@astrale-os/sdk 0.4.18 → 0.5.0-beta.1

package/src/auth/verify.ts

@@ -1,199 +0,0 @@
-/**
- * Inbound credential verification.
- *
- * Uses kernel-core's credential verification infrastructure
- * (CredentialMethodResolver, MethodRegistry) instead of manual JWT handling.
- * Not tied to JWT — supports any credential method kernel-core provides.
- */
-
-import type {
-  Attestation,
-  CredentialInput,
-  Delegation,
-  IssuerId,
-  VerifiedCredential,
-} from '@astrale-os/kernel-core'
-
-import {
-  CredentialMethodResolver,
-  MethodRegistry,
-  SignatureVerificationError,
-  SigningKeyNotFoundError,
-  verifyAudience,
-  verifyCredential,
-} from '@astrale-os/kernel-core'
-import { createLocalJWKSet, createRemoteJWKSet, type JWK } from 'jose'
-
-import type { RemoteIdentityConfig } from './identity.js'
-
-import { derivePublicJwk } from '../server/jwks.js'
-import { canonicalizeServingUrl } from '../server/serving-url.js'
-
-export type VerifiedInbound = {
-  /** The full verified credential (iss, sub, aud, claims) */
-  verified: VerifiedCredential
-  /** Issuer URL (from credential's iss claim) */
-  issuer: string
-  /** Attestation — proves caller can invoke this function */
-  attestation: Attestation
-  /** Delegation — scoped caller permissions as kernel-signed credential */
-  delegation: Delegation
-}
-
-const methodResolver = new CredentialMethodResolver(new MethodRegistry())
-
-// JWKS resolvers cached per JWKS URL (module-level, like the pools/selfIds
-// Maps in kernel-client.ts). jose handles freshness WITHIN a resolver: 10min
-// max-age, 30s fetch cooldown, and auto-refetch on kid-miss when not cooling
-// down. The one gap — issuer restarts with new keys while the cooldown pins
-// the old set (the incident that got a prior indefinite cache removed) — is
-// covered by evict-and-retry-once in `verifyInboundCredential`, so indefinite
-// Map residency is safe and the per-call JWKS fetch is gone.
-const remoteResolvers = new Map<string, ReturnType<typeof createRemoteJWKSet>>()
-
-// Self-issued credentials verify against the worker's own in-memory key;
-// cache the local JWKS per canonical self-issuer (one key per worker) so the
-// public-JWK derivation isn't redone on every request.
-const localResolvers = new Map<string, ReturnType<typeof createLocalJWKSet>>()
-
-/** Clear cached JWKS resolvers. Used in tests when keys rotate between fixtures. */
-export function clearJwksCache(): void {
-  remoteResolvers.clear()
-  localResolvers.clear()
-}
-
-/**
- * M-28 fix: a bare-slug iss (`mails.localhost`) makes
- * `new URL('mails.localhost/.well-known/jwks.json')` throw "Invalid URL
- * string". The dispatcher's identity map normalizes the iss it signs with,
- * but inbound creds from older clients may still carry the slug form. Coerce
- * to a URL with a default `https://` scheme (matches kernel.astrale.ai
- * canonical form). If the actual receiver is on http://localhost the
- * receiver-side resolver still works because both endpoints are on localhost
- * — but for prod targets requiring TLS this is the right default.
