@astrale-os/cli 1.0.0-beta.1 → 1.0.0-beta.11

package/src/commands/__tests__/read-commands.test.ts

@@ -36,6 +36,8 @@ let mutations: unknown[] = []
 let queryResult: unknown
 let getResult: unknown
 let mutationResult: unknown
+let selfFailure: unknown
+let selfContexts: unknown[] = []
 
 const queryMock = mock(async (ast: unknown, options?: unknown) => {
   queryCalls.push({ ast, options })
@@ -49,7 +51,9 @@ const mutateMock = mock(async (mutation: unknown) => {
   mutations.push(mutation)
   return mutationResult
 })
-const expandSelfInPathMock = mock(async (path: string) => {
+const expandSelfInPathMock = mock(async (path: string, context: unknown) => {
+  selfContexts.push(context)
+  if (selfFailure !== undefined) throw selfFailure
   if (path === '@self') {
     return {
       path: '@expanded-self',
@@ -59,10 +63,11 @@ const expandSelfInPathMock = mock(async (path: string) => {
   return { path, meta: undefined }
 })
 const withSelfHintMock = mock(async (action: () => Promise<unknown>) => action())
+const commandContext = {
+  graph: { query: queryMock, getOrThrow: getOrThrowMock, mutate: mutateMock },
+}
 const runKernelCommandMock = mock(async (run: RunOpts) => {
-  const result = await run.fn({
-    graph: { query: queryMock, getOrThrow: getOrThrowMock, mutate: mutateMock },
-  })
+  const result = await run.fn(commandContext)
   await run.format?.(result, run.opts, true)
 })
 
@@ -88,6 +93,8 @@ beforeEach(() => {
   }
   getResult = undefined
   mutationResult = { createdNodes: {} }
+  selfFailure = undefined
+  selfContexts = []
   queryMock.mockClear()
   getOrThrowMock.mockClear()
   mutateMock.mockClear()
@@ -161,7 +168,7 @@ describe('query command', () => {
     ])
   })
 
-  test('authors a Definition source through the same canonical Query V6 call', async () => {
+  test('authors a Class source through the same canonical Query V6 call', async () => {
     const { queryCommand } = await import('../query')
 
     await queryCommand([], {
@@ -179,8 +186,8 @@ describe('query command', () => {
             kind: 'node',
             terms: [
               {
-                kind: 'definition',
-                definition: { origin: 'issues.astrale.ai', kind: 'class', name: 'Issue' },
+                kind: 'class',
+                class: { origin: 'issues.astrale.ai', kind: 'class', name: 'Issue' },
               },
             ],
             binding: 'n0',
@@ -193,6 +200,17 @@ describe('query command', () => {
     ])
   })
 
+  test('resolves @self inside the command session and never relabels transport failure as input', async () => {
+    const { queryCommand } = await import('../query')
+    await queryCommand(['@self'], { json: true, limit: '2' })
+    expect(selfContexts).toEqual([commandContext])
+
+    const aggregate = new AggregateError([], '')
+    selfFailure = aggregate
+    await expect(queryCommand(['@self'], { json: true, limit: '2' })).rejects.toBe(aggregate)
+    expect(errors.join('\n')).not.toContain('INVALID_INPUT')
+  })
+
   /** @evidence TEST-CLI-QUERY-REJECTS-V1-BEFORE-CONNECTION */
   test('rejects a legacy AST before opening the command connection', async () => {
     const { queryCommand } = await import('../query')
@@ -215,7 +233,7 @@ describe('get command', () => {
     const { getCommand } = await import('../get')
     getResult = {
       id: 'note-1',
-      class: '/:notes.example.dev:class.Note',
+      class: 'notes.example.dev:class.Note',
       props: { 'notes.example.dev:class.Note.property.title': 'Hello' },
     }
 
