@kya-os/cli 2.0.0 → 2.0.3

package/bin/__tests__/kya-os-shim.e2e.test.js

@@ -0,0 +1,160 @@
+/** Real process tests in an isolated npm-shaped installation. Never replace
+ * or remove this checkout's installed platform package or workspace symlink. */
+import { execFileSync, spawnSync } from "node:child_process";
+import { chmodSync, copyFileSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { PLATFORM_PACKAGES } from "../resolve-binary.js";
+import { supportsNodeVersion } from "../kya-os.js";
+
+const sourceBin = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const hostPkgName = PLATFORM_PACKAGES[`${process.platform}-${process.arch}`];
+let scratchDir;
+let cliDir;
+let binaryPath;
+
+function installFakeBinary(scriptBody) {
+  writeFileSync(binaryPath, scriptBody);
+  chmodSync(binaryPath, 0o755);
+}
+
+function invoke(args = [], options = {}) {
+  const env = { ...process.env };
+  delete env.MCPI_SIDECAR_ENTRY;
+  delete env.MCPI_RUN_COMPILE_SHIM;
+  return spawnSync(process.execPath, [path.join(cliDir, "bin", "kya-os.js"), ...args], {
+    encoding: "utf-8", timeout: 10_000, ...options, env: { ...env, ...options.env },
+  });
+}
+
+beforeEach(() => {
+  if (!hostPkgName) return;
+  scratchDir = realpathSync(mkdtempSync(path.join(tmpdir(), "kya-os installed shim ")));
+  cliDir = path.join(scratchDir, "node_modules", "@kya-os", "cli");
+  mkdirSync(path.join(cliDir, "bin"), { recursive: true });
+  writeFileSync(path.join(cliDir, "package.json"), JSON.stringify({ name: "@kya-os/cli", type: "module" }));
+  for (const file of ["kya-os.js", "dco.js", "resolve-binary.js", "run-compile.mjs"]) {
+    copyFileSync(path.join(sourceBin, file), path.join(cliDir, "bin", file));
+  }
+  const platformDir = path.join(scratchDir, "node_modules", hostPkgName);
+  mkdirSync(path.join(platformDir, "bin"), { recursive: true });
+  writeFileSync(path.join(platformDir, "package.json"), JSON.stringify({ name: hostPkgName, version: "0.0.0-test" }));
+  binaryPath = path.join(platformDir, "bin", "kya-os");
+});
+
+afterEach(() => {
+  if (scratchDir) rmSync(scratchDir, { recursive: true, force: true });
+});
+
+describe.skipIf(!hostPkgName)("distribution shim in an isolated installed layout", () => {
+  it("requires the SDK minimum while preserving Node 22 and newer support", () => {
+    for (const version of ["18.20.0", "20.0.0", "20.18.3", "unknown", "20.19.0-rc.1"]) {
+      expect(supportsNodeVersion(version)).toBe(false);
+    }
+    for (const version of ["20.19.0", "20.20.1", "22.0.0", "22.19.1", "24.0.0"]) {
+      expect(supportsNodeVersion(version)).toBe(true);
+    }
+    const manifest = JSON.parse(readFileSync(path.join(sourceBin, "..", "package.json"), "utf-8"));
+    expect(manifest.engines.node).toBe(">=20.19.0");
+  });
+
+  it("explains unsupported Node before launch and still permits native help", () => {
+    installFakeBinary('#!/bin/sh\necho native-help-fixture\n');
+    const moduleUrl = pathToFileURL(path.join(cliDir, "bin", "kya-os.js")).href;
+    function runAsOldNode(args) {
+      const code = `const { main } = await import(${JSON.stringify(moduleUrl)}); Object.defineProperty(process.versions, "node", { value: "20.18.3" }); process.argv = ["node", "fixture", ...${JSON.stringify(args)}]; main();`;
+      return spawnSync(process.execPath, ["--input-type=module", "-e", code], { encoding: "utf8", timeout: 5000 });
+    }
+    const rejected = runAsOldNode(["identity", "inspect", "did:web:example.com"]);
+    expect(rejected.status).toBe(1);
+    expect(rejected.stdout).toBe("");
+    expect(rejected.stderr).toContain("requires Node.js >=20.19.0");
+    expect(rejected.stderr).toContain("Upgrade Node.js");
+    const help = runAsOldNode(["--help"]);
+    expect(help.status).toBe(0);
+    expect(help.stdout.trim()).toBe("native-help-fixture");
+  });
+
+  it("finds the sibling platform package through real default Node resolution", () => {
+    installFakeBinary("#!/bin/sh\necho fake-kya-os\n");
+    const moduleUrl = pathToFileURL(path.join(cliDir, "bin", "resolve-binary.js")).href;
+    const output = execFileSync(process.execPath, ["--input-type=module", "-e", `const {resolveBinaryPath} = await import(${JSON.stringify(moduleUrl)}); console.log(resolveBinaryPath());`], { encoding: "utf-8" });
