@vmz/vmz 0.3.12 → 0.3.14

package/dist/workspace/project-build.js

@@ -9,9 +9,11 @@ import { normalizeDeliveryAuthoring, resolveProfileArtifactDir, selectBuildProfi
 import { buildIntegratedDocuments, projectHasDocuments } from '../document/document-integrate.js';
 import { emitLocaleRuntimeModules, localeHasErrors } from '../locale/locale-check.js';
 import { emitLocaleRouteRealization } from '../locale/locale-route-emit.js';
-import { packFromDeploymentIr } from './pack.js';
+import { ensureRuntimeCompanions, packFromDeploymentIr, packSsrFromDeploymentIr } from './pack.js';
 import { loadVmzConfig } from './plugin-host.js';
 import { emitRouteCatalog } from './route-catalog-emit.js';
+import { resolveCoreRuntimeDist } from './runtime-dist.js';
+import { emitStaticBootstrapEntries } from './static-emit.js';
 function dedupeDiagnostics(list) {
     const seen = new Set();
     const out = [];
@@ -81,7 +83,7 @@ export async function buildProjectToOutDirRoot(project, outDirRoot, opts = {}) {
     const assembly = String(selected.selection.assembly || '');
     const profileId = String(selected.selection.profileId || '');
     // Dynamic import avoids init cycle with `./index.js` re-exports.
-    const { createWorkspace, resolveCoreRuntimeDist } = await import('./public-api.js');
+    const { createWorkspace } = await import('./public-api.js');
     const ws = createWorkspace({ root: project, outDir: artifactDir });
     try {
         const code = await runWithPlugins(ws, project, artifactDir, () => {
@@ -141,8 +143,26 @@ export async function buildProjectToOutDirRoot(project, outDirRoot, opts = {}) {
                 error: routeCatalog.error || 'route catalog emit failed',
             };
         }
+        try {
+            // Node graph must be packed before any SSR consumer (document build,
+            // static emit, render host) imports a compiled chunk. Companions are
+            // copied first so the Node graph sees the delivery runtime beside the
+            // client modules.
+            ensureRuntimeCompanions(artifactDir, resolveCoreRuntimeDist());
+            packSsrFromDeploymentIr(artifactDir, { projectRoot: project });
+        }
+        catch (err) {
+            return {
+                ok: false,
+                outDirRoot: root,
+                artifactDir,
+                deliveryName,
+                diagnostics,
+                error: `node pack failed: ${err instanceof Error ? err.message : String(err)}`,
+            };
+        }
         if (projectHasDocuments(project)) {
-            const docs = await buildIntegratedDocuments({ projectRoot: project, outDir: artifactDir });
+            const docs = await buildIntegratedDocuments({ projectRoot: project, outDir: artifactDir, engines: cfg.engines });
             if (!docs.ok) {
                 return {
                     ok: false,
@@ -156,11 +176,13 @@ export async function buildProjectToOutDirRoot(project, outDirRoot, opts = {}) {
         }
         let pack;
         try {
+            // Browser pack entries are the static bootstrap modules; static emit
+            // runs after pack (HTML resolves `_vmz/pack/`), so write them first.
+            emitStaticBootstrapEntries(artifactDir);
             pack = packFromDeploymentIr(artifactDir, {
                 release: Boolean(opts.release),
                 profileId,
                 assembly,
-                coreDist: resolveCoreRuntimeDist(),
                 projectRoot: project,
             });
         }

