diff --git a/.gitignore b/.gitignore
index f780e6f..9207b06 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,3 +3,4 @@
 tmp/
 .idea/
 .vscode/
+*.bnp
diff --git a/Makefile b/Makefile
index 1df1179..1500a50 100644
--- a/Makefile
+++ b/Makefile
@@ -1,29 +1,59 @@
-# Earthen — build helpers (.so plugin workflow)
+# earthen — build & publish helpers (wasm .bnp workflow)
 #
-# Local build only. This Makefile deliberately does NOT include rebuild/deploy
-# targets to avoid touching the live CMS container during agent runs.
+# The theme compiles to a wasip1 reactor-mode wasm module packed into a .bnp
+# artifact (`ninja plugin build`). The legacy .so path is retired (WO-WZ-015):
+# the CMS is wasm-native and can no longer load .so plugins. Distribution is
+# publish-to-registry -> InstallFromRegistry (hot-load, no restart).
+#
+# Usage:
+#   make build          # compile wasm + pack earthen-<version>.bnp
+#   make verify         # validate the built .bnp (layout/abi/name/size)
+#   make archive-check  # prove a clean `git archive HEAD` compiles to wasm
+#   make publish        # ninja plugin publish --bnp (to the active registry)
+#   make templ          # regenerate templ Go files
+#   make clean          # remove build artefacts
 
-.PHONY: all clean templ help
+.PHONY: build verify archive-check publish templ clean help
 
 PLUGIN_NAME := earthen
+NINJA       := ninja
+BNP         := $(PLUGIN_NAME)-$(shell grep '^version' plugin.mod | sed 's/.*"\(.*\)"/\1/').bnp
 
-# Default target: build the .so locally.
-all: $(PLUGIN_NAME).so
+# Compile to wasm and pack the .bnp (GOOS=wasip1 GOARCH=wasm, DESCRIBE probe,
+# tar.zst of plugin.wasm + plugin.mod + manifest.pb + schemas/ + assets/).
+build:
+	$(NINJA) plugin build --dir .
 
-# Local plugin build.
-$(PLUGIN_NAME).so: $(wildcard *.go) plugin.mod go.mod
-	CGO_ENABLED=1 go build -buildmode=plugin -ldflags="-s -w" -o $(PLUGIN_NAME).so .
+# Validate the built .bnp exactly as the registry/loader will.
+verify:
+	$(NINJA) plugin verify $(BNP)
 
-# Regenerate templ Go files.
+# Prove a clean `git archive HEAD` (what publish ships) compiles to wasm.
+archive-check:
+	@T=$$(mktemp -d /tmp/archive-check-$(PLUGIN_NAME).XXXXXX) && \
+	trap 'rm -rf "$$T"' EXIT && \
+	git archive HEAD | tar -x -C "$$T" && \
+	cd "$$T" && GOOS=wasip1 GOARCH=wasm go build -buildmode=c-shared -o "$$T/check.wasm" . && \
+	echo "archive-check OK"
+
+# Publish the prebuilt .bnp to the active registry.
+# Pass --host https://my.localdev.blockninjacms.com for the dev orchestrator.
+publish: build
+	$(NINJA) plugin publish --bnp $(BNP)
+
+# Regenerate templ Go files locally.
 templ:
 	templ generate
 
-# Remove built artefacts.
+# Remove build artefacts.
 clean:
-	rm -f $(PLUGIN_NAME).so
+	rm -f $(PLUGIN_NAME)-*.bnp $(PLUGIN_NAME).so plugin.wasm
 
 help:
 	@echo "Targets:"
-	@echo "  all     Build $(PLUGIN_NAME).so locally (default)"
-	@echo "  templ   Regenerate templ Go files"
-	@echo "  clean   Remove built .so"
+	@echo "  build          Compile wasm + pack the .bnp"
+	@echo "  verify         Validate the built .bnp (loader-identical checks)"
+	@echo "  archive-check  Prove a clean git archive HEAD compiles to wasm"
+	@echo "  publish        Publish the .bnp to the active registry"
+	@echo "  templ          Regenerate templ Go files"
+	@echo "  clean          Remove build artefacts"
diff --git a/plugin.mod b/plugin.mod
index ff75b3f..2aa55c4 100644
--- a/plugin.mod
+++ b/plugin.mod
@@ -9,4 +9,4 @@ categories = ["templates"]
 tags = ["earth", "nonprofit", "sustainability", "outdoor", "farm", "cause", "botanical", "conservation", "ngo"]
 
 [compatibility]
-block_core = ">=0.11.0 <0.12.0"
+block_core = ">=0.15.0 <0.16.0"