@vmz/vmz 0.0.3 → 0.1.0

package/dist/delivery-profile.js

@@ -0,0 +1,279 @@
+/**
+ * B0 — Delivery profile authoring normalize + CLI --profile resolve.
+ * Pure data only; expands legacy site-delivery sugar into profiles[default].
+ */
+// @ts-nocheck
+import crypto from 'node:crypto';
+export const DELIVERY_PROFILE_AUTHORING_SCHEMA = 'vmz.delivery.authoring.v0';
+export const BUILD_PROFILE_SELECTION_SCHEMA = 'vmz.build.profile_selection.v0';
+/** Browser-era assembly kinds (04 B5). */
+export const ASSEMBLIES = Object.freeze(['local-static', 'static-cdn', 'server-host', 'cdn+server', 'rust-embedded']);
+export const SERVER_RUNTIMES = Object.freeze(['node', 'worker', 'deno', 'bun', 'rust-host']);
+/** Official built-in aliases when not overridden in config. */
+export const BUILTIN_PROFILES = Object.freeze({
+    'web-client': { host: 'browser', assembly: 'local-static' },
+    'web-static': { host: 'browser', assembly: 'static-cdn' },
+    'web-ssr': { host: 'browser', assembly: 'server-host', serverRuntime: 'node' },
+    'web-hybrid': { host: 'browser', assembly: 'cdn+server', serverRuntime: 'node' },
+});
+function isPlainObject(v) {
+    return v != null && typeof v === 'object' && !Array.isArray(v);
+}
+export function pickSiteAuthoring(raw) {
+    if (!isPlainObject(raw))
+        return null;
+    if (!Array.isArray(raw.sources) || raw.sources.length < 1)
+        return null;
+    if (typeof raw.artifact !== 'string' || !String(raw.artifact).trim())
+        return null;
+    const site = {
+        artifact: String(raw.artifact),
+        sources: raw.sources,
+    };
+    for (const k of [
+        'siteId',
+        'resolution',
+        'activation',
+        'expectedCompatibility',
+        'failure',
+        'failurePolicy',
+        'update',
+        'updatePolicy',
+        'rollback',
+        'rollbackPolicy',
+        'security',
+        'securityPolicy',
+    ]) {
+        if (raw[k] !== undefined)
+            site[k] = raw[k];
+    }
+    return site;
+}
+function normalizeProfileEntry(entry, id, diagnostics) {
+    if (!isPlainObject(entry)) {
+        diagnostics.push({ code: 'delivery.profile.invalid', message: `profiles.${id} must be an object` });
+        return null;
+    }
+    const host = String(entry.host || 'browser');
+    if (host !== 'browser') {
+        diagnostics.push({
+            code: 'delivery.profile.host',
+            message: `profiles.${id}.host: only 'browser' is supported before Browser Production (got ${host})`,
+        });
+    }
+    const assembly = String(entry.assembly || '').trim();
+    if (!ASSEMBLIES.includes(assembly)) {
+        diagnostics.push({
+            code: 'delivery.profile.assembly',
+            message: `profiles.${id}.assembly must be one of ${ASSEMBLIES.join('|')} (got ${assembly || '(empty)'})`,
+        });
+        return null;
+    }
+    let serverRuntime = null;
+    if (assembly === 'server-host' || assembly === 'cdn+server') {
+        serverRuntime = String(entry.serverRuntime || 'node');
+        if (!SERVER_RUNTIMES.includes(serverRuntime)) {
+            diagnostics.push({
+                code: 'delivery.profile.serverRuntime',
+                message: `profiles.${id}.serverRuntime must be one of ${SERVER_RUNTIMES.join('|')}`,
+            });
+        }
+    }
+    let sources = null;
+    if (entry.sources != null) {
+        if (isPlainObject(entry.sources) && Array.isArray(entry.sources.sources)) {
+            sources = pickSiteAuthoring(entry.sources);
+        }
+        else if (Array.isArray(entry.sources)) {
+            sources = pickSiteAuthoring({
+                artifact: entry.artifact || entry.sourcesArtifact || id,
+                sources: entry.sources,
+                resolution: entry.resolution,
+                activation: entry.activation,
+            });
+        }
+        else {
+            diagnostics.push({
+                code: 'delivery.profile.sources',
+                message: `profiles.${id}.sources must be defineSite({...}) or a sources array with artifact`,
+            });
+        }
+        if (entry.sources != null && sources == null) {
+            const already = diagnostics.some((d) => String(d.message || '').includes(`profiles.${id}`));
+            if (!already) {
+                diagnostics.push({
+                    code: 'delivery.profile.sources.artifact',
+                    message: `profiles.${id} site sources require artifact string`,
+                });
+            }
+        }
+    }
+    return {
+        id,
+        host: 'browser',
+        assembly,
+        serverRuntime,
+        sources,
+    };
+}
+export function normalizeDeliveryAuthoring(raw) {
+    const diagnostics = [];
+    if (raw == null) {
+        const profiles = { ...BUILTIN_PROFILES };
+        const normalized = {};
+        for (const [id, entry] of Object.entries(profiles)) {
+            const n = normalizeProfileEntry(entry, id, diagnostics);
+            if (n)
+                normalized[id] = n;
+        }
+        const table = {
+            schema: DELIVERY_PROFILE_AUTHORING_SCHEMA,
+            default: 'web-ssr',
+            profiles: normalized,
+            sugar: false,
+        };
