@astrale-os/cli 1.0.0-beta.1 → 1.0.0-beta.10

package/src/commands/identity/__tests__/register.test.ts

@@ -1,9 +1,9 @@
 import { issuer, jwk, provision } from '@astrale-os/sdk/auth'
-import { ClassPath } from '@astrale-os/sdk/graph/class'
 import { normalizeProperties } from '@astrale-os/sdk/graph/properties'
 import { expect, mock, test } from 'bun:test'
 import { exportJWK, generateKeyPair, jwtVerify } from 'jose'
 
+import { classKey } from '../../../graph'
 import { formatIdentityRegistration, prepareIdentityProvision } from '../register'
 
 /** @evidence TEST-CLI-IDENTITY-REGISTER-JSON-EXACT */
@@ -46,7 +46,7 @@ test('builds one exact Mutation V3 identity birth bound to a self proof', async
     kid: 'alice-key',
   })
   const kernelIssuer = issuer.accept('https://kernel.example')
-  const classPath = ClassPath.parse('/:accounts.example:class.User')
+  const classPath = classKey('/:accounts.example:class.User', '--class')
   const properties = normalizeProperties({
     'accounts.example:class.User.property.name': 'Alice',
   })
@@ -70,7 +70,7 @@ test('builds one exact Mutation V3 identity birth bound to a self proof', async
       {
         op: 'node.create',
         as: 'identity',
-        class: '/:accounts.example:class.User',
+        class: 'accounts.example:class.User',
         props: { 'accounts.example:class.User.property.name': 'Alice' },
       },
     ],

package/src/commands/identity/register.ts

@@ -1,9 +1,9 @@
 import type { IssuerId, JsonWebKey, ProvisionRequest } from '@astrale-os/sdk/auth'
+import type { ClassKey as ClassKeyValue } from '@astrale-os/sdk/graph/class'
 import type { JWK } from 'jose'
 
 import { provision, jwk } from '@astrale-os/sdk/auth'
-import { ClassPath } from '@astrale-os/sdk/graph/class'
-import { LocalBinding } from '@astrale-os/sdk/graph/model'
+import { LocalBinding } from '@astrale-os/sdk/graph'
 import { normalizeProperties } from '@astrale-os/sdk/graph/properties'
 import { MutationAST } from '@astrale-os/sdk/mutation'
 import { importJWK, SignJWT } from 'jose'
@@ -14,6 +14,7 @@ import type { IdentityRegistrationResult } from '../../identity/index'
 import type { CommandDefinition } from '../../program/index'
 
 import { registrationKeyForTarget, runKernelCommand } from '../../connection'
+import { classKey } from '../../graph'
 import { getIdentity, setRegistration, submitIdentityProvision } from '../../identity/index'
 import { fileExists, keypairPaths } from '../../keys/index'
 import { fatal, log } from '../../lib/log'
@@ -83,7 +84,7 @@ Example:
 
       const privateKey = await readJwk(privatePath)
       const publicKey = jwk.acceptPublic(await readJwk(publicPath))
-      const classPath = ClassPath.parse(opts.class)
+      const classPath = classKey(opts.class, '--class')
       const properties = normalizeProperties(opts.props ? JSON.parse(opts.props) : {})
 
       await runKernelCommand<IdentityRegistrationResult>({
@@ -142,7 +143,7 @@ export function formatIdentityRegistration(
 /** Build and self-prove one exact canonical provision request for the target Kernel. */
 export async function prepareIdentityProvision(input: {
   readonly name: string
-  readonly classPath: ReturnType<typeof ClassPath.parse>
+  readonly classPath: ClassKeyValue
   readonly properties: ReturnType<typeof normalizeProperties>
   readonly privateKey: JWK
   readonly publicKey: JsonWebKey

package/src/commands/instance/create.ts

@@ -1,15 +1,12 @@
 import type { CommandDefinition } from '../../program/index'
 
+import { formatKernelError } from '../../connection/errors'
 import { ADMIN_TARGET_OPTIONS } from '../../lib/admin-target'
-import { fatal } from '../../lib/log'
 import { isMachine, output } from '../../lib/output'
 import { promptText } from '../../lib/prompt'
 import { provisionInstance, type ProvisionOpts } from '../../lib/provision-instance'
 import { validateSlug } from '../../lib/validation'
 