package/dist/workspace/public-api.d.ts

@@ -96,7 +96,7 @@ export { registerApplicationCommands, runCheck as runApplicationCheck } from '..
 export { registerArtifactCommands, runArtifact } from '../cli/release-cmd.js';
 export { ARTIFACT_DIFF_SCHEMA, DELIVERY_ARTIFACT_MANIFEST_SCHEMA, RELEASE_ENVELOPE_SCHEMA, ROUTE_REALIZATION_TABLE_SCHEMA, atomicWritePointer, canonicalJson, diffArtifacts, loadReleaseEnvelope, packRelease, publishRelease, readPointer, rollbackRelease, sha256File, sha256Hex, } from './release-pack.js';
 export { STATIC_DELIVERY_MANIFEST_SCHEMA, emitWebStatic } from './static-emit.js';
-export { CONTENT_ADDRESSED_ASSETS_SCHEMA, emitContentAddressedAssets, resolveAssetByDigest, assertSharedAssetPath, contentAddressedAssetsDigest, rewriteCssImports, rewriteJsEntryRelativeImports, } from './content-addressed-assets.js';
+export { CONTENT_ADDRESSED_ASSETS_SCHEMA, emitContentAddressedAssets, resolveAssetByDigest, assertSharedAssetPath, contentAddressedAssetsDigest, rewriteCssImports, } from './content-addressed-assets.js';
 export { SITE_FAVICON_SCHEMA, emitSiteFavicon, readSiteFaviconHeadHtml, packPngsIntoIco } from './site-favicon.js';
 export { PUBLIC_STATIC_ASSETS_SCHEMA, emitPublicStaticAssets } from './public-static-assets.js';
 export { CDN_POLICY_MANIFEST_SCHEMA, CDN_ADAPTER_PROJECTION_SCHEMA, CACHE_HTML, CACHE_ASSET_IMMUTABLE, CACHE_META, buildCdnPolicyManifest, emitCdnPolicy, projectCdnAdapter, createLocalStaticHandler, listenLocalStaticHost, matchGlob, } from './cdn-policy.js';
@@ -105,7 +105,9 @@ export { EMBEDDED_RESOURCE_INDEX_SCHEMA, emitEmbeddedPackaging } from './embedde
 export { SERVER_LANG_IDS, SERVER_LANG_ALIASES, SERVER_LANGUAGE_BACKENDS, resolveServerLanguage, assertLangRuntimePair, } from './server-language-backend.js';
 export { WECHAT_PACKAGING_SCHEMA, WECHAT_PACKAGING_REL, wechatPackagingFromDelivery, materializeWechatPackaging, prepareWechatPackaging, } from './wechat-packaging.js';
 export { DELIVERY_PROFILE_AUTHORING_SCHEMA, BUILD_PROFILE_SELECTION_SCHEMA, ASSEMBLIES, SERVER_RUNTIMES, BUILTIN_PROFILES, pickSiteAuthoring, pickDeliveryPackaging, normalizeProfileArtifactName, resolveProfileArtifactDir, normalizeDeliveryAuthoring, selectBuildProfile, semanticIdsForAssembly, } from '../delivery/delivery-profile.js';
-export { PACK_MANIFEST_SCHEMA, packFromDeploymentIr, ensureRuntimeCompanions } from './pack.js';
+export { PACK_MANIFEST_SCHEMA, PACK_OUTPUT_DIR_REL, PACK_PUBLIC_BASE, PACK_NODE_MANIFEST_SCHEMA, PACK_NODE_OUTPUT_DIR_REL, PACK_NODE_MANIFEST_REL, packFromDeploymentIr, packSsrFromDeploymentIr, packEntryHref, packNodeEntryFile, ensureRuntimeCompanions, } from './pack.js';
+export { buildPackRequest, runPackPlan, runPackWrite, PackNativeError } from './pack-native.js';
+export type { PackNativeBinding, PackPlan, PackPlanResponse, PackDiagnostic, PackRequest, PackRequestEntry, PackRequestUse, PackTarget, } from './pack-native.js';
 export { SERVER_ARTIFACT_SCHEMA, HTTP_CONTRACT_SCHEMA, SERVER_RUNTIME_ADAPTER_SCHEMA, emitServerArtifact, projectServerRuntimeAdapter, } from './server-artifact.js';
 export { BUILD_PROOF_SCHEMA, ASSEMBLE_MANIFEST_SCHEMA, assembleDelivery, emitBuildProof } from './build-assemble.js';
 export { buildProjectToOutDirRoot, type BuildProjectOptions, type BuildProjectResult } from './project-build.js';
@@ -116,7 +118,9 @@ export { absoluteUrl, assertLocaleCacheKey, buildLocalePageMeta, buildLocaleRout
 export { LOCALE_ROUTE_REALIZATION_ARTIFACT_SCHEMA, emitLocaleRouteRealization } from '../locale/locale-route-emit.js';
 export { assertHostMessageInvariant, assertServerErrorEnvelope, assertServerFormatContext, buildLocaleDeliveryResolution, checkLocaleDelivery, fallbackDigest, messageCatalogHash, proveMiniPackageMessages, validateNativeLocalePack, } from '../locale/locale-delivery.js';
 export { checkLocaleConformance, diffLocaleCatalogs, explainLocaleMessage, extractHardcodedText, pseudoLocalizeCatalog, } from '../locale/locale-tooling.js';
-export { applyPlugins, contentHash, defineConfig, definePlugin, loadVmzConfig } from './plugin-host.js';
+export { applyPlugins, contentHash, definePlugin, loadVmzConfig } from './plugin-host.js';
+export { defineConfig } from './user-config.js';
+export type { DeliveryAssembly, DeliveryAuthoring, DeliveryPackagingAuthoring, DeliveryProfileAuthoring, DeliveryServerRuntime, SiteDeliveryAuthoring, VmzFormatConfig, VmzUserConfig, WechatPackagingAuthoring, } from './user-config.js';
 export { createRolldownPluginVmzAdapter, createVitePluginVmzAdapter, loadDeploymentIr, planAffectedBundleInputs, planBundleInputs, } from './bundler-adapter.js';
 declare const _default: {
     HOST_PROTOCOL: string;

