From 608ebdf4a6b53474e2e1e7d240628b5b6dc5a82b Mon Sep 17 00:00:00 2001
From: MK <fengmk2@gmail.com>
Date: Tue, 20 Oct 2026 20:11:47 +0800
Subject: [PATCH 1/3] feat(cli): support upstream Vite overrides in ecosystem
 CI

---
 .../core_command_root_dispatch.global.md      |   8 +-
 .../core_command_root_dispatch.local.md       |   8 +-
 .../core_module_identity/check-api.mjs        |   2 +-
 .../core_module_identity/check-bundled.mjs    |   2 +-
 .../check-tagged-alias.mjs                    |  23 +--
 .../core_module_identity/snapshots.toml       |   4 +-
 ...dule_identity_npm_tagged_alias_rejected.md |   2 +-
 ...core_module_identity_repackaged_version.md |   8 +-
 .../core_module_identity/stamp-version.mjs    |  20 +++
 .../fixtures/core_resolution_errors/index.ts  |   1 +
 .../core_resolution_errors/snapshots.toml     |   4 +-
 .../snapshots/core_resolution_stale_core.md   |  10 +-
 .../core_resolution_upstream_vite.md          |  10 +-
 .../upstream_vite_override/check-api.mjs      |  23 +++
 .../check-core-guard.mjs                      |  29 ++++
 .../fixtures/upstream_vite_override/entry.ts  |   1 +
 .../upstream_vite_override/index.html         |   2 +
 .../upstream_vite_override/override.test.ts   |  17 ++
 .../upstream_vite_override/package.json       |  13 ++
 .../pnpm-workspace.yaml                       |   3 +
 .../upstream_vite_override/snapshots.toml     |  55 +++++++
 .../upstream_vite_override.global.md          | 147 ++++++++++++++++++
 .../snapshots/upstream_vite_override.local.md | 135 ++++++++++++++++
 .../upstream_vite_override/tsconfig.json      |   5 +
 .../upstream_vite_override/use-local-vite.mjs |  40 +++++
 .../upstream_vite_override/vite.config.ts     |  51 ++++++
 docs/guide/ci.md                              |  44 ++++++
 packages/cli/BUNDLING.md                      |  31 ++--
 packages/cli/build.ts                         |   2 +-
 packages/cli/package.json                     |   1 +
 .../cli/src/__tests__/exports-map.spec.ts     |   1 +
 .../cli/src/__tests__/resolve-core.spec.ts    | 127 ++++++++++++---
 .../cli/src/__tests__/resolve-vite.spec.ts    |  29 +++-
 packages/cli/src/migration/migrator/tsup.ts   |   2 +-
 packages/cli/src/pack-bin.ts                  |   4 +-
 packages/cli/src/pack.ts                      |   4 +-
 packages/cli/src/resolve-core.ts              |  58 +++++--
 packages/cli/src/resolve-pack.ts              |  11 +-
 packages/cli/src/resolve-vite-config.ts       |   2 +-
 packages/cli/src/resolve-vite.ts              |  37 +++--
 pnpm-lock.yaml                                |   3 +
 41 files changed, 863 insertions(+), 116 deletions(-)
 create mode 100644 crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_module_identity/stamp-version.mjs
 create mode 100644 crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_resolution_errors/index.ts
 create mode 100644 crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/check-api.mjs
 create mode 100644 crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/check-core-guard.mjs
 create mode 100644 crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/entry.ts
 create mode 100644 crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/index.html
 create mode 100644 crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/override.test.ts
 create mode 100644 crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/package.json
 create mode 100644 crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/pnpm-workspace.yaml
 create mode 100644 crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/snapshots.toml
 create mode 100644 crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/snapshots/upstream_vite_override.global.md
 create mode 100644 crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/snapshots/upstream_vite_override.local.md
 create mode 100644 crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/tsconfig.json
 create mode 100644 crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/use-local-vite.mjs
 create mode 100644 crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/vite.config.ts

diff --git a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_command_root/snapshots/core_command_root_dispatch.global.md b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_command_root/snapshots/core_command_root_dispatch.global.md
index 3661ad7796..a5f4ff6a4b 100644
--- a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_command_root/snapshots/core_command_root_dispatch.global.md
+++ b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_command_root/snapshots/core_command_root_dispatch.global.md
@@ -137,10 +137,12 @@ error: Failed to resolve vite command: GenericFailure, Expected @voidzero-dev/vi
 
 ## `vp -C . pack packages/app/src/index.ts`
 
-**Exit code:** 1
-
 ```
 VITE+ - The Unified Toolchain for the Web
 
-error: Failed to resolve pack command: GenericFailure, Expected @voidzero-dev/vite-plus-core@<version>, but found vite@8.2.2 at <workspace>/node_modules/.pnpm/vite@8.2.2/node_modules/vite/package.json. Run `vp migrate` to align the Vite alias, then run `vp install`.
+ℹ entry: packages/app/src/index.ts
+ℹ Build start
+ℹ dist/index.mjs  <size> kB │ gzip: <size> kB
+ℹ 1 files, total: <size> kB
+✔ Build complete in <duration>
 ```
diff --git a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_command_root/snapshots/core_command_root_dispatch.local.md b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_command_root/snapshots/core_command_root_dispatch.local.md
index 7ec2ac9b22..8d8ca9766e 100644
--- a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_command_root/snapshots/core_command_root_dispatch.local.md
+++ b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_command_root/snapshots/core_command_root_dispatch.local.md
@@ -119,8 +119,10 @@ error: Failed to resolve vite command: GenericFailure, Expected @voidzero-dev/vi
 
 ## `vp -C . pack packages/app/src/index.ts`
 
-**Exit code:** 1
-
 ```
-error: Failed to resolve pack command: GenericFailure, Expected @voidzero-dev/vite-plus-core@<version>, but found vite@8.2.2 at <workspace>/node_modules/.pnpm/vite@8.2.2/node_modules/vite/package.json. Run `vp migrate` to align the Vite alias, then run `vp install`.
+ℹ entry: packages/app/src/index.ts
+ℹ Build start
+ℹ dist/index.mjs  <size> kB │ gzip: <size> kB
+ℹ 1 files, total: <size> kB
+✔ Build complete in <duration>
 ```
diff --git a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_module_identity/check-api.mjs b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_module_identity/check-api.mjs
index 573b1212d6..d4fb8b2eb8 100644
--- a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_module_identity/check-api.mjs
+++ b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_module_identity/check-api.mjs
@@ -25,5 +25,5 @@ assert.equal(ModuleRunner, VpModuleRunner);
 const config = {};
 assert.equal(vite.defineConfig(config), config);
 assert.equal(pkg.dependencies.vite, `npm:@voidzero-dev/vite-plus-core@${pkg.version}`);
-assert.equal(pkg.dependencies['@voidzero-dev/vite-plus-core'], undefined);
+assert.equal(pkg.dependencies['@voidzero-dev/vite-plus-core'], pkg.version);
 console.log('Packed alias, ESM, CommonJS, and module-runner identity passed');
diff --git a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_module_identity/check-bundled.mjs b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_module_identity/check-bundled.mjs
index 119a23c051..c15bfcf451 100644
--- a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_module_identity/check-bundled.mjs
+++ b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_module_identity/check-bundled.mjs
@@ -7,6 +7,6 @@ import { build } from 'vite-plus/pack';
 const require = createRequire(import.meta.url);
 const cliRequire = createRequire(require.resolve('vite-plus/package.json'));
 assert.equal(createServer, cliRequire('vite').createServer);
-assert.equal(build, cliRequire('vite/pack').build);
+assert.equal(build, cliRequire('@voidzero-dev/vite-plus-core/pack').build);
 assert.equal(require('./package.json').devDependencies.vite, undefined);
 console.log('Bundled APIs resolve without a project Vite dependency');
diff --git a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_module_identity/check-tagged-alias.mjs b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_module_identity/check-tagged-alias.mjs
index 40e971754c..9ee36f9532 100644
--- a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_module_identity/check-tagged-alias.mjs
+++ b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_module_identity/check-tagged-alias.mjs
@@ -12,13 +12,16 @@ assert.equal(require('vite/package.json').name, 'vite');
 assert.equal(cliRequire('vite/package.json').name, '@voidzero-dev/vite-plus-core');
 assert.notEqual(require.resolve('vite/package.json'), cliRequire.resolve('vite/package.json'));
 
-for (const args of [['dev'], ['pack', 'entry.js']]) {
-  const result = spawnSync('vp', args, { encoding: 'utf8', timeout: 30_000 });
-  assert.ifError(result.error);
-  const output = result.stdout + result.stderr;
-  assert.equal(result.status, 1, output);
-  assert.match(output, /Expected @voidzero-dev\/vite-plus-core@/);
-  assert.match(output, /but found vite@/);
-  assert.match(output, /Run `vp migrate` to align the Vite alias, then run `vp install`\./);
-  console.log(`vp ${args[0]} rejects the replaced npm alias and reports the repair command`);
-}
+const dev = spawnSync('vp', ['dev'], { encoding: 'utf8', timeout: 30_000 });
+assert.ifError(dev.error);
+const output = dev.stdout + dev.stderr;
+assert.equal(dev.status, 1, output);
+assert.match(output, /Expected @voidzero-dev\/vite-plus-core@/);
+assert.match(output, /but found vite@/);
+assert.match(output, /Run `vp migrate` to align the Vite alias, then run `vp install`\./);
+console.log('vp dev rejects the replaced npm alias and reports the repair command');
+
+const pack = spawnSync('vp', ['pack', 'entry.js'], { encoding: 'utf8', timeout: 30_000 });
+assert.ifError(pack.error);
+assert.equal(pack.status, 0, pack.stdout + pack.stderr);
+console.log('vp pack uses its internal core despite the replaced npm alias');
diff --git a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_module_identity/snapshots.toml b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_module_identity/snapshots.toml
index d0be4f3f72..5422adfbb5 100644
--- a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_module_identity/snapshots.toml
+++ b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_module_identity/snapshots.toml
@@ -15,9 +15,7 @@ local-registry = true
 comment = "CI can stamp the package version after building the CLI. The resolver must compare installed manifests rather than an inlined build-time version."
 steps = [
   { argv = ["vp", "install", "--ignore-scripts"], snapshot = false },
-  { argv = ["vpt", "json-edit", "node_modules/vite-plus/package.json", "version", "0.0.0"], snapshot = false },
-  { argv = ["vpt", "json-edit", "node_modules/vite-plus/package.json", "dependencies.vite", "npm:@voidzero-dev/vite-plus-core@0.0.0"], snapshot = false },
-  { argv = ["vpt", "json-edit", "node_modules/vite/package.json", "version", "0.0.0"], snapshot = false },
+  { argv = ["node", "stamp-version.mjs"], snapshot = false },
   ["node", "check-api.mjs"],
   ["vp", "dev"],
   ["vp", "build"],
diff --git a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_module_identity/snapshots/core_module_identity_npm_tagged_alias_rejected.md b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_module_identity/snapshots/core_module_identity_npm_tagged_alias_rejected.md
index 8f3b5c664c..2230001883 100644
--- a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_module_identity/snapshots/core_module_identity_npm_tagged_alias_rejected.md
+++ b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_module_identity/snapshots/core_module_identity_npm_tagged_alias_rejected.md
@@ -11,5 +11,5 @@
 
 ```
 vp dev rejects the replaced npm alias and reports the repair command
-vp pack rejects the replaced npm alias and reports the repair command
+vp pack uses its internal core despite the replaced npm alias
 ```
diff --git a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_module_identity/snapshots/core_module_identity_repackaged_version.md b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_module_identity/snapshots/core_module_identity_repackaged_version.md
index 214d0ec8a8..d3863906d7 100644
--- a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_module_identity/snapshots/core_module_identity_repackaged_version.md
+++ b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_module_identity/snapshots/core_module_identity_repackaged_version.md
@@ -5,13 +5,7 @@ CI can stamp the package version after building the CLI. The resolver must compa
 ## `vp install --ignore-scripts`
 
 
-## `vpt json-edit node_modules/vite-plus/package.json version 0.0.0`
-
-
-## `vpt json-edit node_modules/vite-plus/package.json dependencies.vite npm:@voidzero-dev/vite-plus-core@0.0.0`
-
-
-## `vpt json-edit node_modules/vite/package.json version 0.0.0`
+## `node stamp-version.mjs`
 
 
 ## `node check-api.mjs`
diff --git a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_module_identity/stamp-version.mjs b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_module_identity/stamp-version.mjs
new file mode 100644
index 0000000000..c4680319ea
--- /dev/null
+++ b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_module_identity/stamp-version.mjs
@@ -0,0 +1,20 @@
+import { readFileSync, writeFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const cliManifest = require.resolve('vite-plus/package.json');
+const cliRequire = createRequire(cliManifest);
+for (const manifest of new Set([
+  cliManifest,
+  require.resolve('vite/package.json'),
+  cliRequire.resolve('vite/package.json'),
+  cliRequire.resolve('@voidzero-dev/vite-plus-core/package.json'),
+])) {
+  const pkg = JSON.parse(readFileSync(manifest, 'utf8'));
+  pkg.version = '0.0.0';
+  if (pkg.name === 'vite-plus') {
+    pkg.dependencies.vite = 'npm:@voidzero-dev/vite-plus-core@0.0.0';
+    pkg.dependencies['@voidzero-dev/vite-plus-core'] = '0.0.0';
+  }
+  writeFileSync(manifest, JSON.stringify(pkg));
+}
diff --git a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_resolution_errors/index.ts b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_resolution_errors/index.ts
new file mode 100644
index 0000000000..46d3ca8c61
--- /dev/null
+++ b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_resolution_errors/index.ts
@@ -0,0 +1 @@
+export const value = 42;
diff --git a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_resolution_errors/snapshots.toml b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_resolution_errors/snapshots.toml
index 09f24b2b7e..f59accfcaa 100644
--- a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_resolution_errors/snapshots.toml
+++ b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_resolution_errors/snapshots.toml
@@ -4,7 +4,7 @@ vp = "local"
 steps = [
   { argv = ["vpt", "write-file", "node_modules/vite/package.json", "{\"name\":\"vite\",\"version\":\"8.2.2\"}\n"], snapshot = false },
   { argv = ["vp", "dev"], continue-on-failure = true },
-  ["vp", "pack", "index.ts"],
+  ["vp", "pack", "--no-config", "index.ts"],
 ]
 
 [[case]]
@@ -13,5 +13,5 @@ vp = "local"
 steps = [
   { argv = ["vpt", "write-file", "node_modules/vite/package.json", "{\"name\":\"@voidzero-dev/vite-plus-core\",\"version\":\"0.0.0-stale\"}\n"], snapshot = false },
   { argv = ["vp", "dev"], continue-on-failure = true },
-  ["vp", "pack", "index.ts"],
+  ["vp", "pack", "--no-config", "index.ts"],
 ]
diff --git a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_resolution_errors/snapshots/core_resolution_stale_core.md b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_resolution_errors/snapshots/core_resolution_stale_core.md
index 80cf509b19..dc85995c0b 100644
--- a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_resolution_errors/snapshots/core_resolution_stale_core.md
+++ b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_resolution_errors/snapshots/core_resolution_stale_core.md
@@ -12,10 +12,12 @@
 error: Failed to resolve vite command: GenericFailure, Expected @voidzero-dev/vite-plus-core@<version>, but found @voidzero-dev/vite-plus-core@<version> at <workspace>/node_modules/vite/package.json. Run `vp migrate` to align the Vite alias, then run `vp install`.
 ```
 
-## `vp pack index.ts`
-
-**Exit code:** 1
+## `vp pack --no-config index.ts`
 
 ```
-error: Failed to resolve pack command: GenericFailure, Expected @voidzero-dev/vite-plus-core@<version>, but found @voidzero-dev/vite-plus-core@<version> at <workspace>/node_modules/vite/package.json. Run `vp migrate` to align the Vite alias, then run `vp install`.
+ℹ entry: index.ts
+ℹ Build start
+ℹ dist/index.mjs  <size> kB │ gzip: <size> kB
+ℹ 1 files, total: <size> kB
+✔ Build complete in <duration>
 ```
diff --git a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_resolution_errors/snapshots/core_resolution_upstream_vite.md b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_resolution_errors/snapshots/core_resolution_upstream_vite.md
index 57f4377cc1..250f464a7d 100644
--- a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_resolution_errors/snapshots/core_resolution_upstream_vite.md
+++ b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_resolution_errors/snapshots/core_resolution_upstream_vite.md
@@ -12,10 +12,12 @@
 error: Failed to resolve vite command: GenericFailure, Expected @voidzero-dev/vite-plus-core@<version>, but found vite@8.2.2 at <workspace>/node_modules/vite/package.json. Run `vp migrate` to align the Vite alias, then run `vp install`.
 ```
 
