@orkestrel/scaffold 0.0.6 → 0.0.8

package/dist/src/core/index.cjs

@@ -77,6 +77,8 @@ var SRC_MATRIX = Object.freeze({
 		formats: Object.freeze(["es", "cjs"])
 	})
 });
+/** The computed configuration files required by a workspace-owned executable. */
+var BIN_CONFIGS = Object.freeze(["configs/src/vite.bin.config.ts", "configs/src/tsconfig.bin.json"]);
 /**
 * The per-environment application matrix: thin config artifacts, Vitest project
 * label, and executable entry where the environment produces a runtime bundle.
@@ -106,7 +108,7 @@ var APP_MATRIX = Object.freeze({
 * `scripts/codex.sh` / `scripts/ollama.sh`), the repository coding-law policy module,
 * the line's seven byte-identical root dotfiles, and the two guides-grouped
 * mirror candidates: the line-wide dev-tooling guide
-* (`guides/src/guide.md`) and the scaffold engine's own self-guide
+* (`guides/src/guide.md`) and the scaffold bin's own self-guide
 * (`guides/src/scaffold.md`). `stageHost` vendors both; each plan carries the
 * subset selected by `selectHostPaths`, omitting the target blueprint's own
 * guide.
@@ -139,6 +141,8 @@ var HOST_PATHS = Object.freeze([
 	"guides/src/guide.md",
 	"guides/src/scaffold.md"
 ]);
+/** The consumer-owned live-service provisioner expected only by service workspaces. */
+var SERVICE_SCRIPT_PATH = "scripts/service.sh";
 /** The package-name RegExp — lowercase alphanumeric-with-hyphens, letter-first. */
 var NAME_PATTERN = /^[a-z][a-z0-9-]*$/;
 /** Maximum bare workspace name length beneath the generated `@orkestrel/` scope. */
@@ -221,11 +225,11 @@ var DEFAULT_VERSION = "0.0.1";
 /** The `engines.node` range the `blueprint` builder fills. */
 var DEFAULT_ENGINES = `>=${MINIMUM_NODE_VERSION}`;
 /** The devDependency range generated packages pin `@orkestrel/scaffold` at. */
-var SCAFFOLD_RANGE = "^0.0.6";
+var SCAFFOLD_RANGE = "^0.0.8";
 /** Tooling versions shared by scaffold and every generated workspace. */
 var BASE_DEV_DEPENDENCIES = Object.freeze({
 	"@microsoft/api-extractor": "^7.58.12",
-	"@orkestrel/guide": "^0.0.5",
+	"@orkestrel/guide": "^0.0.7",
 	"@orkestrel/scaffold": SCAFFOLD_RANGE,
 	"@types/node": "^26.1.2",
 	oxfmt: "^0.61.0",
@@ -420,9 +424,9 @@ function member(name, category, summary, environment = "core") {
 * @remarks
 * `version` / `engines` default `DEFAULT_VERSION` / `DEFAULT_ENGINES`,
 * `src` defaults `['core']`, and `app` / `keywords` / `dependencies` /
-* `peers` / `extras` / `overrides` default `[]`. `description` is OMITTED
-* entirely when absent, so the result round-trips the exact-record
-* `Blueprint` guard.
+* `peers` / `extras` / `overrides` default `[]`, and `bin` / `integration` /
+* `service` default `false`. `description` is OMITTED entirely when absent, so
+* the result round-trips the exact-record `Blueprint` guard.
 * @returns A complete `Blueprint`.
 *
 * @example
@@ -444,7 +448,9 @@ function blueprint(name, options) {
 		version: options?.version ?? "0.0.1",
 		engines: options?.engines ?? DEFAULT_ENGINES,
 		overrides: options?.overrides ?? [],
-		engine: options?.engine ?? false
+		bin: options?.bin ?? false,
+		integration: options?.integration ?? false,
+		service: options?.service ?? false
 	};
 	return options?.description === void 0 ? base : {
 		...base,
@@ -1795,7 +1801,9 @@ function blueprintShape() {
 			max: MAX_RANGE_LENGTH
 		}),
 		overrides: (0, _orkestrel_contract.arrayShape)(overrideShape(), { max: MAX_COLLECTION_ITEMS }),
-		engine: (0, _orkestrel_contract.booleanShape)()
+		bin: (0, _orkestrel_contract.booleanShape)(),
+		integration: (0, _orkestrel_contract.booleanShape)(),
+		service: (0, _orkestrel_contract.booleanShape)()
 	});
 }
 /**
@@ -5523,24 +5531,28 @@ function compareCodeUnit(a, b) {
 	return a < b ? -1 : a > b ? 1 : 0;
 }
 /**
-* The host-neutral devDependency baseline every generated workspace needs.
-* Browser providers are added only by browser selections or the scaffold
-* engine's generated-browser consumer proof. A package's `extras` (code-unit
-* sorted) merge in on top, the extras' declared range winning on a name
-* collision with the baseline.
+* The complete development dependency set one blueprint emits. The shared
+* baseline is extended by package extras, dev-installed peers, selected
+* browser environments, and the bin axis's browser test provider.
 *
-* @param extras - The blueprint's package-specific `extras` `Dependency[]`.
+* @param spec - The blueprint whose development dependencies are required.
 * @returns The merged `devDependencies` record.
 *
 * @example
 * ```ts
-* devDependenciesFor([])['typescript'] // '^6.0.3'
+* devDependenciesFor(blueprint('router'))['typescript'] // '^6.0.3'
 * ```
 */
-function devDependenciesFor(extras) {
-	const baseline = { ...BASE_DEV_DEPENDENCIES };
-	for (const extra of [...extras].sort((a, b) => compareCodeUnit(a.name, b.name))) baseline[extra.name] = extra.range;
-	return baseline;
+function devDependenciesFor(spec) {
+	const dependencies = { ...BASE_DEV_DEPENDENCIES };
+	for (const extra of [...spec.extras].sort((a, b) => compareCodeUnit(a.name, b.name))) dependencies[extra.name] = extra.range;
+	for (const peer of [...spec.peers].sort((a, b) => compareCodeUnit(a.name, b.name))) dependencies[peer.name] = peer.range;
+	return {
+		...dependencies,
+		...spec.src.includes("browser") ? SOURCE_BROWSER_DEV_DEPENDENCIES : {},
+		...spec.app.includes("browser") ? APP_BROWSER_DEV_DEPENDENCIES : {},
+		...spec.bin ? { "@vitest/browser-playwright": SOURCE_BROWSER_DEV_DEPENDENCIES["@vitest/browser-playwright"] } : {}
+	};
 }
 /**
 * Compute the `package.json` artifact's `content`, applying the manifest and
@@ -5565,24 +5577,22 @@ function packageManifest(spec) {
 	for (const peer of [...spec.peers].sort((a, b) => compareCodeUnit(a.name, b.name))) peerDependencies[peer.name] = peer.range;
 	const peerDependenciesMeta = {};
 	for (const peer of spec.peers) if (peer.optional === true) peerDependenciesMeta[peer.name] = { optional: true };
-	const peerDevDependencies = {};
-	for (const peer of [...spec.peers].sort((a, b) => compareCodeUnit(a.name, b.name))) peerDevDependencies[peer.name] = peer.range;
 	const scripts = {
 		clean: "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\"",
 		copy: "node -e \"const fs=require('node:fs'),p=require('node:path'),a=process.argv[1],b=process.argv[2];fs.mkdirSync(p.dirname(b),{recursive:true});fs.cpSync(a,b,{force:true});console.log('Copied: '+a+' to '+b)\"",
-		scaffold: spec.engine ? "node ./dist/bin/scaffold.js" : "scaffold",
+		scaffold: spec.bin ? "node ./dist/bin/scaffold.js" : "scaffold",
 		lint: "oxlint --config .oxlintrc.json --fix --deny-warnings .",
 		check: [
 			"tsc --noEmit --project tsconfig.json",
-			...hasSource || spec.engine ? ["npm run check:src"] : [],
+			...hasSource || spec.bin ? ["npm run check:src"] : [],
 			...spec.app.length > 0 ? ["npm run check:app"] : []
 		].join(" && ")
 	};
-	if (hasSource || spec.engine) {
-		scripts["check:src"] = spec.src.map((environment) => `npm run check:src:${environment}`).join(" && ") + (spec.engine ? `${spec.src.length > 0 ? " && " : ""}npm run check:src:bin` : "");
+	if (hasSource || spec.bin) {
+		scripts["check:src"] = spec.src.map((environment) => `npm run check:src:${environment}`).join(" && ") + (spec.bin ? `${spec.src.length > 0 ? " && " : ""}npm run check:src:bin` : "");
 		for (const environment of spec.src) scripts[`check:src:${environment}`] = `tsc --noEmit -p configs/src/tsconfig.${environment}.json`;
 	}
-	if (spec.engine) scripts["check:src:bin"] = "tsc --noEmit -p configs/src/tsconfig.bin.json";
+	if (spec.bin) scripts["check:src:bin"] = "tsc --noEmit -p configs/src/tsconfig.bin.json";
 	if (spec.app.length > 0) {
