@astrale-os/cli 0.8.1-alpha.5 → 0.8.1-alpha.7

package/src/commands/instance/bookmark.ts

@@ -1,7 +1,13 @@
 import type { CommandDefinition } from '../../program/index'
 
 import { fetchWithCaFile } from '../../lib/ca-fetch'
-import { normalizeInstanceKernelUrl, setActive, upsertInstance } from '../../lib/instance'
+import {
+  findBookmarkTrustConflicts,
+  normalizeInstanceKernelUrl,
+  readInstances,
+  setActive,
+  upsertInstance,
+} from '../../lib/instance'
 import { fatal, log } from '../../lib/log'
 import { checkIssuerReachability } from '../../lib/meta'
 
@@ -39,14 +45,27 @@ export default {
     try {
       if (!opts.url) fatal(new Error('Missing required flag: --url <url>'))
       const url = normalizeInstanceKernelUrl(opts.url)
-      const expectedIssuer = opts.issuer ? normalizeInstanceKernelUrl(opts.issuer) : undefined
+      const store = await readInstances()
+      const expectedIssuer = opts.issuer
+        ? normalizeInstanceKernelUrl(opts.issuer)
+        : store.instances[name]?.issuer
+      const effectiveCa = opts.ca ?? store.instances[name]?.caFile
+      const trustConflicts = findBookmarkTrustConflicts(store, name, url, effectiveCa)
+      if (trustConflicts.length > 0) {
+        log.warn(
+          `TLS trust differs for the same Kernel URL ${url}: ` +
+            `"${name}" uses ${describeCa(effectiveCa)}, while ${trustConflicts
+              .map((conflict) => `"${conflict.name}" uses ${describeCa(conflict.caFile)}`)
+              .join(', ')}. Remove or update stale bookmarks to avoid certificate surprises.`,
+        )
+      }
 
       if (!opts.skipProbe) {
         try {
           const { issuer, keys } = await checkIssuerReachability(
             url,
             expectedIssuer,
-            opts.ca ? fetchWithCaFile(opts.ca) : undefined,
+            effectiveCa ? fetchWithCaFile(effectiveCa) : undefined,
           )
           log.dim(`  iss=${issuer} keys=${keys.length}`)
         } catch (e) {
@@ -76,3 +95,7 @@ export default {
     }
   },
 } satisfies CommandDefinition
+
+function describeCa(caFile: string | null | undefined): string {
+  return caFile ? `CA ${caFile}` : 'the system trust store'
+}

package/src/commands/instance/list.ts

@@ -30,6 +30,7 @@ export type Bookmark = {
   issuer: string | null
   active: boolean
   defaultIdentity: string | null
+  caFile: string | null
   createdAt: string | null
 }
 
@@ -57,6 +58,7 @@ export default {
         issuer: entry.issuer ?? null,
         active: name === store.active,
         defaultIdentity: entry.defaultIdentity ?? null,
+        caFile: entry.caFile ?? null,
         createdAt: entry.createdAt ?? null,
       }))
 
@@ -111,13 +113,13 @@ export function buildInstanceRows(
   const rows: Array<Record<string, string>> = []
   const merged = new Set<string>()
 
-  const bookmarkByName = new Map<string, { url: string; active: boolean }>()
+  const bookmarkByName = new Map<string, Bookmark & { url: string }>()
   if (show.managed && show.bookmarks) {
     for (const bookmark of bookmarks) {
       if (bookmark.url === null) continue
       bookmarkByName.set(bookmark.name, {
+        ...bookmark,
         url: normalizeInstanceKernelUrl(bookmark.url),
-        active: bookmark.active,
       })
     }
   }
@@ -134,7 +136,9 @@ export function buildInstanceRows(
         name: twin?.active ? `${item.slug} ${chalk.green('*')}` : item.slug,
         kind: 'managed',
         url: item.url ?? '',
-        extra: formatInstanceLocation(item),
+        extra: [formatInstanceLocation(item), twin ? formatBookmarkConnection(twin) : '']
+          .filter(Boolean)
+          .join(' · '),
       })
     }
   }
@@ -146,7 +150,7 @@ export function buildInstanceRows(
         name: item.active ? `${item.name} ${chalk.green('*')}` : item.name,
         kind: 'bookmark',
         url: String(item.url ?? ''),
-        extra: '',
+        extra: formatBookmarkConnection(item),
       })
     }
   }
@@ -154,6 +158,16 @@ export function buildInstanceRows(
   return rows
 }
 