-## `vp pack index.ts`
-
-**Exit code:** 1
+## `vp pack --no-config index.ts`
 
 ```
-error: Failed to resolve pack command: GenericFailure, Expected @voidzero-dev/vite-plus-core@<version>, but found vite@8.2.2 at <workspace>/node_modules/vite/package.json. Run `vp migrate` to align the Vite alias, then run `vp install`.
+ℹ entry: index.ts
+ℹ Build start
+ℹ dist/index.mjs  <size> kB │ gzip: <size> kB
+ℹ 1 files, total: <size> kB
+✔ Build complete in <duration>
 ```
diff --git a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/check-api.mjs b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/check-api.mjs
new file mode 100644
index 0000000000..a7eb099de3
--- /dev/null
+++ b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/check-api.mjs
@@ -0,0 +1,23 @@
+import assert from 'node:assert/strict';
+import { createRequire } from 'node:module';
+import * as vite from 'vite';
+import * as vp from 'vite-plus';
+import { build as pack } from 'vite-plus/pack';
+
+const require = createRequire(import.meta.url);
+const cliRequire = createRequire(require.resolve('vite-plus/package.json'));
+const vitestRequire = createRequire(cliRequire.resolve('vitest/package.json'));
+const core = cliRequire('@voidzero-dev/vite-plus-core/package.json');
+assert.equal(core.version, cliRequire('vite-plus/package.json').version);
+assert.equal(pack, cliRequire('@voidzero-dev/vite-plus-core/pack').build);
+assert.equal(vite.version, '8.3.4');
+for (const name of ['createServer', 'build', 'resolveConfig', 'DevEnvironment']) {
+  assert.equal(vite[name], vp[name], name);
+  assert.equal(require('vite-plus')[name], vite[name], name);
+}
+assert.equal(cliRequire.resolve('vite'), require.resolve('vite'));
+assert.equal(vitestRequire.resolve('vite'), require.resolve('vite'));
+if (process.env.LOCAL_VITE === '1') {
+  assert.equal(vp.ecosystemCiMarker, 'local-vite');
+}
+console.log('API exports and bundled Vitest use upstream Vite; pack uses the matching internal core');
diff --git a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/check-core-guard.mjs b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/check-core-guard.mjs
new file mode 100644
index 0000000000..7d23a9a198
--- /dev/null
+++ b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/check-core-guard.mjs
@@ -0,0 +1,29 @@
+import assert from 'node:assert/strict';
+import { spawnSync } from 'node:child_process';
+import { readFileSync, writeFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { dirname, join } from 'node:path';
+
+const require = createRequire(import.meta.url);
+const cliRequire = createRequire(require.resolve('vite-plus/package.json'));
+const manifest = cliRequire.resolve('@voidzero-dev/vite-plus-core/package.json');
+const original = readFileSync(manifest, 'utf8');
+try {
+  writeFileSync(manifest, JSON.stringify({ ...JSON.parse(original), version: '0.0.0-stale' }));
+  for (const command of ['pack', 'build']) {
+    const local = process.argv[2] === 'local';
+    const args = local
+      ? [join(dirname(require.resolve('vite-plus/package.json')), 'bin/vp'), command]
+      : [command];
+    const result = spawnSync(local ? process.execPath : 'vp', args, {
+      encoding: 'utf8',
+      timeout: 30_000,
+    });
+    assert.ifError(result.error);
+    assert.equal(result.status, 1, result.stdout + result.stderr);
+    assert.match(result.stdout + result.stderr, /found @voidzero-dev\/vite-plus-core@0.0.0-stale/);
+  }
+  console.log('Pack and Vite commands still reject a mismatched internal core');
+} finally {
+  writeFileSync(manifest, original);
+}
diff --git a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/entry.ts b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/entry.ts
new file mode 100644
index 0000000000..74bffb3ffa
--- /dev/null
+++ b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/entry.ts
@@ -0,0 +1 @@
+export const message: string = 'Packed with the internal core';
diff --git a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/index.html b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/index.html
new file mode 100644
index 0000000000..ca3177ab0d
--- /dev/null
+++ b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/index.html
@@ -0,0 +1,2 @@
+<h1>Upstream Vite</h1>
+<script type="module" src="./entry.ts"></script>
diff --git a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/override.test.ts b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/override.test.ts
new file mode 100644
index 0000000000..9231c4e6f9
--- /dev/null
+++ b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/override.test.ts
@@ -0,0 +1,17 @@
+import { expect, test } from 'vite-plus/test';
+import * as vite from 'vite';
+import * as vp from 'vite-plus';
+
+test('uses the replacement Vite through public API exports', async () => {
+  expect(vp.version).toBe('8.3.4');
+  expect(vp.createServer).toBe(vite.createServer);
+  if (process.env.LOCAL_VITE === '1') {
+    expect(vp.ecosystemCiMarker).toBe('local-vite');
+  }
+  const server = await vp.createServer({ configFile: false, server: { middlewareMode: true } });
+  try {
+    expect(vite.isRunnableDevEnvironment(server.environments.ssr)).toBe(true);
+  } finally {
+    await server.close();
+  }
+});
diff --git a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/package.json b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/package.json
new file mode 100644
index 0000000000..433633326a
--- /dev/null
+++ b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/package.json
@@ -0,0 +1,13 @@
+{
+  "name": "upstream-vite-override",
+  "private": true,
+  "type": "module",
+  "packageManager": "pnpm@11.24.0",
+  "devDependencies": {
+    "vite": "8.3.4",
+    "vite-plus": "latest"
+  },
+  "scripts": {
+    "postinstall": "vp pack"
+  }
+}
diff --git a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/pnpm-workspace.yaml b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/pnpm-workspace.yaml
new file mode 100644
index 0000000000..109d7f196e
--- /dev/null
+++ b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/pnpm-workspace.yaml
@@ -0,0 +1,3 @@
+minimumReleaseAge: 0
+overrides:
+  vite: 8.3.4
diff --git a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/snapshots.toml b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/snapshots.toml
new file mode 100644
index 0000000000..3efdc4b09f
--- /dev/null
+++ b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/snapshots.toml
@@ -0,0 +1,55 @@
+[[case]]
+name = "upstream_vite_override"
+vp = ["global"]
+# Use pinned upstream Vite through the runner's registry to exercise its real
+# CLI, API exports, and Vitest peer layout instead of a mock Vite package.
+local-registry = true
+comment = "A global Vite override replaces CLI/API/Vitest Vite, while postinstall pack keeps its matching internal core. Repeat with a local file dependency and a different public CLI entry."
+env = { VP_USE_PROJECT_VITE = "1" }
+steps = [
+  { argv = ["vp", "install"], snapshot = false },
+  ["node", "check-api.mjs"],
+  ["vpt", "stat-file", "packed/entry.mjs", "--assert", "file"],
+  ["vpt", "stat-file", "packed/entry.d.mts", "--assert", "file"],
+  ["vp", "build"],
+  ["vp", "dev"],
+  ["vp", "preview"],
+  ["vp", "test", "run"],
+  { argv = ["node", "use-local-vite.mjs"], snapshot = false },
+  { argv = ["vp", "install"], envs = [["EXPECT_INTERNAL_CONFIG", "1"]], snapshot = false },
+  { argv = ["node", "check-api.mjs"], envs = [["LOCAL_VITE", "1"]] },
+  ["vp", "build"],
+  ["vp", "dev"],
+  ["vp", "preview"],
+  { argv = ["vp", "test", "run"], envs = [["LOCAL_VITE", "1"]] },
+  ["node", "check-core-guard.mjs"],
+]
+
+# The registry installation owns the runtime dependencies. Invoke its public
+# local bin instead of the runner's bootstrap CLI, which has separate Vitest peers.
+[[case]]
+name = "upstream_vite_override"
+vp = ["local"]
+# Use pinned upstream Vite through the runner's registry to exercise its real
+# CLI, API exports, and Vitest peer layout instead of a mock Vite package.
+local-registry = true
+comment = "A global Vite override replaces CLI/API/Vitest Vite, while postinstall pack keeps its matching internal core. Repeat with a local file dependency and a different public CLI entry."
+env = { VP_USE_PROJECT_VITE = "1" }
+steps = [
+  { argv = ["vp", "install"], snapshot = false },
+  ["node", "check-api.mjs"],
+  ["vpt", "stat-file", "packed/entry.mjs", "--assert", "file"],
+  ["vpt", "stat-file", "packed/entry.d.mts", "--assert", "file"],
+  ["node", "node_modules/vite-plus/bin/vp", "build"],
+  ["node", "node_modules/vite-plus/bin/vp", "dev"],
+  ["node", "node_modules/vite-plus/bin/vp", "preview"],
+  ["node", "node_modules/vite-plus/bin/vp", "test", "run"],
+  { argv = ["node", "use-local-vite.mjs"], snapshot = false },
+  { argv = ["node", "node_modules/vite-plus/bin/vp", "install"], envs = [["EXPECT_INTERNAL_CONFIG", "1"]], snapshot = false },
+  { argv = ["node", "check-api.mjs"], envs = [["LOCAL_VITE", "1"]] },
+  ["node", "node_modules/vite-plus/bin/vp", "build"],
+  ["node", "node_modules/vite-plus/bin/vp", "dev"],
+  ["node", "node_modules/vite-plus/bin/vp", "preview"],
+  { argv = ["node", "node_modules/vite-plus/bin/vp", "test", "run"], envs = [["LOCAL_VITE", "1"]] },
+  ["node", "check-core-guard.mjs", "local"],
+]
diff --git a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/snapshots/upstream_vite_override.global.md b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/snapshots/upstream_vite_override.global.md
new file mode 100644
index 0000000000..c691b11741
--- /dev/null
+++ b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/snapshots/upstream_vite_override.global.md
@@ -0,0 +1,147 @@
+# upstream_vite_override
+
+A global Vite override replaces CLI/API/Vitest Vite, while postinstall pack keeps its matching internal core. Repeat with a local file dependency and a different public CLI entry.
+
+## `vp install`
+
+
+## `node check-api.mjs`
+
+```
+API exports and bundled Vitest use upstream Vite; pack uses the matching internal core
+```
+
+## `vpt stat-file packed/entry.mjs --assert file`
+
+```
+packed/entry.mjs: file
+```
+
+## `vpt stat-file packed/entry.d.mts --assert file`
+
+```
+packed/entry.d.mts: file
+```
+
+## `vp build`
+
+```
+VITE+ - The Unified Toolchain for the Web
+
+✓ 4 modules transformed.
+computing gzip size...
+dist/index.html                <size> kB │ gzip: <size> kB
+dist/assets/index-<hash>.js  <size> kB │ gzip: <size> kB
+
+✓ built in <duration>
+```
+
+## `vp dev`
+
+```
+
+  VITE <version>  ready in <duration>
+
+  ➜  Local:   http://127.0.0.1:<port>/
+  ➜  press h + enter to show help
+Upstream Vite dev served HTTP 200
+```
+
+## `vp preview`
+
+```
+VITE+ - The Unified Toolchain for the Web
+
+  ➜  Local:   http://127.0.0.1:<port>/
+  ➜  press h + enter to show help
+Upstream Vite preview served HTTP 200
+```
+
+## `vp test run`
+
+```
+VITE+ - The Unified Toolchain for the Web
+
+ RUN  <version> <workspace>
+
+ ✓ override.test.ts (1 test) <duration>
+   ✓ uses the replacement Vite through public API exports <duration>
+
+ Test Files  1 passed (1)
+      Tests  1 passed (1)
+   Start at  <time>
+   Duration  <duration> (<timing>)
+```
+
+## `node use-local-vite.mjs`
+
+
+## `EXPECT_INTERNAL_CONFIG=1 vp install`
+
+
+## `LOCAL_VITE=1 node check-api.mjs`
+
+```
+API exports and bundled Vitest use upstream Vite; pack uses the matching internal core
+```
+
+## `vp build`
+
+```
+VITE+ - The Unified Toolchain for the Web
+
+Local upstream Vite CLI entry
+✓ 4 modules transformed.
+computing gzip size...
+dist/index.html                <size> kB │ gzip: <size> kB
+dist/assets/index-<hash>.js  <size> kB │ gzip: <size> kB
+
+✓ built in <duration>
+```
+
+## `vp dev`
+
+```
+VITE+ - The Unified Toolchain for the Web
+
+Local upstream Vite CLI entry
+
+  VITE <version>  ready in <duration>
+
+  ➜  Local:   http://127.0.0.1:<port>/
+  ➜  press h + enter to show help
+Upstream Vite dev served HTTP 200
+```
+
+## `vp preview`
+
+```
+VITE+ - The Unified Toolchain for the Web
+
+Local upstream Vite CLI entry
+  ➜  Local:   http://127.0.0.1:<port>/
+  ➜  press h + enter to show help
+Upstream Vite preview served HTTP 200
+```
+
+## `LOCAL_VITE=1 vp test run`
+
+```
+VITE+ - The Unified Toolchain for the Web
+
+ RUN  <version> <workspace>
+
+ ✓ override.test.ts (1 test) <duration>
+   ✓ uses the replacement Vite through public API exports <duration>
+
+ Test Files  1 passed (1)
+      Tests  1 passed (1)
+   Start at  <time>
+   Duration  <duration> (<timing>)
+```
+
+## `node check-core-guard.mjs`
+
+```
+Pack and Vite commands still reject a mismatched internal core
+```
diff --git a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/snapshots/upstream_vite_override.local.md b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/snapshots/upstream_vite_override.local.md
new file mode 100644
index 0000000000..e509d6e831
--- /dev/null
+++ b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/snapshots/upstream_vite_override.local.md
@@ -0,0 +1,135 @@
+# upstream_vite_override
+
+A global Vite override replaces CLI/API/Vitest Vite, while postinstall pack keeps its matching internal core. Repeat with a local file dependency and a different public CLI entry.
+
+## `vp install`
+
+
+## `node check-api.mjs`
+
+```
+API exports and bundled Vitest use upstream Vite; pack uses the matching internal core
+```
+
+## `vpt stat-file packed/entry.mjs --assert file`
+
+```
+packed/entry.mjs: file
+```
+
+## `vpt stat-file packed/entry.d.mts --assert file`
+
+```
+packed/entry.d.mts: file
+```
+
+## `node node_modules/vite-plus/bin/vp build`
+
+```
+✓ 4 modules transformed.
+computing gzip size...
+dist/index.html                <size> kB │ gzip: <size> kB
+dist/assets/index-<hash>.js  <size> kB │ gzip: <size> kB
+
+✓ built in <duration>
+```
+
+## `node node_modules/vite-plus/bin/vp dev`
+
+```
+
+  VITE <version>  ready in <duration>
+
+  ➜  Local:   http://127.0.0.1:<port>/
+  ➜  press h + enter to show help
+Upstream Vite dev served HTTP 200
+```
+
+## `node node_modules/vite-plus/bin/vp preview`
+
+```
+  ➜  Local:   http://127.0.0.1:<port>/
+  ➜  press h + enter to show help
+Upstream Vite preview served HTTP 200
+```
+
+## `node node_modules/vite-plus/bin/vp test run`
+
+```
+
+ RUN  <version> <workspace>
+
+ ✓ override.test.ts (1 test) <duration>
+   ✓ uses the replacement Vite through public API exports <duration>
+
+ Test Files  1 passed (1)
+      Tests  1 passed (1)
+   Start at  <time>
+   Duration  <duration> (<timing>)
+```
+
+## `node use-local-vite.mjs`
+
+
+## `EXPECT_INTERNAL_CONFIG=1 node node_modules/vite-plus/bin/vp install`
+
+
+## `LOCAL_VITE=1 node check-api.mjs`
+
+```
+API exports and bundled Vitest use upstream Vite; pack uses the matching internal core
+```
+
+## `node node_modules/vite-plus/bin/vp build`
+
+```
+Local upstream Vite CLI entry
+✓ 4 modules transformed.
+computing gzip size...
+dist/index.html                <size> kB │ gzip: <size> kB
+dist/assets/index-<hash>.js  <size> kB │ gzip: <size> kB
+
+✓ built in <duration>
+```
+
+## `node node_modules/vite-plus/bin/vp dev`
+
+```
+Local upstream Vite CLI entry
+
+  VITE <version>  ready in <duration>
+
+  ➜  Local:   http://127.0.0.1:<port>/
+  ➜  press h + enter to show help
+Upstream Vite dev served HTTP 200
+```
+
+## `node node_modules/vite-plus/bin/vp preview`
+
+```
+Local upstream Vite CLI entry
+  ➜  Local:   http://127.0.0.1:<port>/
+  ➜  press h + enter to show help
+Upstream Vite preview served HTTP 200
+```
+
+## `LOCAL_VITE=1 node node_modules/vite-plus/bin/vp test run`
+
+```
+
+ RUN  <version> <workspace>
+
+ ✓ override.test.ts (1 test) <duration>
+   ✓ uses the replacement Vite through public API exports <duration>
+
+ Test Files  1 passed (1)
+      Tests  1 passed (1)
+   Start at  <time>
+   Duration  <duration> (<timing>)
+```
+
+## `node check-core-guard.mjs local`
+
+```
+Pack and Vite commands still reject a mismatched internal core
+```
diff --git a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/tsconfig.json b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/tsconfig.json
new file mode 100644
index 0000000000..5ec6370f44
--- /dev/null
+++ b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/tsconfig.json
@@ -0,0 +1,5 @@
+{
+  "compilerOptions": {
+    "isolatedDeclarations": true
+  }
+}
diff --git a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/use-local-vite.mjs b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/use-local-vite.mjs
new file mode 100644
index 0000000000..37de75c9d8
--- /dev/null
+++ b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/use-local-vite.mjs
@@ -0,0 +1,40 @@
+import { cpSync, readFileSync, writeFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { dirname } from 'node:path';
+
+const require = createRequire(import.meta.url);
+// Reuse the installed upstream package to test a local build without a second
+// download. Change its public entries so resolution cannot pass by accident.
+cpSync(dirname(require.resolve('vite/package.json')), 'local-vite', { recursive: true });
+const pkg = JSON.parse(readFileSync('local-vite/package.json', 'utf8'));
+const entry = pkg.exports['.'];
+pkg.exports['.'] = './ecosystem-api.mjs';
+pkg.bin = { vite: './ecosystem-cli.mjs' };
+pkg.files.push('ecosystem-api.mjs', 'ecosystem-cli.mjs');
+writeFileSync('local-vite/package.json', JSON.stringify(pkg));
+writeFileSync(
+  'local-vite/ecosystem-api.mjs',
+  `export * from ${JSON.stringify(entry)};
+import { resolveConfig as upstreamResolveConfig } from ${JSON.stringify(entry)};
+export const ecosystemCiMarker = 'local-vite';
+export function resolveConfig(...args) {
+  if (process.env.EXPECT_INTERNAL_CONFIG === '1') {
+    throw new Error('Pack must load configuration with its internal core');
+  }
+  return upstreamResolveConfig(...args);
+}
+`,
+);
+writeFileSync(
+  'local-vite/ecosystem-cli.mjs',
+  `console.log('Local upstream Vite CLI entry');
+await import('./bin/vite.js');
+`,
+);
+const project = JSON.parse(readFileSync('package.json', 'utf8'));
+project.devDependencies.vite = 'file:./local-vite';
+writeFileSync('package.json', JSON.stringify(project));
+writeFileSync(
+  'pnpm-workspace.yaml',
+  'minimumReleaseAge: 0\noverrides:\n  vite: file:./local-vite\n',
+);
diff --git a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/vite.config.ts b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/vite.config.ts
new file mode 100644
index 0000000000..3ded359c9e
--- /dev/null
+++ b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/vite.config.ts
@@ -0,0 +1,51 @@
+import assert from 'node:assert/strict';
+import { isRunnableDevEnvironment, version } from 'vite';
+import { defineConfig, isRunnableDevEnvironment as fromVitePlus } from 'vite-plus';
+
+export default defineConfig({
+  server: { host: '127.0.0.1', port: 0 },
+  preview: { host: '127.0.0.1', port: 0 },
+  pack: { entry: ['entry.ts'], outDir: 'packed', dts: true },
+  plugins: [
+    {
+      name: 'verify-upstream-vite',
+      configResolved() {
+        assert.equal(version, '8.3.4');
+        assert.equal(isRunnableDevEnvironment, fromVitePlus);
+      },
+      configureServer(server) {
+        assert.ok(isRunnableDevEnvironment(server.environments.ssr));
+        if (server.httpServer) {
+          checkServer(server, 'dev');
+        }
+      },
+      configurePreviewServer(server) {
+        checkServer(server, 'preview');
+      },
+    },
+  ],
+});
+
+function checkServer(server, command) {
+  server.httpServer.once('listening', async () => {
+    try {
+      const address = server.httpServer.address();
+      assert.ok(address && typeof address === 'object');
+      const response = await fetch(`http://127.0.0.1:${address.port}/`, {
+        signal: AbortSignal.timeout(10_000),
+      });
+      assert.equal(response.status, 200);
+      assert.match(await response.text(), /Upstream Vite/);
+      console.log(`Upstream Vite ${command} served HTTP 200`);
+    } catch (error) {
+      console.error(error);
+      process.exitCode = 1;
+    } finally {
+      if (server.close) {
+        await server.close();
+      } else {
+        server.httpServer.close();
+      }
+    }
+  });
+}
diff --git a/docs/guide/ci.md b/docs/guide/ci.md
index 05f93d6cdc..cf7615faaa 100644
--- a/docs/guide/ci.md
+++ b/docs/guide/ci.md
@@ -104,6 +104,50 @@ The Azure Pipelines template supports Microsoft-hosted Linux, macOS, and Windows
 
 For advanced configuration and the complete parameter reference, see the [`setup-vp` Azure Pipelines documentation](https://github.com/voidzero-dev/setup-vp#azure-pipelines).
 
