chore(deps): modernize toolchain (Vite 8, TS 6, ESLint 10, Hono) + cut 14 direct deps (-139 pkgs) (#786)

Author: FelixTJDietrich

.changeset/library-dependency-modernization.md

@@ -0,0 +1,5 @@
+---
+"@tumaet/apollon": patch
+---
+
+Modernize the build toolchain and cut a runtime dependency, behavior-identical. `uuid` is gone — the editor now mints RFC-4122 v4 IDs from an embed-safe `crypto.getRandomValues` (works in any context, unlike `crypto.randomUUID`). The build moves to Vite 8 (Rolldown/Oxc), TypeScript 6.0, and vite-plugin-dts 5 (+ `@microsoft/api-extractor`), and every remaining runtime dependency (`@base-ui/react`, `lucide-react`, `@chenglou/pretext`, …) is verified at its latest release. No public API or rendering change.

.changeset/standalone-runtime-modernization.md

@@ -0,0 +1,10 @@
+---
+"@tumaet/server": patch
+"@tumaet/webapp": patch
+---
+
+Modernize the standalone runtimes, behavior-preserving.
+
+**Server:** migrate Express 5 → Hono 4 + `@hono/node-server` (both zero-runtime-dependency), dropping `express`/`cors`/`cookie`/`pino-http` and ~18 transitives. Routes, status codes, response bodies/headers, the owner-cookie HMAC, CORS policy, the zod error envelopes and the yjs collaboration WebSocket relay are all preserved. Runtime majors bumped: zod 4, redis 6 (RESP2-pinned to keep raw reply shapes), pino 10, ulid 3, and `dotenv` replaced by Node's built-in `util.parseEnv`.
+
+**Webapp:** replace `@ionic/react` (imported only for `isPlatform()` UA checks) with a 45-line vendored `platform.ts`, cutting the Stencil runtime from the initial bundle (~−47% initial gzip) and de-duplicating the editor; `uuid` → native `crypto.randomUUID`.

.changeset/ui-drop-cmdk.md

@@ -0,0 +1,5 @@
+---
+"@tumaet/ui": patch
+---
+
+Drop the unused `cmdk` command-palette component (zero importers) and its dependency, plus a dead `@vitest/coverage-v8` dev dependency. Migrate React linting to `@eslint-react` for ESLint 10 and bump the toolchain (Tailwind 4.3). No component API change.

.github/workflows/pr-health-checks.yml

@@ -213,14 +213,14 @@ jobs:
           # Browser-specific key: the chromium and firefox jobs share this cache
           # path but install different browsers, so they must not share a key
           # (a firefox-only cache would make this job skip its chromium install).
-          key: playwright-chromium-${{ runner.os }}-v1.59.1-${{ hashFiles('standalone/webapp/package.json') }}
+          key: playwright-chromium-${{ runner.os }}-v1.61.1-${{ hashFiles('standalone/webapp/package.json') }}
 
       - name: Install Playwright browsers
         if: steps.playwright-cache.outputs.cache-hit != 'true'
         # Invoke @playwright/test's own CLI (not `pnpm exec playwright`): the
-        # webapp also has `playwright@1.61` for Storybook's vitest browser runner,
-        # so the bare `playwright` bin resolves to 1.61 and installs browsers the
-        # 1.59.1 test runner can't find. cli.js installs 1.59.1's browsers.
+        # webapp also has the `playwright` package (Storybook's vitest browser
+        # runner), and both ship a `playwright` bin, so the bare bin can resolve
+        # to the wrong package. cli.js pins the install to @playwright/test.
         run: pnpm --filter @tumaet/webapp exec node node_modules/@playwright/test/cli.js install chromium
 
       # Shared with perf-firefox-tests; the dpkg-lock hang it guards is
@@ -232,8 +232,8 @@ jobs:
 
       - name: Run E2E tests
         # Use the test:e2e script (node …/@playwright/test/cli.js): running via
-        # `pnpm exec playwright test` picks up the 1.61 runner against 1.59.1 test
-        # files → "did not expect test.describe()".
+        # `pnpm exec playwright test` can pick up the `playwright` package's CLI
+        # (bin collision) instead of @playwright/test's test runner.
         run: pnpm --filter @tumaet/webapp run test:e2e
 
       # No chromium document-growth budget: the metric is engine-independent and
@@ -286,12 +286,13 @@ jobs:
           path: ~/.cache/ms-playwright
           # Firefox-specific key — must differ from the chromium jobs' key (same
           # cache path, different browser) so neither poisons the other's cache.
-          key: playwright-firefox-${{ runner.os }}-v1.59.1-${{ hashFiles('standalone/webapp/package.json') }}
+          key: playwright-firefox-${{ runner.os }}-v1.61.1-${{ hashFiles('standalone/webapp/package.json') }}
 
       - name: Install Playwright Firefox
         if: steps.playwright-cache.outputs.cache-hit != 'true'
-        # @playwright/test's own CLI, so Firefox matches the 1.59.1 test runner
-        # (see the e2e job's install step for why `pnpm exec playwright` is wrong).
+        # @playwright/test's own CLI, so the install targets the test runner's
+        # package — both packages ship a `playwright` bin (see the e2e job's
+        # install step for why `pnpm exec playwright` is wrong).
         run: pnpm --filter @tumaet/webapp exec node node_modules/@playwright/test/cli.js install firefox
 