+function formatBookmarkConnection(bookmark: Bookmark): string {
+  return [
+    bookmark.issuer && bookmark.issuer !== bookmark.url ? `issuer=${bookmark.issuer}` : '',
+    bookmark.caFile ? `ca=${bookmark.caFile}` : '',
+    bookmark.defaultIdentity ? `identity=${bookmark.defaultIdentity}` : '',
+  ]
+    .filter(Boolean)
+    .join(' · ')
+}
+
 const ADMIN_INVENTORY_CODES = new Set([
   'TOKEN_EXCHANGE_SOURCE_INVALID',
   'TOKEN_EXCHANGE_SOURCE_EXPIRED',

package/src/commands/instance/use.ts

@@ -5,7 +5,9 @@ import { AstraleError } from '../../errors'
 import { getDefault, setDefault } from '../../identity/index'
 import { listOwnedInstances } from '../../lib/admin-instance'
 import { ADMIN_TARGET_OPTIONS } from '../../lib/admin-target'
+import { fetchWithCaFile } from '../../lib/ca-fetch'
 import {
+  findBookmarkTrustConflicts,
   getActive,
   readInstances,
   resolveInstance,
@@ -48,12 +50,8 @@ async function useInstance(name?: string, opts: UseOpts = {}): Promise<void> {
 
     const resolved = await resolveUseTarget(name, opts)
 
-    if (!opts.skipJwksCheck && resolved.issuer) {
-      try {
-        await checkIssuerReachability(resolved.url, resolved.issuer)
-      } catch (e) {
-        fatal(e)
-      }
+    if (!opts.skipJwksCheck) {
+      await probeBookmark(resolved)
     }
 
     await setActive(resolved.name)
@@ -94,6 +92,55 @@ async function useInstance(name?: string, opts: UseOpts = {}): Promise<void> {
   }
 }
 
+/** Probe with the exact TLS trust configuration stored on this bookmark. */
+export async function probeBookmark(
+  resolved: ResolvedInstance,
+  dependencies: Partial<BookmarkProbeDependencies> = {},
+): Promise<void> {
+  const probe = { ...defaultBookmarkProbeDependencies, ...dependencies }
+  const store = await probe.readInstances()
+  const conflicts = findBookmarkTrustConflicts(store, resolved.name, resolved.url, resolved.caFile)
+  try {
+    await probe.checkIssuerReachability(
+      resolved.url,
+      resolved.issuer,
+      resolved.caFile ? probe.fetchWithCaFile(resolved.caFile) : undefined,
+    )
+  } catch (cause) {
+    const original = cause instanceof AstraleError ? cause.hint : undefined
+    const trust = resolved.caFile
+      ? `Bookmark "${resolved.name}" trusts CA ${resolved.caFile}.`
+      : `Bookmark "${resolved.name}" uses the system trust store.`
+    const collision =
+      conflicts.length === 0
+        ? ''
+        : ` The same URL is bookmarked with different TLS trust as ${conflicts
+            .map((conflict) =>
+              conflict.caFile
+                ? `"${conflict.name}" (CA ${conflict.caFile})`
+                : `"${conflict.name}" (system trust)`,
+            )
+            .join(', ')}.`
+    throw new AstraleError(
+      cause instanceof AstraleError ? cause.code : 'ISSUER_UNREACHABLE',
+      `Issuer/JWKS probe failed for bookmark "${resolved.name}" at ${resolved.url}.`,
+      `${trust}${collision}${original ? ` ${original}` : ''} Inspect with \`astrale instance list --bookmarked --json\`.`,
+    )
+  }
+}
+
+interface BookmarkProbeDependencies {
+  readonly readInstances: typeof readInstances
+  readonly checkIssuerReachability: typeof checkIssuerReachability
+  readonly fetchWithCaFile: typeof fetchWithCaFile
+}
+
+const defaultBookmarkProbeDependencies: BookmarkProbeDependencies = Object.freeze({
+  readInstances,
+  checkIssuerReachability,
+  fetchWithCaFile,
+})
+
 async function resolveUseTarget(name: string, opts: UseOpts): Promise<ResolvedInstance> {
   const [store, managed] = await Promise.all([readInstances(), fetchManagedInstances(name, opts)])
   const candidates = collectInstanceCandidates(name, store, managed)
@@ -204,7 +251,7 @@ Examples:
       flags: '--adopt-default',
       description: 'Adopt instance default identity without prompt',
     },
-    { flags: '--skip-jwks-check', description: 'Skip the /meta ↔ JWKS match check' },
+    { flags: '--skip-jwks-check', description: 'Skip the OIDC discovery + JWKS liveness probe' },
   ],
   action: async (name: string | undefined, opts: UseOpts) => {
     await useInstance(name, opts)