package/dist/workspace/public-api.js

@@ -284,7 +284,7 @@ export { ARTIFACT_DIFF_SCHEMA, DELIVERY_ARTIFACT_MANIFEST_SCHEMA, RELEASE_ENVELO
 // APPLICATION_ARTIFACT_SCHEMA lives in @vmz/protocol (already re-exported above);
 // release-pack keeps a local constant for envelope writes — do not dual-export the name.
 export { STATIC_DELIVERY_MANIFEST_SCHEMA, emitWebStatic } from './static-emit.js';
-export { CONTENT_ADDRESSED_ASSETS_SCHEMA, emitContentAddressedAssets, resolveAssetByDigest, assertSharedAssetPath, contentAddressedAssetsDigest, rewriteCssImports, rewriteJsEntryRelativeImports, } from './content-addressed-assets.js';
+export { CONTENT_ADDRESSED_ASSETS_SCHEMA, emitContentAddressedAssets, resolveAssetByDigest, assertSharedAssetPath, contentAddressedAssetsDigest, rewriteCssImports, } from './content-addressed-assets.js';
 export { SITE_FAVICON_SCHEMA, emitSiteFavicon, readSiteFaviconHeadHtml, packPngsIntoIco } from './site-favicon.js';
 export { PUBLIC_STATIC_ASSETS_SCHEMA, emitPublicStaticAssets } from './public-static-assets.js';
 export { CDN_POLICY_MANIFEST_SCHEMA, CDN_ADAPTER_PROJECTION_SCHEMA, CACHE_HTML, CACHE_ASSET_IMMUTABLE, CACHE_META, buildCdnPolicyManifest, emitCdnPolicy, projectCdnAdapter, createLocalStaticHandler, listenLocalStaticHost, matchGlob, } from './cdn-policy.js';
@@ -293,7 +293,8 @@ export { EMBEDDED_RESOURCE_INDEX_SCHEMA, emitEmbeddedPackaging } from './embedde
 export { SERVER_LANG_IDS, SERVER_LANG_ALIASES, SERVER_LANGUAGE_BACKENDS, resolveServerLanguage, assertLangRuntimePair, } from './server-language-backend.js';
 export { WECHAT_PACKAGING_SCHEMA, WECHAT_PACKAGING_REL, wechatPackagingFromDelivery, materializeWechatPackaging, prepareWechatPackaging, } from './wechat-packaging.js';
 export { DELIVERY_PROFILE_AUTHORING_SCHEMA, BUILD_PROFILE_SELECTION_SCHEMA, ASSEMBLIES, SERVER_RUNTIMES, BUILTIN_PROFILES, pickSiteAuthoring, pickDeliveryPackaging, normalizeProfileArtifactName, resolveProfileArtifactDir, normalizeDeliveryAuthoring, selectBuildProfile, semanticIdsForAssembly, } from '../delivery/delivery-profile.js';
-export { PACK_MANIFEST_SCHEMA, packFromDeploymentIr, ensureRuntimeCompanions } from './pack.js';
+export { PACK_MANIFEST_SCHEMA, PACK_OUTPUT_DIR_REL, PACK_PUBLIC_BASE, PACK_NODE_MANIFEST_SCHEMA, PACK_NODE_OUTPUT_DIR_REL, PACK_NODE_MANIFEST_REL, packFromDeploymentIr, packSsrFromDeploymentIr, packEntryHref, packNodeEntryFile, ensureRuntimeCompanions, } from './pack.js';
+export { buildPackRequest, runPackPlan, runPackWrite, PackNativeError } from './pack-native.js';
 export { SERVER_ARTIFACT_SCHEMA, HTTP_CONTRACT_SCHEMA, SERVER_RUNTIME_ADAPTER_SCHEMA, emitServerArtifact, projectServerRuntimeAdapter, } from './server-artifact.js';
 export { BUILD_PROOF_SCHEMA, ASSEMBLE_MANIFEST_SCHEMA, assembleDelivery, emitBuildProof } from './build-assemble.js';
 export { buildProjectToOutDirRoot } from './project-build.js';
@@ -304,7 +305,8 @@ export { absoluteUrl, assertLocaleCacheKey, buildLocalePageMeta, buildLocaleRout
 export { LOCALE_ROUTE_REALIZATION_ARTIFACT_SCHEMA, emitLocaleRouteRealization } from '../locale/locale-route-emit.js';
 export { assertHostMessageInvariant, assertServerErrorEnvelope, assertServerFormatContext, buildLocaleDeliveryResolution, checkLocaleDelivery, fallbackDigest, messageCatalogHash, proveMiniPackageMessages, validateNativeLocalePack, } from '../locale/locale-delivery.js';
 export { checkLocaleConformance, diffLocaleCatalogs, explainLocaleMessage, extractHardcodedText, pseudoLocalizeCatalog, } from '../locale/locale-tooling.js';
-export { applyPlugins, contentHash, defineConfig, definePlugin, loadVmzConfig } from './plugin-host.js';
+export { applyPlugins, contentHash, definePlugin, loadVmzConfig } from './plugin-host.js';
+export { defineConfig } from './user-config.js';
 export { createRolldownPluginVmzAdapter, createVitePluginVmzAdapter, loadDeploymentIr, planAffectedBundleInputs, planBundleInputs, } from './bundler-adapter.js';
 export default {
     HOST_PROTOCOL,

package/dist/workspace/static-emit.d.ts

@@ -9,6 +9,12 @@ export type EmitWebStaticOpts = {
     applicationId?: string;
     staticParams?: Record<string, Array<Record<string, string>>>;
     projectRoot?: string;
+    /** Assembly recorded in the manifest (`local-static` overrides the static default). */
+    deliveryProfile?: string;
+    /** Build cancellation signal, forwarded into the SSR `onMount` budget race. */
+    signal?: AbortSignal;
+    /** Per-instance SSR `onMount` budget in ms (runtime default applies when unset). */
+    onMountBudgetMs?: number;
 };
 type StaticDeliveryManifest = {
     schema: string;
@@ -134,4 +140,28 @@ export declare function emitWebStatic(distDir: string, opts?: EmitWebStaticOpts)
         };
     };
 }>;
+/**
+ * Write the browser bootstrap modules ahead of the pack stage: `pack` needs the
+ * literal dynamic-import tables in `entry-client.js` / `entry-event.js` as graph
+ * entries and must run before HTML emit (HTML resolves `_vmz/pack/` URLs). The
+ * static emit stage re-runs the same function, so both passes produce identical
+ * bytes.
+ * @param {string} distDir
+ * @returns {string[]} written bootstrap file names
+ */
+export declare function emitStaticBootstrapEntries(distDir: any): string[];
+/**
+ * Prune the web-static delivery to its final browser set after HTML emit:
+ * remove the Node-only serve-host material (`_vmz/host/`, `vmz-serve-host.mjs`)
+ * and every unpacked module JS/map that `_vmz/pack/` chunks supersede
+ * (bootstrap entries, page/component/layout units, server faces, `#server/`,
+ * `ssr/`). The `/dom.browser.js` face closure stays — the packed navigation
+ * keeps that root-URL load by contract. JSON metadata and assets are untouched.
+ * Only `vmz serve` re-materializes the host (`materializeServeHostRuntime`);
+ * static hosting never needs it.
+ */
+export declare function pruneWebStaticDelivery(outDir: string): {
+    removed: number;
+    keptFaces: string[];
+};
 export {};

