@the-bearded-bear/claude-craft 8.22.0 → 8.23.0

package/Dev/i18n/base/Common/skills/ecosystem-tools/SKILL.md

@@ -21,10 +21,11 @@ See `../../../../docs/ECOSYSTEM.md` for the full catalogue, licenses, and `.mcp.
 
 | Tool | License | Use it for | Rec |
 |------|---------|-----------|-----|
-| **caveman** | MIT | Compress agent **output** ~65% | ✅ Integrate |
+| **caveman** | Apache-2.0 | Compress agent **output** ~65% | ✅ Integrate |
 | **code-review-graph** | MIT | AST graph → read only the blast radius on review | ✅ Integrate |
 | **token-savior** | MIT | Symbol index + Bash output compaction (−80%), RTK alternative | ✅ Integrate |
 | **claude-token-efficient** | MIT | Anti-verbosity CLAUDE.md drop-in | ✅ Integrate |
+| **claude-hud** | MIT | Real-time context/agent/todo monitor (status line) | ✅ Integrate |
 | **context-mode** | ELv2 | Output sandboxing — license blocks commercial redistribution | 🔶 Reference |
 | **claude-context** | MIT | Semantic search; needs a Milvus/Zilliz vector DB | 🔶 Reference |
 

package/Dev/i18n/base/Laravel/rules/06-tooling.md

@@ -284,8 +284,6 @@ return RectorConfig::configure()
 ### docker-compose.yml
 
 ```yaml
-version: '3.8'
-
 services:
     app:
         build:

package/Dev/i18n/base/PHP/checklists/new-feature.md

@@ -45,7 +45,7 @@
 ### Code Quality
 
 - [ ] `declare(strict_types=1)` in all files
-- [ ] PSR-12 coding standards followed
+- [ ] PER-CS 3.0 coding standards followed
 - [ ] PHPStan level 10 passes
 - [ ] PHP-CS-Fixer rules applied
 - [ ] No suppressed warnings without justification

package/Dev/i18n/base/PHP/commands/check-code-quality.md

@@ -15,7 +15,7 @@ Run comprehensive code quality analysis on PHP project.
    - Dead code detection
 
 2. **Code Style**
-   - PSR-12 compliance
+   - PER-CS 3.0 compliance
    - PHP-CS-Fixer rules
    - Naming convention verification
    - Import organization
@@ -95,7 +95,7 @@ parameters:
 return (new PhpCsFixer\Config())
     ->setRiskyAllowed(true)
     ->setRules([
-        '@PSR12' => true,
+        '@PER-CS3x0' => true,
         '@PHP85Migration' => true,
         '@Symfony' => true,
         '@Symfony:risky' => true,
@@ -381,7 +381,7 @@ final class UserRepository implements RepositoryInterface
 - [ ] No deprecated code usage
 
 ### Code Style
-- [ ] PSR-12 compliant
+- [ ] PER-CS 3.0 compliant
 - [ ] PHP-CS-Fixer passes
 - [ ] Imports properly ordered
 - [ ] No unused imports

package/Dev/i18n/base/Vercel/checklists/pre-commit.md

@@ -34,7 +34,7 @@ npx eslint . && tsc --noEmit && npx vitest run && npm run lint:vercel-config
 ### Deprecated Patterns
 
 - [ ] **No new `@vercel/kv` or `@vercel/postgres` import** - these native storage packages are deprecated; use Vercel Blob (native) or the Marketplace integrations (Neon for Postgres, Upstash for KV/Redis) instead
-- [ ] **No new `runtime: 'edge'` declaration** without an explicit migration comment - Edge Runtime is deprecated in favor of Fluid Compute; a legacy handler being touched must carry a comment explaining why it still targets Edge (see the migration note in `templates/function-handler.template.ts`)
+- [ ] **No new `runtime: 'edge'` declaration** without an explicit migration comment - Vercel recommends Fluid Compute over Edge Runtime; a legacy handler being touched must carry a comment explaining why it still targets Edge (see the migration note in `templates/function-handler.template.ts`)
 
 ### Testing
 

package/Dev/i18n/base/Vercel/commands/check-security.md

@@ -18,7 +18,7 @@ Identify security vulnerabilities specific to Vercel's deployment model, mapped
 
 ## SECURITY CHECKS
 
-### 1. Env Var Handling (OWASP #2 Cryptographic Failures, #5 Security Misconfiguration)
+### 1. Env Var Handling (OWASP #4 Cryptographic Failures, #2 Security Misconfiguration)
 
 Scan for:
 - Secrets logged via `console.log(process.env...)` in any `api/` handler
@@ -43,14 +43,14 @@ grep -A3 '"crons"' vercel.json
 grep -n "CRON_SECRET\|x-vercel-cron" api/**/*.ts
 ```
 
-### 3. CORS / CSP Headers in vercel.json (OWASP #1, #5)
+### 3. CORS / CSP Headers in vercel.json (OWASP #1, #2)
 
 Check `headers[]` in `vercel.json`:
 - `Access-Control-Allow-Origin` is not a bare `*` on any route handling authenticated requests
 - CSP (`Content-Security-Policy`) present and restrictive (`script-src`, `frame-ancestors`, `base-uri`)
 - `X-Content-Type-Options: nosniff`, `X-Frame-Options: DENY`, HSTS present
 