+    expect(output.trim()).toBe(binaryPath);
+  });
+
+  it("forwards literal argv and a nonzero child status", () => {
+    installFakeBinary('#!/bin/sh\nprintf "%s\\n" "$@"\nexit 7\n');
+    const result = invoke(["dco", "whoami", "space value", "$(exit 99)"]);
+    expect(result.stdout).toBe("dco\nwhoami\nspace value\n$(exit 99)\n");
+    expect(result.status).toBe(7);
+  });
+
+  it("runs through a symlink from a path containing spaces", () => {
+    installFakeBinary('#!/bin/sh\necho "argv:$@"\n');
+    const linkedPath = path.join(scratchDir, "linked shim.js");
+    symlinkSync(path.join(cliDir, "bin", "kya-os.js"), linkedPath);
+    const output = execFileSync(process.execPath, [linkedPath, "dco", "whoami", "--json"], { encoding: "utf-8" });
+    expect(output.trim()).toBe("argv:dco whoami --json");
+  });
+
+  it("prepends dco to arguments for the standalone alias", () => {
+    installFakeBinary('#!/bin/sh\necho "argv:$@"\n');
+    const output = execFileSync(process.execPath, [path.join(cliDir, "bin", "dco.js"), "whoami", "--json"], { encoding: "utf-8" });
+    expect(output.trim()).toBe("argv:dco whoami --json");
+  });
+
+  it("gives the native child installed sidecar and compiler paths independent of cwd", () => {
+    installFakeBinary('#!/bin/sh\nprintf "%s\\n" "$MCPI_SIDECAR_ENTRY" "$MCPI_RUN_COMPILE_SHIM"\n');
+    const result = invoke([], { cwd: tmpdir() });
+    expect(result.status).toBe(0);
+    expect(result.stdout.trim().split("\n")).toEqual([
+      path.join(cliDir, "dist", "sidecar", "sidecar", "src", "index.js"),
+      path.join(cliDir, "bin", "run-compile.mjs"),
+    ]);
+  });
+
+  it("preserves explicit sidecar and compiler overrides", () => {
+    installFakeBinary('#!/bin/sh\nprintf "%s\\n" "$MCPI_SIDECAR_ENTRY" "$MCPI_RUN_COMPILE_SHIM"\n');
+    const result = invoke([], { env: { ...process.env, MCPI_SIDECAR_ENTRY: "/operator/sidecar.js", MCPI_RUN_COMPILE_SHIM: "/operator/compiler.mjs" } });
+    expect(result.stdout).toBe("/operator/sidecar.js\n/operator/compiler.mjs\n");
+  });
+
+  it("can launch the installed sidecar from the path passed to the native child", () => {
+    const entry = path.join(cliDir, "dist", "sidecar", "sidecar", "src", "index.js");
+    mkdirSync(path.dirname(entry), { recursive: true });
+    writeFileSync(entry, 'console.log("installed-sidecar-fixture");\n');
+    installFakeBinary('#!/bin/sh\nexec node "$MCPI_SIDECAR_ENTRY"\n');
+    const result = invoke([], { cwd: tmpdir() });
+    expect(result.status).toBe(0);
+    expect(result.stdout.trim()).toBe("installed-sidecar-fixture");
+  });
+
+  it("ships a compiler bridge which resolves the target project's compiler", () => {
+    const projectDir = path.join(scratchDir, "target project");
+    const compilerDir = path.join(projectDir, "node_modules", "@kya-os", "mcp-i");
+    mkdirSync(compilerDir, { recursive: true });
+    writeFileSync(path.join(projectDir, "package.json"), '{"name":"fixture-project","type":"module"}');
+    writeFileSync(path.join(compilerDir, "package.json"), '{"name":"@kya-os/mcp-i","type":"module","exports":"./index.js"}');
+    writeFileSync(path.join(compilerDir, "index.js"), 'export async function compile() { console.log("project-compiler:" + process.env.NODE_ENV); }');
+    installFakeBinary('#!/bin/sh\nexec node "$MCPI_RUN_COMPILE_SHIM"\n');
+    const result = invoke([], { cwd: projectDir, env: { NODE_ENV: "production" } });
+    expect(result.status).toBe(0);
+    expect(result.stdout.trim()).toBe("project-compiler:production");
+    const manifest = JSON.parse(readFileSync(path.join(sourceBin, "..", "package.json"), "utf-8"));
+    expect(manifest.files).toContain("bin");
+  });
+
+  it("fails visibly for a missing platform binary", () => {
+    const result = invoke();
+    expect(result.status).toBe(1);
+    expect(result.stderr).toContain("its native binary is missing");
+  });
+
+  it("forwards a signal-death exit code", () => {
+    installFakeBinary('#!/bin/sh\nkill -TERM $$\n');
+    const result = invoke();
+    expect(result.status).toBe(143);
+  });
+});