package/dist/workspace/static-emit.js

@@ -6,7 +6,7 @@ import crypto from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
 import { pathToFileURL } from 'node:url';
-import { listClientComponentsSync } from '@vmz/core/component-registry';
+import { collectDependsOnClosure, listClientComponentsSync, readDeploymentDocument } from '@vmz/core/component-registry';
 import { createRenderHost } from '@vmz/core/render-host';
 import { resolveRouteLayoutChain } from '@vmz/core/route-layout-chain';
 import { emitCdnPolicy } from './cdn-policy.js';
@@ -14,6 +14,7 @@ import { emitContentAddressedAssets, hashedAssetHref } from './content-addressed
 import { LOCALE_LINK_PLAN_REL } from '../locale/locale-route-emit.js';
 import { absoluteUrl, applyLocaleLinkPlan, buildLocaleLinkPlan, buildLocalePageMeta, linkRouteAliasesFromUnits, } from '../locale/locale-router.js';
 import { requireNativeAddon } from './native-addon.js';
+import { PACK_NODE_MANIFEST_REL, PACK_NODE_OUTPUT_DIR_REL, packEntryHref, packNodeEntryFile } from './pack.js';
 import { writePrettyJsonFile } from './pretty-json.js';
 import { emitPublicStaticAssets } from './public-static-assets.js';
 import { emitRouteCatalog, loadRouteCatalog, ROUTE_CATALOG_SCHEMA } from './route-catalog-emit.js';
@@ -23,6 +24,7 @@ export const STATIC_EMIT_PLAN_SCHEMA = 'vmz.static.emit_plan.v0';
 export async function emitWebStatic(distDir, opts = {}) {
     const origin = String(opts.origin || process.env.VMZ_SITE_ORIGIN || 'https://example.test').replace(/\/$/, '');
     const applicationId = opts.applicationId || path.basename(path.dirname(distDir));
+    const deliveryProfile = String(opts.deliveryProfile || 'static');
     const domPath = path.join(distDir, 'vmz-dom.js');
     if (!fs.existsSync(domPath)) {
         throw new Error(`emitWebStatic: missing ${domPath} — run vmz build first`);
@@ -32,6 +34,9 @@ export async function emitWebStatic(distDir, opts = {}) {
     const publicAssets = emitPublicStaticAssets(distDir, { projectRoot: opts.projectRoot });
     const host = await createRenderHost(distDir, { strictDeployment: true, preload: 'none' });
     const { renderToString, renderToStream } = host;
+    // One budget/signal pair for every SSR render of this build: a hung or
+    // aborted `onMount` fails the page build instead of stalling it.
+    const renderOpts = { signal: opts.signal ?? undefined, onMountBudgetMs: opts.onMountBudgetMs };
     const pageCatalog = listPageClientFiles(distDir);
     const generations = [];
     const skipped = [];
@@ -41,7 +46,9 @@ export async function emitWebStatic(distDir, opts = {}) {
     const assets = emitContentAddressedAssets(distDir);
     const cssLogical = readCssEntry(distDir);
     const cssEntry = hashedAssetHref(assets.rewrites, cssLogical) || hashedAssetHref(assets.rewrites, 'vmz.css');
-    const moduleScriptSrc = hashedAssetHref(assets.rewrites, 'entry-client.js') || '/entry-client.js';
+    // Packed browser JS is final-named under `_vmz/pack/` — resolve via the pack
+    // manifest entryFiles mapping; unpacked root bytes are never a fallback.
+    const moduleScriptSrc = packEntryHref(distDir, 'entry-client.js');
     const localeArt = loadLocaleArtifact(distDir);
     const localeLinkPlan = loadLocaleLinkPlan(distDir) || buildLocaleLinkPlan(withLinkRouteAliases(localeArt, distDir, pageCatalog));
     for (const page of pageCatalog) {
@@ -99,14 +106,23 @@ export async function emitWebStatic(distDir, opts = {}) {
         const layoutChain = resolveRouteLayoutChain(distDir, page.chunkId);
         await host.ensureComponents([page.chunkId, ...layoutChain]);
         let bodyHtml = '';
-        for await (const chunk of renderToStream(Page, props, {})) {
-            bodyHtml += chunk;
+        try {
+            for await (const chunk of renderToStream(Page, props, renderOpts)) {
+                bodyHtml += chunk;
+            }
+            for (let i = layoutChain.length - 1; i >= 0; i--) {
+                const Layout = await loadCtor(distDir, layoutChain[i]);
+                if (!Layout)
+                    continue;
+                bodyHtml = await renderToString(Layout, {}, { ...renderOpts, slotHtml: bodyHtml });
+            }
         }
-        for (let i = layoutChain.length - 1; i >= 0; i--) {
-            const Layout = await loadCtor(distDir, layoutChain[i]);
-            if (!Layout)
-                continue;
-            bodyHtml = await renderToString(Layout, {}, { slotHtml: bodyHtml });
+        catch (err) {
+            const detail = err instanceof Error ? err.message : String(err);
+            throw new Error(`emitWebStatic: SSR render failed for route ${pattern} (${page.chunkId}): ${detail}`, { cause: err });
+        }
+        if (opts.signal?.aborted) {
+            throw new Error(`emitWebStatic: build aborted during SSR render for route ${pattern} (${page.chunkId})`);
         }
         const localeWrites = expandLocaleStaticGenerations({
             localeArt,
@@ -188,7 +204,7 @@ export async function emitWebStatic(distDir, opts = {}) {
     const manifest = {
         schema: STATIC_DELIVERY_MANIFEST_SCHEMA,
         applicationId,
-        deliveryProfile: 'static',
+        deliveryProfile,
         origin,
         generatedAt: new Date().toISOString(),
         spaFallback: false,
@@ -232,7 +248,7 @@ export async function emitWebStatic(distDir, opts = {}) {