-### 4. Marketplace Credential Handling (OWASP #6 Supply Chain, #2 Cryptographic Failures)
+### 4. Marketplace Credential Handling (OWASP #3 Supply Chain, #4 Cryptographic Failures)
 
 For Storage via Marketplace (Neon/Upstash, etc.):
 - Connection strings/API keys stored only as env vars, never committed
@@ -71,7 +71,7 @@ Flag as a **migration item** (not a live vulnerability, but unsupported surface)
 ```bash
 grep -rn "runtime.*=.*['\"]edge['\"]\|export const runtime = 'edge'" api/ middleware.ts
 ```
-Flag as a **migration item**: Edge Runtime is deprecated. Recommend migrating to the Node.js runtime default (Fluid Compute) — never recommend adopting Edge Runtime in new code.
+Flag as a **migration item**: Edge Runtime is discouraged. Recommend migrating to the Node.js runtime default (Fluid Compute) — never recommend adopting Edge Runtime in new code.
 
 ### 7. Dependency Security
 
@@ -89,7 +89,7 @@ VERCEL SECURITY AUDIT
 📊 SECURITY SCORE: XX/100
 Risk Level: 🟢 LOW | 🟡 MEDIUM | 🔴 HIGH | ⚫ CRITICAL
 
-🔑 ENV VAR HANDLING (OWASP #2/#5)
+🔑 ENV VAR HANDLING (OWASP #4/#2)
 ──────────────────────────────────────────────────────────────
 Status: ✅ SECURE | ⚠️ RISKS FOUND | ❌ VULNERABLE
 
@@ -117,7 +117,7 @@ Findings:
     File: vercel.json
     Fix: Restrict to explicit allowed origins
 
-🔐 MARKETPLACE CREDENTIALS (OWASP #6/#2)
+🔐 MARKETPLACE CREDENTIALS (OWASP #3/#4)
 ──────────────────────────────────────────────────────────────
 Status: ✅ LEAST PRIVILEGE | ⚠️ OVERSCOPED
 
@@ -133,7 +133,7 @@ Findings:
 ⚙️ LEGACY EDGE RUNTIME (migration items)
 ──────────────────────────────────────────────────────────────
 [ℹ️ MIGRATION] export const runtime = 'edge' in middleware.ts
-    Fix: Migrate to the Node.js runtime default (Fluid Compute); Edge Runtime is deprecated
+    Fix: Migrate to the Node.js runtime default (Fluid Compute); Edge Runtime is discouraged
 
 📦 DEPENDENCY AUDIT
 ──────────────────────────────────────────────────────────────
@@ -184,14 +184,14 @@ grep -rn "runtime.*=.*['\"]edge['\"]" api/ middleware.ts
 ## SECURITY CHECKLIST
 
 ```
-[ ] No secret env var ever logged (OWASP #2)
-[ ] .env.local gitignored, Preview/Production scoping deliberate (OWASP #5)
+[ ] No secret env var ever logged (OWASP #4)
+[ ] .env.local gitignored, Preview/Production scoping deliberate (OWASP #2)
 [ ] Every crons[] target validates a shared secret before executing (OWASP #1)
 [ ] No cron target reachable unauthenticated as a public route (OWASP #1)
 [ ] CORS restricted to explicit origins on authenticated routes (OWASP #1)
-[ ] CSP/HSTS/nosniff/frame-ancestors present in vercel.json headers[] (OWASP #5)
-[ ] Marketplace credentials scoped to least privilege (OWASP #6)
+[ ] CSP/HSTS/nosniff/frame-ancestors present in vercel.json headers[] (OWASP #2)
+[ ] Marketplace credentials scoped to least privilege (OWASP #3)
 [ ] @vercel/kv / @vercel/postgres usage flagged for Marketplace migration
 [ ] No new code uses Edge Runtime; existing usage flagged for Fluid Compute migration
-[ ] Dependencies audited, no moderate+ vulnerabilities (OWASP #10)
+[ ] Dependencies audited, no moderate+ vulnerabilities (OWASP #3)
 ```

package/Dev/i18n/base/Vercel/rules/00-project-context.md.template

@@ -22,7 +22,7 @@
 | Setting | Value |
 |---------|-------|
 | **Production regions** | {{DEPLOY_REGIONS}} <!-- e.g. iad1, cdg1 — see vercel.json "regions" -->|
-| **Functions runtime** | Node.js runtime (Fluid Compute) <!-- Edge Runtime is deprecated — do not select for new projects --> |
+| **Functions runtime** | Node.js runtime (Fluid Compute) <!-- Edge Runtime is discouraged — do not select for new projects --> |
 | **Cron Jobs** | {{CRON_JOBS_SUMMARY}} <!-- none, or list of schedule/path pairs from vercel.json "crons" --> |
 | **Preview Deployments** | {{PREVIEW_POLICY}} <!-- e.g. auto on every PR, restricted to internal branches --> |
 

