codebaseiq 0.1.0

package/package.json

@@ -0,0 +1,482 @@
+{
+  "name": "codebaseiq",
+  "version": "0.1.0",
+  "description": "Evidence and verification for AI coding agents: map code, reuse concepts, finish migrations, and gate diffs.",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/yoStoobie/CodeBaseIQ.git"
+  },
+  "homepage": "https://github.com/yoStoobie/CodeBaseIQ#readme",
+  "bugs": {
+    "url": "https://github.com/yoStoobie/CodeBaseIQ/issues"
+  },
+  "author": "yoStoobie",
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "bin": {
+    "codebaseiq": "dist/cli.js"
+  },
+  "files": [
+    "CHANGELOG.md",
+    "dist/**/*.js",
+    "dist/**/*.d.ts",
+    "docs/assets/**/*",
+    "docs/schemas/**/*",
+    "docs/*.md",
+    "scripts/build-codebaseiq-windows.mjs",
+    "scripts/evidence-product-contract.mjs",
+    "scripts/codebaseiq-windows-provenance.mjs",
+    "scripts/verify-codebaseiq-windows.mjs",
+    "skills/**/*.md",
+    "skills/**/agents/*.yaml"
+  ],
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "types": "./dist/index.d.ts"
+    },
+    "./queries": {
+      "import": "./dist/queries/index.js",
+      "types": "./dist/queries/index.d.ts"
+    },
+    "./queries/affected": {
+      "import": "./dist/queries/affected.js",
+      "types": "./dist/queries/affected.d.ts"
+    },
+    "./queries/architecture": {
+      "import": "./dist/queries/architecture.js",
+      "types": "./dist/queries/architecture.d.ts"
+    },
+    "./queries/anchors": {
+      "import": "./dist/queries/anchors.js",
+      "types": "./dist/queries/anchors.d.ts"
+    },
+    "./queries/bottlenecks": {
+      "import": "./dist/queries/bottlenecks.js",
+      "types": "./dist/queries/bottlenecks.d.ts"
+    },
+    "./queries/by-kind": {
+      "import": "./dist/queries/by-kind.js",
+      "types": "./dist/queries/by-kind.d.ts"
+    },
+    "./queries/call-graph": {
+      "import": "./dist/queries/call-graph.js",
+      "types": "./dist/queries/call-graph.d.ts"
+    },
+    "./queries/change-surface": {
+      "import": "./dist/queries/change-surface.js",
+      "types": "./dist/queries/change-surface.d.ts"
+    },
+    "./queries/cleanup-plan": {
+      "import": "./dist/queries/cleanup-plan.js",
+      "types": "./dist/queries/cleanup-plan.d.ts"
+    },
+    "./queries/co-change": {
+      "import": "./dist/queries/co-change.js",
+      "types": "./dist/queries/co-change.d.ts"
+    },
+    "./queries/code": {
+      "import": "./dist/queries/code.js",
+      "types": "./dist/queries/code.d.ts"
+    },
+    "./queries/complexity": {
+      "import": "./dist/queries/complexity.js",
+      "types": "./dist/queries/complexity.d.ts"
+    },
+    "./queries/complexity-hotspots": {
+      "import": "./dist/queries/complexity-hotspots.js",
+      "types": "./dist/queries/complexity-hotspots.d.ts"
+    },
+    "./queries/convergence": {
+      "import": "./dist/queries/convergence.js",
+      "types": "./dist/queries/convergence.d.ts"
+    },
+    "./queries/coupling": {
+      "import": "./dist/queries/coupling.js",
+      "types": "./dist/queries/coupling.d.ts"
+    },
+    "./queries/cycles": {
+      "import": "./dist/queries/cycles.js",
+      "types": "./dist/queries/cycles.d.ts"
+    },
+    "./queries/dataflow": {
+      "import": "./dist/queries/dataflow.js",
+      "types": "./dist/queries/dataflow.d.ts"
+    },
+    "./queries/dependence-slice": {
+      "import": "./dist/queries/dependence-slice.js",
+      "types": "./dist/queries/dependence-slice.d.ts"
+    },
+    "./queries/dependency-depth": {
+      "import": "./dist/queries/dependency-depth.js",
+      "types": "./dist/queries/dependency-depth.d.ts"
+    },
+    "./queries/dead": {
