@astrale-os/cli 1.0.0-beta.9 → 1.0.0-npm-deprecated.0

package/src/commands/domain/publish.ts

@@ -1,136 +0,0 @@
-import chalk from 'chalk'
-
-import type { KernelCommandOpts } from '../../connection'
-import type { CommandDefinition } from '../../program/index'
-
-import { formatKernelError } from '../../connection/errors'
-import { publishAdminDomain } from '../../lib/admin-domain'
-import { ADMIN_TARGET_OPTIONS, type AdminTargetCommandOpts } from '../../lib/admin-target'
-import { domainPublicationUrl } from '../../lib/domain-publication'
-import { withSpinner } from '../../lib/log'
-import { isMachine, output } from '../../lib/output'
-import { promptText } from '../../lib/prompt'
-import { isHttpUrl, validateName, validateUrl } from '../../lib/validation'
-
-type PublishOpts = KernelCommandOpts &
-  AdminTargetCommandOpts & {
-    origin?: string
-    name?: string
-    // `--public-url`, not `--url`: the global `--url` already means "target this
-    // kernel" (KERNEL_PASSTHROUGH_OPTIONS). This is the domain's own public
-    // address the kernel installs from — named for the role, not the substrate.
-    publicUrl?: string
-    description?: string
-    installByDefault?: boolean
-    // Global flags (program.ts) that force non-interactive — mirrors `instance use`.
-    ci?: boolean
-    noPrompt?: boolean
-  }
-
-/** Host of a URL (the natural `origin` default), or undefined if unparseable. */
-function hostOf(url?: string): string | undefined {
-  if (!url) return undefined
-  try {
-    return new URL(url).host
-  } catch {
-    return undefined
-  }
-}
-
-export default {
-  name: 'publish',
-  description: 'Register a deployed domain in the admin catalog (DomainEntry.publish)',
-  afterHelpText: `
-Behavior:
-  Upserts a catalog entry on the configured admin kernel: a domain's addressing
-  \`origin\`, registry \`name\`, and published \`url\` (no bytes, no version — the
-  author deploys the worker independently; publish just points the registry at
-  it). Idempotent: re-publishing the same name updates its url — and a publish
-  that would change nothing is reported as "already up to date" (no write).
-
-  Publishing only makes the domain INSTALLABLE. Mount it on an instance with
-  \`astrale domain install <url>\` (or rely on the admin's install-by-default
-  policy). Deployment and catalog publication are separate owners: run the
-  project's \`astrale-domain deploy <environment>\`, then publish its observed
-  public URL with this command.
-
-  Run in a terminal with flags omitted and it PROMPTS for origin / name /
-  public-url (origin defaults to the URL host, name to the origin's first
-  label). With no TTY — or \`--ci\` / \`--no-prompt\` — those three are required
-  up front, so piped / CI / agent runs fail fast instead of waiting on input.
-
-Examples:
-  $ astrale domain publish --origin crm.acme.dev --name crm --public-url https://crm.acme.dev
-`,
-  options: [
-    ...ADMIN_TARGET_OPTIONS,
-    { flags: '--origin <origin>', description: 'Domain addressing origin (e.g. crm.acme.dev)' },
-    { flags: '--name <name>', description: 'Registry name / catalog slug (e.g. crm)' },
-    { flags: '--public-url <url>', description: 'Public URL the kernel installs the domain from' },
-    { flags: '--description <text>', description: 'Optional human description for the catalog' },
-    {
-      flags: '--install-by-default',
-      description: 'Mark the domain for install on every new instance',
-    },
-  ],
-  // No positional arguments → Commander passes (opts, command); `opts` is first.
-  action: async (opts: PublishOpts) => {
-    try {
-      // Interactive fill (TTY only): a human running this by hand is prompted for
-      // any missing field. Automation passes every flag. No TTY / --ci /
-      // --no-prompt / CI env means no prompt: fall straight through to the
-      // required-flag error below so a piped or agent run fails fast.
-      const interactive = !!process.stdin.isTTY && !(opts.ci || opts.noPrompt || process.env.CI)
-      let { origin, name, publicUrl } = opts
-      if (interactive) {
-        if (!publicUrl)
-          publicUrl = await promptText('Public URL (https://…)', {
-            validate: (v) => isHttpUrl(v) || 'Enter a valid http(s) URL',
-          })
-        if (!origin)
-          origin = await promptText('Domain origin (e.g. crm.acme.dev)', {
-            default: hostOf(publicUrl),
-          })
-        if (!name) name = await promptText('Registry name', { default: origin?.split('.')[0] })
-      }
-
-      if (!origin || !name || !publicUrl) {
-        throw new Error(
-          'domain publish requires --origin, --name and --public-url, e.g.\n' +
-            '  astrale domain publish --origin crm.acme.dev --name crm --public-url https://crm.acme.dev',
-        )
-      }
-      validateName(origin, 'origin')
-      validateName(name, 'domain')
-      validateUrl(publicUrl)
-      const discoveryUrl = domainPublicationUrl(publicUrl).href
-
-      const result = await withSpinner(
-        `Publishing ${name} → ${publicUrl}`,
-        !isMachine(opts),
-        () =>
-          publishAdminDomain(opts, {
-            origin,
-            name,
-            url: discoveryUrl,
-            ...(opts.description ? { description: opts.description } : {}),
-            ...(opts.installByDefault ? { installByDefault: true } : {}),
-          }),
-        {
-          success: ({ entry, changed, isNew }) =>
-            changed
-              ? `${isNew ? 'Published' : 'Updated'}: ${entry.name} ${chalk.dim(`(${entry.origin} → ${entry.url})`)}`
-              : `Already up to date: ${entry.name} ${chalk.dim(`(${entry.origin} → ${entry.url} — no change, already latest)`)}`,
-        },
-      )
-
-      if (isMachine(opts)) {
-        output({ ...result.entry, changed: result.changed }, opts)
-        return
-      }
-    } catch (e) {
-      await formatKernelError(e, isMachine(opts), undefined, opts.debug)
-      process.exit(1)
-    }
-  },
-} satisfies CommandDefinition