-// Re-exported for tests + `astrale setup`, which share the provisioning saga.
-export { assertAlphaCreateIdentity, parseEligibleHostIds } from '../../lib/provision-instance'
-
 /** inquirer `validate` for a slug: true when valid, else the human message. */
 function slugError(value: string): true | string {
   try {
@@ -22,12 +19,12 @@ function slugError(value: string): true | string {
 
 export default {
   name: 'create',
-  description: 'Provision an alpha instance through the admin kernel (Instance.alphaCreate)',
+  description: 'Provision an instance through the Admin control plane',
   afterHelpText: `
 Behavior:
-  Calls Instance.alphaCreate on the configured admin kernel. The caller must be
-  logged in with WorkOS. When --host-id is omitted, the admin kernel chooses the
-  caller's single eligible host. The new instance becomes the active instance.
+  Requests a new Instance from the configured Admin Domain. The caller must be
+  logged in with WorkOS. Admin owns infrastructure placement. The new instance
+  becomes the active instance.
 
   Run with no slug in a terminal and it prompts for one (validated live). With
   no TTY — or --ci / --no-prompt — the slug argument is required up front, so
@@ -38,13 +35,7 @@ Examples:
   $ astrale instance create demo
 `,
   arguments: [{ name: 'id', description: 'Instance slug', required: false }],
-  options: [
-    ...ADMIN_TARGET_OPTIONS,
-    {
-      flags: '--host-id <id>',
-      description: 'Advanced: host node id to provision on when multiple hosts are available',
-    },
-  ],
+  options: [...ADMIN_TARGET_OPTIONS],
   action: async (id: string | undefined, opts: ProvisionOpts) => {
     try {
       // Interactive (TTY only): prompt for the slug when omitted, with live
@@ -63,7 +54,8 @@ Examples:
         return
       }
     } catch (e) {
-      fatal(e, opts)
+      await formatKernelError(e, isMachine(opts), undefined, opts.debug)
+      process.exit(1)
     }
   },
 } satisfies CommandDefinition

package/src/commands/instance/delete.ts

@@ -1,10 +1,12 @@
 import type { KernelCommandOpts } from '../../connection'
 import type { CommandDefinition } from '../../program/index'
 
+import { AdminInstanceNotFoundError } from '../../admin/instance'
+import { formatKernelError } from '../../connection/errors'
 import { deleteOwnedInstance } from '../../lib/admin-instance'
 import { ADMIN_TARGET_OPTIONS, type AdminTargetCommandOpts } from '../../lib/admin-target'
 import { clearActive, readInstances, removeInstance, resolveInstanceKey } from '../../lib/instance'
-import { fatal, log, withSpinner } from '../../lib/log'
+import { log, withSpinner } from '../../lib/log'
 import { isMachine, output } from '../../lib/output'
 
 type DeleteOpts = KernelCommandOpts &
@@ -18,10 +20,9 @@ export default {
   afterHelpText: `
 Behavior:
   Calls Instance.delete on the configured admin kernel: best-effort decommission
-  of the instance's routing-registry entry + WorkOS org (frees the slug), then
-  removes the Instance record. The host kernel itself is NOT deregistered (the
-  deprovisioning saga is a follow-up). A same-name local bookmark is removed
-  after the delete succeeds unless --keep-bookmark is passed.
+  of the instance's route and tenant reservation, then removes the Instance
+  projection. A same-name local bookmark is removed after the delete succeeds
+  unless --keep-bookmark is passed.
 `,
   arguments: [{ name: 'id', description: 'Instance slug', required: true }],
   options: [
@@ -53,14 +54,16 @@ Behavior:
     } catch (e) {
       // Bookmark-only id → no admin Instance → kernel NOT_FOUND. Point to
       // `forget` (local drop) instead of surfacing the raw path error.
-      const notManaged =
-        e instanceof Error && (e.name === 'NotFoundError' || e.message.startsWith('Path not found'))
-      if (notManaged && resolveInstanceKey(await readInstances(), id)) {
+      if (
+        e instanceof AdminInstanceNotFoundError &&
+        resolveInstanceKey(await readInstances(), id)
+      ) {
         log.error(`No admin-managed instance "${id}".`)
         log.dim(`  hint: it's a local bookmark — drop it with: astrale instance forget ${id}`)
         process.exit(1)
       }
-      fatal(e, opts)
+      await formatKernelError(e, isMachine(opts), undefined, opts.debug)
+      process.exit(1)
     }
   },
 } satisfies CommandDefinition