@@ -226,6 +244,13 @@ describe('get command', () => {
     expect(stdout).not.toContain('__labels')
     expect(stdout).not.toContain('classId')
   })
+
+  test('resolves @self through the same point-read command context', async () => {
+    const { getCommand } = await import('../get')
+    await getCommand('@self', { json: true })
+    expect(selfContexts).toEqual([commandContext])
+    expect(getTargets).toEqual(['@expanded-self'])
+  })
 })
 
 describe('mutate command', () => {
@@ -242,7 +267,7 @@ describe('mutate command', () => {
           {
             op: 'node.create',
             as: 'note',
-            class: '/:notes.example.dev:class.Note',
+            class: 'notes.example.dev:class.Note',
             props: {},
           },
         ],
@@ -258,7 +283,7 @@ describe('mutate command', () => {
           {
             op: 'node.create',
             as: 'note',
-            class: '/:notes.example.dev:class.Note',
+            class: 'notes.example.dev:class.Note',
             props: {},
           },
         ],

package/src/commands/__tests__/studio-descriptor.test.ts

@@ -0,0 +1,22 @@
+import { expect, test } from 'bun:test'
+import { realpathSync } from 'node:fs'
+
+import { encodeStudioCliDescriptor } from '../studio'
+
+test('Studio descriptor preserves the exact runtime and script entrypoint', () => {
+  expect(JSON.parse(encodeStudioCliDescriptor(process.execPath, import.meta.path))).toEqual({
+    version: 1,
+    executable: process.execPath,
+    args: [realpathSync(import.meta.path)],
+  })
+})
+
+test('Studio descriptor reinvokes a compiled executable without its virtual bunfs entry', () => {
+  expect(JSON.parse(encodeStudioCliDescriptor('/opt/bin/astrale', '/$bunfs/root/astrale'))).toEqual(
+    {
+      version: 1,
+      executable: '/opt/bin/astrale',
+      args: [],
+    },
+  )
+})

package/src/commands/__tests__/update.test.ts

@@ -6,14 +6,17 @@ describe('CLI update staleness', () => {
   test('trusts the release manifest for a script install without consulting npm latest', async () => {
     const fetchPackageVersion = mock(async () => '0.8.1-alpha.7')
     const result = await cliStale(
-      { channel: 'beta' },
+      {},
       {
-        update: async () => ({
-          status: 'up-to-date',
-          currentVersion: '1.0.0-beta.0',
-          latestVersion: '1.0.0-beta.0',
-          channel: 'beta',
-        }),
+        update: async ({ channel }) => {
+          expect(channel).toBe('beta')
+          return {
+            status: 'up-to-date',
+            currentVersion: '1.0.0-beta.0',
+            latestVersion: '1.0.0-beta.0',
+            channel: 'beta',
+          }
+        },
         fetchPackageVersion,
       },
     )
@@ -28,37 +31,63 @@ describe('CLI update staleness', () => {
     expect(fetchPackageVersion).not.toHaveBeenCalled()
   })
 
-  test('uses the selected npm dist-tag only for package-managed installs', async () => {
+  test('uses an explicit npm dist-tag only for package-managed installs', async () => {
     const result = await cliStale(
-      { channel: 'beta' },
+      { channel: 'canary' },
       {
-        update: async () => {
-          throw new Error('package managed')
-        },
+        update: async () => ({
+          status: 'managed',
+          currentVersion: '1.0.0-beta.0',
+          executable: '/opt/homebrew/bin/node',
+        }),
         fetchPackageVersion: async ({ channel }) => {
-          expect(channel).toBe('beta')
-          return '1.0.0-beta.0'
+          expect(channel).toBe('canary')
+          return '1.0.0-canary.0'
         },
       },
     )
 
     expect(result).toMatchObject({
       managed: true,
-      latest: '1.0.0-beta.0',
+      latest: '1.0.0-canary.0',
       channel: 'npm',
     })
   })
 
-  test('maps the stable channel to the npm latest dist-tag', async () => {
+  test('does not misclassify a script update failure as package-managed', async () => {
+    const fetchPackageVersion = mock(async () => '9.9.9')
+    const result = await cliStale(
+      {},
+      {
+        update: async () => {
+          throw new Error('release endpoint unavailable')
+        },
+        fetchPackageVersion,
+      },
+    )
+
+    expect(result).toMatchObject({
+      stale: false,
+      managed: false,
+      error: 'release endpoint unavailable',
+    })
+    expect(fetchPackageVersion).not.toHaveBeenCalled()
+  })
+
+  test('maps the default to beta and the stable channel to npm latest', async () => {
     const originalFetch = globalThis.fetch
     const fetchMock = mock(async (input: RequestInfo | URL) => {
-      expect(String(input)).toBe('https://registry.npmjs.org/@astrale-os/cli/latest')
-      return Response.json({ version: '1.0.0' })
+      const target = String(input).split('/').at(-1)
+      return Response.json({ version: target === 'beta' ? '1.0.0-beta.0' : '1.0.0' })
     })
     globalThis.fetch = fetchMock as unknown as typeof fetch
     try {
+      expect(await fetchNpmTargetVersion({})).toBe('1.0.0-beta.0')
       expect(await fetchNpmTargetVersion({ channel: 'stable' })).toBe('1.0.0')
-      expect(fetchMock).toHaveBeenCalledTimes(1)
+      expect(fetchMock.mock.calls.map(([input]) => String(input))).toEqual([
+        'https://registry.npmjs.org/@astrale-os/cli/beta',
+        'https://registry.npmjs.org/@astrale-os/cli/latest',
+      ])
     } finally {
       globalThis.fetch = originalFetch
     }