package/src/commands/domain/uninstall.ts

@@ -1,128 +0,0 @@
-import { Path } from '@astrale-os/sdk/graph/path'
-import { K } from '@astrale-os/sdk/schema'
-import chalk from 'chalk'
-
-import type { KernelCommandOpts } from '../../connection'
-import type { CommandDefinition } from '../../program/index'
-
-import { createPathCall, runKernelCommand } from '../../connection'
-import { AstraleError } from '../../errors'
-import { fatal, log } from '../../lib/log'
-import { output } from '../../lib/output'
-import { confirmWithInput } from '../../lib/prompt'
-
-type UninstallOpts = KernelCommandOpts & {
-  readonly yes?: boolean
-  readonly ci?: boolean
-  readonly noPrompt?: boolean
-}
-
-type UninstallResult = {
-  readonly operation: string
-  readonly transition: {
-    readonly intent: {
-      readonly origin: string
-    }
-  }
-}
-
-/** Public Kernel uninstall syscall input for one installed Domain origin. */
-export function uninstallCallInput(
-  origin: string,
-  operation: string = crypto.randomUUID(),
-): Readonly<{ operation: string; origin: string }> {
-  return Object.freeze({ operation, origin })
-}
-
-export default {
-  name: 'uninstall',
-  description: 'Uninstall a domain from an instance through the public Kernel syscall',
-  afterHelpText: `
-Behavior:
-  Removes one installed Domain origin from the target instance. The Kernel
-  refuses the operation while another installed Domain depends on it or while
-  business data still uses its schema. Uninstall never deletes business data.
-  Type the exact origin to confirm, or pass --yes in automation.
-
-  Use this before reinstalling only when an immutable Domain property (such as
-  its issuer) intentionally changed. Ordinary compatible upgrades should use
-  domain install directly and preserve the existing Domain identity.
-
-Examples:
-  $ astrale domain uninstall grc.example -i staging
-  $ astrale domain uninstall grc.example -i staging --yes --json
-`,
-  arguments: [
-    {
-      name: 'origin',
-      description: 'Installed Domain origin to remove',
-      required: true,
-    },
-  ],
-  options: [
-    {
-      flags: '--yes',
-      description: 'Confirm Domain uninstall without prompting',
-    },
-  ],
-  action: async (origin: string, opts: UninstallOpts) => {
-    try {
-      await confirmUninstall(origin, opts)
-    } catch (error) {
-      fatal(error, opts)
-    }
-
-    await runKernelCommand<UninstallResult>({
-      opts,
-      label: `Uninstalling domain ${origin}`,
-      fn: async ({ session }) =>
-        (await session.call(
-          createPathCall(Path.project(K.functions.uninstall.ref).raw, uninstallCallInput(origin)),
-        )) as UninstallResult,
-      format: (result, formatOpts, machine) => {
-        if (machine) {
-          output(result, formatOpts)
-          return
-        }
-        log.success(`Domain uninstalled: ${result.transition.intent.origin}`)
-        log.dim(`  operation: ${result.operation}`)
-      },
-    })
-  },
-} satisfies CommandDefinition
-
-async function confirmUninstall(origin: string, opts: UninstallOpts): Promise<void> {
-  if (opts.yes) return
-
-  const nonInteractive =
-    opts.ci ||
-    opts.noPrompt ||
-    process.env.CI ||
-    process.argv.includes('--ci') ||
-    process.argv.includes('--no-prompt') ||
-    !process.stdin.isTTY
-  if (nonInteractive) {
-    throw new AstraleError(
-      'CONFIRMATION_REQUIRED',
-      `Uninstalling Domain "${origin}" requires explicit confirmation.`,
-      `Re-run with --yes: astrale domain uninstall ${origin} --yes`,
-    )
-  }
-
-  const warning =
-    chalk.red.bold('⚠  DANGER — DOMAIN UNINSTALL') +
-    '\n' +
-    chalk.dim('│') +
-    `  origin     ${chalk.bold(origin)}\n` +
-    chalk.dim('│') +
-    '\n' +
-    chalk.dim('│') +
-    '  This removes the installed Domain from the target instance.\n' +
-    chalk.dim('│') +
-    '  This command never deletes business data.\n' +
-    chalk.dim('│') +
-    '  The Kernel refuses removal while dependents or business data remain.'
-  if (!(await confirmWithInput(warning, origin))) {
-    throw new AstraleError('UNINSTALL_CANCELLED', `Domain uninstall cancelled for "${origin}".`)
-  }
-}