 		scripts["check:app"] = spec.app.map((environment) => `npm run check:app:${environment}`).join(" && ");
 		for (const environment of spec.app) scripts[`check:app:${environment}`] = environment === "browser" ? "vue-tsc --noEmit -p configs/app/tsconfig.browser.json" : `tsc --noEmit -p configs/app/tsconfig.${environment}.json`;
@@ -5591,17 +5601,19 @@ function packageManifest(spec) {
 	scripts["format:check"] = "oxfmt --config .oxfmtrc.json --check .";
 	scripts["lint:check"] = "oxlint --config .oxlintrc.json --deny-warnings .";
 	scripts.test = [
-		...hasSource || spec.engine ? ["npm run test:src"] : [],
+		...hasSource || spec.bin ? ["npm run test:src"] : [],
 		...spec.app.length > 0 ? ["npm run test:app"] : [],
 		"npm run test:policy",
 		"npm run test:guides"
 	].join(" && ");
-	if (hasSource || spec.engine) {
-		scripts["test:src"] = "vitest run --config vite.config.ts --no-cache --reporter=dot " + spec.src.map((environment) => `--project src:${environment}`).join(" ") + (spec.engine ? `${spec.src.length > 0 ? " " : ""}--project src:bin` : "");
+	if (hasSource || spec.bin) {
+		scripts["test:src"] = "vitest run --config vite.config.ts --no-cache --reporter=dot " + spec.src.map((environment) => `--project src:${environment}`).join(" ") + (spec.bin ? `${spec.src.length > 0 ? " " : ""}--project src:bin` : "");
 		for (const environment of spec.src) scripts[`test:src:${environment}`] = `vitest run --config vite.config.ts --no-cache --reporter=dot --project src:${environment}`;
 	}
-	if (spec.engine) scripts["test:src:bin"] = "vitest run --config vite.config.ts --no-cache --reporter=dot --project src:bin";
-	if (spec.engine) scripts["test:integration"] = "vitest run --config vite.config.ts --no-cache --reporter=dot --project integration";
+	if (spec.bin) scripts["test:src:bin"] = "vitest run --config vite.config.ts --no-cache --reporter=dot --project src:bin";
+	if (spec.integration) scripts["test:integration"] = "vitest run --config vite.config.ts --no-cache --reporter=dot --project integration";
+	if (spec.bin && spec.integration) scripts["test:equivalence"] = "node -e \"const c=require('node:child_process'),n=process.platform==='win32'?'npm.cmd':'npm',r=c.spawnSync(n,['run','test:integration'],{stdio:'inherit',env:{...process.env,SCAFFOLD_BOUNDARY_EQUIVALENCE:'1'}});process.exit(r.status??1)\"";
+	if (spec.service) scripts["test:service"] = "vitest run --config vite.config.ts --no-cache --reporter=dot --project service";
 	if (spec.app.length > 0) {
 		scripts["test:app"] = "vitest run --config vite.config.ts --no-cache --reporter=dot " + spec.app.map((environment) => `--project ${APP_MATRIX[environment].project}`).join(" ");
 		for (const environment of spec.app) scripts[`test:app:${environment}`] = `vitest run --config vite.config.ts --no-cache --reporter=dot --project ${APP_MATRIX[environment].project}`;
@@ -5610,12 +5622,12 @@ function packageManifest(spec) {
 	scripts["test:guides"] = "vitest run --config vite.config.ts --reporter=dot --project guides";
 	scripts.build = [
 		"npm run clean",
-		...hasSource || spec.engine ? ["npm run build:src"] : [],
+		...hasSource || spec.bin ? ["npm run build:src"] : [],
 		...spec.app.length > 0 ? ["npm run build:app"] : [],
-		...spec.engine ? ["npm run build:host"] : []
+		...spec.bin ? ["npm run build:host"] : []
 	].join(" && ");
-	if (hasSource || spec.engine) {
-		scripts["build:src"] = spec.src.map((environment) => `npm run build:src:${environment}`).join(" && ") + (spec.engine ? `${spec.src.length > 0 ? " && " : ""}npm run build:src:bin` : "");
+	if (hasSource || spec.bin) {
+		scripts["build:src"] = spec.src.map((environment) => `npm run build:src:${environment}`).join(" && ") + (spec.bin ? `${spec.src.length > 0 ? " && " : ""}npm run build:src:bin` : "");
 		for (const environment of spec.src) scripts[`build:src:${environment}`] = environment === "browser" ? `vite build --config configs/src/vite.${environment}.config.ts` : `vite build --config configs/src/vite.${environment}.config.ts && npm run copy dist/src/${environment}/index.d.ts dist/src/${environment}/index.d.cts`;
 	}
 	if (spec.app.length > 0) {
@@ -5628,18 +5640,12 @@ function packageManifest(spec) {
 			scripts["serve:build"] = "npm run build:app:server && npm run serve";
 		}
 	}
-	if (spec.engine) {
+	if (spec.bin) {
 		scripts["build:src:bin"] = "vite build --config configs/src/vite.bin.config.ts";
 		scripts["build:host"] = "node -e \"import('./dist/src/server/index.js').then((m)=>{const n=m.stageHost(process.cwd(),'dist/host').length;console.log('build-host: staged '+n+' file(s) into dist/host')})\"";
 	}
-	scripts.prepublishOnly = "npm run format:check && npm run lint:check && npm run check && npm run build && npm test" + (spec.engine ? " && npm run test:integration" : "");
-	const devDependencies = {
-		...devDependenciesFor(spec.extras),
-		...peerDevDependencies,
-		...spec.src.includes("browser") ? SOURCE_BROWSER_DEV_DEPENDENCIES : {},
-		...spec.app.includes("browser") ? APP_BROWSER_DEV_DEPENDENCIES : {},
-		...spec.engine ? SOURCE_BROWSER_DEV_DEPENDENCIES : {}
-	};
+	scripts.prepublishOnly = "npm run format:check && npm run lint:check && npm run check && npm run build && npm test" + (spec.integration ? " && npm run test:integration" : "");
+	const devDependencies = devDependenciesFor(spec);
 	const manifest = {
 		name: hasSource ? `@orkestrel/${spec.name}` : spec.name,
 		version: spec.version,
@@ -5653,15 +5659,15 @@ function packageManifest(spec) {
 			type: "git",
 			url: `git+https://github.com/orkestrel/${spec.name}.git`
 		},
-		...spec.engine ? { bin: { scaffold: "./dist/bin/scaffold.js" } } : {},
-		files: spec.engine ? [
+		...spec.bin ? { bin: { scaffold: "./dist/bin/scaffold.js" } } : {},
+		files: spec.bin ? [
 			"dist/src",
 			"dist/bin",
 			"dist/host",
 			"README.md"
 		] : hasSource ? ["dist/src", "README.md"] : ["dist/app", "README.md"],
 		type: "module",
-		...hasSource ? { sideEffects: spec.engine ? ["./src/bin/scaffold.ts", "./dist/bin/scaffold.js"] : false } : {},
+		...hasSource ? { sideEffects: spec.bin ? ["./src/bin/scaffold.ts", "./dist/bin/scaffold.js"] : false } : {},
 		...entry === void 0 ? {} : {
 			main: entry.main,
 			module: entry.module,
@@ -5671,7 +5677,7 @@ function packageManifest(spec) {
 		},
 		scripts,
 		dependencies,
-		devDependencies: Object.fromEntries(Object.entries(devDependencies).filter(([depName]) => !spec.engine || depName !== "@orkestrel/scaffold").filter(([depName]) => hasSource || depName !== "@microsoft/api-extractor" && depName !== "vite-plugin-dts").filter(([depName]) => hasSource || spec.app.includes("browser") || depName !== "@vitest/browser-playwright").sort(([a], [b]) => compareCodeUnit(a, b))),
+		devDependencies: Object.fromEntries(Object.entries(devDependencies).filter(([depName]) => !spec.bin || depName !== "@orkestrel/scaffold").filter(([depName]) => hasSource || depName !== "@microsoft/api-extractor" && depName !== "vite-plugin-dts").filter(([depName]) => hasSource || spec.app.includes("browser") || depName !== "@vitest/browser-playwright").sort(([a], [b]) => compareCodeUnit(a, b))),
 		...Object.keys(peerDependencies).length > 0 ? { peerDependencies } : {},
 		...Object.keys(peerDependenciesMeta).length > 0 ? { peerDependenciesMeta } : {},
 		engines: { node: spec.engines }
@@ -5744,7 +5750,7 @@ function rootTsconfig(src, app = []) {
 *
 * @param src - The declared published `Environment[]`.
 * @param app - The declared application `Environment[]`, defaulting to none.
-* @param engine - Whether the workspace also builds its own executable.
+* @param bin - Whether the workspace also builds its own executable.
 * @returns The machinery set the generated header renders.
