chore: pull deferred quality gates into scope

Fixes the rest of the round-3/4 deferred punch list. Six concrete
items; cspNonce option deferred separately (requires library API
design + careful emotion-cache plumbing).

Library quality gates

- `size-limit` budgets in `library/package.json#size-limit`:
  standalone entry < 220 kB, /react entry < 50 kB, yjs sync chunk
  < 210 kB (size-limit measures the full transitive graph at
  runtime — different from Vite's gzip column, but the actual
  consumer-visible cost). New `pnpm run size` script and CI step in
  `library-node22-compat`. Verified: 166/29/159 kB current, all
  under budget.
- New `library-react19-compat` CI job in pr-health-checks.yml:
  installs React 19 + ReactDOM 19 + @types/react@19 + @types/react-dom@19
  + @testing-library/react@16 just inside the library workspace,
  rebuilds, reruns 774 tests. The peer range `^18.3.0 || ^19.0.0`
  was previously claimed but unverified. Wired into the
  `pr-health-gate` required-check.

Library: rules-of-hooks bug fixes (formerly latent crashes)

- `lib/nodes/sfcDiagram/SfcJump.tsx`: hooks `useMemo` (minWidth) +
  `useEffect` (auto-resize) were called AFTER `if (!width || !height)
  return null`. If width/height ever flipped, React would see a
  different number of hooks across renders → crash. Hoisted both
  hooks above the early return.
- `lib/nodes/sfcDiagram/SfcActionTable.tsx`: same pattern, same fix.
- `lib/components/popovers/bpmnDiagram/BPMNPoolEditPopover.tsx`:
  `useState(poolNode.data.name)` called after `if (!poolNode) return
  null`. Lifted state init above the early return; falls back to ""
  when the pool node hasn't materialized yet.
- Library eslint promotes `react-hooks/rules-of-hooks` back to
  `error` (warnings only for `exhaustive-deps`, where ~15 hooks have
  legitimate deliberate-stale-closure patterns).

Library public API tightening

- Move v2/v3 version-migration helpers out of the public root export
  into `@tumaet/apollon/internals`:
  - `convertV2ToV4`, `convertV3ToV4`, `convertV3HandleToV4`,
    `convertV3NodeTypeToV4`, `convertV3EdgeTypeToV4`,
    `convertV3MessagesToV4`, `isV2Format`, `isV3Format`, `isV4Format`
  - All `V3*Typings` (`V3UMLClassifier`, `V3BPMNTask`, etc.)
- `importDiagram` remains the public entry — that's what consumers
  actually use to normalize any version of the model to v4. The
  rest were accidentally-public internals leaked through the
  `export * from "./versionConverter"` barrel.
- `lib/utils/index.ts` now does `export { importDiagram }` instead
  of `export *`.

Monorepo

- `capacitor.config.ts` moved from repo root to
  `standalone/webapp/capacitor.config.ts`. `webDir` adjusted from
  "standalone/webapp/dist" to "dist". Verified no `android/` or
  `ios/` native folders to orphan. All `pnpm capacitor:*` scripts at
  root now delegate via `--filter @tumaet/webapp`; the docs at
  `docs/mobile/ios-android-setup.md` continue to work unchanged
  (they only call `pnpm capacitor:*` from root).
- `@capacitor/cli` and `@capacitor/assets` moved from root devDeps
  to `standalone/webapp/devDependencies` (where `cap` and
  `capacitor-assets` actually run).
- Root `@types/node` now references the catalog.

Local feedback loop

- `.husky/pre-push` runs `pnpm run lint` before pushes — catches
  eslint errors before they burn a CI run.
- `lint-staged` extended: `*.{ts,tsx,js,jsx,mjs,cjs}` now runs
  `prettier --write` AND `eslint --fix --no-warn-ignored` on
  staged files (was prettier-only). Pre-commit feedback in
  ~1 sec/file instead of waiting for CI.

CI hardening (from round-4 server audit)

- `pr-health-checks.yml` already had publint+attw added in a prior
  push; size-limit step + React 19 matrix job round it out.

Author: FelixTJDietrich

.github/workflows/pr-health-checks.yml

@@ -199,6 +199,55 @@ jobs:
         # dlx resolves the binary from the package name implicitly.
         run: pnpm dlx @arethetypeswrong/cli@0.18.1 attw --pack . --profile esm-only
 
