@vmz/vmz 0.1.13 → 0.1.14

package/dist/build-assemble.js

@@ -2,13 +2,16 @@
  * B5 Assemble dispatch + B6 build-proof (per-build semantic id slots).
  */
 // @ts-nocheck
-import { mkdirSync, writeFileSync } from 'node:fs';
+import { mkdirSync } from 'node:fs';
 import path from 'node:path';
 import { semanticIdsForAssembly, sha256Hex, canonicalJson } from './delivery-profile.js';
 import { emitServerArtifact } from './server-artifact.js';
 import { emitEmbeddedPackaging } from './embedded-packaging.js';
 import { emitSiteDelivery } from './site-delivery.js';
+import { emitSiteFavicon } from './site-favicon.js';
+import { emitPublicStaticAssets } from './public-static-assets.js';
 import { emitWebStatic } from './static-emit.js';
+import { writePrettyJsonFile } from './pretty-json.js';
 export const BUILD_PROOF_SCHEMA = 'vmz.build.proof.v0';
 export const ASSEMBLE_MANIFEST_SCHEMA = 'vmz.assemble.manifest.v0';
 /**
@@ -25,10 +28,13 @@ export async function assembleDelivery(outDir, ctx) {
         serverRuntime: selection.serverRuntime || null,
         steps: [],
     };
-    if (assembly === 'static-cdn' || assembly === 'cdn+server') {
-        const staticResult = await emitWebStatic(outDir, { origin: ctx.origin });
+    if (assembly === 'web-static' || assembly === 'cdn+server') {
+        const staticResult = await emitWebStatic(outDir, {
+            origin: ctx.origin,
+            projectRoot: ctx.projectRoot,
+        });
         result.steps.push({
-            kind: 'static-cdn',
+            kind: 'web-static',
             digest: staticResult.digest,
             htmlFiles: staticResult.htmlFiles?.length ?? 0,
             skipped: staticResult.skipped?.length ?? 0,
@@ -39,6 +45,11 @@ export async function assembleDelivery(outDir, ctx) {
             skipped: staticResult.skipped,
         };
     }
+    else if (assembly === 'server-host' || assembly === 'local-static') {
+        // SSR / local packs: favicon + opaque public/ for serve-host.
+        emitSiteFavicon(outDir, { projectRoot: ctx.projectRoot });
+        emitPublicStaticAssets(outDir, { projectRoot: ctx.projectRoot });
+    }
     if (assembly === 'local-static') {
         result.steps.push({
             kind: 'local-static',
@@ -106,7 +117,7 @@ export async function assembleDelivery(outDir, ctx) {
     const vmzDir = path.join(outDir, '_vmz');
     mkdirSync(vmzDir, { recursive: true });
     const file = path.join(vmzDir, 'assemble-manifest.json');
-    writeFileSync(file, `${JSON.stringify(result, null, 2)}\n`, 'utf8');
+    writePrettyJsonFile(file, result);
     return { manifest: result, path: file };
 }
 /**
@@ -123,7 +134,7 @@ export function emitBuildProof(outDir, ctx) {
     };
     for (const id of semanticIds) {
         if (id === 'static-delivery') {
-            const step = (ctx.assemble?.steps || []).find((s) => s.kind === 'static-cdn');
+            const step = (ctx.assemble?.steps || []).find((s) => s.kind === 'web-static');
             slots[id] = step
                 ? { status: 'emitted', detail: `digest=${String(step.digest).slice(0, 12)}` }
                 : { status: 'pending', detail: 'assembly requires static emit' };
@@ -186,6 +197,6 @@ export function emitBuildProof(outDir, ctx) {
     const vmzDir = path.join(outDir, '_vmz');
     mkdirSync(vmzDir, { recursive: true });
     const file = path.join(vmzDir, 'build-proof.json');
-    writeFileSync(file, `${JSON.stringify(body, null, 2)}\n`, 'utf8');
+    writePrettyJsonFile(file, body);
     return { proof: body, path: file };
 }

package/dist/cdn-policy.js

@@ -8,6 +8,7 @@ import fs from 'node:fs';
 import http from 'node:http';
 import path from 'node:path';
 import { assertLocaleCacheKey, localeAwareCacheKey } from './locale-router.js';
+import { writePrettyJsonFile } from './pretty-json.js';
 export const CDN_POLICY_MANIFEST_SCHEMA = 'vmz.cdn.policy_manifest.v0';
 export const CDN_ADAPTER_PROJECTION_SCHEMA = 'vmz.cdn.adapter_projection.v0';
 /** HTML: revalidate. Hashed/static assets: long immutable. */
@@ -85,7 +86,7 @@ export function buildCdnPolicyManifest(staticManifest, opts = {}) {
     const body = {