+## Testing Upstream Vite
+
+Ecosystem CI can replace Vite while keeping `vp pack` on the matching Vite+ core.
+Declare `vite` in the project and override **all** `vite` dependencies with the
+version under test. For example, with pnpm:
+
+```json [package.json]
+{
+  "devDependencies": {
+    "vite": "file:../vite/packages/vite",
+    "vite-plus": "<vite-plus-version>"
+  }
+}
+```
+
+```yaml [pnpm-workspace.yaml]
+overrides:
+  vite: file:../vite/packages/vite
+```
+
+Build the local Vite package before installing dependencies. A published Vite
+version can replace the `file:` value in both files.
+
+Set `VP_USE_PROJECT_VITE=1` in the CI job environment, then run the usual commands:
+
+```bash
+export VP_USE_PROJECT_VITE=1
+vp install
+vp pack
+vp build
+vp test run
+```
+
+The variable makes `vp dev`, `vp build`, and `vp preview` use the target project's
+Vite CLI. The dependency override makes `vite-plus` API exports and Vitest use
+that same Vite. Keep the override on the CLI's `vite` dependency too.
+`vp test` and `vite-plus/test` continue to use the same bundled Vitest instance.
+
+Pack and internal configuration loading use `@voidzero-dev/vite-plus-core`.
+Do not override that package; it must match the installed `vite-plus` version.
+Without `VP_USE_PROJECT_VITE=1`, Vite commands retain their normal core alias
+checks. If these commands run in a cached task, include the variable in the
+task's [`cache.env`](/config/run#cache-env).
+
 ## Automatic Version Updates
 
 Dependabot and Renovate can update exact versions in GitHub Actions workflows.
diff --git a/packages/cli/BUNDLING.md b/packages/cli/BUNDLING.md
index 872fc3875e..848ba1e32a 100644
--- a/packages/cli/BUNDLING.md
+++ b/packages/cli/BUNDLING.md
@@ -15,17 +15,24 @@ This architecture allows users to import everything from a single package (`vite
 
 ## Core Dependency Identity
 
-The CLI declares its core dependency as `vite`, using
-`workspace:@voidzero-dev/vite-plus-core@*` in the workspace and an exact npm
-alias in packed releases. Runtime imports and generated shims use `vite` and
-its subpaths. This gives the CLI and plugins the same dependency name and
-avoids separate core instances under the alias and canonical package name.
-
-`resolve-core.ts` resolves the alias from the selected CLI package and checks
-its core version. It also checks any Vite dependency declared by the command's
-target project. An incidental hoisted peer does not trigger project validation.
-These checks run before Vite or packaging commands start. Keep the canonical
-name in release metadata and alias targets to identify the published package.
+The CLI declares `@voidzero-dev/vite-plus-core` as a direct dependency for pack
+and internal configuration loading. `resolve-core.ts` checks its identity and
+exact version against the installed CLI manifest. Pack does not validate the
+project's `vite` dependency.
+
+Public Vite API exports and generated Vite shims use a separate `vite` dependency:
+`workspace:@voidzero-dev/vite-plus-core@*` in the workspace and an exact npm alias
+in packed releases. This also supplies Vitest's Vite peer. A package-manager
+override for `vite` can replace these APIs and Vitest's Vite without replacing
+the internal pack tools. Pack exports, including `pack/client`, use the direct core.
+
+By default, dev/build/preview validate both the CLI's `vite` alias and any Vite
+dependency declared by the target project. An incidental hoisted peer does not
+trigger project validation. `VP_USE_PROJECT_VITE=1` selects the target project's
+declared Vite dependency and permits upstream Vite. Its CLI entry comes from
+`package.json`'s `bin` field, including for local `file:` installations. The
+internal core still requires an exact version match, and a stale core alias
+remains an error. See [ecosystem CI setup](../../docs/guide/ci.md#testing-upstream-vite).
 
 For npm projects without overrides, pin a declared `vite` alias to the exact
 installed `vite-plus` version. npm can replace a tagged alias such as
@@ -45,7 +52,7 @@ Bundles all CLI entry points using tsdown (configured in `tsdown.config.ts`). Th
 - Public API entries: `bin`, `index`, `define-config`, `fmt`, `lint`, `pack`, `pack-bin`
 - Global command entries: `create`, `migrate`, `version`, `config`, `hooks`, `mcp`, `staged`
 - All third-party dependencies are inlined at build time
-- Only packages that must be resolved at runtime stay external (NAPI binding, `vite`, `vitest`, `oxfmt`, `oxlint`)
+- Only packages that must be resolved at runtime stay external (NAPI binding, `@voidzero-dev/vite-plus-core`, `vite`, `vitest`, `oxfmt`, `oxlint`)
 - Code splitting creates shared chunks for code used by multiple entries
 - DTS (`.d.ts`) files are generated for all entries
 
diff --git a/packages/cli/build.ts b/packages/cli/build.ts
index 54eedabbc7..8ad384a306 100644
--- a/packages/cli/build.ts
+++ b/packages/cli/build.ts
@@ -241,7 +241,7 @@ async function syncCorePackageExports(): Promise<void> {
   console.log('  Creating ./pack/client');
   await writeFile(
     join(distDir, 'pack-client.d.ts'),
-    `/// <reference types="${CORE_IMPORT_SPECIFIER}/pack/client" />\n`,
+    `/// <reference types="${CORE_PACKAGE_NAME}/pack/client" />\n`,
   );
 
   for (const subpath of ['module-runner', 'internal']) {
diff --git a/packages/cli/package.json b/packages/cli/package.json
index 185b900ed6..3fb6fedc31 100644
--- a/packages/cli/package.json
+++ b/packages/cli/package.json
@@ -356,6 +356,7 @@
     "@vitest/snapshot": "catalog:",
     "@vitest/spy": "catalog:",
     "@vitest/utils": "catalog:",
+    "@voidzero-dev/vite-plus-core": "workspace:*",
     "oxfmt": "catalog:",
     "oxlint": "catalog:",
     "oxlint-tsgolint": "catalog:",
diff --git a/packages/cli/src/__tests__/exports-map.spec.ts b/packages/cli/src/__tests__/exports-map.spec.ts
index 3f4669019a..d77349313e 100644
--- a/packages/cli/src/__tests__/exports-map.spec.ts
+++ b/packages/cli/src/__tests__/exports-map.spec.ts
@@ -117,6 +117,7 @@ alias({ contextOptions: { reducedMotion: 'bogus' } });
   it('provides the bundled Vitest Vite peer without relying on project dependencies', () => {
     const pkg = JSON.parse(fs.readFileSync(cliPkgJsonPath, 'utf8'));
     expect(pkg.dependencies.vite).toBe('workspace:@voidzero-dev/vite-plus-core@*');
+    expect(pkg.dependencies['@voidzero-dev/vite-plus-core']).toBe('workspace:*');
     expect(pkg.devDependencies.vite).toBeUndefined();
   });
 
diff --git a/packages/cli/src/__tests__/resolve-core.spec.ts b/packages/cli/src/__tests__/resolve-core.spec.ts
index 8e533913dd..4355f767f9 100644
--- a/packages/cli/src/__tests__/resolve-core.spec.ts
+++ b/packages/cli/src/__tests__/resolve-core.spec.ts
@@ -6,7 +6,7 @@ import { join } from 'node:path';
 import { afterEach, beforeEach, describe, expect, it } from 'vitest';
 
 import cliPkg from '../../package.json' with { type: 'json' };
-import { resolveCore } from '../resolve-core.ts';
+import { resolveCore, resolveVitePackage } from '../resolve-core.ts';
 
 function writePackageJson(directory: string, manifest: Record<string, unknown>): void {
   mkdirSync(directory, { recursive: true });
@@ -35,12 +35,13 @@ function writeCli(directory: string, version = cliPkg.version): void {
   });
 }
 
-describe('resolveCore', () => {
+describe('core and Vite resolution', () => {
   let root: string;
   let project: string;
   let cliModule: string;
   let bundled: string;
   let projectCore: string;
+  let cliVite: string;
 
   beforeEach(() => {
     root = realpathSync(mkdtempSync(join(tmpdir(), 'vp-core-resolver-')));
@@ -49,10 +50,13 @@ describe('resolveCore', () => {
       devDependencies: { vite: `npm:@voidzero-dev/vite-plus-core@${cliPkg.version}` },
     });
     cliModule = join(root, 'cli', 'dist', 'bin.js');
-    bundled = join(root, 'cli', 'node_modules', 'vite');
+    bundled = join(root, 'cli', 'node_modules', '@voidzero-dev/vite-plus-core');
+    cliVite = join(root, 'cli', 'node_modules', 'vite');
     projectCore = join(project, 'node_modules', 'vite');
     writeCli(join(root, 'cli'));
     writeCore(bundled);
+    writeCore(cliVite);
+    writeCore(projectCore);
   });
 
   afterEach(() => {
@@ -61,15 +65,16 @@ describe('resolveCore', () => {
 
   it('supports a CLI installation without a project-level vite alias', () => {
     writePackageJson(project, { devDependencies: { 'vite-plus': cliPkg.version } });
-    expect(resolveCore('', project, cliModule)).toBe(join(bundled, 'index.js'));
-    expect(resolveCore('/pack', project, cliModule)).toBe(join(bundled, 'pack.js'));
+    rmSync(projectCore, { recursive: true });
+    expect(resolveVitePackage(project, cliModule, false)).toBe(join(cliVite, 'package.json'));
+    expect(resolveCore('/pack', cliModule)).toBe(join(bundled, 'pack.js'));
   });
 
   it('ignores an upstream Vite peer hoisted by npm in a CLI-only project', () => {
     writePackageJson(project, { devDependencies: { 'vite-plus': cliPkg.version } });
     writeCore(projectCore, 'vite', '8.2.2');
-    expect(resolveCore('', project, cliModule)).toBe(join(bundled, 'index.js'));
-    expect(resolveCore('/pack', project, cliModule)).toBe(join(bundled, 'pack.js'));
+    expect(resolveVitePackage(project, cliModule, false)).toBe(join(cliVite, 'package.json'));
+    expect(resolveCore('/pack', cliModule)).toBe(join(bundled, 'pack.js'));
   });
 
   it.each(['dependencies', 'devDependencies', 'optionalDependencies', 'peerDependencies'])(
@@ -79,13 +84,13 @@ describe('resolveCore', () => {
       writeCore(projectCore, 'vite', '8.2.2');
       const subdirectory = join(project, 'src');
       mkdirSync(subdirectory);
-      expect(() => resolveCore('', subdirectory, cliModule)).toThrow('found vite@8.2.2');
+      expect(() => resolveVitePackage(subdirectory, cliModule, false)).toThrow('found vite@8.2.2');
     },
   );
 
   it('keeps the same anchor as static exports when the project has a matching copy', () => {
     writeCore(projectCore);
-    expect(resolveCore('', project, cliModule)).toBe(join(bundled, 'index.js'));
+    expect(resolveVitePackage(project, cliModule, false)).toBe(join(cliVite, 'package.json'));
   });
 
   it.each(['0.0.0', '0.0.0-commit.1234567'])(
@@ -93,19 +98,21 @@ describe('resolveCore', () => {
     (version) => {
       writeCli(join(root, 'cli'), version);
       writeCore(bundled, '@voidzero-dev/vite-plus-core', version);
+      writeCore(cliVite, '@voidzero-dev/vite-plus-core', version);
       writeCore(projectCore, '@voidzero-dev/vite-plus-core', version);
-      expect(resolveCore('', project, cliModule)).toBe(join(bundled, 'index.js'));
-      expect(resolveCore('/pack', project, cliModule)).toBe(join(bundled, 'pack.js'));
+      expect(resolveVitePackage(project, cliModule, false)).toBe(join(cliVite, 'package.json'));
+      expect(resolveCore('/pack', cliModule)).toBe(join(bundled, 'pack.js'));
     },
   );
 
-  it.each(['project', 'bundled'])(
+  it.each(['project', 'bundled', 'cli alias'])(
     'still rejects a mismatched %s core after repacking the CLI',
     (location) => {
       writeCli(join(root, 'cli'), '0.0.0');
       writeCore(bundled, '@voidzero-dev/vite-plus-core', '0.0.0');
-      writeCore(location === 'project' ? projectCore : bundled);
-      expect(() => resolveCore('', project, cliModule)).toThrow(
+      writeCore(cliVite, '@voidzero-dev/vite-plus-core', '0.0.0');
+      writeCore(location === 'project' ? projectCore : location === 'bundled' ? bundled : cliVite);
+      expect(() => resolveVitePackage(project, cliModule, false)).toThrow(
         `Expected @voidzero-dev/vite-plus-core@0.0.0, but found @voidzero-dev/vite-plus-core@${cliPkg.version}`,
       );
     },
@@ -123,31 +130,101 @@ describe('resolveCore', () => {
       `import { strict as assert } from 'node:assert';
        import { resolveCore } from ${JSON.stringify(new URL('../resolve-core.ts', import.meta.url).href)};
        assert.throws(
-         () => resolveCore('', ${JSON.stringify(project)}, ${JSON.stringify(cliModule)}),
+         () => resolveCore('', ${JSON.stringify(cliModule)}),
          /Could not resolve the bundled Vite/,
        );`,
     ]);
   });
 
-  it.each(['project', 'bundled'])('rejects upstream Vite in the %s dependency', (location) => {
-    writeCore(location === 'project' ? projectCore : bundled, 'vite', '8.2.2');
-    expect(() => resolveCore('', project, cliModule)).toThrow('found vite@8.2.2');
+  it.each(['project', 'bundled', 'cli alias'])(
+    'rejects upstream Vite in the %s dependency',
+    (location) => {
+      writeCore(
+        location === 'project' ? projectCore : location === 'bundled' ? bundled : cliVite,
+        'vite',
+        '8.2.2',
+      );
+      expect(() => resolveVitePackage(project, cliModule, false)).toThrow('found vite@8.2.2');
+    },
+  );
+
+  it.each(['project', 'bundled', 'cli alias'])(
+    'rejects a stale core in the %s dependency',
+    (location) => {
+      writeCore(
+        location === 'project' ? projectCore : location === 'bundled' ? bundled : cliVite,
+        '@voidzero-dev/vite-plus-core',
+        '0.0.0-stale',
+      );
+      expect(() => resolveVitePackage(project, cliModule, false)).toThrow(
+        'found @voidzero-dev/vite-plus-core@0.0.0-stale',
+      );
+    },
+  );
+
+  it.each(['vite', '@voidzero-dev/vite-plus-core'])(
+    'pack ignores a project override to %s',
+    (name) => {
+      writeCore(projectCore, name, '0.0.0-override');
+      writeCore(cliVite, 'vite', '8.3.4');
+      expect(resolveCore('/pack', cliModule)).toBe(join(bundled, 'pack.js'));
+    },
+  );
+
+  it('selects upstream Vite only with the explicit opt-in', () => {
+    writeCore(projectCore, 'vite', '8.3.4');
+    writeCore(cliVite, 'vite', '8.3.4');
+    expect(() => resolveVitePackage(project, cliModule, false)).toThrow('found vite@8.3.4');
+    expect(resolveVitePackage(project, cliModule, true)).toBe(join(projectCore, 'package.json'));
   });
 
-  it.each(['project', 'bundled'])('rejects a stale core in the %s dependency', (location) => {
-    writeCore(
-      location === 'project' ? projectCore : bundled,
-      '@voidzero-dev/vite-plus-core',
-      '0.0.0-stale',
+  it('still checks the internal core with the opt-in', () => {
+    writeCore(projectCore, 'vite', '8.3.4');
+    writeCore(bundled, '@voidzero-dev/vite-plus-core', '0.0.0-stale');
+    expect(() => resolveVitePackage(project, cliModule, true)).toThrow(
+      'found @voidzero-dev/vite-plus-core@0.0.0-stale',
     );
-    expect(() => resolveCore('', project, cliModule)).toThrow(
+    expect(() => resolveCore('/pack', cliModule)).toThrow(
       'found @voidzero-dev/vite-plus-core@0.0.0-stale',
     );
   });
 
+  it.each(['other-package', '@voidzero-dev/vite-plus-core'])(
+    'does not bypass checks for %s with the opt-in',
+    (name) => {
+      writeCore(projectCore, name, '0.0.0-stale');
+      expect(() => resolveVitePackage(project, cliModule, true)).toThrow(
+        `found ${name}@0.0.0-stale`,
+      );
+    },
+  );
+
+  it('does not use a hoisted Vite peer with the opt-in', () => {
+    writePackageJson(project, { devDependencies: { 'vite-plus': cliPkg.version } });
+    writeCore(projectCore, 'vite', '8.3.4');
+    expect(() => resolveVitePackage(project, cliModule, true)).toThrow(
+      'requires a declared project Vite dependency',
+    );
+  });
+
+  it('does not fall back to bundled Vite when the opted-in project dependency is missing', () => {
+    rmSync(projectCore, { recursive: true });
+    execFileSync(process.execPath, [
+      '--no-global-search-paths',
+      '--input-type=module',
+      '--eval',
+      `import { strict as assert } from 'node:assert';
+       import { resolveVitePackage } from ${JSON.stringify(new URL('../resolve-core.ts', import.meta.url).href)};
+       assert.throws(
+         () => resolveVitePackage(${JSON.stringify(project)}, ${JSON.stringify(cliModule)}, true),
+         /Could not resolve the project Vite/,
+       );`,
+    ]);
+  });
+
   it('reports a missing core subpath instead of selecting a project copy', () => {
     writeCore(projectCore);
     rmSync(join(bundled, 'pack.js'));
-    expect(() => resolveCore('/pack', project, cliModule)).toThrow();
+    expect(() => resolveCore('/pack', cliModule)).toThrow();
   });
 });
diff --git a/packages/cli/src/__tests__/resolve-vite.spec.ts b/packages/cli/src/__tests__/resolve-vite.spec.ts
index 78a99efe54..5d3c650ff0 100644
--- a/packages/cli/src/__tests__/resolve-vite.spec.ts
+++ b/packages/cli/src/__tests__/resolve-vite.spec.ts
@@ -1,8 +1,33 @@
-import { resolve } from 'node:path';
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
 
 import { describe, expect, it } from 'vitest';
 
-import { resolveViteRoot } from '../resolve-vite.ts';
+import { resolveViteBin, resolveViteRoot } from '../resolve-vite.ts';
+
+describe('resolveViteBin', () => {
+  it.each([
+    { name: 'vite', bin: { vite: './custom/cli.js' }, entry: 'custom/cli.js' },
+    { name: 'vite', bin: './custom/cli.js', entry: 'custom/cli.js' },
+    { name: '@voidzero-dev/vite-plus-core', entry: 'dist/vite/bin/vite.js' },
+  ])('resolves the CLI for $name with $entry', ({ name, bin, entry }) => {
+    const root = mkdtempSync(join(tmpdir(), 'vp-vite-bin-'));
+    try {
+      const manifest = join(root, 'package.json');
+      writeFileSync(manifest, JSON.stringify({ name, bin }));
+      mkdirSync(join(root, entry, '..'), { recursive: true });
+      writeFileSync(join(root, entry), '');
+      expect(resolveViteBin(manifest)).toBe(join(root, entry));
+      rmSync(join(root, entry));
+      expect(() => resolveViteBin(manifest)).toThrow('Could not find the Vite CLI');
+      writeFileSync(manifest, JSON.stringify({ name: 'vite' }));
+      expect(() => resolveViteBin(manifest)).toThrow("Could not find 'vite' bin entry");
+    } finally {
+      rmSync(root, { recursive: true, force: true });
+    }
+  });
+});
 
 describe('resolveViteRoot', () => {
   const cwd = resolve('workspace');
diff --git a/packages/cli/src/migration/migrator/tsup.ts b/packages/cli/src/migration/migrator/tsup.ts
index 7eff1306e4..54c09d9bdb 100644
--- a/packages/cli/src/migration/migrator/tsup.ts
+++ b/packages/cli/src/migration/migrator/tsup.ts
@@ -2,8 +2,8 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { styleText } from 'node:util';
 
+import corePkg from '@voidzero-dev/vite-plus-core/package.json' with { type: 'json' };
 import * as prompts from '@voidzero-dev/vite-plus-prompts';
-import corePkg from 'vite/package.json' with { type: 'json' };
 
 import { PackageManager, type WorkspacePackage } from '../../types/index.ts';
 import { runCommandSilently } from '../../utils/command.ts';
diff --git a/packages/cli/src/pack-bin.ts b/packages/cli/src/pack-bin.ts
index f788d44bf2..dc68ab684a 100644
--- a/packages/cli/src/pack-bin.ts
+++ b/packages/cli/src/pack-bin.ts
@@ -2,7 +2,6 @@
 import module from 'node:module';
 import path from 'node:path';
 
-import { cac } from 'cac';
 import {
   buildWithConfigs,
   resolveUserConfig,
@@ -11,7 +10,8 @@ import {
   type InlineConfig,
   type ResolvedConfig,
   type TsdownHandle,
-} from 'vite/pack';
+} from '@voidzero-dev/vite-plus-core/pack';
+import { cac } from 'cac';
 
 import { resolveViteConfig } from './resolve-vite-config.ts';
 
diff --git a/packages/cli/src/pack.ts b/packages/cli/src/pack.ts
index 4b7f96e0ca..94a2304ee7 100644
--- a/packages/cli/src/pack.ts
+++ b/packages/cli/src/pack.ts
@@ -1,6 +1,6 @@
-import type { UserConfig as TsdownUserConfig } from 'vite/pack';
+import type { UserConfig as TsdownUserConfig } from '@voidzero-dev/vite-plus-core/pack';
 
-export * from 'vite/pack';
+export * from '@voidzero-dev/vite-plus-core/pack';
 
 export interface PackUserConfig extends TsdownUserConfig {
   /**
diff --git a/packages/cli/src/resolve-core.ts b/packages/cli/src/resolve-core.ts
index c1b9886445..edbab7e4fc 100644
--- a/packages/cli/src/resolve-core.ts
+++ b/packages/cli/src/resolve-core.ts
@@ -19,11 +19,12 @@ function checkCoreVersion(packageJsonPath: string, expectedVersion: string): voi
   }
 }
 
