fix(build): resolve SDK runtime + host WIT for registry installs (0.1.1)

[joshuajbouw]

Summary

@unicity-astrid/build@0.1.0 only worked in workspace (file:-link) mode.
Registry installs (npm install @unicity-astrid/build) failed two ways
that this PR fixes, bundled in @unicity-astrid/build@0.1.1.

Bug 1 — SDK runtime resolution

SDK_PKG_DIR was hardcoded as resolve(HERE, "..", "..", "astrid-sdk").
In workspace mode, HERE resolved through the symlink to the real
sdk-js/packages/astrid-build/src/ so ../../astrid-sdk correctly landed
at sdk-js/packages/astrid-sdk. Under npm install, HERE is
node_modules/@unicity-astrid/build/src/ and ../../astrid-sdk becomes
node_modules/@unicity-astrid/astrid-sdk — wrong scope, doesn't exist.

Fix: import.meta.resolve('@unicity-astrid/sdk/runtime'), which uses the
ESM resolver and honours the SDK's exports.import condition.

createRequire(...).resolve(...) was tried first but uses the CJS
resolver, which only sees exports.require — our exports map is
import-only.

Bug 2 — canonical host WIT shipping

CANONICAL_WIT_DIR was resolve(REPO_ROOT, "contracts", "host") —
unavailable on consumer machines (the unicity-astrid/wit submodule
isn't part of the npm tarball). Failed with canonical host WIT missing or pre-split at /…/node_modules/contracts/host.

The original comment at the resolver claimed "the JS SDK has no such
constraint" (vs cargo package's tarball-must-be-self-contained rule) —
that was wrong; npm has the same constraint.

Fix: committed copies of the canonical per-domain host WIT files to
packages/astrid-build/wit-staging/host/ (analogous to what
astrid-sys does for the Rust SDK). The resolver prefers the workspace
submodule when present (so live developer edits land without sync) and
falls back to the staged copy otherwise. Added scripts/sync-build-wit.sh
to keep the staged copy in sync with the canonical source.

Test plan

• Local sphere-capsule componentize end-to-end via packed tarball
  install (npm install <tgz> then npx astrid-js-build .) —
  previously failed at SDK runtime, then at host WIT, now produces
  a valid .wasm (~47MB, 154 host imports)
• scripts/sync-build-wit.sh --check confirms wit-staging matches
  the canonical submodule
• Post-merge: publish @unicity-astrid/build@0.1.1 to npm.
  sphere-capsule and any other downstream consumer references
  ^0.1.1; the published ^0.1.0 is currently broken on registry
  install.

[gemini-code-assist]

Code Review

This pull request updates @unicity-astrid/build to version 0.1.1, introducing fallback resolution paths for WIT files and the SDK runtime to support both workspace builds and published-package installations. It includes committed copies of the host WIT files in a new wit-staging directory and adds a synchronization script sync-build-wit.sh to keep them in sync with the canonical submodule. A review comment identifies a potential failure in the synchronization script when globbing .wit files in an empty directory and suggests using shopt -s nullglob to handle empty matches gracefully.

[gemini-code-assist]

If the contracts/host directory exists but is empty (e.g., when the git submodule is not initialized), the cp command will fail with a generic error because the glob *.wit does not expand. Additionally, if DST_DIR is empty, the for f in "$DST_DIR"/*.wit loop will execute once with the literal string *.wit and attempt to delete it, causing a script failure under set -e.

Using shopt -s nullglob and checking the array length of matched files provides a robust and clean solution with a helpful error message.

shopt -s nullglob
files=("$SRC_DIR"/*.wit)
if [[ ${#files[@]} -eq 0 ]]; then
  echo "sync-build-wit: no .wit files found in $SRC_DIR" >&2
  echo "sync-build-wit: did you forget 'git submodule update --init --recursive'?" >&2
  exit 1
fi

if [[ "${1:-}" == "--check" ]]; then
  tmp=$(mktemp -d)
  trap 'rm -rf "$tmp"' EXIT
  cp "${files[@]}" "$tmp/"
  if ! diff -rq "$tmp" "$DST_DIR" >/dev/null 2>&1; then
    echo "sync-build-wit: $DST_DIR is out of sync with $SRC_DIR" >&2
    echo "sync-build-wit: run scripts/sync-build-wit.sh to fix" >&2
    diff -r "$tmp" "$DST_DIR" >&2 || true
    exit 1
  fi
  echo "sync-build-wit: in sync"
  exit 0
fi

mkdir -p "$DST_DIR"
# Sync exactly: copy all .wit, then remove any stale files in DST that
# the canonical source no longer has.
cp "${files[@]}" "$DST_DIR/"
for f in "$DST_DIR"/*.wit; do
  base=$(basename "$f")
  if [[ ! -f "$SRC_DIR/$base" ]]; then
    rm "$f"
  fi
done
echo "sync-build-wit: $DST_DIR ← $SRC_DIR/*.wit (${#files[@]} files)"

[joshuajbouw]

Good catch — fixed. The script guarded SRC_DIR existence but not whether it actually contained .wit files, so an initialised-but-empty submodule dir would feed a literal *.wit to cp (cryptic failure), and the freshly-mkdir'd empty DST would make the staleness loop run once on literal *.wit and rm it under set -e. Added shopt -s nullglob after set -euo pipefail (the shebang is already #!/usr/bin/env bash), then build src_files=("$SRC_DIR"/*.wit) once after the existing dir guard and bail with the same git submodule update --init hint when the array is empty. Both the --check and sync cp now use "${src_files[@]}", and with nullglob the for f in "$DST_DIR"/*.wit staleness loop simply iterates zero times on an empty DST. Verified: --check still reports "in sync", and an empty source dir now exits 1 with the helpful message.