@vmz/vmz 0.3.12 → 0.3.13

package/dist/workspace/pack.js

@@ -1,26 +1,69 @@
 /**
- * Pack stage: consume Deployment IR (VPG-owned units), emit pack manifest,
- * and lower browser-unreachable bare package imports to `dist/vendor/**`.
+ * Pack stage: run the browser delivery graph through the Rust `vmz-pack`
+ * binding (N-API `packPlan`/`packWrite`, frozen v0 contract) and record the
+ * resulting chunk/asset mapping in `_vmz/pack-manifest.json`.
  *
- * Current status: a thin module-moving slice — reachable module closure
- * materialization, specifier rewriting, and TypeScript `transpileModule` type
- * erasure. Linking, dead-code elimination, chunk splitting, and minification
- * are NOT implemented in this stage; the manifest reports that honestly.
- * (Any compaction of compile-emitted modules happens upstream in the compiler,
- * not here — pack never rewrites bytes beyond specifier lowering.)
+ * Browser graph roots are the bootstrap modules (`entry-client.js` /
+ * `entry-event.js`) emitted by the compiler / static delivery path; page and
+ * island modules enter the graph through the bootstrap's literal dynamic
+ * import tables, never as pack entries. Bootstrap entries declare
+ * `execution: 'full'` + `exports: { kind: 'all' }` (script-tag load,
+ * whole-module execution).
+ *
+ * SSR/Node is a separate graph: every deployment unit's `clientEntry` is a
+ * Node entry (logical = `chunkId`), packed under `_vmz/pack-node/` and indexed
+ * by `_vmz/pack-node-manifest.json`. Node consumers never fall back to the
+ * unpacked root `${chunkId}.client.js`; browser bootstrap modules are not Node
+ * entries because they bind `dom.browser` / `document`.
+ *
+ * No vendor materialization, no specifier lowering, and no second hashing
+ * pass happen here: `packWrite` emits the final browser JS set under
+ * `_vmz/pack/` with content-hashed names, and consumers resolve logical
+ * entries through `packEntryHref()` against this manifest.
  */
 import crypto from 'node:crypto';
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, realpathSync, rmSync, writeFileSync } from 'node:fs';
 import path from 'node:path';
-import { loadDeploymentIr, planBundleInputs } from './bundler-adapter.js';
-import { packClientBareImports } from './pack-client-packages.js';
+import { loadDeploymentIr } from './bundler-adapter.js';
+import { buildPackRequest, runPackWrite } from './pack-native.js';
 import { deliveryRuntimeFilePairs } from './delivery-runtime-files.js';
 import { rewriteDeliveryImports } from './delivery-runtime-imports.js';
 import { writePrettyJsonFile } from './pretty-json.js';
 export const PACK_MANIFEST_SCHEMA = 'vmz.pack.manifest.v0';
+/** Directory (relative to outDir) where `packWrite` emits the final browser JS set. */
+export const PACK_OUTPUT_DIR_REL = '_vmz/pack';
+/** Site root base — VMZ static delivery has no configurable base (see delivery-profile). */
+export const PACK_PUBLIC_BASE = '/';
+/**
+ * Projection provenance for the pack graph: each deployment unit's emitted
+ * client entry maps back to its source `.vmz`. Bare-specifier package discovery
+ * then walks up from the source location — dependency components (e.g. a
+ * `@vmz/ui` component importing its own peer) keep their source package's
+ * node_modules visibility, matching Node realpath semantics. Relative
+ * specifiers keep resolving against the emitted tree.
+ */
+export function deploymentUnitOrigins(absOut, ir) {
+    const origins = {};
+    for (const unit of ir.units || []) {
+        const source = String(unit.source || '');
+        const chunkId = String(unit.chunkId || '').replace(/\\/g, '/');
+        if (!source || !chunkId)
+            continue;
+        const rel = (unit.clientEntry ? String(unit.clientEntry) : `${chunkId}.client.js`).replace(/\\/g, '/');
+        const emitted = path.join(absOut, ...rel.split('/'));
+        if (!existsSync(emitted) || !existsSync(source))
+            continue;
+        origins[realpathSync(emitted)] = realpathSync(source);
+    }
+    return origins;
+}
+/** Bootstrap modules that are browser pack entries when present in outDir. */
+const BOOTSTRAP_ENTRIES = ['entry-client.js', 'entry-event.js'];
 /**
  * Ensure dom split companions sit next to vmz-dom.js (barrel imports ./dom-core.js).
  * Always refresh from `@vmz/core` when present so SSR/runtime fixes are not sticky in outDir.
+ * Document surfaces (Node-side document layout mount) consume this; browser delivery
+ * runtime files reach the pack graph through `@vmz/core` bare imports in the Rust graph.
  * @param {string} outDir
  * @param {string | null | undefined} coreDist `@vmz/core` dist root
  * @returns {string[]} copied relative names
@@ -41,37 +84,54 @@ export function ensureRuntimeCompanions(outDir, coreDist) {
     }
     return copied;
 }