package/bin/__tests__/resolve-binary.test.js

@@ -0,0 +1,54 @@
+import { describe, expect, it } from "vitest";
+import { resolveBinaryPath } from "../resolve-binary.js";
+
+describe("resolveBinaryPath", () => {
+  it("throws a descriptive error for an unsupported platform/arch combination", () => {
+    expect(() => resolveBinaryPath("sunos", "sparc64")).toThrow(
+      /no prebuilt kya-os binary is published for "sunos-sparc64"/
+    );
+  });
+
+  it("lists the supported platforms in the unsupported-platform error", () => {
+    try {
+      resolveBinaryPath("sunos", "sparc64");
+      throw new Error("expected resolveBinaryPath to throw");
+    } catch (err) {
+      expect(err.message).toContain("darwin-arm64");
+      expect(err.message).toContain("linux-x64");
+    }
+  });
+
+  it("throws a descriptive error when the platform package isn't installed", () => {
+    const resolvePackageJson = () => {
+      throw new Error("Cannot find module '@kya-os/cli-linux-x64-gnu/package.json'");
+    };
+    expect(() => resolveBinaryPath("linux", "x64", resolvePackageJson)).toThrow(
+      /the "@kya-os\/cli-linux-x64-gnu" optional dependency isn't installed/
+    );
+  });
+
+  it("throws a descriptive error when the package is installed but the binary is missing", () => {
+    const resolvePackageJson = () => "/fake/node_modules/@kya-os/cli-linux-x64-gnu/package.json";
+    const fileExists = () => false;
+    expect(() => resolveBinaryPath("linux", "x64", resolvePackageJson, fileExists)).toThrow(
+      /its native binary is missing at \/fake\/node_modules\/@kya-os\/cli-linux-x64-gnu\/bin\/kya-os/
+    );
+  });
+
+  it("resolves the binary path when the package and binary are both present", () => {
+    const resolvePackageJson = () => "/fake/node_modules/@kya-os/cli-darwin-arm64/package.json";
+    const fileExists = (p) => p === "/fake/node_modules/@kya-os/cli-darwin-arm64/bin/kya-os";
+    expect(resolveBinaryPath("darwin", "arm64", resolvePackageJson, fileExists)).toBe(
+      "/fake/node_modules/@kya-os/cli-darwin-arm64/bin/kya-os"
+    );
+  });
+
+  it("has no entry for win32 -- Windows is not a supported target", () => {
+    // agent_wrapper.rs's supervisor loop is POSIX-specific (tokio::signal::unix,
+    // std::os::unix::process::ExitStatusExt), so there is deliberately no
+    // win32 key in PLATFORM_PACKAGES for any arch to resolve to.
+    expect(() => resolveBinaryPath("win32", "x64")).toThrow(
+      /no prebuilt kya-os binary is published for "win32-x64"/
+    );
+  });
+});