package/src/commands/instance/list.ts

@@ -7,7 +7,7 @@ import type { CommandDefinition } from '../../program/index'
 import { AstraleError } from '../../errors'
 import { listOwnedInstances } from '../../lib/admin-instance'
 import {
-  formatInstanceLocation,
+  formatInstanceState,
   type InstanceInfo,
   type OwnedInstanceInfo,
 } from '../../lib/admin-instance'
@@ -136,7 +136,7 @@ export function buildInstanceRows(
         name: twin?.active ? `${item.slug} ${chalk.green('*')}` : item.slug,
         kind: 'managed',
         url: item.url ?? '',
-        extra: [formatInstanceLocation(item), twin ? formatBookmarkConnection(twin) : '']
+        extra: [formatInstanceState(item), twin ? formatBookmarkConnection(twin) : '']
           .filter(Boolean)
           .join(' · '),
       })

package/src/commands/instance/status.ts

@@ -3,44 +3,90 @@ import chalk from 'chalk'
 import type { KernelCommandOpts } from '../../connection'
 import type { CommandDefinition } from '../../program/index'
 
+import { formatKernelError } from '../../connection/errors'
 import { AstraleError } from '../../errors'
-import { statusOwnedInstance } from '../../lib/admin-instance'
+import { statusOwnedInstance, type InstanceInfo } from '../../lib/admin-instance'
 import { ADMIN_TARGET_OPTIONS, type AdminTargetCommandOpts } from '../../lib/admin-target'
-import { fatal, log, withSpinner } from '../../lib/log'
+import { resolveInstance } from '../../lib/instance'
+import { log, withSpinner } from '../../lib/log'
 import { isMachine, output, type RawOutputOpts } from '../../lib/output'
+import { probeBookmark } from './use'
 
-type StatusOpts = KernelCommandOpts & AdminTargetCommandOpts & RawOutputOpts
+type StatusOpts = KernelCommandOpts &
+  AdminTargetCommandOpts &
+  RawOutputOpts & { bookmarked?: boolean }
+
+interface BookmarkStatus {
+  readonly slug: string
+  readonly url: string
+  readonly issuer: string
+  readonly kind: 'bookmark'
+  readonly state: 'ready'
+}
 