+/**
+ * Pack the browser delivery graph via the Rust `vmz-pack` binding and write
+ * `_vmz/pack-manifest.json` (v0). Entries are the bootstrap modules that
+ * already exist in `outDir` — an empty bootstrap set is an explicit request
+ * error, never a silently skipped stage.
+ */
 export function packFromDeploymentIr(outDir, opts = {}) {
-    ensureRuntimeCompanions(outDir, opts.coreDist);
-    // Browser ESM cannot resolve bare npm specs — materialize reachable packages first
-    // so digests below reflect the rewritten graph.
-    const clientPackages = packClientBareImports(outDir, { projectRoot: opts.projectRoot || null });
-    const ir = loadDeploymentIr(outDir);
-    const inputs = planBundleInputs(outDir, ir);
-    const units = [];
-    for (const entry of inputs) {
-        const abs = entry.entry;
-        let digest = null;
-        let bytes = 0;
-        let present = false;
-        if (existsSync(abs)) {
-            present = true;
-            const buf = readFileSync(abs);
-            bytes = buf.length;
-            digest = crypto.createHash('sha256').update(buf).digest('hex');
-        }
-        units.push({
-            chunkId: entry.chunkId,
-            kind: entry.kind,
-            entry: path.relative(outDir, abs).replace(/\\/g, '/'),
-            programIr: path.relative(outDir, entry.programIr).replace(/\\/g, '/'),
-            source: entry.source,
-            present,
-            bytes,
-            digest,
-            rebuilt: Boolean(entry.rebuilt),
-        });
+    const absOut = path.resolve(outDir);
+    const root = opts.projectRoot ? path.resolve(opts.projectRoot) : path.dirname(absOut);
+    const entries = {};
+    for (const logical of BOOTSTRAP_ENTRIES) {
+        const abs = path.join(absOut, logical);
+        if (existsSync(abs))
+            entries[logical] = abs;
+    }
+    const uses = Object.keys(entries).map((logical) => ({
+        logical,
+        execution: 'full',
+        exports: { kind: 'all' },
+    }));
+    // Browser graph entries are the bootstrap modules; page/island units join
+    // through the bootstrap dynamic-import tables and need projection provenance.
+    const origins = deploymentUnitOrigins(absOut, loadDeploymentIr(absOut));
+    const requestJson = buildPackRequest({ entries, target: 'browser', root, uses, publicBase: PACK_PUBLIC_BASE, origins });
+    const packOutDir = path.join(absOut, ...PACK_OUTPUT_DIR_REL.split('/'));
+    // 重建不得残留上一轮 pack 的过期 chunk：manifest/磁盘闭包是交付合同，
+    // 写盘前整体清空旧输出目录（`packWrite` 只增不删）。
+    rmSync(packOutDir, { recursive: true, force: true });
+    const { plan } = runPackWrite(requestJson, packOutDir, opts.binding ? { binding: opts.binding } : {});
+    const ir = loadDeploymentIr(absOut);
+    let nativeManifest;
+    try {
+        nativeManifest = JSON.parse(plan.manifestJson);
+    }
+    catch (error) {
+        throw new Error(`pack manifestJson from binding is not valid JSON: ${error instanceof Error ? error.message : String(error)}`);
     }
+    const chunks = plan.artifacts.map((a) => {
+        const buf = Buffer.from(a.code, 'utf8');
+        return {
+            chunkId: a.chunkId,
+            fileName: a.fileName,
+            modules: a.modules,
+            bytes: buf.length,
+            digest: sha256Hex(buf),
+            sourceMap: a.sourceMapFileName,
+        };
+    });
     const body = {
         schema: PACK_MANIFEST_SCHEMA,
         profileId: opts.profileId || null,
@@ -79,33 +139,177 @@ export function packFromDeploymentIr(outDir, opts = {}) {
         release: Boolean(opts.release),
         preferredClientFace: opts.preferredClientFace || '@vmz/core/dom/client',
         deploymentSchema: ir.schema,
-        unitCount: units.length,
-        units,
-        // Pack runs no compressor in either mode: it reports the bytes it was
-        // given (dev output written verbatim). Release artifacts may already be
-        // compacted by the compiler's release print path upstream — pack does not
-        // claim, add, or verify that compaction.
-        minify: opts.release ? 'none' : 'dev-identity',
-        // Names how VPG deployment units are selected for this manifest. It does
-        // NOT mean JavaScript dead-code elimination ran — that is not implemented.
-        treeShakeBasis: 'vpg-deployment-ir',
-        bundler: 'vmz-pack',
-        clientPackageLowering: {
-            status: 'thin',
-            rewrittenFiles: clientPackages.rewrittenFiles,
-            bareSpecs: clientPackages.bareSpecs,
-            vendoredModules: clientPackages.vendoredModules,
-            unresolvedBareSpecs: clientPackages.unresolvedBareSpecs || [],
-            skippedVmzExports: clientPackages.skippedVmzExports || [],
-            remainingBareSpecs: clientPackages.remainingBareSpecs || [],
