@vmz/vmz 0.0.4 → 0.1.0

package/dist/build-assemble.d.ts

@@ -0,0 +1,52 @@
+/**
+ * B5 Assemble dispatch + B6 build-proof (per-build semantic id slots).
+ */
+export declare const BUILD_PROOF_SCHEMA = "vmz.build.proof.v0";
+export declare const ASSEMBLE_MANIFEST_SCHEMA = "vmz.assemble.manifest.v0";
+/**
+ * @param {string} outDir
+ * @param {any} ctx
+ */
+export declare function assembleDelivery(outDir: any, ctx: any): Promise<{
+    manifest: {
+        schema: string;
+        profileId: any;
+        assembly: any;
+        serverRuntime: any;
+        steps: any[];
+    };
+    path: string;
+}>;
+/**
+ * @param {string} outDir
+ * @param {any} ctx
+ */
+export declare function emitBuildProof(outDir: any, ctx: any): {
+    proof: {
+        schema: string;
+        profileId: any;
+        assembly: any;
+        selectionDigest: any;
+        packDigest: any;
+        assembleDigest: any;
+        release: boolean;
+        semanticIds: string[];
+        slots: {
+            'server-host': {
+                status: string;
+            };
+            'static-delivery': {
+                status: string;
+            };
+            'site-fallback': {
+                status: string;
+            };
+            'asset-graph': {
+                status: string;
+            };
+        };
+        productionReadyClaim: boolean;
+        note: string;
+    };
+    path: string;
+};

package/dist/build-assemble.js

@@ -0,0 +1,191 @@
+/**
+ * B5 Assemble dispatch + B6 build-proof (per-build semantic id slots).
+ */
+// @ts-nocheck
+import { mkdirSync, writeFileSync } from 'node:fs';
+import path from 'node:path';
+import { semanticIdsForAssembly, sha256Hex, canonicalJson } from './delivery-profile.js';
+import { emitServerArtifact } from './server-artifact.js';
+import { emitEmbeddedPackaging } from './embedded-packaging.js';
+import { emitSiteDelivery } from './site-delivery.js';
+import { emitWebStatic } from './static-emit.js';
+export const BUILD_PROOF_SCHEMA = 'vmz.build.proof.v0';
+export const ASSEMBLE_MANIFEST_SCHEMA = 'vmz.assemble.manifest.v0';
+/**
+ * @param {string} outDir
+ * @param {any} ctx
+ */
+export async function assembleDelivery(outDir, ctx) {
+    const { selection, profile } = ctx;
+    const assembly = selection.assembly;
+    const result = {
+        schema: ASSEMBLE_MANIFEST_SCHEMA,
+        profileId: selection.profileId,
+        assembly,
+        serverRuntime: selection.serverRuntime || null,
+        steps: [],
+    };
+    if (assembly === 'static-cdn' || assembly === 'cdn+server') {
+        const staticResult = await emitWebStatic(outDir, { origin: ctx.origin });
+        result.steps.push({
+            kind: 'static-cdn',
+            digest: staticResult.digest,
+            htmlFiles: staticResult.htmlFiles?.length ?? 0,
+            skipped: staticResult.skipped?.length ?? 0,
+        });
+        result.staticDelivery = {
+            digest: staticResult.digest,
+            htmlFiles: staticResult.htmlFiles,
+            skipped: staticResult.skipped,
+        };
+    }
+    if (assembly === 'local-static') {
+        result.steps.push({
+            kind: 'local-static',
+            status: 'modules-ready',
+            note: 'client modules packed; no ServerArtifact',
+        });
+    }
+    if (assembly === 'server-host' || assembly === 'cdn+server') {
+        const server = emitServerArtifact(outDir, {
+            profileId: selection.profileId,
+            assembly,
+            serverRuntime: selection.serverRuntime || 'node',
+            packDigest: ctx.pack?.packDigest || null,
+        });
+        result.steps.push({
+            kind: 'server-host',
+            status: 'emitted',
+            digest: server.artifact.artifactDigest,
+            publicRoutes: server.artifact.publicRoutes?.length ?? 0,
+            internalCapabilities: server.artifact.internalCapabilities?.length ?? 0,
+            httpContractDigest: server.httpContractDigest,
+        });
+        result.serverArtifact = {
+            digest: server.artifact.artifactDigest,
+            httpContractDigest: server.httpContractDigest,
