@orkestrel/scaffold 0.0.3 → 0.0.5

package/dist/src/core/index.js

@@ -118,6 +118,8 @@ var HOST_PATHS = Object.freeze([
 	".claude/settings.json",
 	".codex/agents",
 	".codex/config.toml",
+	".cursor/mcp.json",
+	".mcp.json",
 	"scripts/deps.sh",
 	"scripts/cursor.sh",
 	"scripts/codex.sh",
@@ -215,7 +217,7 @@ var DEFAULT_VERSION = "0.0.1";
 /** The `engines.node` range the `blueprint` builder fills. */
 var DEFAULT_ENGINES = `>=${MINIMUM_NODE_VERSION}`;
 /** The devDependency range generated packages pin `@orkestrel/scaffold` at. */
-var SCAFFOLD_RANGE = "^0.0.2";
+var SCAFFOLD_RANGE = "^0.0.5";
 /** Tooling versions shared by scaffold and every generated workspace. */
 var BASE_DEV_DEPENDENCIES = Object.freeze({
 	"@microsoft/api-extractor": "^7.58.12",
@@ -5682,30 +5684,69 @@ function rootTsconfig(src, app = []) {
 	});
 }
 /**
+* Derive which host-specific machinery a workspace's generated root
+* `vite.config.ts` carries from its declared environments.
+*
+* @remarks
+* This is the SOLE derivation of that set; `rootViteConfig`,
+* `singleSrcViteConfig`, `applicationViteConfig`, and `configArtifacts` all
+* read it rather than recomputing an axis of their own. Nothing here selects
+* a boundary GUARANTEE — the environment-boundary plugin, its module-graph
+* AST audit, and stylesheet rejection ship in every shape.
+*
+* @param src - The declared published `Environment[]`.
+* @param app - The declared application `Environment[]`, defaulting to none.
+* @param engine - Whether the workspace also builds its own executable.
+* @returns The machinery set the generated header renders.
+*
+* @example
+* ```ts
+* viteMachinery(['core']) // { browser: false, vue: false, output: true }
+* viteMachinery([], ['core']) // { browser: false, vue: false, output: false }
+* ```
+*/
+function viteMachinery(src, app = [], engine = false) {
+	const unbuilt = src.length === 0 && app.length > 0 && !engine && app.every((environment) => environment === "core");
+	return {
+		browser: src.includes("browser") || app.includes("browser"),
+		vue: app.includes("browser"),
+		output: !unbuilt
+	};
+}
+/**
 * The rendered import / `resolve` header block every `rootViteConfig` shape
-* prefixes — the official Playwright provider import appears only when
-* `needsPlaywright`, per the three grounded `rootViteConfig`
-* shapes: unconditional for a multi-environment blueprint, conditional on the
-* sole environment being `'browser'` for a single non-`core` environment, absent for
-* `core`-only.
-*
-* @param needsPlaywright - Whether this shape ships a browser test project (and so needs Playwright).
-* @param needsVue - Whether the generated root imports the Vue Vite plugin.
+* prefixes — the environment boundary and every guarantee it enforces ship
+* unconditionally; `machinery` selects only the host-specific pipelines layered
+* over them, per the three grounded `rootViteConfig` shapes: browser machinery
+* unconditional for a multi-environment blueprint carrying `browser`,
+* conditional on the sole environment being `'browser'` for a single non-`core`
+* environment, absent for `core`-only.
+*
+* @param machinery - The host-specific machinery this shape carries, from `viteMachinery`.
 * @returns The rendered header block, newline-terminated.
