@orkestrel/scaffold 0.0.4 → 0.0.5

package/dist/host/claude/agents/codex.md

@@ -81,6 +81,22 @@ shared-file edits, and tree-wide mutating gates. Return the touched files,
 diffstat, scoped validation, and deviation state for independent integration and
 review.
 
+## Routing exclusion — defensive negative-test units
+
+The provider applies a content-safety filter that terminates a turn mid-run when
+the work requires authoring or reproducing a violation construct, even when the
+purpose is to prove a guard REJECTS it: sandbox escapes, resolution-bypassing
+imports, boundary evasion, injection payloads, credential-handling probes. The
+filter reads the construct, not the intent, so a legitimate negative test trips
+it exactly like an attack would. Observed twice on one unit, at the same point in
+the work, with nothing written to disk either time.
+
+Route such a unit to the native Opus `implementer` from the start, and record the
+Codex bench dark for that unit with this reason. Do not soften or obscure a brief
+to slip past the filter — a bench that declines work is a routing fact, not an
+obstacle. The exclusion is per unit: everything else still routes to Sol
+normally, and an audit that merely READS existing negative tests is unaffected.
+
 ## Journals and Windows
 
 - Journals, briefs, session files, and last-message files under `tmp/codex/` are

package/dist/host/guides/src/scaffold.md

@@ -133,6 +133,7 @@ From [`types.ts`](../../src/core/types.ts).
 | `BuildFormat`          | type      |
 | `SrcDefinition`        | interface |
 | `AppDefinition`        | interface |
+| `ViteMachinery`        | interface |
 | `Origin`               | type      |
 | `Group`                | type      |
 | `Category`             | type      |
@@ -183,6 +184,12 @@ is `'INVALID' | 'BLOCKED' | 'DESTROYED' | 'TARGET' | 'WRITE' | 'FETCH'`.
 environment contributes, its test-project label, and — on the `src` axis — its `exports` subpath
 and build formats, or — on the `app` axis — its optional runtime entry.
 
+`ViteMachinery` names the three host-specific pipelines a workspace's generated `vite.config.ts` may
+carry: `browser` for the CSS pipeline and the Playwright-backed browser test project, `vue` for the
+single-file-component, HTML, and development-server machinery an application browser environment
+needs, and `output` for build-output containment. It never selects a boundary guarantee — those ship
+in every shape, as the compilers section sets out.
+
 `Blueprint` is the closed input spec:
 
 ```ts
@@ -946,6 +953,7 @@ From [`compilers.ts`](../../src/core/compilers.ts).
 | `devDependenciesFor`    | function |
 | `packageManifest`       | function |
 | `rootTsconfig`          | function |
+| `viteMachinery`         | function |
 | `viteHeader`            | function |
 | `policyViteProject`     | function |
 | `singleSrcViteConfig`   | function |
@@ -987,10 +995,33 @@ optional metadata, and engines.
 `rootTsconfig` emits the root compiler options and one path alias per declared environment;
 `coreTsconfig`, `srcTsconfig`, and `appTsconfig` emit the scoped configurations that remove the
 wrong host's globals from each environment. `viteHeader` renders the shared header — the alias block
-derived from the tsconfig paths, plus the environment-boundary plugin. `coreViteConfig`,
-`srcViteConfig`, and `appViteConfig` emit the thin per-target wrappers; `rootViteConfig`,
-`singleSrcViteConfig`, and `applicationViteConfig` emit the root configuration for a
-library-only, single non-core `src` environment, and application-bearing workspace respectively;
+derived from the tsconfig paths, plus the environment-boundary plugin — and `viteMachinery` is the
+one place the header's axes are derived, read by `rootViteConfig`, `singleSrcViteConfig`,
+`applicationViteConfig`, and `configArtifacts` alike so no caller can invent a fourth answer.
