@warlock.js/core 5.35.0 → 5.36.0

package/esm/upgrade/codemods/vite-vitest.mjs

@@ -0,0 +1,170 @@
+import { manualAt, replaceNode } from "./helpers.mjs";
+import { parseVersion } from "../version.mjs";
+
+//#region ../../packages/core/src/upgrade/codemods/vite-vitest.ts
+/**
+* The newest releases that are at least two weeks old on the day 5.36 shipped;
+* `warlock add test` and `warlock add web` install the same ones.
+*/
+const TARGETS = {
+	vite: {
+		major: 8,
+		version: "8.3.3"
+	},
+	vitest: {
+		major: 5,
+		version: "5.0.3"
+	},
+	"@vitest/coverage-v8": {
+		major: 5,
+		version: "5.0.3"
+	},
+	"@vitest/coverage-istanbul": {
+		major: 5,
+		version: "5.0.3"
+	},
+	"@vitest/ui": {
+		major: 5,
+		version: "5.0.3"
+	},
+	"@vitejs/plugin-react": {
+		major: 6,
+		version: "6.1.2"
+	}
+};
+const MIGRATION_GUIDES = "https://vite.dev/guide/migration and https://vitest.dev/guide/migration";
+/** Version specs that are not a plain registry range and must not be rewritten. */
+const NON_REGISTRY_SPEC = /^(workspace:|file:|link:|portal:|git|github:|https?:|npm:)|^\*$|^latest$/;
+/** Entry points Vitest 5 removed. `vitest/runners` is handled separately. */
+const REMOVED_ENTRY_POINTS = /* @__PURE__ */ new Set([
+	"vitest/coverage",
+	"vitest/reporters",
+	"vitest/environments",
+	"vitest/snapshot",
+	"vitest/suite",
+	"vitest/mocker",
+	"vitest/internal/module-runner"
+]);
+const VITE_CONFIG_FILE = /^vite(st)?\.config\.(ts|mts|cts|js|mjs|cjs)$/;
+function serialize(original, value) {
+	const indent = /^[ \t]+(?=")/m.exec(original)?.[0];
+	return (indent ? JSON.stringify(value, null, indent) : JSON.stringify(value)) + (original.endsWith("\n") ? "\n" : "");
+}
+function lineOf(source, needle) {
+	const index = source.indexOf(needle);
+	return index < 0 ? 1 : source.slice(0, index).split("\n").length;
+}
+/** The spec moved to `target`, keeping its `^`/`~`/exact style; undefined when it already allows it. */
+function upgradedSpec(spec, target) {
+	if (NON_REGISTRY_SPEC.test(spec)) return void 0;
+	const parsed = parseVersion(spec);
+	if (!parsed || parsed[0] >= target.major) return void 0;
+	return `${/^[\^~]/.exec(spec)?.[0] ?? (/^\d/.test(spec) ? "" : "^")}${target.version}`;
+}
+/**
+* 5.36: Vite 8 (Rolldown), Vitest 5 and `@vitejs/plugin-react` 6 are one
+* family and must move together.
+*
+* - package.json: raises `vite`, `vitest`, `@vitest/*` and
+*   `@vitejs/plugin-react` (dependencies, devDependencies, `overrides` and
+*   `resolutions`) to the supported majors.
+* - `src/test-runner.ts`-style runners: Vitest 5 has no `vitest/runners`; the
+*   runner class is `TestRunner`, exported from `vitest`, and
+*   `onCleanupWorkerContext` is an optional property.
+* - Lists removed Vitest entry points, a top-level `esbuild` option, and object
+*   `manualChunks` in Vite configs for review.
+*/
+const viteVitest = {
+	id: "vite-8-vitest-5",
+	version: "5.36.0",
+	package: "@warlock.js/core",
+	title: "Move to Vite 8, Vitest 5 and @vitejs/plugin-react 6",
+	skill: "upgrade-from-5-29",
+	run(context) {
+		const { Node, SyntaxKind } = context.tsMorph;
+		const output = {
+			edits: [],
+			manual: []
+		};
+		const source = context.text.read("package.json");
+		if (source !== void 0) {
+			const pkg = JSON.parse(source);
+			const changes = [];
+			for (const field of [
+				"dependencies",
+				"devDependencies",
+				"overrides",
+				"resolutions"
+			]) {
+				const entries = pkg[field];
+				if (!entries) continue;
+				for (const [name, target] of Object.entries(TARGETS)) {
+					const spec = entries[name];
+					if (typeof spec !== "string") continue;
+					const next = upgradedSpec(spec, target);
+					if (!next) continue;
+					entries[name] = next;
+					changes.push({
+						name: field === "dependencies" || field === "devDependencies" ? name : `${field}.${name}`,
+						from: spec,
+						to: next
+					});
+				}
+			}
+			const first = changes[0];
+			if (first) context.text.write("package.json", serialize(source, pkg), {
+				line: lineOf(source, `"${first.name.replace(/^[a-z]+\./, "")}"`),
+				description: changes.map((change) => `${change.name} ${change.from} → ${change.to}`).join(", ")
+			});
+		}
+		for (const sourceFile of context.sourceFiles) for (const declaration of sourceFile.getImportDeclarations()) {
+			const moduleName = declaration.getModuleSpecifierValue();
+			if (REMOVED_ENTRY_POINTS.has(moduleName)) {
+				output.manual.push(manualAt(context, declaration, `Vitest 5 removed the "${moduleName}" entry point. Import from "vitest" or "vitest/node" instead; see ${MIGRATION_GUIDES}.`));
+				continue;
+			}
+			if (moduleName !== "vitest/runners") continue;
+			const specifiers = declaration.getNamedImports();
+			const runner = specifiers.find((specifier) => specifier.getName() === "VitestTestRunner");
+			if (!runner || specifiers.length !== 1 || declaration.getDefaultImport()) {
+				output.manual.push(manualAt(context, declaration, "Vitest 5 removed \"vitest/runners\". Import the runner class as `TestRunner` from \"vitest\"; benchmark runners no longer exist."));
+				continue;
+			}
+			const alias = runner.getAliasNode()?.getText();
+			output.edits.push(replaceNode(context, declaration, alias ? `import { TestRunner as ${alias} } from "vitest";` : "import { TestRunner } from \"vitest\";", "imported the runner as TestRunner from \"vitest\""));
+			if (!alias) for (const identifier of sourceFile.getDescendantsOfKind(SyntaxKind.Identifier)) {
+				if (identifier.getText() !== "VitestTestRunner") continue;
+				if (identifier.getFirstAncestorByKind(SyntaxKind.ImportDeclaration)) continue;
+				output.edits.push(replaceNode(context, identifier, "TestRunner", "renamed VitestTestRunner to TestRunner"));
+			}
+			for (const call of sourceFile.getDescendantsOfKind(SyntaxKind.CallExpression)) {
+				const callee = call.getExpression();
+				if (!Node.isPropertyAccessExpression(callee) || callee.getName() !== "onCleanupWorkerContext" || call.getQuestionDotTokenNode()) continue;
+				output.edits.push(replaceNode(context, callee, `${callee.getText()}?.`, "onCleanupWorkerContext is optional in Vitest 5 (absent in vm pools)"));
+			}
+		}
+		for (const file of context.text.list()) {
+			if (!VITE_CONFIG_FILE.test(file)) continue;
+			const config = context.text.read(file);
+			if (config === void 0) continue;
+			config.split("\n").forEach((text, index) => {
+				const line = index + 1;
+				if (/^\s*esbuild\s*:/.test(text)) output.manual.push({
+					file,
+					line,
+					hint: "Vite 8 transforms TypeScript and JSX with Oxc: move this `esbuild` option to `oxc` (jsx, define, include/exclude convert; `target` does not). Oxc does not lower native decorators; keep `lowerStage3Decorators()` in `plugins` for decorated modules."
+				});
+				if (/\bmanualChunks\s*:\s*\{/.test(text)) output.manual.push({
+					file,
+					line,
+					hint: "Vite 8 (Rolldown) removed the object form of `output.manualChunks`. Use `output.codeSplitting.groups` with `name` and `test`."
+				});
+			});
+		}
+		return output;
+	}
+};
+
+//#endregion
+export { viteVitest };
+//# sourceMappingURL=vite-vitest.mjs.map

