@vitest/browser 5.0.0-beta.5 → 5.0.0-beta.7

package/dist/index.js

@@ -1,15 +1,15 @@
+import fs, { promises, existsSync, readFileSync, createReadStream } from 'node:fs';
+import { createRequire } from 'node:module';
 import { ManualMockedModule, RedirectedModule, AutomockedModule, AutospiedModule, MockerRegistry } from '@vitest/mocker';
 import { dynamicImportPlugin, ServerMockResolver, interceptorPlugin } from '@vitest/mocker/node';
-import c from 'tinyrainbow';
-import { isValidApiRequest, isFileServingAllowed, distDir, rolldownVersion, resolveApiServerConfig, resolveFsAllow, isFileLoadingAllowed, createDebugger, createViteLogger, createViteServer } from 'vitest/node';
-import { fileURLToPath } from 'node:url';
-import fs, { readFileSync, createReadStream, promises, existsSync } from 'node:fs';
-import { createRequire } from 'node:module';
 import { distClientRoot } from '@vitest/ui';
-import { slash as slash$1, toArray, deepMerge } from '@vitest/utils/helpers';
-import MagicString from 'magic-string';
+import { slash as slash$1, deepMerge, cleanUrl as cleanUrl$1, toArray } from '@vitest/utils/helpers';
 import sirv from 'sirv';
+import c from 'tinyrainbow';
+import { isFileLoadingAllowed, createDebugger, isValidApiRequest, isCSSRequest, distDir, rolldownVersion, isFileServingAllowed } from 'vitest/node';
+import { fileURLToPath } from 'node:url';
 import crypto from 'node:crypto';
+import MagicString from 'magic-string';
 import { readFile as readFile$1, mkdir, writeFile as writeFile$1 } from 'node:fs/promises';
 import { parseErrorStacktrace, parseStacktrace } from '@vitest/utils/source-map';
 import { extractSourcemapFromFile } from '@vitest/utils/source-map/node';
@@ -19,8 +19,6 @@ import { PNG } from 'pngjs';
 import { diff } from '@blazediff/core';
 import { WebSocketServer } from 'ws';
 
-var version = "5.0.0-beta.5";
-
 const _DRIVE_LETTER_START_RE = /^[A-Za-z]:\//;
 function normalizeWindowsPath(input = "") {
   if (!input) {
@@ -211,6 +209,8 @@ const basename = function(p, extension) {
   return extension && lastSegment.endsWith(extension) ? lastSegment.slice(0, -extension.length) : lastSegment;
 };
 
+var version = "5.0.0-beta.7";
+
 const pkgRoot = resolve(fileURLToPath(import.meta.url), "../..");
 const distRoot = resolve(pkgRoot, "dist");
 
@@ -675,6 +675,17 @@ async function getBrowserProvider(options, project) {
 function slash(path) {
 	return path.replace(/\\/g, "/").replace(/\/+/g, "/");
 }
+function assertBrowserFileAccess(project, path) {
+	const normalized = slash(path);
+	if (!isFileLoadingAllowed(project.vite.config, normalized) && !isFileLoadingAllowed(project.vitest.vite.config, normalized)) {
+		throw new Error(`Access denied to "${path}". See Vite config documentation for "server.fs": https://vitejs.dev/config/server-options.html#server-fs-strict.`);
+	}
+}
+function assertBrowserApiWrite(project, path) {
+	if (!project.config.api.allowWrite || !project.vitest.config.api.allowWrite) {
+		throw new Error(`Cannot modify file "${path}". File writing is disabled because the server is exposed to the internet, see https://vitest.dev/config/browser/api.`);
+	}
+}
 
 async function resolveOrchestrator(globalServer, url, res) {
 	const sessionId = url.searchParams.get("sessionId");
@@ -802,16 +813,21 @@ async function resolveTester(globalServer, url, res, next) {
 		__VITEST_PROVIDED_CONTEXT__: "{}",
 		__VITEST_API_TOKEN__: JSON.stringify(globalServer.vitest.config.api.token)
 	});
-	const testerHtml = typeof browserProject.testerHtml === "string" ? browserProject.testerHtml : await browserProject.testerHtml;
 	try {
-		const url = join("/@fs/", browserProject.testerFilepath);
-		const indexhtml = await browserProject.vite.transformIndexHtml(url, testerHtml);
+		browserProject.testerHtmlTransformed ??= (async () => {
+			const testerHtml = typeof browserProject.testerHtml === "string" ? browserProject.testerHtml : await browserProject.testerHtml;
+			const url = join("/@fs/", browserProject.testerFilepath);
+			return await browserProject.vite.transformIndexHtml(url, testerHtml);
+		})();
+		const indexhtml = await browserProject.testerHtmlTransformed;
 		const html = replacer(indexhtml, {
 			__VITEST_FAVICON__: globalServer.faviconUrl,
 			__VITEST_INJECTOR__: injector
 		});
 		return html;
 	} catch (err) {
+		// don't cache a rejection — the next request should retry the transform
+		browserProject.testerHtmlTransformed = undefined;
 		session.fail(err);
 		next(err);
 	}
@@ -838,49 +854,41 @@ function createTesterMiddleware(browserServer) {
 
 const VIRTUAL_ID_CONTEXT = "\0vitest/browser";
 const ID_CONTEXT = "vitest/browser";
-// for libraries that use an older import but are not type checked
-const DEPRECATED_ID_CONTEXT = "@vitest/browser/context";
-const DEPRECATED_VIRTUAL_ID_UTILS = "\0@vitest/browser/utils";
-const DEPRECATED_ID_UTILS = "@vitest/browser/utils";
 const __dirname$1 = dirname(fileURLToPath(import.meta.url));
-function BrowserContext(globalServer) {
+function BrowserContext(contribution) {
 	return {
 		name: "vitest:browser:virtual-module:context",
 		enforce: "pre",
-		resolveId(id, importer) {
-			if (id === ID_CONTEXT) {
-				return VIRTUAL_ID_CONTEXT;
-			}
-			if (id === DEPRECATED_ID_CONTEXT) {
-				if (importer && !importer.includes("/node_modules/")) {
-					globalServer.vitest.logger.deprecate(`${importer} tries to load a deprecated "${id}" module. ` + `This import will stop working in the next major version. ` + `Please, use "vitest/browser" instead.`);
+		resolveId: {
+			order: "pre",
+			handler(id) {
+				if (id === ID_CONTEXT) {
+					return VIRTUAL_ID_CONTEXT;
 				}
-				return VIRTUAL_ID_CONTEXT;
-			}
-			if (id === DEPRECATED_ID_UTILS) {
-				return DEPRECATED_VIRTUAL_ID_UTILS;
 			}
 		},
 		load(id) {
+			const globalServer = contribution.parent;
 			if (id === VIRTUAL_ID_CONTEXT) {
 				return generateContextFile.call(this, globalServer);
 			}
-			if (id === DEPRECATED_VIRTUAL_ID_UTILS) {
-				return `
-import { utils } from 'vitest/browser'
-export const getElementLocatorSelectors = utils.getElementLocatorSelectors
-export const debug = utils.debug
-export const prettyDOM = utils.prettyDOM
-export const getElementError = utils.getElementError
-        `;
-			}
 		}
 	};
 }
 async function generateContextFile(globalServer) {
 	const commands = Object.keys(globalServer.commands);
-	const provider = [...globalServer.children][0].provider;
-	const providerName = provider?.name || "preview";
+	// The provider instance is initialized lazily when a page opens, so reading
+	// `child.provider` here races and can be `undefined` before the first page is
+	// opened. The provider name is uniform across a project's instances and is
+	// already resolved on the config, so read it from there for this shared
+	// (cached) context module. The instance is still used below for the
+	// preview-only user-event import.
