? bookmark.url,
+    kind: 'bookmark',
+    state: 'ready',
+  })
+}

package/src/commands/instance/use.ts

@@ -3,7 +3,7 @@ import type { CommandDefinition } from '../../program/index'
 
 import { AstraleError } from '../../errors'
 import { getDefault, setDefault } from '../../identity/index'
-import { listOwnedInstances } from '../../lib/admin-instance'
+import { listOwnedInstancesWithIdentity } from '../../lib/admin-instance'
 import { ADMIN_TARGET_OPTIONS } from '../../lib/admin-target'
 import { fetchWithCaFile } from '../../lib/ca-fetch'
 import {
@@ -143,7 +143,7 @@ const defaultBookmarkProbeDependencies: BookmarkProbeDependencies = Object.freez
 
 async function resolveUseTarget(name: string, opts: UseOpts): Promise<ResolvedInstance> {
   const [store, managed] = await Promise.all([readInstances(), fetchManagedInstances(name, opts)])
-  const candidates = collectInstanceCandidates(name, store, managed)
+  const candidates = collectInstanceCandidates(name, store, managed.instances)
 
   if (candidates.length === 0) {
     throw new AstraleError(
@@ -168,12 +168,13 @@ async function resolveUseTarget(name: string, opts: UseOpts): Promise<ResolvedIn
   }
 
   assertManagedReady(chosen.info)
-  const { repointedFrom } = await upsertManagedBookmark(
-    chosen.key,
-    chosen.info.slug,
-    chosen.url,
-    chosen.info.organizationId,
-  )
+  const { repointedFrom } = await upsertManagedBookmark({
+    key: chosen.key,
+    slug: chosen.info.slug,
+    url: chosen.url,
+    ...(chosen.info.organizationId ? { organizationId: chosen.info.organizationId } : {}),
+    ...(managed.identity ? { defaultIdentity: managed.identity } : {}),
+  })
   if (repointedFrom) {
     log.warn(`Bookmark "${chosen.key}" repointed: ${repointedFrom} → ${chosen.url}`)
   }
@@ -185,16 +186,19 @@ async function resolveUseTarget(name: string, opts: UseOpts): Promise<ResolvedIn
  * Best-effort: an unreachable or unauthenticated admin kernel degrades to
  * bookmark-only resolution.
  */
-async function fetchManagedInstances(name: string, opts: UseOpts): Promise<OwnedInstanceInfo[]> {
+async function fetchManagedInstances(
+  name: string,
+  opts: UseOpts,
+): Promise<{ readonly instances: OwnedInstanceInfo[]; readonly identity?: string }> {
   try {
     validateSlug(name)
   } catch {
-    return []
+    return { instances: [] }
   }
   try {
-    return await listOwnedInstances(opts)
+    return await listOwnedInstancesWithIdentity(opts)
   } catch {
-    return []
+    return { instances: [] }
   }
 }