 *
 * @example
@@ -5753,8 +5759,8 @@ function rootTsconfig(src, app = []) {
 * viteMachinery([], ['core']) // { browser: false, vue: false, output: false }
 * ```
 */
-function viteMachinery(src, app = [], engine = false) {
-	const unbuilt = src.length === 0 && app.length > 0 && !engine && app.every((environment) => environment === "core");
+function viteMachinery(src, app = [], bin = false) {
+	const unbuilt = src.length === 0 && app.length > 0 && !bin && app.every((environment) => environment === "core");
 	return {
 		browser: src.includes("browser") || app.includes("browser"),
 		vue: app.includes("browser"),
@@ -5762,6 +5768,96 @@ function viteMachinery(src, app = [], engine = false) {
 	};
 }
 /**
+* Derive the one ordered Vitest project registration list shared by every
+* generated root configuration shape.
+*
+* @param src - The declared published environments.
+* @param app - The declared application environments.
+* @param axes - Optional executable, integration, and service project axes.
+* @returns Source projects, application projects, proof projects, then optional axis projects.
+*
+* @example
+* ```ts
+* viteProjectRegistrations(['core'], [], { integration: true })
+* // [{ project: 'srcCore' }, { project: 'policy' }, { project: 'guides' }, { project: 'integration' }]
+* ```
+*/
+function viteProjectRegistrations(src, app = [], axes = {}) {
+	const registrations = [];
+	for (const environment of ENVIRONMENTS) {
+		if (!src.includes(environment)) continue;
+		if (environment === "core") registrations.push({ project: "srcCore" });
+		if (environment === "browser") registrations.push({
+			project: "srcBrowser",
+			browser: SRC_MATRIX.browser.project
+		});
+		if (environment === "server") registrations.push({ project: "srcServer" });
+	}
+	for (const environment of ENVIRONMENTS) {
+		if (!app.includes(environment)) continue;
+		if (environment === "core") registrations.push({ project: "appCore" });
+		if (environment === "browser") registrations.push({
+			project: "appBrowser",
+			browser: APP_MATRIX.browser.project
+		});
+		if (environment === "server") registrations.push({ project: "appServer" });
+	}
+	registrations.push({ project: "policy" }, { project: "guides" });
+	if (axes.bin === true) registrations.push({ project: "srcBin" });
+	if (axes.integration === true) registrations.push({ project: "integration" });
+	if (axes.service === true) registrations.push({ project: "service" });
+	return registrations;
+}
+/**
+* Render the one ordered proof and structural-axis project definition block.
+*
+* @param axes - Optional executable, integration, and service project axes.
+* @returns Policy, guides, then selected axis project definitions, separated by one blank line.
+*
+* @example
+* ```ts
+* viteProjectDefinitions({ bin: true }).includes('export const srcBin =') // true
+* ```
+*/
+function viteProjectDefinitions(axes = {}) {
+	const definitions = [policyViteProject(), guidesViteProject()];
+	if (axes.bin === true) definitions.push(binViteProject());
+	if (axes.integration === true) definitions.push(integrationViteProject(axes));
+	if (axes.service === true) definitions.push(serviceViteProject());
+	return definitions.join("\n");
+}
+/**
+* Render the root Vitest project registration, preserving browser ownership
+* supplied by the caller.
+*
+* @param registrations - Ordered project factory identifiers with optional browser labels.
+* @param browser - Whether the generated configuration carries browser machinery.
+* @returns The rendered root `test` property.
+*
+* @example
+* ```ts
+* renderViteTest([{ project: 'srcCore' }], false)
+* // '\ttest: {\n\t\tprojects: [srcCore],\n\t},'
+* ```
+*/
+function renderViteTest(registrations, browser) {
+	const projects = registrations.map((registration) => registration.project);
+	const inlineProjects = `		projects: [${projects.join(", ")}],`;
+	const renderedProjects = computeColumnWidth(inlineProjects) <= 100 ? inlineProjects : `		projects: [
+${projects.map((project) => `			${project},`).join("\n")}
+		],`;
+	if (!browser) return `	test: {
+${renderedProjects}
+	},`;
+	return `	test: gateBrowserProjects(
+		[
+${registrations.map((registration) => registration.browser === void 0 ? `{ project: ${registration.project} }` : `{ project: ${registration.project}, browser: ${serializeTypeScriptString(registration.browser)} }`).map((registration) => `			${registration},`).join("\n")}
+		],
+		hasChromium,
+		process.argv,
+	),`;
+}
+/**
 * The rendered import / `resolve` header block every `rootViteConfig` shape
 * prefixes — the environment boundary and every guarantee it enforces ship
 * unconditionally; `machinery` selects only the host-specific pipelines layered
@@ -5799,6 +5895,7 @@ import { parse as parseVue } from 'vue/compiler-sfc'
 		transform: {
 			order: 'pre',
 			async handler(code, id) {
+				if (!isWorkspaceBoundaryModule(id)) return null
 				const restored = /[?&]html-proxy(?:[=&]|$)/.test(id) ? restoreIgnoredHtml(code) : code
 				const target = workspacePath(id)
 				const physicalImporter = physicalPath(id)
@@ -5958,6 +6055,7 @@ import { parse as parseVue } from 'vue/compiler-sfc'
 		transform: {
 			order: 'pre',
 			async handler(code, id) {
+				if (!isWorkspaceBoundaryModule(id)) return null
 				const target = workspacePath(id)
 				const physicalImporter = physicalPath(id)
 				const importerPackageRoot = trustedPackageRootFor(physicalImporter, trustedPackageRoots)
@@ -6040,6 +6138,7 @@ import { parse as parseVue } from 'vue/compiler-sfc'
 		transform: {
 			order: 'pre',
 			async handler(code, id) {
+				if (!isWorkspaceBoundaryModule(id)) return null
 				const target = workspacePath(id)
 				const physicalImporter = physicalPath(id)
 				const importerPackageRoot = trustedPackageRootFor(physicalImporter, trustedPackageRoots)
@@ -6103,15 +6202,21 @@ import { parse as parseVue } from 'vue/compiler-sfc'
 	const environmentBoundary = `
 ${CONST_KEYWORD} WORKSPACE_ROOT = realpathSync.native(dirname(fileURLToPath(import.meta.url)))${needsVue ? `\n${EXPORT_KEYWORD} ${CONST_KEYWORD} IMPORT_META_ENV_PREFIX = 'import.meta.env.'` : ""}
 
+${EXPORT_KEYWORD} function fileSystemPath(pathname: string): string {
+	if (!pathname.startsWith('/@fs/')) return pathname
+	const candidate = pathname.slice('/@fs/'.length)
+	// Vite URL normalization can collapse the leading slash of a POSIX absolute path.
+	return candidate.startsWith('/') || /^[A-Za-z]:[\\\\/]/.test(candidate)
+		? candidate
+		: \`/\${candidate}\`
+}
+
 ${EXPORT_KEYWORD} function physicalPath(path: string): string {
 	const [pathWithoutQuery] = path.split('?')
-	const candidate = pathWithoutQuery?.startsWith('/@fs/')
-		? pathWithoutQuery.slice('/@fs/'.length)
-		: pathWithoutQuery
-	const physicalCandidate =
-		candidate !== undefined && /^file:/i.test(candidate) ? fileURLToPath(candidate) : candidate
+	const candidate = fileSystemPath(pathWithoutQuery ?? path)
+	const physicalCandidate = /^file:/i.test(candidate) ? fileURLToPath(candidate) : candidate
 	const absoluteCandidate =
-		physicalCandidate === undefined || physicalCandidate.length === 0
+		physicalCandidate.length === 0
 			? WORKSPACE_ROOT
 			: isAbsolute(physicalCandidate)
 				? physicalCandidate
@@ -6131,13 +6236,68 @@ ${EXPORT_KEYWORD} function workspacePath(path: string): string | undefined {
 	return relativePath
 }
 
+${EXPORT_KEYWORD} function isBoundaryExemptModule(id: string): boolean {
+	const normalizedId = id.replaceAll('\\\\', '/')
+	const [path] = normalizedId.split(/[?#]/)
+	if (
+		path === undefined ||
+		normalizedId.startsWith('\\0') ||
+		normalizedId.includes('virtual:') ||
+		normalizedId === '@vite/client' ||
+		normalizedId === '@vite/env' ||
+		normalizedId.startsWith('/@id/') ||
+		normalizedId.startsWith('/@vite/') ||
+		normalizedId.startsWith('/__vite') ||
+		normalizedId.startsWith('/__vitest') ||
+		normalizedId.startsWith('@vitest/browser') ||
+		normalizedId.includes('/@vitest/browser/')
+	) {
+		return true
+	}
+	let physicalId: string | undefined
+	try {
+		physicalId = physicalPath(id).replaceAll('\\\\', '/')
+	} catch {
+		physicalId = undefined
+	}
+	for (const candidate of physicalId === undefined ? [path] : [path, physicalId]) {
+		if (candidate.split('/').some((segment) => segment.toLowerCase() === 'node_modules')) {
+			return true
+		}
+	}
+	return false
+}
+
+${EXPORT_KEYWORD} function isWorkspaceBoundaryModule(id: string): boolean {
+	if (isBoundaryExemptModule(id)) return false
+	const normalizedId = id.replaceAll('\\\\', '/')
+	const [path] = normalizedId.split(/[?#]/)
+	if (path === undefined) return false
+	let candidate = fileSystemPath(path)
+	try {
+		if (/^file:/i.test(candidate)) candidate = fileURLToPath(candidate)
+	} catch {
+		return false
+	}
+	const rootRelative = /^\\/(?:app|src)\\/(?:core|browser|server)\\//.test(candidate)
+	const absoluteCandidate = rootRelative
+		? resolvePath(WORKSPACE_ROOT, candidate.slice(1))
+		: isAbsolute(candidate)
+			? candidate
+			: resolvePath(WORKSPACE_ROOT, candidate)
+	const relativeId = relative(WORKSPACE_ROOT, absoluteCandidate).replaceAll('\\\\', '/')
+	return (
+		relativeId !== '..' &&
+		!relativeId.startsWith('../') &&
+		!isAbsolute(relativeId) &&
+		/^(?:app|src)\\/(?:core|browser|server)\\//.test(relativeId)
+	)
+}
+
 ${EXPORT_KEYWORD} function isOutsideWorkspacePath(path: string): boolean {
 	const [pathWithoutQuery] = path.split('?')