package/esm/upgrade/codemods/vite-vitest.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"vite-vitest.mjs","names":[],"sources":["../../../../../../../../../packages/core/src/upgrade/codemods/vite-vitest.ts"],"sourcesContent":["import type { Codemod, CodemodOutput } from \"../types\";\nimport { parseVersion } from \"../version\";\nimport { manualAt, replaceNode } from \"./helpers\";\n\n/**\n * The newest releases that are at least two weeks old on the day 5.36 shipped;\n * `warlock add test` and `warlock add web` install the same ones.\n */\nconst TARGETS: Record<string, { major: number; version: string }> = {\n  vite: { major: 8, version: \"8.3.3\" },\n  vitest: { major: 5, version: \"5.0.3\" },\n  \"@vitest/coverage-v8\": { major: 5, version: \"5.0.3\" },\n  \"@vitest/coverage-istanbul\": { major: 5, version: \"5.0.3\" },\n  \"@vitest/ui\": { major: 5, version: \"5.0.3\" },\n  \"@vitejs/plugin-react\": { major: 6, version: \"6.1.2\" },\n};\n\nconst MIGRATION_GUIDES = \"https://vite.dev/guide/migration and https://vitest.dev/guide/migration\";\n\n/** Version specs that are not a plain registry range and must not be rewritten. */\nconst NON_REGISTRY_SPEC =\n  /^(workspace:|file:|link:|portal:|git|github:|https?:|npm:)|^\\*$|^latest$/;\n\n/** Entry points Vitest 5 removed. `vitest/runners` is handled separately. */\nconst REMOVED_ENTRY_POINTS = new Set([\n  \"vitest/coverage\",\n  \"vitest/reporters\",\n  \"vitest/environments\",\n  \"vitest/snapshot\",\n  \"vitest/suite\",\n  \"vitest/mocker\",\n  \"vitest/internal/module-runner\",\n]);\n\nconst VITE_CONFIG_FILE = /^vite(st)?\\.config\\.(ts|mts|cts|js|mjs|cjs)$/;\n\ntype PackageJson = Record<string, unknown> & {\n  dependencies?: Record<string, unknown>;\n  devDependencies?: Record<string, unknown>;\n  overrides?: Record<string, unknown>;\n  resolutions?: Record<string, unknown>;\n};\n\nfunction serialize(original: string, value: unknown): string {\n  const indent = /^[ \\t]+(?=\")/m.exec(original)?.[0];\n  const json = indent ? JSON.stringify(value, null, indent) : JSON.stringify(value);\n  return json + (original.endsWith(\"\\n\") ? \"\\n\" : \"\");\n}\n\nfunction lineOf(source: string, needle: string): number {\n  const index = source.indexOf(needle);\n  return index < 0 ? 1 : source.slice(0, index).split(\"\\n\").length;\n}\n\n/** The spec moved to `target`, keeping its `^`/`~`/exact style; undefined when it already allows it. */\nfunction upgradedSpec(spec: string, target: { major: number; version: string }) {\n  if (NON_REGISTRY_SPEC.test(spec)) return undefined;\n  const parsed = parseVersion(spec);\n  // `>=7.3.5 <8` and ranges like it are rewritten too: the lower bound is what is read.\n  if (!parsed || parsed[0] >= target.major) return undefined;\n  const prefix = /^[\\^~]/.exec(spec)?.[0] ?? (/^\\d/.test(spec) ? \"\" : \"^\");\n  return `${prefix}${target.version}`;\n}\n\n/**\n * 5.36: Vite 8 (Rolldown), Vitest 5 and `@vitejs/plugin-react` 6 are one\n * family and must move together.\n *\n * - package.json: raises `vite`, `vitest`, `@vitest/*` and\n *   `@vitejs/plugin-react` (dependencies, devDependencies, `overrides` and\n *   `resolutions`) to the supported majors.\n * - `src/test-runner.ts`-style runners: Vitest 5 has no `vitest/runners`; the\n *   runner class is `TestRunner`, exported from `vitest`, and\n *   `onCleanupWorkerContext` is an optional property.\n * - Lists removed Vitest entry points, a top-level `esbuild` option, and object\n *   `manualChunks` in Vite configs for review.\n */\nexport const viteVitest: Codemod = {\n  id: \"vite-8-vitest-5\",\n  version: \"5.36.0\",\n  package: \"@warlock.js/core\",\n  title: \"Move to Vite 8, Vitest 5 and @vitejs/plugin-react 6\",\n  skill: \"upgrade-from-5-29\",\n  run(context) {\n    const { Node, SyntaxKind } = context.tsMorph;\n    const output: CodemodOutput = { edits: [], manual: [] };\n\n    const source = context.text.read(\"package.json\");\n    if (source !