clawpowers 2.2.5 → 2.2.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clawpowers",
-  "version": "2.2.5",
+  "version": "2.2.7",
   "description": "Skills library for AI agents — payments, memory, RSI, wallet. Drop-in capability layer for any agent framework.",
   "type": "module",
   "main": "./dist/index.js",
@@ -14,6 +14,7 @@
   },
   "files": [
     "dist",
+    "skills",
     "src/skills",
     "native/Cargo.toml",
     "native/Cargo.lock",
@@ -28,22 +29,26 @@
     "CHANGELOG.md",
     "SECURITY.md",
     "COMPATIBILITY.md",
+    "skill.json",
     "KNOWN_LIMITATIONS.md",
     "LICENSING.md",
     "scripts/"
   ],
   "scripts": {
     "build:native": "cd native && cargo build --release --workspace || echo 'Rust not installed - using WASM/TS fallback'",
-    "build:wasm": "cd native/wasm && wasm-pack build --target nodejs --out-dir pkg-node || true",
+    "build:wasm": "node scripts/build-wasm.mjs",
     "build": "tsup",
     "test": "vitest run",
     "test:watch": "vitest",
     "typecheck": "tsc --noEmit",
     "lint": "eslint src tests benchmarks",
     "verify:pack": "npm pack --dry-run",
-    "clean": "rm -rf dist",
+    "verify:pack:surface": "npm pack --dry-run --ignore-scripts",
+    "verify:hermes": "node scripts/run-python-script.mjs scripts/verify_hermes_wrappers.py",
+    "clean": "node -e \"fs.rmSync('dist',{recursive:true,force:true})\"",
     "prepublishOnly": "npm run build",
-    "prepack": "npm run build"
+    "prepack": "npm run build:wasm && npm run build",
+    "verify:consumer-install": "node scripts/verify-consumer-install.mjs"
   },
   "keywords": [
     "ai-agent",
@@ -69,19 +74,19 @@
   },
   "homepage": "https://clawpowers.ai",
   "engines": {
-    "node": ">=20.0.0"
+    "node": ">=22.0.0"
   },
   "dependencies": {
-    "zod": "^3.23.0"
+    "zod": "^4.4.3"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",
     "@typescript-eslint/eslint-plugin": "^8.0.0",
     "@typescript-eslint/parser": "^8.0.0",
-    "eslint": "^9.0.0",
+    "eslint": "^10.3.0",
     "globals": "^17.4.0",
     "tsup": "^8.0.0",
     "typescript": "^5.5.0",
-    "vitest": "^2.0.0"
+    "vitest": "^4.1.5"
   }
 }

package/scripts/build-wasm.mjs

@@ -0,0 +1,59 @@
+#!/usr/bin/env node
+/**
+ * Build the Node-targeted WASM fallback when wasm-pack is available.
+ *
+ * Release/source checkouts may already contain committed pkg-node artifacts. In
+ * that case, do not fail prepack on machines that lack Rust/wasm-pack; verify
+ * the required artifacts are present and let the TypeScript fallback package.