 *
 * @example
 * ```ts
-* viteHeader(false).includes('@vitest/browser-playwright') // false
-* viteHeader(true).includes('@vitest/browser-playwright') // true
+* viteHeader(viteMachinery(['core'])).includes('@vitest/browser-playwright') // false
+* viteHeader(viteMachinery(['core', 'browser'])).includes('@vitest/browser-playwright') // true
 * ```
 */
-function viteHeader(needsPlaywright, needsVue = false) {
-	const playwrightImports = needsPlaywright ? `import { playwright } from '@vitest/browser-playwright'
+function viteHeader(machinery) {
+	const { browser: needsBrowser, vue: needsVue, output: needsOutput } = machinery;
+	const playwrightImports = needsBrowser ? `import { playwright } from '@vitest/browser-playwright'
 import { chromium } from 'playwright'
 ` : "";
 	const vueImports = needsVue ? `import vue from '@vitejs/plugin-vue'
 import { parse as parseVue } from 'vue/compiler-sfc'
 ` : "";
+	const viteTypeImports = needsVue ? `import type {
+	CSSOptions,
+	HtmlAssetSource,
+	HTMLOptions,
+	Plugin,
+	ResolvedConfig,
+	UserConfig,
+} from 'vite'` : needsBrowser ? `import type { CSSOptions, Plugin, ResolvedConfig, UserConfig } from 'vite'` : `import type { Plugin, UserConfig } from 'vite'`;
 	const vueBoundary = needsVue ? `,
 		transform: {
 			order: 'pre',
@@ -5865,11 +5906,10 @@ import { parse as parseVue } from 'vue/compiler-sfc'
 				}
 				return restored === code ? null : restored
 			},
-		}` : `,
+		}` : needsBrowser ? `,
 		transform: {
 			order: 'pre',
 			async handler(code, id) {
-				const restored = /[?&]html-proxy(?:[=&]|$)/.test(id) ? restoreIgnoredHtml(code) : code
 				const target = workspacePath(id)
 				const physicalImporter = physicalPath(id)
 				const importerPackageRoot = trustedPackageRootFor(physicalImporter, trustedPackageRoots)
@@ -5883,15 +5923,13 @@ import { parse as parseVue } from 'vue/compiler-sfc'
 				}
 				const environmentModule =
 					target !== undefined && /^(?:app|src)\\/(?:core|browser|server)\\//.test(target)
-				if (!environmentModule && importerPackageRoot === undefined) {
-					return restored === code ? null : restored
-				}
+				if (!environmentModule && importerPackageRoot === undefined) return null
 				if (isCSSRequest(id)) {
 					const config = resolvedConfig
 					if (config === undefined) {
 						this.error('Environment boundary requires resolved Vite configuration')
 					}
-					const stylesheet = await preprocessCSS(restored, id, config)
+					const stylesheet = await preprocessCSS(code, id, config)
 					for (const dependency of stylesheet.deps ?? []) {
 						const physicalDependency = physicalPath(dependency)
 						const dependencyTarget = workspacePath(physicalDependency)
@@ -5905,7 +5943,7 @@ import { parse as parseVue } from 'vue/compiler-sfc'
 						if (dependencyError !== undefined) this.error(dependencyError)
 					}
 				}
-				for (const source of await environmentAssetSources(restored, id)) {
+				for (const source of await environmentAssetSources(code, id)) {
 					const normalizedSource = source.replaceAll('\\\\', '/')
 					const sourceError = environmentSourceError(owner, normalizedSource)
 					if (sourceError !== undefined) this.error(sourceError)
@@ -5948,12 +5986,74 @@ import { parse as parseVue } from 'vue/compiler-sfc'
 					const assetError = environmentPathError(owner, resolvedSource)
 					if (assetError !== undefined) this.error(assetError)
 				}
-				return restored === code ? null : restored
+				return null
+			},
+		}` : `,
+		transform: {
+			order: 'pre',
+			async handler(code, id) {
+				const target = workspacePath(id)
+				const physicalImporter = physicalPath(id)
+				const importerPackageRoot = trustedPackageRootFor(physicalImporter, trustedPackageRoots)
+				if (target === undefined) {
+					if (isOutsideWorkspacePath(id) && importerPackageRoot === undefined) {
