@vmz/vmz 0.0.3 → 0.1.0

package/dist/server-language-backend.d.ts

@@ -0,0 +1,89 @@
+/**
+ * Server Language DSL backends (lang on `<script server>`).
+ * Author surface is a VMZ DSL flavor — not full target-language source.
+ */
+/** @typedef {'ts' | 'rust' | 'python' | 'java'} ServerLangId */
+export declare const SERVER_LANG_IDS: readonly string[];
+/** @type {Record<string, ServerLangId>} */
+export declare const SERVER_LANG_ALIASES: Readonly<{
+    ts: "ts";
+    typescript: "ts";
+    rust: "rust";
+    python: "python";
+    java: "java";
+}>;
+/**
+ * @typedef {{
+ *   langId: ServerLangId,
+ *   aliases: string[],
+ *   compatibleRuntimes: string[],
+ *   implemented: boolean,
+ *   artifactRoot: string,
+ * }} ServerLanguageBackendMeta
+ */
+/** @type {Record<ServerLangId, ServerLanguageBackendMeta>} */
+export declare const SERVER_LANGUAGE_BACKENDS: Readonly<{
+    ts: {
+        langId: string;
+        aliases: string[];
+        compatibleRuntimes: string[];
+        implemented: boolean;
+        artifactRoot: string;
+    };
+    rust: {
+        langId: string;
+        aliases: string[];
+        compatibleRuntimes: string[];
+        implemented: boolean;
+        artifactRoot: string;
+    };
+    python: {
+        langId: string;
+        aliases: string[];
+        compatibleRuntimes: string[];
+        implemented: boolean;
+        artifactRoot: string;
+    };
+    java: {
+        langId: string;
+        aliases: string[];
+        compatibleRuntimes: string[];
+        implemented: boolean;
+        artifactRoot: string;
+    };
+}>;
+/**
+ * Resolve author `lang` attr (or null/undefined for default TS).
+ * @param {string | null | undefined} raw
+ * @returns {{
+ *   ok: true, langId: ServerLangId, backend: ServerLanguageBackendMeta
+ * } | {
+ *   ok: false, code: string, message: string
+ * }}
+ */
+export declare function resolveServerLanguage(raw: any): {
+    ok: boolean;
+    code: string;
+    message: string;
+    langId?: undefined;
+    backend?: undefined;
+} | {
+    ok: boolean;
+    langId: any;
+    backend: any;
+    code?: undefined;
+    message?: undefined;
+};
+/**
+ * @param {ServerLangId} langId
+ * @param {string | null | undefined} serverRuntime
+ */
+export declare function assertLangRuntimePair(langId: any, serverRuntime: any): {
+    ok: boolean;
+    code: string;
+    message: string;
+} | {
+    ok: boolean;
+    code?: undefined;
+    message?: undefined;
+};

package/dist/server-language-backend.js

@@ -0,0 +1,121 @@
+/**
+ * Server Language DSL backends (lang on `<script server>`).
+ * Author surface is a VMZ DSL flavor — not full target-language source.
+ */
+// @ts-nocheck
+/** @typedef {'ts' | 'rust' | 'python' | 'java'} ServerLangId */
+export const SERVER_LANG_IDS = Object.freeze(['ts', 'rust', 'python', 'java']);
+/** @type {Record<string, ServerLangId>} */
+export const SERVER_LANG_ALIASES = Object.freeze({
+    ts: 'ts',
+    typescript: 'ts',
+    rust: 'rust',
+    python: 'python',
+    java: 'java',
+});
+/**
+ * @typedef {{
+ *   langId: ServerLangId,
+ *   aliases: string[],
+ *   compatibleRuntimes: string[],
+ *   implemented: boolean,
+ *   artifactRoot: string,
+ * }} ServerLanguageBackendMeta
+ */
+/** @type {Record<ServerLangId, ServerLanguageBackendMeta>} */
+export const SERVER_LANGUAGE_BACKENDS = Object.freeze({
+    ts: {
+        langId: 'ts',
+        aliases: ['ts', 'typescript'],
+        compatibleRuntimes: ['node', 'worker', 'deno', 'bun'],
+        implemented: true,
+        artifactRoot: 'dist/#server',
+    },
+    rust: {
+        langId: 'rust',
+        aliases: ['rust'],
+        compatibleRuntimes: ['rust-host'],
+        implemented: true,
+        artifactRoot: 'target/vmz/server-rust',
+    },
+    python: {
+        langId: 'python',
+        aliases: ['python'],
+        compatibleRuntimes: ['python-host'],
+        implemented: false,
+        artifactRoot: 'target/vmz/server-python',
+    },
+    java: {
+        langId: 'java',
+        aliases: ['java'],
+        compatibleRuntimes: ['jvm-host'],
+        implemented: false,
+        artifactRoot: 'target/vmz/server-java',
+    },
+});
+/**
+ * Resolve author `lang` attr (or null/undefined for default TS).