== undefined) {\n      const pkg = JSON.parse(source) as PackageJson;\n      const changes: { name: string; from: string; to: string }[] = [];\n      for (const field of [\n        \"dependencies\",\n        \"devDependencies\",\n        \"overrides\",\n        \"resolutions\",\n      ] as const) {\n        const entries = pkg[field];\n        if (!entries) continue;\n        for (const [name, target] of Object.entries(TARGETS)) {\n          const spec = entries[name];\n          if (typeof spec !== \"string\") continue;\n          const next = upgradedSpec(spec, target);\n          if (!next) continue;\n          entries[name] = next;\n          changes.push({\n            name:\n              field === \"dependencies\" || field === \"devDependencies\" ? name : `${field}.${name}`,\n            from: spec,\n            to: next,\n          });\n        }\n      }\n      const first = changes[0];\n      if (first) {\n        context.text.write(\"package.json\", serialize(source, pkg), {\n          line: lineOf(source, `\"${first.name.replace(/^[a-z]+\\./, \"\")}\"`),\n          description: changes\n            .map((change) => `${change.name} ${change.from} → ${change.to}`)\n            .join(\", \"),\n        });\n      }\n    }\n\n    for (const sourceFile of context.sourceFiles) {\n      for (const declaration of sourceFile.getImportDeclarations()) {\n        const moduleName = declaration.getModuleSpecifierValue();\n\n        if (REMOVED_ENTRY_POINTS.has(moduleName)) {\n          output.manual.push(\n            manualAt(\n              context,\n              declaration,\n              `Vitest 5 removed the \"${moduleName}\" entry point. Import from \"vitest\" or \"vitest/node\" instead; see ${MIGRATION_GUIDES}.`,\n            ),\n          );\n          continue;\n        }\n        if (moduleName !== \"vitest/runners\") continue;\n\n        const specifiers = declaration.getNamedImports();\n        const runner = specifiers.find((specifier) => specifier.getName() === \"VitestTestRunner\");\n        if (!runner || specifiers.length !== 1 || declaration.getDefaultImport()) {\n          output.manual.push(\n            manualAt(\n              context,\n              declaration,\n              'Vitest 5 removed \"vitest/runners\". Import the runner class as `TestRunner` from \"vitest\"; benchmark runners no longer exist.',\n            ),\n          );\n          continue;\n        }\n\n        const alias = runner.getAliasNode()?.getText();\n        output.edits.push(\n          replaceNode(\n            context,\n            declaration,\n            alias\n              ? `import { TestRunner as ${alias} } from \"vitest\";`\n              : 'import { TestRunner } from \"vitest\";',\n            'imported the runner as TestRunner from \"vitest\"',\n          ),\n        );\n\n        if (!alias) {\n          for (const identifier of sourceFile.getDescendantsOfKind(SyntaxKind.Identifier)) {\n            if (identifier.getText() !== \"VitestTestRunner\") continue;\n            if (identifier.getFirstAncestorByKind(SyntaxKind.ImportDeclaration)) continue;\n            output.edits.push(\n              replaceNode(\n                context,\n                identifier,\n                \"TestRunner\",\n                \"renamed VitestTestRunner to TestRunner\",\n              ),\n            );\n          }\n        }\n\n        for (const call of sourceFile.getDescendantsOfKind(SyntaxKind.CallExpression)) {\n          const callee = call.getExpression();\n          if (\n            !Node.isPropertyAccessExpression(callee) ||\n            callee.getName() !== \"onCleanupWorkerContext\" ||\n            call.getQuestionDotTokenNode()\n          ) {\n            continue;\n          }\n          output.edits.push(\n            replaceNode(\n              context,\n              callee,\n              `${callee.getText()}?.