+						this.error('Environment modules cannot import files outside the workspace')
+					}
+				} else {
+					const pathError = environmentPathError(owner, target)
+					if (pathError !== undefined) this.error(pathError)
+				}
+				const environmentModule =
+					target !== undefined && /^(?:app|src)\\/(?:core|browser|server)\\//.test(target)
+				if (!environmentModule && importerPackageRoot === undefined) return null
+				for (const source of await environmentAssetSources(code, id)) {
+					const normalizedSource = source.replaceAll('\\\\', '/')
+					const sourceError = environmentSourceError(owner, normalizedSource)
+					if (sourceError !== undefined) this.error(sourceError)
+					const [sourcePath] = normalizedSource.split(/[?#]/)
+					if (sourcePath !== undefined && isBuiltin(sourcePath)) continue
+					const resolution = await this.resolve(normalizedSource, id, { skipSelf: true })
+					const fallbackSource = sourceFallback(physicalImporter, normalizedSource)
+					const physicalSource = physicalPath(resolution?.id ?? fallbackSource)
+					if (importerPackageRoot !== undefined) {
+						const pathLike =
+							normalizedSource.startsWith('.') ||
+							normalizedSource.startsWith('/') ||
+							/^file:/i.test(normalizedSource) ||
+							/^[A-Za-z]:[\\\\/]/.test(normalizedSource)
+						if (pathLike && !containedPath(importerPackageRoot, physicalSource)) {
+							this.error(
+								'Dependency modules cannot import files outside their physical package root',
+							)
+						}
+						if (!pathLike && !containedPath(importerPackageRoot, physicalSource)) {
+							const packageName = packageNameOf(normalizedSource)
+							const packageRoot = normalizedSource.startsWith('#')
+								? workspacePath(physicalSource) === undefined
+									? packageRootForResolved(physicalSource)
+									: undefined
+								: packageName === undefined
+									? undefined
+									: packageRootOf(packageName, physicalSource)
+							if (packageRoot === undefined || !containedPath(packageRoot, physicalSource)) {
+								this.error('Resolved dependencies must remain inside their physical package root')
+							}
+							trustedPackageRoots.add(packageRoot)
+						}
+						continue
+					}
+					const resolvedSource = workspacePath(physicalSource)
+					if (resolvedSource === undefined) {
+						this.error('Environment modules cannot import files outside the workspace')
+					}
+					const assetError = environmentPathError(owner, resolvedSource)
+					if (assetError !== undefined) this.error(assetError)
+				}
+				return null
 			},
 		}`;
 	const environmentBoundary = `
-${CONST_KEYWORD} WORKSPACE_ROOT = realpathSync.native(dirname(fileURLToPath(import.meta.url)))
-${EXPORT_KEYWORD} ${CONST_KEYWORD} IMPORT_META_ENV_PREFIX = 'import.meta.env.'
+${CONST_KEYWORD} WORKSPACE_ROOT = realpathSync.native(dirname(fileURLToPath(import.meta.url)))${needsVue ? `\n${EXPORT_KEYWORD} ${CONST_KEYWORD} IMPORT_META_ENV_PREFIX = 'import.meta.env.'` : ""}
 
 ${EXPORT_KEYWORD} function physicalPath(path: string): string {
 	const [pathWithoutQuery] = path.split('?')
@@ -5998,9 +6098,9 @@ ${EXPORT_KEYWORD} function containedPath(root: string, target: string): boolean
 		relativePath === '' ||
 		(relativePath !== '..' && !relativePath.startsWith(\`..\${sep}\`) && !isAbsolute(relativePath))
 	)
-}
+}${needsVue ? `
 
-${needsVue ? `${EXPORT_KEYWORD} function browserServerRoots(): readonly string[] {
+${EXPORT_KEYWORD} function browserServerRoots(): readonly string[] {
 	const roots: string[] = []
 	for (const path of [
 		'app/browser',
@@ -6282,7 +6382,7 @@ ${EXPORT_KEYWORD} function environmentSourceError(owner: string, source: string)
 	return undefined
 }
 
-${EXPORT_KEYWORD} function stylesheetAssetError(
+${needsBrowser ? `${EXPORT_KEYWORD} function stylesheetAssetError(
 	source: string | undefined,
 	value: string,
 ): string | undefined {