-function checkProjectCoreVersion(
+function resolveProjectVitePackage(
   cwd: string,
   corePackageJsonPath: string,
   expectedVersion: string,
-): void {
+  allowUpstream: boolean,
+): string | undefined {
   // npm can hoist an upstream Vite peer even when the project only declares
   // vite-plus. Validate Vite only when the nearest package declares it.
   const projectPackage = readNearestPackageJson(cwd);
@@ -34,7 +35,10 @@ function checkProjectCoreVersion(
     'peerDependencies',
   ].some((field) => Object.hasOwn(projectPackage?.[field] ?? {}, 'vite'));
   if (!declaresVite) {
-    return;
+    if (allowUpstream) {
+      throw new Error('VP_USE_PROJECT_VITE=1 requires a declared project Vite dependency.');
+    }
+    return undefined;
   }
 
   const projectRequire = createRequire(join(cwd, 'package.json'));
@@ -46,17 +50,19 @@ function checkProjectCoreVersion(
       throw cause;
     }
   }
-  if (projectPackageJsonPath && projectPackageJsonPath !== corePackageJsonPath) {
-    checkCoreVersion(projectPackageJsonPath, expectedVersion);
+  if (projectPackageJsonPath) {
+    const pkg = JSON.parse(readFileSync(projectPackageJsonPath, 'utf8')) as { name?: string };
+    if (projectPackageJsonPath !== corePackageJsonPath && !(allowUpstream && pkg.name === 'vite')) {
+      checkCoreVersion(projectPackageJsonPath, expectedVersion);
+    }
+  } else if (allowUpstream) {
+    throw new Error('Could not resolve the project Vite dependency. Run `vp install`.');
   }
+  return projectPackageJsonPath;
 }
 
-/** Resolve the same core dependency as the CLI's static `vite` re-exports. */
-export function resolveCore(
-  subpath = '',
-  cwd = process.cwd(),
-  modulePath = import.meta.url,
-): string {
+/** Resolve and validate the internal core independently of Vite overrides. */
+export function resolveCore(subpath = '', modulePath = import.meta.url): string {
   const cliRequire = createRequire(modulePath);
   // Read the selected CLI's installed manifest. A static JSON import is inlined
   // during the build, before CI and preview packers can stamp a new version.
@@ -65,12 +71,36 @@ export function resolveCore(
   ) as { version: string };
   let corePackageJsonPath: string;
   try {
-    corePackageJsonPath = cliRequire.resolve('vite/package.json');
+    corePackageJsonPath = cliRequire.resolve(`${CORE_PACKAGE_NAME}/package.json`);
   } catch (cause) {
     throw new Error('Could not resolve the bundled Vite dependency. Run `vp install`.', { cause });
   }
   checkCoreVersion(corePackageJsonPath, expectedVersion);
-  checkProjectCoreVersion(cwd, corePackageJsonPath, expectedVersion);
 
-  return cliRequire.resolve(`vite${subpath}`);
+  return cliRequire.resolve(`${CORE_PACKAGE_NAME}${subpath}`);
+}
+
+/** Resolve the Vite used for dev/build/preview, preserving normal alias checks. */
+export function resolveVitePackage(
+  cwd: string,
+  modulePath = import.meta.url,
+  useProjectVite = process.env.VP_USE_PROJECT_VITE === '1',
+): string {
+  const corePackageJsonPath = resolveCore('/package.json', modulePath);
+  const { version } = JSON.parse(readFileSync(corePackageJsonPath, 'utf8')) as { version: string };
+  const projectPackageJsonPath = resolveProjectVitePackage(
+    cwd,
+    corePackageJsonPath,
+    version,
+    useProjectVite,
+  );
+  if (useProjectVite) {
+    return projectPackageJsonPath!;
+  }
+
+  // Public API re-exports still use `vite`. Validate that dependency as well,
+  // so normal commands cannot silently run a different Vite than API imports.
+  const vitePackageJsonPath = createRequire(modulePath).resolve('vite/package.json');
+  checkCoreVersion(vitePackageJsonPath, version);
+  return vitePackageJsonPath;
 }
diff --git a/packages/cli/src/resolve-pack.ts b/packages/cli/src/resolve-pack.ts
index c6ab2c7fd8..37ff79878d 100644
--- a/packages/cli/src/resolve-pack.ts
+++ b/packages/cli/src/resolve-pack.ts
@@ -1,18 +1,15 @@
 import { join } from 'node:path';
 
-import type { JsCommandContext, JsCommandResolvedResult } from '../binding/index.js';
+import type { JsCommandResolvedResult } from '../binding/index.js';
 import { resolveCore } from './resolve-core.ts';
 import { DEFAULT_ENVS } from './utils/constants.ts';
 
-/** Validate the target project's core alias before starting the bundled pack entry. */
-export async function pack(
-  err: Error | null,
-  { cwd }: JsCommandContext,
-): Promise<JsCommandResolvedResult> {
+/** Validate the internal core before starting the bundled pack entry. */
+export async function pack(err: Error | null): Promise<JsCommandResolvedResult> {
   if (err) {
     throw err;
   }
-  resolveCore('/pack', cwd);
+  resolveCore('/pack');
   return {
     binPath: join(import.meta.dirname, 'pack-bin.js'),
     envs: { ...DEFAULT_ENVS },
diff --git a/packages/cli/src/resolve-vite-config.ts b/packages/cli/src/resolve-vite-config.ts
index 4e3b177e91..66e6573b7d 100644
--- a/packages/cli/src/resolve-vite-config.ts
+++ b/packages/cli/src/resolve-vite-config.ts
@@ -56,7 +56,7 @@ export interface ResolveViteConfigOptions {
  * Resolve vite.config.ts and return the config object.
  */
 export async function resolveViteConfig(cwd: string, options?: ResolveViteConfigOptions) {
-  const { resolveConfig } = await import('./index.js');
+  const { resolveConfig } = await import('@voidzero-dev/vite-plus-core');
 
   // This loads the config purely to read a non-plugin block (lint/fmt/pack/run/
   // staged/create…), so skip the user's plugin factory while it evaluates.
diff --git a/packages/cli/src/resolve-vite.ts b/packages/cli/src/resolve-vite.ts
index 40d9308364..2c84690d1a 100644
--- a/packages/cli/src/resolve-vite.ts
+++ b/packages/cli/src/resolve-vite.ts
@@ -1,10 +1,10 @@
-import { existsSync } from 'node:fs';
-import { dirname, join, resolve } from 'node:path';
+import { existsSync, readFileSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
 
 import { cac } from 'cac';
 
 import type { JsCommandContext, JsCommandResolvedResult } from '../binding/index.js';
-import { resolveCore } from './resolve-core.ts';
+import { resolveVitePackage } from './resolve-core.ts';
 import { DEFAULT_ENVS } from './utils/constants.ts';
 
 export function resolveViteRoot({ cwd, args }: JsCommandContext): string {
@@ -30,7 +30,29 @@ export function resolveViteRoot({ cwd, args }: JsCommandContext): string {
   return resolve(cwd, parsed.args[0] ?? '.');
 }
 
-/** Resolve the bundled CLI for dev, build, and preview from the selected project root. */
+/** Use the core's bundled entry or upstream Vite's public bin entry. */
+export function resolveViteBin(packageJsonPath: string): string {
+  const pkg = JSON.parse(readFileSync(packageJsonPath, 'utf8')) as {
+    name?: string;
+    bin?: string | { vite?: string };
+  };
+  const bin =
+    pkg.name === '@voidzero-dev/vite-plus-core'
+      ? 'dist/vite/bin/vite.js'
+      : typeof pkg.bin === 'string'
+        ? pkg.bin
+        : pkg.bin?.vite;
+  if (!bin) {
+    throw new Error(`Could not find 'vite' bin entry in ${packageJsonPath}`);
+  }
+  const binPath = resolve(dirname(packageJsonPath), bin);
+  if (!existsSync(binPath)) {
+    throw new Error(`Could not find the Vite CLI at ${binPath}. Run \`vp install\`.`);
+  }
+  return binPath;
+}
+
+/** Resolve the CLI for dev, build, and preview from the selected project root. */
 export async function vite(
   err: Error | null,
   context: JsCommandContext,
@@ -38,12 +60,7 @@ export async function vite(
   if (err) {
     throw err;
   }
-  // Start through Vite's bin script, as `vite` does; see packages/core/BUNDLING.md.
-  const viteDistDir = dirname(dirname(resolveCore('', resolveViteRoot(context))));
-  const binPath = join(viteDistDir, 'bin', 'vite.js');
-  if (!existsSync(binPath)) {
-    throw new Error(`Could not find the bundled Vite CLI at ${binPath}. Run \`vp install\`.`);
-  }
+  const binPath = resolveViteBin(resolveVitePackage(resolveViteRoot(context)));
 
   const envs: Record<string, string> = { ...DEFAULT_ENVS };
   if (process.env.DEBUG_DISABLE_SOURCE_MAP) {
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index d182bfb605..2c63eea21a 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -517,6 +517,9 @@ importers:
       '@vitest/utils':
         specifier: 'catalog:'
         version: 5.0.5
+      '@voidzero-dev/vite-plus-core':
+        specifier: workspace:*
+        version: link:../core
       oxfmt:
         specifier: 'catalog:'
         version: 0.74.0(vite-plus@packages+cli)

From 8b121b29a1f11436b3d4c3967747ccc2a41e0199 Mon Sep 17 00:00:00 2001
From: MK <fengmk2@gmail.com>
Date: Tue, 20 Oct 2026 22:35:22 +0800
Subject: [PATCH 2/3] test(cli): disable WebSocket listener in Vite override
 fixture

---
 .../fixtures/upstream_vite_override/override.test.ts         | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/override.test.ts b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/override.test.ts
index 9231c4e6f9..d1c4875970 100644
--- a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/override.test.ts
+++ b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/override.test.ts
@@ -8,7 +8,10 @@ test('uses the replacement Vite through public API exports', async () => {
   if (process.env.LOCAL_VITE === '1') {
     expect(vp.ecosystemCiMarker).toBe('local-vite');
   }
-  const server = await vp.createServer({ configFile: false, server: { middlewareMode: true } });
+  const server = await vp.createServer({
+    configFile: false,
+    server: { middlewareMode: true, ws: false },
+  });
   try {
     expect(vite.isRunnableDevEnvironment(server.environments.ssr)).toBe(true);
   } finally {

From 45c3c5e7b8c9f36fb0789089b1c6999c98030a73 Mon Sep 17 00:00:00 2001
From: MK <fengmk2@gmail.com>
Date: Tue, 20 Oct 2026 23:22:00 +0800
Subject: [PATCH 3/3] refactor(cli): bundle pack independently of the Vite
 alias

---
 .../verify-extensions.mjs                     |   5 +-
 .../snapshots/toolchain_full_global.md        |   4 +
 .../snapshots/toolchain_full_local.md         |   4 +
 .../snapshots/toolchain_old_local_routing.md  |   8 ++
 .../core_module_identity/check-api.mjs        |   2 +-
 .../core_module_identity/check-bundled.mjs    |   2 +-
 .../check-tagged-alias.mjs                    |  27 +++--
 .../core_module_identity/snapshots.toml       |   2 +-
 ... core_module_identity_npm_tagged_alias.md} |   6 +-
 .../core_module_identity/stamp-version.mjs    |   2 -
 .../upstream_vite_override/check-api.mjs      |  22 +++-
 .../check-core-guard.mjs                      |  29 -----
 .../check-vite-identity-guard.mjs             |  73 ++++++++++++
 .../fixtures/upstream_vite_override/entry.ts  |   4 +-
 .../upstream_vite_override/override.test.ts   |   1 +
 .../upstream_vite_override/snapshots.toml     |  16 ++-
 .../upstream_vite_override.global.md          |  50 +++++---
 .../snapshots/upstream_vite_override.local.md |  50 +++++---
 .../fixtures/upstream_vite_override/style.css |   1 +
 .../upstream_vite_override/use-local-vite.mjs |   4 +-
 .../upstream_vite_override/vite.config.ts     |  23 +++-
 docs/guide/ci.md                              |  16 ++-
 packages/cli/BUNDLING.md                      |  62 ++++++----
 packages/cli/build-support/bundle-pack.ts     |  95 +++++++++++++++
 packages/cli/build.ts                         |  20 +++-
 packages/cli/package.json                     |  64 +++++++++-
 .../cli/src/__tests__/exports-map.spec.ts     |  50 +++++++-
 packages/cli/src/__tests__/pack.spec.ts       |   2 +-
 .../cli/src/__tests__/resolve-core.spec.ts    | 111 ++++++++----------
 .../cli/src/migration/__tests__/tsup.spec.ts  |   4 +-
 packages/cli/src/migration/migrator/tsup.ts   |   4 +-
 packages/cli/src/pack-bin.ts                  |   2 +-
 packages/cli/src/pack.ts                      |   4 +-
 packages/cli/src/resolve-core.ts              |  57 ++++-----
 packages/cli/src/resolve-pack.ts              |   4 +-
 packages/cli/src/resolve-vite-config.ts       |   2 +-
 packages/cli/toolchain.config.json            |  10 ++
 packages/cli/tsdown.config.ts                 |   5 +-
 pnpm-lock.yaml                                |  49 +++++++-
 rfcs/vite-core-module-identity.md             |  45 ++++++-
 40 files changed, 692 insertions(+), 249 deletions(-)
 rename crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_module_identity/snapshots/{core_module_identity_npm_tagged_alias_rejected.md => core_module_identity_npm_tagged_alias.md} (62%)
 delete mode 100644 crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/check-core-guard.mjs
 create mode 100644 crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/check-vite-identity-guard.mjs
 create mode 100644 crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/style.css
 create mode 100644 packages/cli/build-support/bundle-pack.ts

diff --git a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/command_pack_tsdown_extensions/verify-extensions.mjs b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/command_pack_tsdown_extensions/verify-extensions.mjs
index 93dbe6cdb1..18a073926f 100644
--- a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/command_pack_tsdown_extensions/verify-extensions.mjs
+++ b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/command_pack_tsdown_extensions/verify-extensions.mjs
@@ -4,7 +4,7 @@
 // bundled tsdown loaded them as external top-level packages, so `vp pack --exe`
 // (and CSS bundling) failed with `Failed to import module "@tsdown/exe"`.
 //
-// They are now bundled into core, so this loads the bundled extension chunks
+// They now ship in the CLI's private pack runtime, so this loads the bundled extension chunks
 // directly to prove they resolve `tsdown/internal` against the bundled tsdown.
 // `vp pack --exe` itself needs Node >= 25.7 (SEA), so it cannot run end-to-end
 // in CI; this check is Node-version independent.
@@ -13,7 +13,8 @@ import path from 'node:path';
 import { pathToFileURL } from 'node:url';
 
 const require = createRequire(import.meta.url);
-const packEntry = require.resolve('@voidzero-dev/vite-plus-core/pack');
+const cliRequire = createRequire(require.resolve('vite-plus/package.json'));
+const packEntry = cliRequire.resolve('#pack');
 const tsdownDir = path.dirname(packEntry);
 
 for (const chunk of ['tsdown-exe.js', 'tsdown-css.js']) {
diff --git a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/command_toolchain/snapshots/toolchain_full_global.md b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/command_toolchain/snapshots/toolchain_full_global.md
index 209b74891e..072392f6ad 100644
--- a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/command_toolchain/snapshots/toolchain_full_global.md
+++ b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/command_toolchain/snapshots/toolchain_full_global.md
@@ -8,6 +8,10 @@ The global flag reads the manifest paired with the global binary.
 Vite+ toolchain (global)
 
 vite-plus@<version>
+├── bundles tsdown@<version>
+├── bundles rolldown@<version>
+│   ├── compiles oxc@<version>
+│   └── compiles oxc-resolver@<version>
 ├── depends on @voidzero-dev/vite-plus-core@<version>
 │   ├── bundles vite@<version>
 │   │   └── uses rolldown@<version>
diff --git a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/command_toolchain/snapshots/toolchain_full_local.md b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/command_toolchain/snapshots/toolchain_full_local.md
index a983347b5a..b5b2a533c9 100644
--- a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/command_toolchain/snapshots/toolchain_full_local.md
+++ b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/command_toolchain/snapshots/toolchain_full_local.md
@@ -8,6 +8,10 @@ The local CLI reads the manifest shipped in its vite-plus package.
 Vite+ toolchain (local)
 
 vite-plus@<version>
+├── bundles tsdown@<version>
+├── bundles rolldown@<version>
+│   ├── compiles oxc@<version>
+│   └── compiles oxc-resolver@<version>
 ├── depends on @voidzero-dev/vite-plus-core@<version>
 │   ├── bundles vite@<version>
 │   │   └── uses rolldown@<version>
diff --git a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/command_toolchain/snapshots/toolchain_old_local_routing.md b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/command_toolchain/snapshots/toolchain_old_local_routing.md
index b98a86b6cb..9ca44f0877 100644
--- a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/command_toolchain/snapshots/toolchain_old_local_routing.md
+++ b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/command_toolchain/snapshots/toolchain_old_local_routing.md
@@ -37,6 +37,10 @@ a package without a runnable local CLI uses the global toolchain
 Vite+ toolchain (global)
 
 vite-plus@<version>
+├── bundles tsdown@<version>
+├── bundles rolldown@<version>
+│   ├── compiles oxc@<version>
+│   └── compiles oxc-resolver@<version>
 ├── depends on @voidzero-dev/vite-plus-core@<version>
 │   ├── bundles vite@<version>
 │   │   └── uses rolldown@<version>
@@ -74,6 +78,10 @@ Run `vp toolchain vite` to show these versions and relationships.
 Vite+ toolchain (global)
 
 vite-plus@<version>
+├── bundles tsdown@<version>
+├── bundles rolldown@<version>
+│   ├── compiles oxc@<version>
+│   └── compiles oxc-resolver@<version>
 ├── depends on @voidzero-dev/vite-plus-core@<version>
 │   ├── bundles vite@<version>
 │   │   └── uses rolldown@<version>
diff --git a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_module_identity/check-api.mjs b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_module_identity/check-api.mjs
index d4fb8b2eb8..573b1212d6 100644
--- a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_module_identity/check-api.mjs
+++ b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_module_identity/check-api.mjs
@@ -25,5 +25,5 @@ assert.equal(ModuleRunner, VpModuleRunner);
 const config = {};
 assert.equal(vite.defineConfig(config), config);
 assert.equal(pkg.dependencies.vite, `npm:@voidzero-dev/vite-plus-core@${pkg.version}`);
-assert.equal(pkg.dependencies['@voidzero-dev/vite-plus-core'], pkg.version);
+assert.equal(pkg.dependencies['@voidzero-dev/vite-plus-core'], undefined);
 console.log('Packed alias, ESM, CommonJS, and module-runner identity passed');
diff --git a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_module_identity/check-bundled.mjs b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_module_identity/check-bundled.mjs
index c15bfcf451..eb9bae87c8 100644
--- a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_module_identity/check-bundled.mjs
+++ b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_module_identity/check-bundled.mjs
@@ -7,6 +7,6 @@ import { build } from 'vite-plus/pack';
 const require = createRequire(import.meta.url);
 const cliRequire = createRequire(require.resolve('vite-plus/package.json'));
 assert.equal(createServer, cliRequire('vite').createServer);
-assert.equal(build, cliRequire('@voidzero-dev/vite-plus-core/pack').build);
+assert.equal(build, cliRequire('#pack').build);
 assert.equal(require('./package.json').devDependencies.vite, undefined);
 console.log('Bundled APIs resolve without a project Vite dependency');
diff --git a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_module_identity/check-tagged-alias.mjs b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_module_identity/check-tagged-alias.mjs
index 9ee36f9532..a94187ed8d 100644
--- a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_module_identity/check-tagged-alias.mjs
+++ b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_module_identity/check-tagged-alias.mjs
@@ -7,21 +7,28 @@ const cliRequire = createRequire(require.resolve('vite-plus/package.json'));
 const project = require('./package.json');
 assert.equal(project.overrides, undefined);
 assert.equal(project.devDependencies.vite, 'npm:@voidzero-dev/vite-plus-core@latest');
-// npm 11.11 accepts a peer's upstream Vite as satisfying the tagged alias.
-assert.equal(require('vite/package.json').name, 'vite');
+// npm may satisfy a tagged alias with an upstream Vite peer. Check the
+// command against the installed package instead of depending on that choice.
+const projectVite = require('vite/package.json');
 assert.equal(cliRequire('vite/package.json').name, '@voidzero-dev/vite-plus-core');
-assert.notEqual(require.resolve('vite/package.json'), cliRequire.resolve('vite/package.json'));
-
 const dev = spawnSync('vp', ['dev'], { encoding: 'utf8', timeout: 30_000 });
 assert.ifError(dev.error);
 const output = dev.stdout + dev.stderr;
-assert.equal(dev.status, 1, output);
-assert.match(output, /Expected @voidzero-dev\/vite-plus-core@/);
-assert.match(output, /but found vite@/);
-assert.match(output, /Run `vp migrate` to align the Vite alias, then run `vp install`\./);
-console.log('vp dev rejects the replaced npm alias and reports the repair command');
+if (projectVite.name === 'vite') {
+  assert.notEqual(require.resolve('vite/package.json'), cliRequire.resolve('vite/package.json'));
+  assert.equal(dev.status, 1, output);
+  assert.match(output, /Expected @voidzero-dev\/vite-plus-core@/);
+  assert.match(output, /but found vite@/);
+  assert.match(output, /Run `vp migrate` to align the Vite alias, then run `vp install`\./);
+} else {
+  assert.equal(projectVite.name, '@voidzero-dev/vite-plus-core');
+  assert.equal(projectVite.version, cliRequire('vite-plus/package.json').version);
+  assert.equal(dev.status, 0, output);
+  assert.match(output, /SSR environment identity and HTTP response passed/);
+}
+console.log('vp dev validates the installed package behind the tagged npm alias');
 
 const pack = spawnSync('vp', ['pack', 'entry.js'], { encoding: 'utf8', timeout: 30_000 });
 assert.ifError(pack.error);
 assert.equal(pack.status, 0, pack.stdout + pack.stderr);
-console.log('vp pack uses its internal core despite the replaced npm alias');
+console.log('vp pack uses its private runtime with the tagged npm alias');
diff --git a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_module_identity/snapshots.toml b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_module_identity/snapshots.toml
index 5422adfbb5..c497b7b185 100644
--- a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_module_identity/snapshots.toml
+++ b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_module_identity/snapshots.toml
@@ -154,7 +154,7 @@ steps = [
 ]
 