+
+**The boundary guarantees do not vary by blueprint.** Every generated `vite.config.ts` — a
+`core`-only library, an application of `app/core` alone, or the full six-environment workspace —
+emits `environmentBoundary`, its `resolveId` / `load` / `buildEnd` walks, the module-graph AST audit
+(`environmentAssetSources`, `parseSync`, `Visitor`), and stylesheet rejection (`isStylesheetPath`
+plus its `environmentPathError` / `environmentSourceError` clauses). Those enforce owner-independent
+laws: core stays host-independent whatever else the workspace declares, a server module never
+imports a stylesheet, and a `@vite-ignore` dynamic import — which `resolveId` never sees and the
+module graph never records — has no other enforcement point. Only host-specific pipelines vary,
+along the three `ViteMachinery` axes:
+
+| Machinery                                                         | Emitted when                         |
+| ----------------------------------------------------------------- | ------------------------------------ |
+| CSS pipeline (`ENVIRONMENT_CSS`, `preprocessCSS`, `isCSSRequest`) | a `src` or `app` browser environment |
+| Playwright provider and `hasChromium`                             | a `src` or `app` browser environment |
+| Vue plugin, HTML boundary, browser development server             | an `app` browser environment         |
+| Output containment (`outputBoundary`, `enforceOutputPath`)        | anything the workspace builds        |
+
+An application of `app/core` alone is the sole shape that builds nothing, so it is the sole shape
+without output containment — and it still carries every boundary guarantee above.
+
+`coreViteConfig`, `srcViteConfig`, and `appViteConfig` emit the thin per-target wrappers;
+`rootViteConfig`, `singleSrcViteConfig`, and `applicationViteConfig` emit the root configuration for
+a library-only, single non-core `src` environment, and application-bearing workspace respectively;
 `policyViteProject` emits the dedicated Node-only repository-policy test project.
 
 `configArtifacts`, `sourceArtifacts`, `applicationArtifacts`, `testArtifacts`, and `guideArtifacts`
@@ -1924,6 +1955,7 @@ import {
 	srcTsconfig,
 	srcViteConfig,
 	viteHeader,
+	viteMachinery,
 } from '@orkestrel/scaffold'
 
 rootTsconfig(['core'], ['core', 'server'])
@@ -1931,7 +1963,9 @@ coreTsconfig()
 srcTsconfig('server')
 appTsconfig('browser', true)
 
-viteHeader(true, true) // the shared header, with browser and Vue support
+viteMachinery(['core']) // { browser: false, vue: false, output: true }
+viteMachinery([], ['core', 'browser']) // { browser: true, vue: true, output: true }
+viteHeader(viteMachinery([], ['core', 'browser'])) // the shared header, with browser and Vue support
 coreViteConfig()
 srcViteConfig('browser')
 appViteConfig('server')

package/dist/src/core/index.cjs

@@ -218,7 +218,7 @@ var DEFAULT_VERSION = "0.0.1";
 /** The `engines.node` range the `blueprint` builder fills. */
 var DEFAULT_ENGINES = `>=${MINIMUM_NODE_VERSION}`;
 /** The devDependency range generated packages pin `@orkestrel/scaffold` at. */
-var SCAFFOLD_RANGE = "^0.0.4";
+var SCAFFOLD_RANGE = "^0.0.5";
 /** Tooling versions shared by scaffold and every generated workspace. */
 var BASE_DEV_DEPENDENCIES = Object.freeze({
 	"@microsoft/api-extractor": "^7.58.12",
@@ -5685,30 +5685,69 @@ function rootTsconfig(src, app = []) {
 	});
 }
 /**
+* Derive which host-specific machinery a workspace's generated root
+* `vite.config.ts` carries from its declared environments.
+*
+* @remarks
+* This is the SOLE derivation of that set; `rootViteConfig`,
+* `singleSrcViteConfig`, `applicationViteConfig`, and `configArtifacts` all
+* read it rather than recomputing an axis of their own. Nothing here selects
+* a boundary GUARANTEE — the environment-boundary plugin, its module-graph
+* AST audit, and stylesheet rejection ship in every shape.
+*
+* @param src - The declared published `Environment[]`.
+* @param app - The declared application `Environment[]`, defaulting to none.
+* @param engine - Whether the workspace also builds its own executable.
+* @returns The machinery set the generated header renders.
+*
+* @example
+* ```ts
+* viteMachinery(['core']) // { browser: false, vue: false, output: true }
+* viteMachinery([], ['core']) // { browser: false, vue: false, output: false }
+* ```
+*/
+function viteMachinery(src, app = [], engine = false) {
+	const unbuilt = src.length === 0 && app.length > 0 && !engine && app.every((environment) => environment === "core");
+	return {
+		browser: src.includes("browser") || app.includes("browser"),
+		vue: app.includes("browser"),
+		output: !unbuilt
+	};
+}
+/**
 * The rendered import / `resolve` header block every `rootViteConfig` shape
-* prefixes — the official Playwright provider import appears only when
-* `needsPlaywright`, per the three grounded `rootViteConfig`
-* shapes: unconditional for a multi-environment blueprint, conditional on the
-* sole environment being `'browser'` for a single non-`core` environment, absent for
-* `core`-only.