`,\n              \"onCleanupWorkerContext is optional in Vitest 5 (absent in vm pools)\",\n            ),\n          );\n        }\n      }\n    }\n\n    for (const file of context.text.list()) {\n      if (!VITE_CONFIG_FILE.test(file)) continue;\n      const config = context.text.read(file);\n      if (config === undefined) continue;\n      const lines = config.split(\"\\n\");\n      lines.forEach((text, index) => {\n        const line = index + 1;\n        if (/^\\s*esbuild\\s*:/.test(text)) {\n          output.manual.push({\n            file,\n            line,\n            hint: \"Vite 8 transforms TypeScript and JSX with Oxc: move this `esbuild` option to `oxc` (jsx, define, include/exclude convert; `target` does not). Oxc does not lower native decorators; keep `lowerStage3Decorators()` in `plugins` for decorated modules.\",\n          });\n        }\n        if (/\\bmanualChunks\\s*:\\s*\\{/.test(text)) {\n          output.manual.push({\n            file,\n            line,\n            hint: \"Vite 8 (Rolldown) removed the object form of `output.manualChunks`. Use `output.codeSplitting.groups` with `name` and `test`.\",\n          });\n        }\n      });\n    }\n\n    return output;\n  },\n};\n"],"mappings":";;;;;;;;AAQA,MAAM,UAA8D;CAClE,MAAM;EAAE,OAAO;EAAG,SAAS;CAAQ;CACnC,QAAQ;EAAE,OAAO;EAAG,SAAS;CAAQ;CACrC,uBAAuB;EAAE,OAAO;EAAG,SAAS;CAAQ;CACpD,6BAA6B;EAAE,OAAO;EAAG,SAAS;CAAQ;CAC1D,cAAc;EAAE,OAAO;EAAG,SAAS;CAAQ;CAC3C,wBAAwB;EAAE,OAAO;EAAG,SAAS;CAAQ;AACvD;AAEA,MAAM,mBAAmB;;AAGzB,MAAM,oBACJ;;AAGF,MAAM,uCAAuB,IAAI,IAAI;CACnC;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,MAAM,mBAAmB;AASzB,SAAS,UAAU,UAAkB,OAAwB;CAC3D,MAAM,SAAS,gBAAgB,KAAK,QAAQ,CAAC,GAAG;CAEhD,QADa,SAAS,KAAK,UAAU,OAAO,MAAM,MAAM,IAAI,KAAK,UAAU,KAAK,MACjE,SAAS,SAAS,IAAI,IAAI,OAAO;AAClD;AAEA,SAAS,OAAO,QAAgB,QAAwB;CACtD,MAAM,QAAQ,OAAO,QAAQ,MAAM;CACnC,OAAO,QAAQ,IAAI,IAAI,OAAO,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;AAC5D;;AAGA,SAAS,aAAa,MAAc,QAA4C;CAC9E,IAAI,kBAAkB,KAAK,IAAI,GAAG,OAAO;CACzC,MAAM,SAAS,aAAa,IAAI;CAEhC,IAAI,CAAC,UAAU,OAAO,MAAM,OAAO,OAAO,OAAO;CAEjD,OAAO,GADQ,SAAS,KAAK,IAAI,CAAC,GAAG,OAAO,MAAM,KAAK,IAAI,IAAI,KAAK,OACjD,OAAO;AAC5B;;;;;;;;;;;;;;AAeA,MAAa,aAAsB;CACjC,IAAI;CACJ,SAAS;CACT,SAAS;CACT,OAAO;CACP,OAAO;CACP,IAAI,SAAS;EACX,MAAM,EAAE,MAAM,eAAe,QAAQ;EACrC,MAAM,SAAwB;GAAE,OAAO,CAAC;GAAG,QAAQ,CAAC;EAAE;EAEtD,MAAM,SAAS,QAAQ,KAAK,KAAK,cAAc;EAC/C,IAAI,WAAW,QAAW;GACxB,MAAM,MAAM,KAAK,MAAM,MAAM;GAC7B,MAAM,UAAwD,CAAC;GAC/D,KAAK,MAAM,SAAS;IAClB;IACA;IACA;IACA;GACF,GAAY;IACV,MAAM,UAAU,IAAI;IACpB,IAAI,CAAC,SAAS;IACd,KAAK,MAAM,CAAC,MAAM,WAAW,OAAO,QAAQ,OAAO,GAAG;KACpD,MAAM,OAAO,QAAQ;KACrB,IAAI,OAAO,SAAS,UAAU;KAC9B,MAAM,OAAO,aAAa,MAAM,MAAM;KACtC,IAAI,CAAC,MAAM;KACX,QAAQ,QAAQ;KAChB,QAAQ,KAAK;MACX,MACE,UAAU,kBAAkB,UAAU,oBAAoB,OAAO,GAAG,MAAM,GAAG;MAC/E,MAAM;MACN,IAAI;KACN,CAAC;IACH;GACF;GACA,MAAM,QAAQ,QAAQ;GACtB,IAAI,OACF,QAAQ,KAAK,MAAM,gBAAgB,UAAU,QAAQ,GAAG,GAAG;IACzD,MAAM,OAAO,QAAQ,IAAI,MAAM,KAAK,QAAQ,aAAa,EAAE,EAAE,EAAE;IAC/D,aAAa,QACV,KAAK,WAAW,GAAG,OAAO,KAAK,GAAG,OAAO,KAAK,KAAK,OAAO,IAAI,CAAC,CAC/D,KAAK,IAAI;GACd,CAAC;EAEL;EAEA,KAAK,MAAM,cAAc,QAAQ,aAC/B,KAAK,MAAM,eAAe,WAAW,sBAAsB,GAAG;GAC5D,MAAM,aAAa,YAAY,wBAAwB;GAEvD,IAAI,qBAAqB,IAAI,UAAU,GAAG;IACxC,OAAO,OAAO,KACZ,SACE,SACA,aACA,yBAAyB,WAAW,oEAAoE,iBAAiB,EAC3H,CACF;IACA;GACF;GACA,IAAI,eAAe,kBAAkB;GAErC,MAAM,aAAa,YAAY,gBAAgB;GAC/C,MAAM,SAAS,WAAW,MAAM,cAAc,UAAU,QAAQ,MAAM,kBAAkB;GACxF,IAAI,CAAC,UAAU,WAAW,WAAW,KAAK,YAAY,iBAAiB,GAAG;IACxE,OAAO,OAAO,KACZ,SACE,SACA,aACA,kIACF,CACF;IACA;GACF;GAEA,MAAM,QAAQ,OAAO,aAAa,CAAC,EAAE,QAAQ;GAC7C,OAAO,MAAM,KACX,YACE,SACA,aACA,QACI,0BAA0B,MAAM,qBAChC,0CACJ,mDACF,CACF;GAEA,IAAI,CAAC,OACH,KAAK,MAAM,cAAc,WAAW,qBAAqB,WAAW,UAAU,GAAG;IAC/E,IAAI,WAAW,QAAQ,MAAM,oBAAoB;IACjD,IAAI,WAAW,uBAAuB,WAAW,iBAAiB,GAAG;IACrE,OAAO,MAAM,KACX,YACE,SACA,YACA,cACA,wCACF,CACF;GACF;GAGF,KAAK,MAAM,QAAQ,WAAW,qBAAqB,WAAW,cAAc,GAAG;IAC7E,MAAM,SAAS,KAAK,cAAc;IAClC,IACE,CAAC,KAAK,2BAA2B,MAAM,KACvC,OAAO,QAAQ,MAAM,4BACrB,KAAK,wBAAwB,GAE7B;IAEF,OAAO,MAAM,KACX,YACE,SACA,QACA,GAAG,OAAO,QAAQ,EAAE,KACpB,qEACF,CACF;GACF;EACF;EAGF,KAAK,MAAM,QAAQ,QAAQ,KAAK,KAAK,GAAG;GACtC,IAAI,CAAC,iBAAiB,KAAK,IAAI,GAAG;GAClC,MAAM,SAAS,QAAQ,KAAK,KAAK,IAAI;GACrC,IAAI,WAAW,QAAW;GAE1B,AADc,OAAO,MAAM,IACvB,CAAC,CAAC,SAAS,MAAM,UAAU;IAC7B,MAAM,OAAO,QAAQ;IACrB,IAAI,kBAAkB,KAAK,IAAI,GAC7B,OAAO,OAAO,KAAK;KACjB;KACA;KACA,MAAM;IACR,CAAC;IAEH,IAAI,0BAA0B,KAAK,IAAI,GACrC,OAAO,OAAO,KAAK;KACjB;KACA;KACA,MAAM;IACR,CAAC;GAEL,CAAC;EACH;EAEA,OAAO;CACT;AACF"}