+	const child = [...globalServer.children][0];
+	const provider = child.provider;
+	const providerName = child.config.browser.provider?.name;
+	if (!providerName) {
+		throw new Error(`Browser provider is not defined for the project "${child.project.name}". This is a bug in Vitest. Please, open a new issue with a reproduction.`);
+	}
 	const commandsCode = commands.filter((command) => !command.startsWith("__vitest")).map((command) => {
 		return `    ["${command}"]: (...args) => __vitest_browser_runner__.commands.triggerCommand("${command}", args),`;
 	}).join("\n");
@@ -915,256 +923,41 @@ async function getUserEventImport(provider, resolve) {
 		throw new Error(`Failed to resolve user-event package from ${previewDistRoot}`);
 	}
 	return `\
-import { userEvent as __vitest_user_event__ } from '${slash$1(`/@fs/${resolved.id}`)}'
-const _userEventSetup = __vitest_user_event__
+import { userEvent as _userEventSetup } from '${slash$1(`/@fs/${resolved.id}`)}'
 `;
 }
 
-const versionRegexp = /(?:\?|&)v=\w{8}/;
-var BrowserPlugin = (parentServer, base = "/") => {
-	function isPackageExists(pkg, root) {
-		return parentServer.vitest.packageInstaller.isPackageExists?.(pkg, { paths: [root] });
-	}
+var BrowserPlugin = (contribution) => {
 	return [
-		{
-			enforce: "pre",
-			name: "vitest:browser",
-			async configureServer(server) {
-				parentServer.setServer(server);
-				// eslint-disable-next-line prefer-arrow-callback
-				server.middlewares.use(function vitestHeaders(_req, res, next) {
-					const headers = server.config.server.headers;
-					if (headers) {
-						for (const name in headers) {
-							res.setHeader(name, headers[name]);
-						}
-					}
-					next();
-				});
-				// strip _vitest_original query added by importActual so that
-				// the plugin pipeline sees the original import id (e.g. virtual modules's load hook).
-				server.middlewares.use((req, _res, next) => {
-					if (req.url?.includes("_vitest_original") && parentServer.project.config.browser.provider?.name === "playwright") {
-						req.url = req.url.replace(/[?&]_vitest_original(?=[&#]|$)/, "").replace(/[?&]ext\b[^&#]*/, "").replace(/\?$/, "");
-					}
-					next();
-				});
-				server.middlewares.use(createOrchestratorMiddleware(parentServer));
-				server.middlewares.use(createTesterMiddleware(parentServer));
-				server.middlewares.use(`${base}favicon.svg`, (_, res) => {
-					const content = readFileSync(resolve(distRoot, "client/favicon.svg"));
-					res.write(content, "utf-8");
-					res.end();
-				});
-				// Serve coverage HTML at ./coverage if configured
-				const coverageHtmlDir = parentServer.vitest.config.coverage?.htmlDir;
-				if (coverageHtmlDir) {
-					server.middlewares.use("/__vitest_test__/coverage", sirv(coverageHtmlDir, {
-						single: true,
-						dev: true,
-						setHeaders: (res) => {
-							const csp = res.getHeader("Content-Security-Policy");
-							if (typeof csp === "string") {
-								// add frame-ancestors to allow the iframe to be loaded by Vitest,
-								// but keep the rest of the CSP
-								res.setHeader("Content-Security-Policy", csp.replace(/frame-ancestors [^;]+/, "frame-ancestors *"));
-							}
-							res.setHeader("Cache-Control", "public,max-age=0,must-revalidate");
-						}
-					}));
-				}
-				server.middlewares.use((req, res, next) => {
-					// 9000 mega head move
-					// Vite always caches optimized dependencies, but users might mock
-					// them in _some_ tests, while keeping original modules in others
-					// there is no way to configure that in Vite, so we patch it here
-					// to always ignore the cache-control set by Vite in the next middleware
-					if (req.url && versionRegexp.test(req.url) && !req.url.includes("chunk-")) {
-						res.setHeader("Cache-Control", "no-cache");
-						const setHeader = res.setHeader.bind(res);
-						res.setHeader = function(name, value) {
-							if (name === "Cache-Control") {
-								return res;
-							}
-							return setHeader(name, value);
-						};
-					}
-					next();
-				});
-				// handle attachments the same way as in packages/ui/node/index.ts
-				server.middlewares.use((req, res, next) => {
-					if (!req.url) {
-						return next();
-					}
-					const url = new URL(req.url, "http://localhost");
-					if (url.pathname !== "/__vitest_attachment__") {
-						return next();
-					}
-					const path = url.searchParams.get("path");
-					const contentType = url.searchParams.get("contentType");
-					if (!isValidApiRequest(parentServer.config, req) || !contentType || !path) {
-						return next();
-					}
-					const fsPath = decodeURIComponent(path);
-					if (!isFileServingAllowed(parentServer.vite.config, fsPath)) {
-						return next();
-					}
-					try {
-						res.setHeader("content-type", contentType);
-						return createReadStream(fsPath).pipe(res).on("close", () => res.end());
-					} catch (err) {
-						return next(err);
-					}
-				});
-			}
-		},
 		{
 			name: "vitest:browser:tests",
 			enforce: "pre",
-			async config() {
-				// this plugin can be used in different projects, but all of them
-				// have the same `include` pattern, so it doesn't matter which project we use
-				const project = parentServer.project;
-				// only glob benchmarks when a browser-enabled bench project exists in
-				// the workspace — keeps the optimizeDeps entries symmetrical across
-				// the test/bench project clones so the optimizer doesn't re-scan when
-				// the user switches modes
-				const hasBrowserBenchProject = parentServer.vitest.projects.some((p) => p.config.browser.enabled && p.config.benchmark.enabled);
-				const benchInclude = hasBrowserBenchProject ? project.config.benchmark.include : [];
-				const dir = project.config.dir || project.config.root;
-				const [{ testFiles: browserTestFiles }, browserBenchFiles] = await Promise.all([project.globTestFiles(), benchInclude.length > 0 ? project.globFiles(benchInclude, project.config.benchmark.exclude ?? project.config.exclude, dir) : []]);
-				const setupFiles = toArray(project.config.setupFiles);
-				// replace env values - cannot be reassign at runtime
-				const define = {};
-				for (const env in project.config.env || {}) {
-					const stringValue = JSON.stringify(project.config.env[env]);
-					define[`import.meta.env.${env}`] = stringValue;
-				}
-				const entries = [
-					...new Set([...browserTestFiles, ...browserBenchFiles]),
-					...setupFiles,
-					resolve(distDir, "index.js"),
-					resolve(distDir, "browser.js"),
-					resolve(distDir, "runners.js"),
-					resolve(distDir, "utils.js"),
-					...project.config.snapshotSerializers || []
-				];
-				const exclude = [
-					"vitest",
-					"vitest/browser",
-					"vitest/internal/browser",
-					"vite/module-runner",
-					"@vitest/browser/utils",
-					"@vitest/browser/context",
-					"@vitest/browser/client",
-					"@vitest/utils",
-					"@vitest/utils/source-map",
-					"@vitest/spy",
-					"@vitest/utils/error",
-					"std-env",
-					"tinybench",
-					"tinyspy",
-					"tinyrainbow",
-					"pathe",