-*
-* @param needsPlaywright - Whether this shape ships a browser test project (and so needs Playwright).
-* @param needsVue - Whether the generated root imports the Vue Vite plugin.
+* prefixes — the environment boundary and every guarantee it enforces ship
+* unconditionally; `machinery` selects only the host-specific pipelines layered
+* over them, per the three grounded `rootViteConfig` shapes: browser machinery
+* unconditional for a multi-environment blueprint carrying `browser`,
+* conditional on the sole environment being `'browser'` for a single non-`core`
+* environment, absent for `core`-only.
+*
+* @param machinery - The host-specific machinery this shape carries, from `viteMachinery`.
 * @returns The rendered header block, newline-terminated.
 *
 * @example
 * ```ts
-* viteHeader(false).includes('@vitest/browser-playwright') // false
-* viteHeader(true).includes('@vitest/browser-playwright') // true
+* viteHeader(viteMachinery(['core'])).includes('@vitest/browser-playwright') // false
+* viteHeader(viteMachinery(['core', 'browser'])).includes('@vitest/browser-playwright') // true
 * ```
 */
-function viteHeader(needsPlaywright, needsVue = false) {
-	const playwrightImports = needsPlaywright ? `import { playwright } from '@vitest/browser-playwright'
+function viteHeader(machinery) {
+	const { browser: needsBrowser, vue: needsVue, output: needsOutput } = machinery;
+	const playwrightImports = needsBrowser ? `import { playwright } from '@vitest/browser-playwright'
 import { chromium } from 'playwright'
 ` : "";
 	const vueImports = needsVue ? `import vue from '@vitejs/plugin-vue'
 import { parse as parseVue } from 'vue/compiler-sfc'
 ` : "";
+	const viteTypeImports = needsVue ? `import type {
+	CSSOptions,
+	HtmlAssetSource,
+	HTMLOptions,
+	Plugin,
+	ResolvedConfig,
+	UserConfig,
+} from 'vite'` : needsBrowser ? `import type { CSSOptions, Plugin, ResolvedConfig, UserConfig } from 'vite'` : `import type { Plugin, UserConfig } from 'vite'`;
 	const vueBoundary = needsVue ? `,
 		transform: {
 			order: 'pre',
@@ -5868,11 +5907,10 @@ import { parse as parseVue } from 'vue/compiler-sfc'
 				}
 				return restored === code ? null : restored
 			},
-		}` : `,
+		}` : needsBrowser ? `,
 		transform: {
 			order: 'pre',
 			async handler(code, id) {
-				const restored = /[?&]html-proxy(?:[=&]|$)/.test(id) ? restoreIgnoredHtml(code) : code
 				const target = workspacePath(id)
 				const physicalImporter = physicalPath(id)
 				const importerPackageRoot = trustedPackageRootFor(physicalImporter, trustedPackageRoots)
@@ -5886,15 +5924,13 @@ import { parse as parseVue } from 'vue/compiler-sfc'
 				}
 				const environmentModule =
 					target !== undefined && /^(?:app|src)\\/(?:core|browser|server)\\//.test(target)
-				if (!environmentModule && importerPackageRoot === undefined) {
-					return restored === code ? null : restored
-				}
+				if (!environmentModule && importerPackageRoot === undefined) return null
 				if (isCSSRequest(id)) {
 					const config = resolvedConfig
 					if (config === undefined) {
 						this.error('Environment boundary requires resolved Vite configuration')
 					}
-					const stylesheet = await preprocessCSS(restored, id, config)
+					const stylesheet = await preprocessCSS(code, id, config)
 					for (const dependency of stylesheet.deps ?? []) {
 						const physicalDependency = physicalPath(dependency)
 						const dependencyTarget = workspacePath(physicalDependency)
@@ -5908,7 +5944,7 @@ import { parse as parseVue } from 'vue/compiler-sfc'
 						if (dependencyError !== undefined) this.error(dependencyError)
 					}
 				}
-				for (const source of await environmentAssetSources(restored, id)) {
+				for (const source of await environmentAssetSources(code, id)) {
 					const normalizedSource = source.replaceAll('\\\\', '/')