package/src/commands/introspect.ts

@@ -0,0 +1,117 @@
+import { Path } from '@astrale-os/sdk/graph/path'
+
+import type { KernelCommandOpts } from '../connection'
+import type { CommandDefinition } from '../program/index'
+
+import { runKernelCommand } from '../connection'
+import { AstraleError } from '../errors'
+import { failClosed } from '../lib/log'
+import { output } from '../lib/output'
+import { describeCallableFromSchema, missingCallableDescription } from './call-describe'
+
+type IntrospectOpts = KernelCommandOpts & { bundle?: boolean }
+
+export async function introspectCommand(target: string, opts: IntrospectOpts): Promise<void> {
+  let origin: string
+  let path: Path
+  try {
+    ;({ origin, path } = parseIntrospectTarget(target))
+  } catch (error) {
+    failClosed(error, opts)
+  }
+  const wantsCallable = isCallablePath(path)
+
+  await runKernelCommand({
+    opts,
+    label: `Introspect ${origin}`,
+    fn: async ({ session }) => {
+      const includeBundle = wantsCallable || opts.bundle === true
+      const result = await session.schema.introspect({
+        from: { kind: 'installation', origin },
+        select: {
+          state: true,
+          target: true,
+          source: true,
+          readiness: true,
+          capabilities: true,
+          ...(includeBundle ? { bundle: true as const } : {}),
+        },
+      })
+      if (result === null) {
+        throw new AstraleError(
+          'DOMAIN_NOT_INSTALLED',
+          `Domain ${origin} is not installed on this Kernel.`,
+        )
+      }
+      if (wantsCallable) {
+        const described = describeCallableFromSchema(path, bundleRoot(result.bundle))
+        if (described === undefined) throw missingCallableDescription(path.raw)
+        return described
+      }
+      return result
+    },
+    format: (value, format) => output(value, format),
+  })
+}
+
+export function parseIntrospectTarget(target: string): { origin: string; path: Path } {
+  if (target.startsWith('@')) {
+    throw new AstraleError(
+      'NOT_A_DOMAIN',
+      'introspect requires a Domain origin or Path, not an @id.',
+      'Example: astrale introspect host.astrale.ai  or  /:host.astrale.ai:class.Manager:createInstance',
+    )
+  }
+  const raw = target.startsWith('/') ? target : `/:${target}`
+  let path: Path
+  try {
+    path = Path.parse(raw)
+  } catch (error) {
+    throw new AstraleError(
+      'PATH_INVALID',
+      error instanceof Error ? error.message : 'Invalid introspect target',
+    )
+  }
+  if (path.ast.anchor.kind !== 'domain') {
+    throw new AstraleError('NOT_A_DOMAIN', 'introspect requires a Domain-rooted Path or origin.')
+  }
+  return { origin: path.ast.anchor.origin, path }
+}
+
+function isCallablePath(path: Path): boolean {
+  const last = path.ast.steps.at(-1)
+  if (last === undefined) return false
+  if (last.kind === 'method') return true
+  return last.kind === 'projection' && last.projection.kind === 'function'
+}
+
+function bundleRoot(bundle: unknown): unknown {
+  if (bundle !== null && typeof bundle === 'object' && 'root' in bundle) {
+    return (bundle as { root: unknown }).root
+  }
+  return bundle
+}
+
+export default {
+  name: 'introspect',
+  description: 'Read installed Domain schema from the Kernel Schema syscall',
+  afterHelpText: `
+Behavior:
+  Calls the public Kernel introspect syscall for one installed Domain.
+  A bare origin (host.astrale.ai or /:host.astrale.ai) prints installation
+  state, target, source, readiness, and capabilities. --bundle includes the
+  schema bundle. A method or Function Path projects that callable's
+  input/output from the installed bundle.
+
+Examples:
+  $ astrale introspect host.astrale.ai
+  $ astrale introspect /:host.astrale.ai --bundle
+  $ astrale introspect /:host.astrale.ai:class.Manager:createInstance
+  $ astrale introspect /:kernel.astrale.ai:function.journal
+`,
+  arguments: [{ name: 'target', description: 'Domain origin or canonical Path' }],
+  options: [{ flags: '--bundle', description: 'Include the installed schema bundle' }],
+  action: async (target, opts) => {
+    await introspectCommand(target as string, opts as IntrospectOpts)
+  },
+} satisfies CommandDefinition