 [[case]]
-name = "core_module_identity_npm_tagged_alias_rejected"
+name = "core_module_identity_npm_tagged_alias"
 vp = "global"
 local-registry = true
 steps = [
diff --git a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_module_identity/snapshots/core_module_identity_npm_tagged_alias_rejected.md b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_module_identity/snapshots/core_module_identity_npm_tagged_alias.md
similarity index 62%
rename from crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_module_identity/snapshots/core_module_identity_npm_tagged_alias_rejected.md
rename to crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_module_identity/snapshots/core_module_identity_npm_tagged_alias.md
index 2230001883..4e8860318c 100644
--- a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_module_identity/snapshots/core_module_identity_npm_tagged_alias_rejected.md
+++ b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_module_identity/snapshots/core_module_identity_npm_tagged_alias.md
@@ -1,4 +1,4 @@
-# core_module_identity_npm_tagged_alias_rejected
+# core_module_identity_npm_tagged_alias
 
 ## `vpt write-file package.json '{"name":"core-module-identity","private":true,"type":"module","packageManager":"npm@11.11.0","devDependencies":{"vite-plus":"latest","vite":"npm:@voidzero-dev/vite-plus-core@latest"}}
 '`
@@ -10,6 +10,6 @@
 ## `node check-tagged-alias.mjs`
 
 ```
-vp dev rejects the replaced npm alias and reports the repair command
-vp pack uses its internal core despite the replaced npm alias
+vp dev validates the installed package behind the tagged npm alias
+vp pack uses its private runtime with the tagged npm alias
 ```
diff --git a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_module_identity/stamp-version.mjs b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_module_identity/stamp-version.mjs
index c4680319ea..ebc130ce31 100644
--- a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_module_identity/stamp-version.mjs
+++ b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/core_module_identity/stamp-version.mjs
@@ -8,13 +8,11 @@ for (const manifest of new Set([
   cliManifest,
   require.resolve('vite/package.json'),
   cliRequire.resolve('vite/package.json'),
-  cliRequire.resolve('@voidzero-dev/vite-plus-core/package.json'),
 ])) {
   const pkg = JSON.parse(readFileSync(manifest, 'utf8'));
   pkg.version = '0.0.0';
   if (pkg.name === 'vite-plus') {
     pkg.dependencies.vite = 'npm:@voidzero-dev/vite-plus-core@0.0.0';
-    pkg.dependencies['@voidzero-dev/vite-plus-core'] = '0.0.0';
   }
   writeFileSync(manifest, JSON.stringify(pkg));
 }
diff --git a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/check-api.mjs b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/check-api.mjs
index a7eb099de3..ee255728f9 100644
--- a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/check-api.mjs
+++ b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/check-api.mjs
@@ -1,23 +1,35 @@
 import assert from 'node:assert/strict';
 import { createRequire } from 'node:module';
+import { pathToFileURL } from 'node:url';
 import * as vite from 'vite';
+import { ModuleRunner } from 'vite/module-runner';
 import * as vp from 'vite-plus';
+import { ModuleRunner as VpModuleRunner } from 'vite-plus/module-runner';
 import { build as pack } from 'vite-plus/pack';
 
 const require = createRequire(import.meta.url);
 const cliRequire = createRequire(require.resolve('vite-plus/package.json'));
 const vitestRequire = createRequire(cliRequire.resolve('vitest/package.json'));
-const core = cliRequire('@voidzero-dev/vite-plus-core/package.json');
-assert.equal(core.version, cliRequire('vite-plus/package.json').version);
-assert.equal(pack, cliRequire('@voidzero-dev/vite-plus-core/pack').build);
+const cliPkg = cliRequire('vite-plus/package.json');
+assert.equal(cliPkg.dependencies['@voidzero-dev/vite-plus-core'], undefined);
+assert.throws(() => cliRequire.resolve('vite/pack'), { code: 'ERR_PACKAGE_PATH_NOT_EXPORTED' });
+assert.equal(pack, (await import(pathToFileURL(cliRequire.resolve('#pack')).href)).build);
 assert.equal(vite.version, '8.3.4');
-for (const name of ['createServer', 'build', 'resolveConfig', 'DevEnvironment']) {
+for (const name of [
+  'createServer',
+  'build',
+  'resolveConfig',
+  'DevEnvironment',
+  'isRunnableDevEnvironment',
+  'isFetchableDevEnvironment',
+]) {
   assert.equal(vite[name], vp[name], name);
   assert.equal(require('vite-plus')[name], vite[name], name);
 }
+assert.equal(ModuleRunner, VpModuleRunner);
 assert.equal(cliRequire.resolve('vite'), require.resolve('vite'));
 assert.equal(vitestRequire.resolve('vite'), require.resolve('vite'));
 if (process.env.LOCAL_VITE === '1') {
   assert.equal(vp.ecosystemCiMarker, 'local-vite');
 }
-console.log('API exports and bundled Vitest use upstream Vite; pack uses the matching internal core');
+console.log('API exports and bundled Vitest use upstream Vite; pack uses its private bundled runtime');
diff --git a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/check-core-guard.mjs b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/check-core-guard.mjs
deleted file mode 100644
index 7d23a9a198..0000000000
--- a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/check-core-guard.mjs
+++ /dev/null
@@ -1,29 +0,0 @@
-import assert from 'node:assert/strict';
-import { spawnSync } from 'node:child_process';
-import { readFileSync, writeFileSync } from 'node:fs';
-import { createRequire } from 'node:module';
-import { dirname, join } from 'node:path';
-
-const require = createRequire(import.meta.url);
-const cliRequire = createRequire(require.resolve('vite-plus/package.json'));
-const manifest = cliRequire.resolve('@voidzero-dev/vite-plus-core/package.json');
-const original = readFileSync(manifest, 'utf8');
-try {
-  writeFileSync(manifest, JSON.stringify({ ...JSON.parse(original), version: '0.0.0-stale' }));
-  for (const command of ['pack', 'build']) {
-    const local = process.argv[2] === 'local';
-    const args = local
-      ? [join(dirname(require.resolve('vite-plus/package.json')), 'bin/vp'), command]
-      : [command];
-    const result = spawnSync(local ? process.execPath : 'vp', args, {
-      encoding: 'utf8',
-      timeout: 30_000,
-    });
-    assert.ifError(result.error);
-    assert.equal(result.status, 1, result.stdout + result.stderr);
-    assert.match(result.stdout + result.stderr, /found @voidzero-dev\/vite-plus-core@0.0.0-stale/);
-  }
-  console.log('Pack and Vite commands still reject a mismatched internal core');
-} finally {
-  writeFileSync(manifest, original);
-}
diff --git a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/check-vite-identity-guard.mjs b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/check-vite-identity-guard.mjs
new file mode 100644
index 0000000000..bf7c0f7339
--- /dev/null
+++ b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/check-vite-identity-guard.mjs
@@ -0,0 +1,73 @@
+import assert from 'node:assert/strict';
+import { spawnSync } from 'node:child_process';
+import { cpSync, existsSync, mkdirSync, mkdtempSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { dirname, join } from 'node:path';
+
+const require = createRequire(import.meta.url);
+const cliRoot = dirname(require.resolve('vite-plus/package.json'));
+const upstream = dirname(require.resolve('vite/package.json'));
+// Also cover the default strict behavior with real upstream Vite installed.
+for (const command of ['dev', 'build', 'preview']) {
+  const local = process.argv[2] === 'local';
+  const args = local ? [join(cliRoot, 'bin/vp'), command] : [command];
+  const result = spawnSync(local ? process.execPath : 'vp', args, {
+    encoding: 'utf8', timeout: 30_000,
+    env: { ...process.env, VP_USE_PROJECT_VITE: '0' },
+  });
+  assert.ifError(result.error);
+  assert.equal(result.status, 1, result.stdout + result.stderr);
+  assert.match(result.stdout + result.stderr, /but found vite@8\.3\.4/);
+}
+console.log('Upstream Vite rejected without the opt-in before dev/build/preview');
+
+const cliModules = join(cliRoot, 'node_modules');
+const cliVite = join(cliModules, 'vite');
+const temporary = mkdtempSync(join(cliRoot, '.vite-identity-'));
+const original = join(temporary, 'original-vite');
+mkdirSync(cliModules, { recursive: true });
+const hadVite = existsSync(cliVite);
+if (hadVite) {
+  renameSync(cliVite, original);
+}
+
+function checkRejected() {
+  for (const command of ['dev', 'build', 'preview']) {
+    const local = process.argv[2] === 'local';
+    const args = local ? [join(cliRoot, 'bin/vp'), command] : [command];
+    const result = spawnSync(local ? process.execPath : 'vp', args, {
+      encoding: 'utf8',
+      timeout: 30_000,
+    });
+    assert.ifError(result.error);
+    const output = result.stdout + result.stderr;
+    assert.equal(result.status, 1, output);
+    assert.match(output, /requires the project and vite-plus to resolve the same Vite package/);
+    assert.match(output, /Apply the same override to all `vite` dependencies/);
+  }
+}
+
+try {
+  // A CLI alias left on core must fail before its runtime is loaded.
+  mkdirSync(cliVite);
+  writeFileSync(join(cliVite, 'package.json'), JSON.stringify({
+    name: '@voidzero-dev/vite-plus-core',
+    version: require('vite-plus/package.json').version,
+    exports: { './package.json': './package.json' },
+  }));
+  checkRejected();
+  console.log('Partial Vite override rejected before dev/build/preview');
+  rmSync(cliVite, { recursive: true });
+
+  // A second physical copy has the same version and exports but different
+  // constructor identities. Version checks alone must not accept it.
+  cpSync(upstream, cliVite, { recursive: true });
+  checkRejected();
+  console.log('Separate Vite copies with the same version rejected before dev/build/preview');
+} finally {
+  rmSync(cliVite, { recursive: true, force: true });
+  if (hadVite) {
+    renameSync(original, cliVite);
+  }
+  rmSync(temporary, { recursive: true, force: true });
+}
diff --git a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/entry.ts b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/entry.ts
index 74bffb3ffa..0a477f2129 100644
--- a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/entry.ts
+++ b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/entry.ts
@@ -1 +1,3 @@
-export const message: string = 'Packed with the internal core';
+import './style.css';
+
+export const message: string = 'Packed with the private runtime';
diff --git a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/override.test.ts b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/override.test.ts
index d1c4875970..aefed16058 100644
--- a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/override.test.ts
+++ b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/override.test.ts
@@ -14,6 +14,7 @@ test('uses the replacement Vite through public API exports', async () => {
   });
   try {
     expect(vite.isRunnableDevEnvironment(server.environments.ssr)).toBe(true);
+    expect(vp.isRunnableDevEnvironment(server.environments.ssr)).toBe(true);
   } finally {
     await server.close();
   }
diff --git a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/snapshots.toml b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/snapshots.toml
index 3efdc4b09f..0743a0c462 100644
--- a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/snapshots.toml
+++ b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/snapshots.toml
@@ -4,25 +4,27 @@ vp = ["global"]
 # Use pinned upstream Vite through the runner's registry to exercise its real
 # CLI, API exports, and Vitest peer layout instead of a mock Vite package.
 local-registry = true
-comment = "A global Vite override replaces CLI/API/Vitest Vite, while postinstall pack keeps its matching internal core. Repeat with a local file dependency and a different public CLI entry."
+comment = "A global Vite override replaces CLI/API/Vitest Vite, while postinstall pack uses its private bundled runtime. Repeat with a local file dependency and a different public CLI entry."
 env = { VP_USE_PROJECT_VITE = "1" }
 steps = [
   { argv = ["vp", "install"], snapshot = false },
   ["node", "check-api.mjs"],
+  ["node", "check-vite-identity-guard.mjs"],
   ["vpt", "stat-file", "packed/entry.mjs", "--assert", "file"],
   ["vpt", "stat-file", "packed/entry.d.mts", "--assert", "file"],
+  ["vpt", "stat-file", "packed/style.css", "--assert", "file"],
   ["vp", "build"],
   ["vp", "dev"],
   ["vp", "preview"],
   ["vp", "test", "run"],
   { argv = ["node", "use-local-vite.mjs"], snapshot = false },
-  { argv = ["vp", "install"], envs = [["EXPECT_INTERNAL_CONFIG", "1"]], snapshot = false },
+  { argv = ["vp", "install"], envs = [["EXPECT_PROJECT_CONFIG", "1"]], snapshot = false },
   { argv = ["node", "check-api.mjs"], envs = [["LOCAL_VITE", "1"]] },
+  ["node", "check-vite-identity-guard.mjs"],
   ["vp", "build"],
   ["vp", "dev"],
   ["vp", "preview"],
   { argv = ["vp", "test", "run"], envs = [["LOCAL_VITE", "1"]] },
-  ["node", "check-core-guard.mjs"],
 ]
 
 # The registry installation owns the runtime dependencies. Invoke its public
@@ -33,23 +35,25 @@ vp = ["local"]
 # Use pinned upstream Vite through the runner's registry to exercise its real
 # CLI, API exports, and Vitest peer layout instead of a mock Vite package.
 local-registry = true
-comment = "A global Vite override replaces CLI/API/Vitest Vite, while postinstall pack keeps its matching internal core. Repeat with a local file dependency and a different public CLI entry."
+comment = "A global Vite override replaces CLI/API/Vitest Vite, while postinstall pack uses its private bundled runtime. Repeat with a local file dependency and a different public CLI entry."
 env = { VP_USE_PROJECT_VITE = "1" }
 steps = [
   { argv = ["vp", "install"], snapshot = false },
   ["node", "check-api.mjs"],
+  ["node", "check-vite-identity-guard.mjs", "local"],
   ["vpt", "stat-file", "packed/entry.mjs", "--assert", "file"],
   ["vpt", "stat-file", "packed/entry.d.mts", "--assert", "file"],
+  ["vpt", "stat-file", "packed/style.css", "--assert", "file"],
   ["node", "node_modules/vite-plus/bin/vp", "build"],
   ["node", "node_modules/vite-plus/bin/vp", "dev"],
   ["node", "node_modules/vite-plus/bin/vp", "preview"],
   ["node", "node_modules/vite-plus/bin/vp", "test", "run"],
   { argv = ["node", "use-local-vite.mjs"], snapshot = false },
-  { argv = ["node", "node_modules/vite-plus/bin/vp", "install"], envs = [["EXPECT_INTERNAL_CONFIG", "1"]], snapshot = false },
+  { argv = ["node", "node_modules/vite-plus/bin/vp", "install"], envs = [["EXPECT_PROJECT_CONFIG", "1"]], snapshot = false },
   { argv = ["node", "check-api.mjs"], envs = [["LOCAL_VITE", "1"]] },
+  ["node", "check-vite-identity-guard.mjs", "local"],
   ["node", "node_modules/vite-plus/bin/vp", "build"],
   ["node", "node_modules/vite-plus/bin/vp", "dev"],
   ["node", "node_modules/vite-plus/bin/vp", "preview"],
   { argv = ["node", "node_modules/vite-plus/bin/vp", "test", "run"], envs = [["LOCAL_VITE", "1"]] },
-  ["node", "check-core-guard.mjs", "local"],
 ]
diff --git a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/snapshots/upstream_vite_override.global.md b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/snapshots/upstream_vite_override.global.md
index c691b11741..812fd462e1 100644
--- a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/snapshots/upstream_vite_override.global.md
+++ b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/snapshots/upstream_vite_override.global.md
@@ -1,6 +1,6 @@
 # upstream_vite_override
 
-A global Vite override replaces CLI/API/Vitest Vite, while postinstall pack keeps its matching internal core. Repeat with a local file dependency and a different public CLI entry.
+A global Vite override replaces CLI/API/Vitest Vite, while postinstall pack uses its private bundled runtime. Repeat with a local file dependency and a different public CLI entry.
 