package/Dev/i18n/base/Vercel/rules/02-architecture-vercel.md

@@ -188,11 +188,11 @@ Choosing a runtime for an api/** handler or middleware:
 ├─ New code, no prior runtime pinned?
 │   → Default to the Node.js runtime with Fluid Compute.
 │     Full Node API access, bytecode caching gives fast cold
-│     starts on Node 20+, Active CPU pricing (billed for actual
+│     starts on Node 22+, Active CPU pricing (billed for actual
 │     CPU work, not idle wall-clock time).
 │
 ├─ Existing code has `export const runtime = 'edge'`?
-│   → Recognize this as LEGACY. Edge Runtime is deprecated by
+│   → Recognize this as LEGACY. Edge Runtime is discouraged by
 │     Vercel in favor of Fluid Compute. Do not extend or copy
 │     this pattern into new handlers. Flag it during a migration
 │     audit; plan removal of the `runtime = 'edge'` export and

package/Dev/i18n/base/Vercel/rules/03-coding-standards.md

@@ -39,7 +39,7 @@ export default async function handler(
 }
 ```
 
-**Rule**: type the handler with `VercelRequest`/`VercelResponse` from `@vercel/node`, not bare `Request`/`Response` — those are the Web Fetch API types used by the (deprecated-for-new-code) Edge runtime, and mixing the two signatures across the `api/` tree makes the runtime each function targets ambiguous at a glance.
+**Rule**: type the handler with `VercelRequest`/`VercelResponse` from `@vercel/node`, not bare `Request`/`Response` — those are the Web Fetch API types used by the (not-recommended-for-new-code) Edge runtime, and mixing the two signatures across the `api/` tree makes the runtime each function targets ambiguous at a glance.
 
 ### Method Dispatch — Guard Clauses, Not Nested Conditionals
 

package/Dev/i18n/base/Vercel/rules/06-tooling.md

@@ -114,6 +114,18 @@ npx ajv-cli validate -s https://openapi.vercel.sh/vercel.json -d vercel.json
 
 ---
 
+## Platform Updates (CLI 63.x, October 2026)
+
+Verified against the official Vercel docs (October 2026):
+
+- **Node.js runtimes**: `24.x` (default) and `22.x` are available; Node.js 20 is deprecated since 2026-10-01. Pin with `package.json` `engines.node` (e.g. `"24.x"`) or the project setting.
+- **Function duration**: with Fluid Compute (default), the default max duration is 300 s on all plans; the configurable maximum is 300 s on Hobby and 800 s on Pro/Enterprise (up to 1800 s in beta, set per function: `maxDuration` in code or `vercel.json` `functions`).
+- **Edge Runtime**: Vercel recommends migrating from Edge to Node.js (both run on Fluid Compute), see https://vercel.com/docs/functions/runtimes/edge.
+- **`vercel.ts`**: programmatic alternative to `vercel.json` (`npm i @vercel/config`; `import { routes, type VercelConfig } from '@vercel/config/v1'`; `export const config: VercelConfig = { ... }`). Use only one of `vercel.ts` or `vercel.json`.
+- **Bun runtime (Beta)**: opt in with `"bunVersion": "1.x"` (or `"1.4.x"`) in `vercel.json`; Node.js remains the default.
+- **`vercel upgrade`**: upgrades the CLI via the package manager that installed it (`--dry-run` previews the command, `--enable-auto`/`--disable-auto` toggle automatic updates).
+- **`vercel api`**: makes authenticated HTTP requests to the Vercel REST API from the CLI.
+
 ## Storage & Marketplace Tooling
 
 Native (first-party) products are provisioned directly from the CLI or dashboard:

package/Dev/i18n/base/Vercel/rules/07-testing-vercel.md

@@ -20,7 +20,7 @@ Functions on Vercel expose two handler signatures depending on runtime:
 | Runtime | Signature | Status |
 |---------|-----------|--------|
 | **Node.js runtime (Fluid Compute)** — default | `(req: VercelRequest, res: VercelResponse) => void` **or** `(req: Request) => Response` | Current, recommended |
-| **Edge Runtime** | `(req: Request) => Response` | **Deprecated** by Vercel — do not target for new code; only relevant when testing legacy handlers during migration |
+| **Edge Runtime** | `(req: Request) => Response` | **Not recommended** by Vercel — do not target for new code; only relevant when testing legacy handlers during migration |
 
 Prefer the native `Request`/`Response` signature for new handlers under Fluid Compute — it is portable and trivial to unit test without mocking Vercel-specific types.
 

package/Dev/i18n/base/Vercel/rules/08-quality-tools.md

@@ -26,7 +26,7 @@ export default [
       'no-console': ['warn', { allow: ['warn', 'error'] }],
       'no-restricted-globals': [
         'error',
-        { name: 'EdgeRuntime', message: 'Edge Runtime is deprecated by Vercel — target the Node.js runtime (Fluid Compute) instead.' },
+        { name: 'EdgeRuntime', message: 'Edge Runtime is not recommended by Vercel — target the Node.js runtime (Fluid Compute) instead.' },
       ],
     },
   },

package/Dev/i18n/base/Vercel/rules/11-security-vercel.md

@@ -129,7 +129,7 @@ Native `@vercel/kv` and `@vercel/postgres` packages are **deprecated** — curre
 