@@ -6329,7 +6429,7 @@ ${EXPORT_KEYWORD} function stylesheetAssetError(
 	return undefined
 }
 
-${EXPORT_KEYWORD} function enforceOutputPath(configured: string, expected: string): void {
+` : ""}${needsOutput ? `${EXPORT_KEYWORD} function enforceOutputPath(configured: string, expected: string): void {
 	if (relative(expected, configured) !== '') {
 		throw new Error(
 			'[orkestrel-output-boundary] Build output must use its exact configured workspace directory',
@@ -6396,7 +6496,7 @@ ${EXPORT_KEYWORD} function outputBoundary(output: string): Plugin {
 	}
 }
 
-${EXPORT_KEYWORD} function decodeAssetSource(source: string): string | undefined {
+` : ""}${EXPORT_KEYWORD} function decodeAssetSource(source: string): string | undefined {
 	try {
 		return decodeURI(source)
 	} catch {
@@ -6404,7 +6504,7 @@ ${EXPORT_KEYWORD} function decodeAssetSource(source: string): string | undefined
 	}
 }
 
-${EXPORT_KEYWORD} function filterHtmlAssetSource(
+${needsVue ? `${EXPORT_KEYWORD} function filterHtmlAssetSource(
 	data: Parameters<NonNullable<HtmlAssetSource['filter']>>[0],
 ): boolean {
 	const decoded = decodeAssetSource(data.value)
@@ -6549,7 +6649,7 @@ ${EXPORT_KEYWORD} function maskIgnoredHtml(environmentKeys: ReadonlySet<string>,
 	)
 }
 
-${EXPORT_KEYWORD} function restoreIgnoredHtml(code: string): string {
+` : ""}${needsVue ? `${EXPORT_KEYWORD} function restoreIgnoredHtml(code: string): string {
 	const literals = code.replace(
 		/(?<prefix>[vV][iI][tT][eE])&#45;(?<suffix>[iI][gG][nN][oO][rR][eE])/gu,
 		'$<prefix>-$<suffix>',
@@ -6605,7 +6705,7 @@ ${EXPORT_KEYWORD} function finalizeHtml(): Plugin {
 	}
 }
 
-${EXPORT_KEYWORD} async function environmentAssetSources(
+` : ""}${EXPORT_KEYWORD} async function environmentAssetSources(
 	code: string,
 	id: string,
 	emitted = false,
@@ -6690,23 +6790,19 @@ ${EXPORT_KEYWORD} async function environmentAssetSources(
 			}
 		},
 	})
-	visitor.visit(parseAst(transformed.code, null, path))
+	visitor.visit(parseSync(path, transformed.code).program)
 	return sources
 }
 
 ${EXPORT_KEYWORD} function environmentBoundary(
 	owner: 'src/core' | 'src/browser' | 'src/server' | 'app/core' | 'app/browser' | 'app/server',
 ): Plugin {
-	const trustedPackageRoots = new Set<string>()
-	let environmentRoot = WORKSPACE_ROOT
-	let resolvedConfig: ResolvedConfig | undefined
+	const trustedPackageRoots = new Set<string>()${needsOutput ? "\n	let environmentRoot = WORKSPACE_ROOT" : ""}${needsBrowser ? "\n	let resolvedConfig: ResolvedConfig | undefined" : ""}
 	return {
 		name: 'orkestrel-environment-boundary',
-		enforce: 'pre',
-		configResolved(config) {
-			environmentRoot = physicalPath(config.root)
-			resolvedConfig = config
-		},
+		enforce: 'pre',${needsOutput || needsBrowser ? `
+		configResolved(config) {${needsOutput ? "\n			environmentRoot = physicalPath(config.root)" : ""}${needsBrowser ? "\n			resolvedConfig = config" : ""}
+		},` : ""}
 ${needsVue ? `		configureServer(server) {
 			if (owner !== 'app/browser') return
 			const roots = browserServerRoots()
@@ -6839,7 +6935,7 @@ ${needsVue ? `		configureServer(server) {
 				}
 			}
 			return null
-		},
+		},${needsOutput ? `
 		async generateBundle(_options, bundle) {
 			for (const output of Object.values(bundle)) {
 				if (output.type === 'chunk') {
@@ -6869,7 +6965,7 @@ ${needsVue ? `		configureServer(server) {
 					if (pathError !== undefined) this.error(pathError)
 				}
 			}
-		},
+		},` : ""}
 		buildEnd(error) {
 			if (error !== undefined) return
 			for (const id of this.getModuleIds()) {
@@ -6890,16 +6986,10 @@ ${needsVue ? `		configureServer(server) {
 	}
 }
 `;
-	return `import type {
-	CSSOptions,
-	HtmlAssetSource,
-	HTMLOptions,
-	Plugin,
-	ResolvedConfig,
-	UserConfig,
-} from 'vite'
-import { isCSSRequest, parseAst, preprocessCSS, transformWithOxc, Visitor } from 'vite'
-import { defineConfig, mergeConfig } from 'vitest/config'