 ## `vp install`
 
@@ -8,7 +8,15 @@ A global Vite override replaces CLI/API/Vitest Vite, while postinstall pack keep
 ## `node check-api.mjs`
 
 ```
-API exports and bundled Vitest use upstream Vite; pack uses the matching internal core
+API exports and bundled Vitest use upstream Vite; pack uses its private bundled runtime
+```
+
+## `node check-vite-identity-guard.mjs`
+
+```
+Upstream Vite rejected without the opt-in before dev/build/preview
+Partial Vite override rejected before dev/build/preview
+Separate Vite copies with the same version rejected before dev/build/preview
 ```
 
 ## `vpt stat-file packed/entry.mjs --assert file`
@@ -23,15 +31,22 @@ packed/entry.mjs: file
 packed/entry.d.mts: file
 ```
 
+## `vpt stat-file packed/style.css --assert file`
+
+```
+packed/style.css: file
+```
+
 ## `vp build`
 
 ```
 VITE+ - The Unified Toolchain for the Web
 
-✓ 4 modules transformed.
+✓ 5 modules transformed.
 computing gzip size...
-dist/index.html                <size> kB │ gzip: <size> kB
-dist/assets/index-<hash>.js  <size> kB │ gzip: <size> kB
+dist/index.html                 <size> kB │ gzip: <size> kB
+dist/assets/index-<hash>.css  <size> kB │ gzip: <size> kB
+dist/assets/index-<hash>.js   <size> kB │ gzip: <size> kB
 
 ✓ built in <duration>
 ```
@@ -76,13 +91,21 @@ VITE+ - The Unified Toolchain for the Web
 ## `node use-local-vite.mjs`
 
 
-## `EXPECT_INTERNAL_CONFIG=1 vp install`
+## `EXPECT_PROJECT_CONFIG=1 vp install`
 
 
 ## `LOCAL_VITE=1 node check-api.mjs`
 
 ```
-API exports and bundled Vitest use upstream Vite; pack uses the matching internal core
+API exports and bundled Vitest use upstream Vite; pack uses its private bundled runtime
+```
+
+## `node check-vite-identity-guard.mjs`
+
+```
+Upstream Vite rejected without the opt-in before dev/build/preview
+Partial Vite override rejected before dev/build/preview
+Separate Vite copies with the same version rejected before dev/build/preview
 ```
 
 ## `vp build`
@@ -91,10 +114,11 @@ API exports and bundled Vitest use upstream Vite; pack uses the matching interna
 VITE+ - The Unified Toolchain for the Web
 
 Local upstream Vite CLI entry
-✓ 4 modules transformed.
+✓ 5 modules transformed.
 computing gzip size...
-dist/index.html                <size> kB │ gzip: <size> kB
-dist/assets/index-<hash>.js  <size> kB │ gzip: <size> kB
+dist/index.html                 <size> kB │ gzip: <size> kB
+dist/assets/index-<hash>.css  <size> kB │ gzip: <size> kB
+dist/assets/index-<hash>.js   <size> kB │ gzip: <size> kB
 
 ✓ built in <duration>
 ```
@@ -139,9 +163,3 @@ VITE+ - The Unified Toolchain for the Web
    Start at  <time>
    Duration  <duration> (<timing>)
 ```
-
-## `node check-core-guard.mjs`
-
-```
-Pack and Vite commands still reject a mismatched internal core
-```
diff --git a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/snapshots/upstream_vite_override.local.md b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/snapshots/upstream_vite_override.local.md
index e509d6e831..64b17669fe 100644
--- a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/snapshots/upstream_vite_override.local.md
+++ b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/snapshots/upstream_vite_override.local.md
@@ -1,6 +1,6 @@
 # upstream_vite_override
 
-A global Vite override replaces CLI/API/Vitest Vite, while postinstall pack keeps its matching internal core. Repeat with a local file dependency and a different public CLI entry.
+A global Vite override replaces CLI/API/Vitest Vite, while postinstall pack uses its private bundled runtime. Repeat with a local file dependency and a different public CLI entry.
 
 ## `vp install`
 
@@ -8,7 +8,15 @@ A global Vite override replaces CLI/API/Vitest Vite, while postinstall pack keep
 ## `node check-api.mjs`
 
 ```
-API exports and bundled Vitest use upstream Vite; pack uses the matching internal core
+API exports and bundled Vitest use upstream Vite; pack uses its private bundled runtime
+```
+
+## `node check-vite-identity-guard.mjs local`
+
+```
+Upstream Vite rejected without the opt-in before dev/build/preview
+Partial Vite override rejected before dev/build/preview
+Separate Vite copies with the same version rejected before dev/build/preview
 ```
 
 ## `vpt stat-file packed/entry.mjs --assert file`
@@ -23,13 +31,20 @@ packed/entry.mjs: file
 packed/entry.d.mts: file
 ```
 
+## `vpt stat-file packed/style.css --assert file`
+
+```
+packed/style.css: file
+```
+
 ## `node node_modules/vite-plus/bin/vp build`
 
 ```
-✓ 4 modules transformed.
+✓ 5 modules transformed.
 computing gzip size...
-dist/index.html                <size> kB │ gzip: <size> kB
-dist/assets/index-<hash>.js  <size> kB │ gzip: <size> kB
+dist/index.html                 <size> kB │ gzip: <size> kB
+dist/assets/index-<hash>.css  <size> kB │ gzip: <size> kB
+dist/assets/index-<hash>.js   <size> kB │ gzip: <size> kB
 
 ✓ built in <duration>
 ```
@@ -71,23 +86,32 @@ Upstream Vite preview served HTTP 200
 ## `node use-local-vite.mjs`
 
 
-## `EXPECT_INTERNAL_CONFIG=1 node node_modules/vite-plus/bin/vp install`
+## `EXPECT_PROJECT_CONFIG=1 node node_modules/vite-plus/bin/vp install`
 
 
 ## `LOCAL_VITE=1 node check-api.mjs`
 
 ```
-API exports and bundled Vitest use upstream Vite; pack uses the matching internal core
+API exports and bundled Vitest use upstream Vite; pack uses its private bundled runtime
+```
+
+## `node check-vite-identity-guard.mjs local`
+
+```
+Upstream Vite rejected without the opt-in before dev/build/preview
+Partial Vite override rejected before dev/build/preview
+Separate Vite copies with the same version rejected before dev/build/preview
 ```
 
 ## `node node_modules/vite-plus/bin/vp build`
 
 ```
 Local upstream Vite CLI entry
-✓ 4 modules transformed.
+✓ 5 modules transformed.
 computing gzip size...
-dist/index.html                <size> kB │ gzip: <size> kB
-dist/assets/index-<hash>.js  <size> kB │ gzip: <size> kB
+dist/index.html                 <size> kB │ gzip: <size> kB
+dist/assets/index-<hash>.css  <size> kB │ gzip: <size> kB
+dist/assets/index-<hash>.js   <size> kB │ gzip: <size> kB
 
 ✓ built in <duration>
 ```
@@ -127,9 +151,3 @@ Upstream Vite preview served HTTP 200
    Start at  <time>
    Duration  <duration> (<timing>)
 ```
-
-## `node check-core-guard.mjs local`
-
-```
-Pack and Vite commands still reject a mismatched internal core
-```
diff --git a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/style.css b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/style.css
new file mode 100644
index 0000000000..1a8654f239
--- /dev/null
+++ b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/style.css
@@ -0,0 +1 @@
+.upstream-override { color: red; }
diff --git a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/use-local-vite.mjs b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/use-local-vite.mjs
index 37de75c9d8..a7781b444c 100644
--- a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/use-local-vite.mjs
+++ b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/use-local-vite.mjs
@@ -18,8 +18,8 @@ writeFileSync(
 import { resolveConfig as upstreamResolveConfig } from ${JSON.stringify(entry)};
 export const ecosystemCiMarker = 'local-vite';
 export function resolveConfig(...args) {
-  if (process.env.EXPECT_INTERNAL_CONFIG === '1') {
-    throw new Error('Pack must load configuration with its internal core');
+  if (process.env.EXPECT_PROJECT_CONFIG === '1') {
+    process.env.PROJECT_CONFIG_LOADED = '1';
   }
   return upstreamResolveConfig(...args);
 }
diff --git a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/vite.config.ts b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/vite.config.ts
index 3ded359c9e..6dac7c9960 100644
--- a/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/vite.config.ts
+++ b/crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/upstream_vite_override/vite.config.ts
@@ -10,13 +10,33 @@ export default defineConfig({
     {
       name: 'verify-upstream-vite',
       configResolved() {
+        if (process.env.EXPECT_PROJECT_CONFIG === '1') {
+          assert.equal(process.env.PROJECT_CONFIG_LOADED, '1');
+        }
         assert.equal(version, '8.3.4');
         assert.equal(isRunnableDevEnvironment, fromVitePlus);
       },
       configureServer(server) {
         assert.ok(isRunnableDevEnvironment(server.environments.ssr));
+        assert.ok(fromVitePlus(server.environments.ssr));
         if (server.httpServer) {
           checkServer(server, 'dev');
+          // Model TanStack's SSR middleware: both API surfaces must recognize
+          // the environment created by the actual CLI before installing it.
+          return () => {
+            if (
+              isRunnableDevEnvironment(server.environments.ssr) &&
+              fromVitePlus(server.environments.ssr)
+            ) {
+              server.middlewares.use((req, res, next) => {
+                if (req.url === '/__ssr_identity') {
+                  res.end('Upstream Vite SSR middleware');
+                } else {
+                  next();
+                }
+              });
+            }
+          };
         }
       },
       configurePreviewServer(server) {
@@ -31,7 +51,8 @@ function checkServer(server, command) {
     try {
       const address = server.httpServer.address();
       assert.ok(address && typeof address === 'object');
-      const response = await fetch(`http://127.0.0.1:${address.port}/`, {
+      const path = command === 'dev' ? '/__ssr_identity' : '/';
+      const response = await fetch(`http://127.0.0.1:${address.port}${path}`, {
         signal: AbortSignal.timeout(10_000),
       });
       assert.equal(response.status, 200);
diff --git a/docs/guide/ci.md b/docs/guide/ci.md
index cf7615faaa..c0280907f0 100644
--- a/docs/guide/ci.md
+++ b/docs/guide/ci.md
@@ -106,7 +106,7 @@ For advanced configuration and the complete parameter reference, see the [`setup
 
 ## Testing Upstream Vite
 
-Ecosystem CI can replace Vite while keeping `vp pack` on the matching Vite+ core.
+Ecosystem CI can replace Vite while `vp pack` uses the runtime bundled inside `vite-plus`.
 Declare `vite` in the project and override **all** `vite` dependencies with the
 version under test. For example, with pnpm:
 
@@ -137,13 +137,17 @@ vp build
 vp test run
 ```
 
-The variable makes `vp dev`, `vp build`, and `vp preview` use the target project's
-Vite CLI. The dependency override makes `vite-plus` API exports and Vitest use
-that same Vite. Keep the override on the CLI's `vite` dependency too.
+The variable permits upstream Vite for `vp dev`, `vp build`, and `vp preview`.
+These commands use the CLI's `vite` dependency, which must resolve to the same
+package as the project's declared `vite`. The override also makes `vite-plus`
+API exports and Vitest use that Vite. Apply it to the CLI's `vite` dependency
+too. A partial override or a separate copy of the same version fails the check.
 `vp test` and `vite-plus/test` continue to use the same bundled Vitest instance.
 
-Pack and internal configuration loading use `@voidzero-dev/vite-plus-core`.
-Do not override that package; it must match the installed `vite-plus` version.
+Pack's runtime and types ship inside `vite-plus`, so they do not depend on
+upstream Vite providing `vite/pack`. Configuration loading uses the same `vite`
+alias as the public APIs. No direct `@voidzero-dev/vite-plus-core` dependency
+is added.
 Without `VP_USE_PROJECT_VITE=1`, Vite commands retain their normal core alias
 checks. If these commands run in a cached task, include the variable in the
 task's [`cache.env`](/config/run#cache-env).
diff --git a/packages/cli/BUNDLING.md b/packages/cli/BUNDLING.md
index 848ba1e32a..86bc974bab 100644
--- a/packages/cli/BUNDLING.md
+++ b/packages/cli/BUNDLING.md
@@ -6,7 +6,7 @@ This document explains how `vite-plus` is built and how it re-exports from `@voi
 
 The CLI package uses a **4-step build process**:
 
-1. **tsdown Build** - Bundle all CLI entry points via tsdown
+1. **Pack and tsdown Build** - Copy the private pack runtime, then bundle CLI entry points
 2. **NAPI Binding Build** - Compile Rust code to native Node.js bindings
 3. **Core Package Export Sync** - Re-export `@voidzero-dev/vite-plus-core` under `./client`, `./types/*`, etc.
 4. **Test Package Export Sync** - Re-export upstream `vitest` under `./test/*`
@@ -15,44 +15,54 @@ This architecture allows users to import everything from a single package (`vite
 
 ## Core Dependency Identity
 
-The CLI declares `@voidzero-dev/vite-plus-core` as a direct dependency for pack
-and internal configuration loading. `resolve-core.ts` checks its identity and
-exact version against the installed CLI manifest. Pack does not validate the
-project's `vite` dependency.
-
-Public Vite API exports and generated Vite shims use a separate `vite` dependency:
+The CLI declares only the `vite` alias for core:
 `workspace:@voidzero-dev/vite-plus-core@*` in the workspace and an exact npm alias
-in packed releases. This also supplies Vitest's Vite peer. A package-manager
-override for `vite` can replace these APIs and Vitest's Vite without replacing
-the internal pack tools. Pack exports, including `pack/client`, use the direct core.
-
-By default, dev/build/preview validate both the CLI's `vite` alias and any Vite
-dependency declared by the target project. An incidental hoisted peer does not
-trigger project validation. `VP_USE_PROJECT_VITE=1` selects the target project's
-declared Vite dependency and permits upstream Vite. Its CLI entry comes from
-`package.json`'s `bin` field, including for local `file:` installations. The
-internal core still requires an exact version match, and a stale core alias
-remains an error. See [ecosystem CI setup](../../docs/guide/ci.md#testing-upstream-vite).
+in releases. Public Vite APIs, configuration loading, module-runner exports,
+and Vite commands resolve through this dependency. It also supplies Vitest's
+Vite peer. The CLI has no direct dependency on the canonical core package name.
+
+Pack uses the private `#pack` import, which points to `dist/pack-runtime/tsdown`.
+The build copies branded tsdown, its CSS/executable extensions, Rolldown,
+pluginutils, declarations, and ESM shims from the core build. It rewrites core
+self-imports to relative paths and copies no Vite runtime. `pack/client` points
+to the copied declarations. Runtime dependencies and optional pack peers belong
+to the CLI, and `#pack-version` supplies migration metadata without reading the
+replaceable Vite manifest. Release bindings use the existing CLI platform
+packages; development builds copy the local Rolldown binding.
+
+By default, dev/build/preview validate the CLI alias and any `vite` dependency
+declared by the target project against the installed CLI version. Incidental
+hoisted peers do not trigger project validation. `VP_USE_PROJECT_VITE=1` permits
+upstream Vite but requires the project and CLI to resolve the same package path.
+Commands always use the CLI dependency, matching the static exports. An upstream
+CLI entry comes from its public `bin` field, including local `file:` builds.
+Partial overrides and separate copies of the same version fail before Vite
+starts. See [ecosystem CI setup](../../docs/guide/ci.md#testing-upstream-vite).
 
 For npm projects without overrides, pin a declared `vite` alias to the exact
 installed `vite-plus` version. npm can replace a tagged alias such as
 `npm:@voidzero-dev/vite-plus-core@latest` with upstream Vite to satisfy Vitest's
 peer range. The CLI rejects that mismatch and directs users to `vp migrate`,
 which writes an exact alias and the package-manager overrides. The npm fixtures
-check shared core identity with an exact alias and rejection of the tagged layout.
+check shared core identity with an exact alias and validation of the installed tagged layout.
 
 ## Build Steps
 
 ### Step 1: tsdown Build (`buildWithTsdown`)
 
-Bundles all CLI entry points using tsdown (configured in `tsdown.config.ts`). The config defines two builds:
+`build.ts` cleans `dist/`, then `bundlePack()` copies pack into `dist/pack-runtime/`.
+The tsdown build preserves this directory and keeps `#pack` and `#pack-version`
+external. Package `imports` resolve them in both source builds and installed
+packages. License generation includes the copied runtime and its dependencies.
+
+The tsdown configuration bundles the CLI entries:
 
 **ESM build** — bundles all entry points to `dist/`:
 
 - Public API entries: `bin`, `index`, `define-config`, `fmt`, `lint`, `pack`, `pack-bin`
 - Global command entries: `create`, `migrate`, `version`, `config`, `hooks`, `mcp`, `staged`
 - All third-party dependencies are inlined at build time
-- Only packages that must be resolved at runtime stay external (NAPI binding, `@voidzero-dev/vite-plus-core`, `vite`, `vitest`, `oxfmt`, `oxlint`)
+- Only packages that must be resolved at runtime stay external (NAPI binding, `#pack`, `#pack-version`, `vite`, `vitest`, `oxfmt`, `oxlint`)
 - Code splitting creates shared chunks for code used by multiple entries
 - DTS (`.d.ts`) files are generated for all entries
 