package/src/commands/get.ts

@@ -1,69 +0,0 @@
-import { Path } from '@astrale-os/sdk/graph/path'
-
-import type { KernelCommandOpts } from '../connection'
-import type { CommandDefinition } from '../program/index'
-
-import { expandSelfInPath, runKernelCommand, withSelfHint } from '../connection'
-import { AstraleError } from '../errors'
-import { failInput, fatal } from '../lib/log'
-import { denoise, output } from '../lib/output'
-
-type GetOpts = KernelCommandOpts & { schema?: boolean }
-
-/** Read one exact canonical Node. The caller's Path is not fabricated into the Node value. */
-export async function getCommand(target: string, opts: GetOpts): Promise<void> {
-  let parsed
-  try {
-    parsed = Path.parse(target)
-  } catch (error) {
-    failInput(error, opts)
-  }
-
-  const last = parsed.ast.steps.at(-1)
-  if (last?.kind === 'method') {
-    const error = new AstraleError(
-      'NOT_A_NODE',
-      `${target} is a callable Path, not a Node.`,
-      `Use \`astrale call ${target}\` or \`astrale introspect ${target}\`.`,
-    )
-    fatal(error, opts)
-  }
-
-  await runKernelCommand({
-    opts,
-    label: `Node ${target}`,
-    fn: async (context) => {
-      const { path, meta } = await expandSelfInPath(target, context)
-      const resolved = meta === undefined ? parsed : Path.parse(path)
-      return withSelfHint(() => context.graph.getOrThrow(resolved), meta)
-    },
-    format: (node, format) => output(opts.schema === true ? node : denoise(node), format),
-  })
-}
-
-export default {
-  name: 'get',
-  description: 'Get one canonical node by Path or ID',
-  afterHelpText: `
-Behavior:
-  Resolves one exact Kernel V2 Path and prints the canonical Node
-  { id, class, props }. Missing and authorization-masked nodes remain
-  intentionally indistinguishable. @self is expanded before dispatch.
-
-  A Node does not contain a synthetic path, labels, or backend class ID.
-  Method Paths are not Nodes — use call / introspect. Schema-valued
-  properties are omitted unless --schema is passed. Use query for
-  graph-shaped reads.
-
-Examples:
-  $ astrale get /:notes.example.dev:class.Note
-  $ astrale get @abc123 --json
-  $ astrale get @self
-  $ astrale get /:kernel.astrale.ai --schema
-`,
-  arguments: [{ name: 'target', description: 'Canonical Node Path or @id' }],
-  options: [{ flags: '--schema', description: 'Include schema-valued properties' }],
-  action: async (target, opts) => {
-    await getCommand(target as string, opts as GetOpts)
-  },
-} satisfies CommandDefinition