         schema: CDN_POLICY_MANIFEST_SCHEMA,
         applicationId: staticManifest.applicationId || null,
-        deliveryProfile: 'web-static',
+        deliveryProfile: 'static',
         origin,
         spaFallback: false,
         staticManifestDigest: staticManifest.manifestDigest || null,
@@ -145,14 +146,14 @@ export function emitCdnPolicy(distDir, staticManifest, opts = {}) {
     const policy = buildCdnPolicyManifest(staticManifest, { ...opts, localeArtifact });
     const vmzDir = path.join(distDir, '_vmz');
     fs.mkdirSync(vmzDir, { recursive: true });
-    fs.writeFileSync(path.join(vmzDir, 'cdn-policy-manifest.json'), `${JSON.stringify(policy, null, 2)}\n`, 'utf8');
+    writePrettyJsonFile(path.join(vmzDir, 'cdn-policy-manifest.json'), policy);
     const local = projectCdnAdapter(policy, 'local-static');
     const netlify = projectCdnAdapter(policy, 'netlify');
     const adaptersDir = path.join(vmzDir, 'adapters');
     fs.mkdirSync(path.join(adaptersDir, 'local-static'), { recursive: true });
     fs.mkdirSync(path.join(adaptersDir, 'netlify'), { recursive: true });
-    fs.writeFileSync(path.join(adaptersDir, 'local-static', 'projection.json'), `${JSON.stringify(local, null, 2)}\n`, 'utf8');
-    fs.writeFileSync(path.join(adaptersDir, 'netlify', 'projection.json'), `${JSON.stringify(netlify, null, 2)}\n`, 'utf8');
+    writePrettyJsonFile(path.join(adaptersDir, 'local-static', 'projection.json'), local);
+    writePrettyJsonFile(path.join(adaptersDir, 'netlify', 'projection.json'), netlify);
     fs.writeFileSync(path.join(adaptersDir, 'netlify', '_headers'), String(netlify.files['_headers'] || ''), 'utf8');
     fs.writeFileSync(path.join(adaptersDir, 'netlify', '_redirects'), String(netlify.files['_redirects'] || ''), 'utf8');
     return { policy, adapters: { 'local-static': local, netlify } };

package/dist/cli.js

@@ -3,9 +3,9 @@
  * Node CLI command implementations .
  */
 import { spawn } from 'node:child_process';
-import { copyFileSync, existsSync } from 'node:fs';
+import { existsSync } from 'node:fs';
 import path from 'node:path';
-import { HOST_PROTOCOL, createWorkspace, getProtocolVersions, resolveCoreRuntimeDist } from './index.js';
+import { HOST_PROTOCOL, createWorkspace, getProtocolVersions, materializeServeHostRuntime, resolveCoreRuntimeDist, resolveNativePath, } from './index.js';
 import { createDevSession } from './dev-session.js';
 import { gateGlobalProjectCommand, getInvocationContext, isGlobalAllowedCommand } from './invocation.js';
 import { log } from './log.js';
@@ -23,7 +23,7 @@ import { cmdRefactor } from './refactor-cmd.js';
 import { cmdExplain } from './explain-cmd.js';
 import { resolveNativeVmzCli } from './resolve-native-cli.js';
 import { loadVmzConfig } from './plugin-host.js';
-import { normalizeDeliveryAuthoring, selectBuildProfile } from './delivery-profile.js';
+import { normalizeDeliveryAuthoring, resolveProfileArtifactDir, selectBuildProfile } from './delivery-profile.js';
 import { packFromDeploymentIr } from './pack.js';
 import { assembleDelivery, emitBuildProof } from './build-assemble.js';
 /**
@@ -104,10 +104,10 @@ export function printProjectHelp() {
 Usage:
   vmz new|init <dir>            Scaffold a minimal app (native CLI)
   vmz check [path]              Check project via Workspace
-  vmz build [path] [options]    Build project via Workspace
+  vmz build [path] [options]    Build project via Workspace; --target mini-program-wechat packs dist/wechat
   vmz serve [path] [options]    Serve dist (optional --build)
-  vmz dev [path] [options]      Long-lived rebuild session (no CLI spawn)
-  vmz format [path] [--check]   Format .vmz via N-API (oxc codegen)
+  vmz dev [path] [options]      Rebuild session; --target mini-program-wechat packs dist/wechat
+  vmz format [path] [--check]   Format .vmz via N-API (oxc formatter + EditorConfig)
   vmz lint [path] [--deny-warnings]  Lint (= check) via N-API
   vmz test [path] [options]     Native test discover / report
   vmz document|docs <cmd>       Project /documents domain 
@@ -121,10 +121,11 @@ Usage:
   vmz help                      Show this help
 