 ## Edge Runtime Legacy-Code Security Gap
 
-Edge Runtime is **deprecated** by Vercel in favor of Fluid Compute on the Node.js runtime — it should not be targeted for new code. When auditing existing handlers still running on Edge Runtime, treat its reduced API surface as a **security-relevant gap**, not just a compatibility one: the historical absence of Node's `crypto` and `fs` modules on Edge Runtime pushed some codebases toward insecure workarounds (hand-rolled or under-vetted crypto implementations, non-constant-time comparisons for secret/signature checks, or fetching data that should have stayed server-side because a Node-only library couldn't run).
+Vercel recommends migrating from Edge Runtime to Node.js on Fluid Compute (source: vercel.com/docs/functions/runtimes/edge) — it should not be targeted for new code. When auditing existing handlers still running on Edge Runtime, treat its reduced API surface as a **security-relevant gap**, not just a compatibility one: the historical absence of Node's `crypto` and `fs` modules on Edge Runtime pushed some codebases toward insecure workarounds (hand-rolled or under-vetted crypto implementations, non-constant-time comparisons for secret/signature checks, or fetching data that should have stayed server-side because a Node-only library couldn't run).
 
 **Rule**: if a Function still targets Edge Runtime and its diff/history shows a custom crypto or signature-comparison routine, treat it as a migration priority — moving it to the Node.js runtime (Fluid Compute) restores access to Node's `crypto` module (`crypto.timingSafeEqual`, etc.) and removes the reason the workaround existed in the first place.
 

package/Dev/i18n/base/Vercel/templates/function-handler.template.ts

@@ -52,7 +52,7 @@ export default async function handler(req: Request): Promise<Response> {
 
 // ============================================================================
 // Edge Runtime migration notes (placeholder only — do NOT implement Edge
-// Runtime code here; Edge Runtime is deprecated by Vercel).
+// Runtime code here; Edge Runtime is not recommended by Vercel).
 //
 // If this handler is being converted FROM a legacy `export const runtime =
 // 'edge'` file:

package/Dev/i18n/base/Vite/checklists/new-feature.md

@@ -17,13 +17,13 @@
 ## Library Feature (new export)
 
 - [ ] **Exported from `src/index.ts`** - single public entry stays the source of truth
-- [ ] **Peer dependency added** to both `package.json` "peerDependencies" and `build.rollupOptions.external`, if applicable
+- [ ] **Peer dependency added** to both `package.json` "peerDependencies" and `build.rolldownOptions.external`, if applicable
 - [ ] **Type declarations verified** - `vite-plugin-dts` output includes the new export with correct types
 - [ ] **Build-output smoke test updated** - `test/build-output.test.ts` covers the new public API surface
 
 ## Multi-Page Feature (new page)
 
-- [ ] **HTML entry created** and added to `build.rollupOptions.input`
+- [ ] **HTML entry created** and added to top-level `input`
 - [ ] **Entry key is stable, kebab-case**, matches folder/file naming convention
 - [ ] **Shared code factored** into `src/shared/`, not duplicated across page entries
 - [ ] **CSP verified** for the new entry (see `11-security-vite.md`)

package/Dev/i18n/base/Vite/checklists/pre-commit.md

@@ -30,8 +30,8 @@ npx eslint . && tsc -b --noEmit && npx vitest run
 ### Shape-Specific
 
 - [ ] **Vanilla SPA**: `index.html` stayed at project root, not moved into `public/`
-- [ ] **Library**: peer dependencies externalized in `build.rollupOptions.external`, not bundled
-- [ ] **Multi-page**: `build.rollupOptions.input` keys unchanged/stable if renaming was not intentional
+- [ ] **Library**: peer dependencies externalized in `build.rolldownOptions.external`, not bundled
+- [ ] **Multi-page**: top-level `input` keys unchanged/stable if renaming was not intentional
 - [ ] **Worker/WASM**: worker message handler validates payload shape
 
 ### Testing

package/Dev/i18n/base/Vite/commands/check-architecture.md

@@ -24,7 +24,7 @@ Detect which of the four project shapes the codebase implements, and validate it
 [ ] Identify shape: vanilla-spa | library | multi-page | worker-wasm (or a combination)
 [ ] index.html present at project root as a SOURCE file (not under public/) — vanilla-spa/multi-page
 [ ] src/index.ts as the single public entry — library shape
-[ ] build.rollupOptions.input is an object map — multi-page shape
+[ ] build.rolldownOptions.input is an object map — multi-page shape
 [ ] worker/WASM entry points use import.meta.url / ?init — worker-wasm shape
 ```
 
@@ -42,7 +42,7 @@ Detect which of the four project shapes the codebase implements, and validate it
 ```
 [ ] Vanilla SPA: single index.html, <script type="module" src="/src/main.ts">
 [ ] Library: build.lib.entry points to src/index.ts, formats include 'es' and 'cjs'
-[ ] MPA: build.rollupOptions.input keys are stable, kebab-case, match folder/file names
+[ ] MPA: build.rolldownOptions.input keys are stable, kebab-case, match folder/file names
 [ ] Worker/WASM: `new Worker(new URL('./x.worker.ts', import.meta.url), { type: 'module' })` pattern used (no bare string URLs)
 ```
 