+	return `${viteTypeImports}
+${needsBrowser ? `import { isCSSRequest, parseSync, preprocessCSS, transformWithOxc, Visitor } from 'vite'
+` : `import { parseSync, transformWithOxc, Visitor } from 'vite'
+`}import { defineConfig, mergeConfig } from 'vitest/config'
 import tsconfig from './tsconfig.json' with { type: 'json' }
 import { fileURLToPath, URL } from 'node:url'
 import { isBuiltin } from 'node:module'
@@ -6914,8 +7004,7 @@ import {
 	realpathSync,
 } from 'node:fs'
 import { dirname, isAbsolute, relative, resolve as resolvePath, sep } from 'node:path'
-${playwrightImports}${vueImports}
-${needsPlaywright ? `${CONST_KEYWORD} hasChromium = existsSync(chromium.executablePath())\n` : ""}
+${playwrightImports}${vueImports}${needsBrowser ? `\n${CONST_KEYWORD} hasChromium = existsSync(chromium.executablePath())\n` : ""}
 ${EXPORT_KEYWORD} function resolveWorkspacePath(relativePath: string): string {
 	return fileURLToPath(new URL(relativePath, import.meta.url))
 }
@@ -6936,7 +7025,7 @@ ${CONST_KEYWORD} resolve = {
 	}, {}),
 }
 
-${EXPORT_KEYWORD} ${CONST_KEYWORD} ENVIRONMENT_CSS = Object.freeze({
+${needsBrowser ? `${EXPORT_KEYWORD} ${CONST_KEYWORD} ENVIRONMENT_CSS = Object.freeze({
 	transformer: 'lightningcss',
 	lightningcss: {
 		visitor: () => {
@@ -6967,7 +7056,7 @@ ${EXPORT_KEYWORD} ${CONST_KEYWORD} ENVIRONMENT_CSS = Object.freeze({
 		},
 	},
 } satisfies CSSOptions)
-${EXPORT_KEYWORD} ${CONST_KEYWORD} PACKAGE_MANIFEST_BYTES = 1_048_576
+` : ""}${EXPORT_KEYWORD} ${CONST_KEYWORD} PACKAGE_MANIFEST_BYTES = 1_048_576
 ${EXPORT_KEYWORD} ${CONST_KEYWORD} ENVIRONMENT_MODULE_BYTES = 8_388_608
 ${environmentBoundary}`;
 }
@@ -7004,7 +7093,8 @@ function policyViteProject() {
 * ```
 */
 function singleSrcViteConfig(environment) {
-	const header = viteHeader(environment === "browser");
+	const machinery = viteMachinery([environment]);
+	const header = viteHeader(machinery);
 	if (environment === "browser") return `${header}
 ${EXPORT_KEYWORD} const srcBrowser = (config?: UserConfig): UserConfig =>
 	mergeConfig(
@@ -7012,10 +7102,7 @@ ${EXPORT_KEYWORD} const srcBrowser = (config?: UserConfig): UserConfig =>
 			resolve,
 			css: ENVIRONMENT_CSS,
 			publicDir: false,
-			plugins: [
-				outputBoundary('dist/src/browser'),
-				environmentBoundary('src/browser'),
-			],
+			plugins: [outputBoundary('dist/src/browser'), environmentBoundary('src/browser')],
 			build: {
 				assetsInlineLimit: 0,
 				emptyOutDir: true,
@@ -7075,13 +7162,9 @@ export default defineConfig({
 ${EXPORT_KEYWORD} const srcServer = (config?: UserConfig): UserConfig =>
 	mergeConfig(
 		{
-			resolve,
-			css: ENVIRONMENT_CSS,
+			resolve,${machinery.browser ? "\n			css: ENVIRONMENT_CSS," : ""}
 			publicDir: false,
-			plugins: [
-				outputBoundary('dist/src/server'),
-				environmentBoundary('src/server'),
-			],
+			plugins: [outputBoundary('dist/src/server'), environmentBoundary('src/server')],
 			build: {
 				emptyOutDir: true,
 				sourcemap: true,
@@ -7163,7 +7246,8 @@ export default defineConfig({
 function rootViteConfig(src, engine = false) {
 	const hasCore = src.includes("core");
 	const nonCore = src.filter((environment) => environment !== "core");
-	const header = viteHeader(src.includes("browser"));
+	const machinery = viteMachinery(src);
+	const header = viteHeader(machinery);
 	if (!hasCore) {
 		const [onlyEnvironment] = nonCore;
 		if (onlyEnvironment === "browser" || onlyEnvironment === "server") return singleSrcViteConfig(onlyEnvironment);
@@ -7175,10 +7259,7 @@ ${EXPORT_KEYWORD} const srcBrowser = (config?: UserConfig): UserConfig =>
 			{
 				css: ENVIRONMENT_CSS,
 				publicDir: false,
-				plugins: [
-					outputBoundary('dist/src/browser'),
-					environmentBoundary('src/browser'),
-				],
+				plugins: [outputBoundary('dist/src/browser'), environmentBoundary('src/browser')],
 				build: {
 					assetsInlineLimit: 0,