+      "import": "./dist/queries/dead.js",
+      "types": "./dist/queries/dead.d.ts"
+    },
+    "./queries/decorative-checkers": {
+      "import": "./dist/queries/decorative-checkers.js",
+      "types": "./dist/queries/decorative-checkers.d.ts"
+    },
+    "./queries/deep-chains": {
+      "import": "./dist/queries/deep-chains.js",
+      "types": "./dist/queries/deep-chains.d.ts"
+    },
+    "./queries/entry-map": {
+      "import": "./dist/queries/entry-map.js",
+      "types": "./dist/queries/entry-map.d.ts"
+    },
+    "./queries/system-map": {
+      "import": "./dist/queries/system-map.js",
+      "types": "./dist/queries/system-map.d.ts"
+    },
+    "./queries/deps": {
+      "import": "./dist/queries/deps.js",
+      "types": "./dist/queries/deps.d.ts"
+    },
+    "./queries/diff-impact": {
+      "import": "./dist/queries/diff-impact.js",
+      "types": "./dist/queries/diff-impact.d.ts"
+    },
+    "./queries/doc-drift": {
+      "import": "./dist/queries/doc-drift.js",
+      "types": "./dist/queries/doc-drift.d.ts"
+    },
+    "./queries/duplicate-bodies": {
+      "import": "./dist/queries/duplicate-bodies.js",
+      "types": "./dist/queries/duplicate-bodies.d.ts"
+    },
+    "./queries/drift": {
+      "import": "./dist/queries/drift.js",
+      "types": "./dist/queries/drift.d.ts"
+    },
+    "./queries/evidence": {
+      "import": "./dist/queries/evidence.js",
+      "types": "./dist/queries/evidence.d.ts"
+    },
+    "./queries/extract-candidates": {
+      "import": "./dist/queries/extract-candidates.js",
+      "types": "./dist/queries/extract-candidates.d.ts"
+    },
+    "./queries/fan": {
+      "import": "./dist/queries/fan.js",
+      "types": "./dist/queries/fan.d.ts"
+    },
+    "./queries/files": {
+      "import": "./dist/queries/files.js",
+      "types": "./dist/queries/files.d.ts"
+    },
+    "./queries/health": {
+      "import": "./dist/queries/health.js",
+      "types": "./dist/queries/health.d.ts"
+    },
+    "./queries/hierarchy": {
+      "import": "./dist/queries/hierarchy.js",
+      "types": "./dist/queries/hierarchy.d.ts"
+    },
+    "./queries/hotspots": {
+      "import": "./dist/queries/hotspots.js",
+      "types": "./dist/queries/hotspots.d.ts"
+    },
+    "./queries/imports": {
+      "import": "./dist/queries/imports.js",
+      "types": "./dist/queries/imports.d.ts"
+    },
+    "./queries/incomplete-migration": {
+      "import": "./dist/queries/incomplete-migration.js",
+      "types": "./dist/queries/incomplete-migration.d.ts"
+    },
+    "./queries/index": {
+      "import": "./dist/queries/index.js",
+      "types": "./dist/queries/index.d.ts"
+    },
+    "./queries/isolated": {
+      "import": "./dist/queries/isolated.js",
+      "types": "./dist/queries/isolated.d.ts"
+    },
+    "./queries/locality-candidates": {
+      "import": "./dist/queries/locality-candidates.js",
+      "types": "./dist/queries/locality-candidates.d.ts"
+    },
+    "./queries/members": {
+      "import": "./dist/queries/members.js",
+      "types": "./dist/queries/members.d.ts"
+    },
+    "./queries/methods": {
+      "import": "./dist/queries/methods.js",
+      "types": "./dist/queries/methods.d.ts"
+    },
+    "./queries/not-implemented": {
+      "import": "./dist/queries/not-implemented.js",
+      "types": "./dist/queries/not-implemented.d.ts"
+    },
+    "./queries/outline": {
+      "import": "./dist/queries/outline.js",
+      "types": "./dist/queries/outline.d.ts"
+    },
+    "./queries/passthrough-candidates": {
+      "import": "./dist/queries/passthrough-candidates.js",
+      "types": "./dist/queries/passthrough-candidates.d.ts"
+    },
+    "./queries/plan-context": {