+            schema: server.artifact.schema,
+            selectedRuntime: server.artifact.selectedRuntime,
+        };
+    }
+    const siteAuthoring = profile.sources || null;
+    if (siteAuthoring || assembly === 'rust-embedded') {
+        if (!siteAuthoring) {
+            throw new Error('rust-embedded requires delivery sources (SiteDeliveryContract); cannot assemble without embedded|filesystem|remote baselines');
+        }
+        const site = emitSiteDelivery(outDir, siteAuthoring, {
+            siteId: ctx.siteId,
+        });
+        result.steps.push({
+            kind: 'site-delivery',
+            digest: site.contract.contractDigest,
+        });
+        result.siteDelivery = {
+            digest: site.contract.contractDigest,
+            schema: site.contract.schema,
+        };
+        if (assembly === 'rust-embedded') {
+            const pack = emitEmbeddedPackaging(outDir, {
+                siteId: ctx.siteId,
+                contractDigest: site.contract.contractDigest,
+            });
+            result.steps.push({
+                kind: 'embedded-packaging',
+                digest: pack.index.indexDigest,
+                objectCount: pack.index.objectCount,
+            });
+            result.embeddedPackaging = {
+                digest: pack.index.indexDigest,
+                objectCount: pack.index.objectCount,
+                schema: pack.index.schema,
+            };
+        }
+    }
+    result.packDigest = ctx.pack?.packDigest || null;
+    result.assembleDigest = sha256Hex(canonicalJson({ ...result, assembleDigest: undefined }));
+    const vmzDir = path.join(outDir, '_vmz');
+    mkdirSync(vmzDir, { recursive: true });
+    const file = path.join(vmzDir, 'assemble-manifest.json');
+    writeFileSync(file, `${JSON.stringify(result, null, 2)}\n`, 'utf8');
+    return { manifest: result, path: file };
+}
+/**
+ * @param {string} outDir
+ * @param {any} ctx
+ */
+export function emitBuildProof(outDir, ctx) {
+    const semanticIds = semanticIdsForAssembly(ctx.selection.assembly);
+    const slots = {
+        'server-host': { status: 'not-applicable' },
+        'static-delivery': { status: 'not-applicable' },
+        'site-fallback': { status: 'not-applicable' },
+        'asset-graph': { status: 'not-applicable' },
+    };
+    for (const id of semanticIds) {
+        if (id === 'static-delivery') {
+            const step = (ctx.assemble?.steps || []).find((s) => s.kind === 'static-cdn');
+            slots[id] = step
+                ? { status: 'emitted', detail: `digest=${String(step.digest).slice(0, 12)}` }
+                : { status: 'pending', detail: 'assembly requires static emit' };
+        }
+        else if (id === 'site-fallback') {
+            const siteStep = (ctx.assemble?.steps || []).find((s) => s.kind === 'site-delivery');
+            const packStep = (ctx.assemble?.steps || []).find((s) => s.kind === 'embedded-packaging');
+            if (siteStep && packStep) {
+                slots[id] = {
+                    status: 'emitted',
+                    detail: `contract=${String(siteStep.digest).slice(0, 12)}; pack=${String(packStep.digest).slice(0, 12)}; objects=${packStep.objectCount ?? '?'}`,
+                };
+            }
+            else if (siteStep && siteStep.status !== 'skipped') {
+                slots[id] = {
+                    status: 'pending',
+                    detail: 'site contract emitted; embedded packaging missing',
+                };
+            }
+            else {
+                slots[id] = { status: 'pending', detail: siteStep?.reason || 'no site sources' };
+            }
+        }
+        else if (id === 'server-host') {
+            const step = (ctx.assemble?.steps || []).find((s) => s.kind === 'server-host');
+            slots[id] =
+                step && step.status === 'emitted'
+                    ? {
+                        status: 'emitted',
+                        detail: `digest=${String(step.digest).slice(0, 12)}; routes=${step.publicRoutes ?? 0}; internal=${step.internalCapabilities ?? 0}`,