+ */
+import { existsSync, rmSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { spawnSync } from 'node:child_process';
+
+const root = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+const wasmDir = resolve(root, 'native/wasm');
+const outDir = resolve(wasmDir, 'pkg-node');
+const requiredArtifacts = [
+  resolve(outDir, 'clawpowers_wasm.js'),
+  resolve(outDir, 'clawpowers_wasm_bg.wasm'),
+];
+
+function haveRequiredArtifacts() {
+  return requiredArtifacts.every(path => existsSync(path));
+}
+
+function run(command, args, options = {}) {
+  return spawnSync(command, args, {
+    stdio: 'inherit',
+    shell: process.platform === 'win32',
+    ...options,
+  });
+}
+
+const version = run('wasm-pack', ['--version'], { stdio: 'ignore' });
+
+if (version.status !== 0) {
+  if (haveRequiredArtifacts()) {
+    console.warn('[clawpowers] wasm-pack not found; using existing native/wasm/pkg-node artifacts.');
+    process.exit(0);
+  }
+
+  console.error('[clawpowers] wasm-pack is required because native/wasm/pkg-node artifacts are missing.');
+  process.exit(version.status ?? 1);
+}
+
+const build = run('wasm-pack', ['build', '--target', 'nodejs', '--out-dir', 'pkg-node'], {
+  cwd: wasmDir,
+});
+
+if (build.status !== 0) {
+  process.exit(build.status ?? 1);
+}
+
+rmSync(resolve(outDir, '.gitignore'), { force: true });
+
+if (!haveRequiredArtifacts()) {
+  console.error('[clawpowers] wasm-pack completed but required pkg-node artifacts are missing.');
+  process.exit(1);
+}

package/scripts/generate_hermes_wrappers.py

@@ -0,0 +1,211 @@
+from __future__ import annotations
+
+import json
+import re
+from pathlib import Path
+
+repo = Path(__file__).resolve().parents[1]
+catalog_path = repo / 'src/skills/catalog.ts'
+overrides_path = repo / 'scripts/hermes_wrapper_overrides.json'
+text = catalog_path.read_text()
+overrides = json.loads(overrides_path.read_text()) if overrides_path.exists() else {}
+
+pattern = re.compile(
+    r"\{\s*name:\s*'(?P<name>[^']+)'\s*,\s*description:\s*'(?P<desc>(?:[^'\\]|\\.)*)'\s*,\s*source:\s*'(?P<source>[^']+)'\s*,\s*category:\s*'(?P<category>[^']+)'\s*,\s*\}",
+    re.S,
+)
+
+
+def bullet_block(title: str, items: list[str]) -> str:
+    if not items:
+        return ''
+    lines = [f'## {title}', '']
+    lines.extend(f'- {item}' for item in items)
+    lines.append('')
+    return '\n'.join(lines)
+
+
+entries = []
+for m in pattern.finditer(text):
+    name = m.group('name')
+    desc = m.group('desc').replace("\\'", "'")
+    entries.append(
+        {
+            'name': name,
+            'description': desc,
+            'source': m.group('source'),
+            'category': m.group('category'),
+        }
+    )
+
+skills_root = repo / 'skills'
+skills_root.mkdir(exist_ok=True)
+manual_skills = {'itp'}
+generated_count = 0
+rich_count = 0
+
+for entry in entries:
+    name = entry['name']
+    if name in manual_skills:
+        continue
+
+    skill_dir = skills_root / name
+    skill_dir.mkdir(parents=True, exist_ok=True)
+
+    desc = entry['description']
+    category = entry['category']
+    source = entry['source']
+    escaped = desc.replace('"', '\\"')
+    override = overrides.get(name, {})
+
+    title = override.get('title', name)
+    summary = override.get(
+        'summary',
+        f'This Hermes-compatible skill wrapper exports the ClawPowers catalog entry for `{name}`.',
+    )
+    when_to_use = override.get('when_to_use', ['use this skill when the task matches the capability described above'])
+    quickstart = override.get('quickstart', [])
+    notes = override.get(
+        'notes',
+        [
+            'This wrapper makes the skill discoverable and loadable by Hermes as a standard `SKILL.md` bundle.',
+            'It does not, by itself, claim that every underlying runtime, CLI, API integration, or library dependency behind the broader ClawPowers ecosystem is fully configured in Hermes.',
+        ],
+    )
+
+    content = (
+        f"---\n"
+        f"name: {name}\n"
+        f"description: \"{escaped}\"\n"
+        f"metadata:\n"
+        f"  hermes:\n"
+        f"    tags: [{category}, clawpowers-catalog, hermes-compatible]\n"