 	if (pathWithoutQuery === undefined) return false
-	const candidate = pathWithoutQuery.startsWith('/@fs/')
-		? pathWithoutQuery.slice('/@fs/'.length)
-		: pathWithoutQuery
-	return isAbsolute(candidate)
+	return isAbsolute(fileSystemPath(pathWithoutQuery))
 }
 
 ${EXPORT_KEYWORD} function containedPath(root: string, target: string): boolean {
@@ -6187,7 +6347,7 @@ ${EXPORT_KEYWORD} function browserServerPath(
 	try {
 		const decoded = decodeURIComponent(pathname)
 		if (decoded.startsWith('/@fs/')) {
-			const candidate = decoded.slice('/@fs/'.length)
+			const candidate = fileSystemPath(decoded)
 			if (candidate.length === 0) return null
 			return physicalPath(candidate)
 		}
@@ -6206,8 +6366,13 @@ ${EXPORT_KEYWORD} function browserServerPath(
 			return undefined
 		}
 		if (/^\\/@(?:app|src)\\//.test(decoded)) return null
+		// Vite owns the app root request, while Vitest owns its in-memory tester root request.
+		if (decoded === '/') return undefined
 		if (!decoded.startsWith('/')) return null
-		return physicalPath(resolvePath(root, decoded.slice(1)))
+		const candidate = physicalPath(resolvePath(root, decoded.slice(1)))
+		if (existsSync(candidate) || !existsSync(decoded)) return candidate
+		// An absolute module URL denotes itself; browserServerRoots still bounds it.
+		return physicalPath(decoded)
 	} catch {
 		return null
 	}
@@ -6708,6 +6873,12 @@ ${EXPORT_KEYWORD} function maskIgnoredHtml(environmentKeys: ReadonlySet<string>,
 	)
 }
 
+${EXPORT_KEYWORD} function isBrowserHtmlEntry(filename: string): boolean {
+	return (
+		physicalPath(filename) === physicalPath(resolvePath(WORKSPACE_ROOT, 'app/browser/index.html'))
+	)
+}
+
 ${EXPORT_KEYWORD} function prepareHtml(): Plugin {
 	const environmentKeys = new Set<string>()
 	return {
@@ -6723,7 +6894,10 @@ ${EXPORT_KEYWORD} function prepareHtml(): Plugin {
 		},
 		transformIndexHtml: {
 			order: 'pre',
-			handler: maskIgnoredHtml.bind(undefined, environmentKeys),
+			handler(html, context) {
+				if (!isBrowserHtmlEntry(context.filename)) return undefined
+				return maskIgnoredHtml(environmentKeys, html)
+			},
 		},
 	}
 }
@@ -6732,7 +6906,10 @@ ${EXPORT_KEYWORD} function restoreHtml(): Plugin {
 	return {
 		name: 'orkestrel-html-boundary-restore',
 		enforce: 'pre',
-		transformIndexHtml: restoreIgnoredHtml,
+		transformIndexHtml(html, context) {
+			if (!isBrowserHtmlEntry(context.filename)) return undefined
+			return restoreIgnoredHtml(html)
+		},
 	}
 }
 
@@ -6742,7 +6919,8 @@ ${EXPORT_KEYWORD} function finalizeHtml(): Plugin {
 		enforce: 'post',
 		transformIndexHtml: {
 			order: 'post',
-			handler(html) {
+			handler(html, context) {
+				if (!isBrowserHtmlEntry(context.filename)) return undefined
 				if (!html.includes(HTML_SECURITY_META)) {
 					throw new Error(
 						'[orkestrel-environment-boundary] Browser HTML must retain its security policy',
@@ -6769,6 +6947,7 @@ ${EXPORT_KEYWORD} function finalizeHtml(): Plugin {
 	const transformed = await transformWithOxc(code, path)
 	const visitor = new Visitor({
 		ImportExpression(node) {
+			if (emitted) return
 			let value: string | undefined
 			if (node.source.type === 'Literal' && typeof node.source.value === 'string') {
 				value = node.source.value
@@ -6867,8 +7046,8 @@ ${needsVue ? `		configureServer(server) {
 			})
 		},
 ` : ""}		async resolveId(source, importer) {
-			if (importer === undefined) return null
-			if (source.startsWith('\\0')) return null
+			if (importer === undefined || !isWorkspaceBoundaryModule(importer)) return null
+			if (isBoundaryExemptModule(source)) return null
 			const normalizedSource = source.replaceAll('\\\\', '/')
 			const sourceError = environmentSourceError(owner, normalizedSource)
 			if (sourceError !== undefined) this.error(sourceError)
@@ -6945,6 +7124,7 @@ ${needsVue ? `		configureServer(server) {
 			return null
 		},
 		async load(id) {
+			if (!isWorkspaceBoundaryModule(id)) return null
 			const physicalImporter = physicalPath(id)
 			const trustedPackageRoot = trustedPackageRootFor(physicalImporter, trustedPackageRoots)
 			const inferredPackageRoot =
@@ -7002,6 +7182,7 @@ ${needsVue ? `		configureServer(server) {
 					const physical = physicalPath(
 						isAbsolute(original) ? original : resolvePath(environmentRoot, original),
 					)
+					if (isBoundaryExemptModule(original) || isBoundaryExemptModule(physical)) continue
 					const target = workspacePath(physical)
 					if (target === undefined) {
 						if (trustedPackageRootFor(physical, trustedPackageRoots) === undefined) {
@@ -7017,6 +7198,7 @@ ${needsVue ? `		configureServer(server) {
 		buildEnd(error) {
 			if (error !== undefined) return
 			for (const id of this.getModuleIds()) {
+				if (!isWorkspaceBoundaryModule(id)) continue
 				const target = workspacePath(id)
 				if (target === undefined) {
 					if (
@@ -7073,7 +7255,58 @@ ${CONST_KEYWORD} resolve = {
 	}, {}),
 }
 
-${needsBrowser ? `${EXPORT_KEYWORD} ${CONST_KEYWORD} ENVIRONMENT_CSS = Object.freeze({
+${needsBrowser ? `${EXPORT_KEYWORD} function gateBrowserProjects(
+	registrations: readonly {
+		readonly project: () => UserConfig
+		readonly browser?: string
+	}[],
+	available: boolean,
+	argv: readonly string[],
+): NonNullable<UserConfig['test']> {
+	const projects: UserConfig[] = []
+	const gated: string[] = []
+	for (const registration of registrations) {
+		if (registration.browser !== undefined && !available) {
+			gated.push(registration.browser)
+			projects.push({
+				resolve,
+				test: {
+					name: { label: registration.browser, color: 'yellow' },
+					include: [],
+					environment: 'node',
+					browser: { enabled: false },
+				},
+			})
+			continue
+		}
+		projects.push(registration.project())
+	}
+	if (gated.length === 0) return { projects }
+	console.warn(\`browser projects skipped: Chromium absent (\${gated.join(', ')})\`)
+	const filters: string[] = []
+	let readable = true
+	for (let index = 0; index < argv.length; index += 1) {
+		const argument = argv[index]
+		if (argument === '--project') {
+			const filter = argv[index + 1]
+			if (filter === undefined) {
+				readable = false
+				continue
+			}
+			filters.push(filter)
+			index += 1
+			continue
+		}
+		if (argument?.startsWith('--project=') === true) {
+			filters.push(argument.slice('--project='.length))
+		}
+	}
+	return readable && filters.length > 0 && filters.every((filter) => gated.includes(filter))
+		? { passWithNoTests: true, projects }
+		: { projects }
+}
+
+${EXPORT_KEYWORD} ${CONST_KEYWORD} ENVIRONMENT_CSS = Object.freeze({
 	transformer: 'lightningcss',
 	lightningcss: {
 		visitor: () => {
@@ -7104,11 +7337,28 @@ ${needsBrowser ? `${EXPORT_KEYWORD} ${CONST_KEYWORD} ENVIRONMENT_CSS = Object.fr
 		},
 	},
 } satisfies CSSOptions)
+
+/** Prevent the Vitest browser mid-run "optimized dependencies changed, reloading" stall. */
+${EXPORT_KEYWORD} ${CONST_KEYWORD} BROWSER_TEST_DEPENDENCIES = Object.freeze([
+	'@vitest/browser/client',
+	'vitest/browser',
+	'vitest/internal/browser',
+	'vitest',
+])
 ` : ""}${EXPORT_KEYWORD} ${CONST_KEYWORD} PACKAGE_MANIFEST_BYTES = 1_048_576
 ${EXPORT_KEYWORD} ${CONST_KEYWORD} ENVIRONMENT_MODULE_BYTES = 8_388_608
 ${environmentBoundary}`;
 }
-/** Build the dedicated Node-only repository policy Vitest project. */
+/**
+* Build the dedicated standalone Node-only repository-policy Vitest project.
