@astrale-os/cli 1.0.0-beta.32 → 1.0.0-beta.43

package/src/commands/domain/list.ts

@@ -1,155 +0,0 @@
-import chalk from 'chalk'
-
-import type { KernelCommandOpts } from '../../connection'
-import type { ListProjection, RawOutputOpts } from '../../lib/output'
-import type { CommandDefinition } from '../../program/index'
-
-import { listAdminDomains, type DomainInfo } from '../../lib/admin-domain'
-import { ADMIN_TARGET_OPTIONS, type AdminTargetCommandOpts } from '../../lib/admin-target'
-import { fetchDomainPublication } from '../../lib/domain-publication'
-import { fatal, withSpinner } from '../../lib/log'
-import { isMachine, presentList } from '../../lib/output'
-
-type ListOpts = KernelCommandOpts &
-  AdminTargetCommandOpts &
-  RawOutputOpts & {
-    check?: boolean
-    defaultOnly?: boolean
-    quiet?: boolean
-    count?: boolean
-    long?: boolean
-    format?: 'yaml' | 'json'
-  }
-
-/** A catalog entry, optionally enriched with a live `--check` probe. */
-export type DomainRow = DomainInfo & {
-  reachable?: boolean
-  schemaRevision?: string
-  checkError?: string | null
-}
-
-/**
- * Catalog rows for the human table. `paths` is the published URL (falling back
- * to origin) so `astrale domain list -q | xargs -I{} astrale domain install {}`
- * composes — install takes a URL. The STATUS column is dropped by `renderTable`
- * unless `--check` filled it in.
- */
-export function domainProjection(items: DomainRow[]): ListProjection {
-  return {
-    columns: [
-      { key: 'name', header: 'NAME', color: chalk.bold },
-      { key: 'origin', header: 'ORIGIN', color: chalk.cyan },
-      { key: 'url', header: 'URL', color: chalk.dim },
-      { key: 'default', header: 'DEFAULT' },
-      { key: 'status', header: 'STATUS' },
-    ],
-    rows: items.map((d) => ({
-      name: d.name,
-      origin: d.origin,
-      url: d.url ?? chalk.dim('(unpublished)'),
-      default: d.installByDefault ? chalk.green('default') : '',
-      status: statusCell(d),
-    })),
-    paths: items.map((d) => d.url ?? d.origin),
-  }
-}
-
-function statusCell(d: DomainRow): string {
-  if (d.reachable === undefined) return ''
-  return d.reachable ? chalk.green('● live') : chalk.red(`○ ${d.checkError ?? 'unreachable'}`)
-}
-
-export default {
-  name: 'list',
-  description: 'List domains published in the admin catalog (DomainEntry.list)',
-  afterHelpText: `
-Behavior:
-  Reads the admin catalog — every domain that has been \`publish\`ed
-  (origin → published worker URL). Listing only shows what is INSTALLABLE;
-  what is actually mounted where lives on each instance's own graph
-  (\`astrale query\` against that instance).
-
-  Default output is a NAME/ORIGIN/URL/DEFAULT table on a TTY, JSON when piped
-  or with --json/--raw (agent-friendly — full DomainInfo objects). -q prints
-  one install URL per line (pipeable into \`domain install\`); --count prints
-  only the number. --default-only keeps the install-by-default entries (what
-  every new instance receives during Admin-managed provisioning). --check probes each published URL's
