@astrale-os/cli 1.0.0-beta.0 → 1.0.0-beta.10

package/src/commands/call-describe.ts

@@ -1,8 +1,9 @@
 import type { Path } from '@astrale-os/sdk/graph/path'
+import type { ResolvedFunction, ResolvedMethod } from '@astrale-os/sdk/schema'
 
-import { AstraleError } from '../errors'
+import { bundle, schema } from '@astrale-os/sdk/schema'
 
-type JsonRecord = Record<string, unknown>
+import { AstraleError } from '../errors'
 
 export interface CallableDescription {
   readonly path: string
@@ -18,40 +19,40 @@ export interface CallableDescription {
   readonly candidates?: readonly CallableDescription[]
 }
 
-/** Resolve one callable's input/output from an installed Domain schema document. */
-export function describeCallableFromSchema(
+/** Resolve one callable from an admitted installed Domain bundle. */
+export function describeCallableFromBundle(
   path: Path,
-  schema: unknown,
+  input: unknown,
 ): CallableDescription | undefined {
   if (path.ast.anchor.kind !== 'domain') return undefined
   const origin = path.ast.anchor.origin
   const last = path.ast.steps.at(-1)
-  const document = asRecord(schema)
-  if (document === undefined || last === undefined) return undefined
+  if (last === undefined) return undefined
+  const domain = schema.resolve(bundle.accept(input).root)
+  if (domain.origin !== origin) return undefined
 
   if (last.kind === 'method') {
-    const owner = path.ast.steps.at(-2)
-    if (
-      owner?.kind === 'projection' &&
-      (owner.projection.kind === 'class' || owner.projection.kind === 'interface')
-    ) {
-      const bag = asRecord(
-        owner.projection.kind === 'class' ? document.classes : document.interfaces,
+    const ownerStep = path.ast.steps.at(-2)
+    if (ownerStep?.kind === 'projection' && ownerStep.projection.kind === 'class') {
+      const owner = domain.classes[ownerStep.projection.name]
+      if (owner?.kind !== 'node') return undefined
+      const method = namedMethod(
+        last.dispatch === 'static' ? owner.static.methods : owner.methods,
+        last.name,
+        last.dispatch,
       )
-      const definition = asRecord(bag?.[owner.projection.name])
-      const method = asRecord(asRecord(definition?.methods)?.[last.name])
-      if (method !== undefined) {
-        return Object.freeze({
-          path: path.raw,
-          origin,
-          class: owner.projection.name,
-          method: last.name,
-          dispatch: last.dispatch,
-          ...callableFields(method),
-        })
-      }
+      return method === undefined
+        ? undefined
+        : description(path, origin, owner.ref.name, method, last.dispatch)
     }
-    const matches = findNamedMethods(document, origin, path.raw, last.name, last.dispatch)
+
+    const matches = Object.values(domain.classes).flatMap((owner) => {
+      if (owner.kind !== 'node') return []
+      const method = namedMethod(owner.methods, last.name, last.dispatch)
+      return method === undefined
+        ? []
+        : [description(path, origin, owner.ref.name, method, last.dispatch)]
+    })
     if (matches.length === 1) return matches[0]
     if (matches.length > 1) {
       return Object.freeze({
@@ -66,13 +67,13 @@ export function describeCallableFromSchema(
   }
 
   if (last.kind === 'projection' && last.projection.kind === 'function') {
-    const fn = asRecord(asRecord(document.functions)?.[last.projection.name])
-    if (fn === undefined) return undefined
+    const callable = domain.functions[last.projection.name]
+    if (callable === undefined) return undefined
     return Object.freeze({
       path: path.raw,
       origin,
-      function: last.projection.name,
-      ...callableFields(fn),
+      function: callable.ref.name,
+      ...callableFields(callable),
     })
   }
   return undefined
@@ -82,50 +83,41 @@ export function missingCallableDescription(path: string): AstraleError {
   return new AstraleError(
     'CALL_DESCRIBE_UNAVAILABLE',
     `No callable schema is installed for ${path}.`,
-    'Use a Domain-rooted Path such as /:host.astrale.ai:class.Manager:createInstance. Method Paths are not Function nodes.',
+    'Use a Domain-rooted Path such as /:kernel.astrale.ai:class.Identity:whois. Method Paths are not Function nodes.',
   )
 }
 