+*
+* @returns The emitted `policy` project definition.
+*
+* @example
+* ```ts
+* policyViteProject().includes("label: 'policy'") // true
+* ```
+*/
 function policyViteProject() {
 	return `${EXPORT_KEYWORD} const policy = (config?: UserConfig): UserConfig =>
 	mergeConfig(
@@ -7127,12 +7377,150 @@ function policyViteProject() {
 `;
 }
 /**
+* Build the standalone Node-only guide-parity Vitest project.
+*
+* @returns The emitted `guides` project definition.
+*
+* @example
+* ```ts
+* guidesViteProject().includes("label: 'guides'") // true
+* ```
+*/
+function guidesViteProject() {
+	return `${EXPORT_KEYWORD} const guides = (config?: UserConfig): UserConfig =>
+	mergeConfig(
+		{
+			resolve,
+			test: {
+				name: { label: 'guides', color: 'green' },
+				include: ['tests/guides/**/*.test.ts'],
+				exclude: ['tests/src/**/*.test.ts', 'tests/app/**/*.test.ts', 'tests/setup.test.ts'],
+				setupFiles: ['./tests/setup.ts'],
+				environment: 'node',
+				browser: { enabled: false },
+			},
+		},
+		config ?? {},
+	)
+`;
+}
+/**
+* Build the executable's dedicated Node-only build and test project.
+*
+* @returns The emitted `srcBin` project definition.
+*
+* @example
+* ```ts
+* binViteProject().includes("label: 'src:bin'") // true
+* ```
+*/
+function binViteProject() {
+	return `${EXPORT_KEYWORD} const srcBin = (config?: UserConfig): UserConfig =>
+	mergeConfig(
+		{
+			resolve,
+			publicDir: false,
+			plugins: [outputBoundary('dist/bin')],
+			build: {
+				emptyOutDir: true,
+				sourcemap: true,
+				minify: false,
+				lib: {
+					entry: resolveWorkspacePath('src/bin/scaffold.ts'),
+					formats: ['es'],
+					fileName: () => 'scaffold.js',
+				},
+				outDir: 'dist/bin',
+				target: 'node22',
+				rolldownOptions: { external: [/^node:/, /^@orkestrel\\//, /^@src\\//] },
+			},
+			test: {
+				name: { label: 'src:bin', color: 'yellow' },
+				include: ['tests/src/bin/**/*.test.ts'],
+				setupFiles: ['./tests/setup.ts', './tests/setupServer.ts'],
+				environment: 'node',
+				browser: { enabled: false },
+			},
+		},
+		config ?? {},
+	)
+`;
+}
+/**
+* Build the standalone Node-only installed-consumer integration proof project.
+*
+* @param axes - Optional executable and integration axes controlling the shared registry setup.
+* @returns The emitted `integration` project definition.
+*
+* @example
+* ```ts
+* integrationViteProject({ bin: true, integration: true }).includes(
+*   "globalSetup: ['./tests/setupIntegration.ts']",
+* ) // true
+* ```
+*/
+function integrationViteProject(axes = {}) {
+	return `${EXPORT_KEYWORD} const integration = (config?: UserConfig): UserConfig =>
+	mergeConfig(
+		{
+			resolve,
+			test: {
+				name: { label: 'integration', color: 'blue' },
+				include: ['tests/integration/**/*.test.ts'],
+				setupFiles: ['./tests/setup.ts'],
+${axes.bin === true && axes.integration === true ? `				// Wire the template registry for the generated-consumer proof.
+				globalSetup: ['./tests/setupIntegration.ts'],
+` : ""}				environment: 'node',
+				browser: { enabled: false },
+				testTimeout: 120_000,
+				hookTimeout: 120_000,
+				fileParallelism: false,
+			},
+		},
+		config ?? {},
+	)
+`;
+}
+/**
+* Build the standalone Node-only live-service proof project.
+*
+* @returns The emitted `service` project definition.
+*
+* @example
+* ```ts
+* serviceViteProject().includes("label: 'service'") // true
+* ```
+*/
+function serviceViteProject() {
+	return `${EXPORT_KEYWORD} const service = (config?: UserConfig): UserConfig =>
+	mergeConfig(
+		{
+			resolve,
+			test: {
+				name: { label: 'service', color: 'red' },
+				include: ['tests/service/**/*.test.ts'],
+				setupFiles: ['./tests/setup.ts', './tests/setupService.ts'],
+				environment: 'node',
+				browser: { enabled: false },
+				testTimeout: 120_000,
+				hookTimeout: 120_000,
+				fileParallelism: false,
+			},
+		},
+		config ?? {},
+	)
+`;
+}
+/**
 * The single non-`core` environment's factory IS the base (Shape 3 of
 * `rootViteConfig`) — the environment's own `viteHeader` (Playwright only when
 * `environment === 'browser'`, per the live sqlite/indexeddb exemplars) prefixes
-* the environment-specific `srcBrowser` / `srcServer` + `guides` projects export.
+* the environment-specific `srcBrowser` / `srcServer` project, followed by the
+* standalone policy and guides proof projects and any selected structural-axis
+* projects.
 *
 * @param environment - The sole declared non-`core` environment.
+* @param axes - Optional executable, integration, and service project axes.
 * @returns The root `vite.config.ts` file content for a single non-`core` environment, newline-terminated.
 *
 * @example
@@ -7140,11 +7528,12 @@ function policyViteProject() {
 * singleSrcViteConfig('server').includes('srcServer') // true
 * ```
 */
-function singleSrcViteConfig(environment) {
+function singleSrcViteConfig(environment, axes = {}) {
 	const machinery = viteMachinery([environment]);
 	const header = viteHeader(machinery);
+	const renderedTest = renderViteTest(viteProjectRegistrations([environment], [], axes), machinery.browser);
+	const definitions = viteProjectDefinitions(axes);
 	if (environment === "browser") return `${header}
-if (!hasChromium) console.warn('browser projects skipped: Chromium absent (${SRC_MATRIX.browser.project})')
 ${EXPORT_KEYWORD} const srcBrowser = (config?: UserConfig): UserConfig =>
 	mergeConfig(
 		{
@@ -7169,11 +7558,22 @@ ${EXPORT_KEYWORD} const srcBrowser = (config?: UserConfig): UserConfig =>
 			},
 			test: {
 				name: { label: 'src:browser', color: 'yellow' },
-				include: hasChromium ? ['tests/src/browser/**/*.test.ts'] : [],
-				passWithNoTests: !hasChromium,
+				include: ['tests/src/browser/**/*.test.ts'],
 				setupFiles: ['./tests/setup.ts', './tests/setupBrowser.ts'],
+				...(config?.test?.browser?.enabled === false
+					? {}
+					: {
+							deps: {
+								optimizer: {
+									client: {
+										enabled: true,
+										include: [...BROWSER_TEST_DEPENDENCIES],
+									},
+								},
+							},
+						}),
 				browser: {
-					enabled: hasChromium,
+					enabled: true,
 					provider: playwright(),
 					instances: [{ browser: 'chromium', headless: true }],
 				},
@@ -7183,28 +7583,10 @@ ${EXPORT_KEYWORD} const srcBrowser = (config?: UserConfig): UserConfig =>
 		config ?? {},
 	)
 
-${policyViteProject()}
-${EXPORT_KEYWORD} const guides = (config?: UserConfig): UserConfig =>
-	srcBrowser(
-		mergeConfig(
-			{
-				test: {
-					name: { label: 'guides', color: 'green' },
-					include: ['tests/guides/**/*.test.ts'],
-					exclude: ['tests/src/**/*.test.ts', 'tests/setup.test.ts'],
-					environment: 'node',
-					browser: { enabled: false },
-				},
-			},
-			config ?? {},
-		),
-	)
-
+${definitions}
 export default defineConfig({
 	resolve,
-	test: {
-		projects: [...(hasChromium ? [srcBrowser] : []), policy, guides],
-	},
+${renderedTest}
 })
 `;
 	return `${header}
@@ -7240,33 +7622,18 @@ ${EXPORT_KEYWORD} const srcServer = (config?: UserConfig): UserConfig =>
 		config ?? {},
 	)
 
-${policyViteProject()}
-${EXPORT_KEYWORD} const guides = (config?: UserConfig): UserConfig =>
-	srcServer(
-		mergeConfig(
-			{
-				test: {
-					name: { label: 'guides', color: 'green' },
-					include: ['tests/guides/**/*.test.ts'],
-					exclude: ['tests/src/**/*.test.ts', 'tests/setup.test.ts'],
-				},
-			},
-			config ?? {},
-		),
-	)
-
+${definitions}
 export default defineConfig({
 	resolve,
-	test: {
-		projects: [srcServer, policy, guides],
-	},
+${renderedTest}
 })
 `;
 }
 /**
 * The root `vite.config.ts` — three grounded shapes, chosen by a blueprint's
 * `src`:
-*   1. `core`-only — `srcCore` + `guides`, no Playwright at all (the live
+*   1. `core`-only — `srcCore` + standalone policy/guides proof projects, no
+*      Playwright at all (the live
 *      timeout exemplar: no browser project exists anywhere in the file).