 Options:
-  --out-dir, -o <dir>   Output directory (default: dist)
+  --out-dir, -o <dir>   Workspace output root (default: dist). Profile artifacts land in <out-dir>/<name> (name defaults to profile id; CDN: name:'cdn' → dist/cdn)
   --release             Release build (omit serve-host; pack minify slot; proof)
-  --profile <name>      Delivery profile (default from config; builtins: web-ssr|web-static|web-client|web-hybrid)
-  --origin <url>        Site origin for static-cdn canonical/sitemap
+  --profile <name>      Delivery profile (default from config; builtins: web-ssr|static|web-client|web-hybrid)
+  --target <id>         browser (default) | mini-program-wechat (pack dist/wechat for WeChat DevTools; build+dev)
+  --origin <url>        Site origin for web-static canonical/sitemap
   --host <host>         Listen host (default: 127.0.0.1)
   --port <port>         Listen port (dev: omit = auto from 5173; set = lock)
   --poll-ms <ms>        Dev watch poll interval (default: 300)
@@ -332,28 +333,35 @@ async function runWithPlugins(ws, project, outDir, fn) {
  */
 async function cmdBuild(args) {
     const pathArg = args._[0] ?? '.';
-    const { project, outDir } = resolveWorkspaceDirs({
+    const targetRaw = typeof args.target === 'string' ? args.target : 'browser';
+    if (targetRaw !== 'browser' && targetRaw !== 'mini-program-wechat') {
+        log.error(`unknown --target ${targetRaw} (browser | mini-program-wechat)`);
+        return 1;
+    }
+    const wechatPack = targetRaw === 'mini-program-wechat';
+    const { project, outDir: outDirRoot } = resolveWorkspaceDirs({
         path: pathArg,
         outDir: typeof args['out-dir'] === 'string' ? args['out-dir'] : undefined,
     });
-    log.info(`build ${project} → ${outDir}`);
+    const cfg = await loadVmzConfig(project);
+    const cliProfile = typeof args.profile === 'string' ? args.profile : '';
+    const norm = normalizeDeliveryAuthoring(cfg.delivery ?? null);
+    if (!norm.ok) {
+        log.diagnostics(norm.diagnostics ?? []);
+        log.error('delivery authoring invalid');
+        return 1;
+    }
+    const selected = selectBuildProfile(norm.table, cliProfile);
+    if (!selected.ok) {
+        log.diagnostics(selected.diagnostics ?? []);
+        log.error(`unknown build --profile ${cliProfile || norm.table.default}`);
+        return 1;
+    }
+    const outDir = resolveProfileArtifactDir(outDirRoot, selected.profile);
+    log.info(`build ${project} → ${outDir}${wechatPack ? ' (target=mini-program-wechat)' : ''} (out-dir=${outDirRoot}, name=${selected.profile.name})`);
     const ws = createWorkspace({ root: project, outDir });
     try {
-        const cfg = await loadVmzConfig(project);
-        const cliProfile = typeof args.profile === 'string' ? args.profile : '';
-        const norm = normalizeDeliveryAuthoring(cfg.delivery ?? null);
-        if (!norm.ok) {
-            log.diagnostics(norm.diagnostics ?? []);
-            log.error('delivery authoring invalid');
-            return 1;
-        }
-        const selected = selectBuildProfile(norm.table, cliProfile);
-        if (!selected.ok) {
-            log.diagnostics(selected.diagnostics ?? []);
-            log.error(`unknown build --profile ${cliProfile || norm.table.default}`);
-            return 1;
-        }
-        log.info(`delivery profile ${selected.selection.profileId} (assembly=${selected.selection.assembly})`);
+        log.info(`delivery profile ${selected.selection.profileId} (assembly=${selected.selection.assembly}, name=${selected.profile.name})`);
         const code = await runWithPlugins(ws, project, outDir, () => {
             const report = ws.build(Boolean(args.release));
             const errors = log.diagnostics(report.diagnostics ?? []);
@@ -394,6 +402,29 @@ async function cmdBuild(args) {
             if (!docs.ok)
                 return 1;
         }
+        if (wechatPack) {
+            if (typeof ws.lowerMiniprogramWechatPackaging !== 'function') {
+                log.error('wechat pack: workspace missing lowerMiniprogramWechatPackaging');
+                return 1;