     writePrettyJsonFile(path.join(vmzDir, 'static-emit-plan.json'), {
         schema: STATIC_EMIT_PLAN_SCHEMA,
         applicationId,
-        deliveryProfile: 'static',
+        deliveryProfile,
         origin,
         localeLinks: localeLinkPlan,
         assetPlanPath: '_vmz/asset-plan.json',
@@ -331,8 +347,11 @@ function htmlPathForRoute(pathname) {
  * @param {string} chunkId
  */
 async function loadCtor(distDir, chunkId) {
-    const href = pathToFileURL(path.join(distDir, `${chunkId}.client.js`)).href;
-    const mod = await import(`${href}?t=${Date.now()}`);
+    // Node chunk identity comes from `_vmz/pack-node-manifest.json`; the
+    // unpacked root `${chunkId}.client.js` is not a fallback. No `?t=` cache
+    // bust: packed chunks are shared instance URLs.
+    const href = pathToFileURL(packNodeEntryFile(distDir, chunkId)).href;
+    const mod = await import(href);
     return mod.default;
 }
 /**
@@ -559,9 +578,14 @@ function buildSitemap(_origin, generations) {
     return native.generateSitemapXml(urls);
 }
 /**
- * Static CDN must ship entry-client/event like serve-host (content-addressed + HTML rewrite).
+ * Static CDN must ship entry-client/event like serve-host. The bootstrap tables
+ * are literal dynamic-import maps: page/layout units are keyed by chunkId
+ * (`data-vmz-page` / `data-vmz-layout` lookups) and islands are enumerated
+ * explicitly — unknown names throw at runtime by design, never via fallback
+ * specifier concatenation.
  * @param {string} distDir
  * @param {Array<{ chunkId: string }>} pageCatalog
+ * @returns {string[]} written bootstrap file names
  */
 function emitStaticClientEntries(distDir, pageCatalog) {
     const componentEntries = listClientComponentsSync(distDir, { strict: true });
@@ -571,16 +595,74 @@ function emitStaticClientEntries(distDir, pageCatalog) {
         .filter((e) => isEventResumeStrategy(e.strategy))
         .map((e) => e.component)
         .filter(Boolean));
-    const eager = componentEntries.filter((e) => !lazySet.has(e.name));
-    const lazy = componentEntries.filter((e) => lazySet.has(e.name));
+    // Pages/layouts resolve `<chunkId>.client.js` at the dist root (SSR loadCtor
+    // uses the same path); they must be in the table or hydration throws.
+    const pageEntries = pageCatalog.map((p) => ({ name: p.chunkId, entry: `${p.chunkId}.client.js` }));
+    const layoutNames = new Set();
+    for (const page of pageCatalog) {
+        for (const id of resolveRouteLayoutChain(distDir, page.chunkId))
+            layoutNames.add(String(id));
+    }
+    const layoutEntries = [...layoutNames].sort().map((id) => ({ name: id, entry: `${id}.client.js` }));
+    // 引导表只登记从页面/布局可达的组件：部署 IR 的 `dependsOn` 闭包之外的
+    // 组件没有任何模板引用，进入表只会变成 pack 死字节；不登记后 pack 图
+    // 不可达，prune 同时清掉未打包的散落模块。
+    const deployment = readDeploymentDocument(distDir, { strict: true });
+    const closure = collectDependsOnClosure(deployment, [...pageCatalog.map((p) => p.chunkId), ...layoutNames]);
+    const reachableComponents = componentEntries.filter((e) => closure.has(e.chunkId));
+    const eagerComponents = reachableComponents.filter((e) => !lazySet.has(e.name));
+    const lazyComponents = reachableComponents.filter((e) => lazySet.has(e.name));
+    const eager = [...eagerComponents, ...pageEntries, ...layoutEntries];
     const native = requireNativeAddon();
     if (typeof native.generateServeEntryClient !== 'function') {
         throw new Error('vmz native addon missing generateServeEntryClient — rebuild with `pnpm napi:build`');
     }
-    fs.writeFileSync(path.join(distDir, 'entry-client.js'), native.generateServeEntryClient(eager, lazy, ''), 'utf8');
+    const written = ['entry-client.js'];
+    fs.writeFileSync(path.join(distDir, 'entry-client.js'), native.generateServeEntryClient(eager, lazyComponents, ''), 'utf8');
     if (typeof native.generateServeEntryEvent === 'function') {
-        fs.writeFileSync(path.join(distDir, 'entry-event.js'), native.generateServeEntryEvent(''), 'utf8');
+        // Event shell islands: event-strategy components + document islands whose
+        // compiled module exists in the component set (explicit enumeration).
+        const islandNames = readDocumentIslandNames(distDir);
+        const islands = [...lazyComponents];
+        for (const entry of eagerComponents) {
+            if (islandNames.has(entry.name))
+                islands.push(entry);
+        }
+        fs.writeFileSync(path.join(distDir, 'entry-event.js'), native.generateServeEntryEvent([], islands, ''), 'utf8');
+        written.push('entry-event.js');
     }
+    return written;
+}
+/**
+ * Write the browser bootstrap modules ahead of the pack stage: `pack` needs the
+ * literal dynamic-import tables in `entry-client.js` / `entry-event.js` as graph
+ * entries and must run before HTML emit (HTML resolves `_vmz/pack/` URLs). The
+ * static emit stage re-runs the same function, so both passes produce identical
+ * bytes.
+ * @param {string} distDir
+ * @returns {string[]} written bootstrap file names
+ */
+export function emitStaticBootstrapEntries(distDir) {
+    return emitStaticClientEntries(distDir, listPageClientFiles(distDir));
+}
+/**
+ * Island names from an integrated document surface (`document.islands.json`,
+ * written by the document build into the same dist). Absent file → no islands.
+ * @param {string} distDir
+ */