@@ -57,7 +57,7 @@ Detect which of the four project shapes the codebase implements, and validate it
 ### 5. Dependency Externalization (library shape)
 
 ```
-[ ] Peer dependencies declared in package.json AND in build.rollupOptions.external
+[ ] Peer dependencies declared in package.json AND in build.rolldownOptions.external
 [ ] package.json "exports" map covers both import and require conditions
 [ ] "sideEffects": false set, unless the library genuinely has side-effectful modules
 ```
@@ -118,11 +118,11 @@ Issues:
 📦 DEPENDENCY EXTERNALIZATION (if library)
 ──────────────────────────────────────────────────────────────
 Peer deps declared: X
-Externalized in rollupOptions.external: X/X
+Externalized in rolldownOptions.external: X/X
 
 Issues:
 - "some-peer-lib" bundled into dist/ instead of externalized
-  → Add to peerDependencies AND build.rollupOptions.external
+  → Add to peerDependencies AND build.rolldownOptions.external
 
 📤 OUTPUT STRUCTURE
 ──────────────────────────────────────────────────────────────

package/Dev/i18n/base/Vite/commands/check-library-build.md

@@ -39,7 +39,7 @@ Confirm the library builds to ES + CJS + `.d.ts`, peer dependencies are correctl
 ### 3. Dependency Externalization
 
 ```
-[ ] Every peer dependency appears in BOTH package.json "peerDependencies" AND build.rollupOptions.external
+[ ] Every peer dependency appears in BOTH package.json "peerDependencies" AND build.rolldownOptions.external
 [ ] No peer dependency's code is present in the built dist/ bundle (verify by inspecting dist/ output or the bundle-visualizer report)
 [ ] Regular (non-peer) dependencies are intentionally bundled, not accidentally externalized
 ```
@@ -95,7 +95,7 @@ Status: ✅ CLEAN | ❌ LEAKS FOUND
 
 Findings:
 [🔴 HIGH] "some-peer-lib" bundled into dist/my-lib.js
-    Fix: Add to peerDependencies and build.rollupOptions.external
+    Fix: Add to peerDependencies and build.rolldownOptions.external
 
 🗂️ PACKAGE.JSON EXPORTS MAP
 ──────────────────────────────────────────────────────────────
@@ -156,7 +156,7 @@ export default defineConfig({
       formats: ['es', 'cjs'],
       fileName: (format) => `my-lib.${format === 'es' ? 'js' : 'cjs'}`,
     },
-    rollupOptions: {
+    rolldownOptions: {
       external: ['some-peer-lib'],
     },
   },

package/Dev/i18n/base/Vite/commands/scaffold-project.md

@@ -59,12 +59,12 @@ npm install -D vite-plugin-dts
 - Move app entry logic out; create `src/index.ts` as the single public entry
 - Rewrite `vite.config.ts` using `templates/vite.config.template.ts` (library section) + `templates/library-entry.template.ts`
 - Add `"main"`, `"module"`, `"types"`, `"exports"`, `"files": ["dist"]`, `"sideEffects": false` to `package.json`
-- Declare any host dependency as a peer dependency, and externalize it in `build.rollupOptions.external`
+- Declare any host dependency as a peer dependency, and externalize it in `build.rolldownOptions.external`
 
 ### Shape: `multi-page`
 
 - Create one HTML file per page (`about.html`, `admin/index.html`, ...) alongside `index.html`
-- Configure `build.rollupOptions.input` as an object map (page name → HTML path) — see `02-architecture-vite.md`, Shape 3
+- Configure top-level `input` as an object map (page name → HTML path) — see `02-architecture-vite.md`, Shape 3
 - Create one `src/<page>.ts` entry per HTML page
 
 ### Shape: `worker-wasm`

package/Dev/i18n/base/Vite/rules/02-architecture-vite.md

@@ -58,7 +58,7 @@ project-root/
 
 ## Shape 2 — Library Authoring
 
-Published as an npm package. Vite bundles `src/index.ts` in **library mode** (`build.lib`), producing ES + CJS outputs plus type declarations via `vite-plugin-dts`. Peer dependencies (e.g. a host framework, if the library happens to wrap one) are excluded from the bundle via `rollupOptions.external`.
+Published as an npm package. Vite bundles `src/index.ts` in **library mode** (`build.lib`), producing ES + CJS outputs plus type declarations via `vite-plugin-dts`. Peer dependencies (e.g. a host framework, if the library happens to wrap one) are excluded from the bundle via `rolldownOptions.external`.
 
 ```
 my-lib/
@@ -98,13 +98,13 @@ my-lib/
 }
 ```
 
-**Rule**: never bundle a peer dependency into the library output — declare it in both `peerDependencies` and `build.rollupOptions.external`, otherwise consumers end up with duplicate copies (and duplicate global state) of that dependency.
+**Rule**: never bundle a peer dependency into the library output — declare it in both `peerDependencies` and `build.rolldownOptions.external`, otherwise consumers end up with duplicate copies (and duplicate global state) of that dependency.
 