package/bin/dco.js

@@ -0,0 +1,17 @@
+#!/usr/bin/env node
+/**
+ * Standalone `dco` entry point: the old TypeScript build shipped a
+ * separate `dist/dco.js` (see the now-deleted `src/dco.ts`) that rooted
+ * Commander directly at `registerDcoSubcommands` with no `dco` prefix
+ * needed on the command line. The Rust binary has no equivalent second
+ * `[[bin]]` target -- `dco setup`/`status`/`verify`/`whoami`/`dispatch`
+ * live under `kya-os dco <subcommand>` (`Commands::Dco` in `main.rs`) --
+ * so this shim reproduces the old prefix-free entry point at the
+ * distribution layer instead: it execs the exact same native binary as
+ * `kya-os`, with `"dco"` prepended to argv, rather than duplicating a
+ * second clap parser for one subcommand tree.
+ */
+
+import { main } from "./kya-os.js";
+
+main(["dco"]);

package/bin/kya-os.js

@@ -0,0 +1,135 @@
+#!/usr/bin/env node
+/**
+ * `kya-os` entry point. The `mcpi` bin was removed in the rename; clap's
+ * `#[command(name = "kya-os", ...)]` in `main.rs` self-identifies as
+ * "kya-os" in all help/usage/error text, so the shim and the binary now
+ * agree on one name. Neither runtime reads argv[0] to decide its
+ * self-reported name.
+ *
+ * `main()` is exported so `bin/dco.js` can reuse it with a prepended
+ * argument instead of duplicating the spawn/exit-code logic.
+ */
+
+import { spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import { resolveBinaryPath } from "./resolve-binary.js";
+
+// POSIX signal name -> number, for the subset a forwarded child could
+// plausibly die from. Mirrors agent_wrapper.rs's own exit_code_for
+// (128 + signal number) so a `kya-os` process killed by a signal reports
+// the same convention whether the death happened inside the Rust
+// binary's own supervisor or at this outer shim layer.
+const SIGNAL_NUMBERS = {
+  SIGHUP: 1,
+  SIGINT: 2,
+  SIGQUIT: 3,
+  SIGILL: 4,
+  SIGTRAP: 5,
+  SIGABRT: 6,
+  SIGBUS: 7,
+  SIGFPE: 8,
+  SIGKILL: 9,
+  SIGSEGV: 11,
+  SIGPIPE: 13,
+  SIGALRM: 14,
+  SIGTERM: 15,
+};
+
+/** didwebvh-ts's hash implementation requires Node 20.19 or newer. */
+export function supportsNodeVersion(version) {
+  const match = /^(\d+)\.(\d+)\.(\d+)$/.exec(version);
+  if (!match) return false;
+  const major = Number(match[1]);
+  const minor = Number(match[2]);
+  return major > 20 || (major === 20 && minor >= 19);
+}
+
+export function main(prependArgs = []) {
+  const args = [...prependArgs, ...process.argv.slice(2)];
+  const helpOnly = args.includes("--help") || args.includes("-h") ||
+    (args.length === 1 && ["--version", "-V"].includes(args[0]));
+  if (!supportsNodeVersion(process.versions.node) && !helpOnly) {
+    process.stderr.write(`@kya-os/cli requires Node.js >=20.19.0 for its identity sidecar; found ${process.versions.node}. Upgrade Node.js and rerun the command.\n`);
+    process.exitCode = 1;
+    return;
+  }
+  let binaryPath;
+  try {
+    binaryPath = resolveBinaryPath();
+  } catch (err) {
+    process.stderr.write(`${err instanceof Error ? err.message : String(err)}\n`);