+ * @param {string | null | undefined} raw
+ * @returns {{
+ *   ok: true, langId: ServerLangId, backend: ServerLanguageBackendMeta
+ * } | {
+ *   ok: false, code: string, message: string
+ * }}
+ */
+export function resolveServerLanguage(raw) {
+    const trimmed = raw == null ? '' : String(raw).trim();
+    if (!trimmed) {
+        return { ok: true, langId: 'ts', backend: SERVER_LANGUAGE_BACKENDS.ts };
+    }
+    const langId = SERVER_LANG_ALIASES[trimmed];
+    if (!langId) {
+        return {
+            ok: false,
+            code: 'vmz::server::unknown_language',
+            message: `unknown script language \`${trimmed}\`; use ts|typescript|rust|python|java`,
+        };
+    }
+    const backend = SERVER_LANGUAGE_BACKENDS[langId];
+    if (!backend.implemented) {
+        return {
+            ok: false,
+            code: 'vmz::server::language_backend_unimplemented',
+            message: `\`<script server lang="${langId}">\` is registered but not implemented yet`,
+        };
+    }
+    return { ok: true, langId, backend };
+}
+/**
+ * @param {ServerLangId} langId
+ * @param {string | null | undefined} serverRuntime
+ */
+export function assertLangRuntimePair(langId, serverRuntime) {
+    const backend = SERVER_LANGUAGE_BACKENDS[langId];
+    if (!backend) {
+        return {
+            ok: false,
+            code: 'vmz::server::unknown_language',
+            message: `unknown langId ${langId}`,
+        };
+    }
+    if (langId === 'ts') {
+        // TS stays compatible with existing node/worker defaults; rust-host rejects ts.
+        if (serverRuntime === 'rust-host' || serverRuntime === 'python-host' || serverRuntime === 'jvm-host') {
+            return {
+                ok: false,
+                code: 'vmz::server::lang_runtime_mismatch',
+                message: `lang=ts is incompatible with serverRuntime=${serverRuntime}`,
+            };
+        }
+        return { ok: true };
+    }
+    const rt = String(serverRuntime || '').trim();
+    if (!backend.compatibleRuntimes.includes(rt)) {
+        return {
+            ok: false,
+            code: 'vmz::server::lang_runtime_mismatch',
+            message: `lang=${langId} requires serverRuntime in [${backend.compatibleRuntimes.join('|')}] (got ${rt || '(none)'})`,
+        };
+    }
+    return { ok: true };
+}

package/dist/site-delivery.d.ts

@@ -0,0 +1,134 @@
+/**
+ * A3-site: SiteDeliveryContract — embedded | filesystem | remote selection + release fallback.
+ * Authoring via defineConfig({ delivery }) / defineSite(...); pure data only.
+ */
+export declare const SITE_DELIVERY_CONTRACT_SCHEMA = "vmz.site.delivery_contract.v0";
+export declare const SITE_DELIVERY_RESOLUTION_SCHEMA = "vmz.site.delivery_resolution.v0";
+/**
+ * Pure-data helper for `defineConfig({ delivery: defineSite(...) })`.
+ * Not a second config entry — CLI never auto-discovers `vmz.site.ts`.
+ * @param {Record<string, unknown>} delivery
+ */
+export declare function defineSite(delivery: any): any;
+/**
+ * Normalize authoring delivery → frozen SiteDeliveryContract.
+ * @param {unknown} raw
+ * @param {{ siteId?: string, projectRoot?: string }} [opts]
+ * @returns {{ ok: true, contract: Record<string, any> } | { ok: false, diagnostics: Array<{ code: string, message: string }> }}
+ */
+export declare function normalizeSiteDelivery(raw: any, opts?: {}): {
+    ok: boolean;
+    diagnostics: any[];
+    contract?: undefined;
+} | {
+    ok: boolean;
+    contract: {
+        schema: string;
+        schemaVersion: string;
+        siteId: any;
+        artifact: string;
+        expectedCompatibility: any;
+        sources: any[];
+        resolutionPolicy: {
+            mode: string;
+            fallback: any;
+            fileLevelMix: boolean;
+        };
+        failurePolicy: any;
+        updatePolicy: any;
+        rollbackPolicy: any;
+        securityPolicy: any;
+        activation: string;
+    };
+    diagnostics?: undefined;
+};
+/**
+ * Probe one physical source for release-level readiness (not per-URL).