 export default {
   name: 'status',
-  description: 'Show admin instance status',
+  description: 'Show managed instance status or probe a bookmark',
   arguments: [{ name: 'id', description: 'Instance slug', required: true }],
-  options: [...ADMIN_TARGET_OPTIONS],
+  options: [
+    ...ADMIN_TARGET_OPTIONS,
+    { flags: '--bookmarked', description: 'Probe a locally bookmarked kernel connection' },
+  ],
   action: async (id: string, opts: StatusOpts) => {
     try {
       const result = await withSpinner(`Fetching instance ${id}`, !isMachine(opts), () =>
-        statusOwnedInstance(opts, id).catch((error) => {
-          if (!(error instanceof Error) || error.name !== 'NotFoundError') throw error
-          throw new AstraleError(
-            'INSTANCE_NOT_FOUND',
-            `No owned instance matches "${id}".`,
-            'Run `astrale instance list` to see your instances.',
-          )
-        }),
+        resolveStatus(id, opts),
       )
       if (isMachine(opts)) {
         output(result, opts)
         return
       }
       console.log(`${chalk.bold(result.slug)} ${chalk.dim(result.url)}`)
-      log.dim(`  state: ${result.state}${result.phase ? ` (${result.phase})` : ''}`)
-      if (result.error) log.dim(`  error: ${result.error}`)
-      if (result.region) log.dim(`  region: ${result.region}`)
-      if (result.hostId) log.dim(`  host: ${result.hostId}`)
-      if (result.organizationId) log.dim(`  organization: ${result.organizationId}`)
-      if (result.createdAt) log.dim(`  created: ${result.createdAt}`)
+      const phase = 'phase' in result ? result.phase : undefined
+      log.dim(`  state: ${result.state}${phase ? ` (${phase})` : ''}`)
+      if ('error' in result && result.error) log.dim(`  error: ${result.error}`)
+      if ('organizationId' in result && result.organizationId)
+        log.dim(`  organization: ${result.organizationId}`)
+      if ('createdAt' in result && result.createdAt) log.dim(`  created: ${result.createdAt}`)
     } catch (e) {
-      fatal(e, opts)
+      await formatKernelError(e, isMachine(opts), undefined, opts.debug)
+      process.exit(1)
     }
   },
 } satisfies CommandDefinition
+
+export interface StatusDependencies {
+  readonly statusOwnedInstance: typeof statusOwnedInstance
+  readonly resolveInstance: typeof resolveInstance
+  readonly probeBookmark: typeof probeBookmark
+}
+
+const defaultStatusDependencies: StatusDependencies = Object.freeze({
+  statusOwnedInstance,
+  resolveInstance,
+  probeBookmark,
+})
+
+export async function resolveStatus(
+  id: string,
+  opts: StatusOpts,
+  dependencies: StatusDependencies = defaultStatusDependencies,
+): Promise<InstanceInfo | BookmarkStatus> {
+  if (!opts.bookmarked) return dependencies.statusOwnedInstance(opts, id)
+  if (opts.admin !== undefined || opts.adminUrl !== undefined || opts.domainIssuer !== undefined) {
+    throw new AstraleError(
+      'INVALID_FLAG',
+      '--bookmarked cannot be combined with Admin target options.',
+      'Remove --bookmarked to inspect managed lifecycle, or remove the Admin options to probe a local bookmark.',
+    )
+  }
+  const bookmark = await dependencies.resolveInstance(id, undefined, { persist: false })
+  await dependencies.probeBookmark(bookmark)
+  return Object.freeze({
+    slug: bookmark.name,
+    url: bookmark.url,
+    issuer: bookmark.issuer ?? bookmark.url,
+    kind: 'bookmark',
+    state: 'ready',
+  })
+}

package/src/commands/instance/use.ts

@@ -3,7 +3,7 @@ import type { CommandDefinition } from '../../program/index'
 
 import { AstraleError } from '../../errors'
 import { getDefault, setDefault } from '../../identity/index'
-import { listOwnedInstances } from '../../lib/admin-instance'
+import { listOwnedInstancesWithIdentity } from '../../lib/admin-instance'
 import { ADMIN_TARGET_OPTIONS } from '../../lib/admin-target'
 import { fetchWithCaFile } from '../../lib/ca-fetch'
 import {
@@ -143,7 +143,7 @@ const defaultBookmarkProbeDependencies: BookmarkProbeDependencies = Object.freez
 
 async function resolveUseTarget(name: string, opts: UseOpts): Promise<ResolvedInstance> {
   const [store, managed] = await Promise.all([readInstances(), fetchManagedInstances(name, opts)])
-  const candidates = collectInstanceCandidates(name, store, managed)
+  const candidates = collectInstanceCandidates(name, store, managed.instances)
 
   if (candidates.length === 0) {
     throw new AstraleError(
@@ -168,12 +168,13 @@ async function resolveUseTarget(name: string, opts: UseOpts): Promise<ResolvedIn
   }
 
   assertManagedReady(chosen.info)
-  const { repointedFrom } = await upsertManagedBookmark(
-    chosen.key,
-    chosen.info.slug,
-    chosen.url,
-    chosen.info.organizationId,
-  )
+  const { repointedFrom } = await upsertManagedBookmark({
+    key: chosen.key,
+    slug: chosen.info.slug,
+    url: chosen.url,
+    ...(chosen.info.organizationId ? { organizationId: chosen.info.organizationId } : {}),
+    ...(managed.identity ? { defaultIdentity: managed.identity } : {}),
+  })
   if (repointedFrom) {
     log.warn(`Bookmark "${chosen.key}" repointed: ${repointedFrom} → ${chosen.url}`)
   }
@@ -185,16 +186,19 @@ async function resolveUseTarget(name: string, opts: UseOpts): Promise<ResolvedIn
  * Best-effort: an unreachable or unauthenticated admin kernel degrades to
  * bookmark-only resolution.
  */
-async function fetchManagedInstances(name: string, opts: UseOpts): Promise<OwnedInstanceInfo[]> {
+async function fetchManagedInstances(
+  name: string,
+  opts: UseOpts,
+): Promise<{ readonly instances: OwnedInstanceInfo[]; readonly identity?: string }> {
   try {
     validateSlug(name)
   } catch {
-    return []
+    return { instances: [] }
   }
   try {
-    return await listOwnedInstances(opts)
+    return await listOwnedInstancesWithIdentity(opts)
   } catch {
-    return []
+    return { instances: [] }
   }
 }
 