-  canonical Publication and adds a live/unreachable STATUS column
-  (+ reachable/schemaRevision in machine output).
-
-  The admin kernel is selected like every admin op — the configured default,
-  or --admin <bookmark> / --admin-url <url>.
-
-Examples:
-  $ astrale domain list
-  $ astrale domain list --check
-  $ astrale domain list --default-only -q
-  $ astrale domain list --json | jq -r '.[].url'
-`,
-  options: [
-    ...ADMIN_TARGET_OPTIONS,
-    {
-      flags: '--check',
-      description: "Probe each domain's canonical Publication + schema revision",
-    },
-    { flags: '--default-only', description: 'Only show install-by-default domains' },
-    { flags: '-q, --quiet', description: 'One install URL per line (unix-pipeable)' },
-    { flags: '--count', description: 'Print only the number of published domains' },
-    { flags: '-l, --long', description: 'Full catalog records in machine output' },
-  ],
-  action: async (opts: ListOpts) => {
-    try {
-      const domains = await withSpinner(
-        'Fetching domains',
-        !isMachine(opts),
-        async (): Promise<DomainRow[]> => {
-          const list = await listAdminDomains(opts)
-          const filtered = opts.defaultOnly ? list.filter((d) => d.installByDefault) : list
-          filtered.sort(byDefaultThenName)
-          if (!opts.check) return filtered as DomainRow[]
-          // Reachability is a direct client-side Publication fetch per entry, in
-          // parallel — no admin round-trip, and version-independent of the
-          // admin worker (mirrors `domain install`'s probeDeclaredOrigin).
-          return Promise.all(filtered.map(probe))
-        },
-      )
-
-      presentList(
-        domains,
-        { ...opts, quiet: opts.quiet, count: opts.count, long: opts.long },
-        domainProjection,
-      )
-    } catch (e) {
-      fatal(e)
-    }
-  },
-} satisfies CommandDefinition
-
-/** Install-by-default first, then alphabetical by origin — a stable display order. */
-export function byDefaultThenName(a: DomainInfo, b: DomainInfo): number {
-  if (!!a.installByDefault !== !!b.installByDefault) return a.installByDefault ? -1 : 1
-  return a.origin.localeCompare(b.origin)
-}
-
-/**
- * Enrich one entry with a reachability probe: fetch the published worker's
- * canonical Publication and read its schema revision. A dead or missing URL is
- * itself a result, not a throw.
- */
-export async function probe(d: DomainInfo): Promise<DomainRow> {
-  if (!d.url) return { ...d, reachable: false, checkError: 'no url published' }
-  try {
-    const deployed = await fetchDomainPublication(d.url, AbortSignal.timeout(10_000))
-    if (deployed.origin !== d.origin) {
-      throw new Error(`Domain origin mismatch: deployed=${deployed.origin} expected=${d.origin}`)
-    }
-    return {
-      ...d,
-      reachable: true,
-      schemaRevision: deployed.schema.revision,
-      checkError: null,
-    }
-  } catch (err) {
-    return { ...d, reachable: false, checkError: err instanceof Error ? err.message : String(err) }
-  }
-}