 ---
 
 ## Shape 3 — Multi-Page App (MPA)
 
-Multiple independent HTML entry points, each with its own module graph, sharing one `vite.config.ts`. Configured via `build.rollupOptions.input` — an object mapping a page name to its HTML file.
+Multiple independent HTML entry points, each with its own module graph, sharing one `vite.config.ts`. Configured via top-level `input` — an object mapping a page name to its HTML file.
 
 ```
 project-root/
@@ -130,7 +130,7 @@ import { defineConfig } from 'vite'
 
 export default defineConfig({
   build: {
-    rollupOptions: {
+    rolldownOptions: {
       input: {
         main: resolve(__dirname, 'index.html'),
         about: resolve(__dirname, 'about.html'),
@@ -196,7 +196,7 @@ export async function loadImageFilter() {
 - Do not let a "library" project accumulate an `index.html` dev harness inside `src/` — keep a separate `playground/` or `demo/` folder with its own `vite.config.ts` if a local preview is needed.
 
 ### 2. Explicit Entry Points
-- Every HTML entry, worker, and WASM module must be reachable from the module graph via a static, analyzable reference (`rollupOptions.input`, `new URL(..., import.meta.url)`, `?init`). Dynamic string concatenation defeats Vite's static analysis.
+- Every HTML entry, worker, and WASM module must be reachable from the module graph via a static, analyzable reference (`rolldownOptions.input`, `new URL(..., import.meta.url)`, `?init`). Dynamic string concatenation defeats Vite's static analysis.
 
 ### 3. Externalize What You Don't Own
 - Libraries externalize peer dependencies; apps do not — this is the one place library and app configs diverge (see `03-coding-standards.md`).

package/Dev/i18n/base/Vite/rules/03-coding-standards.md

@@ -47,7 +47,7 @@ Keep top-level keys in this order for readability and diff-friendliness:
 4. `envPrefix` / `envDir` (only if overriding the `VITE_` default)
 5. `server` (dev server only)
 6. `preview` (preview server only)
-7. `build` (`lib`, `rollupOptions`, `target`, `sourcemap`)
+7. `build` (`lib`, `rolldownOptions`, `target`, `sourcemap`)
 8. `worker` (worker-specific build options)
 9. `test` (Vitest — co-located, not a separate `vitest.config.ts`, unless the project needs a workspace)
 

package/Dev/i18n/base/Vite/rules/06-tooling.md

@@ -26,7 +26,7 @@ npm create vite@latest my-app -- --template lit-ts
 npm create vite@latest my-app -- --template lit
 ```
 
-After scaffolding a **library**, discard the generated `index.html`/dev harness pattern in favor of the library layout described in `02-architecture-vite.md` — `create vite` templates always scaffold an app shape, never a library shape, so library projects need manual `vite.config.ts` adjustments (`build.lib`, `vite-plugin-dts`, `rollupOptions.external`).
+After scaffolding a **library**, discard the generated `index.html`/dev harness pattern in favor of the library layout described in `02-architecture-vite.md` — `create vite` templates always scaffold an app shape, never a library shape, so library projects need manual `vite.config.ts` adjustments (`build.lib`, `vite-plugin-dts`, `rolldownOptions.external`).
 
 ## Environment API (Vite 6+)
 
@@ -105,7 +105,7 @@ if (import.meta.hot) {
 
 As of Vite 8, the **Rolldown**-powered bundler is the default build engine (previously an opt-in `rolldown-vite` package in Vite 6/7). Practical consequences for framework-agnostic projects:
 
-- `build.rollupOptions` config keys still work for the parts of the API Rolldown re-implements (e.g. `input`, `external`), but some Rollup-specific output options changed shape — notably `output.manualChunks` as an **object** is removed; use `build.rolldownOptions.output.codeSplitting.groups` instead (see `08-quality-tools.md` for a full example).
+- `build.rollupOptions` is **deprecated** since Vite 8 (alias of `build.rolldownOptions`; same for `worker.rollupOptions` and `optimizeDeps.esbuildOptions` → `optimizeDeps.rolldownOptions`) — migrate to `rolldownOptions` (e.g. `input`, `external`), but some Rollup-specific output options changed shape — notably `output.manualChunks` as an **object** is removed; use `build.rolldownOptions.output.codeSplitting.groups` instead (see `08-quality-tools.md` for a full example).
 - Library builds (`build.lib`) and `vite-plugin-dts` both work unchanged under Rolldown.
 - If a project depends on a Rollup-only plugin that hasn't been ported, Rolldown can be disabled per-project (consult the current Vite release notes for the opt-out flag, since this is expected to be phased out over time) — treat this as a temporary escape hatch, not a long-term config.
 