       # Shared with e2e-tests; the dpkg-lock hang it guards is documented in
@@ -393,7 +394,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     container:
-      image: mcr.microsoft.com/playwright:v1.59.1-noble
+      image: mcr.microsoft.com/playwright:v1.61.1-noble
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

.github/workflows/update-visual-baselines.yml

@@ -33,7 +33,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     container:
-      image: mcr.microsoft.com/playwright:v1.59.1-noble
+      image: mcr.microsoft.com/playwright:v1.61.1-noble
     steps:
       - name: Checkout target branch
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

README.md

@@ -54,7 +54,7 @@ To preview the documentation site instead, run `pnpm dev:docs` from the repo roo
 | Component     | Technology                                                           |
 | ------------- | -------------------------------------------------------------------- |
 | Library       | React, TypeScript, React Flow (`@xyflow/react`), Yjs, Zustand, Vite  |
-| Server        | Express 5, Redis (RedisJSON), WebSocket relay                        |
+| Server        | Hono 4, Redis (RedisJSON), WebSocket relay                           |
 | Webapp        | React, TypeScript, Vite, shadcn-style UI (Base UI), Tailwind         |
 | Storage       | Redis with RedisJSON (diagrams expire after 120 days via native TTL) |
 | Reverse proxy | Traefik v3 (production)                                              |

docs/contributor/development/project-structure.md

@@ -19,7 +19,7 @@ Apollon/
 │       ├── src/              # components, stories, compiled CSS sources
 │       └── package.json
 ├── standalone/
-│   ├── server/               # @tumaet/server — Express + Redis + WebSocket relay
+│   ├── server/               # @tumaet/server — Hono + Redis + WebSocket relay
 │   │   ├── src/
 │   │   ├── Dockerfile
 │   │   └── package.json

docs/contributor/development/visual-tests.md

@@ -6,7 +6,7 @@ description: Regenerating Playwright snapshots inside the pinned Docker image.
 
 # Visual regression tests
 
-Apollon's visual regression tests run on **every PR** as the `visual-regression-tests` job in `pr-health-checks.yml`, feeding the required **PR Health Gate** check. Gating per-PR forces a rendering change to refresh its own baselines in the same PR; running them nightly-only instead lets a rendering change merge green and resurface later as an orphaned failure on an unrelated PR. They use Playwright with the `mcr.microsoft.com/playwright:v1.59.1-noble` Docker image so snapshots are pinned to one Linux rendering stack regardless of contributor OS.
+Apollon's visual regression tests run on **every PR** as the `visual-regression-tests` job in `pr-health-checks.yml`, feeding the required **PR Health Gate** check. Gating per-PR forces a rendering change to refresh its own baselines in the same PR; running them nightly-only instead lets a rendering change merge green and resurface later as an orphaned failure on an unrelated PR. They use Playwright with the `mcr.microsoft.com/playwright:v1.61.1-noble` Docker image so snapshots are pinned to one Linux rendering stack regardless of contributor OS.
 
 ## Regenerating baselines
 
@@ -22,7 +22,7 @@ From the repo root:
 
 ```sh
 docker run --rm -v "$(pwd)":/work -w /work --ipc=host \
-  mcr.microsoft.com/playwright:v1.59.1-noble \
+  mcr.microsoft.com/playwright:v1.61.1-noble \
   bash -c "curl -fsSL https://deb.nodesource.com/setup_24.x | bash - \
     && apt-get install -y nodejs \
     && npm install -g pnpm@11.1.3 \

docs/library/overview.md

@@ -19,7 +19,7 @@ Apollon ships as an npm library that any framework can embed. The public API is
 `@tumaet/apollon` ships a single build that externalizes every runtime
 dependency a host can install — the React family (`react`, `react-dom`,
 `@xyflow/react`), the CRDT singletons (`yjs`, `y-protocols`), and Apollon's own
-runtime deps (`@base-ui/react`, `lucide-react`, `@dnd-kit`, `zustand`, `uuid`,
+runtime deps (`@base-ui/react`, `lucide-react`, `@dnd-kit`, `zustand`,
 `@chenglou/pretext`), which install transitively with the package. Your bundler
 resolves and de-duplicates each one against your app's `node_modules`, and your
 bundle analyzer / SBOM tooling sees them as the real packages they are — never a

docs/package.json

@@ -18,9 +18,9 @@
     "@docusaurus/faster": "3.10.1",
     "@docusaurus/preset-classic": "3.10.1",
     "@docusaurus/theme-mermaid": "3.10.1",
-    "@easyops-cn/docusaurus-search-local": "0.55.1",
+    "@easyops-cn/docusaurus-search-local": "0.55.2",
     "@mdx-js/react": "3.1.1",
-    "@mermaid-js/layout-elk": "0.2.1",
+    "@mermaid-js/layout-elk": "0.2.2",
     "@tumaet/apollon": "workspace:*",
     "@xyflow/react": "catalog:",
     "clsx": "catalog:",