feat(nuxt): enforce strict-layout Vite boundary for userland server imports

[yamcodes]

Summary

This is the final, isolated security patch for the Nuxt parity epic. ADR-0013 requires the strict layout to block client-side imports of any server-only schema file, including userland files like ~/env/server.ts. The current Vite plugin only blocks the @arkenv/nuxt/server package entry point, so the boundary is incomplete.

Current behavior

The Vite plugin registered by @arkenv/nuxt/module blocks:

• id === "@arkenv/nuxt/server"
• any file under @arkenv/nuxt/src|dist named server

It does not block imports of the user's own env/server.ts (or any file ending with /server inside the configured schema directory), which means a developer can still import server-only schemas into a client component and leak server variable names/types to the browser bundle.

Desired behavior

Extend the Vite resolveId plugin so that, during the client build, it also rejects module IDs whose resolved path ends with /server inside the schema directory. The error message should remain the existing branded message:

[ArkEnv] Importing server-only environment schema on the client is not allowed!

The check should work for both absolute paths and Nuxt aliases that resolve into the schema directory (e.g., ~/env/server, ~~/env/server).

Acceptance criteria

• The Vite plugin blocks imports of userland env/server.ts (or any file ending with /server inside the configured schema directory) during the client build.
• The plugin still blocks @arkenv/nuxt/server and package-internal server entry points.
• The error message is the existing branded ArkEnv message.
• Server-side imports of the same file are unaffected.
• A test verifies that a client-side import of ~/env/server.ts fails the build, while a server-side import succeeds.

Out of scope

• Flat layout parsing and runtime API changes.
• Build-time validation and codegen.
• Changing the error message text or adding a remediation hint (can be a follow-up).

References

• Tracking epic: Tracking: Nuxt Integration Parity #1241
• ADR-0013 — Nuxt strict-layout compile-time boundary via Vite plugin
• @arkenv/nuxt/src/module.ts — current Vite plugin implementation

[pullfrog]

This run croaked 😵

The workflow encountered an error before any progress could be reported. Please check the link below for details.

  ^{｜ Rerun failed job ➔ ｜ View workflow run ｜ via Pullfrog ｜ 𝕏}

[yamcodes]

This was generated by AI during triage.

Agent Brief

Category: enhancement
Summary: Extend the @arkenv/nuxt Vite plugin to block userland server-only schema imports inside the configured schema directory, completing ADR-0013.

Current behavior:
The Vite plugin registered by @arkenv/nuxt/module only blocks imports of @arkenv/nuxt/server and package-internal server entry points. It does not prevent a client component from importing the user's own env/server.ts file (or any file ending with /server inside the schema directory), so server variable names and types can still leak into the browser bundle.

Desired behavior:
During the client build, the plugin should reject any module ID whose resolved path ends with /server inside the configured schema directory. The existing branded error message should be preserved:

[ArkEnv] Importing server-only environment schema on the client is not allowed!

Server-side imports must remain unaffected.

Key interfaces:

• Vite plugin resolveId hook — inspect id and, if isClient is true, reject server-only schema imports.
• Schema directory resolution — derive the strict-layout base directory from resolveLayout / schemaPath and match IDs that resolve under that directory and end with /server.
• Error contract — throw a synchronous error with the exact existing message so existing tests do not need to change.

Acceptance criteria:

• The Vite plugin blocks imports of userland env/server.ts (or any file ending with /server inside the configured schema directory) during the client build.
• The plugin still blocks @arkenv/nuxt/server and package-internal server entry points.
• The error message is the existing branded ArkEnv message.
• Server-side imports of the same file are unaffected.
• A test verifies that a client-side import of ~/env/server.ts fails the build, while a server-side import succeeds.

Out of scope:

• Flat layout parsing and runtime API changes.
• Build-time validation and codegen.
• Changing the error message text or adding a remediation hint.