 					const sourceError = environmentSourceError(owner, normalizedSource)
 					if (sourceError !== undefined) this.error(sourceError)
@@ -5951,12 +5987,74 @@ import { parse as parseVue } from 'vue/compiler-sfc'
 					const assetError = environmentPathError(owner, resolvedSource)
 					if (assetError !== undefined) this.error(assetError)
 				}
-				return restored === code ? null : restored
+				return null
+			},
+		}` : `,
+		transform: {
+			order: 'pre',
+			async handler(code, id) {
+				const target = workspacePath(id)
+				const physicalImporter = physicalPath(id)
+				const importerPackageRoot = trustedPackageRootFor(physicalImporter, trustedPackageRoots)
+				if (target === undefined) {
+					if (isOutsideWorkspacePath(id) && importerPackageRoot === undefined) {
+						this.error('Environment modules cannot import files outside the workspace')
+					}
+				} else {
+					const pathError = environmentPathError(owner, target)
+					if (pathError !== undefined) this.error(pathError)
+				}
+				const environmentModule =
+					target !== undefined && /^(?:app|src)\\/(?:core|browser|server)\\//.test(target)
+				if (!environmentModule && importerPackageRoot === undefined) return null
+				for (const source of await environmentAssetSources(code, id)) {
+					const normalizedSource = source.replaceAll('\\\\', '/')
+					const sourceError = environmentSourceError(owner, normalizedSource)
+					if (sourceError !== undefined) this.error(sourceError)
+					const [sourcePath] = normalizedSource.split(/[?#]/)
+					if (sourcePath !== undefined && isBuiltin(sourcePath)) continue
+					const resolution = await this.resolve(normalizedSource, id, { skipSelf: true })
+					const fallbackSource = sourceFallback(physicalImporter, normalizedSource)
+					const physicalSource = physicalPath(resolution?.id ?? fallbackSource)
+					if (importerPackageRoot !== undefined) {
+						const pathLike =
+							normalizedSource.startsWith('.') ||
+							normalizedSource.startsWith('/') ||
+							/^file:/i.test(normalizedSource) ||
+							/^[A-Za-z]:[\\\\/]/.test(normalizedSource)
+						if (pathLike && !containedPath(importerPackageRoot, physicalSource)) {
+							this.error(
+								'Dependency modules cannot import files outside their physical package root',
+							)
+						}
+						if (!pathLike && !containedPath(importerPackageRoot, physicalSource)) {
+							const packageName = packageNameOf(normalizedSource)
+							const packageRoot = normalizedSource.startsWith('#')
+								? workspacePath(physicalSource) === undefined
+									? packageRootForResolved(physicalSource)
+									: undefined
+								: packageName === undefined
+									? undefined
+									: packageRootOf(packageName, physicalSource)
+							if (packageRoot === undefined || !containedPath(packageRoot, physicalSource)) {
+								this.error('Resolved dependencies must remain inside their physical package root')
+							}
+							trustedPackageRoots.add(packageRoot)
+						}
+						continue
+					}
+					const resolvedSource = workspacePath(physicalSource)
+					if (resolvedSource === undefined) {
+						this.error('Environment modules cannot import files outside the workspace')
+					}
+					const assetError = environmentPathError(owner, resolvedSource)
+					if (assetError !== undefined) this.error(assetError)
+				}
+				return null
 			},
 		}`;
 	const environmentBoundary = `
-${CONST_KEYWORD} WORKSPACE_ROOT = realpathSync.native(dirname(fileURLToPath(import.meta.url)))
-${EXPORT_KEYWORD} ${CONST_KEYWORD} IMPORT_META_ENV_PREFIX = 'import.meta.env.'
+${CONST_KEYWORD} WORKSPACE_ROOT = realpathSync.native(dirname(fileURLToPath(import.meta.url)))${needsVue ? `\n${EXPORT_KEYWORD} ${CONST_KEYWORD} IMPORT_META_ENV_PREFIX = 'import.meta.env.'` : ""}
 
 ${EXPORT_KEYWORD} function physicalPath(path: string): string {
 	const [pathWithoutQuery] = path.split('?')