 					lib: {
@@ -7214,13 +7295,9 @@ ${EXPORT_KEYWORD} const srcBrowser = (config?: UserConfig): UserConfig =>
 ${EXPORT_KEYWORD} const srcServer = (config?: UserConfig): UserConfig =>
 	srcCore(
 		mergeConfig(
-			{
-				css: ENVIRONMENT_CSS,
+			{${machinery.browser ? "\n				css: ENVIRONMENT_CSS," : ""}
 				publicDir: false,
-				plugins: [
-					outputBoundary('dist/src/server'),
-					environmentBoundary('src/server'),
-				],
+				plugins: [outputBoundary('dist/src/server'), environmentBoundary('src/server')],
 				build: {
 					lib: {
 						entry: resolveWorkspacePath('src/server/index.ts'),
@@ -7370,7 +7447,8 @@ export default defineConfig({
 */
 function applicationViteConfig(src, app, engine = false) {
 	const hasSourceCore = src.includes("core");
-	const header = viteHeader(src.includes("browser") || app.includes("browser"), app.includes("browser"));
+	const machinery = viteMachinery(src, app, engine);
+	const header = viteHeader(machinery);
 	const projects = [];
 	const blocks = [];
 	if (src.includes("core")) {
@@ -7379,8 +7457,7 @@ function applicationViteConfig(src, app, engine = false) {
 ${EXPORT_KEYWORD} const srcCore = (config?: UserConfig): UserConfig =>
 	mergeConfig(
 		{
-			resolve,
-			css: ENVIRONMENT_CSS,
+			resolve,${machinery.browser ? "\n			css: ENVIRONMENT_CSS," : ""}
 			publicDir: false,
 			plugins: [environmentBoundary('src/core')],
 			build: { emptyOutDir: true, sourcemap: true, minify: false },
@@ -7462,8 +7539,7 @@ ${EXPORT_KEYWORD} const srcBrowser = (config?: UserConfig): UserConfig =>
 ${EXPORT_KEYWORD} const srcServer = (config?: UserConfig): UserConfig =>
 	mergeConfig(
 		{
-			resolve,
-			css: ENVIRONMENT_CSS,
+			resolve,${machinery.browser ? "\n			css: ENVIRONMENT_CSS," : ""}
 			publicDir: false,
 			plugins: [outputBoundary('dist/src/server'), environmentBoundary('src/server')],
 			build: {
@@ -7499,8 +7575,7 @@ ${EXPORT_KEYWORD} const srcServer = (config?: UserConfig): UserConfig =>
 ${EXPORT_KEYWORD} const appCore = (config?: UserConfig): UserConfig =>
 	mergeConfig(
 		{
-			resolve,
-			css: ENVIRONMENT_CSS,
+			resolve,${machinery.browser ? "\n			css: ENVIRONMENT_CSS," : ""}
 			publicDir: false,
 			plugins: [environmentBoundary('app/core')],
 			test: {
@@ -7577,8 +7652,7 @@ ${EXPORT_KEYWORD} function appBrowser(...config: readonly never[]): UserConfig {
 ${EXPORT_KEYWORD} const appServer = (config?: UserConfig): UserConfig =>
 	mergeConfig(
 		{
-			resolve,
-			css: ENVIRONMENT_CSS,
+			resolve,${machinery.browser ? "\n			css: ENVIRONMENT_CSS," : ""}
 			publicDir: false,
 			plugins: [outputBoundary('dist/app/server'), environmentBoundary('app/server')],
 			build: {
@@ -7710,6 +7784,7 @@ function coreTsconfig() {
 * `configs/src/vite.core.config.ts` — inlines its own `build.lib` /
 * `rolldownOptions` (core's `srcCore` root export carries no build.lib).
 *
+* @param browser - Whether a declared browser environment enables the shared CSS pipeline.
 * @returns The core environment `vite.config.ts` file content, newline-terminated.
 *
 * @example
@@ -7717,12 +7792,11 @@ function coreTsconfig() {
 * coreViteConfig().includes('srcCore(') // true
 * ```
 */
-function coreViteConfig() {
+function coreViteConfig(browser = true) {
 	return `import { defineConfig } from 'vite'
 import dts from 'vite-plugin-dts'
 import {
-	ENVIRONMENT_CSS,
-	environmentBoundary,
+${browser ? "	ENVIRONMENT_CSS,\n" : ""}	environmentBoundary,
 	outputBoundary,
 	srcCore,
 	resolveWorkspacePath,
@@ -7730,8 +7804,7 @@ import {
 
 export default defineConfig(
 	srcCore({
-		css: ENVIRONMENT_CSS,
-		publicDir: false,
+${browser ? "		css: ENVIRONMENT_CSS,\n" : ""}		publicDir: false,
 		plugins: [
 			outputBoundary('dist/src/core'),
 			environmentBoundary('src/core'),
@@ -7953,6 +8026,7 @@ ${spec.engine || spec.src.includes("browser") || spec.app.includes("browser") ?