package/src/commands/call-describe.ts

@@ -1,8 +1,9 @@
 import type { Path } from '@astrale-os/sdk/graph/path'
+import type { ResolvedFunction, ResolvedMethod } from '@astrale-os/sdk/schema'
 
-import { AstraleError } from '../errors'
+import { bundle, schema } from '@astrale-os/sdk/schema'
 
-type JsonRecord = Record<string, unknown>
+import { AstraleError } from '../errors'
 
 export interface CallableDescription {
   readonly path: string
@@ -18,40 +19,40 @@ export interface CallableDescription {
   readonly candidates?: readonly CallableDescription[]
 }
 
-/** Resolve one callable's input/output from an installed Domain schema document. */
-export function describeCallableFromSchema(
+/** Resolve one callable from an admitted installed Domain bundle. */
+export function describeCallableFromBundle(
   path: Path,
-  schema: unknown,
+  input: unknown,
 ): CallableDescription | undefined {
   if (path.ast.anchor.kind !== 'domain') return undefined
   const origin = path.ast.anchor.origin
   const last = path.ast.steps.at(-1)
-  const document = asRecord(schema)
-  if (document === undefined || last === undefined) return undefined
+  if (last === undefined) return undefined
+  const domain = schema.resolve(bundle.accept(input).root)
+  if (domain.origin !== origin) return undefined
 
   if (last.kind === 'method') {
-    const owner = path.ast.steps.at(-2)
-    if (
-      owner?.kind === 'projection' &&
-      (owner.projection.kind === 'class' || owner.projection.kind === 'interface')
-    ) {
-      const bag = asRecord(
-        owner.projection.kind === 'class' ? document.classes : document.interfaces,
+    const ownerStep = path.ast.steps.at(-2)
+    if (ownerStep?.kind === 'projection' && ownerStep.projection.kind === 'class') {
+      const owner = domain.classes[ownerStep.projection.name]
+      if (owner?.kind !== 'node') return undefined
+      const method = namedMethod(
+        last.dispatch === 'static' ? owner.static.methods : owner.methods,
+        last.name,
+        last.dispatch,
       )
-      const definition = asRecord(bag?.[owner.projection.name])
-      const method = asRecord(asRecord(definition?.methods)?.[last.name])
-      if (method !== undefined) {
-        return Object.freeze({
-          path: path.raw,
-          origin,
-          class: owner.projection.name,
-          method: last.name,
-          dispatch: last.dispatch,
-          ...callableFields(method),
-        })
-      }
+      return method === undefined
+        ? undefined
+        : description(path, origin, owner.ref.name, method, last.dispatch)
     }
-    const matches = findNamedMethods(document, origin, path.raw, last.name, last.dispatch)
+
+    const matches = Object.values(domain.classes).flatMap((owner) => {
+      if (owner.kind !== 'node') return []
+      const method = namedMethod(owner.methods, last.name, last.dispatch)
+      return method === undefined
+        ? []
+        : [description(path, origin, owner.ref.name, method, last.dispatch)]
+    })
     if (matches.length === 1) return matches[0]
     if (matches.length > 1) {
       return Object.freeze({
@@ -66,13 +67,13 @@ export function describeCallableFromSchema(
   }
 
   if (last.kind === 'projection' && last.projection.kind === 'function') {
-    const fn = asRecord(asRecord(document.functions)?.[last.projection.name])
-    if (fn === undefined) return undefined
+    const callable = domain.functions[last.projection.name]
+    if (callable === undefined) return undefined
     return Object.freeze({
       path: path.raw,
       origin,
-      function: last.projection.name,
-      ...callableFields(fn),
+      function: callable.ref.name,
+      ...callableFields(callable),
     })
   }
   return undefined
@@ -82,50 +83,41 @@ export function missingCallableDescription(path: string): AstraleError {
   return new AstraleError(
     'CALL_DESCRIBE_UNAVAILABLE',
     `No callable schema is installed for ${path}.`,
-    'Use a Domain-rooted Path such as /:host.astrale.ai:class.Manager:createInstance. Method Paths are not Function nodes.',
+    'Use a Domain-rooted Path such as /:kernel.astrale.ai:class.Identity:whois. Method Paths are not Function nodes.',
   )
 }
 