@@ -6001,9 +6099,9 @@ ${EXPORT_KEYWORD} function containedPath(root: string, target: string): boolean
 		relativePath === '' ||
 		(relativePath !== '..' && !relativePath.startsWith(\`..\${sep}\`) && !isAbsolute(relativePath))
 	)
-}
+}${needsVue ? `
 
-${needsVue ? `${EXPORT_KEYWORD} function browserServerRoots(): readonly string[] {
+${EXPORT_KEYWORD} function browserServerRoots(): readonly string[] {
 	const roots: string[] = []
 	for (const path of [
 		'app/browser',
@@ -6285,7 +6383,7 @@ ${EXPORT_KEYWORD} function environmentSourceError(owner: string, source: string)
 	return undefined
 }
 
-${EXPORT_KEYWORD} function stylesheetAssetError(
+${needsBrowser ? `${EXPORT_KEYWORD} function stylesheetAssetError(
 	source: string | undefined,
 	value: string,
 ): string | undefined {
@@ -6332,7 +6430,7 @@ ${EXPORT_KEYWORD} function stylesheetAssetError(
 	return undefined
 }
 
-${EXPORT_KEYWORD} function enforceOutputPath(configured: string, expected: string): void {
+` : ""}${needsOutput ? `${EXPORT_KEYWORD} function enforceOutputPath(configured: string, expected: string): void {
 	if (relative(expected, configured) !== '') {
 		throw new Error(
 			'[orkestrel-output-boundary] Build output must use its exact configured workspace directory',
@@ -6399,7 +6497,7 @@ ${EXPORT_KEYWORD} function outputBoundary(output: string): Plugin {
 	}
 }
 
-${EXPORT_KEYWORD} function decodeAssetSource(source: string): string | undefined {
+` : ""}${EXPORT_KEYWORD} function decodeAssetSource(source: string): string | undefined {
 	try {
 		return decodeURI(source)
 	} catch {
@@ -6407,7 +6505,7 @@ ${EXPORT_KEYWORD} function decodeAssetSource(source: string): string | undefined
 	}
 }
 
-${EXPORT_KEYWORD} function filterHtmlAssetSource(
+${needsVue ? `${EXPORT_KEYWORD} function filterHtmlAssetSource(
 	data: Parameters<NonNullable<HtmlAssetSource['filter']>>[0],
 ): boolean {
 	const decoded = decodeAssetSource(data.value)
@@ -6552,7 +6650,7 @@ ${EXPORT_KEYWORD} function maskIgnoredHtml(environmentKeys: ReadonlySet<string>,
 	)
 }
 
-${EXPORT_KEYWORD} function restoreIgnoredHtml(code: string): string {
+` : ""}${needsVue ? `${EXPORT_KEYWORD} function restoreIgnoredHtml(code: string): string {
 	const literals = code.replace(
 		/(?<prefix>[vV][iI][tT][eE])&#45;(?<suffix>[iI][gG][nN][oO][rR][eE])/gu,
 		'$<prefix>-$<suffix>',
@@ -6608,7 +6706,7 @@ ${EXPORT_KEYWORD} function finalizeHtml(): Plugin {
 	}
 }
 
-${EXPORT_KEYWORD} async function environmentAssetSources(
+` : ""}${EXPORT_KEYWORD} async function environmentAssetSources(
 	code: string,
 	id: string,
 	emitted = false,
@@ -6693,23 +6791,19 @@ ${EXPORT_KEYWORD} async function environmentAssetSources(
 			}
 		},
 	})
-	visitor.visit(parseAst(transformed.code, null, path))
+	visitor.visit(parseSync(path, transformed.code).program)
 	return sources
 }
 
 ${EXPORT_KEYWORD} function environmentBoundary(
 	owner: 'src/core' | 'src/browser' | 'src/server' | 'app/core' | 'app/browser' | 'app/server',
 ): Plugin {
-	const trustedPackageRoots = new Set<string>()
-	let environmentRoot = WORKSPACE_ROOT
-	let resolvedConfig: ResolvedConfig | undefined
+	const trustedPackageRoots = new Set<string>()${needsOutput ? "\n	let environmentRoot = WORKSPACE_ROOT" : ""}${needsBrowser ? "\n	let resolvedConfig: ResolvedConfig | undefined" : ""}
 	return {
 		name: 'orkestrel-environment-boundary',