-					"msw",
-					"msw/browser"
-				];
-				if (typeof project.config.diff === "string") {
-					entries.push(project.config.diff);
-				}
-				if (parentServer.vitest.coverageProvider) {
-					const coverage = parentServer.vitest._coverageOptions;
-					const provider = coverage.provider;
-					if (provider === "v8") {
-						const path = tryResolve("@vitest/coverage-v8", [parentServer.config.root]);
-						if (path) {
-							entries.push(path);
-							exclude.push("@vitest/coverage-v8/browser");
-						}
-					} else if (provider === "istanbul") {
-						const path = tryResolve("@vitest/coverage-istanbul", [parentServer.config.root]);
-						if (path) {
-							entries.push(path);
-							exclude.push("@vitest/coverage-istanbul");
-						}
-					} else if (provider === "custom" && coverage.customProviderModule) {
-						entries.push(coverage.customProviderModule);
+			resolveId: {
+				order: "pre",
+				handler(id) {
+					if (!/\?browserv=\w+$/.test(id)) {
+						return;
 					}
-				}
-				const include = [
-					"vitest > expect-type",
-					"vitest > magic-string",
-					"vitest > chai"
-				];
-				const provider = parentServer.config.browser.provider || [...parentServer.children][0]?.provider;
-				if (provider?.name === "preview") {
-					include.push("@vitest/browser-preview > @testing-library/user-event", "@vitest/browser-preview > @testing-library/dom");
-				}
-				const fileRoot = browserTestFiles[0] ? dirname(browserTestFiles[0]) : project.config.root;
-				const svelte = isPackageExists("vitest-browser-svelte", fileRoot);
-				if (svelte) {
-					exclude.push("vitest-browser-svelte");
-				}
-				// since we override the resolution in the esbuild plugin, Vite can no longer optimizer it
-				const vue = isPackageExists("vitest-browser-vue", fileRoot);
-				if (vue) {
-					// we override them in the esbuild plugin so optimizer can no longer intercept it
-					include.push("vitest-browser-vue", "vitest-browser-vue > @vue/test-utils", "vitest-browser-vue > @vue/test-utils > @vue/compiler-core");
-				}
-				const vueTestUtils = isPackageExists("@vue/test-utils", fileRoot);
-				if (vueTestUtils) {
-					include.push("@vue/test-utils");
-				}
-				const otelConfig = project.config.experimental.openTelemetry;
-				if (otelConfig?.enabled && otelConfig.browserSdkPath) {
-					entries.push(otelConfig.browserSdkPath);
-					include.push("@opentelemetry/api");
-				} else {
-					exclude.push("@opentelemetry/api");
-				}
-				return {
-					define,
-					resolve: { dedupe: ["vitest"] },
-					optimizeDeps: {
-						entries,
-						exclude,
-						include
+					let useId = id.slice(0, id.lastIndexOf("?"));
+					if (useId.startsWith("/@fs/")) {
+						useId = useId.slice(5);
 					}
-				};
-			},
-			async resolveId(id) {
-				if (!/\?browserv=\w+$/.test(id)) {
-					return;
-				}
-				let useId = id.slice(0, id.lastIndexOf("?"));
-				if (useId.startsWith("/@fs/")) {
-					useId = useId.slice(5);
-				}
-				if (/^\w:/.test(useId)) {
-					useId = useId.replace(/\\/g, "/");
-				}
-				return useId;
-			}
-		},
-		{
-			name: "vitest:browser:resolve-virtual",
-			async resolveId(rawId) {
-				if (rawId === "/mockServiceWorker.js") {
-					return this.resolve("msw/mockServiceWorker.js", distRoot, { skipSelf: true });
+					if (/^\w:/.test(useId)) {
+						useId = useId.replace(/\\/g, "/");
+					}
+					return useId;
 				}
 			}
 		},
 		{
 			name: "vitest:browser:assets",
-			configureServer(server) {
-				server.middlewares.use("/__vitest__", sirv(distClientRoot));
-			},
 			resolveId(id) {
 				if (id.startsWith("/__vitest_browser__/")) {
 					return resolve(distRoot, "client", id.slice(1));
 				}
 			},
 			transform(code, id) {
+				const parentServer = contribution.parent;
 				if (id.includes(parentServer.vite.config.cacheDir) && id.includes("loupe.js")) {
 					// loupe bundle has a nasty require('util') call that leaves a warning in the console
 					const utilRequire = "nodeUtil = require_util();";
@@ -1172,45 +965,16 @@ var BrowserPlugin = (parentServer, base = "/") => {
 				}
 			}
 		},
-		BrowserContext(parentServer),
+		BrowserContext(contribution),
 		dynamicImportPlugin({
 			globalThisAccessor: "\"__vitest_browser_runner__\"",
-			filter(id, environment) {
-				if (environment.name !== "client") {
-					return false;
-				}
+			filter(id) {
 				if (id.includes(distRoot)) {
 					return false;
 				}
 				return true;
 			}
 		}),
-		{
-			name: "vitest:browser:config",
-			enforce: "post",
-			async config(viteConfig) {
-				// Enables using ignore hint for coverage providers with @preserve keyword
-				// Only set esbuild options when not using rolldown-vite (Vite 8+),
-				// which uses oxc for transformation instead of esbuild
-				if (!rolldownVersion && viteConfig.esbuild !== false) {
-					viteConfig.esbuild ||= {};
-					viteConfig.esbuild.legalComments = "inline";
-				}
-				const defaultPort = parentServer.vitest.state._data.browserLastPort++;
-				const api = resolveApiServerConfig(viteConfig.test?.browser || {}, defaultPort);
-				viteConfig.server = {
-					...viteConfig.server,
-					port: defaultPort,
-					...api,
-					middlewareMode: false,
-					open: false
-				};
-				viteConfig.server.fs ??= {};
-				viteConfig.server.fs.allow = viteConfig.server.fs.allow || [];
-				viteConfig.server.fs.allow.push(...resolveFsAllow(parentServer.vitest.config.root, parentServer.vitest.vite.config.configFile), distRoot);
-				return { resolve: { alias: viteConfig.test?.alias } };
-			}
-		},
 		{
 			name: "vitest:browser:in-source-tests",
 			transform: {
@@ -1243,130 +1007,6 @@ var BrowserPlugin = (parentServer, base = "/") => {
 				}
 			}
 		},
-		{
-			name: "vitest:browser:transform-tester-html",
-			enforce: "pre",
-			async transformIndexHtml(html, ctx) {
-				const projectBrowser = [...parentServer.children].find((server) => {
-					return ctx.filename === server.testerFilepath;
-				});
-				if (!projectBrowser) {
-					return;
-				}
-				const stateJs = typeof parentServer.stateJs === "string" ? parentServer.stateJs : await parentServer.stateJs;
-				const testerTags = [];
-				const isDefaultTemplate = resolve(distRoot, "client/tester/tester.html") === projectBrowser.testerFilepath;
-				if (!isDefaultTemplate) {
-					const manifestContent = parentServer.manifest instanceof Promise ? await parentServer.manifest : parentServer.manifest;
-					const testerEntry = manifestContent["tester/tester.html"];
-					testerTags.push({
-						tag: "script",
-						attrs: {
-							type: "module",
-							crossorigin: "",
-							src: `${parentServer.base}${testerEntry.file}`
-						},
-						injectTo: "head"
-					});
-					for (const importName of testerEntry.imports || []) {
-						const entryManifest = manifestContent[importName];
-						if (entryManifest) {
-							testerTags.push({
-								tag: "link",
-								attrs: {
-									href: `${parentServer.base}${entryManifest.file}`,
-									rel: "modulepreload",
-									crossorigin: ""
-								},
-								injectTo: "head"