-        },
+        target: 'browser',
+        publicBase: PACK_PUBLIC_BASE,
+        entries: Object.keys(entries)
+            .sort()
+            .map((logical) => ({ logical, file: path.relative(absOut, entries[logical]).replace(/\\/g, '/') })),
+        entryFiles: plan.entryFiles,
+        dynamicFiles: plan.dynamicFiles,
+        // CSS artifacts are final bytes under `_vmz/pack/` (`packWrite` wrote
+        // them); the wire carries identity/provenance only, never content.
+        styles: plan.styles,
+        assets: plan.assets,
+        chunks,
+        chunkCount: chunks.length,
+        styleCount: plan.styles.length,
+        entryCount: plan.entryFiles.length,
+        // `vmz-pack` runs no compressor: chunk bytes are the linked output verbatim.
+        minify: 'none',
+        // `link` active fixed-point pruning really ran — bootstrap entries
+        // declare full execution, internal modules are pruned to reachable exports.
+        treeShake: 'vmz-pack-link-pruning',
+        // Chunk source maps are line-level v3: every assembled line maps back
+        // to its module line (`<packOut>/<fileName>.map`, `sourceMapFileName`
+        // on the wire); token-level mappings and `names` are not implemented.
+        sourceMaps: 'chunk-v3-line-mappings',
+        nativeManifest,
     };
     body.packDigest = sha256Hex(stableStringify({ ...body }));
-    const vmzDir = path.join(outDir, '_vmz');
+    const vmzDir = path.join(absOut, '_vmz');
     mkdirSync(vmzDir, { recursive: true });
     const file = path.join(vmzDir, 'pack-manifest.json');
     writePrettyJsonFile(file, body);
-    return { manifest: body, path: file, clientPackages };
+    return { manifest: body, path: file };
+}
+export const PACK_NODE_MANIFEST_SCHEMA = 'vmz.pack.node-manifest.v0';
+/** Directory (relative to outDir) where `packWrite` emits the Node JS set. */
+export const PACK_NODE_OUTPUT_DIR_REL = '_vmz/pack-node';
+/** Node pack manifest (relative to outDir); `entryFiles` maps logical → chunk file. */
+export const PACK_NODE_MANIFEST_REL = '_vmz/pack-node-manifest.json';
+/**
+ * Pack the SSR/Node graph via the Rust `vmz-pack` binding and write
+ * `_vmz/pack-node-manifest.json` (v0). Entries are the deployment units'
+ * compiled client modules (`clientEntry`, empty → mirrors `vmz-artifacts`
+ * `component_entries`: `${chunkId}.client.js`). Node consumers only read
+ * `default`, but the import itself is evaluated, hence `side-effects` +
+ * named default rather than `all` / `full` / `unconsumed`.
+ */
+export function packSsrFromDeploymentIr(outDir, opts = {}) {
+    const absOut = path.resolve(outDir);
+    const root = opts.projectRoot ? path.resolve(opts.projectRoot) : path.dirname(absOut);
+    const ir = loadDeploymentIr(absOut);
+    const entries = {};
+    const uses = [];
+    // Deployment IR may list the same component unit more than once (one entry
+    // per consuming page). The node graph identity is `chunkId`, so duplicates
+    // collapse into one entry; a same-identity unit pointing at a different
+    // client file is a contract violation, not something to silently pick.
+    const seen = new Map();
+    for (const unit of ir.units || []) {
+        const chunkId = String(unit.chunkId || '').replace(/\\/g, '/');
+        if (!chunkId)
+            throw new Error(`packSsrFromDeploymentIr: deployment unit has an empty chunkId in ${absOut}`);
+        // `vmz-artifacts` derives the component entry as `${chunkId}.client.js`
+        // when `clientEntry` is empty. Decide it here so the pack request stays
+        // explicit, then require the file — a missing entry is never skipped.
+        const rel = (unit.clientEntry ? String(unit.clientEntry) : `${chunkId}.client.js`).replace(/\\/g, '/');
+        if (seen.has(chunkId)) {
+            if (seen.get(chunkId) !== rel) {
+                throw new Error(`packSsrFromDeploymentIr: deployment unit "${chunkId}" maps to conflicting client entries: ` +
+                    `${seen.get(chunkId)} and ${rel} (in ${absOut})`);
+            }
+            continue;
+        }
+        const abs = path.join(absOut, ...rel.split('/'));
+        if (!existsSync(abs)) {
+            throw new Error(`packSsrFromDeploymentIr: unit "${chunkId}" client entry missing: ${rel} (in ${absOut})`);
+        }
+        seen.set(chunkId, rel);
+        entries[chunkId] = abs;
+        uses.push({ logical: chunkId, execution: 'side-effects', exports: { kind: 'named', names: ['default'] } });
+    }
+    if (!Object.keys(entries).length) {
+        throw new Error(`packSsrFromDeploymentIr: deployment IR has no units in ${absOut}`);
+    }
+    const origins = deploymentUnitOrigins(absOut, ir);
+    const requestJson = buildPackRequest({ entries, target: 'node', root, uses, publicBase: PACK_PUBLIC_BASE, origins });