+            }
+            let report;
+            try {
+                const raw = ws.lowerMiniprogramWechatPackaging();
+                report = typeof raw === 'string' ? JSON.parse(raw) : raw;
+            }
+            catch (err) {
+                log.error(`wechat pack failed: ${err instanceof Error ? err.message : String(err)}`);
+                return 1;
+            }
+            log.diagnostics(report.diagnostics ?? []);
+            if (report.status !== 'ready') {
+                log.error(`wechat pack ${report.status || 'failed'}`);
+                return 1;
+            }
+            const packRoot = report.packRoot || 'dist/wechat';
+            log.info(`wechat pack ok → ${path.join(project, packRoot)} (open in WeChat DevTools)`);
+            return 0;
+        }
         let pack = null;
         try {
             pack = packFromDeploymentIr(outDir, {
@@ -419,8 +450,8 @@ async function cmdBuild(args) {
         const origin = typeof args.origin === 'string' ? args.origin : undefined;
         let assemble = null;
         try {
-            if (selected.selection.assembly === 'static-cdn') {
-                log.info(`web-static emit ${outDir}`);
+            if (selected.selection.assembly === 'web-static') {
+                log.info(`static emit ${outDir}`);
             }
             assemble = await assembleDelivery(outDir, {
                 selection: selected.selection,
@@ -431,10 +462,11 @@ async function cmdBuild(args) {
                 siteId: cfg.application?.id || undefined,
                 origin,
                 pack: pack.manifest,
+                projectRoot: project,
             });
             for (const step of assemble.manifest.steps || []) {
-                if (step.kind === 'static-cdn') {
-                    log.info(`web-static ok (${step.htmlFiles} html, ${step.skipped} skipped, digest=${String(step.digest).slice(0, 12)}…)`);
+                if (step.kind === 'web-static') {
+                    log.info(`static ok (${step.htmlFiles} html, ${step.skipped} skipped, digest=${String(step.digest).slice(0, 12)}…)`);
                 }
                 else if (step.kind === 'site-delivery' && step.digest) {
                     log.info(`site-delivery ok (digest=${String(step.digest).slice(0, 12)}…)`);
@@ -465,20 +497,33 @@ async function cmdServe(args) {
         if (code !== 0)
             return code;
     }
-    const { project, outDir } = resolveWorkspaceDirs({
+    const { project, outDir: outDirRoot } = resolveWorkspaceDirs({
         path: pathArg,
         outDir: typeof args['out-dir'] === 'string' ? args['out-dir'] : undefined,
     });
+    const cfg = await loadVmzConfig(project);
+    const cliProfile = typeof args.profile === 'string' ? args.profile : '';
+    const norm = normalizeDeliveryAuthoring(cfg.delivery ?? null);
+    if (!norm.ok) {
+        log.diagnostics(norm.diagnostics ?? []);
+        log.error('delivery authoring invalid');
+        return 1;
+    }
+    const selected = selectBuildProfile(norm.table, cliProfile);
+    if (!selected.ok) {
+        log.diagnostics(selected.diagnostics ?? []);
+        log.error(`unknown build --profile ${cliProfile || norm.table.default}`);
+        return 1;
+    }
+    const outDir = resolveProfileArtifactDir(outDirRoot, selected.profile);
     const hostJs = path.join(outDir, 'vmz-serve-host.mjs');
     if (!existsSync(hostJs)) {
-        const coreDist = resolveCoreRuntimeDist();
-        const src = coreDist ? path.join(coreDist, 'serve-host.mjs') : null;
-        if (src && existsSync(src)) {
-            copyFileSync(src, hostJs);
+        try {
+            materializeServeHostRuntime(outDir);
             log.info(`materialized ${hostJs} from @vmz/core (release builds omit it)`);
         }
-        else {
-            log.error(`missing ${hostJs} — run \`vmz build\` (without --release) or ensure @vmz/core is installed`);
+        catch (err) {
+            log.error(`missing ${hostJs} — run \`vmz build\` (without --release) or ensure @vmz/core is installed (${err instanceof Error ? err.message : err})`);
             return 1;