+        table.digest = sha256Hex(canonicalJson(table));
+        return { ok: true, table };
+    }
+    if (!isPlainObject(raw)) {
+        return {
+            ok: false,
+            diagnostics: [{ code: 'delivery.invalid', message: 'delivery must be a plain object' }],
+        };
+    }
+    let profileInputs = {};
+    let defaultId = '';
+    let sugar = false;
+    if (isPlainObject(raw.profiles)) {
+        defaultId = String(raw.default || '').trim();
+        profileInputs = { ...BUILTIN_PROFILES, ...raw.profiles };
+        if (!defaultId) {
+            const keys = Object.keys(raw.profiles);
+            defaultId = keys[0] || 'web-ssr';
+        }
+    }
+    else if (Array.isArray(raw.sources) || raw.artifact != null || raw.assembly != null) {
+        sugar = true;
+        const site = pickSiteAuthoring(raw);
+        defaultId = String(raw.default || raw.artifact || 'web-ssr').trim() || 'web-ssr';
+        const assembly = typeof raw.assembly === 'string' && ASSEMBLIES.includes(raw.assembly) ? raw.assembly : site ? 'rust-embedded' : 'server-host';
+        profileInputs = {
+            ...BUILTIN_PROFILES,
+            [defaultId]: {
+                host: raw.host || 'browser',
+                assembly,
+                serverRuntime: raw.serverRuntime || 'node',
+                ...(site
+                    ? {
+                        artifact: site.artifact,
+                        sources: site.sources,
+                        resolution: site.resolution,
+                        activation: site.activation,
+                        expectedCompatibility: site.expectedCompatibility,
+                        failure: site.failure,
+                        failurePolicy: site.failurePolicy,
+                        update: site.update,
+                        updatePolicy: site.updatePolicy,
+                        rollback: site.rollback,
+                        rollbackPolicy: site.rollbackPolicy,
+                        security: site.security,
+                        securityPolicy: site.securityPolicy,
+                    }
+                    : {}),
+            },
+        };
+    }
+    else {
+        return {
+            ok: false,
+            diagnostics: [
+                {
+                    code: 'delivery.shape',
+                    message: 'delivery must declare profiles{} or legacy { artifact, sources }',
+                },
+            ],
+        };
+    }
+    const profiles = {};
+    for (const [id, entry] of Object.entries(profileInputs)) {
+        const n = normalizeProfileEntry(entry, id, diagnostics);
+        if (n)
+            profiles[id] = n;
+    }
+    if (!profiles[defaultId]) {
+        diagnostics.push({
+            code: 'delivery.default',
+            message: `delivery.default '${defaultId}' is not a known profile`,
+        });
+    }
+    if (diagnostics.length)
+        return { ok: false, diagnostics };
+    const table = {
+        schema: DELIVERY_PROFILE_AUTHORING_SCHEMA,
+        default: defaultId,
+        profiles,
+        sugar,
+    };
+    table.digest = sha256Hex(canonicalJson(table));
+    return { ok: true, table };
+}
+export function selectBuildProfile(table, cliProfile = '') {
+    const id = String(cliProfile || '').trim() || table.default;
+    const profile = table.profiles[id];
+    if (!profile) {
+        return {
+            ok: false,
+            diagnostics: [
+                {
+                    code: 'delivery.profile.unknown',
+                    message: `unknown build --profile ${id} (known: ${Object.keys(table.profiles).join(', ')})`,
+                },
+            ],
+        };
+    }
+    const selection = {
+        schema: BUILD_PROFILE_SELECTION_SCHEMA,
+        profileId: id,
+        host: profile.host,
+        assembly: profile.assembly,
+        serverRuntime: profile.serverRuntime,
+        hasSiteSources: Boolean(profile.sources),
+        authoringDigest: table.digest,
+        fromCli: Boolean(String(cliProfile || '').trim()),
+    };
+    selection.digest = sha256Hex(canonicalJson(selection));
+    return { ok: true, selection, profile };
+}
+export function semanticIdsForAssembly(assembly) {
+    switch (assembly) {
+        case 'static-cdn':
+            return ['static-delivery', 'asset-graph'];
+        case 'server-host':
+            return ['server-host', 'asset-graph'];
+        case 'cdn+server':
+            return ['server-host', 'static-delivery', 'asset-graph'];
+        case 'rust-embedded':
+            return ['site-fallback', 'asset-graph'];
+        case 'local-static':
+            return ['asset-graph'];
+        default:
+            return [];
+    }
+}
+export function canonicalJson(value) {
+    return JSON.stringify(sortKeys(value));
+}
+function sortKeys(value) {
+    if (Array.isArray(value))
+        return value.map(sortKeys);
+    if (value && typeof value === 'object') {
+        const out = {};
+        for (const k of Object.keys(value).sort())
+            out[k] = sortKeys(value[k]);
+        return out;
+    }
+    return value;
+}
+export function sha256Hex(text) {
+    return crypto.createHash('sha256').update(text, 'utf8').digest('hex');
+}