- */
-function jwksUrlFor(issuer: string): string {
-  const normalized = /^https?:\/\//.test(issuer) ? issuer : `https://${issuer}`
-  return `${normalized}/.well-known/jwks.json`
-}
-
-function getRemoteResolver(jwksUrl: string): ReturnType<typeof createRemoteJWKSet> {
-  let resolver = remoteResolvers.get(jwksUrl)
-  if (!resolver) {
-    resolver = createRemoteJWKSet(new URL(jwksUrl))
-    remoteResolvers.set(jwksUrl, resolver)
-  }
-  return resolver
-}
-
-function getLocalResolver(
-  selfIssuer: string,
-  privateKey: RemoteIdentityConfig['privateKey'],
-): ReturnType<typeof createLocalJWKSet> {
-  let resolver = localResolvers.get(selfIssuer)
-  if (!resolver) {
-    resolver = createLocalJWKSet({ keys: [derivePublicJwk(privateKey) as JWK] })
-    localResolvers.set(selfIssuer, resolver)
-  }
-  return resolver
-}
-
-/**
- * Build the key resolver for one verifying server. Captures `config` so it can
- * short-circuit the server's OWN issuer (`config.issuer`): a self-issued
- * credential is verified against the in-memory public key, never fetched — a
- * Worker can't fetch its own hostname, and it already holds the key. Every other
- * issuer is resolved via the cached per-URL JWKS resolvers above; every JWKS
- * URL touched is recorded in `resolvedJwksUrls` so the caller can evict
- * exactly those resolvers if verification fails on an unknown signing key.
- */
-function makeResolveKeys(config: RemoteIdentityConfig, resolvedJwksUrls: Set<string>) {
-  // The worker's own canonical iss. STRICT: `config.issuer` is the serving URL
-  // by contract (both producers — buildIdentityMap / buildAuxIdentityMap — feed
-  // it `canonicalizeServingUrl(config.url)`), so a value that doesn't parse is
-  // a construction-time config error. Swallowing it would silently disable
-  // self-verification and route self-issued credentials to a JWKS fetch on the
-  // worker's own hostname — which Cloudflare forbids — turning a config bug
-  // into an opaque per-call failure.
-  const selfIssuer = canonicalizeServingUrl(config.issuer)
-
-  return async (issuer: IssuerId, _method: string, _kid?: string) => {
-    const url = issuer as string
-
-    // Self-issued credential (iss == this worker's own serving URL): resolve
-    // from the in-memory public key. Never fetch self — Cloudflare forbids a
-    // Worker fetching its own hostname, and the published JWKS is this key.
-    if (selfIssuer !== undefined) {
-      let canonical: string | undefined
-      try {
-        canonical = canonicalizeServingUrl(url)
-      } catch {
-        canonical = undefined
-      }
-      if (canonical === selfIssuer) {
-        return getLocalResolver(selfIssuer, config.privateKey)
-      }
-    }
-
-    const jwksUrl = jwksUrlFor(url)
-    resolvedJwksUrls.add(jwksUrl)
-    return getRemoteResolver(jwksUrl)
-  }
-}
-
-/**
- * Verify an inbound delegation credential using kernel-core's verification.
- *
- * @throws AuthenticationError subclasses from kernel-core on verification failure
- */
-export async function verifyInboundCredential(
-  credential: CredentialInput,
-  config: RemoteIdentityConfig,
-): Promise<VerifiedInbound> {
-  // Verify using kernel-core's credential verification pipeline
-  const resolvedJwksUrls = new Set<string>()
-  const deps = { methodResolver, resolveKeys: makeResolveKeys(config, resolvedJwksUrls) }
-  let verified: VerifiedCredential
-  try {
-    verified = await verifyCredential(deps, credential)
-  } catch (error) {
-    // A cached resolver can hold a stale key set after the issuer rotates:
-    //  - new kid → jose kid-misses but its 30s fetch cooldown blocks the
-    //    refetch (SigningKeyNotFoundError) — the incident that got a prior
-    //    indefinite cache removed;
-    //  - SAME kid, new key material (kernel kids derive from the subject, so
-    //    a re-keyed issuer reuses its kid) → the signature check fails
-    //    (SignatureVerificationError).
-    // Both: evict the resolver(s) this verification touched and retry ONCE
-    // with fresh ones. Forged-token spam thus costs at most one JWKS fetch
-    // per bad credential — equal to the uncached per-call baseline, never
-    // worse. An empty set means self-issued — refetching can't help, rethrow.
-    const staleKeySuspect =
-      error instanceof SigningKeyNotFoundError || error instanceof SignatureVerificationError
-    if (!staleKeySuspect || resolvedJwksUrls.size === 0) throw error
-    for (const url of resolvedJwksUrls) remoteResolvers.delete(url)
-    verified = await verifyCredential(deps, credential)
-  }
-
-  // Validate audience matches this function's issuer (its serving URL).