-							});
-						}
-					}
-				} else {
-					// inject the reset style only in the default template,
-					// allowing users to customize the style in their own template
-					testerTags.push({
-						tag: "style",
-						children: `
-html {
-  padding: 0;
-  margin: 0;
-}
-body {
-  padding: 0;
-  margin: 0;
-  min-height: 100vh;
-}`,
-						injectTo: "head"
-					});
-				}
-				return [
-					{
-						tag: "script",
-						children: "{__VITEST_INJECTOR__}",
-						injectTo: "head-prepend"
-					},
-					{
-						tag: "script",
-						children: stateJs,
-						injectTo: "head-prepend"
-					},
-					{
-						tag: "script",
-						attrs: {
-							type: "module",
-							src: parentServer.errorCatcherUrl
-						},
-						injectTo: "head"
-					},
-					{
-						tag: "script",
-						attrs: {
-							type: "module",
-							src: parentServer.matchersUrl
-						},
-						injectTo: "head"
-					},
-					...parentServer.initScripts.map((script) => ({
-						tag: "script",
-						attrs: {
-							type: "module",
-							src: join("/@fs/", script)
-						},
-						injectTo: "head"
-					})),
-					...testerTags
-				].filter((s) => s != null);
-			}
-		},
-		{
-			name: "vitest:browser:support-testing-library",
-			enforce: "pre",
-			config() {
-				const rolldownPlugin = {
-					name: "vue-test-utils-rewrite",
-					resolveId: {
-						filter: { id: /^@vue\/(test-utils|compiler-core)$/ },
-						handler(source, importer) {
-							const resolved = getRequire().resolve(source, { paths: [importer] });
-							return resolved;
-						}
-					}
-				};
-				const esbuildPlugin = {
-					name: "test-utils-rewrite",
-					setup(build) {
-						// test-utils: resolve to CJS instead of the browser because the browser version expects a global Vue object
-						// compiler-core: only CJS version allows slots as strings
-						build.onResolve({ filter: /^@vue\/(test-utils|compiler-core)$/ }, (args) => {
-							const resolved = getRequire().resolve(args.path, { paths: [args.importer] });
-							return { path: resolved };
-						});
-					}
-				};
-				return { optimizeDeps: rolldownVersion ? { rolldownOptions: { plugins: [rolldownPlugin] } } : { esbuildOptions: { plugins: [esbuildPlugin] } } };
-			}
-		},
 		{
 			name: "vitest:browser:__vitest_browser_import_meta_env_init__",
 			transform: { handler(code) {
@@ -1379,21 +1019,6 @@ body {
 		}
 	];
 };
-function tryResolve(path, paths) {
-	try {
-		const _require = getRequire();
-		return _require.resolve(path, { paths });
-	} catch {
-		return undefined;
-	}
-}
-let _require;
-function getRequire() {
-	if (!_require) {
-		_require = createRequire(import.meta.url);
-	}
-	return _require;
-}
 const postfixRE = /[?#].*$/;
 function cleanUrl(url) {
 	return url.replace(postfixRE, "");
@@ -1439,19 +1064,6 @@ class BrowserServerCDPHandler {
 	}
 }
 
-const _startV8Coverage = async (context) => {
-	const session = await context.__ensureCDPHandler();
-	await session.send("Profiler.enable");
-	await session.send("Profiler.startPreciseCoverage", {
-		callCount: true,
-		detailed: true
-	});
-};
-const _takeV8Coverage = async (context) => {
-	const session = await context.__ensureCDPHandler();
-	return session.send("Profiler.takePreciseCoverage");
-};
-
 const types = {
     'application/andrew-inset': ['ez'],
     'application/appinstaller': ['appinstaller'],
@@ -1904,19 +1516,9 @@ _Mime_extensionToType = new WeakMap(), _Mime_typeToExtension = new WeakMap(), _M
 
 var mime = new Mime(types)._freeze();
 
-function assertFileAccess(path, project) {
-	if (!isFileLoadingAllowed(project.vite.config, path) && !isFileLoadingAllowed(project.vitest.vite.config, path)) {
-		throw new Error(`Access denied to "${path}". See Vite config documentation for "server.fs": https://vitejs.dev/config/server-options.html#server-fs-strict.`);
-	}
-}
-function assertWrite(path, project) {
-	if (!project.config.browser.api.allowWrite || !project.vitest.config.api.allowWrite) {
-		throw new Error(`Cannot modify file "${path}". File writing is disabled because server is exposed to the internet, see https://vitest.dev/config/browser/api.`);
-	}
-}
 const readFile = async ({ project }, path, options = {}) => {
 	const filepath = resolve$1(project.config.root, path);
-	assertFileAccess(slash(filepath), project);
+	assertBrowserFileAccess(project, filepath);
 	// never return a Buffer
 	if (typeof options === "object" && !options.encoding) {
 		options.encoding = "utf-8";
@@ -1924,9 +1526,9 @@ const readFile = async ({ project }, path, options = {}) => {
 	return promises.readFile(filepath, options);
 };
 const writeFile = async ({ project }, path, data, options) => {
-	assertWrite(path, project);
+	assertBrowserApiWrite(project, path);
 	const filepath = resolve$1(project.config.root, path);
-	assertFileAccess(slash(filepath), project);
+	assertBrowserFileAccess(project, filepath);
 	const dir = dirname$1(filepath);
 	if (!fs.existsSync(dir)) {
 		await promises.mkdir(dir, { recursive: true });
@@ -1934,14 +1536,14 @@ const writeFile = async ({ project }, path, data, options) => {
 	await promises.writeFile(filepath, data, options);
 };
 const removeFile = async ({ project }, path) => {
-	assertWrite(path, project);
+	assertBrowserApiWrite(project, path);
 	const filepath = resolve$1(project.config.root, path);
-	assertFileAccess(slash(filepath), project);
+	assertBrowserFileAccess(project, filepath);
 	await promises.rm(filepath);
 };
 const _fileInfo = async ({ project }, path, encoding) => {
 	const filepath = resolve$1(project.config.root, path);
-	assertFileAccess(slash(filepath), project);
+	assertBrowserFileAccess(project, filepath);
 	const content = await promises.readFile(filepath, encoding || "base64");
 	return {
 		content,
@@ -2106,7 +1708,7 @@ function resolveOptions({ context, name, options, testName }) {
 		ext: `.${extension}`,
 		platform: platform(),
 		root,
-		screenshotDirectory: relative(root, join(root, context.project.config.browser.screenshotDirectory ?? "__screenshots__")),
+		screenshotDirectory: context.project.config.browser.expect?.toMatchScreenshot?.screenshotDirectory ?? "__screenshots__",
 		attachmentsDir: relative(root, context.project.config.attachmentsDir),
 		testFileDirectory: relative(root, dirname(context.testPath)),
 		testFileName: basename(context.testPath),
@@ -2213,7 +1815,7 @@ function asyncTimeout(timeout) {
 		if (timeout === 0) {
 			resolve(null);
 		} else {
-			setTimeout(() => resolve(null), timeout);
+			setTimeout(resolve, timeout, null);
 		}
 	});
 }
@@ -2287,7 +1889,7 @@ const screenshotMatcher = async (context, name, testName, options) => {
 		comparator,
 		comparatorOptions
 	});
-	await performSideEffects(outcome, codec);
+	await performSideEffects(outcome, codec, context.project);
 	return buildOutput(outcome, timeout);
 };
 /**
@@ -2377,17 +1979,17 @@ async function determineOutcome({ comparator, comparatorOptions, paths, referenc
 *
 * Only `missing-reference`, `update-reference`, and `mismatch` write files. Successful matches produce no side effects.