+      "import": "./dist/queries/plan-context.js",
+      "types": "./dist/queries/plan-context.d.ts"
+    },
+    "./queries/context": {
+      "import": "./dist/queries/context.js",
+      "types": "./dist/queries/context.d.ts"
+    },
+    "./queries/recent-duplicates": {
+      "import": "./dist/queries/recent-duplicates.js",
+      "types": "./dist/queries/recent-duplicates.d.ts"
+    },
+    "./queries/redundant-reexports": {
+      "import": "./dist/queries/redundant-reexports.js",
+      "types": "./dist/queries/redundant-reexports.d.ts"
+    },
+    "./queries/reference-neighborhood": {
+      "import": "./dist/queries/reference-neighborhood.js",
+      "types": "./dist/queries/reference-neighborhood.d.ts"
+    },
+    "./queries/reference-reachability": {
+      "import": "./dist/queries/reference-reachability.js",
+      "types": "./dist/queries/reference-reachability.d.ts"
+    },
+    "./queries/refs": {
+      "import": "./dist/queries/refs.js",
+      "types": "./dist/queries/refs.d.ts"
+    },
+    "./queries/self-audit": {
+      "import": "./dist/queries/self-audit.js",
+      "types": "./dist/queries/self-audit.d.ts"
+    },
+    "./queries/similar": {
+      "import": "./dist/queries/similar.js",
+      "types": "./dist/queries/similar.d.ts"
+    },
+    "./queries/similar-chains": {
+      "import": "./dist/queries/similar-chains.js",
+      "types": "./dist/queries/similar-chains.d.ts"
+    },
+    "./queries/similar-files": {
+      "import": "./dist/queries/similar-files.js",
+      "types": "./dist/queries/similar-files.d.ts"
+    },
+    "./queries/react-component-duplicates": {
+      "import": "./dist/queries/react-component-duplicates.js",
+      "types": "./dist/queries/react-component-duplicates.d.ts"
+    },
+    "./queries/react-hook-candidates": {
+      "import": "./dist/queries/react-hook-candidates.js",
+      "types": "./dist/queries/react-hook-candidates.d.ts"
+    },
+    "./queries/react-large-component-pressure": {
+      "import": "./dist/queries/react-large-component-pressure.js",
+      "types": "./dist/queries/react-large-component-pressure.d.ts"
+    },
+    "./queries/vue-component-duplicates": {
+      "import": "./dist/queries/vue-component-duplicates.js",
+      "types": "./dist/queries/vue-component-duplicates.d.ts"
+    },
+    "./queries/vue-composable-candidates": {
+      "import": "./dist/queries/vue-composable-candidates.js",
+      "types": "./dist/queries/vue-composable-candidates.d.ts"
+    },
+    "./queries/vue-large-view-pressure": {
+      "import": "./dist/queries/vue-large-view-pressure.js",
+      "types": "./dist/queries/vue-large-view-pressure.d.ts"
+    },
+    "./queries/similar-signatures": {
+      "import": "./dist/queries/similar-signatures.js",
+      "types": "./dist/queries/similar-signatures.d.ts"
+    },
+    "./queries/slice": {
+      "import": "./dist/queries/slice.js",
+      "types": "./dist/queries/slice.d.ts"
+    },
+    "./queries/source-inspection": {
+      "import": "./dist/queries/source-inspection.js",
+      "types": "./dist/queries/source-inspection.d.ts"
+    },
+    "./queries/source-search": {
+      "import": "./dist/queries/source-search.js",
+      "types": "./dist/queries/source-search.d.ts"
+    },
+    "./queries/stale-abstractions": {
+      "import": "./dist/queries/stale-abstractions.js",
+      "types": "./dist/queries/stale-abstractions.d.ts"
+    },
+    "./queries/stats": {
+      "import": "./dist/queries/stats.js",
+      "types": "./dist/queries/stats.d.ts"
+    },
+    "./queries/surface": {
+      "import": "./dist/queries/surface.js",
+      "types": "./dist/queries/surface.d.ts"
+    },
+    "./queries/symbols": {
+      "import": "./dist/queries/symbols.js",
