Published database command depends on unavailable @askrjs/orm package

[smiggleworth]

Affected release

@askrjs/cli 0.0.23 on Node 24.19.0 and npm 12.0.1.

The published CLI advertises askr database in help and documents database commands, but every database command delegates to @askrjs/orm/tooling. @askrjs/orm is not available from the public npm registry, so a registry-only consumer cannot make the advertised command work.

Steps to reproduce

1. Create an empty package: npm init -y
2. Install the CLI: npm install @askrjs/cli@0.0.23
3. Run: npx askr --help
4. Observe the advertised database command.
5. Run: npx askr database validate
6. Attempt to satisfy the error: npm install @askrjs/orm

Actual result

The database command exits 1 with: This project does not have @askrjs/orm installed. Install it before running askr database.

The requested installation then returns npm E404 because @askrjs/orm has no public release.

Expected result

Every command advertised by the public CLI has a public, installable dependency path, or unreleased functionality is clearly gated and omitted from the released help and documentation.

Acceptance criteria

• Guardrail: Add a permanent regression at the affected public boundary that reproduces this failure and fails if the same class of bug returns.

• A clean registry-only consumer can install every package needed to run askr database, or the CLI no longer advertises the command until that is possible.

• The CLI gives an actionable error that does not instruct users to install an unavailable package.

• Add an end-to-end test using only public npm artifacts that exercises at least askr database validate.

• Verify the fixed CLI and any required ORM release from a clean temporary project.

[smiggleworth]

Acceptance evidence: @askrjs/orm@0.0.1 is public and latest on npm; a clean temporary project installed public @askrjs/cli@0.0.23 and @askrjs/orm@0.0.1, generated an SQLite database artifact, and passed askr database validate. PR #92 makes the missing dependency instruction exact (npm install @askrjs/orm) and adds a permanent post-publish registry-only generate/validate job. Exact-head CI run 31897889867 passed every job.

[smiggleworth]

Release closure: workflow 31898038085 published @askrjs/cli@0.0.24 through OIDC, and its new post-publish job installed public CLI 0.0.24 plus ORM 0.0.1 and passed database generate/validate. Annotated tag v0.0.24 dereferences to squash merge e5c66a2.