 *   2. Multi-environment (2+ src, always including `core` per the live
 *      middleware/router exemplars) — `srcCore` is the shared base;
@@ -7281,10 +7648,9 @@ export default defineConfig({
 *      environment is `browser` (it must run its own tests in a real browser).
 *
 * @param src - The declared `Environment[]`.
-* @param engine - Structural: `true` appends the `srcBin` project (an
-*   executable build target, never a barrel) after the other declared
-*   projects — the self-hosting tax, grounded against this very repo's own
-*   checked-in `vite.config.ts`.
+* @param axes - Optional structural project axes. `bin` appends the standalone
+*   executable build-and-test project; `integration` and `service` append their
+*   standalone proof projects.
 * @returns The root `vite.config.ts` file content, newline-terminated.
 *
 * @example
@@ -7292,14 +7658,14 @@ export default defineConfig({
 * rootViteConfig(['core']).includes('srcCore') // true
 * ```
 */
-function rootViteConfig(src, engine = false) {
+function rootViteConfig(src, axes = {}) {
 	const hasCore = src.includes("core");
-	const nonCore = src.filter((environment) => environment !== "core");
+	const nonCore = ENVIRONMENTS.filter((environment) => environment !== "core" && src.includes(environment));
 	const machinery = viteMachinery(src);
 	const header = viteHeader(machinery);
 	if (!hasCore) {
 		const [onlyEnvironment] = nonCore;
-		if (onlyEnvironment === "browser" || onlyEnvironment === "server") return singleSrcViteConfig(onlyEnvironment);
+		if (onlyEnvironment === "browser" || onlyEnvironment === "server") return singleSrcViteConfig(onlyEnvironment, axes);
 	}
 	const browserBlock = `
 ${EXPORT_KEYWORD} const srcBrowser = (config?: UserConfig): UserConfig =>
@@ -7324,12 +7690,23 @@ ${EXPORT_KEYWORD} const srcBrowser = (config?: UserConfig): UserConfig =>
 				},
 				test: {
 					name: { label: 'src:browser', color: 'yellow' },
-					include: hasChromium ? ['tests/src/browser/**/*.test.ts'] : [],
-					passWithNoTests: !hasChromium,
+					include: ['tests/src/browser/**/*.test.ts'],
 					exclude: ['tests/src/core/**/*.test.ts'],
 					setupFiles: ['./tests/setup.ts', './tests/setupBrowser.ts'],
+					...(config?.test?.browser?.enabled === false
+						? {}
+						: {
+								deps: {
+									optimizer: {
+										client: {
+											enabled: true,
+											include: [...BROWSER_TEST_DEPENDENCIES],
+										},
+									},
+								},
+							}),
 					browser: {
-						enabled: hasChromium,
+						enabled: true,
 						provider: playwright(),
 						instances: [{ browser: 'chromium', headless: true }],
 					},
@@ -7382,65 +7759,10 @@ ${EXPORT_KEYWORD} const srcServer = (config?: UserConfig): UserConfig =>
 		),
 	)
 `;
-	const binBlock = engine ? `
-${EXPORT_KEYWORD} const srcBin = (config?: UserConfig): UserConfig =>
-	srcCore(
-		mergeConfig(
-			{
-				publicDir: false,
-				plugins: [outputBoundary('dist/bin')],
-				build: {
-					lib: {
-						entry: resolveWorkspacePath('src/bin/scaffold.ts'),
-						formats: ['es'],
-						fileName: () => 'scaffold.js',
-					},
-					outDir: 'dist/bin',
-					target: 'node22',
-					rolldownOptions: {
-						external: [/^node:/, /^@orkestrel\\//, /^@src\\//],
-					},
-				},
-				test: {
-					name: { label: 'src:bin', color: 'yellow' },
-					include: ['tests/src/bin/**/*.test.ts'],
-					exclude: ['tests/src/core/**/*.test.ts', 'tests/src/server/**/*.test.ts'],
-					setupFiles: ['./tests/setup.ts', './tests/setupServer.ts'],
-				},
-			},
-			config ?? {},
-		),
-	)
-
-${EXPORT_KEYWORD} const integration = (config?: UserConfig): UserConfig =>
-	srcBin(
-		mergeConfig(
-			{
-				test: {
-					name: { label: 'integration', color: 'blue' },
-					include: ['tests/integration/**/*.test.ts'],
-					exclude: ['tests/src/**/*.test.ts', 'tests/guides/**/*.test.ts'],
-				},
-			},
-			config ?? {},
-		),
-	)
-` : "";
-	const blocks = nonCore.map((environment) => environment === "browser" ? browserBlock : serverBlock).join("") + binBlock;
-	const projectNames = [
-		...hasCore ? ["srcCore"] : [],
-		...nonCore.map((environment) => environment === "browser" ? "...(hasChromium ? [srcBrowser] : [])" : `src${pascalCase(environment)}`),
-		"policy",
-		"guides",
-		...engine ? ["srcBin"] : [],
-		...engine ? ["integration"] : []
-	];
-	const inlineProjects = `		projects: [${projectNames.join(", ")}],`;
-	const renderedProjects = computeColumnWidth(inlineProjects) <= 100 ? inlineProjects : `		projects: [
-${projectNames.map((project) => `			${project},`).join("\n")}
-		],`;
+	const blocks = nonCore.map((environment) => environment === "browser" ? browserBlock : serverBlock).join("");
+	const renderedTest = renderViteTest(viteProjectRegistrations(src, [], axes), machinery.browser);
 	return `${header}
-${machinery.browser ? `if (!hasChromium) console.warn('browser projects skipped: Chromium absent (${SRC_MATRIX.browser.project})')\n` : ""}${EXPORT_KEYWORD} const srcCore = (config?: UserConfig): UserConfig =>
+${EXPORT_KEYWORD} const srcCore = (config?: UserConfig): UserConfig =>
 	mergeConfig(
 		{
 			resolve,
@@ -7460,27 +7782,11 @@ ${machinery.browser ? `if (!hasChromium) console.warn('browser projects skipped:
 		},
 		config ?? {},
 	)
-
-${policyViteProject()}
-${EXPORT_KEYWORD} const guides = (config?: UserConfig): UserConfig =>
-	srcCore(
-		mergeConfig(
-			{
-				test: {
-					name: { label: 'guides', color: 'green' },
-					include: ['tests/guides/**/*.test.ts'],
-					exclude: ['tests/src/**/*.test.ts', 'tests/setup.test.ts'],
-				},
-			},
-			config ?? {},
-		),
-	)
 ${blocks}
+${viteProjectDefinitions(axes)}
 export default defineConfig({
 	resolve,
-	test: {
-${renderedProjects}
-	},
+${renderedTest}
 })
 `;
 }
@@ -7490,7 +7796,7 @@ ${renderedProjects}
 *
 * @param src - Published src environments.
 * @param app - Private app environments.
-* @param engine - Whether the workspace also builds scaffold's executable.
+* @param axes - Optional executable, integration, and service project axes.
 * @returns The root `vite.config.ts` content.