+      "types": "./dist/queries/symbols.d.ts"
+    },
+    "./queries/system": {
+      "import": "./dist/queries/system.js",
+      "types": "./dist/queries/system.d.ts"
+    },
+    "./queries/test-quality": {
+      "import": "./dist/queries/test-quality.js",
+      "types": "./dist/queries/test-quality.d.ts"
+    },
+    "./queries/trace": {
+      "import": "./dist/queries/trace.js",
+      "types": "./dist/queries/trace.d.ts"
+    },
+    "./queries/twin-ab": {
+      "import": "./dist/queries/twin-ab.js",
+      "types": "./dist/queries/twin-ab.d.ts"
+    },
+    "./queries/twin-drift": {
+      "import": "./dist/queries/twin-drift.js",
+      "types": "./dist/queries/twin-drift.d.ts"
+    },
+    "./queries/unused-params": {
+      "import": "./dist/queries/unused-params.js",
+      "types": "./dist/queries/unused-params.d.ts"
+    },
+    "./queries/value-flow": {
+      "import": "./dist/queries/value-flow.js",
+      "types": "./dist/queries/value-flow.d.ts"
+    },
+    "./queries/unused-imports": {
+      "import": "./dist/queries/unused-imports.js",
+      "types": "./dist/queries/unused-imports.d.ts"
+    },
+    "./queries/wrapper-candidates": {
+      "import": "./dist/queries/wrapper-candidates.js",
+      "types": "./dist/queries/wrapper-candidates.d.ts"
+    },
+    "./reindex": {
+      "import": "./dist/reindex.js",
+      "types": "./dist/reindex.d.ts"
+    },
+    "./runtime": {
+      "import": "./dist/runtime.js",
+      "types": "./dist/runtime.d.ts"
+    }
+  },
+  "//build": "The declaration build is the memory ceiling of this repository: tsup generates types in a worker that needs roughly 10 GB for the public surface (8192 fails with ERR_WORKER_OUT_OF_MEMORY, 12288 completes at a 9.7 GB peak). The ceiling has to stay under the host's RAM, not merely above that need. A 16 GB runner given a 16 GB budget never collects hard enough, so the kernel kills the runner and the job reports a cancellation rather than a heap error. Raise this only alongside the memory of the smallest machine expected to build.",
+  "scripts": {
+    "build": "node --max-old-space-size=12288 ./node_modules/tsup/dist/cli-default.js",
+    "dev": "tsup --watch",
+    "format": "prettier --write \"{src,tests,scripts}/**/*.{ts,tsx,js,mjs,json}\" \"*.{ts,js,json}\"",
+    "format:check": "prettier --check \"{src,tests,scripts}/**/*.{ts,tsx,js,mjs,json}\" \"*.{ts,js,json}\"",
+    "test": "vitest run",
+    "soak:cache-lifecycle": "npm run build && vite-node scripts/cache-lifecycle-soak.ts",
+    "test:watch": "vitest",
+    "typecheck": "tsc --noEmit && tsc -p tests/fixtures/invocation-coverage-contract/tsconfig.json && tsc -p tests/fixtures/protocol-state-contract/tsconfig.json",
+    "audit:prod": "node scripts/audit-production-dependencies.mjs",
+    "api:report": "node scripts/api-surface-contract.mjs report",
+    "api:check": "npm run build && node scripts/api-surface-contract.mjs check && tsc -p tests/fixtures/public-api-consumer/tsconfig.json",
+    "api:update": "npm run build && node scripts/api-surface-contract.mjs update",
+    "lint": "npm run format:check && eslint src tests tsup.config.ts scripts/api-surface-contract.mjs scripts/audit-production-dependencies.mjs scripts/build-codebaseiq-windows.mjs scripts/cache-lifecycle-soak.ts scripts/codex-exploration-sandbox.mjs scripts/codex-exploration-trial-core.mjs scripts/codex-exploration-trial.mjs scripts/compare-exploration-trials.mjs scripts/exploration-benchmark-core.mjs scripts/exploration-benchmark.mjs scripts/npm-release-state.ts scripts/npm-release.ts scripts/publish-codebaseiq-windows.ts scripts/release-npm-guard.ts scripts/release-npm.ts scripts/codebaseiq-windows-package-identity.ts scripts/codebaseiq-windows-provenance.mjs scripts/codebaseiq-windows-release.ts scripts/verify-identity-collision-cli.mjs scripts/verify-codebaseiq-windows.mjs scripts/verify-codebaseiq-windows-registry.ts && npm run api:check && node scripts/check-skill-links.mjs",