+    const packOutDir = path.join(absOut, ...PACK_NODE_OUTPUT_DIR_REL.split('/'));
+    // 与浏览器 pack 同口径：写盘前清空旧 Node chunk 目录，闭包合同不接受残留。
+    rmSync(packOutDir, { recursive: true, force: true });
+    const { plan } = runPackWrite(requestJson, packOutDir, opts.binding ? { binding: opts.binding } : {});
+    let nativeManifest;
+    try {
+        nativeManifest = JSON.parse(plan.manifestJson);
+    }
+    catch (error) {
+        throw new Error(`node pack manifestJson from binding is not valid JSON: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    const chunks = plan.artifacts.map((a) => {
+        const buf = Buffer.from(a.code, 'utf8');
+        return {
+            chunkId: a.chunkId,
+            fileName: a.fileName,
+            modules: a.modules,
+            bytes: buf.length,
+            digest: sha256Hex(buf),
+            sourceMap: a.sourceMapFileName,
+        };
+    });
+    // dist roots carry no package.json; Node needs one beside the chunk set to
+    // treat content-hashed `.js` files as ESM.
+    mkdirSync(packOutDir, { recursive: true });
+    writeFileSync(path.join(packOutDir, 'package.json'), `${JSON.stringify({ type: 'module' })}\n`, 'utf8');
+    const body = {
+        schema: PACK_NODE_MANIFEST_SCHEMA,
+        target: 'node',
+        deploymentSchema: ir.schema,
+        entries: Object.keys(entries)
+            .sort()
+            .map((logical) => ({ logical, file: path.relative(absOut, entries[logical]).replace(/\\/g, '/') })),
+        entryFiles: plan.entryFiles,
+        dynamicFiles: plan.dynamicFiles,
+        chunks,
+        chunkCount: chunks.length,
+        entryCount: plan.entryFiles.length,
+        nativeManifest,
+    };
+    body.packDigest = sha256Hex(stableStringify({ ...body }));
+    const file = path.join(absOut, ...PACK_NODE_MANIFEST_REL.split('/'));
+    writePrettyJsonFile(file, body);
+    return { manifest: body, path: file };
+}
+/**
+ * Resolve a Node logical entry (`chunkId`) to its packed absolute file from
+ * `_vmz/pack-node-manifest.json`. Missing manifest, missing logical, or a
+ * missing chunk file is an explicit error — never a fallback to the unpacked
+ * root `${chunkId}.client.js`.
+ */
+export function packNodeEntryFile(outDir, chunkId) {
+    const absOut = path.resolve(outDir);
+    const manifestPath = path.join(absOut, ...PACK_NODE_MANIFEST_REL.split('/'));
+    if (!existsSync(manifestPath)) {
+        throw new Error(`packNodeEntryFile: missing ${manifestPath} — run vmz build (node pack) first`);
+    }
+    const manifest = JSON.parse(readFileSync(manifestPath, 'utf8'));
+    const hit = (manifest.entryFiles || []).find((e) => e && e.logical === chunkId);
+    if (!hit || typeof hit.file !== 'string' || !hit.file) {
+        throw new Error(`packNodeEntryFile: node pack manifest has no entry file for "${chunkId}"`);
+    }
+    const abs = path.join(absOut, ...PACK_NODE_OUTPUT_DIR_REL.split('/'), ...hit.file.split('/'));
+    if (!existsSync(abs)) {
+        throw new Error(`packNodeEntryFile: node pack chunk missing on disk: ${path.relative(absOut, abs)}`);
+    }
+    return abs;
+}
+/**
+ * Resolve the final browser URL of a packed logical entry from
+ * `_vmz/pack-manifest.json` (`entryFiles` is the only logical→physical map).
+ * Missing manifest or missing logical entry is an explicit error — no
+ * fallback to unpacked root bytes.
+ */
+export function packEntryHref(outDir, logical) {
+    const manifestPath = path.join(path.resolve(outDir), '_vmz', 'pack-manifest.json');
+    if (!existsSync(manifestPath)) {
+        throw new Error(`packEntryHref: missing ${manifestPath} — run vmz build (pack) first`);
+    }
+    const manifest = JSON.parse(readFileSync(manifestPath, 'utf8'));
+    const hit = (manifest.entryFiles || []).find((e) => e && e.logical === logical);
+    if (!hit || typeof hit.file !== 'string' || !hit.file) {
+        throw new Error(`packEntryHref: pack manifest has no entry file for "${logical}"`);
+    }
+    const base = String(manifest.publicBase || PACK_PUBLIC_BASE).replace(/\/$/, '');
+    return `${base}/${PACK_OUTPUT_DIR_REL}/${hit.file}`;
 }
 function stableStringify(value) {
     return JSON.stringify(sortKeys(value));
@@ -115,12 +319,13 @@ function sortKeys(value) {
         return value.map(sortKeys);
     if (value && typeof value === 'object') {
         const out = {};
-        for (const k of Object.keys(value).sort())
+        for (const k of Object.keys(value).sort()) {
             out[k] = sortKeys(value[k]);
+        }
         return out;
     }
     return value;
 }
-function sha256Hex(text) {
-    return crypto.createHash('sha256').update(text, 'utf8').digest('hex');
+function sha256Hex(data) {
+    return crypto.createHash('sha256').update(data).digest('hex');
 }