-function findNamedMethods(
-  schema: JsonRecord,
+function namedMethod(
+  methods: Iterable<ResolvedMethod>,
+  name: string,
+  dispatch: 'static' | 'instance',
+): ResolvedMethod | undefined {
+  const expectedStatic = dispatch === 'static'
+  return [...methods].find((method) => method.name === name && method.static === expectedStatic)
+}
+
+function description(
+  path: Path,
   origin: string,
-  path: string,
-  method: string,
+  className: string,
+  callable: ResolvedMethod,
   dispatch: 'static' | 'instance',
-): CallableDescription[] {
-  const matches: CallableDescription[] = []
-  for (const bag of [schema.classes, schema.interfaces]) {
-    const definitions = asRecord(bag)
-    if (definitions === undefined) continue
-    for (const [className, definition] of Object.entries(definitions)) {
-      const methodDef = asRecord(asRecord(asRecord(definition)?.methods)?.[method])
-      if (methodDef === undefined) continue
-      matches.push(
-        Object.freeze({
-          path,
-          origin,
-          class: className,
-          method,
-          dispatch,
-          ...callableFields(methodDef),
-        }),
-      )
-    }
-  }
-  return matches
+): CallableDescription {
+  return Object.freeze({
+    path: path.raw,
+    origin,
+    class: className,
+    method: callable.name,
+    dispatch,
+    ...callableFields(callable),
+  })
 }
 
-function callableFields(value: JsonRecord): Partial<CallableDescription> {
+function callableFields(callable: ResolvedFunction | ResolvedMethod): Partial<CallableDescription> {
   return {
-    ...(typeof value.description === 'string' ? { description: value.description } : {}),
-    ...(value.auth === undefined ? {} : { auth: value.auth }),
-    ...(value.input === undefined ? {} : { input: value.input }),
-    ...(value.output === undefined ? {} : { output: value.output }),
+    ...(callable.description === undefined ? {} : { description: callable.description }),
+    auth: callable.auth,
+    input: callable.input,
+    output: callable.output,
   }
 }
-
-function asRecord(input: unknown): JsonRecord | undefined {
-  return input !== null && typeof input === 'object' && !Array.isArray(input)
-    ? (input as JsonRecord)
-    : undefined
-}

package/src/commands/call.ts

@@ -5,7 +5,7 @@ import type { CommandDefinition } from '../program/index'
 
 import { createPathCall, expandSelfInCall, runKernelCommand, withSelfHint } from '../connection'
 import { presentBinary } from '../lib/binary'
-import { failClosed, log } from '../lib/log'
+import { failInput, log } from '../lib/log'
 import { output, present } from '../lib/output'
 
 type CallOpts = KernelCommandOpts & {
@@ -24,60 +24,47 @@ export async function callCommand(
   rawParams: string[],
   opts: CallOpts,
 ): Promise<void> {
-  // Expand @self before describe/execute through authenticated Identity.whoami.
-  let expanded: Awaited<ReturnType<typeof expandSelfInCall>>
-  try {
-    expanded = await expandSelfInCall(path, rawParams, opts)
-  } catch (error) {
-    failClosed(error, opts)
-  }
-  const expandedPath = expanded.path
-  try {
-    Path.parse(expandedPath)
-  } catch (error) {
-    failClosed(error, opts)
-  }
-
-  // ── Parse params ────────────────────────────────────────
   let params: Record<string, unknown>
   try {
-    params = await parseParams([...expanded.parameters], opts.data)
-  } catch (e) {
-    failClosed(e, opts)
-  }
-
-  // ── Dry-run: show what would be sent ─────────────────────
-  if (opts.dryRun) {
-    output({ method: expandedPath, params }, opts)
-    return
+    Path.parse(path)
+    params = await parseParams(rawParams, opts.data)
+  } catch (error) {
+    failInput(error, opts)
   }
 