+    "build:codebaseiq-windows": "node scripts/build-codebaseiq-windows.mjs",
+    "verify:codebaseiq-windows": "node scripts/verify-codebaseiq-windows.mjs",
+    "verify:identity-collision-cli": "node scripts/verify-identity-collision-cli.mjs",
+    "verify:codebaseiq-windows-registry": "vite-node scripts/verify-codebaseiq-windows-registry.ts",
+    "bench:evidence-products": "node scripts/evidence-product-contract.mjs",
+    "bench:exploration": "node scripts/exploration-benchmark.mjs",
+    "bench:exploration:codex": "node scripts/codex-exploration-trial.mjs",
+    "bench:exploration:compare": "node scripts/compare-exploration-trials.mjs",
+    "bench:native-symbol-leaf": "node scripts/bench-native-symbol-leaf.mjs",
+    "calibrate": "node scripts/accuracy-calibration.mjs",
+    "docs:commands": "vite-node scripts/render-command-reference.ts --write",
+    "prepublishOnly": "vite-node scripts/release-npm-guard.ts",
+    "postinstall": "node dist/postinstall.js || true",
+    "publish:codebaseiq-windows": "vite-node scripts/publish-codebaseiq-windows.ts",
+    "release:npm": "vite-node scripts/release-npm.ts",
+    "release:npm:dry-run": "vite-node scripts/release-npm.ts --dry-run"
+  },
+  "keywords": [
+    "scip",
+    "code-intelligence",
+    "code-navigation",
+    "go-to-definition",
+    "find-references",
+    "dead-code",
+    "dependency-graph",
+    "sourcegraph",
+    "typescript",
+    "python",
+    "rust",
+    "java",
+    "ruby",
+    "php",
+    "csharp"
+  ],
+  "license": "Apache-2.0",
+  "engines": {
+    "node": ">=22.0.0"
+  },
+  "dependencies": {
+    "@bufbuild/protobuf": "^2.11.0",
+    "@c4312/scip": "^0.1.0",
+    "@vue/compiler-dom": "^3.5.40",
+    "@vue/compiler-sfc": "^3.5.40",
+    "better-sqlite3": "^13.0.2",
+    "chokidar": "^4.0.3",
+    "commander": "^13.1.0",
+    "ignore": "^7.0.3",
+    "ts-morph": "^28.0.0"
+  },
+  "//optionalDependencies": "Native parsers and bundled SCIP indexers go in optionalDependencies so a failed install (missing build tools, restricted registry, incompatible platform) downgrades codebaseiq gracefully — the affected language falls back to regex parsing or asks the user to install its indexer manually — instead of blocking npm install.",
+  "optionalDependencies": {
+    "@sourcegraph/scip-typescript": "0.4.0",
+    "scip-python-plus": "0.7.5",
+    "codebaseiq-windows": "0.1.0",
+    "tree-sitter": "0.21.1",
+    "tree-sitter-c": "0.23.2",
+    "tree-sitter-c-sharp": "0.23.1",
+    "tree-sitter-cpp": "0.23.4",
+    "tree-sitter-java": "0.23.5",
+    "tree-sitter-javascript": "0.23.1",
+    "tree-sitter-kotlin": "0.3.8",
+    "tree-sitter-php": "0.23.12",
+    "tree-sitter-python": "0.23.4",
+    "tree-sitter-ruby": "0.23.1",
+    "tree-sitter-rust": "0.23.1",
+    "tree-sitter-scala": "0.24.0",
+    "tree-sitter-typescript": "0.23.2"
+  },
+  "devDependencies": {
+    "@eslint/js": "^10.0.1",
+    "@types/better-sqlite3": "^7.6.12",
+    "@types/node": "^22.10.0",
+    "eslint": "^10.2.0",
+    "globals": "^17.5.0",
+    "prettier": "^3.8.4",
+    "tsup": "^8.3.0",
+    "typescript": "^5.7.0",
+    "typescript-eslint": "^8.58.1",
+    "vitest": "^3.2.7"
+  },
+  "allowScripts": {
+    "better-sqlite3": false,
+    "esbuild@0.27.7": true,
+    "fsevents@2.3.3": true,
+    "tree-sitter@0.21.1": true,
+    "tree-sitter-c@0.23.2": true,
+    "tree-sitter-c-sharp@0.23.1": true,
+    "tree-sitter-cpp@0.23.4": true,