package/dist/dev-session.js

@@ -10,6 +10,7 @@ import { existsSync } from 'node:fs';
 import path from 'node:path';
 import { buildIntegratedDocuments, projectHasDocuments } from './document-integrate.js';
 import { createWorkspace } from './index.js';
+import { emitLocaleRuntimeModules, localeHasErrors } from './locale-check.js';
 import { log } from './log.js';
 import { diffFingerprints, fileFingerprintMap } from './watch-diff.js';
 /**
@@ -48,12 +49,24 @@ export function createDevSession(options) {
             ws.updateFiles(changes);
         return ws.build();
     }
+    function emitLocales() {
+        const localeEmit = emitLocaleRuntimeModules(project, outDir);
+        // Always surface locale diagnostics (warnings included) — missing /locales must not be silent.
+        log.diagnostics(localeEmit.diagnostics ?? []);
+        if (!localeEmit.ok || localeHasErrors({ diagnostics: localeEmit.diagnostics })) {
+            log.error('locale runtime emit failed');
+            return false;
+        }
+        return true;
+    }
     function printReport(report, label) {
         const errors = log.diagnostics(report.diagnostics ?? []);
         if (errors) {
             log.error(`${label} failed (${errors} error(s))`);
             return false;
         }
+        if (!emitLocales())
+            return false;
         const mode = report.full ? 'full' : 'affected';
         const chunks = (report.affectedChunks || []).join(', ') || '(none)';
         log.info(`${label} ok (${mode}; chunks=[${chunks}]; ${(report.emitted ?? []).length} emitted)`);
@@ -82,7 +95,8 @@ export function createDevSession(options) {
         }
         child = spawnHost({ project, outDir, host, port });
         const docsRoot = path.join(project, 'documents');
-        const watchRoots = [src].concat(existsSync(docsRoot) ? [docsRoot] : []);
+        const localesRoot = path.join(project, 'locales');
+        const watchRoots = [src].concat(existsSync(docsRoot) ? [docsRoot] : []).concat(existsSync(localesRoot) ? [localesRoot] : []);
         log.info(`dev → http://${host}:${port} (watching ${watchRoots.join(', ')})`);
         /** @type {Map<string, Map<string, string>>} */
         let fingerprints = new Map();
@@ -100,10 +114,12 @@ export function createDevSession(options) {
                 if (stopped || signal?.aborted)
                     break;
                 if (child && child.exitCode != null) {
-                    throw new Error(`vmz serve-host exited: ${child.exitCode}`);
+                    log.warn(`serve-host exited (${child.exitCode}) — respawning…`);
+                    child = spawnHost({ project, outDir, host, port });
+                    continue;
                 }
-                /** @type {{ srcChanged: string[], srcDeleted: string[], docsDirty: boolean }} */
-                let batch = { srcChanged: [], srcDeleted: [], docsDirty: false };
+                /** @type {{ srcChanged: string[], srcDeleted: string[], docsDirty: boolean, localesDirty: boolean }} */
+                let batch = { srcChanged: [], srcDeleted: [], docsDirty: false, localesDirty: false };
                 try {
                     // Probe only — keep prior fingerprints until debounce resample
                     // (same contract as pre-docs watcher: empty second pass would miss soft reload).
@@ -115,6 +131,10 @@ export function createDevSession(options) {
                             batch.srcChanged = diff.changed;
                             batch.srcDeleted = diff.deleted;
                         }
+                        else if (root === localesRoot) {
+                            if (diff.changed.length || diff.deleted.length)
+                                batch.localesDirty = true;
+                        }
                         else if (diff.changed.length || diff.deleted.length) {
                             batch.docsDirty = true;
                         }
@@ -124,11 +144,11 @@ export function createDevSession(options) {