+    process.exitCode = 1;
+    return;
+  }
+
+  // Native release builds contain the build host's CARGO_MANIFEST_DIR.
+  // Resolve auxiliary code from this installed npm package instead. Keep
+  // explicit overrides for development and isolated operator deployments.
+  const env = {
+    ...process.env,
+    MCPI_SIDECAR_ENTRY: process.env.MCPI_SIDECAR_ENTRY ??
+      fileURLToPath(new URL("../dist/sidecar/sidecar/src/index.js", import.meta.url)),
+    MCPI_RUN_COMPILE_SHIM: process.env.MCPI_RUN_COMPILE_SHIM ??
+      fileURLToPath(new URL("./run-compile.mjs", import.meta.url)),
+  };
+  const result = spawnSync(binaryPath, args, { stdio: "inherit", env });
+
+  if (result.error) {
+    process.stderr.write(
+      `@kya-os/cli: failed to launch the native kya-os binary: ${result.error.message}\n`
+    );
+    process.exitCode = 1;
+    return;
+  }
+
+  if (result.signal) {
+    const signalNumber = SIGNAL_NUMBERS[result.signal];
+    process.exitCode = signalNumber ? 128 + signalNumber : 1;
+    return;
+  }
+
+  process.exitCode = result.status ?? 1;
+}
+
+// Only run when invoked directly (`kya-os ...`), not when imported -- lets
+// bin/dco.js and this file's own tests import `main` without triggering
+// a real process spawn as a side effect of the import itself.
+//
+// Real bug found by actually invoking this through pnpm's own bin-link
+// (node_modules/.bin/kya-os, a generated shell wrapper that execs
+// `node .../node_modules/@kya-os/cli/bin/kya-os.js` -- a SYMLINKED path),
+// not caught by any test here since every prior test invoked this file
+// by its own real path directly: `import.meta.url` is Node's resolved,
+// post-symlink canonical URL, but `process.argv[1]` is the path AS
+// INVOKED (still symlinked) -- neither the exact-string nor the
+// endsWith comparison ever matched through that indirection, so `main()`
+// silently never ran for every real npm/pnpm install of this package
+// (global or workspace), the exact way any real user would actually run
+// it. `fs.realpathSync` resolves argv[1] through its own symlink first,
+// so the comparison is canonical-path-to-canonical-path on both sides.
+//
+// Second real bug, caught by Bugbot right after the first fix landed:
+// building the comparison URL by hand (`` `file://${real}` ``) doesn't
+// percent-encode anything, but `import.meta.url` DOES (Node encodes
+// spaces and other special characters in file URLs) -- an install path
+// containing a space would never match either, the same silent-no-op
+// failure with a different trigger. `pathToFileURL` builds the URL the
+// same way Node itself does, matching `resolve-binary.js`'s own
+// already-correct use of it for the identical reason.
+import { realpathSync } from "node:fs";
+import { pathToFileURL } from "node:url";
+
+function isDirectRun() {
+  if (!process.argv[1]) return false;
+  let real;
+  try {
+    real = realpathSync(process.argv[1]);
+  } catch {
+    return false;
+  }
+  return import.meta.url === pathToFileURL(real).href;
+}
+
+if (isDirectRun()) {
+  main();
+}