package/esm/upgrade/notes.mjs

@@ -4,6 +4,10 @@
 * operations. Printed so the rollout plans for them.
 */
 const UPGRADE_NOTES = [
+	{
+		version: "5.36.0",
+		text: "Vitest 5 changes defaults: `clearMocks` is true, `json`/`junit` reporters write to `.vitest/` instead of stdout, `-t` joins names with ` > `, nested `vi.mock`/`vi.hoisted` calls throw and unawaited `resolves`/`rejects` assertions fail the test. Vite 8 needs Node.js 20.19 or 22.12+ and bundles with Rolldown."
+	},
 	{
 		version: "5.34.0",
 		text: "ESLint and Prettier support is gone in 5.34.0. Oxlint/Oxfmt is the only toolchain. The oxc-toolchain-removal step migrates remaining legacy configs/dependencies; review its manual findings. New/migrated templates enable correctness: error, which may report additional defects."

package/esm/upgrade/notes.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"notes.mjs","names":[],"sources":["../../../../../../../../packages/core/src/upgrade/notes.ts"],"sourcesContent":["import type { UpgradeNote } from \"./types\";\n\n/**\n * Breaking changes with nothing to edit in source: they change data or\n * operations. Printed so the rollout plans for them.\n */\nexport const UPGRADE_NOTES: readonly UpgradeNote[] = [\n  {\n    version: \"5.34.0\",\n    text: \"ESLint and Prettier support is gone in 5.34.0. Oxlint/Oxfmt is the only toolchain. The oxc-toolchain-removal step migrates remaining legacy configs/dependencies; review its manual findings. New/migrated templates enable correctness: error, which may report additional defects.\",\n  },\n  {\n    version: \"5.30.0\",\n    text: \"Auth login throttle keys are hashed: counters and lockouts written by 5.29 are forgotten on upgrade (locked accounts and IPs unlock).\",\n  },\n  {\n    version: \"5.30.0\",\n    text: \"Image derivatives use a new cache layout: the first request re-renders each one. Delete the old two-level cache folders once the rollout is done.\",\n  },\n];\n"],"mappings":";;;;;AAMA,MAAa,gBAAwC;CACnD;EACE,SAAS;EACT,MAAM;CACR;CACA;EACE,SAAS;EACT,MAAM;CACR;CACA;EACE,SAAS;EACT,MAAM;CACR;AACF"}
+{"version":3,"file":"notes.mjs","names":[],"sources":["../../../../../../../../packages/core/src/upgrade/notes.ts"],"sourcesContent":["import type { UpgradeNote } from \"./types\";\n\n/**\n * Breaking changes with nothing to edit in source: they change data or\n * operations. Printed so the rollout plans for them.\n */\nexport const UPGRADE_NOTES: readonly UpgradeNote[] = [\n  {\n    version: \"5.36.0\",\n    text: \"Vitest 5 changes defaults: `clearMocks` is true, `json`/`junit` reporters write to `.vitest/` instead of stdout, `-t` joins names with ` > `, nested `vi.mock`/`vi.hoisted` calls throw and unawaited `resolves`/`rejects` assertions fail the test. Vite 8 needs Node.js 20.19 or 22.12+ and bundles with Rolldown.\",\n  },\n  {\n    version: \"5.34.0\",\n    text: \"ESLint and Prettier support is gone in 5.34.0. Oxlint/Oxfmt is the only toolchain. The oxc-toolchain-removal step migrates remaining legacy configs/dependencies; review its manual findings. New/migrated templates enable correctness: error, which may report additional defects.\",\n  },\n  {\n    version: \"5.30.0\",\n    text: \"Auth login throttle keys are hashed: counters and lockouts written by 5.29 are forgotten on upgrade (locked accounts and IPs unlock).\",\n  },\n  {\n    version: \"5.30.0\",\n    text: \"Image derivatives use a new cache layout: the first request re-renders each one. Delete the old two-level cache folders once the rollout is done.\",\n  },\n];\n"],"mappings":";;;;;AAMA,MAAa,gBAAwC;CACnD;EACE,SAAS;EACT,MAAM;CACR;CACA;EACE,SAAS;EACT,MAAM;CACR;CACA;EACE,SAAS;EACT,MAAM;CACR;CACA;EACE,SAAS;EACT,MAAM;CACR;AACF"}

package/esm/warlock-config/index.d.mts

@@ -1,5 +1,5 @@
-import { BudgetPage, BudgetViolation, BuildBudgetReport, BuildBudgets, PageBudget } from "../production/build-budgets.mjs";
+import { BudgetPage, BudgetViolation, BuildBudgetReport, BuildBudgets, PageBudget, PayloadBudget } from "../production/build-budgets.mjs";
 import { WarlockConfig } from "./types.mjs";
 import { defineConfig } from "./define-config.mjs";
 import { WarlockConfigManager, isUnknownTsExtensionError, isUnresolvedConfigImportError, isUnsupportedTypeStrippingError, warlockConfigManager } from "./warlock-config.manager.mjs";
-export { type BudgetPage, type BudgetViolation, type BuildBudgetReport, type BuildBudgets, type PageBudget, WarlockConfig, WarlockConfigManager, defineConfig, isUnknownTsExtensionError, isUnresolvedConfigImportError, isUnsupportedTypeStrippingError, warlockConfigManager };
+export { type BudgetPage, type BudgetViolation, type BuildBudgetReport, type BuildBudgets, type PageBudget, type PayloadBudget, WarlockConfig, WarlockConfigManager, defineConfig, isUnknownTsExtensionError, isUnresolvedConfigImportError, isUnsupportedTypeStrippingError, warlockConfigManager };

package/llms-full.txt

@@ -4014,6 +4014,19 @@ router.get("/webhooks/status", webhookStatusController, { rateLimit: false });
 - The `send-response` topic — picking the right `response.<helper>()`.
 - The `warlock-conventions` topic — module layout, the `guarded` convention, path aliases.
 
+## A named route the browser must never call — `clientVisible: false`
+
+A named API route is embedded in a page's browser route table only when that page's client code reaches its name. Mark an endpoint that browser code must never reach with `clientVisible: false`:
+
+```ts
+router.post("/internal/reindex", reindexController, {
+  name: "internal.reindex",
+  clientVisible: false,
+});
+```
+
+It is then never embedded in a page, and `warlock check` reports a browser reference to its name as `WL9020` (an error). The server still authorizes the call as for any route.
+
 
 ## report-framework-issue  `@warlock.js/core/skills/report-framework-issue/SKILL.md`
 
@@ -8505,7 +8518,7 @@ and has no Warlock setup or HTTP global setup. `integration` discovers
 It uses the framework setup, HTTP global setup and a generated `src/test-runner.ts`.
 Keep pure service specs beside their source and mock repositories at the boundary.
 Existing config files are preserved; copy the projects layout into them manually.
-Vitest 4.1.10 or newer is required for the generated runner.
+Vitest 5 or newer is required for the generated runner (Vitest 5 removed `vitest/runners`; the runner extends `TestRunner` from `vitest`).
 
 For a unit spec that needs configuration values, use:
 