+        f"---\n\n"
+        f"<!-- generated-by: scripts/generate_hermes_wrappers.py -->\n\n"
+        f"# {title}\n\n"
+        f"{summary}\n\n"
+        f"## Purpose\n\n"
+        f"{desc}\n\n"
+        f"{bullet_block('When to use', when_to_use)}"
+        f"{bullet_block('Quickstart', quickstart)}"
+        f"## Source of truth\n\n"
+        f"- Catalog source: `src/skills/catalog.ts`\n"
+        f"- Catalog entry source class: `{source}`\n"
+        f"- Category: `{category}`\n\n"
+        f"{bullet_block('Notes', notes)}"
+        f"## Compatibility boundary\n\n"
+        f"This file is part of the Hermes-compatible top-level `skills/` surface for this branch. It should be read as a discoverable skill bundle, not as a blanket claim that the wider `clawpowers` library/runtime surface is fully configured inside Hermes.\n"
+    )
+
+    (skill_dir / 'SKILL.md').write_text(content)
+    generated_count += 1
+    if override:
+        rich_count += 1
+
+
+total_exported = generated_count + len(manual_skills)
+
+(repo / 'skills' / 'README.md').write_text(
+    f'''# ClawPowers skills for Hermes
+
+This directory is the **Hermes-supported surface** for this branch.
+
+Only skills placed here are in scope for the branch's Hermes compatibility claim.
+
+## Current exported skills
+
+- Total exported skills: {total_exported}
+- Hand-authored validated wedge: `itp`
+- Catalog-derived wrappers: {generated_count}
+- Richer generated wrappers with override guidance: {rich_count}
+
+## Install shape
+
+Hermes expects skills like:
+
+```text
+~/.hermes/skills/<skill-name>/SKILL.md
+```
+
+Example:
+
+```bash
+mkdir -p ~/.hermes/skills/itp
+cp skills/itp/SKILL.md ~/.hermes/skills/itp/SKILL.md
+```
+
+## Fast verification
+
+```bash
+python3 scripts/verify_hermes_wrappers.py
+```
+
+Then validate with Hermes' own skill tooling.
+
+## Important boundary
+
+This branch now exports the full ClawPowers catalog as Hermes-loadable skill bundles, but that does **not** automatically mean every broader `clawpowers` runtime/library module is a native Hermes package surface.
+
+This branch separates:
+
+- **Hermes-compatible skill bundles** under `skills/`
+- **non-Hermes-native library/runtime surfaces** elsewhere in the repo
+'''
+)
+
+(repo / 'HERMES_COMPATIBILITY.md').write_text(
+    f'''# Hermes compatibility
+
+This branch exists to expose the **Hermes-compatible** ClawPowers surface only.
+
+## Support contract on this branch
+
+The Hermes-supported surface is the top-level `skills/` directory.
+
+Current exported Hermes-loadable skill bundles:
+
+- total exported skills: {total_exported}
+- richer validated proof bundle: `skills/itp/SKILL.md`
+- catalog-derived wrappers: {generated_count}
+- richer generated wrappers with extra operator guidance: {rich_count}
+
+## What this branch claims
+
+This branch claims that the top-level `skills/` directory is Hermes-loadable as standard `SKILL.md` bundles.
+
+## What is not part of the Hermes-native runtime claim
+
+The following may still be useful in other environments, but they are **not** currently claimed here as native Hermes runtime/package surfaces just because the skill bundles load:
+
+- the broader `clawpowers` npm capability library
+- wallet APIs as a native Hermes package feature
+- payments / x402 runtime flows as a native Hermes package feature
+- RSI, memory, swarm, and other library modules as native Hermes package features unless separately validated in that form
+
+## Validation rule
+
+A ClawPowers skill is treated as Hermes-compatible on this branch when it:
+
+1. is exported as a standard `SKILL.md` bundle under `skills/`
+2. can be discovered by Hermes from `~/.hermes/skills/`
+3. loads cleanly through Hermes' own skill tooling
+4. passes requirement checks without hidden patches
+
+## Fast verification
+
+Run:
+
+```bash
+python3 scripts/verify_hermes_wrappers.py
+```
+
+## Current status
+
+The branch exports the full catalog as Hermes-loadable bundles. The `itp` skill remains the deepest manually validated wedge. A small set of high-value skills now also gets richer generated guidance from curated overrides while preserving the same Hermes compatibility boundary.