 *
 * @example
@@ -7498,15 +7804,12 @@ ${renderedProjects}
 * applicationViteConfig([], ['core', 'server']).includes('appServer') // true
 * ```
 */
-function applicationViteConfig(src, app, engine = false) {
+function applicationViteConfig(src, app, axes = {}) {
 	const hasSourceCore = src.includes("core");
-	const machinery = viteMachinery(src, app, engine);
+	const machinery = viteMachinery(src, app, axes.bin === true);
 	const header = viteHeader(machinery);
-	const projects = [];
 	const blocks = [];
-	if (src.includes("core")) {
-		projects.push("srcCore");
-		blocks.push(`
+	if (src.includes("core")) blocks.push(`
 ${EXPORT_KEYWORD} const srcCore = (config?: UserConfig): UserConfig =>
 	mergeConfig(
 		{
@@ -7525,9 +7828,7 @@ ${EXPORT_KEYWORD} const srcCore = (config?: UserConfig): UserConfig =>
 		config ?? {},
 	)
 `);
-	}
 	if (src.includes("browser")) {
-		projects.push("...(hasChromium ? [srcBrowser] : [])");
 		const coreOutput = hasSourceCore ? `
 					output: { paths: { '@src/core': '../core/index.js' } },` : "";
 		const coreExternal = hasSourceCore ? `id === '@src/core' || ` : "";
@@ -7556,11 +7857,22 @@ ${EXPORT_KEYWORD} const srcBrowser = (config?: UserConfig): UserConfig =>
 			},
 			test: {
 				name: { label: 'src:browser', color: 'yellow' },
-				include: hasChromium ? ['tests/src/browser/**/*.test.ts'] : [],
-				passWithNoTests: !hasChromium,
+				include: ['tests/src/browser/**/*.test.ts'],
 				${hasSourceCore ? "exclude: ['tests/src/core/**/*.test.ts'],\n				" : ""}setupFiles: ['./tests/setup.ts', './tests/setupBrowser.ts'],
+				...(config?.test?.browser?.enabled === false
+					? {}
+					: {
+							deps: {
+								optimizer: {
+									client: {
+										enabled: true,
+										include: [...BROWSER_TEST_DEPENDENCIES],
+									},
+								},
+							},
+						}),
 				browser: {
-					enabled: hasChromium,
+					enabled: true,
 					provider: playwright(),
 					instances: [{ browser: 'chromium', headless: true }],
 				},
@@ -7572,7 +7884,6 @@ ${EXPORT_KEYWORD} const srcBrowser = (config?: UserConfig): UserConfig =>
 `);
 	}
 	if (src.includes("server")) {
-		projects.push("srcServer");
 		const coreOutput = hasSourceCore ? `
 					output: [
 						{
@@ -7622,9 +7933,7 @@ ${EXPORT_KEYWORD} const srcServer = (config?: UserConfig): UserConfig =>
 	)
 `);
 	}
-	if (app.includes("core")) {
-		projects.push("appCore");
-		blocks.push(`
+	if (app.includes("core")) blocks.push(`
 ${EXPORT_KEYWORD} const appCore = (config?: UserConfig): UserConfig =>
 	mergeConfig(
 		{
@@ -7642,10 +7951,7 @@ ${EXPORT_KEYWORD} const appCore = (config?: UserConfig): UserConfig =>
 		config ?? {},
 	)
 `);
-	}
-	if (app.includes("browser")) {
-		projects.push("...(hasChromium ? [appBrowser()] : [])");
-		blocks.push(`
+	if (app.includes("browser")) blocks.push(`
 ${EXPORT_KEYWORD} function appBrowser(...config: readonly never[]): UserConfig {
 	if (config.length > 0) {
 		throw new Error(
@@ -7664,7 +7970,6 @@ ${EXPORT_KEYWORD} function appBrowser(...config: readonly never[]): UserConfig {
 			prepareHtml(),
 			finalizeHtml(),
 		],
-		optimizeDeps: { include: ['vue'] },
 		root: resolveWorkspacePath('app/browser'),
 		publicDir: false,
 		server: {
@@ -7685,11 +7990,18 @@ ${EXPORT_KEYWORD} function appBrowser(...config: readonly never[]): UserConfig {
 			name: { label: '${APP_MATRIX.browser.project}', color: 'blue' },
 			root: resolveWorkspacePath('.'),
 			dir: resolveWorkspacePath('.'),
-			include: hasChromium ? ['tests/app/browser/**/*.test.ts'] : [],
-			passWithNoTests: !hasChromium,
+			include: ['tests/app/browser/**/*.test.ts'],
 			setupFiles: ['./tests/setup.ts', './tests/setupBrowser.ts'],
+			deps: {
+				optimizer: {
+					client: {
+						enabled: true,
+						include: ['vue', ...BROWSER_TEST_DEPENDENCIES],
+					},
+				},
+			},
 			browser: {
-				enabled: hasChromium,
+				enabled: true,
 				provider: playwright(),
 				instances: [{ browser: 'chromium', headless: true }],
 			},
@@ -7698,10 +8010,7 @@ ${EXPORT_KEYWORD} function appBrowser(...config: readonly never[]): UserConfig {
 	}
 }
 `);
-	}
-	if (app.includes("server")) {
-		projects.push("appServer");
-		blocks.push(`
+	if (app.includes("server")) blocks.push(`
 ${EXPORT_KEYWORD} const appServer = (config?: UserConfig): UserConfig =>
 	mergeConfig(
 		{
@@ -7732,89 +8041,13 @@ ${EXPORT_KEYWORD} const appServer = (config?: UserConfig): UserConfig =>
 		config ?? {},
 	)
 `);
-	}
-	if (engine) {
-		projects.push("srcBin", "integration");
-		blocks.push(`
-${EXPORT_KEYWORD} const srcBin = (config?: UserConfig): UserConfig =>
-	mergeConfig(
-		{
-			resolve,
-			publicDir: false,
-			plugins: [outputBoundary('dist/bin')],
-			build: {
-				lib: {
-					entry: resolveWorkspacePath('src/bin/scaffold.ts'),
-					formats: ['es'],
-					fileName: () => 'scaffold.js',
-				},
-				outDir: 'dist/bin',
-				target: 'node22',
-				rolldownOptions: { external: [/^node:/, /^@orkestrel\\//, /^@src\\//] },
-			},
-			test: {
-				name: { label: 'src:bin', color: 'yellow' },
-				include: ['tests/src/bin/**/*.test.ts'],
-				setupFiles: ['./tests/setup.ts', './tests/setupServer.ts'],
-				environment: 'node',
-				browser: { enabled: false },
-			},
-		},
-		config ?? {},
-	)
-
-${EXPORT_KEYWORD} const integration = (config?: UserConfig): UserConfig =>
-	srcBin(
-		mergeConfig(
-			{
-				test: {
-					name: { label: 'integration', color: 'blue' },
-					include: ['tests/integration/**/*.test.ts'],
-					exclude: ['tests/src/**/*.test.ts', 'tests/app/**/*.test.ts', 'tests/guides/**/*.test.ts'],
-				},
-			},
-			config ?? {},
-		),
-	)
-`);
-	}
-	const projectNames = [
-		...projects,
-		"policy",
-		"guides"
-	];
-	const inlineProjects = `		projects: [${projectNames.join(", ")}],`;
-	const renderedProjects = computeColumnWidth(inlineProjects) <= 100 ? inlineProjects : `		projects: [
-${projectNames.map((project) => `			${project},`).join("\n")}
-		],`;
-	const browserProjects = [...src.includes("browser") ? [SRC_MATRIX.browser.project] : [], ...app.includes("browser") ? [APP_MATRIX.browser.project] : []];
-	const browserNotice = serializeTypeScriptString(`browser projects skipped: Chromium absent (${browserProjects.join(", ")})`);
-	const inlineBrowserNotice = `if (!hasChromium) console.warn(${browserNotice})`;
-	const renderedBrowserNotice = browserProjects.length === 0 ? void 0 : computeColumnWidth(inlineBrowserNotice) <= 100 ? inlineBrowserNotice : `if (!hasChromium)
-	console.warn(${browserNotice})`;
-	return `${header}
-${renderedBrowserNotice === void 0 ? "" : `${renderedBrowserNotice}\n`}${policyViteProject()}
-${EXPORT_KEYWORD} const guides = (config?: UserConfig): UserConfig =>
-	mergeConfig(
-		{
-			resolve,
-			test: {
-				name: { label: 'guides', color: 'green' },
-				include: ['tests/guides/**/*.test.ts'],
-				exclude: ['tests/src/**/*.test.ts', 'tests/app/**/*.test.ts', 'tests/setup.test.ts'],
-				setupFiles: ['./tests/setup.ts'],
-				environment: 'node',
-				browser: { enabled: false },
-			},
-		},
-		config ?? {},
-	)
-${blocks.join("")}
+	const renderedTest = renderViteTest(viteProjectRegistrations(src, app, axes), machinery.browser);
+	const definitions = viteProjectDefinitions(axes);
+	return `${header}${blocks.join("")}
+${definitions}
 export default defineConfig({
 	resolve,
-	test: {
-${renderedProjects}
-	},
+${renderedTest}
 })
 `;
 }
@@ -7965,6 +8198,67 @@ export default defineConfig(
 `;
 }
 /**
+* Build the executable's declaration-only `configs/src/tsconfig.bin.json`.
+*
+* @returns The executable `tsconfig` file content, newline-terminated.
