Module build 

fz build <manifest> — the headless compile engine’s front door.

Parse and validate a venture manifest, resolve its module set against the catalog (the built-in one, or a release-stamped one via --catalog), and generate a deterministic Cloudflare venture crate (issue #138). This is standalone: it needs no compiled-in harness, because it produces one. It stops at source — turning the generated crate into a deployable wasm is worker-build and wrangler deploy, which the printed plan names as the next (toolchain / needs-human) steps.

Construct, never deploy (issue #142)

Construction and deployment are separate operations with separate credentials, and this command only ever constructs. It writes sources plus a provenance.json (Provenance) binding the artifact to the exact reviewed release pins resolution chose; it never runs wrangler, never contacts a deployment target, and refuses to attest a sanctioned build when the environment shows a deploy credential or any other contract gap. Wrangler remains the only holder of the path to production credentials.

sandbox_attestation_from_env is honest about what it is: a probe of this process’s environment. On the build service — whose environment the platform, not the tenant, controls — it is the machine-checkable form of the BuildEnvironmentAttestation contract, and every shortfall is a hard refusal with itemized reasons. On any other machine it proves nothing about isolation, which is exactly why a local build without the markers records attestation: null rather than a pass: an explicit gap beats a fake green check.

Functions

run

Runs fz build.