+ * @param {{
+ *   available?: boolean,
+ *   artifactDigest?: string | null,
+ *   integrityOk?: boolean,
+ *   signatureOk?: boolean,
+ *   objectClosureOk?: boolean,
+ *   mixedDigestObjects?: boolean,
+ *   error?: string | null,
+ * }} [probe]
+ */
+export declare function normalizeSourceProbe(probe?: {}): {
+    available: boolean;
+    artifactDigest: any;
+    integrityOk: boolean;
+    signatureOk: boolean;
+    objectClosureOk: boolean;
+    mixedDigestObjects: boolean;
+    error: any;
+};
+/**
+ * Resolve one complete release per SiteDeliveryContract (no file-level mix).
+ * @param {Record<string, any>} contract
+ * @param {Record<string, ReturnType<typeof normalizeSourceProbe>>} probes by sourceId
+ */
+export declare function resolveSiteRelease(contract: any, probes?: {}): {
+    schema: string;
+    status: string;
+    selectedSourceId: any;
+    selectedKind: any;
+    selectedDigest: any;
+    fallbackReason: string;
+    attempted: any[];
+    fileLevelMix: boolean;
+    activation: string;
+    contractDigest: any;
+} | {
+    schema: string;
+    status: string;
+    selectedSourceId: any;
+    selectedKind: any;
+    selectedDigest: any;
+    fallbackReason: string;
+    attempted: any[];
+    fileLevelMix: boolean;
+    activation: string;
+    contractDigest: any;
+    resolutionDigest: any;
+};
+/**
+ * Read a packed release directory probe (expects _vmz/release-envelope.json + object closure).
+ * @param {string} releaseDir absolute path to a release snapshot (contains dist/ or is dist/)
+ */
+export declare function probeReleaseDirectory(releaseDir: any): {
+    available: boolean;
+    artifactDigest: any;
+    integrityOk: boolean;
+    signatureOk: boolean;
+    objectClosureOk: boolean;
+    mixedDigestObjects: boolean;
+    error: any;
+};
+/**
+ * Emit normalized contract (+ optional resolution) under dist/_vmz.
+ * @param {string} outDir
+ * @param {unknown} deliveryRaw
+ * @param {{ siteId?: string, probes?: Record<string, any> }} [opts]
+ */
+export declare function emitSiteDelivery(outDir: any, deliveryRaw: any, opts?: {}): {
+    contract: {
+        schema: string;
+        schemaVersion: string;
+        siteId: any;
+        artifact: string;
+        expectedCompatibility: any;
+        sources: any[];
+        resolutionPolicy: {
+            mode: string;
+            fallback: any;
+            fileLevelMix: boolean;
+        };
+        failurePolicy: any;
+        updatePolicy: any;
+        rollbackPolicy: any;
+        securityPolicy: any;
+        activation: string;
+    };
+    resolution: any;
+};

package/dist/site-delivery.js

@@ -0,0 +1,345 @@
+/**
+ * A3-site: SiteDeliveryContract — embedded | filesystem | remote selection + release fallback.
+ * Authoring via defineConfig({ delivery }) / defineSite(...); pure data only.
+ */
+// @ts-nocheck
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+export const SITE_DELIVERY_CONTRACT_SCHEMA = 'vmz.site.delivery_contract.v0';
+export const SITE_DELIVERY_RESOLUTION_SCHEMA = 'vmz.site.delivery_resolution.v0';
+/**
+ * Pure-data helper for `defineConfig({ delivery: defineSite(...) })`.
+ * Not a second config entry — CLI never auto-discovers `vmz.site.ts`.
+ * @param {Record<string, unknown>} delivery
+ */
+export function defineSite(delivery) {
+    return delivery;
+}
+/**
+ * Normalize authoring delivery → frozen SiteDeliveryContract.