package/dist/workspace/plugin-host.d.ts

@@ -1,8 +1,8 @@
 /**
  * Plugin protocol v1 helpers + typed config loading.
  */
-import { contentHash, defineConfig, definePlugin } from '@vmz/plugin';
-export { contentHash, defineConfig, definePlugin };
+import { contentHash, definePlugin } from '@vmz/plugin';
+export { contentHash, definePlugin };
 export declare const PLUGIN_PROTOCOL = "0.1.0";
 export declare const CONFIG_NAMES: string[];
 export declare const CONFIG_LOAD_FAILED = "vmz::config::load_failed";
@@ -13,9 +13,9 @@ export declare const PLUGIN_ENTRY_INVALID = "vmz::plugin::invalid_entry";
  * @returns {Promise<{
  *   plugins: import('@vmz/plugin').VmzPlugin[],
  *   engines: import('@vmz/plugin').VmzEngines,
- *   delivery: import('@vmz/plugin').DeliveryAuthoring | null,
+ *   delivery: import('./user-config.js').DeliveryAuthoring | null,
  *   application: { id?: string } | null,
- *   format: import('@vmz/plugin').VmzFormatConfig | null,
+ *   format: import('./user-config.js').VmzFormatConfig | null,
  *   path: string | null,
  *   pluginPath: string | null,
  * }>}

package/dist/workspace/plugin-host.js

@@ -4,10 +4,10 @@
 import { existsSync } from 'node:fs';
 import path from 'node:path';
 import { pathToFileURL } from 'node:url';
-import { PLUGIN_PROTOCOL as PLUGIN_PROTOCOL_PKG, contentHash, defineConfig, definePlugin } from '@vmz/plugin';
+import { PLUGIN_PROTOCOL as PLUGIN_PROTOCOL_PKG, contentHash, definePlugin } from '@vmz/plugin';
 import { log } from './log.js';
 import { resolveWorkspacePackages } from './packages.js';
-export { contentHash, defineConfig, definePlugin };
+export { contentHash, definePlugin };
 export const PLUGIN_PROTOCOL = PLUGIN_PROTOCOL_PKG;
 export const CONFIG_NAMES = ['vmz.config.ts', 'vmz.config.mts', 'vmz.config.mjs', 'vmz.config.js'];
 const ROOT_PLUGIN_NAMES = ['vmz.plugin.ts', 'vmz.plugin.mts', 'vmz.plugin.mjs', 'vmz.plugin.js'];
@@ -61,9 +61,9 @@ function configDiagnosticError(code, sourcePath, err) {
  * @returns {Promise<{
  *   plugins: import('@vmz/plugin').VmzPlugin[],
  *   engines: import('@vmz/plugin').VmzEngines,
- *   delivery: import('@vmz/plugin').DeliveryAuthoring | null,
+ *   delivery: import('./user-config.js').DeliveryAuthoring | null,
  *   application: { id?: string } | null,
- *   format: import('@vmz/plugin').VmzFormatConfig | null,
+ *   format: import('./user-config.js').VmzFormatConfig | null,
  *   path: string | null,
  *   pluginPath: string | null,
  * }>}
@@ -73,11 +73,11 @@ export async function loadVmzConfig(project) {
     const plugins = [];
     /** @type {import('@vmz/plugin').VmzEngines} */
     let engines = {};
-    /** @type {import('@vmz/plugin').DeliveryAuthoring | null} */
+    /** @type {import('./user-config.js').DeliveryAuthoring | null} */
     let delivery = null;
     /** @type {{ id?: string } | null} */
     let application = null;
-    /** @type {import('@vmz/plugin').VmzFormatConfig | null} */
+    /** @type {import('./user-config.js').VmzFormatConfig | null} */
     let format = null;
     /** @type {string | null} */
     let configPath = null;

package/dist/workspace/production-observability.d.ts

@@ -95,6 +95,8 @@ export declare function checkCapabilityClosure(cap: any, policy: any): {
 export declare function applySecurityHeadersToCdnPolicy(cdnPolicy: any, security: any): any;
 /**
  * Measure dist sizes for budget gates.
+ * Browser delivery JS final set = packed chunks under `_vmz/pack/`
+ * (root `*.client.js` / bootstrap files are Node SSR / pack inputs, not delivery bytes).
  * @param {string} distDir
  */
 export declare function measureDistBudgets(distDir: any): {

package/dist/workspace/production-observability.js

@@ -398,13 +398,16 @@ export function applySecurityHeadersToCdnPolicy(cdnPolicy, security) {
 }
 /**
  * Measure dist sizes for budget gates.
+ * Browser delivery JS final set = packed chunks under `_vmz/pack/`
+ * (root `*.client.js` / bootstrap files are Node SSR / pack inputs, not delivery bytes).
  * @param {string} distDir
  */
 export function measureDistBudgets(distDir) {
     let htmlBytes = 0;
     let clientJsBytes = 0;
     let artifactBytes = 0;
-    const stack = [distDir];
+    const abs = path.resolve(distDir);
+    const stack = [abs];
     while (stack.length) {
         const dir = stack.pop();
         if (!fs.existsSync(dir))
@@ -419,7 +422,8 @@ export function measureDistBudgets(distDir) {
             artifactBytes += st.size;
             if (name.endsWith('.html'))
                 htmlBytes += st.size;
-            if (name.endsWith('.client.js') || name === 'entry-client.js' || name === 'entry-event.js') {
+            const rel = path.relative(abs, full).replace(/\\/g, '/');
+            if (rel.startsWith('_vmz/pack/') && name.endsWith('.js')) {
                 clientJsBytes += st.size;
             }
         }