+                    }
+                    : {
+                        status: 'pending',
+                        detail: step?.note || 'ServerArtifact not emitted',
+                    };
+        }
+        else if (id === 'asset-graph') {
+            slots[id] = {
+                status: ctx.pack?.packDigest ? 'pack-digest' : 'pending',
+                detail: ctx.pack?.packDigest
+                    ? `pack=${String(ctx.pack.packDigest).slice(0, 12)} units=${ctx.pack.unitCount ?? '?'}`
+                    : 'pack missing',
+            };
+        }
+    }
+    const body = {
+        schema: BUILD_PROOF_SCHEMA,
+        profileId: ctx.selection.profileId,
+        assembly: ctx.selection.assembly,
+        selectionDigest: ctx.selection.digest || null,
+        packDigest: ctx.pack?.packDigest || null,
+        assembleDigest: ctx.assemble?.assembleDigest || null,
+        release: Boolean(ctx.release),
+        semanticIds,
+        slots,
+        productionReadyClaim: false,
+        note: 'Aggregate production-ready requires browser-production + cleared production-proof gaps (08)',
+    };
+    body.proofDigest = sha256Hex(canonicalJson({ ...body, proofDigest: undefined }));
+    const vmzDir = path.join(outDir, '_vmz');
+    mkdirSync(vmzDir, { recursive: true });
+    const file = path.join(vmzDir, 'build-proof.json');
+    writeFileSync(file, `${JSON.stringify(body, null, 2)}\n`, 'utf8');
+    return { proof: body, path: file };
+}

package/dist/cdn-policy.d.ts

@@ -9,9 +9,13 @@ export declare const CACHE_HTML = "public, max-age=0, must-revalidate";
 export declare const CACHE_ASSET_IMMUTABLE = "public, max-age=31536000, immutable";
 export declare const CACHE_META = "public, max-age=3600";
 /**
- * Build CDNPolicyManifest from StaticDeliveryManifest (+ optional redirects).
+ * Build CDNPolicyManifest from StaticDeliveryManifest (+ optional redirects / locale artifact).
+ * Locale-prefixed HTML gets LocaleId-encoded cache keys; Accept-Language must not steal body.
  * @param {Record<string, any>} staticManifest
- * @param {{ redirects?: Array<{ from: string, to: string, status?: number, reason?: string }> }} [opts]
+ * @param {{
+ *   redirects?: Array<{ from: string, to: string, status?: number, reason?: string }>,
+ *   localeArtifact?: Record<string, any> | null,
+ * }} [opts]
  */
 export declare function buildCdnPolicyManifest(staticManifest: any, opts?: {}): {
     schema: string;
@@ -35,7 +39,14 @@ export declare function buildCdnPolicyManifest(staticManifest: any, opts?: {}):
         };
     })[];
     errorDocuments: any;
-    routes: any;
+    routes: any[];
+    localeCache: {
+        strategy: string;
+        varyAcceptLanguage: boolean;
+        defaultLocale: any;
+        routeCount: number;
+        locales: any[];
+    };
 };
 /**
  * Write CDN policy + adapter projections under dist/_vmz.
@@ -66,7 +77,14 @@ export declare function emitCdnPolicy(distDir: any, staticManifest: any, opts?:
             };
         })[];
         errorDocuments: any;
-        routes: any;
+        routes: any[];
+        localeCache: {
+            strategy: string;
+            varyAcceptLanguage: boolean;
+            defaultLocale: any;
+            routeCount: number;
+            locales: any[];
+        };
     };
     adapters: {
         'local-static': {

package/dist/cdn-policy.js

@@ -7,6 +7,7 @@ import crypto from 'node:crypto';
 import fs from 'node:fs';
 import http from 'node:http';
 import path from 'node:path';
+import { assertLocaleCacheKey, localeAwareCacheKey } from './locale-router.js';
 export const CDN_POLICY_MANIFEST_SCHEMA = 'vmz.cdn.policy_manifest.v0';
 export const CDN_ADAPTER_PROJECTION_SCHEMA = 'vmz.cdn.adapter_projection.v0';
 /** HTML: revalidate. Hashed/static assets: long immutable. */
@@ -14,13 +15,23 @@ export const CACHE_HTML = 'public, max-age=0, must-revalidate';
 export const CACHE_ASSET_IMMUTABLE = 'public, max-age=31536000, immutable';
 export const CACHE_META = 'public, max-age=3600';
 /**
- * Build CDNPolicyManifest from StaticDeliveryManifest (+ optional redirects).
