build(frame): update Vite to 8.3 and measure lazy destinations by what they fetch

[crynta]

Vite 8.3 (Rolldown 1.1.5 → 1.2.12) looked like a 32-budget regression; it isn't one at runtime.

What changed in Rolldown 1.2: code a lazy destination shares with the destination that opens it now goes into the opener's chunk. The opener has always run first, so opening the destination fetches only its own code. Our budget measured a destination against its page's startup graph only, so that shared code was charged again:

Destination	vs page startup	vs what is loaded when it opens
Work code view	+517 KB	+15 KB
About page	+149 KB	0 KB
Agent line	+560 KB	0 KB
Computer part	+531 KB	+9 KB

Measurement: a destination's cost is now its static graph minus what every way of opening it has certainly loaded: its page plus the destinations on the way, intersected across openers. Destinations no page reaches are charged their whole graph. loadedBeforeOpening is a pure function with unit tests (direct opener, chained opener, two openers, unreachable).

Result with Vite 8.3:

• Startup is unchanged: browser 365,843 bytes (was 365,920), panel 113,358 (was 113,655), startup requests within 24.
• 83 destinations record smaller sizes, so their budgets are tighter. Eight rise by at most 116 bytes.

Also:

• Config modules import with .ts extensions; Vite 8.3 loads its config natively and warned.
• The Dependabot hold on Vite is removed.

Verified: pnpm run check (739), pnpm run build (no warnings), the TabRow, Appearance and NarrowChrome component tests in WebKit (7), and the dev server serving the browser page and its entry module.

Summary by CodeRabbit

• Improvements
  • Updated lazy-loaded page size estimates to account for resources already loaded and resources required to open each page. This provides a more accurate view of the additional JavaScript and CSS needed when navigating to a destination.
• Documentation
  • Clarified how lazy-loaded page budgets are measured.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: zephium-browser/Zephium/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 4e43f614-febf-4aeb-a569-63f1f51e3dc6

📥 Commits

Reviewing files that changed from the base of the PR and between 338ed63 and 84b519a.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml, !pnpm-lock.yaml

📒 Files selected for processing (12)

• .github/dependabot.yml
• docs/frontend.md
• frame/bootstrap-report.ts
• frame/bundle-budget.test.ts
• frame/bundle-budget.ts
• frame/bundle-budgets.json
• frame/package.json
• frame/tsconfig.node.json
• frame/vite.config.ts
• frame/vite.frame.ts
• frame/vite.onboarding.config.ts
• frame/vitest.config.ts

💤 Files with no reviewable changes (1)

• .github/dependabot.yml

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 8 remain after this review.

---

📝 Walkthrough

Walkthrough

The bundle budget calculation now excludes files loaded before a lazy destination opens. The PR adds tests, updates recorded budgets and documentation, upgrades Vite, and changes TypeScript configuration imports to use explicit extensions.

Changes

Lazy Bundle Budgets

Layer / File(s)	Summary
Calculate pre-opening files frame/bundle-budget.ts, frame/bundle-budget.test.ts	Adds loadedBeforeOpening to calculate files loaded before each root opens. Tests cover page files, opener chunks, files common to every opener, and empty results.
Apply pre-opening files to budgets frame/bootstrap-report.ts, docs/frontend.md, frame/bundle-budgets.json	Lazy-destination budgets now exclude files already loaded before opening. The documentation and recorded JavaScript and CSS budgets are updated.

Vite Build Configuration

Layer / File(s)	Summary
Update Vite and TypeScript configuration .github/dependabot.yml, frame/package.json, frame/tsconfig.node.json, frame/vite.config.ts, frame/vite.frame.ts, frame/vite.onboarding.config.ts, frame/vitest.config.ts	Upgrades Vite, enables TypeScript imports with explicit extensions, updates configuration imports to use .ts extensions, and removes the Dependabot rule that excluded minor and major Vite updates.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Other

Suggested labels: bug, area: build & ci, size: M

Merge Risk: ⚪ Minimal · up to 84b51

The change adjusts how lazy-destination bundle budgets are measured and upgrades Vite. No concrete risk was found, and the reported checks and builds passed.

🚥 Pre-merge checks | ✅ 10

✅ Passed checks (10 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title follows the required Conventional Commits format with the valid type build, scope frame, and an imperative summary that accurately describes the Vite update and lazy-destination measurem…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
One Logical Change	✅ Passed	All changed files support one logical change: upgrading Vite/Rolldown and adapting the lazy-destination budget measurement. The code, tests, documentation, recorded budgets, and Dependabot rule addres…
Linked Issue For Larger Changes	✅ Passed	The PR fixes incorrect lazy-destination bundle-budget measurement caused by Vite/Rolldown chunking. The diff is limited to build logic, tests, documentation, dependency configuration, and generated bu…
Tests Cover Changed Behavior	✅ Passed	The changed TypeScript behavior has tests. frame/bundle-budget.test.ts directly tests loadedBeforeOpening for a direct opener, a chained opener, multiple openers with intersection, and an unreacha…
Generated Files Follow Their Source	✅ Passed	No prohibited generated-file mismatch is present. The PR does not change frame/src/shared/ipc/bindings.ts, Rust IPC types, or generated i18n output. pnpm-lock.yaml changes together with `frame/pac…
Privileged Boundary Intact	✅ Passed	No stated boundary violation is introduced. The PR changes Vite, TypeScript import extensions, bundle-budget accounting, generated budgets, and Dependabot settings. It adds no Tauri IPC call, Wry IPC …
Performance Impact Stated	✅ Passed	The pull request changes build-time bundle-budget analysis, tests, configuration, documentation, and dependency metadata. It does not change engine adapters, content blocking, tab/session state, rende…

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}