package/src/commands/identity/__tests__/register.test.ts

@@ -1,93 +0,0 @@
-import { issuer, jwk, provision } from '@astrale-os/sdk/auth'
-import { normalizeProperties } from '@astrale-os/sdk/graph/properties'
-import { expect, mock, test } from 'bun:test'
-import { exportJWK, generateKeyPair, jwtVerify } from 'jose'
-
-import { classKey } from '../../../graph'
-import { formatIdentityRegistration, prepareIdentityProvision } from '../register'
-
-/** @evidence TEST-CLI-IDENTITY-REGISTER-JSON-EXACT */
-test('emits exactly one structured value for machine registration output', () => {
-  const writes: string[] = []
-  const logs: string[] = []
-  const originalWrite = process.stdout.write
-  const originalLog = console.log
-  process.stdout.write = mock((chunk: string | Uint8Array) => {
-    writes.push(typeof chunk === 'string' ? chunk : new TextDecoder().decode(chunk))
-    return true
-  }) as typeof process.stdout.write
-  console.log = mock((...values: unknown[]) => logs.push(values.map(String).join(' ')))
-
-  try {
-    formatIdentityRegistration(
-      { iss: 'https://identity.example', sub: 'self', nodeId: 'operator-node' },
-      { json: true },
-      true,
-    )
-  } finally {
-    process.stdout.write = originalWrite
-    console.log = originalLog
-  }
-
-  expect(JSON.parse(writes.join(''))).toEqual({
-    iss: 'https://identity.example',
-    sub: 'self',
-    nodeId: 'operator-node',
-  })
-  expect(logs).toEqual([])
-})
-
-test('builds one exact Mutation V3 identity birth bound to a self proof', async () => {
-  const { privateKey, publicKey } = await generateKeyPair('ES256', { extractable: true })
-  const privateJwk = { ...(await exportJWK(privateKey)), alg: 'ES256', kid: 'alice-key' }
-  const publicJwk = jwk.acceptPublic({
-    ...(await exportJWK(publicKey)),
-    alg: 'ES256',
-    kid: 'alice-key',
-  })
-  const kernelIssuer = issuer.accept('https://kernel.example')
-  const classPath = classKey('/:accounts.example:class.User', '--class')
-  const properties = normalizeProperties({
-    'accounts.example:class.User.property.name': 'Alice',
-  })
-
-  const prepared = await prepareIdentityProvision({
-    name: 'alice',
-    classPath,
-    properties,
-    privateKey: privateJwk,
-    publicKey: publicJwk,
-    kernelIssuer,
-  })
-
-  expect(String(prepared.binding)).toBe('identity')
-  expect(prepared.request.idempotencyKey).toBe('identity-register:alice')
-  expect(JSON.parse(JSON.stringify(prepared.request.mutation))).toEqual({
-    format: 'astrale.graph.mutation',
-    version: 'v3',
-    preconditions: [],
-    operations: [
-      {
-        op: 'node.create',
-        as: 'identity',
-        class: 'accounts.example:class.User',
-        props: { 'accounts.example:class.User.property.name': 'Alice' },
-      },
-    ],
-  })
-
-  const credentials = prepared.request.identities[prepared.binding]?.credentials
-  expect(credentials?.publicKey).toEqual(publicJwk)
-  expect(typeof credentials?.proof).toBe('string')
-  if (typeof credentials?.proof !== 'string') throw new TypeError('Expected compact JWT proof')
-
-  const expectedFingerprint = await provision.fingerprint(prepared.request)
-  const expectedIssuer = await provision.selfIssuer(kernelIssuer, publicJwk)
-  const verified = await jwtVerify(credentials.proof, publicKey, {
-    algorithms: ['ES256'],
-    issuer: expectedIssuer,
-    subject: 'self',
-    audience: kernelIssuer,
-  })
-  expect(verified.payload.provision).toBe(expectedFingerprint)
-})