 */
-async function performSideEffects(outcome, codec) {
+async function performSideEffects(outcome, codec, project) {
 	switch (outcome.type) {
 		case "missing-reference":
 		case "update-reference": {
-			await writeScreenshot(outcome.reference.path, await encodeScreenshot(outcome.reference, codec));
+			await writeScreenshot(outcome.reference.path, await encodeScreenshot(outcome.reference, codec), project);
 			break;
 		}
 		case "mismatch": {
-			await writeScreenshot(outcome.actual.path, await encodeScreenshot(outcome.actual, codec));
+			await writeScreenshot(outcome.actual.path, await encodeScreenshot(outcome.actual, codec), project);
 			if (outcome.diff) {
-				await writeScreenshot(outcome.diff.path, await codec.encode(outcome.diff.image, {}));
+				await writeScreenshot(outcome.diff.path, await codec.encode(outcome.diff.image, {}), project);
 			}
 			break;
 		}
@@ -2549,8 +2151,10 @@ async function takeScreenshotData({ buffer, codec, context, element, name, scree
 	};
 }
 /** Writes encoded images to disk, creating parent directories as needed. */
-async function writeScreenshot(path, image) {
+async function writeScreenshot(path, image, project) {
 	try {
+		assertBrowserApiWrite(project, path);
+		assertBrowserFileAccess(project, path);
 		await mkdir(dirname(path), { recursive: true });
 		await writeFile$1(path, image);
 	} catch (cause) {
@@ -2598,8 +2202,6 @@ var builtinCommands = {
 	readFile,
 	removeFile,
 	writeFile,
-	__vitest_startV8Coverage: _startV8Coverage,
-	__vitest_takeV8Coverage: _takeV8Coverage,
 	__vitest_markTrace: _markTrace,
 	__vitest_groupTraceStart: _groupTraceStart,
 	__vitest_groupTraceEnd: _groupTraceEnd,
@@ -2617,6 +2219,10 @@ class BrowserServerState {
 class ProjectBrowser {
 	testerHtml;
 	testerFilepath;
+	// the tester template is read once per server, so the transformed HTML
+	// is stable too — computing it for every iframe request pays the whole
+	// transformIndexHtml plugin pipeline each time
+	testerHtmlTransformed;
 	provider;
 	vitest;
 	vite;
@@ -2718,21 +2324,27 @@ class ParentBrowserProject {
 	config;
 	// cache for non-vite source maps
 	sourceMapCache = new Map();
-	constructor(project, base) {
-		this.project = project;
+	constructor(ctx, base) {
 		this.base = base;
-		this.vitest = project.vitest;
-		this.config = project.config;
+		this.vitest = ctx.vitest;
+		this.config = ctx.config;
 		this.stackTraceOptions = {
-			frameFilter: project.config.onStackTrace,
+			frameFilter: this.config.onStackTrace,
 			getSourceMap: (id) => {
 				if (this.sourceMapCache.has(id)) {
 					return this.sourceMapCache.get(id);
 				}
 				const result = this.vite.moduleGraph.getModuleById(id)?.transformResult;
-				// handle non-inline source map such as pre-bundled deps in node_modules/.vite
-				if (result && !result.map) {
-					const filePath = id.split("?")[0];
+				const filePath = id.split("?")[0];
+				// prefer the map stored on disk when the transform pipeline can't
+				// provide a usable one:
+				// - pre-bundled deps: the pipeline map resolves back into the
+				//   optimizer cache, while the map esbuild wrote next to the file
+				//   points at the real package sources
+				// - an empty `mappings` means the map was intentionally not served
+				//   to the browser (`vitest:browser:framework-sourcemaps`), but disk
+				//   is still the source of truth for error stack traces
+				if (result && (!result.map || result.map.mappings === "" || filePath.startsWith(this.vite.config.cacheDir))) {
 					const extracted = extractSourcemapFromFile(result.code, filePath);
 					this.sourceMapCache.set(id, extracted?.map);
 					return extracted?.map;
@@ -2763,11 +2375,11 @@ class ParentBrowserProject {
 			this.commands[name] ??= command;
 		}
 		// validate names because they can't be used as identifiers
-		for (const command in project.config.browser.commands) {
+		for (const command in this.config.browser.commands) {
 			if (!/^[a-z_$][\w$]*$/i.test(command)) {
 				throw new Error(`Invalid command name "${command}". Only alphanumeric characters, $ and _ are allowed.`);
 			}
-			this.commands[command] = project.config.browser.commands[command];
+			this.commands[command] = this.config.browser.commands[command];
 		}
 		this.prefixTesterUrl = `${base || "/"}`;
 		this.prefixOrchestratorUrl = `${base}__vitest_test__/`;
@@ -2775,7 +2387,7 @@ class ParentBrowserProject {
 		this.manifest = (async () => {
 			return JSON.parse(await readFile$1(`${distRoot}/client/.vite/manifest.json`, "utf8"));
 		})().then((manifest) => this.manifest = manifest);
-		this.orchestratorHtml = (project.config.browser.ui ? readFile$1(resolve(distClientRoot, "index.html"), "utf8") : readFile$1(resolve(distRoot, "client/orchestrator.html"), "utf8")).then((html) => this.orchestratorHtml = html);
+		this.orchestratorHtml = (this.config.browser.ui ? readFile$1(resolve(distClientRoot, "index.html"), "utf8") : readFile$1(resolve(distRoot, "client/orchestrator.html"), "utf8")).then((html) => this.orchestratorHtml = html);
 		this.injectorJs = readFile$1(resolve(distRoot, "client/esm-client-injector.js"), "utf8").then((js) => this.injectorJs = js);
 		this.errorCatcherUrl = join("/@fs/", resolve(distRoot, "client/error-catcher.js"));
 		this.matchersUrl = join("/@fs/", distRoot, "expect-element.js");
@@ -3153,14 +2765,14 @@ function setupBrowserRpc(globalServer, defaultMockerRegistry) {
 		}
 	}
 	function canWrite(project) {
-		return project.config.browser.api.allowWrite && project.vitest.config.browser.api.allowWrite && project.config.api.allowWrite && project.vitest.config.api.allowWrite;
+		return project.config.api.allowWrite && project.vitest.config.api.allowWrite;
 	}
 	function isCdpAllowed(project) {
-		return project.config.api.allowExec && project.config.browser.api.allowExec && project.vitest.config.api.allowExec && project.vitest.config.browser.api.allowExec && project.config.api.allowWrite && project.config.browser.api.allowWrite && project.vitest.config.api.allowWrite && project.vitest.config.browser.api.allowWrite;
+		return project.config.api.allowExec && project.vitest.config.api.allowExec && project.config.api.allowWrite && project.vitest.config.api.allowWrite;
 	}
 	function assertCdpAllowed(project) {
 		if (!isCdpAllowed(project)) {
-			throw new Error(`Cannot use CDP because browser API write or exec operations are disabled. See https://vitest.dev/config/browser/api.`);
+			throw new Error(`Cannot use CDP because browser API write or exec operations are disabled. See https://vitest.dev/config/api.`);
 		}
 	}
 	function setupClient(project, rpcId, ws, options) {
@@ -3196,13 +2808,23 @@ function setupBrowserRpc(globalServer, defaultMockerRegistry) {
 				if (!canWrite(project)) {
 					if (artifact.type === "internal:annotation" && artifact.annotation.attachment) {
 						artifact.annotation.attachment = undefined;
-						vitest.logger.error(`[vitest] Cannot record annotation attachment because file writing is disabled. See https://vitest.dev/config/browser/api.`);
+						vitest.logger.error(`[vitest] Cannot record annotation attachment because file writing is disabled. See https://vitest.dev/config/api.`);
 					}
 					// remove attachments if cannot write
 					if (artifact.attachments?.length) {
 						const attachments = artifact.attachments.map((n) => n.path).filter((r) => !!r).join("\", \"");
 						artifact.attachments = [];
-						vitest.logger.error(`[vitest] Cannot record attachments ("${attachments}") because file writing is disabled, removing attachments from artifact "${artifact.type}". See https://vitest.dev/config/browser/api.`);