+'''
+)
+
+print('generated_wrappers', generated_count)
+print('manual_wrappers', len(manual_skills))
+print('rich_wrappers', rich_count)
+print('total_exported_skills', total_exported)

package/scripts/hermes_wrapper_overrides.json

@@ -0,0 +1,184 @@
+{
+  "autoresearch": {
+    "title": "Autoresearch — Autonomous Code Quality & RSI Loop",
+    "summary": "Autonomous code quality and harness-improvement loop for audits, baselines, and keep-or-revert mutation experiments.",
+    "when_to_use": [
+      "when you need a code audit or quality scan",
+      "when you want a baseline before making changes",
+      "when running a small keep-or-revert improvement loop",
+      "when evaluating prompt or harness mutations"
+    ],
+    "quickstart": [
+      "python3 tools/autoresearch-mlx/autoresearch_agent.py audit <path>",
+      "python3 tools/autoresearch-mlx/autoresearch_agent.py baseline <path>",
+      "python3 tools/autoresearch-mlx/autoresearch_agent.py scan <path>"
+    ],
+    "notes": [
+      "Use one mutation per experiment and keep it reversible.",
+      "If quality regresses, revert immediately.",
+      "This wrapper summarizes the real workspace skill without claiming the full local toolchain ships inside this repo."
+    ]
+  },
+  "content-writer": {
+    "title": "Content Writer",
+    "summary": "Platform-aware writing skill for articles, posts, emails, and other outward-facing copy.",
+    "when_to_use": [
+      "when writing an article, social post, email, or announcement",
+      "when adapting the same idea to multiple platforms",
+      "when you need concise platform-specific formatting rules"
+    ],
+    "quickstart": [
+      "Use plain punctuation, straight quotes, and simple bullets.",
+      "Avoid AI-slop phrasing and repetitive listicle structure.",
+      "Match the output to the target platform instead of writing one generic draft."
+    ],
+    "notes": [
+      "The source skill is stricter than this wrapper and includes extensive formatting and tone rules.",
+      "This branch exports a Hermes-loadable version of the skill surface, not the entire external content pipeline."
+    ]
+  },
+  "humanize": {
+    "title": "Humanize",
+    "summary": "Rewrite protocol for making drafts sound like a specific human rather than generic AI copy.",
+    "when_to_use": [
+      "after a first draft exists",
+      "before publishing external content",
+      "when the copy sounds too polished, flat, or corporate"
+    ],
+    "quickstart": [
+      "add specifics such as dates, versions, names, and concrete numbers",
+      "vary sentence length on purpose",
+      "state a real opinion instead of hedging every claim"
+    ],
+    "notes": [
+      "The source skill includes a fuller rewrite framework, self-check protocol, and companion files.",
+      "This wrapper exposes the discoverable Hermes skill surface only."
+    ]
+  },
+  "prospector": {
+    "title": "Prospector",
+    "summary": "Lead-generation workflow for finding companies and enriching contacts against an ICP.",
+    "when_to_use": [
+      "when the user asks to find leads or prospects",
+      "when building a contact list that matches an ICP",
+      "when exporting prospect results to CSV or syncing to CRM"
+    ],
+    "quickstart": [
+      "configure Exa and Apollo API keys first",
+      "collect ICP inputs such as industry, company size, geography, and contact count",
+      "run the search and export results to CSV"
+    ],
+    "notes": [
+      "The source skill expects Exa and Apollo, with optional Attio sync.",
+      "This wrapper does not claim those third-party credentials or integrations are preconfigured in Hermes."