-  // ── Execute ────────────────────────────────────────────
-  await runKernelCommand<MaterializedCallResult>({
-    opts,
-    label: expandedPath,
-    fn: (ctx) =>
-      withSelfHint(
-        async () =>
-          materializeCallResult(await ctx.session.dispatch(createPathCall(expandedPath, params))),
-        expanded.meta,
-      ),
-    format: async (result, fmtOpts) => {
-      switch (result.kind) {
-        case 'value':
-          present(result.value, fmtOpts)
-          return
-        case 'binary':
-          await presentBinary(result.value, fmtOpts, { outFile: opts.output })
-          return
-        case 'stream':
-          output(result.values, fmtOpts)
-          return
-        case 'redirect':
-          throw new Error('Client Session returned an unresolved redirect.')
-      }
+  await runKernelCommand<MaterializedCallResult | { readonly kind: 'dry'; readonly call: unknown }>(
+    {
+      opts,
+      label: path,
+      fn: async (ctx) => {
+        const expanded = await expandSelfInCall(path, params, ctx)
+        const request = createPathCall(expanded.path, expanded.parameters)
+        if (opts.dryRun) return { kind: 'dry', call: request }
+        return withSelfHint(
+          async () => materializeCallResult(await ctx.session.dispatch(request)),
+          expanded.meta,
+        )
+      },
+      format: async (result, fmtOpts) => {
+        switch (result.kind) {
+          case 'dry':
+            output(result.call, fmtOpts)
+            return
+          case 'value':
+            present(result.value, fmtOpts)
+            return
+          case 'binary':
+            await presentBinary(result.value, fmtOpts, { outFile: opts.output })
+            return
+          case 'stream':
+            output(result.values, fmtOpts)
+            return
+          case 'redirect':
+            throw new Error('Client Session returned an unresolved redirect.')
+        }
+      },
     },
-  })
+  )
 }
 
 /** Drain a session-backed stream before the command-scoped Client Session closes. */
@@ -101,7 +88,7 @@ export async function parseParams(
     try {
       return JSON.parse(dataFlag)
     } catch {
-      throw new Error(`Invalid JSON in --data: ${dataFlag}`)
+      throw new TypeError(`Invalid JSON in --data: ${dataFlag}`)
     }
   }
 
@@ -114,7 +101,7 @@ export async function parseParams(
     try {
       return JSON.parse(stdin)
     } catch {
-      throw new Error('Invalid JSON from stdin')
+      throw new TypeError('Invalid JSON from stdin')
     }
   }
 
@@ -142,7 +129,7 @@ export function parseKeyValue(pairs: string[]): Record<string, unknown> {
   for (const pair of pairs) {
     const eqIdx = pair.indexOf('=')
     if (eqIdx === -1) {
-      throw new Error(`Invalid param "${pair}" — expected key=value format`)
+      throw new TypeError(`Invalid param "${pair}" — expected key=value format`)
     }
     const key = pair.slice(0, eqIdx)
     const raw = pair.slice(eqIdx + 1)
@@ -150,7 +137,7 @@ export function parseKeyValue(pairs: string[]): Record<string, unknown> {
       const hint = key.endsWith(':')
         ? ` (looks like httpie's "key:=value" syntax — Astrale CLI doesn't support it; use --data '{"${key.slice(0, -1)}":<value>}' for nested values)`
         : ` (keys must be identifier-shaped: letters, digits, underscore, hyphen)`
-      throw new Error(`Invalid param key "${key}" in "${pair}"${hint}`)
+      throw new TypeError(`Invalid param key "${key}" in "${pair}"${hint}`)
     }
     result[key] = coerceValue(raw)
   }
@@ -194,7 +181,7 @@ Self-reference:
   Callable input/output lives on astrale introspect <path>.
 