+function readDocumentIslandNames(distDir) {
+    const names = new Set();
+    try {
+        const plan = JSON.parse(fs.readFileSync(path.join(distDir, 'document.islands.json'), 'utf8'));
+        for (const island of plan?.islands || []) {
+            if (typeof island?.name === 'string' && island.name)
+                names.add(island.name);
+        }
+    }
+    catch {
+        /* no document surface */
+    }
+    return names;
 }
 /**
  * @param {string} distDir
@@ -605,3 +687,114 @@ function loadPageResumeEntriesSync(distDir, chunkId) {
 function isEventResumeStrategy(strategy) {
     return strategy === 'event' || strategy === 'click' || String(strategy).startsWith('event:');
 }
+/** Runtime face barrel loaded by URL (`import('/dom.browser.js')`) in the packed client navigation. */
+const FACE_ENTRY_REL = 'dom.browser.js';
+/**
+ * Transitive closure of the URL-loaded browser face: start at `dom.browser.js`
+ * and follow relative import specifiers that resolve to files in the dist tree.
+ * Everything else that is executable JS is either packed into `_vmz/pack/` or
+ * Node-side, so it must not ship in a web-static delivery.
+ */
+function collectFaceClosure(abs) {
+    const closure = new Set();
+    if (!fs.existsSync(path.join(abs, FACE_ENTRY_REL)))
+        return closure;
+    const queue = [FACE_ENTRY_REL];
+    while (queue.length) {
+        const rel = queue.shift();
+        if (closure.has(rel))
+            continue;
+        closure.add(rel);
+        let text;
+        try {
+            text = fs.readFileSync(path.join(abs, ...rel.split('/')), 'utf8');
+        }
+        catch {
+            continue;
+        }
+        const specs = [
+            ...text.matchAll(/from\s+['"](\.[^'"]+)['"]/g),
+            ...text.matchAll(/import\(\s*['"](\.[^'"]+)['"]/g),
+        ];
+        for (const m of specs) {
+            const next = path.posix.normalize(`${path.posix.dirname(rel)}/${m[1]}`);
+            if (next.startsWith('..'))
+                continue;
+            if (!fs.existsSync(path.join(abs, ...next.split('/'))))
+                continue;
+            if (!closure.has(next))
+                queue.push(next);
+        }
+    }
+    return closure;
+}
+function listFilesRecursive(abs, rel = '') {
+    const out = [];
+    for (const entry of fs.readdirSync(path.join(abs, ...rel.split('/')), { withFileTypes: true })) {
+        const nextRel = rel ? `${rel}/${entry.name}` : entry.name;
+        if (entry.isDirectory())
+            out.push(...listFilesRecursive(abs, nextRel));
+        else if (entry.isFile())
+            out.push(nextRel);
+    }
+    return out;
+}
+function removeEmptyDirsBottomUp(abs, rel = '') {
+    for (const entry of fs.readdirSync(path.join(abs, ...rel.split('/')), { withFileTypes: true })) {
+        if (!entry.isDirectory())
+            continue;
+        const nextRel = rel ? `${rel}/${entry.name}` : entry.name;
+        if (nextRel === '_vmz/pack' || nextRel.startsWith('_vmz/pack/'))
+            continue;
+        removeEmptyDirsBottomUp(abs, nextRel);
+        if (nextRel === '_vmz')
+            continue;
+        if (fs.readdirSync(path.join(abs, ...nextRel.split('/'))).length === 0) {
+            fs.rmdirSync(path.join(abs, ...nextRel.split('/')));
+        }
+    }
+}
+/**
+ * Prune the web-static delivery to its final browser set after HTML emit:
+ * remove the Node-only serve-host material (`_vmz/host/`, `vmz-serve-host.mjs`)
+ * and every unpacked module JS/map that `_vmz/pack/` chunks supersede
+ * (bootstrap entries, page/component/layout units, server faces, `#server/`,
+ * `ssr/`). The `/dom.browser.js` face closure stays — the packed navigation
+ * keeps that root-URL load by contract. JSON metadata and assets are untouched.
+ * Only `vmz serve` re-materializes the host (`materializeServeHostRuntime`);
+ * static hosting never needs it.
+ */
+export function pruneWebStaticDelivery(outDir) {
+    const abs = path.resolve(outDir);
+    if (!fs.existsSync(abs))
+        throw new Error(`pruneWebStaticDelivery: missing dist ${abs}`);
+    const faceClosure = collectFaceClosure(abs);
+    let removed = 0;
+    for (const rel of listFilesRecursive(abs)) {
+        if (rel.startsWith('_vmz/pack/') || rel.startsWith('assets/'))
+            continue;
+        const isHost = rel.startsWith('_vmz/host/');
+        const isJs = rel.endsWith('.js') || rel.endsWith('.mjs') || rel.endsWith('.map');
+        if (!isHost && (!isJs || faceClosure.has(rel)))
+            continue;
+        fs.rmSync(path.join(abs, ...rel.split('/')), { force: true });
+        removed++;
+    }
+    // Node pack 是构建期产物：静态托管不会执行它，浏览器集已由 `_vmz/pack/`
+    // 定型。这里显式清掉 Node chunk 目录与 manifest，避免把服务端字节一起交付。
+    const nodePackDir = path.join(abs, ...PACK_NODE_OUTPUT_DIR_REL.split('/'));
+    if (fs.existsSync(nodePackDir)) {
+        for (const entry of fs.readdirSync(nodePackDir, { recursive: true, withFileTypes: true })) {
+            if (entry.isFile())
+                removed++;
+        }
+        fs.rmSync(nodePackDir, { recursive: true, force: true });
+    }
+    const nodeManifestPath = path.join(abs, ...PACK_NODE_MANIFEST_REL.split('/'));
+    if (fs.existsSync(nodeManifestPath)) {
+        fs.rmSync(nodeManifestPath, { force: true });
+        removed++;
+    }
+    removeEmptyDirsBottomUp(abs);
+    return { removed, keptFaces: [...faceClosure].sort() };
+}