                     log.warn('watch error:', err);
                     continue;
                 }
-                if (!batch.srcChanged.length && !batch.srcDeleted.length && !batch.docsDirty)
+                if (!batch.srcChanged.length && !batch.srcDeleted.length && !batch.docsDirty && !batch.localesDirty)
                     continue;
                 await sleep(200);
                 // Resample against the same prior fingerprints, then commit.
-                batch = { srcChanged: [], srcDeleted: [], docsDirty: false };
+                batch = { srcChanged: [], srcDeleted: [], docsDirty: false, localesDirty: false };
                 for (const root of watchRoots) {
                     const prev = fingerprints.get(root) || new Map();
                     const next = fileFingerprintMap(root);
@@ -138,11 +158,15 @@ export function createDevSession(options) {
                         batch.srcChanged = diff.changed;
                         batch.srcDeleted = diff.deleted;
                     }
+                    else if (root === localesRoot) {
+                        if (diff.changed.length || diff.deleted.length)
+                            batch.localesDirty = true;
+                    }
                     else if (diff.changed.length || diff.deleted.length) {
                         batch.docsDirty = true;
                     }
                 }
-                if (!batch.srcChanged.length && !batch.srcDeleted.length && !batch.docsDirty)
+                if (!batch.srcChanged.length && !batch.srcDeleted.length && !batch.docsDirty && !batch.localesDirty)
                     continue;
                 let needFullReload = batch.docsDirty;
                 if (batch.srcChanged.length || batch.srcDeleted.length) {
@@ -180,12 +204,26 @@ export function createDevSession(options) {
                                 : 'soft reload ok (full page)');
                     }
                     catch (err) {
-                        log.warn(`soft reload failed (${err}) — restarting serve-host…`);
-                        killChild(child);
-                        child = spawnHost({ project, outDir, host, port });
+                        log.warn(`soft reload failed (${err}) — keeping previous serve-host (fix and save)`);
                     }
                     continue;
                 }
+                if (batch.localesDirty) {
+                    log.info('locales change detected — re-emitting #locales runtime…');
+                    if (!emitLocales()) {
+                        log.warn('locale runtime emit failed — keeping previous modules');
+                        continue;
+                    }
+                    try {
+                        await softReload(host, port, { full: true, islandHmr: false });
+                        log.info('soft reload ok (full page; locales)');
+                    }
+                    catch (err) {
+                        log.warn(`soft reload failed (${err}) — keeping previous serve-host (fix and save)`);
+                    }
+                    if (!batch.docsDirty)
+                        continue;
+                }
                 if (batch.docsDirty) {
                     log.info('documents change detected — rebuilding document mount…');
                     const docs = await buildIntegratedDocuments({ projectRoot: project, outDir });
@@ -198,9 +236,7 @@ export function createDevSession(options) {
                         log.info('soft reload ok (full page; docs)');
                     }
                     catch (err) {
-                        log.warn(`soft reload failed (${err}) — restarting serve-host…`);
-                        killChild(child);
-                        child = spawnHost({ project, outDir, host, port });
+                        log.warn(`soft reload failed (${err}) — keeping previous serve-host (fix and save)`);
                     }
                 }
             }