package/src/commands/identity/create.ts

@@ -1,35 +0,0 @@
-import type { CommandDefinition } from '../../program/index'
-
-import { createIdentity } from '../../identity/index'
-import { fatal, log } from '../../lib/log'
-import { isMachine, output, RAW_OUTPUT_OPTIONS, type RawOutputOpts } from '../../lib/output'
-
-export default {
-  name: 'create',
-  description: 'Create a new identity',
-  arguments: [{ name: 'name', description: 'Identity name', required: true }],
-  options: [
-    { flags: '--subject <sub>', description: 'Custom subject (defaults to name)' },
-    { flags: '--local', description: 'Local-only identity (default)' },
-    { flags: '--remote', description: 'Remote (cloud-synced) identity — requires cloud login' },
-    ...RAW_OUTPUT_OPTIONS,
-  ],
-  action: async (
-    name: string,
-    opts: { subject?: string; local?: boolean; remote?: boolean } & RawOutputOpts,
-  ) => {
-    try {
-      const mode = opts.remote ? 'remote' : 'local'
-      const identity = await createIdentity(name, { subject: opts.subject, mode })
-      if (isMachine(opts)) {
-        output({ name, ...identity }, opts)
-        return
-      }
-      log.success(
-        `Created identity "${name}" (subject: ${identity.subject}, mode: ${identity.mode})`,
-      )
-    } catch (e) {
-      fatal(e, opts)
-    }
-  },
-} satisfies CommandDefinition

package/src/commands/identity/delete.ts

@@ -1,24 +0,0 @@
-import type { CommandDefinition } from '../../program/index'
-
-import { deleteIdentity } from '../../identity/index'
-import { fatal, log } from '../../lib/log'
-import { isMachine, output, RAW_OUTPUT_OPTIONS, type RawOutputOpts } from '../../lib/output'
-
-export default {
-  name: 'delete',
-  description: 'Delete an identity',
-  arguments: [{ name: 'name', description: 'Identity name', required: true }],
-  options: [...RAW_OUTPUT_OPTIONS],
-  action: async (name: string, opts: RawOutputOpts) => {
-    try {
-      await deleteIdentity(name)
-      if (isMachine(opts)) {
-        output({ deleted: name }, opts)
-        return
-      }
-      log.success(`Deleted identity "${name}"`)
-    } catch (e) {
-      fatal(e, opts)
-    }
-  },
-} satisfies CommandDefinition

package/src/commands/identity/export.ts

@@ -1,46 +0,0 @@
-import type { CommandDefinition } from '../../program/index'
-
-import { encodeIdentityExport, exportIdentity, writeIdentityExport } from '../../identity/index'
-import { fatal, log } from '../../lib/log'
-import { isMachine, output, RAW_OUTPUT_OPTIONS, type RawOutputOpts } from '../../lib/output'
-import { readPassphrase } from '../../lib/prompt'
-
-/**
- * Export the per-identity keypair as a plaintext JWK envelope by default.
- * With `--encrypt`, wrap it in a JOSE JWE (PBES2-HS256+A128KW / A256GCM)
- * using a passphrase prompted from the TTY.
- */
-export default {
-  name: 'export',
-  description: 'Export an identity keypair to disk (optional --encrypt)',
-  arguments: [
-    { name: 'name', description: 'Identity name', required: true },
-    { name: 'path', description: 'Output file path', required: true },
-  ],
-  options: [
-    { flags: '--encrypt', description: 'Encrypt the envelope with a passphrase (JOSE JWE)' },
-    ...RAW_OUTPUT_OPTIONS,
-  ],
-  action: async (name: string, path: string, opts: { encrypt?: boolean } & RawOutputOpts) => {
-    try {
-      const envelope = await exportIdentity(name)
-      const passphrase = opts.encrypt
-        ? await readPassphrase('Passphrase (min 8 chars): ', { minLength: 8 })
-        : undefined
-      await writeIdentityExport(path, await encodeIdentityExport(envelope, passphrase))
-
-      if (isMachine(opts)) {
-        output({ name, path, encrypted: Boolean(opts.encrypt) }, opts)
-        return
-      }
-      log.success(`Exported identity "${name}" → ${path}${opts.encrypt ? ' (encrypted)' : ''}`)
-      if (!opts.encrypt) {
-        log.warn(
-          '  Plaintext private JWK — keep this file secure. Use --encrypt for passphrase wrapping.',
-        )
-      }
-    } catch (e) {
-      fatal(e, opts)
-    }
-  },
-} satisfies CommandDefinition