-function findNamedMethods(
-  schema: JsonRecord,
+function namedMethod(
+  methods: Iterable<ResolvedMethod>,
+  name: string,
+  dispatch: 'static' | 'instance',
+): ResolvedMethod | undefined {
+  const expectedStatic = dispatch === 'static'
+  return [...methods].find((method) => method.name === name && method.static === expectedStatic)
+}
+
+function description(
+  path: Path,
   origin: string,
-  path: string,
-  method: string,
+  className: string,
+  callable: ResolvedMethod,
   dispatch: 'static' | 'instance',
-): CallableDescription[] {
-  const matches: CallableDescription[] = []
-  for (const bag of [schema.classes, schema.interfaces]) {
-    const definitions = asRecord(bag)
-    if (definitions === undefined) continue
-    for (const [className, definition] of Object.entries(definitions)) {
-      const methodDef = asRecord(asRecord(asRecord(definition)?.methods)?.[method])
-      if (methodDef === undefined) continue
-      matches.push(
-        Object.freeze({
-          path,
-          origin,
-          class: className,
-          method,
-          dispatch,
-          ...callableFields(methodDef),
-        }),
-      )
-    }
-  }
-  return matches
+): CallableDescription {
+  return Object.freeze({
+    path: path.raw,
+    origin,
+    class: className,
+    method: callable.name,
+    dispatch,
+    ...callableFields(callable),
+  })
 }
 
-function callableFields(value: JsonRecord): Partial<CallableDescription> {
+function callableFields(callable: ResolvedFunction | ResolvedMethod): Partial<CallableDescription> {
   return {
-    ...(typeof value.description === 'string' ? { description: value.description } : {}),
-    ...(value.auth === undefined ? {} : { auth: value.auth }),
-    ...(value.input === undefined ? {} : { input: value.input }),
-    ...(value.output === undefined ? {} : { output: value.output }),
+    ...(callable.description === undefined ? {} : { description: callable.description }),
+    auth: callable.auth,
+    input: callable.input,
+    output: callable.output,
   }
 }
-
-function asRecord(input: unknown): JsonRecord | undefined {
-  return input !== null && typeof input === 'object' && !Array.isArray(input)
-    ? (input as JsonRecord)
-    : undefined
-}

package/src/commands/call.ts

@@ -5,7 +5,7 @@ import type { CommandDefinition } from '../program/index'
 
 import { createPathCall, expandSelfInCall, runKernelCommand, withSelfHint } from '../connection'
 import { presentBinary } from '../lib/binary'
-import { failClosed, log } from '../lib/log'
+import { failInput, log } from '../lib/log'
 import { output, present } from '../lib/output'
 
 type CallOpts = KernelCommandOpts & {
@@ -24,60 +24,47 @@ export async function callCommand(
   rawParams: string[],
   opts: CallOpts,
 ): Promise<void> {
-  // Expand @self before describe/execute through authenticated Identity.whoami.
-  let expanded: Awaited<ReturnType<typeof expandSelfInCall>>
-  try {
-    expanded = await expandSelfInCall(path, rawParams, opts)
-  } catch (error) {
-    failClosed(error, opts)
-  }
-  const expandedPath = expanded.path
-  try {
-    Path.parse(expandedPath)
-  } catch (error) {
-    failClosed(error, opts)
-  }
-
-  // ── Parse params ────────────────────────────────────────
   let params: Record<string, unknown>
   try {
-    params = await parseParams([...expanded.parameters], opts.data)
-  } catch (e) {
-    failClosed(e, opts)
-  }
-
-  // ── Dry-run: show what would be sent ─────────────────────
-  if (opts.dryRun) {
-    output({ method: expandedPath, params }, opts)
-    return
+    Path.parse(path)
+    params = await parseParams(rawParams, opts.data)
+  } catch (error) {
+    failInput(error, opts)
   }
 