package/Dev/i18n/base/Vite/rules/07-testing-vite.md

@@ -154,7 +154,7 @@ describe('loadImageFilter', () => {
 
 ## Testing Library Build Output
 
-A library's unit tests exercise the **source** (`src/`); a separate smoke test confirms the **published build** (`dist/`) is actually importable and shaped correctly — this catches `rollupOptions.external` misconfigurations and broken `exports` maps that source-level tests cannot see.
+A library's unit tests exercise the **source** (`src/`); a separate smoke test confirms the **published build** (`dist/`) is actually importable and shaped correctly — this catches `rolldownOptions.external` misconfigurations and broken `exports` maps that source-level tests cannot see.
 
 ```typescript
 // test/build-output.test.ts — run AFTER `vite build`, not part of the regular unit suite

package/Dev/i18n/base/Vite/rules/11-security-vite.md

@@ -4,7 +4,7 @@
 
 ## OWASP Top 10:2025 Focus Areas for This Stack
 
-### A05:2025 - Security Misconfiguration — `envPrefix` / `define()` Secret Leakage
+### A02:2025 - Security Misconfiguration — `envPrefix` / `define()` Secret Leakage
 
 Vite inlines any environment variable matching `envPrefix` (default: `VITE_`) directly into the **client** bundle at build time, as plain-text string replacement — there is no runtime secret-fetch, no server boundary. The same is true of anything passed through `define()`. Both are permanent, public leaks once shipped: a value baked into a bundle by `define()` or `VITE_*` is retrievable by anyone who downloads the JS file, forever (until the artifact is rebuilt and redeployed).
 
@@ -38,7 +38,7 @@ VITE_API_BASE_URL=https://api.example.com   // public endpoint, fine to expose
 
 **Custom `envPrefix`**: if a project sets `envPrefix: ['PUBLIC_', 'APP_']` to move away from the `VITE_` convention, audit the prefix change itself — a broader or misconfigured prefix (e.g. accidentally matching `SECRET_` too) silently starts exposing variables that were previously safe by not matching the default `VITE_` filter.
 
-### A05:2025 - Security Misconfiguration — CSP for Multi-Page Apps
+### A02:2025 - Security Misconfiguration — CSP for Multi-Page Apps
 
 Each HTML entry point in an MPA (Shape 3) is a separate document with its own `<head>` — a CSP `<meta>` tag added to `index.html` does **not** propagate to `admin/index.html` or `about.html`. Either template the CSP meta tag into every HTML entry consistently, or (preferred) set it once via server response headers so it applies uniformly regardless of which entry is served.
 
@@ -66,7 +66,7 @@ export default defineConfig({
 
 **Rule**: for a multi-page app, verify the CSP (or its equivalent header configuration on the production host) against *every* entry, not just the root `index.html` — a common gap is a hardened root page next to an `admin/index.html` that was scaffolded later and never got the same treatment.
 
-### A05:2025 - Security Misconfiguration — WASM Sandboxing
+### A02:2025 - Security Misconfiguration — WASM Sandboxing
 
 A WebAssembly module loaded via the `?init` suffix runs inside the **same** JavaScript sandbox as the rest of the page — it gains no elevated OS-level privileges, but it does share the page's origin and any capabilities explicitly passed to it through the imports object. Two practical implications:
 
@@ -87,7 +87,7 @@ export default defineConfig({
 
 **Rule**: never grant a WASM module's imports object a host function it doesn't need (e.g. a raw `fetch` or filesystem-like capability) just because it's convenient — the imports object is the module's entire capability surface; treat it like a permissions list, not a utility bag.
 
-### A03:2025 - Injection — Worker Message Contracts
+### A05:2025 - Injection — Worker Message Contracts
 
 A Web Worker (Shape 4) receiving untrusted `postMessage` payloads (e.g. data forwarded from a third-party iframe, or attacker-influenced input) must validate the message shape before acting on it — `onmessage` has no built-in origin check when the worker is same-document, but if a worker is ever exposed to `postMessage` from other windows/origins, validate `event.origin` before trusting `event.data`.
 

package/Dev/i18n/base/Vite/templates/library-entry.template.ts

@@ -12,7 +12,7 @@ export type { {{PublicType}}, {{PublicOptions}} } from './core/{{public-module}}
 // export * as {{subArea}} from './{{sub-area}}'
 
 // ============================================================================
-// vite.config.ts — build.lib entry + rollupOptions.external example
+// vite.config.ts — build.lib entry + rolldownOptions.external example
 // ============================================================================
 //
 // import { resolve } from 'node:path'
@@ -27,7 +27,7 @@ export type { {{PublicType}}, {{PublicOptions}} } from './core/{{public-module}}
 //       formats: ['es', 'cjs'],