@@ -8553,20 +8566,20 @@ Run with `npx vitest run --project integration`. Worker lifetime refuses watch,
 threads, isolated module graphs, or a missing runner with a message explaining
 the required settings. Keep `afterAll(teardownTest)` in the setup file: in worker
 mode it marks the end of the file; Vitest's awaited worker cleanup closes the
-runtime once. The runner uses `VitestTestRunner.onCleanupWorkerContext`, verified
-in Vitest 4.1.10's `runners.d.ts`, runner implementation and worker cleanup source.
+runtime once. The runner uses `TestRunner.onCleanupWorkerContext`, verified
+in Vitest 5.0.3's `TestRunner` declaration, runner implementation and worker cleanup source.
 For an existing project, generate this runner without overwriting your config:
 
 ```ts title="src/test-runner.ts"
 import { configureTestWorker } from "@warlock.js/core/tests";
-import { VitestTestRunner } from "vitest/runners";
+import { TestRunner } from "vitest";
 
-export default class WarlockTestRunner extends VitestTestRunner {
-  public constructor(config: ConstructorParameters<typeof VitestTestRunner>[0]) {
+export default class WarlockTestRunner extends TestRunner {
+  public constructor(config: ConstructorParameters<typeof TestRunner>[0]) {
     super(config);
     configureTestWorker(
       { pool: this.pool, watch: config.watch, isolate: config.isolate },
-      (cleanup) => this.onCleanupWorkerContext(cleanup),
+      (cleanup) => this.onCleanupWorkerContext?.(cleanup),
     );
   }
 }
@@ -8585,7 +8598,7 @@ This trades module isolation for startup cost: application singletons, config
 mutations, mocks and module side effects can survive between files. Reset your
 own state in `resetBetweenFiles`, restore mocks, and keep connector selection
 consistent. Give each worker a distinct database/schema using
-`process.env.VITEST_POOL_ID` when preparing test connections. Never drop a shared
+`process.env.VITEST_POOL_ID` (1-based since Vitest 5) when preparing test connections. Never drop a shared
 database from this hook while other workers are using it. The framework does not
 create a memory replica set or a cross-worker lock; those belong to the application's
 global setup. A shared HTTP server and a single replica set can contend on I/O,
@@ -9360,6 +9373,97 @@ one `#vessel` around `{children}`. Client navigation still swaps layout/page
 children while preserving the document root. Remove temporary explicit form IDs
 only when the application does not otherwise depend on those names.
 
+## 5.35 to 5.36 per-page API routes
+
+A page document now carries only the named API routes its client code can reach. Before 5.36 every page carried every named route, so a browser call to a name the build cannot see worked on every page by accident. Check each `apiHref()` and `useSubmitForm({ route })` call:
+
+- A name written as a string literal, a constant or a template with a static prefix is found automatically.
+- A name computed at run time, or taken from a module the build cannot follow, now throws on the page that calls it. Declare the names in that page's setup file, for example `export const config = { apiRoutes: ["orders.*"] };`, a layout or root `config` covers every page that renders it. Or call the endpoint with an explicit `path` and `method`.
+- `npx warlock check` reports the call sites that need a declaration as `WL9019`.
+
+Routes registered with `clientVisible: false` are never embedded, and a browser call to one is an error (`WL9020`). Keep endpoints the browser must not reach on that option. Authorization is unchanged: the server still decides each request.
+
+To measure a page's inline payload, set `build.budgets.payload` (default `64kb`). An over-budget route logs one line per process and never fails a request.
+
+## 5.35 to 5.36 translation payloads
+
+A page's hydration payload now carries only the translations its client code
+can reach, in route-dictionary (`locales.json`) and global-registry (`extend()`)
+apps alike. The groups every page uses (default `app` and `common`) arrive once
+per locale in a hashed, cached file that the page preloads. Nothing in a page's
+render changes: server output is the full dictionary, as before.
+
+Run `warlock build`, then `warlock check`. A `WL9104` warning marks a page that
+renders a translation key computed at runtime. Declare the keys it renders in
+the page's setup file, for example
+`export const config = { translations: ["statuses.*", "members.title"] }`, so the
+page ships only what it uses.
+
+In development, a warning names a key the page reads but its payload lacks, and
+resolves it from the full table so the page keeps working. In production the
+key renders as its own text and the miss is reported once through
+`onClientError` with `kind: "translations"`. Declare the key, or set
+`build: { translations: { prune: false } }` in the web connector options while migrating to
+restore the previous per-page payload.
+
+Global-registry apps are covered too. Their shared table is served at
+`/__warlock/translations/<locale>.<hash>.json`, which is cached immutable in
+production. A direct `trans()` call from `@mongez/localization` is not checked
+for a pruning miss; the calls through `useTrans()` are.
+
+## 5.35 to 5.36 Vite 8 and Vitest 5
+
+`@warlock.js/web` requires Vite 8 (`^8.0.0`) and `@vitejs/plugin-react` 6, and the
+test kit requires Vitest 5. Vite 8 bundles with Rolldown and transforms
+TypeScript with Oxc. Vite 7 is not supported; plugin-react 6 needs Vite 8, so the
+family moves together. Vite 8 needs Node.js 20.19 or 22.12 and newer, Vitest 5
+needs 22.12 or newer; Warlock already requires 22.15.
+
+```bash
+npx warlock upgrade --from 5.35 --to 5.36.0 --dry-run
+npx warlock upgrade --from 5.35 --to 5.36.0
+npm install
+npx warlock check
+```
+
+The `vite-8-vitest-5` codemod:
+
+- raises `vite` (8.3.3), `vitest` and `@vitest/*` (5.0.3) and `@vitejs/plugin-react`
+  (6.1.2) in `dependencies`, `devDependencies`, `overrides` and `resolutions`,
+  keeping `^`, `~` or exact style;
+- rewrites a generated `src/test-runner.ts` from `VitestTestRunner` in
+  `vitest/runners` to `TestRunner` from `vitest`, and calls
+  `this.onCleanupWorkerContext?.(cleanup)` (the hook is absent in vm pools);
+- lists, without editing, imports of the removed `vitest/coverage`,
+  `vitest/reporters`, `vitest/environments`, `vitest/snapshot`, `vitest/suite`,
+  `vitest/mocker` and `vitest/internal/module-runner` entry points, other names
+  imported from `vitest/runners`, a top-level `esbuild` option in a Vite or
+  Vitest config, and object-form `output.manualChunks`.
+
+Do these by hand when the codemod lists them:
+
+- Move a config's `esbuild: { jsx: "automatic" }` to
+  `oxc: { jsx: { runtime: "automatic" } }`. `esbuild.target` is not converted, and
+  Oxc does not lower native decorators: keep `lowerStage3Decorators()` from
+  `@warlock.js/core/vite` first in `plugins` for decorated modules, as in the
+  generated test config.
+- Replace object `manualChunks` with
+  `build.rolldownOptions.output.codeSplitting.groups`; `build.rollupOptions` still
+  works but is deprecated in favour of `build.rolldownOptions`.
+- A custom bundler `external` list that names Node builtins is still refused by the
+  client build.
+
+Vitest 5 changes defaults that can alter a green suite: `clearMocks` is true,
+`json` and `junit` reporters write to `.vitest/` instead of stdout, `-t` joins a
+test's names with `>`, `VITEST_POOL_ID` and `VITEST_WORKER_ID` start at 1, nested
+`vi.mock`/`vi.hoisted` calls throw, and an unawaited `resolves` or `rejects`
+assertion fails the test. Vitest also no longer searches parent directories for a
+config file; run it from the package that owns the config. Official guides:
+https://vite.dev/guide/migration and https://vitest.dev/guide/migration.
+
+A project that uses `@warlock.js/ai`'s custom matchers needs Vitest 5 for their
+TypeScript types.
+
 
 ## upload-file  `@warlock.js/core/skills/upload-file/SKILL.md`
 
@@ -10347,6 +10451,10 @@ workers, and registered module cleanup hooks, including after partial startup.
 A Node loader registration is process-scoped; its message channel is closed at
 teardown. Module-owned timers/listeners must register their cleanup hooks.
 
+## Translation keys in pages (5.36)
+
+`warlock check` reports `WL9104` when a page renders a translation key computed at runtime (`trans(key)` with no static prefix, or a translator passed on as a value). Such a page ships every translation group. Declare its keys in the page's setup file, `export const config = { translations: ["statuses.*", "members.title"] }`, to ship only what it uses. The `web` skill `localize-pages` covers the browser side.
+
 
 ## use-middleware  `@warlock.js/core/skills/use-middleware/SKILL.md`
 
@@ -12214,14 +12322,17 @@ and work through the manual-review list. Use `--lint=oxc` for new apps.