+						vitest.logger.error(`[vitest] Cannot record attachments ("${attachments}") because file writing is disabled, removing attachments from artifact "${artifact.type}". See https://vitest.dev/config/api.`);
+					}
+				} else {
+					// attachment files are copied into `attachmentsDir`, so confine
+					// client-supplied paths to Vite's `server.fs` boundary
+					const attachments = artifact.type === "internal:annotation" ? artifact.annotation.attachment ? [artifact.annotation.attachment] : [] : artifact.attachments ?? [];
+					for (const attachment of attachments) {
+						const path = attachment.path;
+						if (path && !path.startsWith("http://") && !path.startsWith("https://")) {
+							checkFileAccess(resolve(project.config.root, path));
+						}
 					}
 				}
 				return vitest._testRun.recordArtifact(id, artifact);
@@ -3216,7 +2838,7 @@ function setupBrowserRpc(globalServer, defaultMockerRegistry) {
 			},
 			async writeBenchmarkResult(relativePath, data) {
 				if (!canWrite(project)) {
-					vitest.logger.error(`[vitest] Cannot write benchmark artifact "${relativePath}" because file writing is disabled. See https://vitest.dev/config/browser/api.`);
+					vitest.logger.error(`[vitest] Cannot write benchmark artifact "${relativePath}" because file writing is disabled. See https://vitest.dev/config/api.`);
 					return;
 				}
 				checkFileAccess(project.benchmark.resolve(relativePath));
@@ -3258,7 +2880,7 @@ function setupBrowserRpc(globalServer, defaultMockerRegistry) {
 			async saveSnapshotFile(id, content) {
 				checkFileAccess(id);
 				if (!canWrite(project)) {
-					vitest.logger.error(`[vitest] Cannot save snapshot file "${id}". File writing is disabled because server is exposed to the internet, see https://vitest.dev/config/browser/api.`);
+					vitest.logger.error(`[vitest] Cannot save snapshot file "${id}". File writing is disabled because server is exposed to the internet, see https://vitest.dev/config/api.`);
 					return;
 				}
 				await promises.mkdir(dirname(id), { recursive: true });
@@ -3267,7 +2889,7 @@ function setupBrowserRpc(globalServer, defaultMockerRegistry) {
 			async removeSnapshotFile(id) {
 				checkFileAccess(id);
 				if (!canWrite(project)) {
-					vitest.logger.error(`[vitest] Cannot remove snapshot file "${id}". File writing is disabled because server is exposed to the internet, see https://vitest.dev/config/browser/api.`);
+					vitest.logger.error(`[vitest] Cannot remove snapshot file "${id}". File writing is disabled because server is exposed to the internet, see https://vitest.dev/config/api.`);
 					return;
 				}
 				if (!existsSync(id)) {
@@ -3448,66 +3070,437 @@ function stringifyReplace(key, value) {
 function defineBrowserCommand(fn) {
 	return fn;
 }
-const createBrowserServer = async (options) => {
-	const project = options.project;
-	const configFile = project.vite.config.configFile;
-	if (project.vitest.version !== version) {
-		project.vitest.logger.warn(c.yellow(`Loaded ${c.inverse(c.yellow(` vitest@${project.vitest.version} `))} and ${c.inverse(c.yellow(` @vitest/browser@${version} `))}.` + "\nRunning mixed versions is not supported and may lead into bugs" + "\nUpdate your dependencies and make sure the versions match."));
-	}
-	const server = new ParentBrowserProject(project, "/");
-	const configPath = typeof configFile === "string" ? configFile : false;
-	const logLevel = process.env.VITEST_BROWSER_DEBUG ?? "info";
-	const logger = createViteLogger(project.vitest.logger, logLevel, { allowClearScreen: false });
+const versionRegexp = /(?:\?|&)v=\w{8}/;
+/**
+* The browser provider's `serverFactory`. Returns a `BrowserServerContribution`
+* that Vitest core uses to build the SINGLE Vite server shared by `project.vite`
+* and `project.browser.vite`. This factory does NOT create a server (core does);
+* it only contributes config, plugins, the parent factory, and the RPC setup.
+*/
+const createBrowserServer = async () => {
 	const mockerRegistry = new MockerRegistry();
-	let cacheDir;
-	const vite = await createViteServer({
-		...project.options,
-		define: project.config.viteDefine,
-		base: "/",
-		root: project.config.root,
-		logLevel,
-		customLogger: {
-			...logger,
-			info(msg, options) {
-				logger.info(msg, options);
-				if (msg.includes("optimized dependencies changed. reloading")) {
-					logger.warn([c.yellow(`\n${c.bold("[vitest]")} Vite unexpectedly reloaded a test. This may cause tests to fail, lead to flaky behaviour or duplicated test runs.\n`), c.yellow(`For a stable experience, please add mentioned dependencies to your config\'s ${c.bold("`optimizeDeps.include`")} field manually.\n\n`)].join(""));
+	const contribution = {
+		async transformIndexHtml(ctx) {
+			const parentServer = contribution.parent;
+			const projectBrowser = [...parentServer.children].find((server) => {
+				return ctx.filename === server.testerFilepath;
+			});
+			if (!projectBrowser) {
+				return;
+			}
+			const stateJs = typeof parentServer.stateJs === "string" ? parentServer.stateJs : await parentServer.stateJs;
+			const testerTags = [];
+			const isDefaultTemplate = resolve(distRoot, "client/tester/tester.html") === projectBrowser.testerFilepath;
+			if (!isDefaultTemplate) {
+				const manifestContent = parentServer.manifest instanceof Promise ? await parentServer.manifest : parentServer.manifest;
+				const testerEntry = manifestContent["tester/tester.html"];
+				testerTags.push({
+					tag: "script",
+					attrs: {
+						type: "module",
+						crossorigin: "",
+						src: `${parentServer.base}${testerEntry.file}`
+					},
+					injectTo: "head"
+				});
+				for (const importName of testerEntry.imports || []) {
+					const entryManifest = manifestContent[importName];
+					if (entryManifest) {
+						testerTags.push({
+							tag: "link",
+							attrs: {
+								href: `${parentServer.base}${entryManifest.file}`,
+								rel: "modulepreload",
+								crossorigin: ""
+							},
+							injectTo: "head"
+						});
+					}
+				}
+			} else {
+				// inject the reset style only in the default template,
+				// allowing users to customize the style in their own template
+				testerTags.push({
+					tag: "style",
+					children: `
+html {
+  padding: 0;
+  margin: 0;
+}
+body {
+  padding: 0;
+  margin: 0;
+  min-height: 100vh;
+}`,
+					injectTo: "head"
+				});
+			}
+			return [
+				{
+					tag: "script",
+					children: "{__VITEST_INJECTOR__}",
+					injectTo: "head-prepend"
+				},
+				{
+					tag: "script",
+					children: stateJs,
+					injectTo: "head-prepend"
+				},
+				{
+					tag: "script",
+					attrs: {
+						type: "module",
+						src: parentServer.errorCatcherUrl
+					},
+					injectTo: "head"
+				},
+				{
+					tag: "script",
+					attrs: {
+						type: "module",
+						src: parentServer.matchersUrl
+					},
+					injectTo: "head"
+				},
+				...parentServer.initScripts.map((script) => ({
+					tag: "script",
+					attrs: {
+						type: "module",
+						src: join("/@fs/", script)
+					},
+					injectTo: "head"
+				})),
+				...testerTags
+			].filter((s) => s != null);
+		},
+		configureServer(server) {
+			const parentServer = contribution.parent;
+			parentServer.setServer(server);
+			// eslint-disable-next-line prefer-arrow-callback
+			server.middlewares.use(function vitestHeaders(_req, res, next) {
+				const headers = server.config.server.headers;
+				if (headers) {
+					for (const name in headers) {
+						res.setHeader(name, headers[name]);
+					}
+				}
+				next();
+			});
+			// strip _vitest_original query added by importActual so that
+			// the plugin pipeline sees the original import id (e.g. virtual modules's load hook).