package/src/commands/domain/publish.ts

@@ -1,136 +0,0 @@
-import chalk from 'chalk'
-
-import type { KernelCommandOpts } from '../../connection'
-import type { CommandDefinition } from '../../program/index'
-
-import { formatKernelError } from '../../connection/errors'
-import { publishAdminDomain } from '../../lib/admin-domain'
-import { ADMIN_TARGET_OPTIONS, type AdminTargetCommandOpts } from '../../lib/admin-target'
-import { domainPublicationUrl } from '../../lib/domain-publication'
-import { withSpinner } from '../../lib/log'
-import { isMachine, output } from '../../lib/output'
-import { promptText } from '../../lib/prompt'
-import { isHttpUrl, validateName, validateUrl } from '../../lib/validation'
-
-type PublishOpts = KernelCommandOpts &
-  AdminTargetCommandOpts & {
-    origin?: string
-    name?: string
-    // `--public-url`, not `--url`: the global `--url` already means "target this
-    // kernel" (KERNEL_PASSTHROUGH_OPTIONS). This is the domain's own public
-    // address the kernel installs from — named for the role, not the substrate.
-    publicUrl?: string
-    description?: string
-    installByDefault?: boolean
-    // Global flags (program.ts) that force non-interactive — mirrors `instance use`.
-    ci?: boolean
-    noPrompt?: boolean
-  }
-
-/** Host of a URL (the natural `origin` default), or undefined if unparseable. */
-function hostOf(url?: string): string | undefined {
-  if (!url) return undefined
-  try {
-    return new URL(url).host
-  } catch {
-    return undefined
-  }
-}
-
-export default {
-  name: 'publish',
-  description: 'Register a deployed domain in the admin catalog (DomainEntry.publish)',
-  afterHelpText: `
-Behavior:
-  Upserts a catalog entry on the configured admin kernel: a domain's addressing
-  \`origin\`, registry \`name\`, and published \`url\` (no bytes, no version — the
-  author deploys the worker independently; publish just points the registry at
-  it). Idempotent: re-publishing the same name updates its url — and a publish
-  that would change nothing is reported as "already up to date" (no write).
-
-  Publishing only makes the domain INSTALLABLE. Mount it on an instance with
-  \`astrale domain install <url>\` (or rely on the admin's install-by-default
-  policy). Deployment and catalog publication are separate owners: run the
-  project's \`astrale-domain deploy <environment>\`, then publish its observed
-  public URL with this command.
-
-  Run in a terminal with flags omitted and it PROMPTS for origin / name /
-  public-url (origin defaults to the URL host, name to the origin's first
-  label). With no TTY — or \`--ci\` / \`--no-prompt\` — those three are required
-  up front, so piped / CI / agent runs fail fast instead of waiting on input.
-
-Examples:
-  $ astrale domain publish --origin crm.acme.dev --name crm --public-url https://crm.acme.dev
-`,
-  options: [
-    ...ADMIN_TARGET_OPTIONS,
-    { flags: '--origin <origin>', description: 'Domain addressing origin (e.g. crm.acme.dev)' },
-    { flags: '--name <name>', description: 'Registry name / catalog slug (e.g. crm)' },
-    { flags: '--public-url <url>', description: 'Public URL the kernel installs the domain from' },
-    { flags: '--description <text>', description: 'Optional human description for the catalog' },
-    {
-      flags: '--install-by-default',
-      description: 'Mark the domain for install on every new instance',
-    },
-  ],
-  // No positional arguments → Commander passes (opts, command); `opts` is first.
-  action: async (opts: PublishOpts) => {
-    try {
-      // Interactive fill (TTY only): a human running this by hand is prompted for
-      // any missing field. Automation passes every flag. No TTY / --ci /
-      // --no-prompt / CI env means no prompt: fall straight through to the
-      // required-flag error below so a piped or agent run fails fast.
-      const interactive = !!process.stdin.isTTY && !(opts.ci || opts.noPrompt || process.env.CI)
-      let { origin, name, publicUrl } = opts
-      if (interactive) {
-        if (!publicUrl)
-          publicUrl = await promptText('Public URL (https://…)', {
-            validate: (v) => isHttpUrl(v) || 'Enter a valid http(s) URL',
-          })
-        if (!origin)
-          origin = await promptText('Domain origin (e.g. crm.acme.dev)', {
-            default: hostOf(publicUrl),
-          })
-        if (!name) name = await promptText('Registry name', { default: origin?.split('.')[0] })
-      }
-
-      if (!origin || !name || !publicUrl) {
-        throw new Error(
-          'domain publish requires --origin, --name and --public-url, e.g.\n' +
-            '  astrale domain publish --origin crm.acme.dev --name crm --public-url https://crm.acme.dev',
-        )
-      }
-      validateName(origin, 'origin')
-      validateName(name, 'domain')
-      validateUrl(publicUrl)
-      const discoveryUrl = domainPublicationUrl(publicUrl).href
-
-      const result = await withSpinner(
-        `Publishing ${name} → ${publicUrl}`,
-        !isMachine(opts),
-        () =>
-          publishAdminDomain(opts, {
-            origin,
-            name,
-            url: discoveryUrl,
-            ...(opts.description ? { description: opts.description } : {}),
-            ...(opts.installByDefault ? { installByDefault: true } : {}),
-          }),
-        {
-          success: ({ entry, changed, isNew }) =>
-            changed
-              ? `${isNew ? 'Published' : 'Updated'}: ${entry.name} ${chalk.dim(`(${entry.origin} → ${entry.url})`)}`
-              : `Already up to date: ${entry.name} ${chalk.dim(`(${entry.origin} → ${entry.url} — no change, already latest)`)}`,
-        },
-      )
-
-      if (isMachine(opts)) {
-        output({ ...result.entry, changed: result.changed }, opts)
-        return
-      }
-    } catch (e) {
-      await formatKernelError(e, isMachine(opts), undefined, opts.debug)
-      process.exit(1)
-    }
-  },
-} satisfies CommandDefinition