 The following codes default to **warnings**, so upgrading does not fail existing projects.
 They parse real TypeScript/JSX syntax with the same oxc-parser adapter as the existing conventions.
 
-| Code     | Convention                                                                   | Remedy                                                                                                                                                             |
-| -------- | ---------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| `WL9013` | A component file exceeds 150 lines                                           | Split components and extract hooks; configure `componentLineLimit`.                                                                                                |
-| `WL9014` | More than one component in a file                                            | Move each component into its own TSX file.                                                                                                                         |
-| `WL9015` | State/effects or event-handler functions inside a component                  | Move `useState`, `useReducer`, `useEffect`, `useLayoutEffect` and handlers into `use-*.ts` hooks.                                                                  |
-| `WL9016` | Native select, checkbox, radio, date, time or datetime-local input           | Use the design-system control. Native controls are allowed in `src/web/design-system/**`.                                                                          |
-| `WL9017` | DOM input/textarea/select native validation                                  | Use shared schema validation instead of `required`, `pattern`, `min`, `max`, `minLength`, `maxLength` or input `type="email"`. Custom component props are allowed. |
-| `WL9018` | Exported `RequestHandler` in `src/app/**/controllers` lacks `responseSchema` | Assign `handler.responseSchema` to document each response status.                                                                                                  |
+| Code     | Convention                                                                       | Remedy                                                                                                                                                             |
+| -------- | -------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `WL9013` | A component file exceeds 150 lines                                               | Split components and extract hooks; configure `componentLineLimit`.                                                                                                |
+| `WL9014` | More than one component in a file                                                | Move each component into its own TSX file.                                                                                                                         |
+| `WL9015` | State/effects or event-handler functions inside a component                      | Move `useState`, `useReducer`, `useEffect`, `useLayoutEffect` and handlers into `use-*.ts` hooks.                                                                  |
+| `WL9016` | Native select, checkbox, radio, date, time or datetime-local input               | Use the design-system control. Native controls are allowed in `src/web/design-system/**`.                                                                          |
+| `WL9017` | DOM input/textarea/select native validation                                      | Use shared schema validation instead of `required`, `pattern`, `min`, `max`, `minLength`, `maxLength` or input `type="email"`. Custom component props are allowed. |
+| `WL9018` | Exported `RequestHandler` in `src/app/**/controllers` lacks `responseSchema`     | Assign `handler.responseSchema` to document each response status.                                                                                                  |
+| `WL9019` | Browser route call (`apiHref`, `useSubmitForm({ route })`) takes a run-time name | Pass a string literal or a template with a static prefix, or declare the names with `config.apiRoutes` in a page setup file.                                       |
+| `WL9020` | Browser code names a route registered with `clientVisible: false` (error)        | Call the endpoint from the server, or remove `clientVisible: false` from the route.                                                                                |
+| `WL9104` | Translation key computed at runtime in `src/web` (the page ships every group)    | Declare the keys with `config.translations` in the page's setup file, for example `["statuses.*"]`.                                                                |
 
 Web rules apply to `src/web/**/*.tsx`. Components are top-level JSX-returning functions
 with a capitalized name (or an anonymous default export). Hook files and ordinary helpers

package/package.json

@@ -25,12 +25,12 @@
     "@mongez/slug": "^1.0.7",
     "@mongez/supportive-is": "^3.0.0",
     "@mongez/time-wizard": "^1.0.6",
-    "@warlock.js/cache": "5.35.0",
-    "@warlock.js/cascade": "5.35.0",
-    "@warlock.js/context": "5.35.0",
-    "@warlock.js/fs": "5.35.0",
-    "@warlock.js/logger": "5.35.0",
-    "@warlock.js/seal": "5.35.0",
+    "@warlock.js/cache": "5.36.0",
+    "@warlock.js/cascade": "5.36.0",
+    "@warlock.js/context": "5.36.0",
+    "@warlock.js/fs": "5.36.0",
+    "@warlock.js/logger": "5.36.0",
+    "@warlock.js/seal": "5.36.0",
     "bcryptjs": "^3.0.3",
     "chokidar": "^5.0.0",
     "dayjs": "^1.11.19",
@@ -56,12 +56,12 @@
     "@aws-sdk/lib-storage": "^3.955.0",
     "@aws-sdk/s3-request-presigner": "^3.955.0",
     "@react-email/render": "^2.0.5",
-    "@warlock.js/access": "5.35.0",
-    "@warlock.js/ai": "5.35.0",
-    "@warlock.js/ai-tools": "5.35.0",
-    "@warlock.js/devtools": "5.35.0",
-    "@warlock.js/herald": "5.35.0",
-    "@warlock.js/notifications": "5.35.0",
+    "@warlock.js/access": "5.36.0",
+    "@warlock.js/ai": "5.36.0",
+    "@warlock.js/ai-tools": "5.36.0",
+    "@warlock.js/devtools": "5.36.0",
+    "@warlock.js/herald": "5.36.0",
+    "@warlock.js/notifications": "5.36.0",
     "nodemailer": "^8.0.5",
     "react": "^19.2.3",
     "react-dom": "^19.2.3",
@@ -146,7 +146,7 @@
   "engines": {
     "node": ">=22.15"
   },
-  "version": "5.35.0",
+  "version": "5.36.0",
   "type": "module",
   "main": "./esm/index.mjs",
   "module": "./esm/index.mjs",

package/skills/register-route/SKILL.md

@@ -279,3 +279,16 @@ router.get("/webhooks/status", webhookStatusController, { rateLimit: false });
 - The `create-controller` topic — the handler shape, validation, request/response surface.
 - The `send-response` topic — picking the right `response.<helper>()`.
 - The `warlock-conventions` topic — module layout, the `guarded` convention, path aliases.
+
+## A named route the browser must never call — `clientVisible: false`
+
+A named API route is embedded in a page's browser route table only when that page's client code reaches its name. Mark an endpoint that browser code must never reach with `clientVisible: false`:
+
+```ts
+router.post("/internal/reindex", reindexController, {
+  name: "internal.reindex",
+  clientVisible: false,
+});
+```
+
+It is then never embedded in a page, and `warlock check` reports a browser reference to its name as `WL9020` (an error). The server still authorizes the call as for any route.

package/skills/test-service/SKILL.md

@@ -454,7 +454,7 @@ and has no Warlock setup or HTTP global setup. `integration` discovers
 It uses the framework setup, HTTP global setup and a generated `src/test-runner.ts`.
 Keep pure service specs beside their source and mock repositories at the boundary.
 Existing config files are preserved; copy the projects layout into them manually.
-Vitest 4.1.10 or newer is required for the generated runner.
+Vitest 5 or newer is required for the generated runner (Vitest 5 removed `vitest/runners`; the runner extends `TestRunner` from `vitest`).
 
 For a unit spec that needs configuration values, use:
 
@@ -502,20 +502,20 @@ Run with `npx vitest run --project integration`. Worker lifetime refuses watch,
 threads, isolated module graphs, or a missing runner with a message explaining
 the required settings. Keep `afterAll(teardownTest)` in the setup file: in worker
 mode it marks the end of the file; Vitest's awaited worker cleanup closes the
-runtime once. The runner uses `VitestTestRunner.onCleanupWorkerContext`, verified
-in Vitest 4.1.10's `runners.d.ts`, runner implementation and worker cleanup source.
+runtime once. The runner uses `TestRunner.onCleanupWorkerContext`, verified
+in Vitest 5.0.3's `TestRunner` declaration, runner implementation and worker cleanup source.
 For an existing project, generate this runner without overwriting your config:
 