+    ]
+  },
+  "strykr-prism": {
+    "title": "Strykr PRISM",
+    "summary": "Unified financial data API skill for crypto, stocks, forex, ETFs, and market analysis workflows.",
+    "when_to_use": [
+      "when the user needs live market data or symbol resolution",
+      "when checking trending assets, sentiment, or market overview",
+      "when pulling token-risk or venue data for an agent workflow"
+    ],
+    "quickstart": [
+      "export PRISM_API_KEY before use",
+      "resolve an asset first when the symbol is ambiguous",
+      "use the market overview and price endpoints for fast analyst workflows"
+    ],
+    "notes": [
+      "The source skill contains a much larger endpoint catalog and examples.",
+      "This wrapper does not imply the external PRISM service is bundled with this repo."
+    ]
+  },
+  "validator-agent": {
+    "title": "Validator Agent",
+    "summary": "Multi-round validation gate for TypeScript and Solidity projects before merge or publish.",
+    "when_to_use": [
+      "before merging a PR",
+      "before npm publish or release",
+      "after dependency or build-system changes"
+    ],
+    "quickstart": [
+      "run compile or typecheck first",
+      "then run tests, security checks, and docs/changelog verification",
+      "treat any blocking issue as a stop signal until fixed"
+    ],
+    "notes": [
+      "The source skill is read-only and produces a verdict rather than modifying code.",
+      "This wrapper summarizes the validation lane without claiming the full project-specific toolchain is present in Hermes."
+    ]
+  },
+  "github": {
+    "title": "GitHub",
+    "summary": "GitHub workflow wrapper for PRs, issues, CI runs, diffs, and API queries through the usual gh-driven lane.",
+    "when_to_use": [
+      "when checking PR or CI status",
+      "when creating or commenting on issues and pull requests",
+      "when reviewing diffs or querying GitHub state quickly"
+    ],
+    "quickstart": [
+      "confirm the repo and target issue or PR first",
+      "use the gh-driven lane for status, comments, diffs, and workflow inspection",
+      "treat auth and repo context as prerequisites before acting"
+    ],
+    "notes": [
+      "The catalog explicitly scopes this skill to issues, PRs, CI, review, and API queries.",
+      "This Hermes wrapper does not guarantee gh auth or GitHub credentials are already configured in the current environment."
+    ]
+  },
+  "security": {
+    "title": "Security",
+    "summary": "Security workflow wrapper for threat detection, vulnerability management, and audit-oriented checks across the workspace.",
+    "when_to_use": [
+      "when investigating vulnerabilities or suspicious behavior",
+      "when auditing a project before release or after changes",
+      "when tracking remediation work for security findings"
+    ],
+    "quickstart": [
+      "start with the concrete finding, alert, or attack surface",
+      "separate severity assessment from remediation steps",
+      "prefer verification and containment before claiming a fix"
+    ],
+    "notes": [
+      "The catalog positions this as an infrastructure and vulnerability workflow, not a generic coding skill.",
+      "This wrapper does not claim bundled scanners, credentials, or external security services are preconfigured in Hermes."
+    ]
+  },
+  "business-strategy": {
+    "title": "Business Strategy",
+    "summary": "Strategy wrapper for PMF validation, beachhead selection, ROI calls, and kill-or-invest decisions for the AI Agent Economy.",
+    "when_to_use": [
+      "when deciding what to invest in or cut",
+      "when evaluating PMF, beachheads, or strategic focus",
+      "when comparing activity ROI or prioritizing execution lanes"
+    ],
+    "quickstart": [
+      "define the decision and success metric first",
+      "compare options using expected ROI and strategic fit",
+      "end with a clear continue, kill, or reallocate recommendation"
+    ],
+    "notes": [
+      "The catalog frames this as a decision-making and prioritization surface, not a generic brainstorming tool.",
+      "This wrapper exposes the Hermes-loadable skill surface only and does not replace deeper strategy artifacts elsewhere in the workspace."