 * ```
 */
 function configArtifacts(spec) {
+	const machinery = viteMachinery(spec.src, spec.app, spec.engine);
 	const artifacts = [{
 		path: "tsconfig.json",
 		group: "configs",
@@ -7968,7 +8042,7 @@ function configArtifacts(spec) {
 		const row = SRC_MATRIX[environment];
 		for (const path of row.configs) {
 			const isTsconfig = path.endsWith(".json");
-			const content = environment === "core" ? isTsconfig ? coreTsconfig() : coreViteConfig() : isTsconfig ? srcTsconfig(environment) : srcViteConfig(environment);
+			const content = environment === "core" ? isTsconfig ? coreTsconfig() : coreViteConfig(machinery.browser) : isTsconfig ? srcTsconfig(environment) : srcViteConfig(environment);
 			artifacts.push({
 				path,
 				group: "configs",
@@ -9104,6 +9178,6 @@ function createBlueprint(data) {
 	return candidate;
 }
 //#endregion
-export { APP_BROWSER_DEV_DEPENDENCIES, APP_MATRIX, BASE_DEV_DEPENDENCIES, CATEGORIES, CHECKOUT_ACTION_SHA, COMPILER_ID, COMPILE_STAGES, CONST_KEYWORD, CONTROL_CHARACTER_PATTERN, Compiler, DEFAULT_ENGINES, DEFAULT_VERSION, DEPENDENCY_NAME_PATTERN, ENGINES_PATTERN, ENVIRONMENTS, EXPORT_KEYWORD, EXTRA_NAME_PATTERN, EXTRA_RANGE_PATTERN, FRESHNESS, FUNCTION_KEYWORD, GROUPS, HEX_PATTERN, HOST_PATHS, IMPORT_KEYWORD, INVALID_PATH_CHARACTER_PATTERN, JSON_PRINT_WIDTH, JSON_TAB_WIDTH, MAX_ARTIFACT_BYTES, MAX_ARTIFACT_HEX_LENGTH, MAX_COLLECTION_ITEMS, MAX_DATA_GRAPH_KEYS, MAX_DATA_GRAPH_NODES, MAX_DEPENDENCY_NAME_LENGTH, MAX_MANIFEST_BYTES, MAX_NAME_LENGTH, MAX_PATH_LENGTH, MAX_RANGE_LENGTH, MAX_SERIALIZED_INPUT_BYTES, MAX_TOTAL_ARTIFACT_BYTES, MINIMUM_NODE_VERSION, NAME_PATTERN, ORIGINS, ORKESTREL_RANGE_PATTERN, PlanManager, SCAFFOLD_RANGE, SETUP_NODE_ACTION_SHA, SOURCE_BROWSER_DEV_DEPENDENCIES, SRC_MATRIX, SYNC_BASELINE_PATTERN, ScaffoldError, TEMPLATES, TYPESCRIPT_EXTENSIONS, VERSION_PATTERN, alignTable, appTsconfig, appViteConfig, applicationArtifacts, applicationViteConfig, applyOverrides, artifactShape, auditToReview, blueprint, blueprintShape, blueprintToMembers, blueprintToPlan, bytesToHex, catalogNames, catalogToBlock, ciWorkflow, compareCodeUnit, computeColumnWidth, computeHash, configArtifacts, contentByteLength, contentCodePoint, contentToBytes, contentToHex, coreTsconfig, coreViteConfig, createBlueprint, createCompiler, createPlanManager, delimiterCell, dependency, dependencyShape, devDependenciesFor, diffPlan, dualCondition, entryFields, escapeHtmlText, exportsMap, fillArtifact, findFileConflict, findPathConflict, formatJson, guideArtifacts, guideMemberTable, guideMethods, guideTests, guideUsage, hasBlueprintEnvironment, hasOnlyDataProperties, hasValidArtifactBytes, hasValidArtifactHex, hasValidAuditBytes, hasValidBlueprintBytes, hasValidOverrideBytes, hasValidPlanBytes, hasValidPlanHex, hasValidSnapshotBytes, hasValidSyncReportBytes, hostGroup, inferGroup, isArtifact, isBehind, isBlueprint, isCompilerEventHooks, isDenseDataArray, isDependency, isEmitterErrorHandler, isMember, isOverride, isPlan, isPlanManagerEventHooks, isScaffoldError, isSyncReport, isWorkspaceName, manifestToDependencies, member, memberShape, override, overrideShape, ownDataValue, packageManifest, padCell, paritySpecifiers, parseBlueprint, parseBoundedJSON, parseCompilerOptions, parsePlan, parsePlanIds, parsePlanManagerOptions, parseSyncReport, pascalCase, pinPlan, planPayload, planShape, planToReview, planToSummary, policyViteProject, rangeToFreshness, renderArray, renderObject, renderValue, rootTsconfig, rootViteConfig, serializeTypeScriptString, singleSrcViteConfig, snapshotOf, snapshotPlan, sourceArtifacts, splitTableRow, srcTsconfig, srcVariant, srcViteConfig, stableStringify, syncReportShape, syncToReview, testArtifacts, validateBlueprint, validateDependencyArray, validatePlan, viteHeader };