package/dist/workspace/project-build.js

@@ -9,9 +9,11 @@ import { normalizeDeliveryAuthoring, resolveProfileArtifactDir, selectBuildProfi
 import { buildIntegratedDocuments, projectHasDocuments } from '../document/document-integrate.js';
 import { emitLocaleRuntimeModules, localeHasErrors } from '../locale/locale-check.js';
 import { emitLocaleRouteRealization } from '../locale/locale-route-emit.js';
-import { packFromDeploymentIr } from './pack.js';
+import { ensureRuntimeCompanions, packFromDeploymentIr, packSsrFromDeploymentIr } from './pack.js';
 import { loadVmzConfig } from './plugin-host.js';
 import { emitRouteCatalog } from './route-catalog-emit.js';
+import { resolveCoreRuntimeDist } from './runtime-dist.js';
+import { emitStaticBootstrapEntries } from './static-emit.js';
 function dedupeDiagnostics(list) {
     const seen = new Set();
     const out = [];
@@ -81,7 +83,7 @@ export async function buildProjectToOutDirRoot(project, outDirRoot, opts = {}) {
     const assembly = String(selected.selection.assembly || '');
     const profileId = String(selected.selection.profileId || '');
     // Dynamic import avoids init cycle with `./index.js` re-exports.
-    const { createWorkspace, resolveCoreRuntimeDist } = await import('./public-api.js');
+    const { createWorkspace } = await import('./public-api.js');
     const ws = createWorkspace({ root: project, outDir: artifactDir });
     try {
         const code = await runWithPlugins(ws, project, artifactDir, () => {
@@ -141,8 +143,26 @@ export async function buildProjectToOutDirRoot(project, outDirRoot, opts = {}) {
                 error: routeCatalog.error || 'route catalog emit failed',
             };
         }
+        try {
+            // Node graph must be packed before any SSR consumer (document build,
+            // static emit, render host) imports a compiled chunk. Companions are
+            // copied first so the Node graph sees the delivery runtime beside the
+            // client modules.
+            ensureRuntimeCompanions(artifactDir, resolveCoreRuntimeDist());
+            packSsrFromDeploymentIr(artifactDir, { projectRoot: project });
+        }
+        catch (err) {
+            return {
+                ok: false,
+                outDirRoot: root,
+                artifactDir,
+                deliveryName,
+                diagnostics,
+                error: `node pack failed: ${err instanceof Error ? err.message : String(err)}`,
+            };
+        }
         if (projectHasDocuments(project)) {
-            const docs = await buildIntegratedDocuments({ projectRoot: project, outDir: artifactDir });
+            const docs = await buildIntegratedDocuments({ projectRoot: project, outDir: artifactDir, engines: cfg.engines });
             if (!docs.ok) {
                 return {
                     ok: false,
@@ -156,11 +176,13 @@ export async function buildProjectToOutDirRoot(project, outDirRoot, opts = {}) {
         }
         let pack;
         try {
+            // Browser pack entries are the static bootstrap modules; static emit
+            // runs after pack (HTML resolves `_vmz/pack/`), so write them first.
+            emitStaticBootstrapEntries(artifactDir);
             pack = packFromDeploymentIr(artifactDir, {
                 release: Boolean(opts.release),
                 profileId,
                 assembly,
-                coreDist: resolveCoreRuntimeDist(),
                 projectRoot: project,
             });
         }