@@ -188,7 +198,7 @@ packages/cli/
 │   ├── define-config.d.ts
 │   ├── fmt.js                # Re-exports oxfmt
 │   ├── lint.js               # Re-exports oxlint types
-│   ├── pack.js               # Re-exports vite-plus-core/pack
+│   ├── pack.js               # Re-exports the private #pack runtime
 │   ├── pack-bin.js           # tsdown CLI for `vp pack`
 │   ├── create.js             # Global command: vp create
 │   ├── migrate.js            # Global command: vp migrate
@@ -327,8 +337,8 @@ A binding built by `pnpm build` contains:
 
 ```
 User imports 'vite-plus/rolldown'
-  → packages/cli re-exports from @voidzero-dev/vite-plus-core/rolldown
-    → packages/core/dist/rolldown/index.mjs
+  → packages/cli/dist/pack-runtime/tsdown
+    → packages/cli/dist/pack-runtime/rolldown/index.mjs
       → Native binding: @voidzero-dev/vite-plus-darwin-arm64
         (rewritten from @rolldown/binding-darwin-arm64)
         → vite-plus.darwin-arm64.node (contains rolldown_binding)
@@ -425,10 +435,10 @@ Preview retries still require the same PR head, an open PR, and the
 
 ### Why Shim Files?
 
-The CLI package creates thin shim files that re-export from `@voidzero-dev/vite-plus-core` rather than bundling the actual code. This approach:
+For Vite APIs, the CLI creates thin shim files that re-export through `vite`. Pack ships its own runtime as described above. This approach:
 
 1. **Enables drop-in replacement** - Users can replace `vite` with `vite-plus` without changing imports
-2. **Keeps packages in sync** - No need to rebuild CLI when core package changes
+2. **Keeps Vite APIs in sync** - Vite shims resolve the installed alias; pack changes require a CLI rebuild
 3. **Reduces duplication** - No file copying, just re-exports
 4. **Preserves module resolution** - Node.js resolves to the actual core package
 
diff --git a/packages/cli/build-support/bundle-pack.ts b/packages/cli/build-support/bundle-pack.ts
new file mode 100644
index 0000000000..92ef03aebb
--- /dev/null
+++ b/packages/cli/build-support/bundle-pack.ts
@@ -0,0 +1,95 @@
+import { cp, mkdir, readdir, readFile, writeFile } from 'node:fs/promises';
+import { createRequire } from 'node:module';
+import { dirname, join, relative } from 'node:path';
+
+import { format } from 'oxfmt';
+
+import { rewriteModuleSpecifiers } from '../../core/build-support/rewrite-module-specifiers.ts';
+import corePkg from '../../core/package.json' with { type: 'json' };
+
+/**
+ * Ship pack independently of the replaceable `vite` alias. Reuse the core
+ * build's branded tsdown, extensions, Rolldown, and declarations, but copy no
+ * Vite code. Release Rolldown uses the CLI's existing native platform packages;
+ * development builds carry the local Rolldown binding, as core does.
+ */
+export async function bundlePack(projectDir: string): Promise<void> {
+  const source = join(projectDir, '../core/dist');
+  const destination = join(projectDir, 'dist/pack-runtime');
+  await mkdir(destination, { recursive: true });
+  for (const entry of ['tsdown', 'rolldown', 'pluginutils', 'esm-shims.js']) {
+    await cp(join(source, entry), join(destination, entry), { recursive: true });
+  }
+
+  const exports: Record<string, string | { types?: string; default?: string } | null> =
+    corePkg.exports;
+  for (const file of await readdir(destination, { recursive: true })) {
+    if (!/\.(?:[cm]?js|[cm]?ts)$/.test(file)) {
+      continue;
+    }
+    const filename = join(destination, file);
+    const content = await readFile(filename, 'utf8');
+    const rewritten = rewriteModuleSpecifiers(content, filename, {
+      rules: [
+        {
+          from: '@voidzero-dev/vite-plus-core',
+          to(specifier) {
+            const subpath = `.${specifier.slice('@voidzero-dev/vite-plus-core'.length)}`;
+            const entry = exports[subpath];
+            const target =
+              entry && typeof entry === 'object'
+                ? /\.d\.[cm]?ts$/.test(file)
+                  ? entry.types
+                  : entry.default
+                : undefined;
+            if (!target || !/^\.\/dist\/(?:rolldown|pluginutils)\//.test(target)) {
+              throw new Error(`Pack must not depend on core at runtime: ${specifier} in ${file}`);
+            }
+            const path = relative(
+              dirname(filename),
+              join(destination, target.slice('./dist/'.length)),
+            ).replaceAll('\\', '/');
+            return path.startsWith('.') ? path : `./${path}`;
+          },
+        },
+      ],
+    });
+    if (rewritten.includes('@voidzero-dev/vite-plus-core')) {
+      throw new Error(`Unresolved core reference in private pack runtime: ${file}`);
+    }
+    await writeFile(filename, rewritten);
+  }
+
+  await writeFile(
+    join(destination, 'version.js'),
+    `export const tsdownVersion = ${JSON.stringify(corePkg.bundledVersions.tsdown)};\n`,
+  );
+  await writeFile(
+    join(destination, 'version.d.ts'),
+    'export declare const tsdownVersion: string;\n',
+  );
+
+  // These peers are resolved from the pack bundle at runtime. Keep the
+  // declarations in sync with the same tsdown and DTS plugin that core bundles.
+  const coreRequire = createRequire(join(projectDir, '../core/package.json'));
+  const tsdownPath = coreRequire.resolve('tsdown/package.json');
+  const tsdownPkg = JSON.parse(await readFile(tsdownPath, 'utf8'));
+  const dtsPkg = createRequire(tsdownPath)('rolldown-plugin-dts/package.json');
+  const manifestPath = join(projectDir, 'package.json');
+  const manifest = JSON.parse(await readFile(manifestPath, 'utf8'));
+  const bundled = new Set(['rolldown', '@tsdown/css', '@tsdown/exe']);
+  for (const field of ['peerDependencies', 'peerDependenciesMeta']) {
+    for (const [name, value] of Object.entries({ ...dtsPkg[field], ...tsdownPkg[field] })) {
+      if (!bundled.has(name)) {
+        manifest[field][name] = value;
+      }
+    }
+  }
+  const { code, errors } = await format(manifestPath, JSON.stringify(manifest, null, 2) + '\n', {
+    sortPackageJson: true,
+  });
+  if (errors.length > 0) {
+    throw new Error(`Could not format pack dependencies: ${JSON.stringify(errors)}`);
+  }
+  await writeFile(manifestPath, code);
+}
diff --git a/packages/cli/build.ts b/packages/cli/build.ts
index 8ad384a306..feaf4dce5c 100644
--- a/packages/cli/build.ts
+++ b/packages/cli/build.ts
@@ -31,6 +31,7 @@ import { format } from 'oxfmt';
 
 import { generateLicenseFile } from '../../scripts/generate-license.js';
 import corePkg from '../core/package.json' with { type: 'json' };
+import { bundlePack } from './build-support/bundle-pack.ts';
 import { VITEST_VERSION } from './src/utils/constants.ts';
 
 const projectDir = dirname(fileURLToPath(import.meta.url));
@@ -115,6 +116,8 @@ const customFlags = new Set(['--skip-native', '--skip-ts', '--skip-format']);
 const napiArgs = process.argv.slice(2).filter((arg) => !customFlags.has(arg));
 
 if (!skipTs) {
+  await rm(join(projectDir, 'dist'), { recursive: true, force: true });
+  await bundlePack(projectDir);
   buildWithTsdown();
   generateLicenseFile({
     title: 'Vite-Plus CLI license',
@@ -122,7 +125,20 @@ if (!skipTs) {
     outputPath: join(projectDir, 'LICENSE'),
     coreLicensePath: join(projectDir, '..', '..', 'LICENSE'),
     bundledPaths: [join(projectDir, 'dist')],
-    resolveFrom: [projectDir],
+    resolveFrom: [projectDir, join(projectDir, '../core'), join(projectDir, '../..')],
+    extraPackages: [
+      {
+        packageDir: join(projectDir, '../../rolldown/packages/rolldown'),
+        licensePath: join(projectDir, '../../rolldown/LICENSE'),
+      },
+      {
+        packageDir: join(
+          projectDir,
+          '../../rolldown/packages/rolldown/node_modules/@rolldown/pluginutils',
+        ),
+      },
+      { packageDir: join(projectDir, '../core/node_modules/tsdown') },
+    ],
   });
   if (!existsSync(join(projectDir, 'LICENSE'))) {
     throw new Error('LICENSE was not generated during build');
@@ -241,7 +257,7 @@ async function syncCorePackageExports(): Promise<void> {
   console.log('  Creating ./pack/client');
   await writeFile(
     join(distDir, 'pack-client.d.ts'),
-    `/// <reference types="${CORE_PACKAGE_NAME}/pack/client" />\n`,
+    '/// <reference path="./pack-runtime/tsdown/client.d.ts" />\n',
   );
 
   for (const subpath of ['module-runner', 'internal']) {
diff --git a/packages/cli/package.json b/packages/cli/package.json
index 3fb6fedc31..4b4dfa9ec0 100644
--- a/packages/cli/package.json
+++ b/packages/cli/package.json
@@ -35,6 +35,14 @@
   "sideEffects": false,
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
+  "imports": {
+    "#pack": {
+      "types": "./dist/pack-runtime/tsdown/index-types.d.ts",
+      "default": "./dist/pack-runtime/tsdown/index.js"
+    },
+    "#pack-version": "./dist/pack-runtime/version.js",
+    "#parallel-plugin-worker": "./dist/pack-runtime/rolldown/parallel-plugin-worker.mjs"
+  },
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
@@ -356,12 +364,14 @@
     "@vitest/snapshot": "catalog:",
     "@vitest/spy": "catalog:",
     "@vitest/utils": "catalog:",
-    "@voidzero-dev/vite-plus-core": "workspace:*",
+    "lightningcss": "catalog:",
     "oxfmt": "catalog:",
     "oxlint": "catalog:",
     "oxlint-tsgolint": "catalog:",
+    "postcss": "^8.5.29",
     "vite": "workspace:@voidzero-dev/vite-plus-core@*",
-    "vitest": "catalog:"
+    "vitest": "catalog:",
+    "yuku-parser": "0.19.0"
   },
   "devDependencies": {
     "@emnapi/core": "catalog:",
@@ -370,6 +380,7 @@
     "@nkzw/safe-word-list": "catalog:",
     "@types/cross-spawn": "catalog:",
     "@types/validate-npm-package-name": "catalog:",
+    "@typescript/native-preview": "catalog:",
     "@vitest/browser-playwright": "catalog:",
     "@vitest/browser-webdriverio": "catalog:",
     "@voidzero-dev/vite-plus-prompts": "workspace:*",
@@ -393,9 +404,20 @@
     "zod": "catalog:"
   },
   "peerDependencies": {
+    "@arethetypeswrong/core": "^0.18.1",
+    "@typescript/native-preview": "*",
+    "@vitejs/devtools": "*",
     "@vitest/browser-playwright": "catalog:",
     "@vitest/browser-webdriverio": "^5.0.0-beta.5 || >=5.0.0",
-    "playwright": "*"
+    "@volar/typescript": "~2.4.0",
+    "@vue/language-core": "~3.2.0 || ~3.3.0",
+    "playwright": "*",
+    "publint": "^0.3.8",
+    "tsx": "*",
+    "typescript": "^5.0.0 || ^6.0.0 || ^7.0.0",
+    "unplugin-unused": ">=0.5.0",
+    "unrun": "*",
+    "vue-tsc": "~3.2.0 || ~3.3.0"
   },
   "peerDependenciesMeta": {
     "@vitest/browser-playwright": {
@@ -406,8 +428,44 @@
     },
     "playwright": {
       "optional": true
+    },
+    "@typescript/native-preview": {
+      "optional": true
+    },
+    "@volar/typescript": {
+      "optional": true
+    },
+    "@vue/language-core": {
+      "optional": true
+    },
+    "typescript": {
+      "optional": true
+    },
+    "vue-tsc": {
+      "optional": true
+    },
+    "@arethetypeswrong/core": {
+      "optional": true
+    },
+    "@vitejs/devtools": {
+      "optional": true
+    },
+    "publint": {
+      "optional": true
+    },
+    "tsx": {
+      "optional": true
+    },
+    "unplugin-unused": {
+      "optional": true
+    },
+    "unrun": {
+      "optional": true
     }
   },
+  "optionalDependencies": {
+    "fsevents": "~2.3.3"
+  },
   "napi": {
     "binaryName": "vite-plus",
     "packageName": "@voidzero-dev/vite-plus",
diff --git a/packages/cli/src/__tests__/exports-map.spec.ts b/packages/cli/src/__tests__/exports-map.spec.ts
index d77349313e..65ef808d6b 100644
--- a/packages/cli/src/__tests__/exports-map.spec.ts
+++ b/packages/cli/src/__tests__/exports-map.spec.ts
@@ -59,6 +59,54 @@ function typeDiagnostics(source: string, separator: string = path.sep): string[]
 }
 
 describe('package.json exports map', () => {
+  it('checks pack declarations without an installed Vite or core package', () => {
+    const directory = fs.mkdtempSync(path.join(os.tmpdir(), 'vite-plus-pack-types-'));
+    try {
+      const installed = path.join(directory, 'node_modules/vite-plus');
+      fs.mkdirSync(installed, { recursive: true });
+      fs.copyFileSync(cliPkgJsonPath, path.join(installed, 'package.json'));
+      fs.cpSync(path.join(cliPkgDir, 'dist'), path.join(installed, 'dist'), {
+        recursive: true,
+        filter: (file) => fs.statSync(file).isDirectory() || /\.d\.[cm]?ts$/.test(file),
+      });
+      const filename = path.join(directory, 'pack.mts');
+      fs.writeFileSync(
+        filename,
+        `
+import type { PackUserConfig } from 'vite-plus/pack';
+import 'vite-plus/pack/client';
+const config: PackUserConfig = {
+  entry: ['src/index.ts'],
+  outputOptions: { format: 'esm' },
+};
+// @ts-expect-error Entry options must retain their types through #pack.
+config.entry = 42;
+// @ts-expect-error Copied Rolldown declarations must retain format constraints.
+config.outputOptions = { format: 'unknown-format' };
+const modules = import.meta.glob<number>('./*.ts');
+const value: Promise<number> = modules['./entry.ts']();
+// @ts-expect-error The pack/client declarations must retain their generic types.
+const invalid: Promise<string> = value;
+`,
+      );
+      const program = ts.createProgram([filename], {
+        noEmit: true,
+        strict: true,
+        skipLibCheck: true,
+        types: [],
+        module: ts.ModuleKind.NodeNext,
+        target: ts.ScriptTarget.ESNext,
+      });
+      expect(
+        ts
+          .getPreEmitDiagnostics(program)
+          .map((d) => ts.flattenDiagnosticMessageText(d.messageText, '\n')),
+      ).toEqual([]);
+    } finally {
+      fs.rmSync(directory, { recursive: true, force: true });
+    }
+  }, 15_000);
+
   // The first full type check in this file takes up to about 3 s on the Alpine musl
   // runner, so a slow runner pushes it past Vitest's 5 s default.
   it('checks Playwright options with only declared dependencies available', () => {
@@ -117,7 +165,7 @@ alias({ contextOptions: { reducedMotion: 'bogus' } });
   it('provides the bundled Vitest Vite peer without relying on project dependencies', () => {
     const pkg = JSON.parse(fs.readFileSync(cliPkgJsonPath, 'utf8'));
     expect(pkg.dependencies.vite).toBe('workspace:@voidzero-dev/vite-plus-core@*');
-    expect(pkg.dependencies['@voidzero-dev/vite-plus-core']).toBe('workspace:*');
+    expect(pkg.dependencies['@voidzero-dev/vite-plus-core']).toBeUndefined();
     expect(pkg.devDependencies.vite).toBeUndefined();
   });
 
diff --git a/packages/cli/src/__tests__/pack.spec.ts b/packages/cli/src/__tests__/pack.spec.ts
index cda2669b89..97ba7e503d 100644
--- a/packages/cli/src/__tests__/pack.spec.ts
+++ b/packages/cli/src/__tests__/pack.spec.ts
@@ -10,7 +10,7 @@ import {
   enableDebug,
 } from '../pack.js';
 
-test('should export all pack APIs from @voidzero-dev/vite-plus-core/pack', () => {
+test('should export all pack APIs from the private pack runtime', () => {
   expect(defineConfig).toBeTypeOf('function');
   expect(build).toBeTypeOf('function');
   expect(globalLogger).toBeDefined();
diff --git a/packages/cli/src/__tests__/resolve-core.spec.ts b/packages/cli/src/__tests__/resolve-core.spec.ts
index 4355f767f9..de43fc68b1 100644
--- a/packages/cli/src/__tests__/resolve-core.spec.ts
+++ b/packages/cli/src/__tests__/resolve-core.spec.ts
@@ -1,12 +1,12 @@
 import { execFileSync } from 'node:child_process';
-import { mkdirSync, mkdtempSync, realpathSync, rmSync, writeFileSync } from 'node:fs';
+import { mkdirSync, mkdtempSync, realpathSync, rmSync, symlinkSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 
 import { afterEach, beforeEach, describe, expect, it } from 'vitest';
 
 import cliPkg from '../../package.json' with { type: 'json' };
-import { resolveCore, resolveVitePackage } from '../resolve-core.ts';
+import { resolveVitePackage } from '../resolve-core.ts';
 
 function writePackageJson(directory: string, manifest: Record<string, unknown>): void {
   mkdirSync(directory, { recursive: true });
@@ -39,7 +39,6 @@ describe('core and Vite resolution', () => {
   let root: string;
   let project: string;
   let cliModule: string;
-  let bundled: string;
   let projectCore: string;
   let cliVite: string;
 
@@ -50,11 +49,9 @@ describe('core and Vite resolution', () => {
       devDependencies: { vite: `npm:@voidzero-dev/vite-plus-core@${cliPkg.version}` },
     });
     cliModule = join(root, 'cli', 'dist', 'bin.js');
-    bundled = join(root, 'cli', 'node_modules', '@voidzero-dev/vite-plus-core');
     cliVite = join(root, 'cli', 'node_modules', 'vite');
     projectCore = join(project, 'node_modules', 'vite');
     writeCli(join(root, 'cli'));
-    writeCore(bundled);
     writeCore(cliVite);
     writeCore(projectCore);
   });
@@ -67,14 +64,12 @@ describe('core and Vite resolution', () => {
     writePackageJson(project, { devDependencies: { 'vite-plus': cliPkg.version } });
     rmSync(projectCore, { recursive: true });
     expect(resolveVitePackage(project, cliModule, false)).toBe(join(cliVite, 'package.json'));
-    expect(resolveCore('/pack', cliModule)).toBe(join(bundled, 'pack.js'));
   });
 
   it('ignores an upstream Vite peer hoisted by npm in a CLI-only project', () => {
     writePackageJson(project, { devDependencies: { 'vite-plus': cliPkg.version } });
     writeCore(projectCore, 'vite', '8.2.2');
     expect(resolveVitePackage(project, cliModule, false)).toBe(join(cliVite, 'package.json'));
-    expect(resolveCore('/pack', cliModule)).toBe(join(bundled, 'pack.js'));
   });
 
   it.each(['dependencies', 'devDependencies', 'optionalDependencies', 'peerDependencies'])(
@@ -97,21 +92,18 @@ describe('core and Vite resolution', () => {
     'uses the installed CLI manifest after repacking as %s',
     (version) => {
       writeCli(join(root, 'cli'), version);
-      writeCore(bundled, '@voidzero-dev/vite-plus-core', version);
       writeCore(cliVite, '@voidzero-dev/vite-plus-core', version);
       writeCore(projectCore, '@voidzero-dev/vite-plus-core', version);
       expect(resolveVitePackage(project, cliModule, false)).toBe(join(cliVite, 'package.json'));
-      expect(resolveCore('/pack', cliModule)).toBe(join(bundled, 'pack.js'));
     },
   );
 
-  it.each(['project', 'bundled', 'cli alias'])(
+  it.each(['project', 'cli alias'])(
     'still rejects a mismatched %s core after repacking the CLI',
     (location) => {
       writeCli(join(root, 'cli'), '0.0.0');
-      writeCore(bundled, '@voidzero-dev/vite-plus-core', '0.0.0');
       writeCore(cliVite, '@voidzero-dev/vite-plus-core', '0.0.0');
-      writeCore(location === 'project' ? projectCore : location === 'bundled' ? bundled : cliVite);
+      writeCore(location === 'project' ? projectCore : cliVite);
       expect(() => resolveVitePackage(project, cliModule, false)).toThrow(
         `Expected @voidzero-dev/vite-plus-core@0.0.0, but found @voidzero-dev/vite-plus-core@${cliPkg.version}`,
       );
@@ -120,7 +112,7 @@ describe('core and Vite resolution', () => {
 
   it('does not fall back to the project when the CLI dependency is missing', () => {
     writeCore(projectCore);
-    rmSync(bundled, { recursive: true });
+    rmSync(cliVite, { recursive: true });
     // pnpm injects NODE_PATH, which can supply an unrelated Vite package.
     // Check the missing dependency in a process without global search paths.
     execFileSync(process.execPath, [
@@ -128,67 +120,68 @@ describe('core and Vite resolution', () => {
       '--input-type=module',
       '--eval',
       `import { strict as assert } from 'node:assert';
-       import { resolveCore } from ${JSON.stringify(new URL('../resolve-core.ts', import.meta.url).href)};
+       import { resolveVitePackage } from ${JSON.stringify(new URL('../resolve-core.ts', import.meta.url).href)};
        assert.throws(
-         () => resolveCore('', ${JSON.stringify(cliModule)}),
+         () => resolveVitePackage(${JSON.stringify(project)}, ${JSON.stringify(cliModule)}, false),
          /Could not resolve the bundled Vite/,
        );`,
     ]);
   });
 
-  it.each(['project', 'bundled', 'cli alias'])(
-    'rejects upstream Vite in the %s dependency',
-    (location) => {
-      writeCore(
-        location === 'project' ? projectCore : location === 'bundled' ? bundled : cliVite,
-        'vite',
-        '8.2.2',
-      );
-      expect(() => resolveVitePackage(project, cliModule, false)).toThrow('found vite@8.2.2');
+  it.each(['project', 'cli alias'])('rejects upstream Vite in the %s dependency', (location) => {
+    writeCore(location === 'project' ? projectCore : cliVite, 'vite', '8.2.2');
