diff --git a/tsdown.config.ts b/tsdown.config.ts
index c0062b6379..8ad1a5c41c 100644
--- a/tsdown.config.ts
+++ b/tsdown.config.ts
@@ -11,10 +11,10 @@ import { defineConfig } from 'tsdown'
  * (schemastery: dual ESM+CJS; logger-console: extra browser entry).
  */
 export default defineConfig({
-  // Explicit globs keep bundling to vendored Cordis and the TypeScript package tree;
-  // `workspace: true` would discover package manifests outside that bundle set. Landlock
-  // platform packages contain only a prebuilt native binary, so they have no JS entry.
-  workspace: ['vendor/*', 'packages/*/*', 'apps/*'],
+  // Explicit globs keep bundling to vendored Cordis, the TypeScript package tree, and
+  // the Node CLI assembly. `apps/web` is a Vite application with no lib/types entry;
+  // `workspace: true` or `apps/*` would incorrectly treat it as a package bundle.
+  workspace: ['vendor/*', 'packages/*/*', 'apps/cli'],
   // The brace glob admits the package companion when present while retaining the
   // index-only build for vendored Cordis packages outside the Harness package tree.
   entry: ['lib/types/{index,invariant}.js'],