 Examples:
-  $ astrale introspect /:host.astrale.ai:class.Manager:createInstance
+  $ astrale introspect /:kernel.astrale.ai:class.Identity:whois
   $ astrale call /:blog.acme.com:class.Author:list limit=10
   $ astrale call '@self::deactivate'
   $ astrale call /:kernel.astrale.ai:function.journal --data '{"limit":5}' --json
@@ -203,7 +190,7 @@ Examples:
     {
       name: 'path',
       description:
-        'Operation path (e.g., /:host.astrale.ai:class.Manager:createInstance or /node::method)',
+        'Operation path (e.g., /:kernel.astrale.ai:class.Identity:whois or /node::method)',
     },
     { name: 'params...', description: 'Params as key=value pairs', required: false },
   ],

package/src/commands/domain/install.ts

@@ -1,5 +1,5 @@
 import { Path } from '@astrale-os/sdk/graph/path'
-import { syscalls } from '@astrale-os/sdk/schema/kernel'
+import { K } from '@astrale-os/sdk/schema'
 import chalk from 'chalk'
 
 import type { KernelCommandOpts } from '../../connection'
@@ -15,6 +15,7 @@ import {
 } from '../../lib/admin-domain'
 import { listOwnedInstancesInContext, type OwnedInstanceInfo } from '../../lib/admin-instance'
 import { ADMIN_TARGET_OPTIONS, type AdminTargetCommandOpts } from '../../lib/admin-target'
+import { fetchDomainPublication } from '../../lib/domain-publication'
 import { getActive } from '../../lib/instance'
 import { fatal, log, withSpinner } from '../../lib/log'
 import { isMachine, output } from '../../lib/output'
@@ -413,7 +414,7 @@ export async function installDirect(
     fn: async ({ session }) =>
       (await session.call(
         createPathCall(
-          Path.project(syscalls.install.ref).raw,
+          Path.project(K.functions.install.ref).raw,
           directInstallCallInput(url, operation, opts.token),
         ),
       )) as DirectInstallResult,
@@ -429,11 +430,11 @@ export async function installDirect(
       log.dim(`  operation:   ${result.operation}`)
       // Belt-and-braces: the kernel-confirmed origin is authoritative. If it
       // aliases the host and the pre-install gate never consented to THAT
-      // origin (lying or absent `/meta`), say so loudly after the fact.
+      // origin (lying or unavailable Publication), say so loudly after the fact.
       if (isIdentityOverride(installed.origin, host) && installed.origin !== consentedOrigin) {
         log.warn(
           `Installed origin "${installed.origin}" differs from the serving host "${host}" ` +
-            `and was not confirmed before install (the worker's /meta did not declare it). ` +
+            `and was not confirmed before install (the worker Publication was unavailable). ` +
             `Every ${installed.origin}/* call on this instance now routes to ${host}.`,
         )
       }
@@ -478,10 +479,10 @@ export function isIdentityOverride(origin: string, host: string): boolean {
  * Claiming an origin that differs from the serving host is an explicit actAs
  * and needs typed consent (or `--allow-identity-override` in scripts).
  *
- * The pre-install check reads the worker's self-reported `/meta.origin`,
+ * The pre-install check reads the worker's canonical Publication origin,
  * so it is consent UX, not enforcement — a hostile worker can lie here, and
  * the kernel anchors the cryptographic identity (`iss`) on the real URL
- * regardless. When `/meta` is unreachable or silent on the origin, the gate
+ * regardless. When the Publication is unreachable or invalid, the gate
  * degrades to a warning and the kernel-confirmed origin is re-checked after
  * install (see `format` above).
  *
@@ -496,7 +497,8 @@ async function ensureIdentityOverrideConsent(
   const origin = await probeDeclaredOrigin(url)
   if (origin === undefined) {
     log.warn(
-      `Could not read a declared origin from ${new URL('/meta', url).href} — ` +
+      `Could not read a declared origin from ` +
+        `${new URL('/.well-known/astrale/domain.json', url).href} — ` +
         `skipping the pre-install identity check (the installed origin is verified after install).`,
     )
     return undefined
@@ -534,19 +536,13 @@ async function ensureIdentityOverrideConsent(
   return origin
 }
 