package/src/commands/introspect.ts

@@ -5,9 +5,9 @@ import type { CommandDefinition } from '../program/index'
 
 import { runKernelCommand } from '../connection'
 import { AstraleError } from '../errors'
-import { failClosed } from '../lib/log'
+import { failInput } from '../lib/log'
 import { output } from '../lib/output'
-import { describeCallableFromSchema, missingCallableDescription } from './call-describe'
+import { describeCallableFromBundle, missingCallableDescription } from './call-describe'
 
 type IntrospectOpts = KernelCommandOpts & { bundle?: boolean }
 
@@ -17,7 +17,7 @@ export async function introspectCommand(target: string, opts: IntrospectOpts): P
   try {
     ;({ origin, path } = parseIntrospectTarget(target))
   } catch (error) {
-    failClosed(error, opts)
+    failInput(error, opts)
   }
   const wantsCallable = isCallablePath(path)
 
@@ -44,7 +44,7 @@ export async function introspectCommand(target: string, opts: IntrospectOpts): P
         )
       }
       if (wantsCallable) {
-        const described = describeCallableFromSchema(path, bundleRoot(result.bundle))
+        const described = describeCallableFromBundle(path, result.bundle)
         if (described === undefined) throw missingCallableDescription(path.raw)
         return described
       }
@@ -59,7 +59,7 @@ export function parseIntrospectTarget(target: string): { origin: string; path: P
     throw new AstraleError(
       'NOT_A_DOMAIN',
       'introspect requires a Domain origin or Path, not an @id.',
-      'Example: astrale introspect host.astrale.ai  or  /:host.astrale.ai:class.Manager:createInstance',
+      'Example: astrale introspect kernel.astrale.ai  or  /:kernel.astrale.ai:class.Identity:whois',
     )
   }
   const raw = target.startsWith('/') ? target : `/:${target}`
@@ -85,28 +85,21 @@ function isCallablePath(path: Path): boolean {
   return last.kind === 'projection' && last.projection.kind === 'function'
 }
 
-function bundleRoot(bundle: unknown): unknown {
-  if (bundle !== null && typeof bundle === 'object' && 'root' in bundle) {
-    return (bundle as { root: unknown }).root
-  }
-  return bundle
-}
-
 export default {
   name: 'introspect',
   description: 'Read installed Domain schema from the Kernel Schema syscall',
   afterHelpText: `
 Behavior:
   Calls the public Kernel introspect syscall for one installed Domain.
-  A bare origin (host.astrale.ai or /:host.astrale.ai) prints installation
+  A bare origin (kernel.astrale.ai or /:kernel.astrale.ai) prints installation
   state, target, source, readiness, and capabilities. --bundle includes the
   schema bundle. A method or Function Path projects that callable's
   input/output from the installed bundle.
 
 Examples:
-  $ astrale introspect host.astrale.ai
-  $ astrale introspect /:host.astrale.ai --bundle
-  $ astrale introspect /:host.astrale.ai:class.Manager:createInstance
+  $ astrale introspect kernel.astrale.ai
+  $ astrale introspect /:kernel.astrale.ai --bundle
+  $ astrale introspect /:kernel.astrale.ai:class.Identity:whois
   $ astrale introspect /:kernel.astrale.ai:function.journal
 `,
   arguments: [{ name: 'target', description: 'Domain origin or canonical Path' }],

package/src/commands/logs.ts

@@ -1,21 +1,16 @@
 import { Path } from '@astrale-os/sdk/graph/path'
-import { syscalls } from '@astrale-os/sdk/schema/kernel'
+import { K } from '@astrale-os/sdk/schema'
 import chalk from 'chalk'
 
 import type { ConnectionContext, KernelCommandOpts } from '../connection'
 import type { Column, ListProjection } from '../lib/output'
 import type { CommandDefinition } from '../program/index'
 