package/dist/workspace/user-config.d.ts

@@ -0,0 +1,112 @@
+/**
+ * Application authoring config surface — `defineConfig` + `VmzUserConfig`.
+ *
+ * Ownership: the application config entry belongs to the `vmz` package (CLI /
+ * workspace host). `@vmz/plugin` keeps the plugin author surface (`definePlugin`,
+ * protocol types). Plugin-facing types (`VmzPlugin`, `VmzEngines`) stay in
+ * `@vmz/plugin` and are referenced here by type import only.
+ */
+import type { VmzEngines, VmzPlugin } from '@vmz/plugin';
+/**
+ * Format options (`vmz format` reads `vmz.config` `format`).
+ *
+ * Scope is always the explicit CLI path; config can only narrow it. There is
+ * no `includes` / language toggle here — `vmz format <path>` formats the
+ * given file or directory and nothing else.
+ */
+export interface VmzFormatConfig {
+    /** Skip paths under these globs inside an explicit directory target. */
+    excludes?: string[];
+    /** Biome-style formatter config (default: `biome.json` at project root). */
+    style?: string;
+}
+export interface VmzUserConfig {
+    plugins?: Array<string | VmzPlugin | Promise<VmzPlugin>>;
+    engines?: VmzEngines;
+    /** Format excludes / style (`vmz format` scope is the explicit CLI path). */
+    format?: VmzFormatConfig;
+    /** Application identity (optional authoring). */
+    application?: {
+        id?: string;
+        [key: string]: unknown;
+    };
+    /**
+     * Delivery: named profiles (`default` + `profiles`) or legacy site sugar.
+     * Pure data only; never a parallel `vmz.site.ts` entry.
+     */
+    delivery?: DeliveryAuthoring;
+}
+/** Site resource sources (embedded | filesystem | remote) — orthogonal to assembly. */
+export interface SiteDeliveryAuthoring {
+    artifact: string;
+    siteId?: string;
+    sources: Array<{
+        id: string;
+        kind: 'embedded' | 'filesystem' | 'remote';
+        directory?: string;
+        baseUrl?: string;
+        artifact?: string;
+        trust?: string;
+        timeoutMs?: number;
+        priority?: number;
+        integrity?: unknown;
+        signaturePolicy?: string;
+    }>;
+    resolution?: {
+        mode?: 'release';
+        fallback?: string[];
+    };
+    activation?: 'atomic';
+    expectedCompatibility?: unknown;
+    failure?: unknown;
+    failurePolicy?: unknown;
+    update?: unknown;
+    updatePolicy?: unknown;
+    rollback?: unknown;
+    rollbackPolicy?: unknown;
+    security?: unknown;
+    securityPolicy?: unknown;
+}
+export type DeliveryAssembly = 'local-static' | 'web-static' | 'server-host' | 'cdn+server' | 'rust-embedded';
+export type DeliveryServerRuntime = 'node' | 'worker' | 'deno' | 'bun' | 'rust-host';
+export interface DeliveryProfileAuthoring {
+    host?: 'browser';
+    assembly: DeliveryAssembly;
+    /**
+     * Artifact directory under CLI `--out-dir` (default = profile id).
+     * Example: profile `static` + `name: 'cdn'` → `dist/cdn`.
+     */
+    name?: string;
+    serverRuntime?: DeliveryServerRuntime;
+    /** Inline site sources or `defineSite({...})`. */
+    sources?: SiteDeliveryAuthoring | SiteDeliveryAuthoring['sources'];
+    artifact?: string;
+    resolution?: SiteDeliveryAuthoring['resolution'];
+    activation?: SiteDeliveryAuthoring['activation'];
+}
+/** WeChat DevTools project identity. Pure data; not WeChat JSON / wx.* APIs. */
+export interface WechatPackagingAuthoring {
+    /** Registered AppID. Omit for WeChat tourist mode (`touristappid`). */
+    appId?: string;
+    projectName?: string;
+    /** `app.json` `window.navigationBarTitleText`. */
+    title?: string;
+}
+/** Vendor packaging identity under `defineConfig({ delivery })`. */
+export interface DeliveryPackagingAuthoring {
+    wechat?: WechatPackagingAuthoring;
+}
+/** Named profiles (preferred) or legacy site-only sugar. */
+export type DeliveryAuthoring = {
+    default?: string;
+    profiles: Record<string, DeliveryProfileAuthoring>;
+    packaging?: DeliveryPackagingAuthoring;
+} | (SiteDeliveryAuthoring & {
+    default?: string;
+    assembly?: DeliveryAssembly;
+    host?: 'browser';
+    serverRuntime?: DeliveryServerRuntime;
+    packaging?: DeliveryPackagingAuthoring;
+});
+/** Identity helper for `vmz.config.ts` inference. */
+export declare function defineConfig(config: VmzUserConfig): VmzUserConfig;