-  // kernel-core's verifyAudience compares canonically.
-  verifyAudience(verified, (config.audience ?? config.issuer) as IssuerId)
-
-  // Extract attestation and delegation from claims
-  const attestation = verified.claims.attestation as Attestation | undefined
-  if (!attestation?.expr) {
-    throw new Error('Credential missing attestation')
-  }
-
-  const delegation = verified.claims.delegation as Delegation | undefined
-  if (!delegation?.credential) {
-    throw new Error('Credential missing delegation')
-  }
-
-  return {
-    verified,
-    issuer: verified.iss as string,
-    attestation,
-    delegation,
-  }
-}

package/src/cli/bin.ts

@@ -1,15 +0,0 @@
-#!/usr/bin/env bun
-/**
- * `astrale-domain` bin entry. Runs under bun (native TS) so it can import the
- * project's `astrale.config.ts` directly — matching the `astrale` CLI.
- */
-
-import { run } from './run.js'
-
-run(process.argv.slice(2))
-  .then((code) => process.exit(code))
-  .catch((err: unknown) => {
-    process.stderr.write(`\x1b[31m✗\x1b[0m ${(err as Error).message ?? String(err)}\n`)
-    if (process.env.DEBUG) process.stderr.write(`${(err as Error).stack ?? ''}\n`)
-    process.exit(1)
-  })

package/src/cli/dotenv.ts

@@ -1,65 +0,0 @@
-/**
- * Minimal dotenv parser — the secrets-file boundary.
- *
- * `secrets: '.env.<env>'` in an adapter's params points a gitignored file whose
- * entire contents are secrets. `loadDotenvFile` reads it into a flat
- * `Record<string,string>` the CLI hands the adapter (injected into the local
- * runtime in dev, pushed to a secret store in prod). No `process.env` mutation,
- * no interpolation magic beyond `${VAR}` against earlier keys in the same file.
- */
-
-import { readFileSync } from 'node:fs'
-
-export function parseDotenv(contents: string): Record<string, string> {
-  const out: Record<string, string> = {}
-  for (const raw of contents.split('\n')) {
-    const line = raw.trim()
-    if (!line || line.startsWith('#')) continue
-    const match = /^(?:export\s+)?([A-Za-z_]\w*)\s*=\s*(.*)$/.exec(line)
-    if (!match) continue
-    const [, key, rawValue] = match
-    let value = rawValue.trim()
-    // Single quotes mean a LITERAL value (standard dotenv): no `${VAR}`
-    // interpolation, so a secret that legitimately contains a literal `${...}`
-    // (e.g. a password) survives intact instead of being silently blanked.
-    const singleQuoted = value.length >= 2 && value.startsWith("'") && value.endsWith("'")
-    if ((value.length >= 2 && value.startsWith('"') && value.endsWith('"')) || singleQuoted) {
-      value = value.slice(1, -1)
-    }
-    out[key] = singleQuoted
-      ? value
-      : value.replace(/\$\{(\w+)\}/g, (_, name: string) => out[name] ?? '')
-  }
-  return out
-}
-
-/** Read + parse a dotenv file. Returns `{}` if the file is absent (CI-safe). */
-export function loadDotenvFile(path: string): Record<string, string> {
-  let contents: string
-  try {
-    contents = readFileSync(path, 'utf-8')
-  } catch {
-    return {}
-  }
-  return parseDotenv(contents)
-}
-
-/**
- * Read + parse a dotenv file the preset explicitly DECLARED (`secrets:`).
- * Declared-but-absent is a wiring error (the gitignored file was never created
- * on this machine), so it throws instead of loading `{}` — silently forwarding
- * nothing surfaces much later as an empty credential at the provider. A file
- * that exists but holds no keys is legitimate (a domain with no secrets yet).