-  // ── Execute ────────────────────────────────────────────
-  await runKernelCommand<MaterializedCallResult>({
-    opts,
-    label: expandedPath,
-    fn: (ctx) =>
-      withSelfHint(
-        async () =>
-          materializeCallResult(await ctx.session.dispatch(createPathCall(expandedPath, params))),
-        expanded.meta,
-      ),
-    format: async (result, fmtOpts) => {
-      switch (result.kind) {
-        case 'value':
-          present(result.value, fmtOpts)
-          return
-        case 'binary':
-          await presentBinary(result.value, fmtOpts, { outFile: opts.output })
-          return
-        case 'stream':
-          output(result.values, fmtOpts)
-          return
-        case 'redirect':
-          throw new Error('Client Session returned an unresolved redirect.')
-      }
+  await runKernelCommand<MaterializedCallResult | { readonly kind: 'dry'; readonly call: unknown }>(
+    {
+      opts,
+      label: path,
+      fn: async (ctx) => {
+        const expanded = await expandSelfInCall(path, params, ctx)
+        const request = createPathCall(expanded.path, expanded.parameters)
+        if (opts.dryRun) return { kind: 'dry', call: request }
+        return withSelfHint(
+          async () => materializeCallResult(await ctx.session.dispatch(request)),
+          expanded.meta,
+        )
+      },
+      format: async (result, fmtOpts) => {
+        switch (result.kind) {
+          case 'dry':
+            output(result.call, fmtOpts)
+            return
+          case 'value':
+            present(result.value, fmtOpts)
+            return
+          case 'binary':
+            await presentBinary(result.value, fmtOpts, { outFile: opts.output })
+            return
+          case 'stream':
+            output(result.values, fmtOpts)
+            return
+          case 'redirect':
+            throw new Error('Client Session returned an unresolved redirect.')
+        }
+      },
     },
-  })
+  )
 }
 
 /** Drain a session-backed stream before the command-scoped Client Session closes. */
@@ -101,7 +88,7 @@ export async function parseParams(
     try {
       return JSON.parse(dataFlag)
     } catch {
-      throw new Error(`Invalid JSON in --data: ${dataFlag}`)
+      throw new TypeError(`Invalid JSON in --data: ${dataFlag}`)
     }
   }
 
@@ -114,7 +101,7 @@ export async function parseParams(
     try {
       return JSON.parse(stdin)
     } catch {
-      throw new Error('Invalid JSON from stdin')
+      throw new TypeError('Invalid JSON from stdin')
     }
   }
 
@@ -142,7 +129,7 @@ export function parseKeyValue(pairs: string[]): Record<string, unknown> {
   for (const pair of pairs) {
     const eqIdx = pair.indexOf('=')
     if (eqIdx === -1) {
-      throw new Error(`Invalid param "${pair}" — expected key=value format`)
+      throw new TypeError(`Invalid param "${pair}" — expected key=value format`)
     }
     const key = pair.slice(0, eqIdx)
     const raw = pair.slice(eqIdx + 1)
@@ -150,7 +137,7 @@ export function parseKeyValue(pairs: string[]): Record<string, unknown> {
       const hint = key.endsWith(':')
         ? ` (looks like httpie's "key:=value" syntax — Astrale CLI doesn't support it; use --data '{"${key.slice(0, -1)}":<value>}' for nested values)`
         : ` (keys must be identifier-shaped: letters, digits, underscore, hyphen)`
-      throw new Error(`Invalid param key "${key}" in "${pair}"${hint}`)
+      throw new TypeError(`Invalid param key "${key}" in "${pair}"${hint}`)
     }
     result[key] = coerceValue(raw)
   }
@@ -194,7 +181,7 @@ Self-reference:
   Callable input/output lives on astrale introspect <path>.
 
 Examples:
-  $ astrale introspect /:host.astrale.ai:class.Manager:createInstance
+  $ astrale introspect /:kernel.astrale.ai:class.Identity:whois
   $ astrale call /:blog.acme.com:class.Author:list limit=10
   $ astrale call '@self::deactivate'
   $ astrale call /:kernel.astrale.ai:function.journal --data '{"limit":5}' --json
@@ -203,7 +190,7 @@ Examples:
     {
       name: 'path',
       description:
-        'Operation path (e.g., /:host.astrale.ai:class.Manager:createInstance or /node::method)',
+        'Operation path (e.g., /:kernel.astrale.ai:class.Identity:whois or /node::method)',
     },
     { name: 'params...', description: 'Params as key=value pairs', required: false },
   ],