package/src/commands/domain/uninstall.ts

@@ -1,128 +0,0 @@
-import { Path } from '@astrale-os/sdk/graph/path'
-import { K } from '@astrale-os/sdk/schema'
-import chalk from 'chalk'
-
-import type { KernelCommandOpts } from '../../connection'
-import type { CommandDefinition } from '../../program/index'
-
-import { createPathCall, runKernelCommand } from '../../connection'
-import { AstraleError } from '../../errors'
-import { fatal, log } from '../../lib/log'
-import { output } from '../../lib/output'
-import { confirmWithInput } from '../../lib/prompt'
-
-type UninstallOpts = KernelCommandOpts & {
-  readonly yes?: boolean
-  readonly ci?: boolean
-  readonly noPrompt?: boolean
-}
-
-type UninstallResult = {
-  readonly operation: string
-  readonly transition: {
-    readonly intent: {
-      readonly origin: string
-    }
-  }
-}
-
-/** Public Kernel uninstall syscall input for one installed Domain origin. */
-export function uninstallCallInput(
-  origin: string,
-  operation: string = crypto.randomUUID(),
-): Readonly<{ operation: string; origin: string }> {
-  return Object.freeze({ operation, origin })
-}
-
-export default {
-  name: 'uninstall',
-  description: 'Uninstall a domain from an instance through the public Kernel syscall',
-  afterHelpText: `
-Behavior:
-  Removes one installed Domain origin from the target instance. The Kernel
-  refuses the operation while another installed Domain depends on it or while
-  business data still uses its schema. Uninstall never deletes business data.
-  Type the exact origin to confirm, or pass --yes in automation.
-
-  Use this before reinstalling only when an immutable Domain property (such as
-  its issuer) intentionally changed. Ordinary compatible upgrades should use
-  domain install directly and preserve the existing Domain identity.
-
-Examples:
-  $ astrale domain uninstall grc.example -i staging
-  $ astrale domain uninstall grc.example -i staging --yes --json
-`,
-  arguments: [
-    {
-      name: 'origin',
-      description: 'Installed Domain origin to remove',
-      required: true,
-    },
-  ],
-  options: [
-    {
-      flags: '--yes',
-      description: 'Confirm Domain uninstall without prompting',
-    },
-  ],
-  action: async (origin: string, opts: UninstallOpts) => {
-    try {
-      await confirmUninstall(origin, opts)
-    } catch (error) {
-      fatal(error, opts)
-    }
-
-    await runKernelCommand<UninstallResult>({
-      opts,
-      label: `Uninstalling domain ${origin}`,
-      fn: async ({ session }) =>
-        (await session.call(
-          createPathCall(Path.project(K.functions.uninstall.ref).raw, uninstallCallInput(origin)),
-        )) as UninstallResult,
-      format: (result, formatOpts, machine) => {
-        if (machine) {
-          output(result, formatOpts)
-          return
-        }
-        log.success(`Domain uninstalled: ${result.transition.intent.origin}`)
-        log.dim(`  operation: ${result.operation}`)
-      },
-    })
-  },
-} satisfies CommandDefinition
-
-async function confirmUninstall(origin: string, opts: UninstallOpts): Promise<void> {
-  if (opts.yes) return
-
-  const nonInteractive =
-    opts.ci ||
-    opts.noPrompt ||
-    process.env.CI ||
-    process.argv.includes('--ci') ||
-    process.argv.includes('--no-prompt') ||
-    !process.stdin.isTTY
-  if (nonInteractive) {
-    throw new AstraleError(
-      'CONFIRMATION_REQUIRED',
-      `Uninstalling Domain "${origin}" requires explicit confirmation.`,
-      `Re-run with --yes: astrale domain uninstall ${origin} --yes`,
-    )
-  }
-
-  const warning =
-    chalk.red.bold('⚠  DANGER — DOMAIN UNINSTALL') +
-    '\n' +
-    chalk.dim('│') +
-    `  origin     ${chalk.bold(origin)}\n` +
-    chalk.dim('│') +
-    '\n' +
-    chalk.dim('│') +
-    '  This removes the installed Domain from the target instance.\n' +
-    chalk.dim('│') +
-    '  This command never deletes business data.\n' +
-    chalk.dim('│') +
-    '  The Kernel refuses removal while dependents or business data remain.'
-  if (!(await confirmWithInput(warning, origin))) {
-    throw new AstraleError('UNINSTALL_CANCELLED', `Domain uninstall cancelled for "${origin}".`)
-  }
-}