-/** Best-effort read of the worker's declared origin from its `/meta` probe. */
+/** Best-effort read of the worker's origin from its admitted canonical Publication. */
 export async function probeDeclaredOrigin(url: string): Promise<string | undefined> {
   try {
-    const res = await fetch(new URL('/meta', url), { signal: AbortSignal.timeout(10_000) })
-    if (!res.ok) return undefined
-    // SDK workers serve `origin`; `domainName` is the pre-Kernel-V2 name, kept
-    // as a fallback for workers deployed before the rename.
-    const body = (await res.json()) as { origin?: unknown; domainName?: unknown }
-    const declared = body.origin ?? body.domainName
-    return typeof declared === 'string' && declared.length > 0 ? declared : undefined
+    return (await fetchDomainPublication(url, AbortSignal.timeout(10_000))).origin
   } catch {
-    // Unreachable /meta is not fatal here: the caller warns and the install
-    // itself will surface a dead worker with its own error.
+    // An unreachable or invalid Publication is not fatal here: the caller warns
+    // and the install itself will surface a dead worker with its own error.
     return undefined
   }
 }

package/src/commands/domain/list.ts

@@ -6,6 +6,7 @@ import type { CommandDefinition } from '../../program/index'
 
 import { listAdminDomains, type DomainInfo } from '../../lib/admin-domain'
 import { ADMIN_TARGET_OPTIONS, type AdminTargetCommandOpts } from '../../lib/admin-target'
+import { fetchDomainPublication } from '../../lib/domain-publication'
 import { fatal, withSpinner } from '../../lib/log'
 import { isMachine, presentList } from '../../lib/output'
 
@@ -23,7 +24,7 @@ type ListOpts = KernelCommandOpts &
 /** A catalog entry, optionally enriched with a live `--check` probe. */
 export type DomainRow = DomainInfo & {
   reachable?: boolean
-  schemaHash?: string
+  schemaRevision?: string
   checkError?: string | null
 }
 
@@ -72,9 +73,9 @@ Behavior:
   or with --json/--raw (agent-friendly — full DomainInfo objects). -q prints
   one install URL per line (pipeable into \`domain install\`); --count prints
   only the number. --default-only keeps the install-by-default entries (what
-  every new instance gets via alphaCreate). --check probes each published URL's
-  /meta and adds a live/unreachable STATUS column (+ reachable/schemaHash in
-  machine output).
+  every new instance receives during Admin-managed provisioning). --check probes each published URL's
+  canonical Publication and adds a live/unreachable STATUS column
+  (+ reachable/schemaRevision in machine output).
 
   The admin kernel is selected like every admin op — the configured default,
   or --admin <bookmark> / --admin-url <url>.
@@ -87,7 +88,10 @@ Examples:
 `,
   options: [
     ...ADMIN_TARGET_OPTIONS,
-    { flags: '--check', description: "Probe each domain's URL for reachability + schema hash" },
+    {
+      flags: '--check',
+      description: "Probe each domain's canonical Publication + schema revision",
+    },
     { flags: '--default-only', description: 'Only show install-by-default domains' },
     { flags: '-q, --quiet', description: 'One install URL per line (unix-pipeable)' },
     { flags: '--count', description: 'Print only the number of published domains' },
@@ -103,7 +107,7 @@ Examples:
           const filtered = opts.defaultOnly ? list.filter((d) => d.installByDefault) : list
           filtered.sort(byDefaultThenName)
           if (!opts.check) return filtered as DomainRow[]
-          // Reachability is a direct client-side /meta fetch per entry, in
+          // Reachability is a direct client-side Publication fetch per entry, in
           // parallel — no admin round-trip, and version-independent of the
           // admin worker (mirrors `domain install`'s probeDeclaredOrigin).
           return Promise.all(filtered.map(probe))
@@ -129,19 +133,20 @@ export function byDefaultThenName(a: DomainInfo, b: DomainInfo): number {
 