package/src/commands/logs.ts

@@ -6,7 +6,13 @@ import type { ConnectionContext, KernelCommandOpts } from '../connection'
 import type { Column, ListProjection } from '../lib/output'
 import type { CommandDefinition } from '../program/index'
 
-import { createPathCall, runKernelCommand, withClientSession } from '../connection'
+import {
+  createPathCall,
+  expandSelfInPath,
+  runKernelCommand,
+  withClientSession,
+} from '../connection'
+import { failClosed } from '../lib/log'
 import { isMachine, output, presentList } from '../lib/output'
 
 const JOURNAL_PATH = Path.project(syscalls.journal.ref).raw
@@ -50,10 +56,18 @@ export interface JournalInput {
   readonly limit: number
 }
 
+const ISO_TIMESTAMP = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/
+const CURSOR_TOKEN = /^[A-Za-z0-9._:+=/-]{8,}$/
+
 /** Map flags to the exact public journal syscall input without legacy glob/sequence lowering. */
 export function buildJournalInput(opts: LogsOpts): JournalInput {
   const exact = nonEmpty(opts.topic)
   const prefix = nonEmpty(opts.topicPrefix)
+  const since = timestampFlag('--since', opts.since)
+  const until = timestampFlag('--until', opts.until)
+  if (since !== undefined && until !== undefined && Date.parse(since) > Date.parse(until)) {
+    throw new TypeError('--since must be earlier than or equal to --until')
+  }
   return {
     ...(exact === undefined && prefix === undefined
       ? {}
@@ -64,13 +78,30 @@ export function buildJournalInput(opts: LogsOpts): JournalInput {
           },
         }),
     ...(nonEmpty(opts.principal) === undefined ? {} : { principal: opts.principal }),
-    ...(nonEmpty(opts.since) === undefined ? {} : { since: opts.since }),
-    ...(nonEmpty(opts.until) === undefined ? {} : { until: opts.until }),
-    ...(nonEmpty(opts.cursor) === undefined ? {} : { cursor: opts.cursor }),
+    ...(since === undefined ? {} : { since }),
+    ...(until === undefined ? {} : { until }),
+    ...(opts.cursor === undefined ? {} : { cursor: cursorFlag(opts.cursor) }),
     limit: opts.limit === undefined ? DEFAULT_LIMIT : positiveInteger('--limit', opts.limit),
   }
 }
 
+function timestampFlag(name: string, raw: string | undefined): string | undefined {
+  const value = nonEmpty(raw)
+  if (value === undefined) return undefined
+  if (!ISO_TIMESTAMP.test(value) || Number.isNaN(Date.parse(value))) {
+    throw new TypeError(`${name} must be an ISO-8601 timestamp (e.g. 2026-08-19T16:51:10.049Z)`)
+  }
+  return value
+}
+
+function cursorFlag(raw: string): string {
+  const value = raw.trim()
+  if (!CURSOR_TOKEN.test(value)) {
+    throw new TypeError('--cursor must be an opaque journal resume token (at least 8 characters)')
+  }
+  return value
+}
+
 /** Validate the record fields the CLI presentation consumes and retain the opaque cursor. */
 export function acceptJournalPage(input: unknown): JournalPage {
   if (!isRecord(input) || !Array.isArray(input.records)) {
@@ -196,6 +227,14 @@ function positiveInteger(flag: string, raw: string): number {
   return value
 }
 