package/bin/resolve-binary.js

@@ -0,0 +1,98 @@
+/**
+ * Resolves the real native `kya-os` binary for the current platform, from
+ * whichever `@kya-os/cli-<platform>-<arch>` optional dependency npm
+ * actually installed. This is the one piece of logic `bin/kya-os.js` and
+ * `bin/dco.js` both need, factored out so it has its own direct test
+ * coverage instead of only being exercised indirectly through a spawned
+ * child process.
+ *
+ * Mirrors the `esbuild`/`swc`/`turbo` distribution pattern referenced by
+ * the design spec (docs/superpowers/specs/2026-08-27-rust-cli-rewrite-design.md):
+ * a small `optionalDependencies` package per OS/arch pair, each shipping
+ * nothing but a prebuilt binary at `bin/kya-os` (no package.json `bin`
+ * field of its own -- resolution here is by fixed path convention, the
+ * same convention those packages use).
+ *
+ * Platform scope is intentionally narrower than Node's own full
+ * `process.platform` matrix: this codebase's `agent run` supervisor
+ * (agent_wrapper.rs) is POSIX-specific (tokio::signal::unix for
+ * SIGINT/SIGTERM forwarding, std::os::unix::process::ExitStatusExt for
+ * the signal-death exit code), so Windows is not a supported target for
+ * this rewrite -- not an oversight, a real scope boundary carried over
+ * from the Rust source itself. See the design spec's own Scope section.
+ */
+
+import { existsSync } from "node:fs";
+import { createRequire } from "node:module";
+
+const defaultRequire = createRequire(import.meta.url);
+/** Real default: Node's own module resolution, rooted at this file. */
+const defaultResolvePackageJson = (pkgName) => defaultRequire.resolve(`${pkgName}/package.json`);
+
+/** platform-arch key (`${process.platform}-${process.arch}`) -> npm package name. */
+export const PLATFORM_PACKAGES = {
+  "darwin-arm64": "@kya-os/cli-darwin-arm64",
+  "darwin-x64": "@kya-os/cli-darwin-x64",
+  "linux-x64": "@kya-os/cli-linux-x64-gnu",
+  "linux-arm64": "@kya-os/cli-linux-arm64-gnu",
+};
+
+/**
+ * Resolves the absolute path to the native `kya-os` binary for the given
+ * platform/arch, or throws a descriptive `Error` if none is available --
+ * either because this OS/arch combination has no published package at
+ * all, or because npm didn't install it (an `optionalDependencies` entry
+ * silently no-ops on an unsupported platform rather than failing
+ * `npm install`, so a missing package on a supported platform usually
+ * means a broken/partial install, not an unsupported target).
+ *
+ * `platform`/`arch`/`resolvePackageJson`/`fileExists` are parameters
+ * (each defaulting to the real thing) so tests can exercise every branch
+ * -- including ones that depend on what's actually installed -- without
+ * mutating the shared `node_modules` tree or needing to run on every OS.
+ * This mirrors the injectable-fetch/injectable-fs convention the Rust
+ * side already uses throughout (e.g. `verify.rs`'s `PostRequest`/
+ * `GetRequest` closures): a real default, swappable in tests.
+ */
+export function resolveBinaryPath(
+  platform = process.platform,
+  arch = process.arch,
+  resolvePackageJson = defaultResolvePackageJson,
+  fileExists = existsSync
+) {
+  const key = `${platform}-${arch}`;
+  const pkgName = PLATFORM_PACKAGES[key];
+  if (!pkgName) {
+    const supported = Object.keys(PLATFORM_PACKAGES).sort().join(", ");
+    throw new Error(
+      `@kya-os/cli: no prebuilt kya-os binary is published for "${key}". ` +
+        `Supported platforms: ${supported}.`
+    );
+  }
+
+  let pkgJsonPath;
+  try {
+    pkgJsonPath = resolvePackageJson(pkgName);
+  } catch {
+    throw new Error(
+      `@kya-os/cli: the "${pkgName}" optional dependency isn't installed. ` +
+        `This usually means npm/pnpm skipped it during install -- try ` +
+        `reinstalling, or file an issue if "${key}" should be supported.`
+    );
+  }
+  const pkgDir = pkgJsonPath.slice(0, -"package.json".length);
+  // No `.exe` branch: every entry in PLATFORM_PACKAGES is POSIX (see the
+  // module doc comment on why win32 has no entry at all), so there is no
+  // platform this function can be called with where the binary would
+  // ever be named anything but plain "kya-os".
+  const binaryPath = `${pkgDir}bin/kya-os`;
+
+  if (!fileExists(binaryPath)) {
+    throw new Error(
+      `@kya-os/cli: "${pkgName}" is installed but its native binary is ` +
+        `missing at ${binaryPath}. The package may be corrupted -- try ` +
+        `reinstalling.`
+    );
+  }
+  return binaryPath;
+}

package/bin/run-compile.mjs

@@ -0,0 +1,29 @@
+#!/usr/bin/env node
+// A thin invocation shim for the Rust CLI's `kya-os build`/`kya-os dev`
+// commands: the only piece of `@kya-os/mcp-i`'s webpack-based `compile()`
+// that Rust genuinely cannot do itself (a full JS bundler). Everything
+// else -- package.json/xmcp.config.ts detection, the identity-missing
+// fallback, the non-XMCP npm/tsc fallback path, signal forwarding -- is
+// native Rust; this script's only job is to invoke `compile()`.
+//
+// Resolves `@kya-os/mcp-i` relative to the CURRENT WORKING DIRECTORY
+// (the target project the Rust CLI was invoked against) rather than this
+// script's own location, via `createRequire`. This matters: this script
+// is not necessarily co-located with the target project's own
+// `node_modules` (it ships alongside the Rust binary, wherever that is
+// installed) -- resolving it explicitly against the target project's own
+// `package.json` guarantees the target project's own installed compiler
+// version is used, the same one a bare `import("@kya-os/mcp-i")` would
+// resolve to if it ran from code actually living inside that project.
+//
+// `NODE_ENV` is expected to already be set by the parent (Rust) process
+// before spawning this script -- `development` enables `compile()`'s own
+// watch mode, `production` runs a single compile pass. This script does
+// not set or read `NODE_ENV` itself.
+import { createRequire } from "node:module";
+import { pathToFileURL } from "node:url";
+
+const require = createRequire(new URL("package.json", pathToFileURL(process.cwd() + "/")));
+const resolved = require.resolve("@kya-os/mcp-i");
+const { compile } = await import(pathToFileURL(resolved).href);
+await compile();