 /**
  * Enrich one entry with a reachability probe: fetch the published worker's
- * `/meta` (the same endpoint the admin `DomainEntry.check` hits) and read its
- * schema hash. A dead / missing url is itself a result, not a throw.
+ * canonical Publication and read its schema revision. A dead or missing URL is
+ * itself a result, not a throw.
  */
-async function probe(d: DomainInfo): Promise<DomainRow> {
+export async function probe(d: DomainInfo): Promise<DomainRow> {
   if (!d.url) return { ...d, reachable: false, checkError: 'no url published' }
   try {
-    const res = await fetch(new URL('/meta', d.url), { signal: AbortSignal.timeout(10_000) })
-    if (!res.ok) return { ...d, reachable: false, checkError: `meta HTTP ${res.status}` }
-    const meta = (await res.json()) as { schemaHash?: unknown }
+    const deployed = await fetchDomainPublication(d.url, AbortSignal.timeout(10_000))
+    if (deployed.origin !== d.origin) {
+      throw new Error(`Domain origin mismatch: deployed=${deployed.origin} expected=${d.origin}`)
+    }
     return {
       ...d,
       reachable: true,
-      ...(typeof meta.schemaHash === 'string' ? { schemaHash: meta.schemaHash } : {}),
+      schemaRevision: deployed.schema.revision,
       checkError: null,
     }
   } catch (err) {

package/src/commands/domain/publish.ts

@@ -3,9 +3,11 @@ import chalk from 'chalk'
 import type { KernelCommandOpts } from '../../connection'
 import type { CommandDefinition } from '../../program/index'
 
+import { formatKernelError } from '../../connection/errors'
 import { publishAdminDomain } from '../../lib/admin-domain'
 import { ADMIN_TARGET_OPTIONS, type AdminTargetCommandOpts } from '../../lib/admin-target'
-import { fatal, withSpinner } from '../../lib/log'
+import { domainPublicationUrl } from '../../lib/domain-publication'
+import { withSpinner } from '../../lib/log'
 import { isMachine, output } from '../../lib/output'
 import { promptText } from '../../lib/prompt'
 import { isHttpUrl, validateName, validateUrl } from '../../lib/validation'
@@ -48,9 +50,9 @@ Behavior:
 
   Publishing only makes the domain INSTALLABLE. Mount it on an instance with
   \`astrale domain install <url>\` (or rely on the admin's install-by-default
-  policy). This is usually invoked for you by \`astrale-domain publish\` (which
-  registers the already-deployed URL — it does NOT deploy) or by
-  \`astrale-domain deploy --publish\` (deploy AND register in one step).
+  policy). Deployment and catalog publication are separate owners: run the
+  project's \`astrale-domain deploy <environment>\`, then publish its observed
+  public URL with this command.
 
   Run in a terminal with flags omitted and it PROMPTS for origin / name /
   public-url (origin defaults to the URL host, name to the origin's first
@@ -68,17 +70,16 @@ Examples:
     { flags: '--description <text>', description: 'Optional human description for the catalog' },
     {
       flags: '--install-by-default',
-      description: 'Mark the domain for install on every new instance (alphaCreate)',
+      description: 'Mark the domain for install on every new instance',
     },
   ],
   // No positional arguments → Commander passes (opts, command); `opts` is first.
   action: async (opts: PublishOpts) => {
     try {
       // Interactive fill (TTY only): a human running this by hand is prompted for
-      // any missing field. The primary caller — `astrale-domain publish` — always
-      // passes every flag, so it never prompts. No TTY / --ci / --no-prompt / CI
-      // env → no prompt: fall straight through to the required-flag error below,
-      // so a piped / agent / LLM run fails fast instead of hanging on a read.
+      // any missing field. Automation passes every flag. No TTY / --ci /
+      // --no-prompt / CI env means no prompt: fall straight through to the
+      // required-flag error below so a piped or agent run fails fast.
       const interactive = !!process.stdin.isTTY && !(opts.ci || opts.noPrompt || process.env.CI)
       let { origin, name, publicUrl } = opts
       if (interactive) {
@@ -102,6 +103,7 @@ Examples:
       validateName(origin, 'origin')
       validateName(name, 'domain')
       validateUrl(publicUrl)
+      const discoveryUrl = domainPublicationUrl(publicUrl).href
 