package/dist/document-build.js

@@ -164,11 +164,12 @@ function renderStaticHtml({ title, locale, route, nav, bodyHtml, headings, desig
     /** @type {string[]} */
     const cssHrefs = [];
     if (hostChrome) {
-        // Same application stylesheet as landing pages (header/footer chrome).
-        cssHrefs.push(`${prefix}vmz.css`);
+        // Integrated documents are served with pretty directory URLs. Root
+        // absolute assets remain correct for both emitted files and rewrites.
+        cssHrefs.push('/vmz.css');
     }
     if (designsHref)
-        cssHrefs.push(prefix + designsHref);
+        cssHrefs.push(hostChrome ? `/${designsHref}` : prefix + designsHref);
     const cssLink = cssHrefs.map((href) => `  <link rel="stylesheet" href="${esc(href)}" />`).join('\n') + (cssHrefs.length ? '\n' : '');
     const navItems = nav
         .map((n) => {
@@ -200,13 +201,17 @@ ${cssLink}</head>
   <div class="site site--docs">
   <a class="skip-link" href="#main">Skip to content</a>
 ${header}
+  <div class="doc-body">
+    <aside class="doc-sidebar">
 ${docsNav}
 ${searchShellHtml}
-  <div class="doc-body">
+    </aside>
+    <div class="doc-content">
   ${toc}<main id="main">
 ${bodyHtml}
 ${playgroundShellHtml}
   </main>
+    </div>
   </div>
 ${hostChrome.footer}
   </div>

package/dist/document-designs.js

@@ -64,12 +64,17 @@ function emitMinimalDesignsCss(designsDir) {
     const vars = {};
     const tokenDir = path.join(designsDir, 'tokens');
     if (fs.existsSync(tokenDir)) {
-        walkJson(tokenDir, (obj, prefix) => flattenTokens(obj, prefix, vars));
+        walkJson(tokenDir, (obj, prefix) => {
+            collectStyleThemeEntries(obj, vars);
+            flattenTokens(obj, prefix, vars);
+        });
     }
     const themeJson = path.join(designsDir, 'theme.json');
     if (fs.existsSync(themeJson)) {
         try {
-            flattenTokens(JSON.parse(fs.readFileSync(themeJson, 'utf8')), '', vars);
+            const theme = JSON.parse(fs.readFileSync(themeJson, 'utf8'));
+            collectStyleThemeEntries(theme, vars);
+            flattenTokens(theme, '', vars);
         }
         catch {
             /* ignore */
@@ -89,10 +94,33 @@ function cssVar(key) {
         .replace(/^-|-$/g, '');
     return `--${name}`;
 }
+/**
+ * Style Theme entries (`key.path` + `value`) → `vmz-*` CSS vars (same naming as application compile).
+ * @param {unknown} obj
+ * @param {Record<string, string>} out
+ */
+function collectStyleThemeEntries(obj, out) {
+    if (obj == null || typeof obj !== 'object' || Array.isArray(obj))
+        return;
+    const entries = /** @type {{ key?: { path?: unknown }, value?: unknown }[]} */ ( /** @type {{ entries?: unknown }} */(obj).entries);
+    if (!Array.isArray(entries))
+        return;
+    for (const e of entries) {
+        const pathParts = e?.key?.path;
+        if (!Array.isArray(pathParts) || pathParts.length === 0)
+            continue;
+        if (typeof e.value !== 'string' && typeof e.value !== 'number')
+            continue;
+        const dotted = pathParts.map(String).join('-');
+        out[`vmz-${dotted}`] = String(e.value);
+    }
+}
 function flattenTokens(obj, prefix, out) {
     if (obj == null || typeof obj !== 'object' || Array.isArray(obj))
         return;
     for (const [k, v] of Object.entries(obj)) {
+        if (k === 'entries')
+            continue;
         const key = prefix ? `${prefix}-${k}` : k;
         if (v != null && typeof v === 'object' && !Array.isArray(v)) {
             if ('value' in v && (typeof v.value === 'string' || typeof v.value === 'number')) {

