Vite 6 Environment API Cross-Realm Prototype Isolation & Scope Boundary Standard

--- description: Vite 6 Environment API Cross-Realm Prototype Isolation & Scope Boundary Standard - Enforces strict prototype isolation and cross-realm defensive boundaries when executing multiple SSR microfrontend islands using the Vite 6 Environment API. Prevents runtime cross-contamination, memory leaks across HMR cycles, and prototype pollution caused by shared global intrinsics. globs: vite.config.{ts,js}, src/**/*.{ts,tsx}, server/**/*.{ts,js} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/vite6-cross-realm-prototype-isolation" --- # Vite 6 Environment API Cross-Realm Prototype Isolation & Scope Boundary Standard > **Severity**: CRITICAL | **Category**: frontend > **Anti-Pattern Warning**: Mutating Shared Global Intrinsics or Exchanging Raw Uncloned Objects Across Vite 6 Environment Boundaries ## System Constraints You are a Principal Architect enforcing strict runtime and prototype isolation for Vite 6 Environment API implementations. Vite 6 enables multi-environment execution (e.g., client, ssr, edge, microfrontend islands) within a unified dev server. When multiple islands execute in shared or adjacent environments, mutating global intrinsics (Object.prototype, Array.prototype, globalThis) or passing raw object references across realm boundaries causes cross-island state leakage, prototype pollution, and 'instanceof' parity failures. Enforce zero-leakage cross-realm communication, structured cloning, clean V8 contexts, and brand checking. ## Strict Guidelines - Engineers MUST ALWAYS isolate execution runtimes into discrete V8 realms (e.g., using isolated worker threads or dedicated vm.Context inside custom RunnableDevEnvironment instances) when hosting independent microfrontend islands. - Engineers MUST NOT mutate built-in prototypes (Object.prototype, Array.prototype, Promise.prototype) or attach shared mutable state to globalThis within Vite environment module graphs. - Services MUST detach cross-realm prototype chains by running transport payloads through structuredClone() or explicit JSON serialization before transferring data between environment instances (e.g., from an island runner to the host SSR aggregator). - Code SHOULD rely on structural validation, brand symbols, or schema guards (e.g., Zod, ArkType) instead of 'instanceof' checks when consuming objects received across realm boundaries. - Components NEVER expose environment-specific singletons or global polyfill side-effects that execute unconditionally across multi-tenant island evaluation cycles. ## Bad vs Good Implementations ### Cross-Environment Dispatch and Prototype Leakage Prevention #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Mutating Array.prototype pollutes all environments running within the Node.js process. Passing rawProps directly exposes prototype chains across realms, allowing malicious or accidental prototype tampering between microfrontends. Using 'instanceof Array' fails when objects originate from different V8 execution realms. ```typescript import type { DevEnvironment, ViteDevServer } from 'vite'; // ANTI-PATTERN: Shared global modification & direct reference passing across environments declare global { interface Array<T> { toCustomIslandFormat(): string[]; } } // Leaks polyfill to all islands executing in the same Node.js process Array.prototype.toCustomIslandFormat = function () { return this.map((item) => `island:${String(item)}`); }; export async function renderIslandUnsafe( server: ViteDevServer, islandEnvName: string, rawProps: Record<string, unknown> ) { const env = server.environments[islandEnvName] as DevEnvironment; // Passing rawProps directly retains caller's prototype chain and shared mutable references const islandRunner = await env.runner.import('/src/island-entry.ts'); // Using instanceof across environment boundaries breaks or yields false negatives if (rawProps.data instanceof Array) { return islandRunner.render(rawProps); } throw new TypeError('Invalid payload: not an Array'); } ``` #### Production Standard (Correct) > **Standard**: The good pattern utilizes structuredClone() to sever foreign prototype chains and prevent cross-realm object tampering. It replaces brittle 'instanceof' checks with structural and brand-based type guards, and verifies that the target Vite 6 environment exists before invoking its runner. ```typescript import type { DevEnvironment, ViteDevServer } from 'vite'; // PRODUCTION INVARIANT: Realm-isolated dispatch with structured cloning and brand checks export interface IslandPayload { readonly __brand: 'IslandPayload'; readonly items: readonly string[]; } function isIslandPayload(value: unknown): value is IslandPayload { return ( typeof value === 'object' && value !== null && '__brand' in value && (value as IslandPayload).__brand === 'IslandPayload' && Array.isArray((value as IslandPayload).items) ); } export async function renderIslandIsolated( server: ViteDevServer, islandEnvName: string, incomingData: unknown ): Promise<string> { const env = server.environments[islandEnvName] as DevEnvironment | undefined; if (!env) { throw new Error(`Environment '${islandEnvName}' is not registered on Vite server.`); } // Neutralize prototype pollution and sever cross-realm memory links const sanitized = structuredClone(incomingData); if (!isIslandPayload(sanitized)) { throw new TypeError('Contract violation: Payload failed structural validation.'); } // Freeze top-level to prevent runtime mutation during island execution Object.freeze(sanitized); const islandModule = await env.runner.import('/src/island-entry.ts'); return islandModule.render(sanitized); } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Vite 6 Environment API Cross-Realm Prototype Isolation & Scope Boundary Standard

Vite 6 Environment API Cross-Realm Prototype Isolation & Scope Boundary Standard defines an industrial-grade behavioral standard for frontend engineering. Enforces strict prototype isolation and cross-realm defensive boundaries when executing multiple SSR microfrontend islands using the Vite 6 Environment API. Prevents runtime cross-contamination, memory leaks across HMR cycles, and prototype pollution caused by shared global intrinsics. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Mutating Shared Global Intrinsics or Exchanging Raw Uncloned Objects Across Vite 6 Environment Boundaries Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Mutating Shared Global Intrinsics or Exchanging Raw Uncloned Objects Across Vite 6 Environment Boundaries	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS isolate execution runtimes into discrete V8 realms (e.g., using isolated worker threads or dedicated vm.Context inside custom RunnableDevEnvironment instances) when hosting independent microfrontend islands.

Engineers MUST ALWAYS isolate execution runtimes into discrete V8 realms (e.g., using isolated worker threads or dedicated vm.Context inside custom RunnableDevEnvironment instances) when hosting independent microfrontend islands.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.