-		enforce: 'pre',
-		configResolved(config) {
-			environmentRoot = physicalPath(config.root)
-			resolvedConfig = config
-		},
+		enforce: 'pre',${needsOutput || needsBrowser ? `
+		configResolved(config) {${needsOutput ? "\n			environmentRoot = physicalPath(config.root)" : ""}${needsBrowser ? "\n			resolvedConfig = config" : ""}
+		},` : ""}
 ${needsVue ? `		configureServer(server) {
 			if (owner !== 'app/browser') return
 			const roots = browserServerRoots()
@@ -6842,7 +6936,7 @@ ${needsVue ? `		configureServer(server) {
 				}
 			}
 			return null
-		},
+		},${needsOutput ? `
 		async generateBundle(_options, bundle) {
 			for (const output of Object.values(bundle)) {
 				if (output.type === 'chunk') {
@@ -6872,7 +6966,7 @@ ${needsVue ? `		configureServer(server) {
 					if (pathError !== undefined) this.error(pathError)
 				}
 			}
-		},
+		},` : ""}
 		buildEnd(error) {
 			if (error !== undefined) return
 			for (const id of this.getModuleIds()) {
@@ -6893,16 +6987,10 @@ ${needsVue ? `		configureServer(server) {
 	}
 }
 `;
-	return `import type {
-	CSSOptions,
-	HtmlAssetSource,
-	HTMLOptions,
-	Plugin,
-	ResolvedConfig,
-	UserConfig,
-} from 'vite'
-import { isCSSRequest, parseAst, preprocessCSS, transformWithOxc, Visitor } from 'vite'
-import { defineConfig, mergeConfig } from 'vitest/config'
+	return `${viteTypeImports}
+${needsBrowser ? `import { isCSSRequest, parseSync, preprocessCSS, transformWithOxc, Visitor } from 'vite'
+` : `import { parseSync, transformWithOxc, Visitor } from 'vite'
+`}import { defineConfig, mergeConfig } from 'vitest/config'
 import tsconfig from './tsconfig.json' with { type: 'json' }
 import { fileURLToPath, URL } from 'node:url'
 import { isBuiltin } from 'node:module'
@@ -6917,8 +7005,7 @@ import {
 	realpathSync,
 } from 'node:fs'
 import { dirname, isAbsolute, relative, resolve as resolvePath, sep } from 'node:path'
-${playwrightImports}${vueImports}
-${needsPlaywright ? `${CONST_KEYWORD} hasChromium = existsSync(chromium.executablePath())\n` : ""}
+${playwrightImports}${vueImports}${needsBrowser ? `\n${CONST_KEYWORD} hasChromium = existsSync(chromium.executablePath())\n` : ""}
 ${EXPORT_KEYWORD} function resolveWorkspacePath(relativePath: string): string {
 	return fileURLToPath(new URL(relativePath, import.meta.url))
 }
@@ -6939,7 +7026,7 @@ ${CONST_KEYWORD} resolve = {
 	}, {}),
 }
 
-${EXPORT_KEYWORD} ${CONST_KEYWORD} ENVIRONMENT_CSS = Object.freeze({
+${needsBrowser ? `${EXPORT_KEYWORD} ${CONST_KEYWORD} ENVIRONMENT_CSS = Object.freeze({
 	transformer: 'lightningcss',
 	lightningcss: {
 		visitor: () => {
@@ -6970,7 +7057,7 @@ ${EXPORT_KEYWORD} ${CONST_KEYWORD} ENVIRONMENT_CSS = Object.freeze({
 		},
 	},
 } satisfies CSSOptions)
-${EXPORT_KEYWORD} ${CONST_KEYWORD} PACKAGE_MANIFEST_BYTES = 1_048_576
+` : ""}${EXPORT_KEYWORD} ${CONST_KEYWORD} PACKAGE_MANIFEST_BYTES = 1_048_576
 ${EXPORT_KEYWORD} ${CONST_KEYWORD} ENVIRONMENT_MODULE_BYTES = 8_388_608
 ${environmentBoundary}`;
 }
@@ -7007,7 +7094,8 @@ function policyViteProject() {
 * ```
 */
 function singleSrcViteConfig(environment) {
-	const header = viteHeader(environment === "browser");
+	const machinery = viteMachinery([environment]);
+	const header = viteHeader(machinery);
 	if (environment === "browser") return `${header}
 ${EXPORT_KEYWORD} const srcBrowser = (config?: UserConfig): UserConfig =>
 	mergeConfig(