+ * Build CDNPolicyManifest from StaticDeliveryManifest (+ optional redirects / locale artifact).
+ * Locale-prefixed HTML gets LocaleId-encoded cache keys; Accept-Language must not steal body.
  * @param {Record<string, any>} staticManifest
- * @param {{ redirects?: Array<{ from: string, to: string, status?: number, reason?: string }> }} [opts]
+ * @param {{
+ *   redirects?: Array<{ from: string, to: string, status?: number, reason?: string }>,
+ *   localeArtifact?: Record<string, any> | null,
+ * }} [opts]
  */
 export function buildCdnPolicyManifest(staticManifest, opts = {}) {
     const origin = String(staticManifest.origin || '');
-    const redirects = [{ from: '/home', to: '/', status: 301, reason: 'canonical-alias' }, ...(opts.redirects || [])];
+    const localeArt = opts.localeArtifact || null;
+    const localeRedirects = buildOmitPrefixRedirects(staticManifest, localeArt);
+    const redirects = [
+        { from: '/home', to: '/', status: 301, reason: 'canonical-alias' },
+        ...localeRedirects,
+        ...(opts.redirects || []),
+    ];
     const headers = [
         { match: '**/*.html', headers: { 'cache-control': CACHE_HTML } },
         {
@@ -34,6 +45,47 @@ export function buildCdnPolicyManifest(staticManifest, opts = {}) {
         { match: '**/robots.txt', headers: { 'cache-control': CACHE_META } },
     ];
     const errorDocuments = Array.isArray(staticManifest.errorDocuments) ? staticManifest.errorDocuments : [{ status: 404, path: '404.html' }];
+    /** @type {any[]} */
+    const routes = [];
+    /** @type {any[]} */
+    const cacheKeyDiagnostics = [];
+    for (const r of staticManifest.routes || []) {
+        const localeId = r.localeId || null;
+        const alternates = Array.isArray(r.seo?.alternates) ? r.seo.alternates : [];
+        const cacheKey = localeId
+            ? localeAwareCacheKey({ routeId: String(r.routeId), localeId: String(localeId), path: String(r.path) })
+            : `route=${r.routeId}|path=${r.path}`;
+        // When LocaleId is bound, prove the key would still be safe even if Vary: Accept-Language were set.
+        if (localeId) {
+            const assert = assertLocaleCacheKey({
+                cacheKey,
+                varyAcceptLanguage: true,
+                localeId: String(localeId),
+            });
+            if (!assert.ok) {
+                cacheKeyDiagnostics.push(...(assert.diagnostics || []));
+            }
+        }
+        routes.push({
+            routeId: r.routeId,
+            path: r.path,
+            htmlPath: r.htmlPath,
+            canonical: r.seo?.canonical || null,
+            localeId,
+            cacheKey,
+            varyAcceptLanguage: false,
+            hreflang: alternates.map((a) => ({
+                hreflang: a.hreflang,
+                href: a.href,
+                localeId: a.localeId || null,
+            })),
+        });
+    }
+    if (cacheKeyDiagnostics.length) {
+        const msg = cacheKeyDiagnostics.map((d) => d.message || d.code).join('; ');
+        throw new Error(`buildCdnPolicyManifest: locale cache key contract failed: ${msg}`);
+    }
+    const localeRoutes = routes.filter((r) => r.localeId);
     const body = {
         schema: CDN_POLICY_MANIFEST_SCHEMA,
         applicationId: staticManifest.applicationId || null,
@@ -44,16 +96,48 @@ export function buildCdnPolicyManifest(staticManifest, opts = {}) {
         redirects,
         headers,
         errorDocuments,
-        routes: (staticManifest.routes || []).map((r) => ({
-            routeId: r.routeId,
-            path: r.path,
-            htmlPath: r.htmlPath,
-            canonical: r.seo?.canonical || null,
-        })),
+        routes,
+        localeCache: {
+            strategy: 'path-locale',
+            varyAcceptLanguage: false,
+            defaultLocale: localeArt?.defaultLocale || null,
+            routeCount: localeRoutes.length,
+            locales: [...new Set(localeRoutes.map((r) => r.localeId))],
+        },
     };
     body.policyDigest = sha256Hex(canonicalJson(body));
     return body;
 }
+/**
+ * Omit-prefix: /{defaultLocale}/… → canonical unprefixed path (CDN redirect, not Accept-Language).