package/dist/sidecar/sidecar/src/conformance/pins.js

@@ -0,0 +1,54 @@
+// Fixed official suite manifest; tested byte-for-byte against the embedded Rust suite.
+export const SUITE = {
+    "suiteVersion": "1.1.0",
+    "vectorSetHash": "sha256:38f34222fd91e75a162b01a81f83aa40907674f9c1bed72c46f1861cb49ceef5",
+    "vectorCount": 48,
+    "files": [
+        [
+            "audit-integrity.json",
+            "a60e0ee2fd23996a2b58eb76ec953e8509f2234476bb5513995e8b3844eb3b6f"
+        ],
+        [
+            "card-proof.json",
+            "412997a8792c719e4ddcb2805e908bc3d96e335e9ca26bc6236779746a66caa4"
+        ],
+        [
+            "delegation-chain.json",
+            "d224caf4acd42d955faf57f702b1480959860c313af1a838fe8327d096491366"
+        ],
+        [
+            "did-key-resolution.json",
+            "a8a7122ca1da56b549f8c064bb204238fc07c0d0ae1f94284a6ff34a262dab2e"
+        ],
+        [
+            "did-web-resolution.json",
+            "da782b7b9ab6ca98987c638be828398a046e51010ca83b09d50ef69c7b17f471"
+        ],
+        [
+            "entity-card.json",
+            "6a0c8c1b1aaef63e701d4dfb4dde29d71435d1378010ce2014782b4658daaaac"
+        ],
+        [
+            "negotiation.json",
+            "64a19c39240527b04b26651833fe6940b2be006f3a737512fc877535a3a15ffa"
+        ],
+        [
+            "signed-proof.json",
+            "0b28e324b0b559327a20177175ad84e718be94db68c598a1cafa15a4c174649d"
+        ],
+        [
+            "status-list.json",
+            "feebe3b7b00c14fff8688bb975a7bab82575b7bbe14e920920d28ee3fe24b8f0"
+        ]
+    ],
+    "pinnedAt": {
+        "package": "@kya-os/mcp",
+        "packageVersion": "1.14.2"
+    }
+};
+// Provenance of the licensed, adapted source set, not a live-server certificate.
+export const HARNESS = {
+    "commit": "84ccfe779ec618491b9cce4cc010a732aaebbb79",
+    "sourceDigest": "sha256:22631c8b32da5f0b364345af5808fbeadaeabdb1d7f4aab0e41fc2c3655f92d4"
+};
+//# sourceMappingURL=pins.js.map

package/dist/sidecar/sidecar/src/conformance/pins.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pins.js","sourceRoot":"","sources":["../../../../../sidecar/src/conformance/pins.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,MAAM,CAAC,MAAM,KAAK,GAAG;IACnB,cAAc,EAAE,OAAO;IACvB,eAAe,EAAE,yEAAyE;IAC1F,aAAa,EAAE,EAAE;IACjB,OAAO,EAAE;QACP;YACE,sBAAsB;YACtB,kEAAkE;SACnE;QACD;YACE,iBAAiB;YACjB,kEAAkE;SACnE;QACD;YACE,uBAAuB;YACvB,kEAAkE;SACnE;QACD;YACE,yBAAyB;YACzB,kEAAkE;SACnE;QACD;YACE,yBAAyB;YACzB,kEAAkE;SACnE;QACD;YACE,kBAAkB;YAClB,kEAAkE;SACnE;QACD;YACE,kBAAkB;YAClB,kEAAkE;SACnE;QACD;YACE,mBAAmB;YACnB,kEAAkE;SACnE;QACD;YACE,kBAAkB;YAClB,kEAAkE;SACnE;KACF;IACD,UAAU,EAAE;QACV,SAAS,EAAE,aAAa;QACxB,gBAAgB,EAAE,QAAQ;KAC3B;CACO,CAAC;AAEX,iFAAiF;AACjF,MAAM,CAAC,MAAM,OAAO,GAAG;IACrB,QAAQ,EAAE,0CAA0C;IACpD,cAAc,EAAE,yEAAyE;CACjF,CAAC"}