+async function prepareLogsOpts(opts: LogsOpts): Promise<LogsOpts> {
+  buildJournalInput(opts)
+  const principal = nonEmpty(opts.principal)
+  if (principal !== '@self') return opts
+  const { path } = await expandSelfInPath('@self', opts)
+  return { ...opts, principal: path.startsWith('@') ? path.slice(1) : path }
+}
+
 function nonEmpty(input: string | undefined): string | undefined {
   const value = input?.trim()
   return value ? value : undefined
@@ -234,7 +273,12 @@ Examples:
     { flags: '--follow', description: 'Poll using returned cursors until interrupted' },
   ],
   action: async (opts: LogsOpts) => {
-    if (opts.follow) await follow(opts)
-    else await runOnce(opts)
+    try {
+      const prepared = await prepareLogsOpts(opts)
+      if (prepared.follow) await follow(prepared)
+      else await runOnce(prepared)
+    } catch (error) {
+      failClosed(error, opts)
+    }
   },
 } satisfies CommandDefinition

package/src/commands/mutate.ts

@@ -8,7 +8,7 @@ import type { CommandDefinition } from '../program/index'
 
 import { runKernelCommand } from '../connection'
 import { prepareMutation } from '../graph/index'
-import { log } from '../lib/log'
+import { failClosed } from '../lib/log'
 import { output } from '../lib/output'
 import { renderTable } from '../lib/table'
 
@@ -23,8 +23,7 @@ export async function mutateCommand(opts: MutateOpts): Promise<void> {
   try {
     mutation = prepareMutation(await readDocument(opts))
   } catch (error) {
-    log.error(error instanceof Error ? error.message : 'Invalid Mutation V3 document')
-    process.exit(1)
+    failClosed(error, opts)
   }
 
   if (opts.dry) {

package/src/commands/query.ts

@@ -7,7 +7,7 @@ import type { CommandDefinition } from '../program/index'
 
 import { expandSelfInPath, runKernelCommand, withSelfHint } from '../connection'
 import { prepareQuery, type QueryCommandInput } from '../graph/index'
-import { log } from '../lib/log'
+import { failClosed } from '../lib/log'
 import { isMachine, output } from '../lib/output'
 
 type QueryOpts = KernelCommandOpts & {
@@ -48,16 +48,14 @@ export async function queryCommand(sources: string[], opts: QueryOpts): Promise<
       }
     }
   } catch (error) {
-    log.error(error instanceof Error ? error.message : 'Invalid query')
-    process.exit(1)
+    failClosed(error, opts)
   }
 
   let prepared
   try {
     prepared = prepareQuery(input)
   } catch (error) {
-    log.error(error instanceof Error ? error.message : 'Invalid Query V6 document')
-    process.exit(1)
+    failClosed(error, opts)
   }
 
   await runKernelCommand({

package/src/commands/token.ts

@@ -4,7 +4,10 @@ import type { KernelCommandOpts } from '../connection'
 import type { CommandDefinition } from '../program/index'
 
 import { runKernelCommand } from '../connection'
-import { log } from '../lib/log'
+import { AstraleError } from '../errors'
+import { decodeJwtExpiration } from '../lib/local-status'
+import { failClosed, log } from '../lib/log'
+import { output } from '../lib/output'
 
 /**
  * `astrale token` — mint a fresh delegation token for the active instance
@@ -20,6 +23,7 @@ export type TokenOpts = KernelCommandOpts & {
 
 export async function tokenCommand(opts: TokenOpts): Promise<void> {
   const commandOpts: TokenOpts = opts.for && !opts.as ? { ...opts, as: opts.for } : opts
+  const ttl = parseTtl(commandOpts.ttl)
   await runKernelCommand<string>({
     opts: commandOpts,
     label: 'Minting delegation token',
@@ -28,8 +32,6 @@ export async function tokenCommand(opts: TokenOpts): Promise<void> {
         commandOpts.audience === undefined
           ? ctx.target.kernelIssuer
           : issuer.accept(commandOpts.audience)
-      const parsedTtl = Number(commandOpts.ttl)
-      const ttl = Number.isFinite(parsedTtl) && parsedTtl > 0 ? parsedTtl : 3600
       const self = await ctx.auth.whoami()
       return ctx.auth.delegate(self.id, {
         audience,
@@ -37,17 +39,37 @@ export async function tokenCommand(opts: TokenOpts): Promise<void> {
         attenuation: { kind: 'identity', self: true },
       })
     },
-    format: (token, fmtOpts, isRaw) => {
-      if (isRaw) {
-        process.stdout.write(token + '\n')
+    format: (token, fmtOpts) => {
+      if (fmtOpts.json || fmtOpts.format !== undefined) {
+        output({ token, expiresAt: decodeJwtExpiration(token)?.expiresAt ?? null }, fmtOpts)
         return
       }
-      log.dim('  (delegation token — ES256, self-identity)')
+      if (!fmtOpts.raw && (process.stdout.isTTY ?? false)) {
+        log.dim('  (delegation token — ES256, self-identity)')
+      }
       process.stdout.write(`${token}\n`)
     },
   })
 }
 