+ * @param {Record<string, any>} staticManifest
+ * @param {Record<string, any> | null} localeArt
+ */
+function buildOmitPrefixRedirects(staticManifest, localeArt) {
+    const routing = localeArt?.routing || {};
+    const defaultLocale = localeArt?.defaultLocale || routing.defaultLocale;
+    if (!defaultLocale || routing.defaultPrefix !== 'omit')
+        return [];
+    /** @type {Array<{ from: string, to: string, status: number, reason: string }>} */
+    const out = [];
+    const seen = new Set();
+    for (const r of staticManifest.routes || []) {
+        if (r.localeId !== defaultLocale)
+            continue;
+        const canonical = String(r.path || '/');
+        const from = canonical === '/' ? `/${defaultLocale}` : `/${defaultLocale}${canonical.startsWith('/') ? canonical : `/${canonical}`}`;
+        if (seen.has(from))
+            continue;
+        seen.add(from);
+        out.push({
+            from,
+            to: canonical,
+            status: 301,
+            reason: 'locale-omit-prefix-default',
+        });
+    }
+    return out;
+}
 /**
  * Write CDN policy + adapter projections under dist/_vmz.
  * @param {string} distDir
@@ -61,7 +145,8 @@ export function buildCdnPolicyManifest(staticManifest, opts = {}) {
  * @param {{ redirects?: Array<{ from: string, to: string, status?: number, reason?: string }> }} [opts]
  */
 export function emitCdnPolicy(distDir, staticManifest, opts = {}) {
-    const policy = buildCdnPolicyManifest(staticManifest, opts);
+    const localeArtifact = loadLocaleArtifact(distDir);
+    const policy = buildCdnPolicyManifest(staticManifest, { ...opts, localeArtifact });
     const vmzDir = path.join(distDir, '_vmz');
     fs.mkdirSync(vmzDir, { recursive: true });
     fs.writeFileSync(path.join(vmzDir, 'cdn-policy-manifest.json'), `${JSON.stringify(policy, null, 2)}\n`, 'utf8');
@@ -76,6 +161,20 @@ export function emitCdnPolicy(distDir, staticManifest, opts = {}) {
     fs.writeFileSync(path.join(adaptersDir, 'netlify', '_redirects'), String(netlify.files['_redirects'] || ''), 'utf8');
     return { policy, adapters: { 'local-static': local, netlify } };
 }
+/**
+ * @param {string} distDir
+ */
+function loadLocaleArtifact(distDir) {
+    const p = path.join(distDir, '_vmz', 'locale-route-realization.json');
+    if (!fs.existsSync(p))
+        return null;
+    try {
+        return JSON.parse(fs.readFileSync(p, 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * Project vendor-neutral policy to an adapter. Must preserve redirect targets and forbid SPA fallback.