         }
     }
@@ -493,6 +538,8 @@ async function cmdServe(args) {
             VMZ_DIST: outDir,
             VMZ_PORT: String(port),
             VMZ_HOST: host,
+            VMZ_PROJECT_ROOT: project,
+            VMZ_NATIVE_NODE: resolveNativePath(),
         },
         stdio: 'inherit',
     });
@@ -517,10 +564,25 @@ async function cmdServe(args) {
  */
 async function cmdDev(args) {
     const pathArg = args._[0] ?? '.';
-    const { project, outDir } = resolveWorkspaceDirs({
+    const { project, outDir: outDirRoot } = resolveWorkspaceDirs({
         path: pathArg,
         outDir: typeof args['out-dir'] === 'string' ? args['out-dir'] : undefined,
     });
+    const cfg = await loadVmzConfig(project);
+    const cliProfile = typeof args.profile === 'string' ? args.profile : '';
+    const norm = normalizeDeliveryAuthoring(cfg.delivery ?? null);
+    if (!norm.ok) {
+        log.diagnostics(norm.diagnostics ?? []);
+        log.error('delivery authoring invalid');
+        return 1;
+    }
+    const selected = selectBuildProfile(norm.table, cliProfile);
+    if (!selected.ok) {
+        log.diagnostics(selected.diagnostics ?? []);
+        log.error(`unknown build --profile ${cliProfile || norm.table.default}`);
+        return 1;
+    }
+    const outDir = resolveProfileArtifactDir(outDirRoot, selected.profile);
     const host = typeof args.host === 'string' ? args.host : '127.0.0.1';
     const portLocked = Object.prototype.hasOwnProperty.call(args, 'port');
     let port;
@@ -539,6 +601,11 @@ async function cmdDev(args) {
         }
     }
     const pollMs = Number(args['poll-ms'] ?? 300);
+    const targetRaw = typeof args.target === 'string' ? args.target : 'browser';
+    if (targetRaw !== 'browser' && targetRaw !== 'mini-program-wechat') {
+        log.error(`unknown --target ${targetRaw} (browser | mini-program-wechat)`);
+        return 1;
+    }
     const ac = new AbortController();
     const onSig = () => {
         log.info('shutting down…');
@@ -552,6 +619,7 @@ async function cmdDev(args) {
         host,
         port,
         pollMs,
+        target: targetRaw,
         signal: ac.signal,
     });
     try {

package/dist/content-addressed-assets.d.ts

@@ -1,9 +1,30 @@
 /**
  * A3: content-addressed assets/<hash> layout for immutable CDN objects.
- * Logical paths stay available for serve/dev; web-static HTML rewrites to hashed URLs.
- * Identical bytes → identical asset path (cross-release / cross-source reuse by digest).
+ * Logical paths stay available for serve/dev; static HTML rewrites to hashed URLs.
+ * CSS aggregators (vmz.css) rewrite `@import` to hashed sibling paths under assets/.
+ * JS under assets/ always rewrites ESM `./` → `../` so barrels (vmz-dom → dom-core)
+ * resolve at dist root — never prefer hashed siblings for JS (second-hop 404).
  */
 export declare const CONTENT_ADDRESSED_ASSETS_SCHEMA = "vmz.content_addressed_assets.v0";
+/**
+ * Rewrite relative `@import "./foo.css"` to hashed paths under assets/.
+ * @param {string} cssText
+ * @param {Record<string, string>} rewrites logical (no leading slash) or `/logical` → `assets/hash.ext`
+ */
+export declare function rewriteCssImports(cssText: any, rewrites: any): any;
+/**
+ * Rewrite relative ESM so a file served from `/assets/<hash>.js` resolves against
+ * dist root (static `from "./x"` / `export * from "./x"` + dynamic `import("./"+…)`).
+ *
+ * Always use `../…` (Fix A). Do **not** prefer hashed siblings under `assets/`:
+ * barrels like `vmz-dom.js` (`export * from './dom-core.js'`) would then resolve
+ * as `/assets/dom-core.js` and 404. `rewrites` is accepted for API parity with CSS
+ * but intentionally ignored for JS path choice.
+ *
+ * @param {string} jsText
+ * @param {Record<string, string>} [_rewrites]
+ */
+export declare function rewriteJsEntryRelativeImports(jsText: any, _rewrites?: {}): string;
 /**
  * Emit `assets/<sha256>.<ext>` copies and rewrite HTML href/src to hashed URLs.
  * @param {string} distDir

package/dist/content-addressed-assets.js

@@ -1,13 +1,16 @@
 /**
  * A3: content-addressed assets/<hash> layout for immutable CDN objects.