+export function parseTtl(raw: string | undefined): number {
+  if (raw === undefined) return 3600
+  if (!/^\d+$/.test(raw)) {
+    throw new AstraleError(
+      'INVALID_FLAG',
+      `Invalid --ttl value "${raw}" — expected a positive integer (seconds)`,
+    )
+  }
+  const value = Number.parseInt(raw, 10)
+  if (!Number.isSafeInteger(value) || value <= 0) {
+    throw new AstraleError(
+      'INVALID_FLAG',
+      `Invalid --ttl value "${raw}" — must be a positive integer`,
+    )
+  }
+  return value
+}
+
 export default {
   name: 'token',
   description: 'Mint a fresh delegation token for the active instance + identity',
@@ -63,6 +85,7 @@ Behavior:
 
 Examples:
   $ export TOKEN=$(astrale token --audience shell.astrale.ai --raw)
+  $ astrale token --json -i staging
   $ astrale token --audience worker.example.com --for alice -i staging
 `,
   options: [
@@ -74,6 +97,10 @@ Examples:
     { flags: '--for <identity>', description: 'Mint the token for this identity (alias of --as)' },
   ],
   action: async (opts) => {
-    await tokenCommand(opts as Parameters<typeof tokenCommand>[0])
+    try {
+      await tokenCommand(opts as Parameters<typeof tokenCommand>[0])
+    } catch (error) {
+      failClosed(error, opts as TokenOpts)
+    }
   },
 } satisfies CommandDefinition

package/src/commands/update.ts

@@ -116,26 +116,47 @@ export type StaleReport = {
 }
 
 async function cliStale(opts: UpdateOpts): Promise<StaleReport['cli']> {
+  const running = pkg.version
+  const latest = await fetchNpmLatestVersion().catch(() => undefined)
   try {
     const r = await updateAstrale({
       check: true,
       channel: opts.channel,
       version: opts.version,
-      currentVersion: pkg.version,
+      currentVersion: running,
     })
-    // `check: true` never returns 'updated'; narrow for the type checker.
-    if (r.status === 'updated') return { stale: false, managed: false, current: r.currentVersion }
+    if (r.status === 'updated') {
+      return { stale: false, managed: false, current: running, latest: latest ?? running }
+    }
     return {
-      stale: r.status === 'available',
+      stale: latest !== undefined ? latest !== running : r.status === 'available',
       managed: false,
-      current: r.currentVersion,
-      latest: r.latestVersion,
-      channel: r.channel,
+      current: running,
+      latest: latest ?? r.latestVersion,
+      channel: latest !== undefined ? 'npm' : r.channel,
     }
   } catch {
-    // A package-managed install (or missing metadata) can't self-update — not stale.
-    return { stale: false, managed: true }
+    return {
+      stale: latest !== undefined && latest !== running,
+      managed: true,
+      current: running,
+      ...(latest === undefined ? {} : { latest, channel: 'npm' }),
+    }
+  }
+}
+
+async function fetchNpmLatestVersion(): Promise<string> {
+  const response = await fetch('https://registry.npmjs.org/@astrale-os/cli/latest')
+  if (!response.ok) throw new Error(`npm registry HTTP ${response.status}`)
+  const body: unknown = await response.json()
+  if (
+    body === null ||
+    typeof body !== 'object' ||
+    typeof (body as { version?: unknown }).version !== 'string'
+  ) {
+    throw new Error('npm registry latest document is missing version')
   }
+  return (body as { version: string }).version
 }
 
 async function sdkStale(): Promise<StaleReport['sdk']> {