+    expect(() => resolveVitePackage(project, cliModule, false)).toThrow('found vite@8.2.2');
+  });
+
+  it.each(['project', 'cli alias'])('rejects a stale core in the %s dependency', (location) => {
+    writeCore(
+      location === 'project' ? projectCore : cliVite,
+      '@voidzero-dev/vite-plus-core',
+      '0.0.0-stale',
+    );
+    expect(() => resolveVitePackage(project, cliModule, false)).toThrow(
+      'found @voidzero-dev/vite-plus-core@0.0.0-stale',
+    );
+  });
+
+  it.each(['8.3.4', '9.0.0-dev'])(
+    'allows shared upstream Vite %s only with the opt-in',
+    (version) => {
+      writeCore(cliVite, 'vite', version);
+      rmSync(projectCore, { recursive: true });
+      symlinkSync(cliVite, projectCore, 'junction');
+      expect(() => resolveVitePackage(project, cliModule, false)).toThrow(`found vite@${version}`);
+      expect(resolveVitePackage(project, cliModule, true)).toBe(join(cliVite, 'package.json'));
     },
   );
 
-  it.each(['project', 'bundled', 'cli alias'])(
-    'rejects a stale core in the %s dependency',
+  it.each(['project', 'cli'])(
+    'rejects an override applied only to the %s with the opt-in',
     (location) => {
-      writeCore(
-        location === 'project' ? projectCore : location === 'bundled' ? bundled : cliVite,
-        '@voidzero-dev/vite-plus-core',
-        '0.0.0-stale',
-      );
-      expect(() => resolveVitePackage(project, cliModule, false)).toThrow(
-        'found @voidzero-dev/vite-plus-core@0.0.0-stale',
+      writeCore(location === 'project' ? projectCore : cliVite, 'vite', '8.3.4');
+      expect(() => resolveVitePackage(project, cliModule, true)).toThrow(
+        'requires the project and vite-plus to resolve the same Vite package',
       );
     },
   );
 
-  it.each(['vite', '@voidzero-dev/vite-plus-core'])(
-    'pack ignores a project override to %s',
-    (name) => {
-      writeCore(projectCore, name, '0.0.0-override');
-      writeCore(cliVite, 'vite', '8.3.4');
-      expect(resolveCore('/pack', cliModule)).toBe(join(bundled, 'pack.js'));
-    },
-  );
-
-  it('selects upstream Vite only with the explicit opt-in', () => {
-    writeCore(projectCore, 'vite', '8.3.4');
-    writeCore(cliVite, 'vite', '8.3.4');
-    expect(() => resolveVitePackage(project, cliModule, false)).toThrow('found vite@8.3.4');
-    expect(resolveVitePackage(project, cliModule, true)).toBe(join(projectCore, 'package.json'));
-  });
-
-  it('still checks the internal core with the opt-in', () => {
-    writeCore(projectCore, 'vite', '8.3.4');
-    writeCore(bundled, '@voidzero-dev/vite-plus-core', '0.0.0-stale');
+  it.each([
+    ['vite', '8.3.4'],
+    ['@voidzero-dev/vite-plus-core', cliPkg.version],
+  ])('rejects separate copies of %s@%s with the opt-in', (name, version) => {
+    writeCore(projectCore, name, version);
+    writeCore(cliVite, name, version);
     expect(() => resolveVitePackage(project, cliModule, true)).toThrow(
-      'found @voidzero-dev/vite-plus-core@0.0.0-stale',
-    );
-    expect(() => resolveCore('/pack', cliModule)).toThrow(
-      'found @voidzero-dev/vite-plus-core@0.0.0-stale',
+      'requires the project and vite-plus to resolve the same Vite package',
     );
   });
 
+  it('allows a shared matching core alias with the opt-in', () => {
+    rmSync(projectCore, { recursive: true });
+    symlinkSync(cliVite, projectCore, 'junction');
+    expect(resolveVitePackage(project, cliModule, true)).toBe(join(cliVite, 'package.json'));
+  });
+
   it.each(['other-package', '@voidzero-dev/vite-plus-core'])(
     'does not bypass checks for %s with the opt-in',
     (name) => {
@@ -221,10 +214,4 @@ describe('core and Vite resolution', () => {
        );`,
     ]);
   });
-
-  it('reports a missing core subpath instead of selecting a project copy', () => {
-    writeCore(projectCore);
-    rmSync(join(bundled, 'pack.js'));
-    expect(() => resolveCore('/pack', cliModule)).toThrow();
-  });
 });
diff --git a/packages/cli/src/migration/__tests__/tsup.spec.ts b/packages/cli/src/migration/__tests__/tsup.spec.ts
index 7935beb699..8f01be979d 100644
--- a/packages/cli/src/migration/__tests__/tsup.spec.ts
+++ b/packages/cli/src/migration/__tests__/tsup.spec.ts
@@ -4,8 +4,8 @@ import path from 'node:path';
 
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 
-vi.mock('vite/package.json', () => ({
-  default: { bundledVersions: { tsdown: '0.99.0' } },
+vi.mock('#pack-version', () => ({
+  tsdownVersion: '0.99.0',
 }));
 
 const { mockConfirm, mockInfo, mockWarn } = vi.hoisted(() => ({
diff --git a/packages/cli/src/migration/migrator/tsup.ts b/packages/cli/src/migration/migrator/tsup.ts
index 54c09d9bdb..6f4e35733e 100644
--- a/packages/cli/src/migration/migrator/tsup.ts
+++ b/packages/cli/src/migration/migrator/tsup.ts
@@ -2,7 +2,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { styleText } from 'node:util';
 
-import corePkg from '@voidzero-dev/vite-plus-core/package.json' with { type: 'json' };
+import { tsdownVersion } from '#pack-version';
 import * as prompts from '@voidzero-dev/vite-plus-prompts';
 
 import { PackageManager, type WorkspacePackage } from '../../types/index.ts';
@@ -381,7 +381,7 @@ async function runTsdownMigrateStep(
       command: vpBin,
       args: [
         'dlx',
-        `tsdown-migrate@${corePkg.bundledVersions.tsdown}`,
+        `tsdown-migrate@${tsdownVersion}`,
         '--yes',
         '--package-manager',
         packageManager,
diff --git a/packages/cli/src/pack-bin.ts b/packages/cli/src/pack-bin.ts
index dc68ab684a..a896ca46cf 100644
--- a/packages/cli/src/pack-bin.ts
+++ b/packages/cli/src/pack-bin.ts
@@ -10,7 +10,7 @@ import {
   type InlineConfig,
   type ResolvedConfig,
   type TsdownHandle,
-} from '@voidzero-dev/vite-plus-core/pack';
+} from '#pack';
 import { cac } from 'cac';
 
 import { resolveViteConfig } from './resolve-vite-config.ts';
diff --git a/packages/cli/src/pack.ts b/packages/cli/src/pack.ts
index 94a2304ee7..036d6ba2fd 100644
--- a/packages/cli/src/pack.ts
+++ b/packages/cli/src/pack.ts
@@ -1,6 +1,6 @@
-import type { UserConfig as TsdownUserConfig } from '@voidzero-dev/vite-plus-core/pack';
+import type { UserConfig as TsdownUserConfig } from '#pack';
 
-export * from '@voidzero-dev/vite-plus-core/pack';
+export * from '#pack';
 
 export interface PackUserConfig extends TsdownUserConfig {
   /**
diff --git a/packages/cli/src/resolve-core.ts b/packages/cli/src/resolve-core.ts
index edbab7e4fc..c1d6892acb 100644
--- a/packages/cli/src/resolve-core.ts
+++ b/packages/cli/src/resolve-core.ts
@@ -21,7 +21,6 @@ function checkCoreVersion(packageJsonPath: string, expectedVersion: string): voi
 
 function resolveProjectVitePackage(
   cwd: string,
-  corePackageJsonPath: string,
   expectedVersion: string,
   allowUpstream: boolean,
 ): string | undefined {
@@ -52,7 +51,7 @@ function resolveProjectVitePackage(
   }
   if (projectPackageJsonPath) {
     const pkg = JSON.parse(readFileSync(projectPackageJsonPath, 'utf8')) as { name?: string };
-    if (projectPackageJsonPath !== corePackageJsonPath && !(allowUpstream && pkg.name === 'vite')) {
+    if (!(allowUpstream && pkg.name === 'vite')) {
       checkCoreVersion(projectPackageJsonPath, expectedVersion);
     }
   } else if (allowUpstream) {
@@ -61,46 +60,36 @@ function resolveProjectVitePackage(
   return projectPackageJsonPath;
 }
 
-/** Resolve and validate the internal core independently of Vite overrides. */
-export function resolveCore(subpath = '', modulePath = import.meta.url): string {
+/** Resolve Vite from the same dependency as the CLI's static public exports. */
+export function resolveVitePackage(
+  cwd: string,
+  modulePath = import.meta.url,
+  useProjectVite = process.env.VP_USE_PROJECT_VITE === '1',
+): string {
   const cliRequire = createRequire(modulePath);
-  // Read the selected CLI's installed manifest. A static JSON import is inlined
-  // during the build, before CI and preview packers can stamp a new version.
-  const { version: expectedVersion } = JSON.parse(
+  // Read the installed version after preview/local packers have stamped it.
+  const { version } = JSON.parse(
     readFileSync(cliRequire.resolve('vite-plus/package.json'), 'utf8'),
   ) as { version: string };
-  let corePackageJsonPath: string;
+  let vitePackageJsonPath: string;
   try {
-    corePackageJsonPath = cliRequire.resolve(`${CORE_PACKAGE_NAME}/package.json`);
+    vitePackageJsonPath = cliRequire.resolve('vite/package.json');
   } catch (cause) {
     throw new Error('Could not resolve the bundled Vite dependency. Run `vp install`.', { cause });
   }
-  checkCoreVersion(corePackageJsonPath, expectedVersion);
-
-  return cliRequire.resolve(`${CORE_PACKAGE_NAME}${subpath}`);
-}
-
-/** Resolve the Vite used for dev/build/preview, preserving normal alias checks. */
-export function resolveVitePackage(
-  cwd: string,
-  modulePath = import.meta.url,
-  useProjectVite = process.env.VP_USE_PROJECT_VITE === '1',
-): string {
-  const corePackageJsonPath = resolveCore('/package.json', modulePath);
-  const { version } = JSON.parse(readFileSync(corePackageJsonPath, 'utf8')) as { version: string };
-  const projectPackageJsonPath = resolveProjectVitePackage(
-    cwd,
-    corePackageJsonPath,
-    version,
-    useProjectVite,
-  );
+  const projectPackageJsonPath = resolveProjectVitePackage(cwd, version, useProjectVite);
   if (useProjectVite) {
-    return projectPackageJsonPath!;
+    // Version equality does not establish module identity. Even the opt-in
+    // must keep the active server and public Vite APIs on the same package.
+    if (projectPackageJsonPath !== vitePackageJsonPath) {
+      throw new Error(
+        'VP_USE_PROJECT_VITE=1 requires the project and vite-plus to resolve the same Vite package. ' +
+          `Project: ${projectPackageJsonPath}. CLI: ${vitePackageJsonPath}. ` +
+          'Apply the same override to all `vite` dependencies, including `vite-plus>vite`, then run `vp install`.',
+      );
+    }
+  } else {
+    checkCoreVersion(vitePackageJsonPath, version);
   }
-
-  // Public API re-exports still use `vite`. Validate that dependency as well,
-  // so normal commands cannot silently run a different Vite than API imports.
-  const vitePackageJsonPath = createRequire(modulePath).resolve('vite/package.json');
-  checkCoreVersion(vitePackageJsonPath, version);
   return vitePackageJsonPath;
 }
diff --git a/packages/cli/src/resolve-pack.ts b/packages/cli/src/resolve-pack.ts
index 37ff79878d..df1907104b 100644
--- a/packages/cli/src/resolve-pack.ts
+++ b/packages/cli/src/resolve-pack.ts
@@ -1,15 +1,13 @@
 import { join } from 'node:path';
 
 import type { JsCommandResolvedResult } from '../binding/index.js';
-import { resolveCore } from './resolve-core.ts';
 import { DEFAULT_ENVS } from './utils/constants.ts';
 
-/** Validate the internal core before starting the bundled pack entry. */
+/** Start the pack runtime shipped with this CLI. */
 export async function pack(err: Error | null): Promise<JsCommandResolvedResult> {
   if (err) {
     throw err;
   }
-  resolveCore('/pack');
   return {
     binPath: join(import.meta.dirname, 'pack-bin.js'),
     envs: { ...DEFAULT_ENVS },
diff --git a/packages/cli/src/resolve-vite-config.ts b/packages/cli/src/resolve-vite-config.ts
index 66e6573b7d..4e3b177e91 100644
--- a/packages/cli/src/resolve-vite-config.ts
+++ b/packages/cli/src/resolve-vite-config.ts
@@ -56,7 +56,7 @@ export interface ResolveViteConfigOptions {
  * Resolve vite.config.ts and return the config object.
  */
 export async function resolveViteConfig(cwd: string, options?: ResolveViteConfigOptions) {
-  const { resolveConfig } = await import('@voidzero-dev/vite-plus-core');
+  const { resolveConfig } = await import('./index.js');
 
   // This loads the config purely to read a non-plugin block (lint/fmt/pack/run/
   // staged/create…), so skip the user's plugin factory while it evaluates.
diff --git a/packages/cli/toolchain.config.json b/packages/cli/toolchain.config.json
index d71c335087..fa6fadf7cf 100644
--- a/packages/cli/toolchain.config.json
+++ b/packages/cli/toolchain.config.json
@@ -156,6 +156,16 @@
     }
   ],
   "edges": [
+    {
+      "from": "vite-plus",
+      "to": "tsdown",
+      "relationship": "bundles"
+    },
+    {
+      "from": "vite-plus",
+      "to": "rolldown",
+      "relationship": "bundles"
+    },
     {
       "from": "vite-plus",
       "to": "vite-plus-core",
diff --git a/packages/cli/tsdown.config.ts b/packages/cli/tsdown.config.ts
index 203444c9b6..5be9f056f4 100644
--- a/packages/cli/tsdown.config.ts
+++ b/packages/cli/tsdown.config.ts
@@ -76,9 +76,10 @@ export default defineConfig([
     fixedExtension: false,
     shims: true,
     dts: true,
-    clean: true,
+    // build.ts cleans dist before it installs the private pack runtime.
+    clean: false,
     // NAPI binding uses a relative path that tsdown can't auto-detect from package.json
-    deps: { neverBundle: [/\.\.\/binding\/index\.(js|cjs)/] },
+    deps: { neverBundle: [/\.\.\/binding\/index\.(js|cjs)/, /^#pack(?:-version)?$/] },
     inputOptions: {
       resolve: {
         // Prefer ESM entry (module field) over CJS/UMD (main field) for bundled deps.
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 2c63eea21a..d8ed2c701e 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -487,6 +487,9 @@ importers:
 
   packages/cli:
     dependencies:
+      '@arethetypeswrong/core':
+        specifier: ^0.18.1
+        version: 0.18.2
       '@oxc-project/runtime':
         specifier: 'catalog:'
         version: 0.155.0
@@ -496,6 +499,9 @@ importers:
       '@oxlint/plugins':
         specifier: 'catalog:'
         version: 1.89.0
+      '@vitejs/devtools':
+        specifier: '*'
+        version: 0.7.6(@devframes/json-render@1.0.0(@devframes/hub@1.0.0(@devframes/agentic@1.0.0)(crossws@0.4.12(srvx@1.0.5))(devframe@1.0.0))(devframe@1.0.0))(crossws@0.4.12(srvx@1.0.5))(srvx@1.0.5)(vite@packages+core)
       '@vitest/browser':
         specifier: 'catalog:'
         version: 5.0.5(vite@packages+core)(vitest@5.0.5)
@@ -517,9 +523,15 @@ importers:
       '@vitest/utils':
         specifier: 'catalog:'
         version: 5.0.5
-      '@voidzero-dev/vite-plus-core':
-        specifier: workspace:*
-        version: link:../core
+      '@volar/typescript':
+        specifier: ~2.4.0
+        version: 2.4.28(typescript@6.0.3)
+      '@vue/language-core':
+        specifier: ~3.2.0 || ~3.3.0
+        version: 3.3.12
+      lightningcss:
+        specifier: 'catalog:'
+        version: 1.33.0
       oxfmt:
         specifier: 'catalog:'
         version: 0.74.0(vite-plus@packages+cli)
@@ -532,12 +544,36 @@ importers:
       playwright:
         specifier: '*'
         version: 1.62.1
+      postcss:
+        specifier: ^8.5.29
+        version: 8.5.29
+      publint:
+        specifier: ^0.3.8
+        version: 0.3.24
+      tsx:
+        specifier: '*'
+        version: 4.23.15
+      typescript:
+        specifier: ^5.0.0 || ^6.0.0 || ^7.0.0
+        version: 6.0.3
+      unplugin-unused:
+        specifier: '>=0.5.0'
+        version: 0.5.6
+      unrun:
+        specifier: '*'
+        version: 0.3.1
       vite:
         specifier: workspace:@voidzero-dev/vite-plus-core@*
         version: link:../core
       vitest:
         specifier: 'catalog:'
         version: 5.0.5(@edge-runtime/vm@5.0.0)(@opentelemetry/api@1.9.0)(@types/node@24.10.3)(@vitest/browser-playwright@5.0.5)(@vitest/browser-preview@5.0.5)(@vitest/browser-webdriverio@5.0.0)(@vitest/ui@5.0.5)(happy-dom@20.0.10)(jsdom@27.2.0(supports-color@8.1.1))(vite@packages+core)
+      vue-tsc:
+        specifier: ~3.2.0 || ~3.3.0
+        version: 3.3.12(typescript@6.0.3)
+      yuku-parser:
+        specifier: 0.19.0
+        version: 0.19.0
     devDependencies:
       '@emnapi/core':
         specifier: 'catalog:'
@@ -557,6 +593,9 @@ importers:
       '@types/validate-npm-package-name':
         specifier: 'catalog:'
         version: 4.0.2
+      '@typescript/native-preview':
+        specifier: 'catalog:'
+        version: 7.0.0-dev.20260707.2
       '@vitest/browser-playwright':
         specifier: 'catalog:'
         version: 5.0.5(playwright@1.62.1)(vite@packages+core)(vitest@5.0.5)
@@ -620,6 +659,10 @@ importers:
       zod:
         specifier: 'catalog:'
         version: 4.6.5
+    optionalDependencies:
+      fsevents:
+        specifier: ~2.3.3
+        version: 2.3.3
 
   packages/core:
     dependencies:
diff --git a/rfcs/vite-core-module-identity.md b/rfcs/vite-core-module-identity.md
index 80b2b60897..3cb0c97dd9 100644
--- a/rfcs/vite-core-module-identity.md
+++ b/rfcs/vite-core-module-identity.md
@@ -121,7 +121,7 @@ Change import specifiers that refer to the CLI's core dependency from
 | Source                                    | Required change                                                         |
 | ----------------------------------------- | ----------------------------------------------------------------------- |
 | `packages/cli/src/index.ts`, `index.cts`  | Re-export Vite APIs through `vite` in both module formats               |
-| `packages/cli/src/pack.ts`, `pack-bin.ts` | Import the bundled tsdown API through `vite/pack`                       |
+| `packages/cli/src/pack.ts`, `pack-bin.ts` | Import the private bundled tsdown API through `#pack`                   |
 | `packages/cli/build.ts`                   | Generate module-runner, internal, client, and type shims through `vite` |
 | `packages/cli/src/define-config.ts`       | Update type imports and review the module augmentation                  |
 | Migration and build metadata readers      | Resolve the declared alias when reading the CLI's core dependency       |
@@ -174,10 +174,51 @@ Use the command's execution directory for project validation, including
 positional root from that directory. Keep the selected CLI as the anchor for
 its required dependency.
 
-Apply these checks before the CLI starts Vite or loads its packaging entry.
+Apply these checks before the CLI starts Vite.
 Retain the distinction between pure `vite.defineConfig()` and the Vite+
 configuration helper, which injects Vite+ plugins.
 
+### Ecosystem CI and independent pack runtime
+
+Issue [#3135](https://github.com/voidzero-dev/vite-plus/issues/3135) requires
+replacing Vite for ecosystem CI, including projects that run `vp pack` during
+installation. Upstream Vite has no `vite/pack` export. Relaxing the version
+check alone cannot support this workflow.
+
+Keep the alias-only dependency graph. Bundle pack inside `vite-plus` through
+the private `#pack` import. Reuse the core build's branded tsdown, extensions,
+Rolldown, pluginutils, declarations, and ESM shims, with relative imports between
+copied files. Copy no Vite code. Declare pack's runtime dependencies and optional
+peers on the CLI. Release builds reuse its existing native platform packages.
+`vite-plus/pack/client` references the copied declarations, and migration uses
+bundled pack version metadata. Standalone core keeps its existing exports.
+
+Public Vite APIs and configuration loading continue to use `vite`. With
+`VP_USE_PROJECT_VITE=1`, allow an upstream package named `vite` instead of the
+exact core release. Still resolve commands from the CLI's own dependency and
+require its resolved package path to equal the project's declared Vite path.
+Version equality is insufficient: a second copy has different constructors.
+Reject partial overrides and separate copies before starting dev/build/preview.
+Read an upstream CLI entry from its public `package.json` `bin` field.
+Without the opt-in, retain the existing core name/version checks.
+
+```mermaid
+flowchart TD
+  project["Project vite"] --> selected["One selected Vite package"]
+  cli["vite-plus"] -->|"vite alias"| selected
+  cli -->|"private #pack"| pack["Bundled pack and Rolldown"]
+  commands["dev / build / preview"] -->|"CLI dependency"| selected
+  api["Vite APIs / config / module-runner"] --> selected
+  vitest["Bundled Vitest"] -->|"Vite peer"| selected
+```
+
+The ecosystem fixture checks both `isRunnableDevEnvironment` exports before
+installing SSR middleware, then requires HTTP 200 from that route. It also
+checks ESM/CJS exports, module-runner identity, Vitest's Vite peer, postinstall
+pack, published/local upstream builds, and rejection of mismatched layouts.
+The API-only server disables its unused WebSocket listener with `ws: false`.
+Keep the existing npm, pnpm, Yarn, Bun, and peer-context identity fixtures.
+
 ### Compatibility and installation
 
 Projects retain `vite` aliases that target `@voidzero-dev/vite-plus-core`.