       const result = await withSpinner(
         `Publishing ${name} → ${publicUrl}`,
@@ -110,7 +112,7 @@ Examples:
           publishAdminDomain(opts, {
             origin,
             name,
-            url: publicUrl,
+            url: discoveryUrl,
             ...(opts.description ? { description: opts.description } : {}),
             ...(opts.installByDefault ? { installByDefault: true } : {}),
           }),
@@ -127,7 +129,8 @@ Examples:
         return
       }
     } catch (e) {
-      fatal(e)
+      await formatKernelError(e, isMachine(opts), undefined, opts.debug)
+      process.exit(1)
     }
   },
 } satisfies CommandDefinition

package/src/commands/domain/uninstall.ts

@@ -1,5 +1,5 @@
 import { Path } from '@astrale-os/sdk/graph/path'
-import { syscalls } from '@astrale-os/sdk/schema/kernel'
+import { K } from '@astrale-os/sdk/schema'
 import chalk from 'chalk'
 
 import type { KernelCommandOpts } from '../../connection'
@@ -77,7 +77,7 @@ Examples:
       label: `Uninstalling domain ${origin}`,
       fn: async ({ session }) =>
         (await session.call(
-          createPathCall(Path.project(syscalls.uninstall.ref).raw, uninstallCallInput(origin)),
+          createPathCall(Path.project(K.functions.uninstall.ref).raw, uninstallCallInput(origin)),
         )) as UninstallResult,
       format: (result, formatOpts, machine) => {
         if (machine) {

package/src/commands/get.ts

@@ -4,40 +4,39 @@ import type { KernelCommandOpts } from '../connection'
 import type { CommandDefinition } from '../program/index'
 
 import { expandSelfInPath, runKernelCommand, withSelfHint } from '../connection'
-import { formatKernelError } from '../connection/errors'
 import { AstraleError } from '../errors'
-import { denoise, isMachine, output } from '../lib/output'
+import { failInput, fatal } from '../lib/log'
+import { denoise, output } from '../lib/output'
 
 type GetOpts = KernelCommandOpts & { schema?: boolean }
 
 /** Read one exact canonical Node. The caller's Path is not fabricated into the Node value. */
 export async function getCommand(target: string, opts: GetOpts): Promise<void> {
-  let path: string
-  let meta
   let parsed
   try {
-    ;({ path, meta } = await expandSelfInPath(target, opts))
-    parsed = Path.parse(path)
+    parsed = Path.parse(target)
   } catch (error) {
-    await formatKernelError(error, isMachine(opts), undefined, opts.debug)
-    process.exit(1)
+    failInput(error, opts)
   }
 
   const last = parsed.ast.steps.at(-1)
   if (last?.kind === 'method') {
     const error = new AstraleError(
       'NOT_A_NODE',
-      `${path} is a callable Path, not a Node.`,
-      `Use \`astrale call ${path}\` or \`astrale introspect ${path}\`.`,
+      `${target} is a callable Path, not a Node.`,
+      `Use \`astrale call ${target}\` or \`astrale introspect ${target}\`.`,
     )
-    await formatKernelError(error, isMachine(opts), undefined, opts.debug)
-    process.exit(1)
+    fatal(error, opts)
   }
 
   await runKernelCommand({
     opts,
-    label: `Node ${path}`,
-    fn: ({ graph }) => withSelfHint(() => graph.getOrThrow(parsed), meta),
+    label: `Node ${target}`,
+    fn: async (context) => {
+      const { path, meta } = await expandSelfInPath(target, context)
+      const resolved = meta === undefined ? parsed : Path.parse(path)
+      return withSelfHint(() => context.graph.getOrThrow(resolved), meta)
+    },
     format: (node, format) => output(opts.schema === true ? node : denoise(node), format),
   })
 }
@@ -60,7 +59,7 @@ Examples:
   $ astrale get /:notes.example.dev:class.Note
   $ astrale get @abc123 --json
   $ astrale get @self
-  $ astrale get /:host.astrale.ai --schema
+  $ astrale get /:kernel.astrale.ai --schema
 `,
   arguments: [{ name: 'target', description: 'Canonical Node Path or @id' }],
   options: [{ flags: '--schema', description: 'Include schema-valued properties' }],