+    ]
+  },
+  "webmcp-payments": {
+    "title": "WebMCP Payments",
+    "summary": "Payments workflow wrapper for handling HTTP 402 Payment Required responses through agentpay-mcp within approved spending limits.",
+    "when_to_use": [
+      "when a workflow hits an HTTP 402 payment-required response",
+      "when an agent needs to decide whether a micropayment is allowed",
+      "when connecting payment-required APIs to a policy-controlled execution path"
+    ],
+    "quickstart": [
+      "detect the 402 and capture the payment metadata first",
+      "check the spending policy before attempting execution",
+      "route execution through the AgentPay MCP lane instead of treating payment as an unguarded side effect"
+    ],
+    "notes": [
+      "Current product naming in the broader workspace is AgentPay MCP, while this catalog entry remains webmcp-payments.",
+      "This wrapper does not imply payment credentials, wallets, or spending policies are already configured inside Hermes."
+    ]
+  }
+}

package/scripts/run-python-script.mjs

@@ -0,0 +1,48 @@
+#!/usr/bin/env node
+import { spawnSync } from 'node:child_process';
+
+const [, , scriptPath, ...scriptArgs] = process.argv;
+
+if (!scriptPath) {
+  console.error('Usage: node scripts/run-python-script.mjs <script.py> [...args]');
+  process.exit(2);
+}
+
+const candidates = process.platform === 'win32'
+  ? [
+      ['python', []],
+      ['py', ['-3']],
+      ['python3', []],
+    ]
+  : [
+      ['python3', []],
+      ['python', []],
+    ];
+
+const failures = [];
+for (const [command, prefixArgs] of candidates) {
+  const probe = spawnSync(command, [...prefixArgs, '--version'], {
+    encoding: 'utf8',
+    stdio: ['ignore', 'pipe', 'pipe'],
+  });
+  const versionOutput = `${probe.stdout ?? ''}${probe.stderr ?? ''}`;
+  if (probe.status !== 0 || /Microsoft Store/i.test(versionOutput)) {
+    failures.push(`${command} ${prefixArgs.join(' ')} -> ${versionOutput.trim() || probe.error?.message || `exit ${probe.status}`}`);
+    continue;
+  }
+
+  const run = spawnSync(command, [...prefixArgs, scriptPath, ...scriptArgs], {
+    stdio: 'inherit',
+  });
+  if (run.error) {
+    failures.push(`${command} ${prefixArgs.join(' ')} -> ${run.error.message}`);
+    continue;
+  }
+  process.exit(run.status ?? 1);
+}
+
+console.error('Unable to find a working Python interpreter for', scriptPath);
+for (const failure of failures) {
+  console.error('-', failure);
+}
+process.exit(1);

package/scripts/verify-consumer-install.mjs

@@ -0,0 +1,109 @@
+#!/usr/bin/env node
+/**
+ * Clean consumer install smoke for the packed npm tarball.
+ *
+ * This catches release-only failures that local tests miss: missing dist files,
+ * missing packaged skills/WASM artifacts, bad exports, and install-time metadata
+ * drift between package.json and the tarball npm consumers receive.