@@ -7015,10 +7103,7 @@ ${EXPORT_KEYWORD} const srcBrowser = (config?: UserConfig): UserConfig =>
 			resolve,
 			css: ENVIRONMENT_CSS,
 			publicDir: false,
-			plugins: [
-				outputBoundary('dist/src/browser'),
-				environmentBoundary('src/browser'),
-			],
+			plugins: [outputBoundary('dist/src/browser'), environmentBoundary('src/browser')],
 			build: {
 				assetsInlineLimit: 0,
 				emptyOutDir: true,
@@ -7078,13 +7163,9 @@ export default defineConfig({
 ${EXPORT_KEYWORD} const srcServer = (config?: UserConfig): UserConfig =>
 	mergeConfig(
 		{
-			resolve,
-			css: ENVIRONMENT_CSS,
+			resolve,${machinery.browser ? "\n			css: ENVIRONMENT_CSS," : ""}
 			publicDir: false,
-			plugins: [
-				outputBoundary('dist/src/server'),
-				environmentBoundary('src/server'),
-			],
+			plugins: [outputBoundary('dist/src/server'), environmentBoundary('src/server')],
 			build: {
 				emptyOutDir: true,
 				sourcemap: true,
@@ -7166,7 +7247,8 @@ export default defineConfig({
 function rootViteConfig(src, engine = false) {
 	const hasCore = src.includes("core");
 	const nonCore = src.filter((environment) => environment !== "core");
-	const header = viteHeader(src.includes("browser"));
+	const machinery = viteMachinery(src);
+	const header = viteHeader(machinery);
 	if (!hasCore) {
 		const [onlyEnvironment] = nonCore;
 		if (onlyEnvironment === "browser" || onlyEnvironment === "server") return singleSrcViteConfig(onlyEnvironment);
@@ -7178,10 +7260,7 @@ ${EXPORT_KEYWORD} const srcBrowser = (config?: UserConfig): UserConfig =>
 			{
 				css: ENVIRONMENT_CSS,
 				publicDir: false,
-				plugins: [
-					outputBoundary('dist/src/browser'),
-					environmentBoundary('src/browser'),
-				],
+				plugins: [outputBoundary('dist/src/browser'), environmentBoundary('src/browser')],
 				build: {
 					assetsInlineLimit: 0,
 					lib: {
@@ -7217,13 +7296,9 @@ ${EXPORT_KEYWORD} const srcBrowser = (config?: UserConfig): UserConfig =>
 ${EXPORT_KEYWORD} const srcServer = (config?: UserConfig): UserConfig =>
 	srcCore(
 		mergeConfig(
-			{
-				css: ENVIRONMENT_CSS,
+			{${machinery.browser ? "\n				css: ENVIRONMENT_CSS," : ""}
 				publicDir: false,
-				plugins: [
-					outputBoundary('dist/src/server'),
-					environmentBoundary('src/server'),
-				],
+				plugins: [outputBoundary('dist/src/server'), environmentBoundary('src/server')],
 				build: {
 					lib: {
 						entry: resolveWorkspacePath('src/server/index.ts'),
@@ -7373,7 +7448,8 @@ export default defineConfig({
 */
 function applicationViteConfig(src, app, engine = false) {
 	const hasSourceCore = src.includes("core");
-	const header = viteHeader(src.includes("browser") || app.includes("browser"), app.includes("browser"));
+	const machinery = viteMachinery(src, app, engine);
+	const header = viteHeader(machinery);
 	const projects = [];
 	const blocks = [];
 	if (src.includes("core")) {
@@ -7382,8 +7458,7 @@ function applicationViteConfig(src, app, engine = false) {
 ${EXPORT_KEYWORD} const srcCore = (config?: UserConfig): UserConfig =>
 	mergeConfig(
 		{
-			resolve,
-			css: ENVIRONMENT_CSS,
+			resolve,${machinery.browser ? "\n			css: ENVIRONMENT_CSS," : ""}
 			publicDir: false,
 			plugins: [environmentBoundary('src/core')],
 			build: { emptyOutDir: true, sourcemap: true, minify: false },
@@ -7465,8 +7540,7 @@ ${EXPORT_KEYWORD} const srcBrowser = (config?: UserConfig): UserConfig =>