- * Logical paths stay available for serve/dev; web-static HTML rewrites to hashed URLs.
- * Identical bytes → identical asset path (cross-release / cross-source reuse by digest).
+ * Logical paths stay available for serve/dev; static HTML rewrites to hashed URLs.
+ * CSS aggregators (vmz.css) rewrite `@import` to hashed sibling paths under assets/.
+ * JS under assets/ always rewrites ESM `./` → `../` so barrels (vmz-dom → dom-core)
+ * resolve at dist root — never prefer hashed siblings for JS (second-hop 404).
  */
 // @ts-nocheck
 import crypto from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
 import { canonicalJson, sha256Hex } from './release-pack.js';
+import { writePrettyJsonFile } from './pretty-json.js';
 export const CONTENT_ADDRESSED_ASSETS_SCHEMA = 'vmz.content_addressed_assets.v0';
 /** Immutable delivery candidates (client-facing bytes). */
 const DEFAULT_CANDIDATES = [
@@ -15,11 +18,64 @@ const DEFAULT_CANDIDATES = [
     'entry-event.js',
     'vmz.css',
     'vmz-designs.css',
+    'vmz-style.css',
     'vmz-dom.js',
     'vmz-runtime.js',
     'vmz-http.js',
     'vmz-client-nav.js',
 ];
+/** CSS files that may @import other logical CSS; processed after leaf CSS is hashed. */
+const CSS_AGGREGATORS = new Set(['vmz.css']);
+/** JS entry shells hashed under assets/; relative ESM must be rewritten first. */
+const JS_ENTRY_AGGREGATORS = new Set(['entry-client.js', 'entry-event.js']);
+const CSS_IMPORT_RE = /@import\s*(?:url\()?['"]?(\.\/)?([^'")\s;]+)['"]?\)?/gi;
+/**
+ * Rewrite relative `@import "./foo.css"` to hashed paths under assets/.
+ * @param {string} cssText
+ * @param {Record<string, string>} rewrites logical (no leading slash) or `/logical` → `assets/hash.ext`
+ */
+export function rewriteCssImports(cssText, rewrites) {
+    return cssText.replace(CSS_IMPORT_RE, (match, _dot, target) => {
+        const logical = String(target || '').replace(/^\.\//, '');
+        if (!logical)
+            return match;
+        const hashed = rewrites[logical] || rewrites[`/${logical}`] || rewrites[`assets/${logical}`];
+        if (!hashed)
+            return match;
+        const rel = hashed.startsWith('/') ? hashed.slice(1) : hashed;
+        const sibling = rel.startsWith('assets/') ? `./${path.basename(rel)}` : `./${rel}`;
+        return `@import"${sibling}"`;
+    });
+}
+/**
+ * Rewrite relative ESM so a file served from `/assets/<hash>.js` resolves against
+ * dist root (static `from "./x"` / `export * from "./x"` + dynamic `import("./"+…)`).
+ *
+ * Always use `../…` (Fix A). Do **not** prefer hashed siblings under `assets/`:
+ * barrels like `vmz-dom.js` (`export * from './dom-core.js'`) would then resolve
+ * as `/assets/dom-core.js` and 404. `rewrites` is accepted for API parity with CSS
+ * but intentionally ignored for JS path choice.
+ *
+ * @param {string} jsText
+ * @param {Record<string, string>} [_rewrites]
+ */
+export function rewriteJsEntryRelativeImports(jsText, _rewrites = {}) {
+    let out = String(jsText || '');
+    // Dynamic: import("./" + id) → import("../" + id)
+    out = out.replace(/import\(\s*"\.\/"\s*\+/g, 'import("../"+');
+    out = out.replace(/import\(\s*'\.\/'\s*\+/g, "import('../'+");
+    const rewriteSpec = (spec) => {
+        const logical = String(spec || '').replace(/^\.\//, '');
+        if (!logical || logical.startsWith('../') || logical.startsWith('/'))
+            return spec;
+        return `../${logical}`;
+    };
+    // import/export … from "./x"  |  import("./x")
+    out = out.replace(/\b((?:import|export)\s+[^'"\n]*?\s+from\s+|import\s*\(\s*)(['"])(\.\/[^'"]+)\2/g, (match, prefix, quote, spec) => `${prefix}${quote}${rewriteSpec(spec)}${quote}`);
+    // side-effect: import "./x.js"
+    out = out.replace(/(^|[;\s])(import\s*)(['"])(\.\/[^'"]+)\3/gm, (match, lead, kw, quote, spec) => `${lead}${kw}${quote}${rewriteSpec(spec)}${quote}`);
+    return out;
+}
 /**
  * Emit `assets/<sha256>.<ext>` copies and rewrite HTML href/src to hashed URLs.