package/dist/document-enrich.js

@@ -199,6 +199,14 @@ function resolveDocHref(href, fromPageKey, locale, routeBase, pageKeySet) {
     pk = normalizePageKey(pk);
     const keys = pageKeySet.get(locale) || new Set();
     if (!keys.has(pk)) {
+        // A directory index and a leaf page share the same normalized PageKey shape.
+        // Prefer the regular sibling resolution above, then retry relative to the
+        // PageKey itself so `guide/optimizations/index.md` keeps its directory.
+        const indexJoined = path.posix.normalize(path.posix.join(fromPageKey || '.', pathPart));
+        const indexPk = normalizePageKey(indexJoined.replace(/^\.\//, ''));
+        if (keys.has(indexPk)) {
+            return { ok: true, locale, pageKey: indexPk, anchor, anchors: [] };
+        }
         return { ok: false, reason: `no PageKey ${pk} in ${locale}` };
     }
     return { ok: true, locale, pageKey: pk, anchor, anchors: [] };

package/dist/embedded-packaging.d.ts

@@ -0,0 +1,22 @@
+/**
+ * rust-embedded packaging adapter: resource index + baseline closure.
+ * Packaging only — does not invent route / MIME / fallback semantics.
+ */
+export declare const EMBEDDED_RESOURCE_INDEX_SCHEMA = "vmz.embedded.resource_index.v0";
+/**
+ * Walk outDir and build path → digest → relative blob path map.
+ * Copies files into `dist/_vmz/embedded-baseline/` (whole release, no file-level mix).
+ * @param {string} outDir
+ * @param {{ siteId?: string, contractDigest?: string | null }} [opts]
+ */
+export declare function emitEmbeddedPackaging(outDir: any, opts?: {}): {
+    index: {
+        schema: string;
+        siteId: any;
+        contractDigest: any;
+        objectCount: number;
+        objects: any[];
+    };
+    indexPath: string;
+    baselineDir: string;
+};