package/src/commands/domain/install.ts

@@ -1,5 +1,5 @@
 import { Path } from '@astrale-os/sdk/graph/path'
-import { syscalls } from '@astrale-os/sdk/schema/kernel'
+import { K } from '@astrale-os/sdk/schema'
 import chalk from 'chalk'
 
 import type { KernelCommandOpts } from '../../connection'
@@ -15,6 +15,7 @@ import {
 } from '../../lib/admin-domain'
 import { listOwnedInstancesInContext, type OwnedInstanceInfo } from '../../lib/admin-instance'
 import { ADMIN_TARGET_OPTIONS, type AdminTargetCommandOpts } from '../../lib/admin-target'
+import { fetchDomainPublication } from '../../lib/domain-publication'
 import { getActive } from '../../lib/instance'
 import { fatal, log, withSpinner } from '../../lib/log'
 import { isMachine, output } from '../../lib/output'
@@ -413,7 +414,7 @@ export async function installDirect(
     fn: async ({ session }) =>
       (await session.call(
         createPathCall(
-          Path.project(syscalls.install.ref).raw,
+          Path.project(K.functions.install.ref).raw,
           directInstallCallInput(url, operation, opts.token),
         ),
       )) as DirectInstallResult,
@@ -429,11 +430,11 @@ export async function installDirect(
       log.dim(`  operation:   ${result.operation}`)
       // Belt-and-braces: the kernel-confirmed origin is authoritative. If it
       // aliases the host and the pre-install gate never consented to THAT
-      // origin (lying or absent `/meta`), say so loudly after the fact.
+      // origin (lying or unavailable Publication), say so loudly after the fact.
       if (isIdentityOverride(installed.origin, host) && installed.origin !== consentedOrigin) {
         log.warn(
           `Installed origin "${installed.origin}" differs from the serving host "${host}" ` +
-            `and was not confirmed before install (the worker's /meta did not declare it). ` +
+            `and was not confirmed before install (the worker Publication was unavailable). ` +
             `Every ${installed.origin}/* call on this instance now routes to ${host}.`,
         )
       }
@@ -478,10 +479,10 @@ export function isIdentityOverride(origin: string, host: string): boolean {
  * Claiming an origin that differs from the serving host is an explicit actAs
  * and needs typed consent (or `--allow-identity-override` in scripts).
  *
- * The pre-install check reads the worker's self-reported `/meta.origin`,
+ * The pre-install check reads the worker's canonical Publication origin,
  * so it is consent UX, not enforcement — a hostile worker can lie here, and
  * the kernel anchors the cryptographic identity (`iss`) on the real URL
- * regardless. When `/meta` is unreachable or silent on the origin, the gate
+ * regardless. When the Publication is unreachable or invalid, the gate
  * degrades to a warning and the kernel-confirmed origin is re-checked after
  * install (see `format` above).
  *
@@ -496,7 +497,8 @@ async function ensureIdentityOverrideConsent(
   const origin = await probeDeclaredOrigin(url)
   if (origin === undefined) {
     log.warn(
-      `Could not read a declared origin from ${new URL('/meta', url).href} — ` +
+      `Could not read a declared origin from ` +
+        `${new URL('/.well-known/astrale/domain.json', url).href} — ` +
         `skipping the pre-install identity check (the installed origin is verified after install).`,
     )
     return undefined
@@ -534,19 +536,13 @@ async function ensureIdentityOverrideConsent(
   return origin
 }
 
-/** Best-effort read of the worker's declared origin from its `/meta` probe. */
+/** Best-effort read of the worker's origin from its admitted canonical Publication. */
 export async function probeDeclaredOrigin(url: string): Promise<string | undefined> {
   try {
-    const res = await fetch(new URL('/meta', url), { signal: AbortSignal.timeout(10_000) })
-    if (!res.ok) return undefined
-    // SDK workers serve `origin`; `domainName` is the pre-Kernel-V2 name, kept
-    // as a fallback for workers deployed before the rename.
-    const body = (await res.json()) as { origin?: unknown; domainName?: unknown }
-    const declared = body.origin ?? body.domainName
-    return typeof declared === 'string' && declared.length > 0 ? declared : undefined
+    return (await fetchDomainPublication(url, AbortSignal.timeout(10_000))).origin
   } catch {
-    // Unreachable /meta is not fatal here: the caller warns and the install
-    // itself will surface a dead worker with its own error.
+    // An unreachable or invalid Publication is not fatal here: the caller warns
+    // and the install itself will surface a dead worker with its own error.
     return undefined
   }
 }