package/src/commands/get.ts

@@ -1,69 +0,0 @@
-import { Path } from '@astrale-os/sdk/graph/path'
-
-import type { KernelCommandOpts } from '../connection'
-import type { CommandDefinition } from '../program/index'
-
-import { expandSelfInPath, runKernelCommand, withSelfHint } from '../connection'
-import { AstraleError } from '../errors'
-import { failInput, fatal } from '../lib/log'
-import { denoise, output } from '../lib/output'
-
-type GetOpts = KernelCommandOpts & { schema?: boolean }
-
-/** Read one exact canonical Node. The caller's Path is not fabricated into the Node value. */
-export async function getCommand(target: string, opts: GetOpts): Promise<void> {
-  let parsed
-  try {
-    parsed = Path.parse(target)
-  } catch (error) {
-    failInput(error, opts)
-  }
-
-  const last = parsed.ast.steps.at(-1)
-  if (last?.kind === 'method') {
-    const error = new AstraleError(
-      'NOT_A_NODE',
-      `${target} is a callable Path, not a Node.`,
-      `Use \`astrale call ${target}\` or \`astrale introspect ${target}\`.`,
-    )
-    fatal(error, opts)
-  }
-
-  await runKernelCommand({
-    opts,
-    label: `Node ${target}`,
-    fn: async (context) => {
-      const { path, meta } = await expandSelfInPath(target, context)
-      const resolved = meta === undefined ? parsed : Path.parse(path)
-      return withSelfHint(() => context.graph.getOrThrow(resolved), meta)
-    },
-    format: (node, format) => output(opts.schema === true ? node : denoise(node), format),
-  })
-}
-
-export default {
-  name: 'get',
-  description: 'Get one canonical node by Path or ID',
-  afterHelpText: `
-Behavior:
-  Resolves one exact Kernel Path and prints the canonical Node
-  { id, class, props }. Missing and authorization-masked nodes remain
-  intentionally indistinguishable. @self is expanded before dispatch.
-
-  A Node does not contain a synthetic path, labels, or backend class ID.
-  Method Paths are not Nodes — use call / introspect. Schema-valued
-  properties are omitted unless --schema is passed. Use query for
-  graph-shaped reads.
-
-Examples:
-  $ astrale get /:notes.example.dev:class.Note
-  $ astrale get @abc123 --json
-  $ astrale get @self
-  $ astrale get /:kernel.astrale.ai --schema
-`,
-  arguments: [{ name: 'target', description: 'Canonical Node Path or @id' }],
-  options: [{ flags: '--schema', description: 'Include schema-valued properties' }],
-  action: async (target, opts) => {
-    await getCommand(target as string, opts as GetOpts)
-  },
-} satisfies CommandDefinition