  * @param {Record<string, any>} policy

package/dist/cli.js

@@ -16,14 +16,16 @@ import { cmdDocument } from './document-cmd.js';
 import { buildIntegratedDocuments, projectHasDocuments } from './document-integrate.js';
 import { cmdLocale } from './locale-cmd.js';
 import { emitLocaleRuntimeModules, localeHasErrors } from './locale-check.js';
+import { emitLocaleRouteRealization } from './locale-route-emit.js';
 import { cmdApplication } from './application-cmd.js';
 import { cmdArtifact } from './release-cmd.js';
 import { cmdRefactor } from './refactor-cmd.js';
 import { cmdExplain } from './explain-cmd.js';
 import { resolveNativeVmzCli } from './resolve-native-cli.js';
-import { emitWebStatic } from './static-emit.js';
-import { emitSiteDelivery } from './site-delivery.js';
 import { loadVmzConfig } from './plugin-host.js';
+import { normalizeDeliveryAuthoring, selectBuildProfile } from './delivery-profile.js';
+import { packFromDeploymentIr } from './pack.js';
+import { assembleDelivery, emitBuildProof } from './build-assemble.js';
 /**
  * @param {string[]} argv
  */
@@ -120,9 +122,9 @@ Usage:
 
 Options:
   --out-dir, -o <dir>   Output directory (default: dist)
-  --release             Release build (build only)
-  --profile <name>      Delivery profile after build (web-static)
-  --origin <url>        Site origin for web-static canonical/sitemap
+  --release             Release build (omit serve-host; pack minify slot; proof)
+  --profile <name>      Delivery profile (default from config; builtins: web-ssr|web-static|web-client|web-hybrid)
+  --origin <url>        Site origin for static-cdn canonical/sitemap
   --host <host>         Listen host (default: 127.0.0.1)
   --port <port>         Listen port (dev: omit = auto from 5173; set = lock)
   --poll-ms <ms>        Dev watch poll interval (default: 300)
@@ -281,7 +283,11 @@ function cmdCheck(args) {
     try {
         return runWithPlugins(ws, project, outDir, async () => {
             const report = ws.check();
-            const errors = log.diagnostics(report.diagnostics ?? []);
+            const { checkLocales, localeHasErrors } = await import('./locale-check.js');
+            const localeReport = checkLocales({ projectRoot: project, checkUnused: false });
+            // Locale policy is first-class: missing /locales is warning (not silent), hard errors still fail.
+            const errors = log.diagnostics([...(report.diagnostics ?? []), ...(localeReport.diagnostics ?? [])]) ||
+                (localeHasErrors(localeReport) ? 1 : 0);
             log.info(`checked ${report.filesChecked} file(s)`);
             return errors ? 1 : 0;
         });
@@ -290,6 +296,23 @@ function cmdCheck(args) {
         ws.dispose();
     }
 }
+/**
+ * Dedupe locale/build diagnostics by code+path+message (runtime + route emit both report missing manifest).
+ * @param {Array<{ code?: string, path?: string, message?: string, severity?: string }>} list
+ */
+function dedupeDiagnostics(list) {
+    const seen = new Set();
+    /** @type {typeof list} */
+    const out = [];
+    for (const d of list || []) {
+        const key = `${d.code || ''}\0${d.path || ''}\0${d.message || ''}\0${d.severity || ''}`;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        out.push(d);
+    }
+    return out;
+}
 /**
  * @param {import('./index.js').Workspace} ws
  * @param {string} project
@@ -316,6 +339,21 @@ async function cmdBuild(args) {
     log.info(`build ${project} → ${outDir}`);
     const ws = createWorkspace({ root: project, outDir });
     try {
+        const cfg = await loadVmzConfig(project);
+        const cliProfile = typeof args.profile === 'string' ? args.profile : '';
+        const norm = normalizeDeliveryAuthoring(cfg.delivery ?? null);
+        if (!norm.ok) {
+            log.diagnostics(norm.diagnostics ?? []);
+            log.error('delivery authoring invalid');
+            return 1;
+        }
+        const selected = selectBuildProfile(norm.table, cliProfile);
+        if (!selected.ok) {
+            log.diagnostics(selected.diagnostics ?? []);
+            log.error(`unknown build --profile ${cliProfile || norm.table.default}`);
+            return 1;
+        }
+        log.info(`delivery profile ${selected.selection.profileId} (assembly=${selected.selection.assembly})`);
         const code = await runWithPlugins(ws, project, outDir, () => {
             const report = ws.build(Boolean(args.release));
             const errors = log.diagnostics(report.diagnostics ?? []);
@@ -330,47 +368,91 @@ async function cmdBuild(args) {
         if (code !== 0)
             return code;
         const localeEmit = emitLocaleRuntimeModules(project, outDir);
+        const localeRoutes = emitLocaleRouteRealization(project, outDir, {
+            origin: typeof args.origin === 'string' ? args.origin : undefined,
+        });
+        // Always surface locale diagnostics (warnings included) — missing /locales must not be silent.
+        // Dedupe: runtime emit + route realization both report the same missing-manifest warning.