package/dist/embedded-packaging.js

@@ -0,0 +1,113 @@
+/**
+ * rust-embedded packaging adapter: resource index + baseline closure.
+ * Packaging only — does not invent route / MIME / fallback semantics.
+ */
+// @ts-nocheck
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+export const EMBEDDED_RESOURCE_INDEX_SCHEMA = 'vmz.embedded.resource_index.v0';
+/** Paths that must never enter the embedded baseline closure. */
+const SKIP_NAMES = new Set([
+    'vmz-serve-host.mjs',
+    'vmz-serve-host.js',
+    'node_modules',
+    '.git',
+]);
+/**
+ * Walk outDir and build path → digest → relative blob path map.
+ * Copies files into `dist/_vmz/embedded-baseline/` (whole release, no file-level mix).
+ * @param {string} outDir
+ * @param {{ siteId?: string, contractDigest?: string | null }} [opts]
+ */
+export function emitEmbeddedPackaging(outDir, opts = {}) {
+    const vmzDir = path.join(outDir, '_vmz');
+    const baselineDir = path.join(vmzDir, 'embedded-baseline');
+    fs.mkdirSync(baselineDir, { recursive: true });
+    /** @type {Array<{ path: string, digest: string, blob: string, bytes: number }>} */
+    const objects = [];
+    const root = path.resolve(outDir);
+    walkFiles(root, (abs) => {
+        const rel = toPosix(path.relative(root, abs));
+        if (!rel || rel.startsWith('_vmz/embedded-baseline'))
+            return;
+        if (rel.startsWith('_vmz/embedded-resource-index'))
+            return;
+        const base = path.basename(abs);
+        if (SKIP_NAMES.has(base))
+            return;
+        // Keep other _vmz manifests inside baseline (contract, capability table, etc.)
+        const buf = fs.readFileSync(abs);
+        const digest = sha256Hex(buf);
+        const blobRel = `objects/${digest.slice(0, 2)}/${digest}`;
+        const blobAbs = path.join(baselineDir, blobRel);
+        fs.mkdirSync(path.dirname(blobAbs), { recursive: true });
+        if (!fs.existsSync(blobAbs))
+            fs.writeFileSync(blobAbs, buf);
+        // Also mirror tree under baseline/tree for host convenience
+        const treeAbs = path.join(baselineDir, 'tree', rel);
+        fs.mkdirSync(path.dirname(treeAbs), { recursive: true });
+        fs.copyFileSync(abs, treeAbs);
+        objects.push({ path: rel, digest, blob: blobRel, bytes: buf.length });
+    });
+    objects.sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0));
+    const index = {
+        schema: EMBEDDED_RESOURCE_INDEX_SCHEMA,
+        siteId: opts.siteId || null,
+        contractDigest: opts.contractDigest || null,
+        objectCount: objects.length,
+        objects,
+    };
+    index.indexDigest = sha256Hex(canonicalJson({ ...index, indexDigest: undefined }));
+    const indexPath = path.join(vmzDir, 'embedded-resource-index.json');
+    fs.writeFileSync(indexPath, `${JSON.stringify(index, null, 2)}\n`, 'utf8');
+    // Optional include_bytes entry point for Rust packaging adapters
+    const rsPath = path.join(vmzDir, 'embedded_site.rs');
+    fs.writeFileSync(rsPath, `// @generated by vmz — rust-embedded packaging adapter (do not edit)
+// Index digest: ${index.indexDigest}
+pub const EMBEDDED_RESOURCE_INDEX: &str = include_str!("embedded-resource-index.json");
+`, 'utf8');
+    return { index, indexPath, baselineDir };
+}
+/**
+ * @param {string} dir
+ * @param {(abs: string) => void} onFile
+ */
+function walkFiles(dir, onFile) {
+    if (!fs.existsSync(dir))
+        return;
+    for (const name of fs.readdirSync(dir)) {
+        if (SKIP_NAMES.has(name))
+            continue;
+        const abs = path.join(dir, name);
+        const st = fs.statSync(abs);
+        if (st.isDirectory()) {
+            if (name === 'embedded-baseline' && path.basename(path.dirname(abs)) === '_vmz')
+                continue;
+            walkFiles(abs, onFile);
+        }
+        else if (st.isFile()) {
+            onFile(abs);
+        }
+    }
+}
+function toPosix(p) {
+    return p.split(path.sep).join('/');
+}
+function sha256Hex(data) {
+    return crypto.createHash('sha256').update(data).digest('hex');
+}
+function canonicalJson(value) {
+    return JSON.stringify(sortKeys(value));
+}
+function sortKeys(value) {
+    if (Array.isArray(value))
+        return value.map(sortKeys);
+    if (value && typeof value === 'object') {
+        const out = {};
+        for (const k of Object.keys(value).sort())
+            out[k] = sortKeys(value[k]);
+        return out;
+    }
+    return value;
+}