package/src/commands/identity/__tests__/register.test.ts

@@ -1,93 +0,0 @@
-import { issuer, jwk, provision } from '@astrale-os/sdk/auth'
-import { normalizeProperties } from '@astrale-os/sdk/graph/properties'
-import { expect, mock, test } from 'bun:test'
-import { exportJWK, generateKeyPair, jwtVerify } from 'jose'
-
-import { classKey } from '../../../graph'
-import { formatIdentityRegistration, prepareIdentityProvision } from '../register'
-
-/** @evidence TEST-CLI-IDENTITY-REGISTER-JSON-EXACT */
-test('emits exactly one structured value for machine registration output', () => {
-  const writes: string[] = []
-  const logs: string[] = []
-  const originalWrite = process.stdout.write
-  const originalLog = console.log
-  process.stdout.write = mock((chunk: string | Uint8Array) => {
-    writes.push(typeof chunk === 'string' ? chunk : new TextDecoder().decode(chunk))
-    return true
-  }) as typeof process.stdout.write
-  console.log = mock((...values: unknown[]) => logs.push(values.map(String).join(' ')))
-
-  try {
-    formatIdentityRegistration(
-      { iss: 'https://identity.example', sub: 'self', nodeId: 'operator-node' },
-      { json: true },
-      true,
-    )
-  } finally {
-    process.stdout.write = originalWrite
-    console.log = originalLog
-  }
-
-  expect(JSON.parse(writes.join(''))).toEqual({
-    iss: 'https://identity.example',
-    sub: 'self',
-    nodeId: 'operator-node',
-  })
-  expect(logs).toEqual([])
-})
-
-test('builds one exact Mutation V3 identity birth bound to a self proof', async () => {
-  const { privateKey, publicKey } = await generateKeyPair('ES256', { extractable: true })
-  const privateJwk = { ...(await exportJWK(privateKey)), alg: 'ES256', kid: 'alice-key' }
-  const publicJwk = jwk.acceptPublic({
-    ...(await exportJWK(publicKey)),
-    alg: 'ES256',
-    kid: 'alice-key',
-  })
-  const kernelIssuer = issuer.accept('https://kernel.example')
-  const classPath = classKey('/:accounts.example:class.User', '--class')
-  const properties = normalizeProperties({
-    'accounts.example:class.User.property.name': 'Alice',
-  })
-
-  const prepared = await prepareIdentityProvision({
-    name: 'alice',
-    classPath,
-    properties,
-    privateKey: privateJwk,
-    publicKey: publicJwk,
-    kernelIssuer,
-  })
-
-  expect(String(prepared.binding)).toBe('identity')
-  expect(prepared.request.idempotencyKey).toBe('identity-register:alice')
-  expect(JSON.parse(JSON.stringify(prepared.request.mutation))).toEqual({
-    format: 'astrale.graph.mutation',
-    version: 'v3',
-    preconditions: [],
-    operations: [
-      {
-        op: 'node.create',
-        as: 'identity',
-        class: 'accounts.example:class.User',
-        props: { 'accounts.example:class.User.property.name': 'Alice' },
-      },
-    ],
-  })
-
-  const credentials = prepared.request.identities[prepared.binding]?.credentials
-  expect(credentials?.publicKey).toEqual(publicJwk)
-  expect(typeof credentials?.proof).toBe('string')
-  if (typeof credentials?.proof !== 'string') throw new TypeError('Expected compact JWT proof')
-
-  const expectedFingerprint = await provision.fingerprint(prepared.request)
-  const expectedIssuer = await provision.selfIssuer(kernelIssuer, publicJwk)
-  const verified = await jwtVerify(credentials.proof, publicKey, {
-    algorithms: ['ES256'],
-    issuer: expectedIssuer,
-    subject: 'self',
-    audience: kernelIssuer,
-  })
-  expect(verified.payload.provision).toBe(expectedFingerprint)
-})