+        const localeDiags = dedupeDiagnostics([
+            ...(localeEmit.diagnostics ?? []),
+            ...(localeRoutes.diagnostics ?? []),
+        ]);
+        log.diagnostics(localeDiags);
         if (!localeEmit.ok || localeHasErrors({ diagnostics: localeEmit.diagnostics })) {
-            log.diagnostics(localeEmit.diagnostics ?? []);
             log.error('locale runtime emit failed');
             return 1;
         }
         if (localeEmit.written.length) {
             log.info(`locale runtime emit (${localeEmit.written.length} module(s))`);
         }
+        if (!localeRoutes.ok) {
+            log.error('locale route realization emit failed');
+            return 1;
+        }
+        if (localeRoutes.written.length) {
+            log.info(`locale route realization (${localeRoutes.written.length} artifact(s))`);
+        }
         if (projectHasDocuments(project)) {
             const docs = await buildIntegratedDocuments({ projectRoot: project, outDir });
             if (!docs.ok)
                 return 1;
         }
-        const cfg = await loadVmzConfig(project);
-        if (cfg.delivery) {
-            log.info(`site-delivery emit ${outDir}`);
-            const site = emitSiteDelivery(outDir, cfg.delivery, {
-                siteId: cfg.application?.id || undefined,
+        let pack = null;
+        try {
+            pack = packFromDeploymentIr(outDir, {
+                release: Boolean(args.release),
+                profileId: selected.selection.profileId,
+                assembly: selected.selection.assembly,
+                coreDist: resolveCoreRuntimeDist(),
             });
-            log.info(`site-delivery ok (digest=${String(site.contract.contractDigest).slice(0, 12)}…)`);
+            log.info(`pack ok (units=${pack.manifest.unitCount}, digest=${String(pack.manifest.packDigest).slice(0, 12)}…)`);
         }
-        const profile = typeof args.profile === 'string' ? args.profile : '';
-        if (profile === 'web-static') {
-            const origin = typeof args.origin === 'string' ? args.origin : undefined;
-            log.info(`web-static emit ${outDir}`);
-            const result = await emitWebStatic(outDir, { origin });
-            log.info(`web-static ok (${result.htmlFiles.length} html, ${result.skipped.length} skipped, digest=${result.digest.slice(0, 12)}…)`);
+        catch (err) {
+            log.error(`pack failed: ${err instanceof Error ? err.message : String(err)}`);
+            return 1;
+        }
+        const origin = typeof args.origin === 'string' ? args.origin : undefined;
+        let assemble = null;
+        try {
+            if (selected.selection.assembly === 'static-cdn') {
+                log.info(`web-static emit ${outDir}`);
+            }
+            assemble = await assembleDelivery(outDir, {
+                selection: selected.selection,
+                profile: {
+                    ...selected.profile,
+                    sources: selected.profile.sources || (norm.table.sugar ? norm.table.profiles[norm.table.default]?.sources : null),
+                },
+                siteId: cfg.application?.id || undefined,
+                origin,
+                pack: pack.manifest,
+            });
+            for (const step of assemble.manifest.steps || []) {
+                if (step.kind === 'static-cdn') {
+                    log.info(`web-static ok (${step.htmlFiles} html, ${step.skipped} skipped, digest=${String(step.digest).slice(0, 12)}…)`);
+                }
+                else if (step.kind === 'site-delivery' && step.digest) {
+                    log.info(`site-delivery ok (digest=${String(step.digest).slice(0, 12)}…)`);
+                }
+            }
         }
-        else if (profile) {
-            log.error(`unknown build --profile ${profile} (supported: web-static)`);
+        catch (err) {
+            log.error(`assemble failed: ${err instanceof Error ? err.message : String(err)}`);
             return 1;
         }
+        const proof = emitBuildProof(outDir, {
+            selection: selected.selection,
+            pack: pack.manifest,
+            assemble: assemble.manifest,
+            release: Boolean(args.release),
+        });
+        log.info(`build-proof ok (profile=${proof.proof.profileId}, slots=${proof.proof.semanticIds.join(',')})`);
         return 0;
     }
     finally {
         ws.dispose();
     }
 }
-/**
- * @param {Record<string, string | boolean> & { _: string[] }} args
- */
 async function cmdServe(args) {
     const pathArg = args._[0] ?? '.';
     if (args.build) {