+    "tree-sitter-java@0.23.5": true,
+    "tree-sitter-javascript@0.23.1": true,
+    "tree-sitter-kotlin@0.3.8": true,
+    "tree-sitter-php@0.23.12": true,
+    "tree-sitter-python@0.23.4": true,
+    "tree-sitter-ruby@0.23.1": true,
+    "tree-sitter-rust@0.23.1": true,
+    "tree-sitter-scala@0.24.0": true,
+    "tree-sitter-typescript@0.23.2": true
+  }
+}

package/scripts/build-codebaseiq-windows.mjs

@@ -0,0 +1,197 @@
+#!/usr/bin/env node
+import { execFileSync } from 'node:child_process';
+import { copyFileSync, mkdirSync, mkdtempSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { basename, dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import {
+  createWindowsSidecarProvenance,
+  DEFAULT_SCIP_REPOSITORY,
+  DEFAULT_SCIP_TAG,
+  PINNED_GO_VERSION,
+  verifyWindowsSidecarProvenance,
+  WINDOWS_SIDECAR_BUILD,
+  WINDOWS_SIDECAR_PROVENANCE_FILE,
+  WINDOWS_SIDECAR_TARGETS,
+} from './codebaseiq-windows-provenance.mjs';
+
+const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+
+export function buildCodebaseIqWindowsSidecar(
+  {
+    root = ROOT,
+    sourceRepository = process.env.SCIP_REPO_URL ?? DEFAULT_SCIP_REPOSITORY,
+    sourceTag = process.env.SCIP_VERSION ?? DEFAULT_SCIP_TAG,
+    expectedGoVersion = process.env.SCIP_GO_VERSION ?? PINNED_GO_VERSION,
+  } = {},
+  runtime = createBuildRuntime(),
+) {
+  const sidecarDir = join(root, 'packages', 'codebaseiq-windows');
+  const sidecarPackage = JSON.parse(runtime.readFile(join(sidecarDir, 'package.json'), 'utf8'));
+  runtime.assertAvailable('git');
+  runtime.assertAvailable('go');
+
+  const workDir = runtime.makeTempDirectory(join(runtime.tempDirectory(), 'codebaseiq-scip-'));
+  try {
+    const checkoutDir = join(workDir, 'scip');
+    const artifactDir = join(workDir, 'artifacts');
+    runtime.mkdir(artifactDir);
+
+    const goVersion = parseGoVersion(
+      runtime.run('go', ['version'], {
+        encoding: 'utf8',
+        stdio: ['ignore', 'pipe', 'pipe'],
+      }),
+    );
+    if (goVersion !== expectedGoVersion) {
+      throw new Error(
+        `Go toolchain mismatch: expected ${expectedGoVersion}, received ${goVersion}. ` +
+          `Install the pinned toolchain or intentionally update the provenance contract.`,
+      );
+    }
+
+    runtime.run('git', ['clone', '--depth', '1', '--branch', sourceTag, sourceRepository, checkoutDir], {
+      stdio: 'inherit',
+    });
+    const sourceCommit = runtime
+      .run('git', ['rev-parse', 'HEAD'], {
+        cwd: checkoutDir,
+        encoding: 'utf8',
+        stdio: ['ignore', 'pipe', 'pipe'],
+      })
+      .trim();
+
+    runtime.copyFile(join(checkoutDir, 'LICENSE'), join(artifactDir, 'LICENSE.scip'));
+    runtime.writeFile(
+      join(artifactDir, 'README.md'),
+      renderSidecarReadme({ sourceRepository, sourceTag, sourceCommit, goVersion }),
+    );
+
+    for (const target of WINDOWS_SIDECAR_TARGETS) {
+      const outputPath = join(artifactDir, target.filename);
+      runtime.run('go', ['build', ...WINDOWS_SIDECAR_BUILD.flags, '-o', outputPath, WINDOWS_SIDECAR_BUILD.package], {
+        cwd: checkoutDir,
+        env: {
+          ...process.env,
+          ...WINDOWS_SIDECAR_BUILD.environment,
+          GOARCH: target.goarch,
+        },
+        stdio: 'inherit',
+      });
+    }
+
+    const manifest = createWindowsSidecarProvenance({
+      sidecarDir: artifactDir,
+      packageName: sidecarPackage.name,
+      packageVersion: sidecarPackage.version,
+      sourceRepository,
+      sourceTag,
+      sourceCommit,
+      goVersion,
+      readFile: runtime.readFile,
+    });
+    runtime.writeFile(join(artifactDir, WINDOWS_SIDECAR_PROVENANCE_FILE), `${JSON.stringify(manifest, null, 2)}\n`);