-import {
-  createPathCall,
-  expandSelfInPath,
-  runKernelCommand,
-  withClientSession,
-} from '../connection'
-import { failClosed } from '../lib/log'
+import { createPathCall, expandSelfInPath, runKernelCommand } from '../connection'
+import { failInput } from '../lib/log'
 import { isMachine, output, presentList } from '../lib/output'
 
-const JOURNAL_PATH = Path.project(syscalls.journal.ref).raw
+const JOURNAL_PATH = Path.project(K.functions.journal.ref).raw
 const DEFAULT_LIMIT = 200
 const FOLLOW_INTERVAL_MS = 2_000
 
@@ -127,7 +122,7 @@ async function runOnce(opts: LogsOpts): Promise<void> {
   await runKernelCommand({
     opts,
     label: 'Kernel journal',
-    fn: (context) => fetchPage(context, opts),
+    fn: async (context) => fetchPage(context, await resolveLogsOpts(opts, context)),
     format: (page, format) => {
       if (isMachine(format) || format.format !== undefined) output(page, format)
       else {
@@ -139,14 +134,19 @@ async function runOnce(opts: LogsOpts): Promise<void> {
 }
 
 async function follow(opts: LogsOpts): Promise<void> {
-  await withClientSession(opts, async (context) => {
-    let cursor = opts.cursor
-    for (;;) {
-      const page = await fetchPage(context, { ...opts, cursor })
-      for (const record of page.records) printRecord(record)
-      cursor = page.cursor ?? cursor
-      await new Promise((resolve) => setTimeout(resolve, FOLLOW_INTERVAL_MS))
-    }
+  await runKernelCommand({
+    opts,
+    label: 'Kernel journal',
+    fn: async (context): Promise<never> => {
+      const resolved = await resolveLogsOpts(opts, context)
+      let cursor = resolved.cursor
+      for (;;) {
+        const page = await fetchPage(context, { ...resolved, cursor })
+        for (const record of page.records) printRecord(record)
+        cursor = page.cursor ?? cursor
+        await new Promise((resolve) => setTimeout(resolve, FOLLOW_INTERVAL_MS))
+      }
+    },
   })
 }
 
@@ -227,11 +227,10 @@ function positiveInteger(flag: string, raw: string): number {
   return value
 }
 
-async function prepareLogsOpts(opts: LogsOpts): Promise<LogsOpts> {
-  buildJournalInput(opts)
+async function resolveLogsOpts(opts: LogsOpts, context: ConnectionContext): Promise<LogsOpts> {
   const principal = nonEmpty(opts.principal)
   if (principal !== '@self') return opts
-  const { path } = await expandSelfInPath('@self', opts)
+  const { path } = await expandSelfInPath('@self', context)
   return { ...opts, principal: path.startsWith('@') ? path.slice(1) : path }
 }
 
@@ -274,11 +273,11 @@ Examples:
   ],
   action: async (opts: LogsOpts) => {
     try {
-      const prepared = await prepareLogsOpts(opts)
-      if (prepared.follow) await follow(prepared)
-      else await runOnce(prepared)
+      buildJournalInput(opts)
     } catch (error) {
-      failClosed(error, opts)
+      failInput(error, opts)
     }
+    if (opts.follow) await follow(opts)
+    else await runOnce(opts)
   },
 } satisfies CommandDefinition

package/src/commands/mutate.ts

@@ -7,8 +7,9 @@ import type { KernelCommandOpts } from '../connection'
 import type { CommandDefinition } from '../program/index'
 
 import { runKernelCommand } from '../connection'
+import { AstraleError } from '../errors'
 import { prepareMutation } from '../graph/index'
-import { failClosed } from '../lib/log'
+import { failInput } from '../lib/log'
 import { output } from '../lib/output'
 import { renderTable } from '../lib/table'
 