package/dist/workspace/user-config.js

@@ -0,0 +1,12 @@
+/**
+ * Application authoring config surface — `defineConfig` + `VmzUserConfig`.
+ *
+ * Ownership: the application config entry belongs to the `vmz` package (CLI /
+ * workspace host). `@vmz/plugin` keeps the plugin author surface (`definePlugin`,
+ * protocol types). Plugin-facing types (`VmzPlugin`, `VmzEngines`) stay in
+ * `@vmz/plugin` and are referenced here by type import only.
+ */
+/** Identity helper for `vmz.config.ts` inference. */
+export function defineConfig(config) {
+    return config ?? {};
+}

package/host-runtime-files.json

@@ -14,6 +14,7 @@
         { "src": "host/serve/hmr-dev.js", "out": "_vmz/host/serve/hmr-dev.js", "rewriteVmzRuntimeImport": true },
         { "src": "host/serve/page-render.js", "out": "_vmz/host/serve/page-render.js", "rewriteVmzRuntimeImport": true },
         { "src": "host/serve/page-catalog.js", "out": "_vmz/host/serve/page-catalog.js" },
+        { "src": "host/serve/pack-entry.js", "out": "_vmz/host/serve/pack-entry.js" },
         { "src": "host/serve/locale-theme.js", "out": "_vmz/host/serve/locale-theme.js" },
         { "src": "host/serve/constants.js", "out": "_vmz/host/serve/constants.js" },
         { "src": "host/serve/route-catalog.js", "out": "_vmz/host/serve/route-catalog.js" },

package/locales/en-US/cli.json

@@ -5,10 +5,11 @@
     "cli.cmd.build": "Build project via Workspace",
     "cli.cmd.serve": "Serve dist (optional --build)",
     "cli.cmd.dev": "Rebuild session",
-    "cli.cmd.format": "Format workspace surfaces and .vmz via vmz.config format",
-    "cli.opt.format-no-javascript": "Skip JS/TS workspace format",
-    "cli.opt.format-no-rust": "Skip cargo fmt",
-    "cli.opt.format-no-vmz": "Skip .vmz author format",
+    "cli.cmd.format": "Format an explicit file/directory path (JS/TS, .vmz, .rs with --rust)",
+    "cli.opt.format-rust": "Also format .rs files under a directory target via rustfmt",
+    "cli.opt.format-no-javascript": "Reject JS/TS targets",
+    "cli.opt.format-no-rust": "Reject .rs targets",
+    "cli.opt.format-no-vmz": "Skip .vmz targets",
     "cli.cmd.lint": "Lint (= check) via N-API",
     "cli.cmd.test": "Native test discover / report",
     "cli.cmd.document": "Project /documents domain",

package/locales/en-US/diag.json

@@ -10,6 +10,8 @@
     "vmz::template::illegal_directive": "Illegal or unsupported directive in `<template>`: {detail}",
     "vmz::template::parse_failed": "Failed to parse `<template>`: {detail}",
     "vmz::template::invalid_expr": "Invalid template expression: {detail}",
+    "vmz::template::v_model_invalid_target": "`v-model` target must be an assignable identifier or member expression: `{expr}`",
+    "vmz::template::v_model_on_file_input": "`v-model` cannot bind an `<input type=\"file\">`",
     "vmz::template::each_missing_key": "`v-for` on `<{tag}>` should declare a `:key`",
     "vmz::template::each_static_key": "`v-for` on `<{tag}>` must not use a static key `{key}`",
     "vmz::template::each_literal_key": "`v-for` on `<{tag}>` must not use a literal key `{key}`",