+ * @param {unknown} raw
+ * @param {{ siteId?: string, projectRoot?: string }} [opts]
+ * @returns {{ ok: true, contract: Record<string, any> } | { ok: false, diagnostics: Array<{ code: string, message: string }> }}
+ */
+export function normalizeSiteDelivery(raw, opts = {}) {
+    /** @type {Array<{ code: string, message: string }>} */
+    const diagnostics = [];
+    if (raw == null || typeof raw !== 'object' || Array.isArray(raw)) {
+        return {
+            ok: false,
+            diagnostics: [{ code: 'site.delivery.invalid', message: 'delivery must be a plain object' }],
+        };
+    }
+    const d = /** @type {Record<string, any>} */ (raw);
+    if (typeof d.artifact !== 'string' || !d.artifact.trim()) {
+        diagnostics.push({ code: 'site.delivery.artifact', message: 'delivery.artifact is required' });
+    }
+    if (!Array.isArray(d.sources) || d.sources.length < 1) {
+        diagnostics.push({ code: 'site.delivery.sources', message: 'delivery.sources must be a non-empty array' });
+    }
+    const sources = [];
+    const seen = new Set();
+    for (const [i, s] of (d.sources || []).entries()) {
+        if (!s || typeof s !== 'object') {
+            diagnostics.push({ code: 'site.delivery.source', message: `sources[${i}] must be an object` });
+            continue;
+        }
+        const id = String(s.id || '').trim();
+        const kind = String(s.kind || '').trim();
+        if (!id) {
+            diagnostics.push({ code: 'site.delivery.sourceId', message: `sources[${i}].id is required` });
+            continue;
+        }
+        if (seen.has(id)) {
+            diagnostics.push({ code: 'site.delivery.sourceId.dup', message: `duplicate source id ${id}` });
+            continue;
+        }
+        seen.add(id);
+        if (!['embedded', 'filesystem', 'remote'].includes(kind)) {
+            diagnostics.push({
+                code: 'site.delivery.kind',
+                message: `sources[${i}].kind must be embedded|filesystem|remote`,
+            });
+            continue;
+        }
+        if (typeof s.directory === 'function' || typeof s.baseUrl === 'function') {
+            diagnostics.push({
+                code: 'site.delivery.executable',
+                message: `sources[${i}] must be pure data (no functions)`,
+            });
+            continue;
+        }
+        if (kind === 'filesystem' && typeof s.directory !== 'string') {
+            diagnostics.push({
+                code: 'site.delivery.filesystem',
+                message: `sources[${i}] filesystem requires directory string`,
+            });
+        }
+        if (kind === 'remote' && typeof s.baseUrl !== 'string') {
+            diagnostics.push({
+                code: 'site.delivery.remote',
+                message: `sources[${i}] remote requires baseUrl string`,
+            });
+        }
+        if (kind === 'embedded' && s.artifact == null && d.artifact == null) {
+            diagnostics.push({
+                code: 'site.delivery.embedded',
+                message: `sources[${i}] embedded requires artifact id`,
+            });
+        }
+        sources.push({
+            sourceId: id,
+            kind,
+            priority: typeof s.priority === 'number' ? s.priority : i,
+            trust: s.trust || 'signed-release',
+            directory: kind === 'filesystem' ? String(s.directory) : null,
+            baseUrl: kind === 'remote' ? String(s.baseUrl).replace(/\/$/, '') : null,
+            timeoutMs: kind === 'remote' ? Number(s.timeoutMs || 1500) : null,
+            artifact: s.artifact != null ? String(s.artifact) : kind === 'embedded' ? String(d.artifact) : null,
+            integrity: s.integrity || null,
+            signaturePolicy: s.signaturePolicy || s.trust || 'signed-release',
+        });
+    }
+    const resolution = d.resolution && typeof d.resolution === 'object' ? d.resolution : {};
+    const mode = String(resolution.mode || 'release');
+    if (mode !== 'release') {
+        diagnostics.push({
+            code: 'site.delivery.resolution.mode',
+            message: `resolution.mode must be 'release' (got ${mode})`,
+        });
+    }
+    let fallback = Array.isArray(resolution.fallback) ? resolution.fallback.map(String) : sources.map((s) => s.sourceId);
+    for (const id of fallback) {
+        if (!seen.has(id)) {
+            diagnostics.push({
+                code: 'site.delivery.fallback.unknown',
+                message: `resolution.fallback references unknown source ${id}`,
+            });
+        }
+    }
+    // Preserve author order — do not reorder by discovery/speed.