package/src/commands/identity/import.ts

@@ -1,61 +0,0 @@
-import { readFile } from 'node:fs/promises'
-
-import type { CommandDefinition } from '../../program/index'
-
-import {
-  decodeIdentityExport,
-  importIdentity,
-  isEncryptedIdentityExport,
-} from '../../identity/index'
-import { fatal, log } from '../../lib/log'
-import { isMachine, output, RAW_OUTPUT_OPTIONS, type RawOutputOpts } from '../../lib/output'
-import { readPassphrase } from '../../lib/prompt'
-
-export default {
-  name: 'import',
-  description: 'Import an identity keypair envelope (auto-detects JWE)',
-  arguments: [{ name: 'path', description: 'Envelope file path', required: true }],
-  options: [
-    {
-      flags: '--name <name>',
-      description: 'Override identity name (defaults to envelope subject)',
-    },
-    {
-      flags: '--issuer <url>',
-      description: 'Default issuer for credentials signed with this imported key',
-    },
-    {
-      flags: '--replace',
-      description: 'Replace an existing key-backed identity with the imported keypair',
-    },
-    ...RAW_OUTPUT_OPTIONS,
-  ],
-  action: async (
-    path: string,
-    opts: { name?: string; issuer?: string; replace?: boolean } & RawOutputOpts,
-  ) => {
-    try {
-      const raw = await readFile(path, 'utf-8')
-      const passphrase = isEncryptedIdentityExport(raw)
-        ? await readPassphrase('Passphrase: ')
-        : undefined
-      const envelope = await decodeIdentityExport(raw, passphrase)
-      const name = opts.name ?? envelope.subject
-      const identity = await importIdentity(envelope, {
-        name,
-        issuer: opts.issuer,
-        replace: opts.replace,
-      })
-
-      if (isMachine(opts)) {
-        output({ name, ...identity }, opts)
-        return
-      }
-      log.success(
-        `Imported identity "${name}" (subject=${identity.subject}, kid=${identity.kid ?? '?'})`,
-      )
-    } catch (e) {
-      fatal(e, opts)
-    }
-  },
-} satisfies CommandDefinition

package/src/commands/identity/list.ts

@@ -1,56 +0,0 @@
-import chalk from 'chalk'
-
-import type { ListOpts, ListProjection } from '../../lib/output'
-import type { CommandDefinition } from '../../program/index'
-
-import { readIdentities } from '../../identity/index'
-import { log } from '../../lib/log'
-import { isMachine, presentList, RAW_OUTPUT_OPTIONS } from '../../lib/output'
-
-type IdentityRow = {
-  name: string
-  subject: string
-  source: string
-  idp?: string
-  default: boolean
-  createdAt?: string
-}
-
-function projection(items: IdentityRow[]): ListProjection {
-  return {
-    columns: [
-      { key: 'name', header: 'NAME', color: chalk.bold },
-      { key: 'subject', header: 'SUBJECT', color: chalk.dim },
-      { key: 'source', header: 'SOURCE', color: chalk.dim },
-    ],
-    rows: items.map((i) => ({
-      name: i.default ? `${i.name} ${chalk.green('*')}` : i.name,
-      subject: i.subject !== i.name ? i.subject : '',
-      source: i.source === 'idp' ? `idp:${i.idp ?? '?'}` : 'key',
-    })),
-    paths: items.map((i) => i.name),
-  }
-}
-
-export default {
-  name: 'list',
-  description: 'List all identities',
-  options: [...RAW_OUTPUT_OPTIONS],
-  action: async (opts: ListOpts) => {
-    const store = await readIdentities()
-    const items: IdentityRow[] = Object.entries(store.identities).map(([name, id]) => ({
-      name,
-      subject: id.subject,
-      source: id.source ?? 'key',
-      idp: id.idp,
-      default: name === store.default,
-      createdAt: id.createdAt,
-    }))
-
-    if (items.length === 0 && !isMachine(opts)) {
-      log.dim('  No identities. Run: astrale identity create <name>')
-      return
-    }
-    presentList(items, opts, projection)
-  },
-} satisfies CommandDefinition