@@ -23,7 +24,7 @@ export async function mutateCommand(opts: MutateOpts): Promise<void> {
   try {
     mutation = prepareMutation(await readDocument(opts))
   } catch (error) {
-    failClosed(error, opts)
+    failInput(error, opts)
   }
 
   if (opts.dry) {
@@ -51,9 +52,9 @@ async function readDocument(opts: MutateOpts): Promise<unknown> {
     try {
       raw = await readFile(opts.file, 'utf8')
     } catch (error) {
-      throw new Error(
-        `Cannot read --file ${opts.file}: ${error instanceof Error ? error.message : error}`,
-      )
+      throw new AstraleError('FILE_READ_FAILED', `Cannot read --file ${opts.file}.`, undefined, {
+        cause: error,
+      })
     }
     return parseJson(raw, opts.file)
   }

package/src/commands/query.ts

@@ -6,8 +6,9 @@ import type { KernelCommandOpts, SelfExpansionMeta } from '../connection'
 import type { CommandDefinition } from '../program/index'
 
 import { expandSelfInPath, runKernelCommand, withSelfHint } from '../connection'
+import { AstraleError } from '../errors'
 import { prepareQuery, type QueryCommandInput } from '../graph/index'
-import { failClosed } from '../lib/log'
+import { failInput } from '../lib/log'
 import { isMachine, output } from '../lib/output'
 
 type QueryOpts = KernelCommandOpts & {
@@ -22,46 +23,42 @@ type QueryOpts = KernelCommandOpts & {
 
 export async function queryCommand(sources: string[], opts: QueryOpts): Promise<void> {
   let input: QueryCommandInput
-  let meta: SelfExpansionMeta | undefined
   try {
     const ast = await readAst(opts)
-    if (ast === undefined) {
-      const expanded = await Promise.all(sources.map((source) => expandSelfInPath(source, opts)))
-      input = {
-        sources: expanded.map(({ path }) => path),
-        definition: opts.definition,
-        edge: opts.edge,
-        direction: opts.direction,
-        limit: opts.limit,
-        cursor: opts.cursor,
-      }
-      meta = expanded.find((entry) => entry.meta !== undefined)?.meta
-    } else {
-      input = {
-        sources,
-        ast,
-        definition: opts.definition,
-        edge: opts.edge,
-        direction: opts.direction,
-        limit: opts.limit,
-        cursor: opts.cursor,
-      }
+    input = {
+      sources,
+      ...(ast === undefined ? {} : { ast }),
+      definition: opts.definition,
+      edge: opts.edge,
+      direction: opts.direction,
+      limit: opts.limit,
+      cursor: opts.cursor,
     }
   } catch (error) {
-    failClosed(error, opts)
+    failInput(error, opts)
   }
 
   let prepared
   try {
     prepared = prepareQuery(input)
   } catch (error) {
-    failClosed(error, opts)
+    failInput(error, opts)
   }
 
   await runKernelCommand({
     opts,
     label: 'Query',
-    fn: ({ graph }) => withSelfHint(() => graph.query(prepared.ast, { page: prepared.page }), meta),
+    fn: async (context) => {
+      const expanded = await Promise.all(sources.map((source) => expandSelfInPath(source, context)))
+      const meta: SelfExpansionMeta | undefined = expanded.find(
+        (entry) => entry.meta !== undefined,
+      )?.meta
+      const resolved =
+        meta === undefined
+          ? prepared
+          : prepareQuery({ ...input, sources: expanded.map(({ path }) => path) })
+      return withSelfHint(() => context.graph.query(resolved.ast, { page: resolved.page }), meta)
+    },
     format: (response, format) => {
       output(response.result, format)
       if (response.page.next && !isMachine(format)) {
@@ -81,9 +78,9 @@ async function readAst(opts: QueryOpts): Promise<unknown | undefined> {
   try {
     raw = await readFile(opts.file, 'utf8')
   } catch (error) {
-    throw new Error(
-      `Cannot read --file ${opts.file}: ${error instanceof Error ? error.message : error}`,
-    )
+    throw new AstraleError('FILE_READ_FAILED', `Cannot read --file ${opts.file}.`, undefined, {
+      cause: error,
+    })
   }
   return parseJson(raw, opts.file)
 }
@@ -122,7 +119,7 @@ Examples:
     { flags: '-f, --file <path>', description: 'Read a canonical Query V6 document from a file' },
     {
       flags: '--definition <path>',
-      description: 'Select Nodes implementing one exact Class or Interface',
+      description: 'Select Nodes satisfying one exact Class',
     },
     { flags: '--edge <class>', description: 'Expand one exact Edge Class' },
     {