+			server.middlewares.use((req, _res, next) => {
+				if (req.url?.includes("_vitest_original") && parentServer.config.browser.provider?.name === "playwright") {
+					req.url = req.url.replace(/[?&]_vitest_original(?=[&#]|$)/, "").replace(/[?&]ext\b[^&#]*/, "").replace(/\?$/, "");
+				}
+				next();
+			});
+			server.middlewares.use(createOrchestratorMiddleware(parentServer));
+			server.middlewares.use(createTesterMiddleware(parentServer));
+			server.middlewares.use(`/favicon.svg`, (_, res) => {
+				const content = readFileSync(resolve(distRoot, "client/favicon.svg"));
+				res.write(content, "utf-8");
+				res.end();
+			});
+			// Serve coverage HTML at ./coverage if configured
+			const coverageHtmlDir = parentServer.vitest.config.coverage?.htmlDir;
+			if (coverageHtmlDir) {
+				server.middlewares.use("/__vitest_test__/coverage", sirv(coverageHtmlDir, {
+					single: true,
+					dev: true,
+					setHeaders: (res) => {
+						const csp = res.getHeader("Content-Security-Policy");
+						if (typeof csp === "string") {
+							// add frame-ancestors to allow the iframe to be loaded by Vitest,
+							// but keep the rest of the CSP
+							res.setHeader("Content-Security-Policy", csp.replace(/frame-ancestors [^;]+/, "frame-ancestors *"));
+						}
+						res.setHeader("Cache-Control", "public,max-age=0,must-revalidate");
+					}
+				}));
+			}
+			server.middlewares.use((req, res, next) => {
+				// 9000 mega head move
+				// Vite always caches optimized dependencies, but users might mock
+				// them in _some_ tests, while keeping original modules in others
+				// there is no way to configure that in Vite, so we patch it here
+				// to always ignore the cache-control set by Vite in the next middleware
+				if (req.url && versionRegexp.test(req.url) && !req.url.includes("chunk-")) {
+					res.setHeader("Cache-Control", "no-cache");
+					const setHeader = res.setHeader.bind(res);
+					res.setHeader = function(name, value) {
+						if (name === "Cache-Control") {
+							return res;
+						}
+						return setHeader(name, value);
+					};
+				}
+				next();
+			});
+			// handle attachments the same way as in packages/ui/node/index.ts
+			server.middlewares.use((req, res, next) => {
+				if (!req.url) {
+					return next();
+				}
+				const url = new URL(req.url, "http://localhost");
+				if (url.pathname !== "/__vitest_attachment__") {
+					return next();
+				}
+				const path = url.searchParams.get("path");
+				const contentType = url.searchParams.get("contentType");
+				if (!isValidApiRequest(parentServer.config, req) || !contentType || !path) {
+					return next();
+				}
+				const fsPath = decodeURIComponent(path);
+				if (!isFileServingAllowed(parentServer.vite.config, fsPath)) {
+					return next();
+				}
+				try {
+					res.setHeader("content-type", contentType);
+					return createReadStream(fsPath).pipe(res).on("close", () => res.end());
+				} catch (err) {
+					return next(err);
+				}
+			});
+			// When the Vitest UI (`test.ui`) is enabled, the `vitest:ui` plugin owns
+			// `/__vitest__` (including the token-injected index.html and its assets),
+			// so registering sirv here would shadow it and serve the page without a token.
+			if (!parentServer.vitest.config.ui) {
+				server.middlewares.use("/__vitest__", sirv(distClientRoot));
+			}
+		},
+		async config(viteConfig) {
+			const testConfig = viteConfig.test || {};
+			const config = {
+				resolve: {
+					alias: testConfig.alias,
+					dedupe: ["vitest"]
+				},
+				server: {
+					fs: { allow: [distRoot] },
+					middlewareMode: false,
+					watch: null,
+					forwardConsole: false
 				}
+			};
+			// Enables using the @preserve ignore hint for coverage providers. Only for
+			// esbuild (rolldown-vite uses oxc instead).
+			if (!rolldownVersion && viteConfig.esbuild !== false) {
+				config.esbuild = { legalComments: "inline" };
+			}
+			const define = {};
+			const envVars = testConfig.env || {};
+			for (const env in envVars) {
+				define[`import.meta.env.${env}`] = JSON.stringify(envVars[env]);
 			}
+			config.define = define;
+			return config;
 		},
-		mode: project.config.mode,
-		configFile: configPath,
-		configLoader: project.vite.config.inlineConfig.configLoader,
-		server: {
-			...project.options?.server,
-			hmr: false,
-			watch: null
+		resolveOptimizeDeps(projectConfigs, testFiles, harness) {
+			return resolveBrowserOptimizeDeps(projectConfigs, testFiles, harness);
+		},
+		plugins: [],
+		createParent({ config, vitest }) {
+			if (vitest.version !== version) {
+				vitest.logger.warn(c.yellow(`Loaded ${c.inverse(c.yellow(` vitest@${vitest.version} `))} and ${c.inverse(c.yellow(` @vitest/browser@${version} `))}.` + "\nRunning mixed versions is not supported and may lead into bugs" + "\nUpdate your dependencies and make sure the versions match."));
+			}
+			return new ParentBrowserProject({
+				config,
+				vitest
+			}, "/");
 		},
-		cacheDir: project.vite.config.cacheDir,
-		plugins: [
-			{
-				name: "vitest-internal:browser-cacheDir",
-				configResolved(config) {
-					cacheDir = config.cacheDir;
+		setupRpc(parent) {
+			setupBrowserRpc(parent, mockerRegistry);
+		}
+	};
+	contribution.plugins = [
+		...BrowserPlugin(contribution),
+		interceptorPlugin({ registry: mockerRegistry }),
+		{
+			name: "vitest:browser:framework-sourcemaps",
+			enforce: "post",
+			transform(code, id) {
+				const parentServer = contribution.parent;
+				// In a headless run nothing can open devtools, so sourcemaps of
+				// Vitest's own pre-built modules are never consumed: their stack
+				// frames are filtered by stackIgnorePatterns. Generating and
+				// inlining these maps costs server CPU and multiplies the bytes
+				// the browser downloads by ~5 for every fresh browser context.
+				// Sourcemaps of user files and (by default) their dependencies are
+				// kept — they point error stacks and devtools at original sources.