+    const activation = String(d.activation || 'atomic');
+    if (activation !== 'atomic') {
+        diagnostics.push({
+            code: 'site.delivery.activation',
+            message: `activation must be 'atomic' in v0`,
+        });
+    }
+    if (diagnostics.length)
+        return { ok: false, diagnostics };
+    const contractBody = {
+        schema: SITE_DELIVERY_CONTRACT_SCHEMA,
+        schemaVersion: '0',
+        siteId: opts.siteId || d.siteId || d.artifact,
+        artifact: String(d.artifact),
+        expectedCompatibility: d.expectedCompatibility || {
+            runtime: 'vmz',
+            deliveryProfiles: ['web-static', 'filesystem'],
+        },
+        sources,
+        resolutionPolicy: {
+            mode: 'release',
+            fallback,
+            fileLevelMix: false,
+        },
+        failurePolicy: d.failure || d.failurePolicy || { onAllSourcesFailed: 'embedded-or-fail' },
+        updatePolicy: d.update || d.updatePolicy || { backgroundRemote: true },
+        rollbackPolicy: d.rollback || d.rollbackPolicy || { retainPrevious: true },
+        securityPolicy: d.security || d.securityPolicy || { requireSignature: true, forbidSecretsInContract: true },
+        activation: 'atomic',
+    };
+    contractBody.contractDigest = sha256Hex(canonicalJson(contractBody));
+    return { ok: true, contract: contractBody };
+}
+/**
+ * Probe one physical source for release-level readiness (not per-URL).
+ * @param {{
+ *   available?: boolean,
+ *   artifactDigest?: string | null,
+ *   integrityOk?: boolean,
+ *   signatureOk?: boolean,
+ *   objectClosureOk?: boolean,
+ *   mixedDigestObjects?: boolean,
+ *   error?: string | null,
+ * }} [probe]
+ */
+export function normalizeSourceProbe(probe = {}) {
+    return {
+        available: probe.available !== false,
+        artifactDigest: probe.artifactDigest ?? null,
+        integrityOk: probe.integrityOk !== false,
+        signatureOk: probe.signatureOk !== false,
+        objectClosureOk: probe.objectClosureOk !== false,
+        mixedDigestObjects: Boolean(probe.mixedDigestObjects),
+        error: probe.error || null,
+    };
+}
+/**
+ * Resolve one complete release per SiteDeliveryContract (no file-level mix).
+ * @param {Record<string, any>} contract
+ * @param {Record<string, ReturnType<typeof normalizeSourceProbe>>} probes by sourceId
+ */
+export function resolveSiteRelease(contract, probes = {}) {
+    const attempted = [];
+    const fallback = contract.resolutionPolicy?.fallback || contract.sources.map((s) => s.sourceId);
+    for (const sourceId of fallback) {
+        const source = (contract.sources || []).find((s) => s.sourceId === sourceId);
+        if (!source) {
+            attempted.push({ sourceId, result: 'skip', reason: 'unknown-source' });
+            continue;
+        }
+        const probe = normalizeSourceProbe(probes[sourceId]);
+        if (!probe.available) {
+            attempted.push({ sourceId, result: 'reject', reason: probe.error || 'unavailable' });
+            continue;
+        }
+        if (probe.mixedDigestObjects) {
+            attempted.push({
+                sourceId,
+                result: 'reject',
+                reason: 'file-level-mix-forbidden',
+            });
+            continue;
+        }
+        if (!probe.objectClosureOk) {
+            attempted.push({ sourceId, result: 'reject', reason: 'object-closure-incomplete' });
+            continue;
+        }
+        if (contract.securityPolicy?.requireSignature !== false && !probe.signatureOk) {
+            attempted.push({ sourceId, result: 'reject', reason: 'signature-failed' });
+            continue;
+        }
+        if (!probe.integrityOk) {
+            attempted.push({ sourceId, result: 'reject', reason: 'integrity-failed' });
+            continue;
+        }
+        if (!probe.artifactDigest) {
+            attempted.push({ sourceId, result: 'reject', reason: 'missing-artifact-digest' });
+            continue;
+        }
+        attempted.push({ sourceId, result: 'accept', reason: null });
+        const resolution = {
+            schema: SITE_DELIVERY_RESOLUTION_SCHEMA,
+            status: 'activated',
+            selectedSourceId: sourceId,
+            selectedKind: source.kind,
+            selectedDigest: probe.artifactDigest,
+            fallbackReason: attempted.some((a) => a.result === 'reject')
+                ? attempted
+                    .filter((a) => a.result === 'reject')
+                    .map((a) => `${a.sourceId}:${a.reason}`)
+                    .join(';')
+                : null,
+            attempted,
+            fileLevelMix: false,
+            activation: 'atomic',
+            contractDigest: contract.contractDigest,
+        };
+        resolution.resolutionDigest = sha256Hex(canonicalJson(resolution));
+        return resolution;
+    }
+    return {
+        schema: SITE_DELIVERY_RESOLUTION_SCHEMA,
+        status: 'failed',
+        selectedSourceId: null,
+        selectedKind: null,
+        selectedDigest: null,
+        fallbackReason: 'all-sources-rejected',
+        attempted,
+        fileLevelMix: false,
+        activation: 'atomic',
+        contractDigest: contract.contractDigest,
+        resolutionDigest: null,
+    };
+}
+/**
+ * Read a packed release directory probe (expects _vmz/release-envelope.json + object closure).