+ */
+import { mkdtempSync, rmSync, existsSync, readFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
+import { spawnSync } from 'node:child_process';
+
+const repoRoot = process.cwd();
+const pkg = JSON.parse(readFileSync(join(repoRoot, 'package.json'), 'utf8'));
+
+function commandSpec(command, args) {
+  if (command === 'npm' && process.env.npm_execpath) {
+    return { command: process.execPath, args: [process.env.npm_execpath, ...args] };
+  }
+  return { command, args };
+}
+
+function run(command, args, options = {}) {
+  const spec = commandSpec(command, args);
+  const result = spawnSync(spec.command, spec.args, {
+    cwd: options.cwd ?? repoRoot,
+    env: { ...process.env, ...(options.env ?? {}) },
+    encoding: 'utf8',
+    stdio: options.capture ? ['ignore', 'pipe', 'pipe'] : 'inherit',
+    shell: false,
+    maxBuffer: 64 * 1024 * 1024,
+  });
+  if (result.status !== 0) {
+    if (options.capture) {
+      process.stderr.write(result.stdout ?? '');
+      process.stderr.write(result.stderr ?? '');
+    }
+    if (result.error) process.stderr.write(`${result.error.stack ?? result.error}\n`);
+    throw new Error(`${command} ${args.join(' ')} failed with exit ${result.status}`);
+  }
+  return result;
+}
+
+function parsePackJson(stdout) {
+  let pos = stdout.lastIndexOf('[');
+  while (pos >= 0) {
+    try {
+      return JSON.parse(stdout.slice(pos));
+    } catch {
+      pos = stdout.lastIndexOf('[', pos - 1);
+    }
+  }
+  throw new Error(`Could not parse npm pack JSON output:\n${stdout.slice(0, 800)}`);
+}
+
+const pack = run('npm', ['pack', '--json'], { capture: true });
+const packed = parsePackJson(pack.stdout ?? '');
+const filename = packed[0]?.filename;
+if (!filename) throw new Error('npm pack did not report a tarball filename');
+const tarball = resolve(repoRoot, filename);
+
+const temp = mkdtempSync(join(tmpdir(), 'clawpowers-consumer-'));
+try {
+  run('npm', ['init', '-y'], { cwd: temp, capture: true });
+  run('npm', ['install', tarball, '--save-exact', '--ignore-scripts'], { cwd: temp });
+
+  const smoke = `
+    import { existsSync, readdirSync } from 'node:fs';
+    import { join } from 'node:path';
+    import {
+      VERSION,
+      PACKAGE_NAME,
+      initConfig,
+      discoverSkills,
+      deriveEthereumAddress,
+      getCapabilitySummary,
+    } from 'clawpowers';
+
+    if (PACKAGE_NAME !== 'clawpowers') throw new Error('Unexpected package name: ' + PACKAGE_NAME);
+    if (VERSION !== '${pkg.version}') throw new Error('Unexpected VERSION export: ' + VERSION);
+
+    const config = initConfig();
+    if (config.version !== '${pkg.version}') throw new Error('Config version drift: ' + config.version);
+
+    const packageRoot = join(process.cwd(), 'node_modules', 'clawpowers');
+    const skillsDir = join(packageRoot, 'skills');
+    if (!existsSync(skillsDir)) throw new Error('Packaged skills directory missing');
+    const skillCount = discoverSkills(skillsDir).length;
+    if (skillCount < 20) throw new Error('Expected at least 20 packaged skills, saw ' + skillCount);
+
+    const wasmPath = join(packageRoot, 'native', 'wasm', 'pkg-node', 'clawpowers_wasm_bg.wasm');
+    if (!existsSync(wasmPath)) throw new Error('Packaged WASM fallback missing');
+
+    const hardhat0 = Buffer.from('ac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80', 'hex');
+    const address = deriveEthereumAddress(hardhat0);
+    if (address !== '0xf39Fd6e51aad88F6F4ce6aB8827279cffFb92266') {
+      throw new Error('Ethereum derivation smoke failed: ' + address);
+    }
+
+    const summary = getCapabilitySummary();
+    if (!summary || typeof summary !== 'object') throw new Error('Capability summary unavailable');
+    console.log('consumer smoke OK: clawpowers ${pkg.version}, skills=' + skillCount);
+  `;
+  run('node', ['--input-type=module', '--eval', smoke], { cwd: temp });
+} finally {
+  rmSync(temp, { recursive: true, force: true });
+  if (existsSync(tarball)) rmSync(tarball, { force: true });
+}