+				if (!parentServer || !isHeadlessServer(parentServer) || parentServer.vitest.config.inspector.enabled) {
+					return null;
 				}
-			},
-			...options.mocksPlugins({ filter(id) {
-				if (id.includes(distRoot) || id.includes(cacheDir)) {
-					return false;
+				if (isCSSRequest(id)) {
+					return null;
 				}
-				return true;
-			} }),
-			options.metaEnvReplacer(),
-			...project.options?.plugins || [],
-			BrowserPlugin(server),
-			interceptorPlugin({ registry: mockerRegistry }),
-			options.coveragePlugin()
-		]
-	});
-	await vite.listen();
-	setupBrowserRpc(server, mockerRegistry);
-	return server;
+				const path = cleanUrl$1(id);
+				if (path.startsWith(distRoot) || path.startsWith(distDir)) {
+					return {
+						code,
+						map: { mappings: "" }
+					};
+				}
+				// users that never debug into node_modules can drop dependency
+				// sourcemaps entirely; `server.sourcemapIgnoreList` (default:
+				// node_modules) can opt paths back in even then, e.g. with
+				// `preserveSymlinks` where workspace code keeps its node_modules
+				// path and would be wrongly treated as a dependency
+				if (parentServer.config.browser.dependencySourcemaps === false && path.includes("/node_modules/") && (parentServer.vite.config.server.sourcemapIgnoreList(path, path) ?? true)) {
+					return {
+						code,
+						map: { mappings: "" }
+					};
+				}
+				return null;
+			}
+		}
+	];
+	return contribution;
 };
+function isHeadlessServer(parentServer) {
+	if (!parentServer.config.browser.headless) {
+		return false;
+	}
+	// sibling instances share this server (and its module graph cache, so a
+	// late-spawned instance would receive already-cached transforms) and can
+	// override `headless` — check the static instance options instead of the
+	// lazily populated `children` to stay deterministic across runs
+	const instances = parentServer.config.browser.instances ?? [];
+	return instances.every((instance) => instance.headless !== false);
+}
+function resolveBrowserOptimizeDeps(projectConfigs, testFiles, harness) {
+	// `testFiles` are globbed by the core package and aggregated across every
+	// project that shares this browser Vite server (instance and benchmark
+	// variants). The remaining options are shared by those projects, so the first
+	// config is representative.
+	const testConfig = projectConfigs[0];
+	const root = testConfig.root || process.cwd();
+	const setupFiles = new Set(projectConfigs.flatMap((config) => toArray(config.setupFiles || [])));
+	const entries = [
+		...testFiles,
+		...setupFiles,
+		resolve(distDir, "index.js"),
+		resolve(distDir, "browser.js"),
+		resolve(distDir, "runners.js"),
+		resolve(distDir, "utils.js"),
+		...testConfig.snapshotSerializers || []
+	];
+	// Keep these external (never pre-bundle by optimizer):
+	// - vitest/browser, @vitest/browser/context, @vitest/browser/utils are
+	//   VIRTUAL modules generated per-server (see pluginContext.ts) — optimizer
+	//   cannot resolve/run their `load`, it would freeze stale/empty content.
+	// - vite/module-runner is small enough to not need pre-bundling.
+	// - msw is a large, side-effectful service-worker library.
+	const exclude = [
+		"vitest/browser",
+		"vite/module-runner",
+		"@vitest/browser/utils",
+		"@vitest/browser/context",
+		"msw",
+		"msw/browser"
+	];
+	if (typeof testConfig.diff === "string") {
+		entries.push(testConfig.diff);
+	}
+	if (testConfig.coverage?.enabled) {
+		const provider = testConfig.coverage.provider ?? "v8";
+		if (provider === "v8") {
+			const path = tryResolve("@vitest/coverage-v8", [root]);
+			if (path) {
+				entries.push(path);
+				exclude.push("@vitest/coverage-v8/browser");
+			}
+		} else if (provider === "istanbul") {
+			const path = tryResolve("@vitest/coverage-istanbul", [root]);
+			if (path) {
+				entries.push(path);
+				exclude.push("@vitest/coverage-istanbul");
+			}
+		} else if (provider === "custom" && testConfig.coverage.customProviderModule) {
+			entries.push(testConfig.coverage.customProviderModule);
+		}
+	}
+	// Pre-bundle the vitest runtime so the browser fetches a few optimized
+	// chunks instead of ~20 separately-served dist chunks (faster startup).
+	// `vitest`, `vitest/internal/browser` and `@vitest/browser/client` are
+	// optimized together in a single pass, so esbuild dedupes their shared
+	// stateful chunks (the test collector, the runner, the RPC client) to a
+	// single instance — preserving module identity between the test files'
+	// `import 'vitest'` and the tester. Their transitive deps (@vitest/utils,
+	// @vitest/spy, pathe, tinyrainbow, …) are inlined into these bundles.
+	const include = [
+		"vitest > expect-type",
+		"vitest > magic-string",
+		"vitest > chai",
+		"vitest",
+		"vitest/internal/browser",
+		"@vitest/browser/client"
+	];
+	const provider = testConfig.browser?.provider;
+	if (provider?.name === "preview") {
+		include.push("@vitest/browser-preview > @testing-library/user-event", "@vitest/browser-preview > @testing-library/dom");
+	}
+	const isPackageExists = (pkg) => {
+		return harness.packageInstaller.isPackageExists(pkg, { paths: [root] });
+	};
+	if (isPackageExists("vitest-browser-svelte")) {
+		exclude.push("vitest-browser-svelte");
+	}
+	// since we override the resolution in the esbuild plugin, Vite can no longer optimize it
+	if (isPackageExists("vitest-browser-vue")) {
+		include.push("vitest-browser-vue", "vitest-browser-vue > @vue/test-utils", "vitest-browser-vue > @vue/test-utils > @vue/compiler-core");
+	}
+	if (isPackageExists("@vue/test-utils")) {
+		include.push("@vue/test-utils");
+	}
+	const otelConfig = testConfig.experimental?.openTelemetry;
+	if (otelConfig?.enabled && otelConfig.browserSdkPath) {
+		entries.push(otelConfig.browserSdkPath);
+		include.push("@opentelemetry/api");
+	} else {
+		exclude.push("@opentelemetry/api");
+	}
+	// resolve @vue/(test-utils|compiler-core) to CJS instead of the browser build:
+	// test-utils' browser build expects a global Vue; compiler-core's CJS build is
+	// the only one that allows slots as strings.
+	const rolldownPlugin = {
+		name: "vue-test-utils-rewrite",
+		resolveId: {
+			filter: { id: /^@vue\/(test-utils|compiler-core)$/ },
+			handler(source, importer) {
+				return getRequire().resolve(source, { paths: [importer] });
+			}
+		}
+	};
+	const esbuildPlugin = {
+		name: "test-utils-rewrite",
+		setup(build) {
+			build.onResolve({ filter: /^@vue\/(test-utils|compiler-core)$/ }, (args) => {
+				return { path: getRequire().resolve(args.path, { paths: [args.importer] }) };
+			});
+		}
+	};
+	return {
+		entries,
+		exclude,
+		include,
+		...rolldownVersion ? { rolldownOptions: { plugins: [rolldownPlugin] } } : { esbuildOptions: { plugins: [esbuildPlugin] } }
+	};
+}
+function tryResolve(path, paths) {
+	try {
+		return getRequire().resolve(path, { paths });
+	} catch {
+		return undefined;
+	}
+}
+let _require;
+function getRequire() {
+	if (!_require) {
+		_require = createRequire(import.meta.url);
+	}
+	return _require;
+}
 function defineBrowserProvider(options) {
 	return {
 		...options,
@@ -3516,4 +3509,4 @@ function defineBrowserProvider(options) {
 	};
 }
 
-export { createBrowserServer, defineBrowserCommand, defineBrowserProvider, parseKeyDef, resolveScreenshotPath };
+export { assertBrowserApiWrite, assertBrowserFileAccess, createBrowserServer, defineBrowserCommand, defineBrowserProvider, parseKeyDef, resolveScreenshotPath };