  * @param {string} distDir
@@ -37,36 +93,55 @@ export function emitContentAddressedAssets(distDir, opts = {}) {
     const objects = [];
     /** @type {Record<string, string>} */
     const rewrites = {};
-    for (const rel of candidates) {
-        const logical = String(rel).replace(/\\/g, '/').replace(/^\//, '');
-        const src = path.join(abs, ...logical.split('/'));
-        if (!fs.existsSync(src) || !fs.statSync(src).isFile())
+    const ordered = orderCandidates(candidates);
+    for (const rel of ordered) {
+        // Aggregators are replaced in later passes; leaf JS must rewrite ./ → ../ so a
+        // hashed barrel under assets/ never 404s on second-hop relative re-exports.
+        if (CSS_AGGREGATORS.has(rel) || JS_ENTRY_AGGREGATORS.has(rel)) {
+            ingestCandidate(abs, rel, rewrites, objects, { transform: null });
             continue;
-        const buf = fs.readFileSync(src);
-        const digest = sha256Hex(buf);
-        const ext = path.extname(logical) || '';
-        const assetRel = `assets/${digest}${ext}`;
-        const dest = path.join(abs, ...assetRel.split('/'));
-        if (!fs.existsSync(dest)) {
-            fs.mkdirSync(path.dirname(dest), { recursive: true });
-            fs.writeFileSync(dest, buf);
         }
-        else {
-            // Cross-release reuse: identical digest must not be rewritten.
-            const existing = sha256Hex(fs.readFileSync(dest));
-            if (existing !== digest) {
-                throw new Error(`content-address collision at ${assetRel}`);
-            }
+        if (/\.m?js$/i.test(rel)) {
+            const src = path.join(abs, rel);
+            if (!fs.existsSync(src))
+                continue;
+            const rewritten = rewriteJsEntryRelativeImports(fs.readFileSync(src, 'utf8'), {});
+            ingestCandidate(abs, rel, rewrites, objects, {
+                transform: () => Buffer.from(rewritten, 'utf8'),
+            });
+            continue;
         }
-        objects.push({
-            logicalPath: logical,
-            assetPath: assetRel,
-            digest,
-            bytes: buf.length,
-            immutable: true,
+        ingestCandidate(abs, rel, rewrites, objects, { transform: null });
+    }
+    // Aggregator CSS (vmz.css) must import hashed leaf files — rewrite then hash.
+    for (const rel of ordered) {
+        if (!CSS_AGGREGATORS.has(rel))
+            continue;
+        const src = path.join(abs, rel);
+        if (!fs.existsSync(src))
+            continue;
+        const rewritten = rewriteCssImports(fs.readFileSync(src, 'utf8'), rewrites);
+        removeLogicalObject(objects, rel);
+        delete rewrites[`/${rel}`];
+        delete rewrites[rel];
+        ingestCandidate(abs, rel, rewrites, objects, {
+            transform: () => Buffer.from(rewritten, 'utf8'),
+        });
+    }
+    // JS entry shells: rewrite relative ESM (static + dynamic) then re-hash.