- */
-export function loadDeclaredSecrets(path: string, declaration: string): Record<string, string> {
-  let contents: string
-  try {
-    contents = readFileSync(path, 'utf-8')
-  } catch {
-    throw new Error(
-      `Secrets file '${declaration}' is declared in the preset but missing at ${path}. ` +
-        `Create it (it may be empty) or remove 'secrets:' from the preset.`,
-    )
-  }
-  return parseDotenv(contents)
-}

package/src/cli/index.ts

@@ -1,15 +0,0 @@
-/**
- * `@astrale-os/sdk/cli` — the `astrale-domain` CLI (dev | build | deploy) and
- * the dotenv secrets-file boundary, folded in from the former
- * `@astrale-os/devkit` package.
- *
- * Node-only: the CLI imports `node:fs`/`node:module`/`node:url` and runs under
- * Bun (it imports the project's `astrale.config.ts` directly). This subpath is
- * deliberately NOT re-exported from the package barrel — pulling it into the
- * isomorphic `.` entry would poison browser/worker bundlers that traverse every
- * re-export (the same rule that keeps `./server` and `./deploy` off the barrel).
- * The bin lives at `./bin`.
- */
-
-export { run, parseArgs } from './run.js'
-export { parseDotenv, loadDotenvFile, loadDeclaredSecrets } from './dotenv.js'

package/src/cli/log.ts

@@ -1,18 +0,0 @@
-/** CLI output helpers + ANSI colours, shared by run.ts and publish.ts. */
-
-export const GREEN = '\x1b[32m'
-export const DIM = '\x1b[2m'
-export const BOLD = '\x1b[1m'
-export const YELLOW = '\x1b[33m'
-export const RED = '\x1b[31m'
-export const RESET = '\x1b[0m'
-
-export function info(msg: string): void {
-  process.stdout.write(`${DIM}›${RESET} ${msg}\n`)
-}
-export function warn(msg: string): void {
-  process.stderr.write(`${YELLOW}!${RESET} ${msg}\n`)
-}
-export function error(msg: string): void {
-  process.stderr.write(`${RED}✗${RESET} ${msg}\n`)
-}

package/src/cli/publish.ts

@@ -1,341 +0,0 @@
-/**
- * All `publish` logic — the schema-publish step, the admin-catalog register, and
- * the release orchestration tying them together. `run.ts` only parses args and
- * dispatches here.
- *
- * A release has two halves that must stay in sync: the CONTRACT (the `./schema`
- * package on npm, so other domains can `imports`/`implements`/`extends` it) and
- * the DEPLOYMENT (the worker URL in the admin catalog). They run npm-FIRST — npm
- * publish is irreversible, so the catalog is registered only on schema-publish
- * success, never pointing at an unpublished contract.
- *
- * Why `pnpm pack` then `npm publish <tarball>` (not a plain `npm publish`): a
- * schema package ships only `dist` and uses `publishConfig` to repoint
- * main/exports from source `.ts` to `dist` — a field override only PNPM applies,
- * so npm would otherwise publish an entry pointing at unshipped source.
- */
-import { spawn } from 'node:child_process'
-import { existsSync, mkdtempSync, readdirSync, readFileSync, rmSync } from 'node:fs'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-
-import { BOLD, DIM, error, GREEN, info, RESET, warn } from './log.js'
-
-type SchemaPkg = {
-  name?: string
-  version?: string
-  private?: boolean
-  files?: readonly string[]
-  peerDependencies?: Record<string, string>
-  dependencies?: Record<string, string>
-  optionalDependencies?: Record<string, string>
-  publishConfig?: { access?: string }
-}
-
-// ── release orchestration (schema THEN catalog) ──────────────────────────────
-
-/** `publish` (no deploy): publish the schema, then register the deployed URL. */
-export async function runRelease(opts: {
-  projectDir: string
-  origin: string
-  name?: string
-  publicUrl?: string
-  skipSchema: boolean
-  dryRun: boolean
-  otp?: string
-  installByDefault?: boolean
-}): Promise<number> {
-  const schemaCode = await publishSchemaBeforeCatalog(opts.projectDir, opts)
-  if (schemaCode !== 0) return schemaCode
-
-  const url = opts.publicUrl ?? `https://${opts.origin}`
-  if (opts.dryRun) {
-    info(`dry-run: would register ${opts.origin} → ${url} in the admin catalog (not registered).`)
-    return 0
-  }
-  info(`registering ${opts.origin} → ${url} in the admin catalog (no deploy)`)
-  return await registerCatalog(opts.projectDir, opts, url)
-}
-
-/** The `deploy --publish` tail: publish the schema, then register the just-deployed URL. */
-export async function runReleaseAfterDeploy(opts: {
-  projectDir: string
-  origin: string
-  deployedUrl: string
-  name?: string
-  skipSchema: boolean
-  otp?: string
-  installByDefault?: boolean
-}): Promise<number> {
-  const schemaCode = await publishSchemaBeforeCatalog(opts.projectDir, { ...opts, dryRun: false })
-  if (schemaCode !== 0) return schemaCode
-  return await registerCatalog(opts.projectDir, opts, opts.deployedUrl)
-}
-
-/**
- * The schema half of a release. npm publish is irreversible, so it runs FIRST:
- * returns 0 to proceed (published | skipped | no `./schema` package), non-zero to
- * ABORT before the catalog touch — so the catalog never points at an unpublished
- * contract.