+
+    for (const file of [
+      'LICENSE.scip',
+      'README.md',
+      ...WINDOWS_SIDECAR_TARGETS.map((target) => target.filename),
+      WINDOWS_SIDECAR_PROVENANCE_FILE,
+    ]) {
+      runtime.promoteFile(join(artifactDir, file), join(sidecarDir, file));
+    }
+
+    const verified = verifyWindowsSidecarProvenance({
+      sidecarDir,
+      expectedSourceRepository: sourceRepository,
+      expectedSourceTag: sourceTag,
+      expectedGoVersion,
+      readFile: runtime.readFile,
+    });
+    runtime.log(
+      `Built and verified ${verified.package.name}@${verified.package.version} from ${sourceTag} (${sourceCommit.slice(0, 12)}).`,
+    );
+    return verified;
+  } finally {
+    runtime.removeTree(workDir);
+  }
+}
+
+export function createBuildRuntime() {
+  return {
+    assertAvailable(binary) {
+      const probe = process.platform === 'win32' ? 'where' : 'which';
+      try {
+        execFileSync(probe, [binary], { stdio: 'ignore' });
+      } catch {
+        throw new Error(`Required command not found on PATH: ${binary}`);
+      }
+    },
+    copyFile: copyFileSync,
+    log: console.log,
+    makeTempDirectory: mkdtempSync,
+    mkdir(path) {
+      mkdirSync(path, { recursive: true });
+    },
+    promoteFile(source, destination) {
+      mkdirSync(dirname(destination), { recursive: true });
+      const staging = join(dirname(destination), `.${basename(destination)}.${process.pid}.tmp`);
+      try {
+        copyFileSync(source, staging);
+        renameSync(staging, destination);
+      } finally {
+        rmSync(staging, { force: true });
+      }
+    },
+    readFile: readFileSync,
+    removeTree(path) {
+      rmSync(path, { recursive: true, force: true });
+    },
+    run(binary, args, options = {}) {
+      console.log(`$ ${binary} ${args.join(' ')}`);
+      return execFileSync(binary, args, options);
+    },
+    tempDirectory: tmpdir,
+    writeFile: writeFileSync,
+  };
+}
+
+export function parseGoVersion(output) {
+  const match = /\b(go\d+(?:\.\d+){1,2}(?:[a-z0-9.-]*)?)\b/.exec(String(output));
+  if (!match) {
+    throw new Error(`Could not parse Go toolchain version from: ${String(output).trim()}`);
+  }
+  return match[1];
+}
+
+export function renderSidecarReadme({ sourceRepository, sourceTag, sourceCommit, goVersion }) {
+  return [
+    '# Windows scip.exe npm sidecar',
+    '',
+    `These binaries are built from ${sourceRepository} at ${sourceTag}`,
+    `(${sourceCommit}) with ${goVersion}.`,
+    'They are bundled in the OS-gated `codebaseiq-windows` npm package. The main',
+    '`codebaseiq` package declares that sidecar as an optional dependency, so npm',
+    'installs it automatically on Windows and `reindex` works without Go or WSL.',
+    '',
+    `\`${WINDOWS_SIDECAR_PROVENANCE_FILE}\` binds the package version and exact source,`,
+    'toolchain, build flags, target machine, file size, and SHA-256 for both binaries.',
+    'Build, pack, and publish checks reject missing or mismatched evidence.',
+    '',
+    'Run `npm run build:codebaseiq-windows` to rebuild the binaries and provenance manifest.',
+    'Review and commit the manifest change before release. Publishing the main package',
+    'verifies the version pin and the complete sidecar provenance before any registry',
+    'decision.',
+    '',
+  ].join('\n');
+}
+
+const invokedPath = process.argv[1] ? resolve(process.argv[1]) : null;
+if (invokedPath === fileURLToPath(import.meta.url)) {
+  try {
+    buildCodebaseIqWindowsSidecar();
+  } catch (error) {
+    console.error(`Windows sidecar build FAILED:\n  - ${error instanceof Error ? error.message : String(error)}`);
+    process.exitCode = 1;
+  }
+}