+    for (const rel of ordered) {
+        if (!JS_ENTRY_AGGREGATORS.has(rel))
+            continue;
+        const src = path.join(abs, rel);
+        if (!fs.existsSync(src))
+            continue;
+        const rewritten = rewriteJsEntryRelativeImports(fs.readFileSync(src, 'utf8'), rewrites);
+        removeLogicalObject(objects, rel);
+        delete rewrites[`/${rel}`];
+        delete rewrites[rel];
+        ingestCandidate(abs, rel, rewrites, objects, {
+            transform: () => Buffer.from(rewritten, 'utf8'),
         });
-        rewrites[`/${logical}`] = `/${assetRel}`;
-        rewrites[logical] = assetRel;
     }
     objects.sort((a, b) => (a.logicalPath < b.logicalPath ? -1 : a.logicalPath > b.logicalPath ? 1 : 0));
     let rewrittenHtml = 0;
@@ -85,9 +160,83 @@ export function emitContentAddressedAssets(distDir, opts = {}) {
     const vmzDir = path.join(abs, '_vmz');
     fs.mkdirSync(vmzDir, { recursive: true });
     const outPath = path.join(vmzDir, 'content-addressed-assets.json');
-    fs.writeFileSync(outPath, `${JSON.stringify(manifest, null, 2)}\n`, 'utf8');
+    writePrettyJsonFile(outPath, manifest);
     return { manifest, assetsDir, rewrites, manifestPath: outPath };
 }
+/**
+ * @param {string[]} candidates
+ */
+function orderCandidates(candidates) {
+    const set = new Set(candidates.map((c) => String(c).replace(/\\/g, '/').replace(/^\//, '')));
+    /** @type {string[]} */
+    const out = [];
+    for (const name of DEFAULT_CANDIDATES) {
+        if (set.has(name) && !CSS_AGGREGATORS.has(name) && !JS_ENTRY_AGGREGATORS.has(name))
+            out.push(name);
+    }
+    for (const name of [...set].sort()) {
+        if (!CSS_AGGREGATORS.has(name) && !JS_ENTRY_AGGREGATORS.has(name) && !out.includes(name)) {
+            out.push(name);
+        }
+    }
+    if (set.has('vmz.css'))
+        out.push('vmz.css');
+    for (const name of ['entry-client.js', 'entry-event.js']) {
+        if (set.has(name))
+            out.push(name);
+    }
+    return out;
+}
+/**
+ * @param {Array<Record<string, any>>} objects
+ * @param {string} logical
+ */
+function removeLogicalObject(objects, logical) {
+    const idx = objects.findIndex((o) => o.logicalPath === logical);
+    if (idx >= 0)
+        objects.splice(idx, 1);
+}
+/**
+ * @param {string} absDist
+ * @param {string} rel
+ * @param {Record<string, string>} rewrites
+ * @param {Array<Record<string, any>>} objects
+ * @param {{ transform?: ((buf: Buffer) => Buffer) | null }} opts
+ */
+function ingestCandidate(absDist, rel, rewrites, objects, opts) {
+    const logical = String(rel).replace(/\\/g, '/').replace(/^\//, '');
+    const src = path.join(absDist, ...logical.split('/'));
+    if (!fs.existsSync(src) || !fs.statSync(src).isFile())
+        return;
+    let buf = fs.readFileSync(src);
+    if (typeof opts.transform === 'function') {
+        buf = opts.transform(buf);
+    }
+    const digest = sha256Hex(buf);
+    const ext = path.extname(logical) || '';
+    const assetRel = `assets/${digest}${ext}`;
+    const dest = path.join(absDist, ...assetRel.split('/'));
+    if (!fs.existsSync(dest)) {
+        fs.mkdirSync(path.dirname(dest), { recursive: true });
+        fs.writeFileSync(dest, buf);
+    }
+    else {
+        const existing = sha256Hex(fs.readFileSync(dest));
+        if (existing !== digest) {
+            // Stale assets/ from a prior partial build can reuse hash filenames with different bytes.
+            fs.writeFileSync(dest, buf);
+        }
+    }
+    objects.push({
+        logicalPath: logical,
+        assetPath: assetRel,
+        digest,
+        bytes: buf.length,
+        immutable: true,
+    });
+    rewrites[`/${logical}`] = `/${assetRel}`;
+    rewrites[logical] = assetRel;
+}
 /**
  * Resolve an immutable object by digest under dist/assets (cross-source reuse).
  * @param {string} distDir
@@ -123,7 +272,6 @@ export function assertSharedAssetPath(distDir, a, b, ext = '.js') {
     const rel = `assets/${da}${ext}`;
     const dest = path.join(distDir, ...rel.split('/'));
     fs.writeFileSync(dest, typeof a === 'string' ? Buffer.from(a) : a);
-    // Second write of identical bytes must be reuse, not fork.
     fs.writeFileSync(dest, typeof b === 'string' ? Buffer.from(b) : b);
     const again = resolveAssetByDigest(distDir, da, ext);
     if (!again || again.assetPath !== rel) {
@@ -138,7 +286,6 @@ function collectCandidates(distDir) {
         if (fs.existsSync(path.join(distDir, name)))
             out.push(name);
     }
-    // Include top-level *.client.js and pages/**/*.client.js referenced by resume.
     walk(distDir, distDir, (rel) => {
         if (/\.client\.js$/i.test(rel))
             out.push(rel);
@@ -172,7 +319,6 @@ function rewriteHtmlReferences(distDir, rewrites) {
         let text = fs.readFileSync(file, 'utf8');
         let next = text;
         for (const [from, to] of pairs) {
-            // href="/x" src="/x" and unquoted variants in attributes
             next = next.split(from).join(to);
         }
         if (next !== text) {