- */
-async function publishSchemaBeforeCatalog(
-  projectDir: string,
-  opts: { skipSchema: boolean; dryRun: boolean; otp?: string },
-): Promise<number> {
-  if (opts.skipSchema) return 0
-  if (!existsSync(join(projectDir, 'schema', 'package.json'))) {
-    info('no ./schema package — registering the catalog only.')
-    return 0
-  }
-  const code = await publishSchema({
-    projectDir,
-    schemaDir: 'schema',
-    dryRun: opts.dryRun,
-    ...(opts.otp !== undefined ? { otp: opts.otp } : {}),
-  })
-  if (code !== 0)
-    error(
-      'schema publish failed — NOT registering the catalog (a catalog entry must never point ' +
-        'at an unpublished contract). Fix the schema package and re-run, or pass --skip-schema.',
-    )
-  return code
-}
-
-/**
- * Register a domain's public URL in the admin catalog by shelling out to the
- * operator CLI (`astrale domain publish`). Deliberately a subprocess: all
- * credential/admin-target resolution lives in `@astrale-os/cli`, kept out of
- * this build tool. A missing `astrale` is reported with the exact line to run by
- * hand. The catalog `name` is a short slug (the origin's first label by default),
- * distinct from the FQDN origin and from any `@scope/…` npm package name.
- */
-async function registerCatalog(
-  projectDir: string,
-  opts: { origin: string; name?: string; installByDefault?: boolean },
-  url: string,
-): Promise<number> {
-  const { description } = readPackageMeta(projectDir)
-  const name = opts.name ?? opts.origin.split('.')[0] ?? opts.origin
-  // `--public-url`, not `--url`: the operator CLI reserves `--url` for kernel targeting.
-  const cliArgs = [
-    'domain',
-    'publish',
-    '--origin',
-    opts.origin,
-    '--name',
-    name,
-    '--public-url',
-    url,
-  ]
-  if (description) cliArgs.push('--description', description)
-  if (opts.installByDefault) cliArgs.push('--install-by-default')
-
-  info(`publishing to the admin catalog → astrale ${cliArgs.join(' ')}`)
-  return await new Promise<number>((resolve) => {
-    const child = spawn('astrale', cliArgs, { stdio: 'inherit' })
-    child.on('error', (err) => {
-      if ((err as NodeJS.ErrnoException).code === 'ENOENT')
-        error(
-          `\`astrale\` CLI not found on PATH. Register it by hand:\n      astrale ${cliArgs.join(' ')}`,
-        )
-      else error(`failed to run \`astrale domain publish\`: ${err.message}`)
-      resolve(1)
-    })
-    child.on('exit', (code) => resolve(code ?? 1))
-  })
-}
-
-function readPackageMeta(projectDir: string): { name?: string; description?: string } {
-  try {
-    return JSON.parse(readFileSync(join(projectDir, 'package.json'), 'utf8')) as {
-      name?: string
-      description?: string
-    }
-  } catch {
-    return {}
-  }
-}
-
-// ── schema publish ───────────────────────────────────────────────────────────
-
-/**
- * Build a domain's thin schema package and publish it to npm. Operates on the
- * schema PACKAGE (its own package.json), not astrale.config.ts, so it needs no
- * adapter — `publish --schema` runs it config-free.