 ```ts title="src/test-runner.ts"
 import { configureTestWorker } from "@warlock.js/core/tests";
-import { VitestTestRunner } from "vitest/runners";
+import { TestRunner } from "vitest";
 
-export default class WarlockTestRunner extends VitestTestRunner {
-  public constructor(config: ConstructorParameters<typeof VitestTestRunner>[0]) {
+export default class WarlockTestRunner extends TestRunner {
+  public constructor(config: ConstructorParameters<typeof TestRunner>[0]) {
     super(config);
     configureTestWorker(
       { pool: this.pool, watch: config.watch, isolate: config.isolate },
-      (cleanup) => this.onCleanupWorkerContext(cleanup),
+      (cleanup) => this.onCleanupWorkerContext?.(cleanup),
     );
   }
 }
@@ -534,7 +534,7 @@ This trades module isolation for startup cost: application singletons, config
 mutations, mocks and module side effects can survive between files. Reset your
 own state in `resetBetweenFiles`, restore mocks, and keep connector selection
 consistent. Give each worker a distinct database/schema using
-`process.env.VITEST_POOL_ID` when preparing test connections. Never drop a shared
+`process.env.VITEST_POOL_ID` (1-based since Vitest 5) when preparing test connections. Never drop a shared
 database from this hook while other workers are using it. The framework does not
 create a memory replica set or a cross-worker lock; those belong to the application's
 global setup. A shared HTTP server and a single replica set can contend on I/O,

package/skills/upgrade-from-5-29/SKILL.md

@@ -552,3 +552,94 @@ Root components and providers execute in both realms. Move server-only work into
 one `#vessel` around `{children}`. Client navigation still swaps layout/page
 children while preserving the document root. Remove temporary explicit form IDs
 only when the application does not otherwise depend on those names.
+
+## 5.35 to 5.36 per-page API routes
+
+A page document now carries only the named API routes its client code can reach. Before 5.36 every page carried every named route, so a browser call to a name the build cannot see worked on every page by accident. Check each `apiHref()` and `useSubmitForm({ route })` call:
+
+- A name written as a string literal, a constant or a template with a static prefix is found automatically.
+- A name computed at run time, or taken from a module the build cannot follow, now throws on the page that calls it. Declare the names in that page's setup file, for example `export const config = { apiRoutes: ["orders.*"] };`, a layout or root `config` covers every page that renders it. Or call the endpoint with an explicit `path` and `method`.
+- `npx warlock check` reports the call sites that need a declaration as `WL9019`.
+
+Routes registered with `clientVisible: false` are never embedded, and a browser call to one is an error (`WL9020`). Keep endpoints the browser must not reach on that option. Authorization is unchanged: the server still decides each request.
+
+To measure a page's inline payload, set `build.budgets.payload` (default `64kb`). An over-budget route logs one line per process and never fails a request.
+
+## 5.35 to 5.36 translation payloads
+
+A page's hydration payload now carries only the translations its client code
+can reach, in route-dictionary (`locales.json`) and global-registry (`extend()`)
+apps alike. The groups every page uses (default `app` and `common`) arrive once
+per locale in a hashed, cached file that the page preloads. Nothing in a page's
+render changes: server output is the full dictionary, as before.
+
+Run `warlock build`, then `warlock check`. A `WL9104` warning marks a page that
+renders a translation key computed at runtime. Declare the keys it renders in
+the page's setup file, for example
+`export const config = { translations: ["statuses.*", "members.title"] }`, so the
+page ships only what it uses.
+
+In development, a warning names a key the page reads but its payload lacks, and
+resolves it from the full table so the page keeps working. In production the
+key renders as its own text and the miss is reported once through
+`onClientError` with `kind: "translations"`. Declare the key, or set
+`build: { translations: { prune: false } }` in the web connector options while migrating to
+restore the previous per-page payload.
+
+Global-registry apps are covered too. Their shared table is served at
+`/__warlock/translations/<locale>.<hash>.json`, which is cached immutable in
+production. A direct `trans()` call from `@mongez/localization` is not checked
+for a pruning miss; the calls through `useTrans()` are.
+
+## 5.35 to 5.36 Vite 8 and Vitest 5
+
+`@warlock.js/web` requires Vite 8 (`^8.0.0`) and `@vitejs/plugin-react` 6, and the
+test kit requires Vitest 5. Vite 8 bundles with Rolldown and transforms
+TypeScript with Oxc. Vite 7 is not supported; plugin-react 6 needs Vite 8, so the
+family moves together. Vite 8 needs Node.js 20.19 or 22.12 and newer, Vitest 5
+needs 22.12 or newer; Warlock already requires 22.15.
+
+```bash
+npx warlock upgrade --from 5.35 --to 5.36.0 --dry-run
+npx warlock upgrade --from 5.35 --to 5.36.0
+npm install
+npx warlock check
+```
+
+The `vite-8-vitest-5` codemod:
+
+- raises `vite` (8.3.3), `vitest` and `@vitest/*` (5.0.3) and `@vitejs/plugin-react`
+  (6.1.2) in `dependencies`, `devDependencies`, `overrides` and `resolutions`,
+  keeping `^`, `~` or exact style;
+- rewrites a generated `src/test-runner.ts` from `VitestTestRunner` in
+  `vitest/runners` to `TestRunner` from `vitest`, and calls
+  `this.onCleanupWorkerContext?.(cleanup)` (the hook is absent in vm pools);
+- lists, without editing, imports of the removed `vitest/coverage`,
+  `vitest/reporters`, `vitest/environments`, `vitest/snapshot`, `vitest/suite`,
+  `vitest/mocker` and `vitest/internal/module-runner` entry points, other names
+  imported from `vitest/runners`, a top-level `esbuild` option in a Vite or
+  Vitest config, and object-form `output.manualChunks`.
+
+Do these by hand when the codemod lists them:
+
+- Move a config's `esbuild: { jsx: "automatic" }` to
+  `oxc: { jsx: { runtime: "automatic" } }`. `esbuild.target` is not converted, and
+  Oxc does not lower native decorators: keep `lowerStage3Decorators()` from
+  `@warlock.js/core/vite` first in `plugins` for decorated modules, as in the
+  generated test config.
+- Replace object `manualChunks` with
+  `build.rolldownOptions.output.codeSplitting.groups`; `build.rollupOptions` still
+  works but is deprecated in favour of `build.rolldownOptions`.
+- A custom bundler `external` list that names Node builtins is still refused by the
+  client build.
+
+Vitest 5 changes defaults that can alter a green suite: `clearMocks` is true,
+`json` and `junit` reporters write to `.vitest/` instead of stdout, `-t` joins a
+test's names with `>`, `VITEST_POOL_ID` and `VITEST_WORKER_ID` start at 1, nested
+`vi.mock`/`vi.hoisted` calls throw, and an unawaited `resolves` or `rejects`
+assertion fails the test. Vitest also no longer searches parent directories for a
+config file; run it from the package that owns the config. Official guides:
+https://vite.dev/guide/migration and https://vitest.dev/guide/migration.
+
+A project that uses `@warlock.js/ai`'s custom matchers needs Vitest 5 for their
+TypeScript types.