+ * @param {string} releaseDir absolute path to a release snapshot (contains dist/ or is dist/)
+ */
+export function probeReleaseDirectory(releaseDir) {
+    const root = path.resolve(releaseDir);
+    const dist = fs.existsSync(path.join(root, 'dist')) ? path.join(root, 'dist') : root;
+    const envelopePath = path.join(dist, '_vmz', 'release-envelope.json');
+    if (!fs.existsSync(envelopePath)) {
+        return normalizeSourceProbe({
+            available: false,
+            error: 'missing-release-envelope',
+            objectClosureOk: false,
+            signatureOk: false,
+            integrityOk: false,
+        });
+    }
+    let envelope;
+    try {
+        envelope = JSON.parse(fs.readFileSync(envelopePath, 'utf8'));
+    }
+    catch {
+        return normalizeSourceProbe({
+            available: false,
+            error: 'invalid-release-envelope',
+            objectClosureOk: false,
+            signatureOk: false,
+            integrityOk: false,
+        });
+    }
+    const digest = envelope.artifactDigest || null;
+    const required = ['index.html', '_vmz/release-envelope.json'];
+    let closureOk = true;
+    for (const rel of required) {
+        if (!fs.existsSync(path.join(dist, rel))) {
+            closureOk = false;
+            break;
+        }
+    }
+    // Detect naive file-level mix: CURRENT HTML digest stamp mismatch with envelope (test hook).
+    const mixMarker = path.join(dist, '_vmz', 'MIXED_DIGEST');
+    const mixed = fs.existsSync(mixMarker);
+    return normalizeSourceProbe({
+        available: true,
+        artifactDigest: digest,
+        integrityOk: Boolean(digest) && !mixed,
+        signatureOk: envelope.signatureOk !== false,
+        objectClosureOk: closureOk && !mixed,
+        mixedDigestObjects: mixed,
+        error: mixed ? 'mixed-digest' : null,
+    });
+}
+/**
+ * Emit normalized contract (+ optional resolution) under dist/_vmz.
+ * @param {string} outDir
+ * @param {unknown} deliveryRaw
+ * @param {{ siteId?: string, probes?: Record<string, any> }} [opts]
+ */
+export function emitSiteDelivery(outDir, deliveryRaw, opts = {}) {
+    const norm = normalizeSiteDelivery(deliveryRaw, { siteId: opts.siteId });
+    if (!norm.ok) {
+        throw new Error(`emitSiteDelivery: ${norm.diagnostics.map((d) => d.message).join('; ')}`);
+    }
+    const vmzDir = path.join(outDir, '_vmz');
+    fs.mkdirSync(vmzDir, { recursive: true });
+    fs.writeFileSync(path.join(vmzDir, 'site-delivery-contract.json'), `${JSON.stringify(norm.contract, null, 2)}\n`, 'utf8');
+    let resolution = null;
+    if (opts.probes) {
+        resolution = resolveSiteRelease(norm.contract, opts.probes);
+        fs.writeFileSync(path.join(vmzDir, 'site-delivery-resolution.json'), `${JSON.stringify(resolution, null, 2)}\n`, 'utf8');
+    }
+    return { contract: norm.contract, resolution };
+}
+function sha256Hex(data) {
+    return crypto.createHash('sha256').update(data).digest('hex');
+}
+function canonicalJson(value) {
+    return JSON.stringify(sortKeys(value));
+}
+function sortKeys(value) {
+    if (Array.isArray(value))
+        return value.map(sortKeys);
+    if (value && typeof value === 'object') {
+        const out = {};
+        for (const k of Object.keys(value).sort())
+            out[k] = sortKeys(value[k]);
+        return out;
+    }
+    return value;
+}