package/src/commands/identity/create.ts

@@ -1,35 +0,0 @@
-import type { CommandDefinition } from '../../program/index'
-
-import { createIdentity } from '../../identity/index'
-import { fatal, log } from '../../lib/log'
-import { isMachine, output, RAW_OUTPUT_OPTIONS, type RawOutputOpts } from '../../lib/output'
-
-export default {
-  name: 'create',
-  description: 'Create a new identity',
-  arguments: [{ name: 'name', description: 'Identity name', required: true }],
-  options: [
-    { flags: '--subject <sub>', description: 'Custom subject (defaults to name)' },
-    { flags: '--local', description: 'Local-only identity (default)' },
-    { flags: '--remote', description: 'Remote (cloud-synced) identity — requires cloud login' },
-    ...RAW_OUTPUT_OPTIONS,
-  ],
-  action: async (
-    name: string,
-    opts: { subject?: string; local?: boolean; remote?: boolean } & RawOutputOpts,
-  ) => {
-    try {
-      const mode = opts.remote ? 'remote' : 'local'
-      const identity = await createIdentity(name, { subject: opts.subject, mode })
-      if (isMachine(opts)) {
-        output({ name, ...identity }, opts)
-        return
-      }
-      log.success(
-        `Created identity "${name}" (subject: ${identity.subject}, mode: ${identity.mode})`,
-      )
-    } catch (e) {
-      fatal(e, opts)
-    }
-  },
-} satisfies CommandDefinition

package/src/commands/identity/delete.ts

@@ -1,24 +0,0 @@
-import type { CommandDefinition } from '../../program/index'
-
-import { deleteIdentity } from '../../identity/index'
-import { fatal, log } from '../../lib/log'
-import { isMachine, output, RAW_OUTPUT_OPTIONS, type RawOutputOpts } from '../../lib/output'
-
-export default {
-  name: 'delete',
-  description: 'Delete an identity',
-  arguments: [{ name: 'name', description: 'Identity name', required: true }],
-  options: [...RAW_OUTPUT_OPTIONS],
-  action: async (name: string, opts: RawOutputOpts) => {
-    try {
-      await deleteIdentity(name)
-      if (isMachine(opts)) {
-        output({ deleted: name }, opts)
-        return
-      }
-      log.success(`Deleted identity "${name}"`)
-    } catch (e) {
-      fatal(e, opts)
-    }
-  },
-} satisfies CommandDefinition

package/src/commands/identity/export.ts

@@ -1,46 +0,0 @@
-import type { CommandDefinition } from '../../program/index'
-
-import { encodeIdentityExport, exportIdentity, writeIdentityExport } from '../../identity/index'
-import { fatal, log } from '../../lib/log'
-import { isMachine, output, RAW_OUTPUT_OPTIONS, type RawOutputOpts } from '../../lib/output'
-import { readPassphrase } from '../../lib/prompt'
-
-/**
- * Export the per-identity keypair as a plaintext JWK envelope by default.
- * With `--encrypt`, wrap it in a JOSE JWE (PBES2-HS256+A128KW / A256GCM)
- * using a passphrase prompted from the TTY.
- */
-export default {
-  name: 'export',
-  description: 'Export an identity keypair to disk (optional --encrypt)',
-  arguments: [
-    { name: 'name', description: 'Identity name', required: true },
-    { name: 'path', description: 'Output file path', required: true },
-  ],
-  options: [
-    { flags: '--encrypt', description: 'Encrypt the envelope with a passphrase (JOSE JWE)' },
-    ...RAW_OUTPUT_OPTIONS,
-  ],
-  action: async (name: string, path: string, opts: { encrypt?: boolean } & RawOutputOpts) => {
-    try {
-      const envelope = await exportIdentity(name)
-      const passphrase = opts.encrypt
-        ? await readPassphrase('Passphrase (min 8 chars): ', { minLength: 8 })
-        : undefined
-      await writeIdentityExport(path, await encodeIdentityExport(envelope, passphrase))
-
-      if (isMachine(opts)) {
-        output({ name, path, encrypted: Boolean(opts.encrypt) }, opts)
-        return
-      }
-      log.success(`Exported identity "${name}" → ${path}${opts.encrypt ? ' (encrypted)' : ''}`)
-      if (!opts.encrypt) {
-        log.warn(
-          '  Plaintext private JWK — keep this file secure. Use --encrypt for passphrase wrapping.',
-        )
-      }
-    } catch (e) {
-      fatal(e, opts)
-    }
-  },
-} satisfies CommandDefinition