 ${EXPORT_KEYWORD} const srcServer = (config?: UserConfig): UserConfig =>
 	mergeConfig(
 		{
-			resolve,
-			css: ENVIRONMENT_CSS,
+			resolve,${machinery.browser ? "\n			css: ENVIRONMENT_CSS," : ""}
 			publicDir: false,
 			plugins: [outputBoundary('dist/src/server'), environmentBoundary('src/server')],
 			build: {
@@ -7502,8 +7576,7 @@ ${EXPORT_KEYWORD} const srcServer = (config?: UserConfig): UserConfig =>
 ${EXPORT_KEYWORD} const appCore = (config?: UserConfig): UserConfig =>
 	mergeConfig(
 		{
-			resolve,
-			css: ENVIRONMENT_CSS,
+			resolve,${machinery.browser ? "\n			css: ENVIRONMENT_CSS," : ""}
 			publicDir: false,
 			plugins: [environmentBoundary('app/core')],
 			test: {
@@ -7580,8 +7653,7 @@ ${EXPORT_KEYWORD} function appBrowser(...config: readonly never[]): UserConfig {
 ${EXPORT_KEYWORD} const appServer = (config?: UserConfig): UserConfig =>
 	mergeConfig(
 		{
-			resolve,
-			css: ENVIRONMENT_CSS,
+			resolve,${machinery.browser ? "\n			css: ENVIRONMENT_CSS," : ""}
 			publicDir: false,
 			plugins: [outputBoundary('dist/app/server'), environmentBoundary('app/server')],
 			build: {
@@ -7713,6 +7785,7 @@ function coreTsconfig() {
 * `configs/src/vite.core.config.ts` — inlines its own `build.lib` /
 * `rolldownOptions` (core's `srcCore` root export carries no build.lib).
 *
+* @param browser - Whether a declared browser environment enables the shared CSS pipeline.
 * @returns The core environment `vite.config.ts` file content, newline-terminated.
 *
 * @example
@@ -7720,12 +7793,11 @@ function coreTsconfig() {
 * coreViteConfig().includes('srcCore(') // true
 * ```
 */
-function coreViteConfig() {
+function coreViteConfig(browser = true) {
 	return `import { defineConfig } from 'vite'
 import dts from 'vite-plugin-dts'
 import {
-	ENVIRONMENT_CSS,
-	environmentBoundary,
+${browser ? "	ENVIRONMENT_CSS,\n" : ""}	environmentBoundary,
 	outputBoundary,
 	srcCore,
 	resolveWorkspacePath,
@@ -7733,8 +7805,7 @@ import {
 
 export default defineConfig(
 	srcCore({
-		css: ENVIRONMENT_CSS,
-		publicDir: false,
+${browser ? "		css: ENVIRONMENT_CSS,\n" : ""}		publicDir: false,
 		plugins: [
 			outputBoundary('dist/src/core'),
 			environmentBoundary('src/core'),
@@ -7956,6 +8027,7 @@ ${spec.engine || spec.src.includes("browser") || spec.app.includes("browser") ?
 * ```
 */
 function configArtifacts(spec) {
+	const machinery = viteMachinery(spec.src, spec.app, spec.engine);
 	const artifacts = [{
 		path: "tsconfig.json",
 		group: "configs",
@@ -7971,7 +8043,7 @@ function configArtifacts(spec) {
 		const row = SRC_MATRIX[environment];
 		for (const path of row.configs) {
 			const isTsconfig = path.endsWith(".json");
-			const content = environment === "core" ? isTsconfig ? coreTsconfig() : coreViteConfig() : isTsconfig ? srcTsconfig(environment) : srcViteConfig(environment);
+			const content = environment === "core" ? isTsconfig ? coreTsconfig() : coreViteConfig(machinery.browser) : isTsconfig ? srcTsconfig(environment) : srcViteConfig(environment);
 			artifacts.push({
 				path,
 				group: "configs",
@@ -9280,5 +9352,6 @@ exports.validateBlueprint = validateBlueprint;
 exports.validateDependencyArray = validateDependencyArray;
 exports.validatePlan = validatePlan;
 exports.viteHeader = viteHeader;
+exports.viteMachinery = viteMachinery;
 
 //# sourceMappingURL=index.cjs.map