- */
-export async function publishSchema(args: {
-  projectDir: string
-  /** Schema-package dir. Default: `<projectDir>/schema`, else `<projectDir>`. */
-  schemaDir?: string
-  dryRun: boolean
-  /** 2FA one-time password forwarded to `npm publish`. */
-  otp?: string
-}): Promise<number> {
-  const dir = resolveSchemaDir(args.projectDir, args.schemaDir)
-  if (!dir) {
-    error(
-      `No schema package found (no package.json at ./schema or the current dir). A schema\n` +
-        `  package declares peerDependencies (@astrale-os/kernel-core + kernel-dsl + zod) and a\n` +
-        `  publishConfig that repoints main/exports to ./dist — see domains/shell/schema.`,
-    )
-    return 1
-  }
-
-  const pkgPath = join(dir, 'package.json')
-  let pkg: SchemaPkg
-  try {
-    pkg = JSON.parse(readFileSync(pkgPath, 'utf8')) as SchemaPkg
-  } catch (err) {
-    error(`Could not read ${pkgPath}: ${(err as Error).message}`)
-    return 1
-  }
-
-  const problems = preflight(pkg)
-  if (problems.length > 0) {
-    error(`Schema package is not ready to publish (${pkgPath}):`)
-    for (const p of problems) process.stderr.write(`    • ${p}\n`)
-    return 1
-  }
-  const name = pkg.name as string
-  const version = pkg.version as string
-
-  // Idempotent in BOTH modes: a dry-run must skip too, since `npm publish
-  // --dry-run` still validates against the registry and errors on an existing version.
-  if (await isOnRegistry(name, version)) {
-    info(
-      `${BOLD}${name}@${version}${RESET} is already published — ` +
-        (args.dryRun ? `a real run would skip it.` : `bump the version to ship again.`),
-    )
-    return 0
-  }
-
-  const dest = mkdtempSync(join(tmpdir(), 'astrale-schema-pack-'))
-  try {
-    info(`packing ${BOLD}${name}@${version}${RESET} from ${rel(args.projectDir, dir)}`)
-    if ((await runInherit('pnpm', ['pack', '--pack-destination', dest], dir)) !== 0) {
-      error(`pnpm pack failed — see the build output above.`)
-      return 1
-    }
-    const tarball = readdirSync(dest)
-      .filter((f) => f.endsWith('.tgz'))
-      .map((f) => join(dest, f))[0]
-    if (!tarball) {
-      error(`pnpm pack produced no .tgz in ${dest}.`)
-      return 1
-    }
-
-    // `--access` mirrors the manifest's baked publishConfig.access; npm's 2FA
-    // prompt passes through `stdio: 'inherit'` (or `--otp` for non-interactive).
-    const access = pkg.publishConfig?.access ?? 'public'
-    const publishArgs = [
-      'publish',
-      tarball,
-      '--access',
-      access,
-      ...(args.dryRun ? ['--dry-run'] : []),
-      ...(args.otp ? ['--otp', args.otp] : []),
-    ]
-    info(
-      args.dryRun
-        ? `dry-run: ${DIM}npm ${publishArgs.join(' ')}${RESET}`
-        : `publishing ${DIM}(a browser / OTP prompt may appear for 2FA)${RESET}`,
-    )
-    const code = await runInherit('npm', publishArgs)
-    if (code !== 0) {
-      error(
-        `npm publish exited ${code}. An auth error (E401/E404) usually means the session ` +
-          `expired — \`npm login\` and retry.`,
-      )
-      return code
-    }
-    if (args.dryRun) info(`dry-run complete — nothing was published.`)
-    else printPublished(name, version)
-    return 0
-  } finally {
-    try {
-      rmSync(dest, { recursive: true, force: true })
-    } catch {
-      warn(`(non-fatal) could not clean the temp pack dir ${dest}`)
-    }
-  }
-}
-
-/** Locate the schema package: an explicit path, else `<projectDir>/schema`, else `<projectDir>`. */
-function resolveSchemaDir(projectDir: string, explicit?: string): string | undefined {
-  const candidates = explicit
-    ? [join(projectDir, explicit)]
-    : [join(projectDir, 'schema'), projectDir]
-  return candidates.find((c) => existsSync(join(c, 'package.json')))
-}
-
-/** Static guards against the classic schema-publish footguns, before any network call. */
-function preflight(pkg: SchemaPkg): string[] {
-  const problems: string[] = []
-  if (!pkg.name) problems.push('package.json has no "name".')