 //       fileName: (format) => `{{PACKAGE_NAME}}.${format === 'es' ? 'js' : 'cjs'}`,
 //     },
-//     rollupOptions: {
+//     rolldownOptions: {
 //       // Peer deps: declared in package.json "peerDependencies" AND excluded
 //       // from the bundle here — never both bundle AND declare as a peer dep.
 //       external: ['{{peer-dependency-name}}', /^{{peer-dependency-name}}\//],

package/Dev/i18n/base/Vite/templates/vite.config.template.ts

@@ -59,14 +59,14 @@ export default defineConfig(({ mode, command }) => ({
     //   formats: ['es', 'cjs'],
     //   fileName: (format) => `{{PACKAGE_NAME}}.${format === 'es' ? 'js' : 'cjs'}`,
     // },
-    // rollupOptions: {
+    // rolldownOptions: {
     //   external: [/* peer deps, e.g. 'some-peer-lib' */],
     // },
 
     // ============================================================
     // {{SHAPE: multi-page}} — object map of page name -> HTML path
     // ============================================================
-    // rollupOptions: {
+    // rolldownOptions: {
     //   input: {
     //     main: resolve(__dirname, 'index.html'),
     //     about: resolve(__dirname, 'about.html'),

package/Dev/i18n/base/VueJS/rules/06-tooling.md

@@ -277,7 +277,7 @@ auto-install-peers=true
 pnpm install
 
 # Add dependency
-pnpm add vue-router pinia
+pnpm add vue-router pinia @vue/devtools-api
 
 # Add dev dependency
 pnpm add -D vitest @vue/test-utils
@@ -349,7 +349,8 @@ const router = createRouter({ history: createWebHistory() });
   "dependencies": {
     "vue": "^3.5.0",
     "vue-router": "^5.0.0",
-    "pinia": "^3.0.0"
+    "pinia": "^4.0.0",
+    "@vue/devtools-api": "^8.0.0"
   },
   "devDependencies": {
     "@types/node": "^20.0.0",

package/Dev/i18n/de/Angular/agents/angular-reviewer.md

@@ -46,8 +46,8 @@ Ist der Zustand synchron und wird für das Rendering verwendet?
 
 **Zoneless als Standard (stabil) :**
 - ~33 KB Bundle-Einsparung (Zone.js optional)
-- +30-40% Rendering-Performance-Verbesserung laut Angular DevRel
-- Stabile API: `provideZonelessChangeDetection()` aus `@angular/core` (nicht mehr `Experimental`)
+- Performance-Gewinne variieren je nach Anwendung (die Zahl „+30-40 %“ stammt aus einer Quelle von 2024): messen, nicht annehmen
+- Kein Provider ab v21/v22 erforderlich: `provideZonelessChangeDetection()` wird nur in v20 benötigt (https://angular.dev/guide/zoneless)
 
 **Signal Forms (stabil v22) :**
 - Natives signal-basiertes Alternative zu Reactive Forms, **produktionsreif**
@@ -421,7 +421,7 @@ Verwendet die Anwendung Zoneless Change Detection?
     JA --> Lösen Event-Listener die CD korrekt aus?
   NEIN --> Wird Zone.js verwendet?
     JA --> GERINGFÜGIG in v22+: Migration zu Zoneless empfohlen (spart ~33 KB)
-    NEIN --> Sicherstellen, dass provideZonelessChangeDetection() konfiguriert ist (stabil seit v20.2)
+    NEIN --> Sicherstellen, dass kein provideZoneChangeDetection() Zone.js reaktiviert (zoneless standardmäßig seit v21)
 
 Wird httpResource() für repetitive HTTP-Anfragen verwendet?
   NEIN --> Verwenden Komponenten signal + effect + HttpClient?

package/Dev/i18n/de/Common/agents/devops-engineer.md

@@ -7,6 +7,20 @@ maxTurns: 8
 tools: [Read, Glob, Grep, Edit, Write, Bash, WebFetch, WebSearch]
 permissionMode: default
 skills: [security, git-workflow]
+disallowedTools:
+  - "Bash(rm -rf:*)"
+  - "Bash(dd:*)"
+  - "Bash(mkfs:*)"
+  - "Bash(kubectl delete:*)"
+  - "Bash(helm uninstall:*)"
+  - "Bash(terraform destroy:*)"
+  - "Bash(tofu destroy:*)"
+  - "Bash(docker system prune -a*)"
+  - "Bash(docker volume rm:*)"
+  - "Bash(curl * | sh*)"
+  - "Bash(wget * | sh*)"
+  - "Bash(git push --force*)"
+  - "Bash(git push -f*)"
 ---
 
 # DevOps Engineer Agent
@@ -31,7 +45,7 @@ Sie sind ein **Senior DevOps Engineer** mit über 10 Jahren Erfahrung in CI/CD,
 | Docker | Multi-Stage-Builds, Image-Optimierung, Security-Scanning |
 | Docker Compose | Lokale Orchestrierung, Profiles, Extensions |
 | Kubernetes | Deployments, Services, Ingress, ConfigMaps, Secrets |
-| Helm | Charts, Values, Templating | 4.2.0 (MAJOR — Server-Side Apply, WASM-Plugins, API v4 ; Helm 3 Sicherheits-EOL Nov. 2026) |
+| Helm | Charts, Values, Templating | 4.2.2 (Helm 4 = MAJOR — Server-Side Apply, WASM-Plugins, API v4 ; Helm 3 Sicherheits-EOL Nov. 2026) |
 
 ### Cloud-Provider
 | Provider | Services |

package/Dev/i18n/de/Common/agents/ralph-conductor.md

@@ -5,8 +5,19 @@ model: opus
 effort: xhigh
 maxTurns: 10
 memory: user
-tools: [Read, Glob, Grep, Edit, Write, Bash, Task, WebFetch, WebSearch]
+tools: [Read, Glob, Grep, Edit, Write, Bash, Agent, WebFetch, WebSearch]
 permissionMode: default
+disallowedTools:
+  - "Bash(rm -rf:*)"
+  - "Bash(dd:*)"
+  - "Bash(mkfs:*)"
+  - "Bash(:(){:|:&};:*)"
+  - "Bash(sudo:*)"
+  - "Bash(chmod 777:*)"
+  - "Bash(curl * | sh*)"
+  - "Bash(wget * | sh*)"
+  - "Bash(git push --force*)"
+  - "Bash(git push -f*)"
 ---
 
 # Ralph Conductor Agent v2.0