package/dist/workspace/public-api.d.ts

@@ -96,7 +96,7 @@ export { registerApplicationCommands, runCheck as runApplicationCheck } from '..
 export { registerArtifactCommands, runArtifact } from '../cli/release-cmd.js';
 export { ARTIFACT_DIFF_SCHEMA, DELIVERY_ARTIFACT_MANIFEST_SCHEMA, RELEASE_ENVELOPE_SCHEMA, ROUTE_REALIZATION_TABLE_SCHEMA, atomicWritePointer, canonicalJson, diffArtifacts, loadReleaseEnvelope, packRelease, publishRelease, readPointer, rollbackRelease, sha256File, sha256Hex, } from './release-pack.js';
 export { STATIC_DELIVERY_MANIFEST_SCHEMA, emitWebStatic } from './static-emit.js';
-export { CONTENT_ADDRESSED_ASSETS_SCHEMA, emitContentAddressedAssets, resolveAssetByDigest, assertSharedAssetPath, contentAddressedAssetsDigest, rewriteCssImports, rewriteJsEntryRelativeImports, } from './content-addressed-assets.js';
+export { CONTENT_ADDRESSED_ASSETS_SCHEMA, emitContentAddressedAssets, resolveAssetByDigest, assertSharedAssetPath, contentAddressedAssetsDigest, rewriteCssImports, } from './content-addressed-assets.js';
 export { SITE_FAVICON_SCHEMA, emitSiteFavicon, readSiteFaviconHeadHtml, packPngsIntoIco } from './site-favicon.js';
 export { PUBLIC_STATIC_ASSETS_SCHEMA, emitPublicStaticAssets } from './public-static-assets.js';
 export { CDN_POLICY_MANIFEST_SCHEMA, CDN_ADAPTER_PROJECTION_SCHEMA, CACHE_HTML, CACHE_ASSET_IMMUTABLE, CACHE_META, buildCdnPolicyManifest, emitCdnPolicy, projectCdnAdapter, createLocalStaticHandler, listenLocalStaticHost, matchGlob, } from './cdn-policy.js';
@@ -105,7 +105,9 @@ export { EMBEDDED_RESOURCE_INDEX_SCHEMA, emitEmbeddedPackaging } from './embedde
 export { SERVER_LANG_IDS, SERVER_LANG_ALIASES, SERVER_LANGUAGE_BACKENDS, resolveServerLanguage, assertLangRuntimePair, } from './server-language-backend.js';
 export { WECHAT_PACKAGING_SCHEMA, WECHAT_PACKAGING_REL, wechatPackagingFromDelivery, materializeWechatPackaging, prepareWechatPackaging, } from './wechat-packaging.js';
 export { DELIVERY_PROFILE_AUTHORING_SCHEMA, BUILD_PROFILE_SELECTION_SCHEMA, ASSEMBLIES, SERVER_RUNTIMES, BUILTIN_PROFILES, pickSiteAuthoring, pickDeliveryPackaging, normalizeProfileArtifactName, resolveProfileArtifactDir, normalizeDeliveryAuthoring, selectBuildProfile, semanticIdsForAssembly, } from '../delivery/delivery-profile.js';
-export { PACK_MANIFEST_SCHEMA, packFromDeploymentIr, ensureRuntimeCompanions } from './pack.js';
+export { PACK_MANIFEST_SCHEMA, PACK_OUTPUT_DIR_REL, PACK_PUBLIC_BASE, PACK_NODE_MANIFEST_SCHEMA, PACK_NODE_OUTPUT_DIR_REL, PACK_NODE_MANIFEST_REL, packFromDeploymentIr, packSsrFromDeploymentIr, packEntryHref, packNodeEntryFile, ensureRuntimeCompanions, } from './pack.js';
+export { buildPackRequest, runPackPlan, runPackWrite, PackNativeError } from './pack-native.js';
+export type { PackNativeBinding, PackPlan, PackPlanResponse, PackDiagnostic, PackRequest, PackRequestEntry, PackRequestUse, PackTarget, } from './pack-native.js';
 export { SERVER_ARTIFACT_SCHEMA, HTTP_CONTRACT_SCHEMA, SERVER_RUNTIME_ADAPTER_SCHEMA, emitServerArtifact, projectServerRuntimeAdapter, } from './server-artifact.js';
 export { BUILD_PROOF_SCHEMA, ASSEMBLE_MANIFEST_SCHEMA, assembleDelivery, emitBuildProof } from './build-assemble.js';
 export { buildProjectToOutDirRoot, type BuildProjectOptions, type BuildProjectResult } from './project-build.js';
@@ -116,7 +118,9 @@ export { absoluteUrl, assertLocaleCacheKey, buildLocalePageMeta, buildLocaleRout
 export { LOCALE_ROUTE_REALIZATION_ARTIFACT_SCHEMA, emitLocaleRouteRealization } from '../locale/locale-route-emit.js';
 export { assertHostMessageInvariant, assertServerErrorEnvelope, assertServerFormatContext, buildLocaleDeliveryResolution, checkLocaleDelivery, fallbackDigest, messageCatalogHash, proveMiniPackageMessages, validateNativeLocalePack, } from '../locale/locale-delivery.js';
 export { checkLocaleConformance, diffLocaleCatalogs, explainLocaleMessage, extractHardcodedText, pseudoLocalizeCatalog, } from '../locale/locale-tooling.js';
-export { applyPlugins, contentHash, defineConfig, definePlugin, loadVmzConfig } from './plugin-host.js';
+export { applyPlugins, contentHash, definePlugin, loadVmzConfig } from './plugin-host.js';
+export { defineConfig } from './user-config.js';
+export type { DeliveryAssembly, DeliveryAuthoring, DeliveryPackagingAuthoring, DeliveryProfileAuthoring, DeliveryServerRuntime, SiteDeliveryAuthoring, VmzFormatConfig, VmzUserConfig, WechatPackagingAuthoring, } from './user-config.js';
 export { createRolldownPluginVmzAdapter, createVitePluginVmzAdapter, loadDeploymentIr, planAffectedBundleInputs, planBundleInputs, } from './bundler-adapter.js';
 declare const _default: {
     HOST_PROTOCOL: string;