+*
+* @example
+* ```ts
+* binTsconfig().includes('"outDir": "../../dist/bin"') // true
+* ```
+*/
+function binTsconfig() {
+	return formatJson({
+		extends: "../../tsconfig.json",
+		compilerOptions: {
+			lib: ["ESNext"],
+			types: ["node"],
+			noEmit: false,
+			declaration: true,
+			emitDeclarationOnly: true,
+			rootDir: "../../src",
+			outDir: "../../dist/bin"
+		},
+		include: TYPESCRIPT_EXTENSIONS.map((extension) => `../../src/bin/**/*.${extension}`)
+	});
+}
+/**
+* Build the executable's `configs/src/vite.bin.config.ts` wrapper.
+*
+* @returns The executable Vite configuration content, newline-terminated.
+*
+* @example
+* ```ts
+* binViteConfig().includes("banner: '#!/usr/bin/env node'") // true
+* ```
+*/
+function binViteConfig() {
+	return `import { defineConfig } from 'vite'
+import { srcBin } from '../../vite.config'
+
+// The \`scaffold\` executable build — a single ESM lib file, no declarations (an
+// executable ships no types), with the \`#!/usr/bin/env node\` shebang re-emitted via
+// \`output.banner\` (rolldown strips shebangs from source during bundling), and
+// \`output.paths\` rewriting the externalized \`@src/*\` specifiers to the built sibling
+// src environments (relative to \`dist/bin/\`), so the emitted bin resolves at runtime.
+export default defineConfig(
+	srcBin({
+		build: {
+			rolldownOptions: {
+				output: {
+					banner: '#!/usr/bin/env node',
+					paths: {
+						'@src/core': '../src/core/index.js',
+						'@src/server': '../src/server/index.js',
+					},
+				},
+			},
+		},
+	}),
+)
+`;
+}
+/**
 * Build one `configs/app/tsconfig.<environment>.json` check-only configuration.
 *
 * @param environment - The application environment.
@@ -8013,12 +8307,25 @@ export default defineConfig(${anchor}())
 `;
 }
 /**
-* Build selection-aware GitHub CI without external service dependencies.
+* Build selection-aware GitHub CI, provisioning the declared foreign service before its proof.
 *
 * @param spec - The workspace blueprint.
 * @returns The complete `.github/workflows/ci.yml` content.
 */
 function ciWorkflow(spec) {
+	const browser = spec.bin || spec.src.includes("browser") || spec.app.includes("browser") ? `
+      - name: Install Playwright browsers
+        run: npx --no-install playwright install --with-deps chromium
+` : "";
+	const tail = [];
+	if (spec.integration) tail.push(`      - name: Run live consumer integration
+        run: npm run test:integration`);
+	if (spec.service) {
+		tail.push(`      - name: Provision live service
+        run: bash ${SERVICE_SCRIPT_PATH}`);
+		tail.push(`      - name: Run live service tests
+        run: npm run test:service`);
+	}
 	return `name: ci.yml
 
 on:
@@ -8050,10 +8357,7 @@ jobs:
 
       - name: Install dependencies
         run: npm ci --ignore-scripts
-${spec.engine || spec.src.includes("browser") || spec.app.includes("browser") ? `
-      - name: Install Playwright browsers
-        run: npx --no-install playwright install --with-deps chromium
-` : ""}
+${browser}
       - name: Check formatting
         run: npm run format:check
 
@@ -8067,11 +8371,7 @@ ${spec.engine || spec.src.includes("browser") || spec.app.includes("browser") ?
         run: npm run build
 
       - name: Run tests
-        run: npm test${spec.engine ? `
-
-      - name: Run live consumer integration
-        run: npm run test:integration
-` : ""}
+        run: npm test${tail.length === 0 ? "" : `\n\n${tail.join("\n\n")}`}
 `;
 }
 /**
@@ -8089,7 +8389,7 @@ ${spec.engine || spec.src.includes("browser") || spec.app.includes("browser") ?
 * ```
 */
 function configArtifacts(spec) {
-	const machinery = viteMachinery(spec.src, spec.app, spec.engine);
+	const machinery = viteMachinery(spec.src, spec.app, spec.bin);
 	const artifacts = [{
 		path: "tsconfig.json",
 		group: "configs",
@@ -8099,7 +8399,7 @@ function configArtifacts(spec) {
 		path: "vite.config.ts",
 		group: "configs",
 		origin: "computed",
-		content: spec.app.length > 0 ? applicationViteConfig(spec.src, spec.app, spec.engine) : rootViteConfig(spec.src, spec.engine)
+		content: spec.app.length > 0 ? applicationViteConfig(spec.src, spec.app, spec) : rootViteConfig(spec.src, spec)
 	}];
 	for (const environment of spec.src) {
 		const row = SRC_MATRIX[environment];
@@ -8115,6 +8415,12 @@ function configArtifacts(spec) {
 			});
 		}
 	}
+	if (spec.bin) for (const path of BIN_CONFIGS) artifacts.push({
+		path,
+		group: "configs",
+		origin: "computed",
+		content: path.endsWith(".json") ? binTsconfig() : binViteConfig()
+	});
 	for (const environment of spec.app) {
 		const row = APP_MATRIX[environment];
 		for (const path of row.configs) {
@@ -9263,6 +9569,7 @@ function createBlueprint(data) {
 exports.APP_BROWSER_DEV_DEPENDENCIES = APP_BROWSER_DEV_DEPENDENCIES;
 exports.APP_MATRIX = APP_MATRIX;
 exports.BASE_DEV_DEPENDENCIES = BASE_DEV_DEPENDENCIES;
+exports.BIN_CONFIGS = BIN_CONFIGS;
 exports.CATEGORIES = CATEGORIES;
 exports.CHECKOUT_ACTION_SHA = CHECKOUT_ACTION_SHA;
 exports.COMPILER_ID = COMPILER_ID;
@@ -9305,6 +9612,7 @@ exports.ORIGINS = ORIGINS;
 exports.ORKESTREL_RANGE_PATTERN = ORKESTREL_RANGE_PATTERN;
 exports.PlanManager = PlanManager;
 exports.SCAFFOLD_RANGE = SCAFFOLD_RANGE;
+exports.SERVICE_SCRIPT_PATH = SERVICE_SCRIPT_PATH;
 exports.SETUP_NODE_ACTION_SHA = SETUP_NODE_ACTION_SHA;
 exports.SOURCE_BROWSER_DEV_DEPENDENCIES = SOURCE_BROWSER_DEV_DEPENDENCIES;
 exports.SRC_MATRIX = SRC_MATRIX;
@@ -9321,6 +9629,9 @@ exports.applicationViteConfig = applicationViteConfig;
 exports.applyOverrides = applyOverrides;
 exports.artifactShape = artifactShape;
 exports.auditToReview = auditToReview;
+exports.binTsconfig = binTsconfig;
+exports.binViteConfig = binViteConfig;
+exports.binViteProject = binViteProject;
 exports.blueprint = blueprint;
 exports.blueprintShape = blueprintShape;
 exports.blueprintToMembers = blueprintToMembers;
@@ -9360,6 +9671,7 @@ exports.guideMemberTable = guideMemberTable;
 exports.guideMethods = guideMethods;
 exports.guideTests = guideTests;
 exports.guideUsage = guideUsage;
+exports.guidesViteProject = guidesViteProject;
 exports.hasBlueprintEnvironment = hasBlueprintEnvironment;
 exports.hasOnlyDataProperties = hasOnlyDataProperties;
 exports.hasValidArtifactBytes = hasValidArtifactBytes;
@@ -9373,6 +9685,7 @@ exports.hasValidSnapshotBytes = hasValidSnapshotBytes;
 exports.hasValidSyncReportBytes = hasValidSyncReportBytes;
 exports.hostGroup = hostGroup;
 exports.inferGroup = inferGroup;
+exports.integrationViteProject = integrationViteProject;
 exports.isArtifact = isArtifact;
 exports.isBehind = isBehind;
 exports.isBlueprint = isBlueprint;
@@ -9415,10 +9728,12 @@ exports.rangeToFreshness = rangeToFreshness;
 exports.renderArray = renderArray;
 exports.renderObject = renderObject;
 exports.renderValue = renderValue;
+exports.renderViteTest = renderViteTest;
 exports.rootTsconfig = rootTsconfig;
 exports.rootViteConfig = rootViteConfig;
 exports.selectHostPaths = selectHostPaths;
 exports.serializeTypeScriptString = serializeTypeScriptString;
+exports.serviceViteProject = serviceViteProject;
 exports.singleSrcViteConfig = singleSrcViteConfig;
 exports.snapshotOf = snapshotOf;
 exports.snapshotPlan = snapshotPlan;
@@ -9436,5 +9751,7 @@ exports.validateDependencyArray = validateDependencyArray;
 exports.validatePlan = validatePlan;
 exports.viteHeader = viteHeader;
 exports.viteMachinery = viteMachinery;
+exports.viteProjectDefinitions = viteProjectDefinitions;
+exports.viteProjectRegistrations = viteProjectRegistrations;
 
 //# sourceMappingURL=index.cjs.map