-  if (!pkg.version) problems.push('package.json has no "version".')
-  else if (!/^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/.test(pkg.version))
-    problems.push(`"version" ("${pkg.version}") must be an exact semver, not a range.`)
-  if (pkg.private) problems.push('"private": true — remove it to publish.')
-  // Peers, not deps: bundling kernel-core/dsl/zod gives the consumer a 2nd copy
-  // and breaks the def `__brand` identity at compile time.
-  if (!pkg.peerDependencies || Object.keys(pkg.peerDependencies).length === 0)
-    problems.push(
-      'no "peerDependencies" — peer-depend on @astrale-os/kernel-core (+ kernel-dsl, zod).',
-    )
-  if (!pkg.files?.includes('dist'))
-    problems.push('"files" must include "dist" (ship only the built output).')
-  if (!pkg.publishConfig)
-    problems.push('no "publishConfig" — main/types/exports won\'t repoint to ./dist at pack time.')
-  for (const field of ['dependencies', 'peerDependencies', 'optionalDependencies'] as const) {
-    for (const [dep, spec] of Object.entries(pkg[field] ?? {})) {
-      if (/^(link:|file:|workspace:)/.test(spec))
-        problems.push(
-          `${field}["${dep}"] is "${spec}" — npm can't publish that; use a semver range.`,
-        )
-    }
-  }
-  return problems
-}
-
-/** True if `<name>@<version>` already exists on the registry. */
-async function isOnRegistry(name: string, version: string): Promise<boolean> {
-  return await new Promise<boolean>((resolve) => {
-    let out = ''
-    const child = spawn('npm', ['view', `${name}@${version}`, 'version'], {
-      stdio: ['ignore', 'pipe', 'ignore'],
-    })
-    child.stdout?.on('data', (d) => (out += String(d)))
-    child.on('error', () => resolve(false)) // npm missing / not-found / offline → let publish surface it
-    child.on('exit', () => resolve(out.trim().length > 0))
-  })
-}
-
-async function runInherit(cmd: string, cmdArgs: readonly string[], cwd?: string): Promise<number> {
-  return await new Promise<number>((resolve) => {
-    const child = spawn(cmd, cmdArgs as string[], { stdio: 'inherit', ...(cwd ? { cwd } : {}) })
-    child.on('error', (err) => {
-      const c = (err as NodeJS.ErrnoException).code
-      error(
-        c === 'ENOENT'
-          ? `\`${cmd}\` not found on PATH.`
-          : `failed to run \`${cmd}\`: ${err.message}`,
-      )
-      resolve(1)
-    })
-    child.on('exit', (code) => resolve(code ?? 1))
-  })
-}
-
-function printPublished(name: string, version: string): void {
-  process.stdout.write(
-    `\n${GREEN}✓${RESET} published ${BOLD}${name}@${version}${RESET}\n` +
-      `  ${DIM}consume it:${RESET} ${BOLD}import { schema as S } from '${name}'${RESET}` +
-      `${DIM} → imports: [S], implements: [S.interfaces.X]${RESET}\n` +
-      `  ${DIM}and add ${BOLD}requires: ['<this-origin>']${RESET}${DIM} on the consumer ` +
-      `(producer installs first).${RESET}\n\n`,
-  )
-}
-
-function rel(from: string, to: string): string {
-  return to.startsWith(from) ? `.${to.slice(from.length) || '/'}` : to
-}