package/dist/workspace/public-api.js

@@ -284,7 +284,7 @@ export { ARTIFACT_DIFF_SCHEMA, DELIVERY_ARTIFACT_MANIFEST_SCHEMA, RELEASE_ENVELO
 // APPLICATION_ARTIFACT_SCHEMA lives in @vmz/protocol (already re-exported above);
 // release-pack keeps a local constant for envelope writes — do not dual-export the name.
 export { STATIC_DELIVERY_MANIFEST_SCHEMA, emitWebStatic } from './static-emit.js';
-export { CONTENT_ADDRESSED_ASSETS_SCHEMA, emitContentAddressedAssets, resolveAssetByDigest, assertSharedAssetPath, contentAddressedAssetsDigest, rewriteCssImports, rewriteJsEntryRelativeImports, } from './content-addressed-assets.js';
+export { CONTENT_ADDRESSED_ASSETS_SCHEMA, emitContentAddressedAssets, resolveAssetByDigest, assertSharedAssetPath, contentAddressedAssetsDigest, rewriteCssImports, } from './content-addressed-assets.js';
 export { SITE_FAVICON_SCHEMA, emitSiteFavicon, readSiteFaviconHeadHtml, packPngsIntoIco } from './site-favicon.js';
 export { PUBLIC_STATIC_ASSETS_SCHEMA, emitPublicStaticAssets } from './public-static-assets.js';
 export { CDN_POLICY_MANIFEST_SCHEMA, CDN_ADAPTER_PROJECTION_SCHEMA, CACHE_HTML, CACHE_ASSET_IMMUTABLE, CACHE_META, buildCdnPolicyManifest, emitCdnPolicy, projectCdnAdapter, createLocalStaticHandler, listenLocalStaticHost, matchGlob, } from './cdn-policy.js';
@@ -293,7 +293,8 @@ export { EMBEDDED_RESOURCE_INDEX_SCHEMA, emitEmbeddedPackaging } from './embedde
 export { SERVER_LANG_IDS, SERVER_LANG_ALIASES, SERVER_LANGUAGE_BACKENDS, resolveServerLanguage, assertLangRuntimePair, } from './server-language-backend.js';
 export { WECHAT_PACKAGING_SCHEMA, WECHAT_PACKAGING_REL, wechatPackagingFromDelivery, materializeWechatPackaging, prepareWechatPackaging, } from './wechat-packaging.js';
 export { DELIVERY_PROFILE_AUTHORING_SCHEMA, BUILD_PROFILE_SELECTION_SCHEMA, ASSEMBLIES, SERVER_RUNTIMES, BUILTIN_PROFILES, pickSiteAuthoring, pickDeliveryPackaging, normalizeProfileArtifactName, resolveProfileArtifactDir, normalizeDeliveryAuthoring, selectBuildProfile, semanticIdsForAssembly, } from '../delivery/delivery-profile.js';
-export { PACK_MANIFEST_SCHEMA, packFromDeploymentIr, ensureRuntimeCompanions } from './pack.js';
+export { PACK_MANIFEST_SCHEMA, PACK_OUTPUT_DIR_REL, PACK_PUBLIC_BASE, PACK_NODE_MANIFEST_SCHEMA, PACK_NODE_OUTPUT_DIR_REL, PACK_NODE_MANIFEST_REL, packFromDeploymentIr, packSsrFromDeploymentIr, packEntryHref, packNodeEntryFile, ensureRuntimeCompanions, } from './pack.js';
+export { buildPackRequest, runPackPlan, runPackWrite, PackNativeError } from './pack-native.js';
 export { SERVER_ARTIFACT_SCHEMA, HTTP_CONTRACT_SCHEMA, SERVER_RUNTIME_ADAPTER_SCHEMA, emitServerArtifact, projectServerRuntimeAdapter, } from './server-artifact.js';
 export { BUILD_PROOF_SCHEMA, ASSEMBLE_MANIFEST_SCHEMA, assembleDelivery, emitBuildProof } from './build-assemble.js';
 export { buildProjectToOutDirRoot } from './project-build.js';
@@ -304,7 +305,8 @@ export { absoluteUrl, assertLocaleCacheKey, buildLocalePageMeta, buildLocaleRout
 export { LOCALE_ROUTE_REALIZATION_ARTIFACT_SCHEMA, emitLocaleRouteRealization } from '../locale/locale-route-emit.js';
 export { assertHostMessageInvariant, assertServerErrorEnvelope, assertServerFormatContext, buildLocaleDeliveryResolution, checkLocaleDelivery, fallbackDigest, messageCatalogHash, proveMiniPackageMessages, validateNativeLocalePack, } from '../locale/locale-delivery.js';
 export { checkLocaleConformance, diffLocaleCatalogs, explainLocaleMessage, extractHardcodedText, pseudoLocalizeCatalog, } from '../locale/locale-tooling.js';
-export { applyPlugins, contentHash, defineConfig, definePlugin, loadVmzConfig } from './plugin-host.js';
+export { applyPlugins, contentHash, definePlugin, loadVmzConfig } from './plugin-host.js';
+export { defineConfig } from './user-config.js';
 export { createRolldownPluginVmzAdapter, createVitePluginVmzAdapter, loadDeploymentIr, planAffectedBundleInputs, planBundleInputs, } from './bundler-adapter.js';
 export default {
     HOST_PROTOCOL,