+export { APP_BROWSER_DEV_DEPENDENCIES, APP_MATRIX, BASE_DEV_DEPENDENCIES, CATEGORIES, CHECKOUT_ACTION_SHA, COMPILER_ID, COMPILE_STAGES, CONST_KEYWORD, CONTROL_CHARACTER_PATTERN, Compiler, DEFAULT_ENGINES, DEFAULT_VERSION, DEPENDENCY_NAME_PATTERN, ENGINES_PATTERN, ENVIRONMENTS, EXPORT_KEYWORD, EXTRA_NAME_PATTERN, EXTRA_RANGE_PATTERN, FRESHNESS, FUNCTION_KEYWORD, GROUPS, HEX_PATTERN, HOST_PATHS, IMPORT_KEYWORD, INVALID_PATH_CHARACTER_PATTERN, JSON_PRINT_WIDTH, JSON_TAB_WIDTH, MAX_ARTIFACT_BYTES, MAX_ARTIFACT_HEX_LENGTH, MAX_COLLECTION_ITEMS, MAX_DATA_GRAPH_KEYS, MAX_DATA_GRAPH_NODES, MAX_DEPENDENCY_NAME_LENGTH, MAX_MANIFEST_BYTES, MAX_NAME_LENGTH, MAX_PATH_LENGTH, MAX_RANGE_LENGTH, MAX_SERIALIZED_INPUT_BYTES, MAX_TOTAL_ARTIFACT_BYTES, MINIMUM_NODE_VERSION, NAME_PATTERN, ORIGINS, ORKESTREL_RANGE_PATTERN, PlanManager, SCAFFOLD_RANGE, SETUP_NODE_ACTION_SHA, SOURCE_BROWSER_DEV_DEPENDENCIES, SRC_MATRIX, SYNC_BASELINE_PATTERN, ScaffoldError, TEMPLATES, TYPESCRIPT_EXTENSIONS, VERSION_PATTERN, alignTable, appTsconfig, appViteConfig, applicationArtifacts, applicationViteConfig, applyOverrides, artifactShape, auditToReview, blueprint, blueprintShape, blueprintToMembers, blueprintToPlan, bytesToHex, catalogNames, catalogToBlock, ciWorkflow, compareCodeUnit, computeColumnWidth, computeHash, configArtifacts, contentByteLength, contentCodePoint, contentToBytes, contentToHex, coreTsconfig, coreViteConfig, createBlueprint, createCompiler, createPlanManager, delimiterCell, dependency, dependencyShape, devDependenciesFor, diffPlan, dualCondition, entryFields, escapeHtmlText, exportsMap, fillArtifact, findFileConflict, findPathConflict, formatJson, guideArtifacts, guideMemberTable, guideMethods, guideTests, guideUsage, hasBlueprintEnvironment, hasOnlyDataProperties, hasValidArtifactBytes, hasValidArtifactHex, hasValidAuditBytes, hasValidBlueprintBytes, hasValidOverrideBytes, hasValidPlanBytes, hasValidPlanHex, hasValidSnapshotBytes, hasValidSyncReportBytes, hostGroup, inferGroup, isArtifact, isBehind, isBlueprint, isCompilerEventHooks, isDenseDataArray, isDependency, isEmitterErrorHandler, isMember, isOverride, isPlan, isPlanManagerEventHooks, isScaffoldError, isSyncReport, isWorkspaceName, manifestToDependencies, member, memberShape, override, overrideShape, ownDataValue, packageManifest, padCell, paritySpecifiers, parseBlueprint, parseBoundedJSON, parseCompilerOptions, parsePlan, parsePlanIds, parsePlanManagerOptions, parseSyncReport, pascalCase, pinPlan, planPayload, planShape, planToReview, planToSummary, policyViteProject, rangeToFreshness, renderArray, renderObject, renderValue, rootTsconfig, rootViteConfig, serializeTypeScriptString, singleSrcViteConfig, snapshotOf, snapshotPlan, sourceArtifacts, splitTableRow, srcTsconfig, srcVariant, srcViteConfig, stableStringify, syncReportShape, syncToReview, testArtifacts, validateBlueprint, validateDependencyArray, validatePlan, viteHeader, viteMachinery };
 
 //# sourceMappingURL=index.js.map