+      - name: Enforce bundle-size budget
+        working-directory: library
+        # Budgets in library/package.json#size-limit. Fails on regression
+        # of >10% (size-limit default) per artifact.
+        run: pnpm run size
+
+  # The library declares `react: ^18.3 || ^19` as a peer. Back the upper
+  # bound with a build + test against React 19 so the range claim is
+  # actually verified.
+  library-react19-compat:
+    needs: [detect-changes]
+    if: needs.detect-changes.outputs.should-skip != 'true' && needs.detect-changes.outputs.library == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@ac6db6d3c1f721f886538a378a2d73e85697340a # v6.0.8
+
+      - name: Set up Node
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
+        with:
+          node-version-file: ".nvmrc"
+          cache: "pnpm"
+
+      - name: Override library devDeps to React 19 via pnpm.overrides
+        # Run only inside the library workspace; the rest of the
+        # monorepo stays on React 18.3 (matches Artemis / standalone
+        # webapp consumers). MUI v6 peer-supports React 19 since 6.0.
+        run: |
+          pnpm --filter @tumaet/apollon add -D \
+            react@19 \
+            react-dom@19 \
+            @types/react@19 \
+            @types/react-dom@19 \
+            @testing-library/react@16 \
+            --save-exact --ignore-scripts
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile=false --config.engine-strict=false
+
+      - name: Build library against React 19
+        run: pnpm --filter @tumaet/apollon run build
+
+      - name: Run library unit tests against React 19
+        run: pnpm --filter @tumaet/apollon run test
+
   # Baseline regeneration: see docs/development/visual-tests.md.
   visual-regression-tests:
     needs: [detect-changes]
@@ -258,6 +307,7 @@ jobs:
         detect-changes,
         lint-and-format-check,
         library-node22-compat,
+        library-react19-compat,
         e2e-tests,
         visual-regression-tests,
       ]

.husky/pre-push

@@ -0,0 +1 @@
+pnpm run lint

library/eslint.config.js

@@ -16,15 +16,13 @@ export default [
   {
     settings: { react: { version: "detect" } },
     plugins: { "react-hooks": reactHooks },
-    // react-hooks: surfaced as warnings, not errors, in this turn cycle.
-    // The rules-of-hooks violations in lib/nodes/sfcDiagram/* are
-    // pre-existing latent crashes (hooks after an early return) and
-    // exhaustive-deps drift in ~15 hooks — fixing both is a behavioral
-    // change that doesn't belong in the foundational pnpm/Node migration.
-    // Tracked for a follow-up PR.
+    // rules-of-hooks at error (the pre-existing violations in
+    // lib/nodes/sfcDiagram/* were latent crashes — hooks called after an
+    // early return — and are now fixed). exhaustive-deps stays at warn
+    // because ~15 hooks have legitimate deliberate-stale-closure patterns
+    // (e.g. imperative editor lifecycle keyed on a single boolean).
     rules: {
       ...reactHooks.configs.recommended.rules,
-      "react-hooks/rules-of-hooks": "warn",
       "react-hooks/exhaustive-deps": "warn",
       "react/prop-types": "off",
       "no-console": "error",

library/lib/components/popovers/bpmnDiagram/BPMNPoolEditPopover.tsx

@@ -15,16 +15,16 @@ export const BPMNPoolEditPopover = ({ elementId }: PopoverProps) => {
     }))
   )
 
-  const poolNode = nodes.find(
-    (node) => node.id === elementId
-  ) as Node<BPMNPoolProps>
+  const poolNode = nodes.find((node) => node.id === elementId) as
+    | Node<BPMNPoolProps>
+    | undefined
+
+  const [poolName, setPoolName] = useState(poolNode?.data.name ?? "")
 
   if (!poolNode) {
     return null
   }
 
-  const [poolName, setPoolName] = useState(poolNode.data.name)
-
   const handlePoolNameChange = (value: string) => {
     setPoolName(value)
 

library/lib/internals.ts

@@ -1,5 +1,26 @@
-// Unstable surface: Yjs wire-protocol primitives for host integration
-// tests. NOT covered by semver. Do not import from application code.
+// Unstable surface: collaboration + version-migration primitives for host
+// integration tests. NOT covered by semver — do not import from application
+// code. Public consumers should use the documented `ApollonEditor` /
+// `importDiagram` API.
+
+// Yjs wire-protocol primitives.
 export { YjsSyncClass, MessageType } from "./sync/yjsSyncClass"
 export type { SendBroadcastMessage } from "./sync/yjsSyncClass"
 export { createHeadlessSync } from "./sync/headless"
+
+// Version-migration internals. `importDiagram` (root export) is the public
+// entry; everything else here lets a host introspect or test the conversion
+// pipeline against a frozen wire format. These names are *internal* and
+// may change in any release.
+export {
+  convertV2ToV4,
+  convertV3ToV4,
+  convertV3HandleToV4,
+  convertV3NodeTypeToV4,
+  convertV3EdgeTypeToV4,
+  convertV3MessagesToV4,
+  isV2Format,
+  isV3Format,
+  isV4Format,
+} from "./utils/versionConverter"
+export type * from "./utils/v3Typings"

library/lib/nodes/sfcDiagram/SfcActionTable.tsx

@@ -25,16 +25,10 @@ export function SfcActionTable({
     }))
   )
 
-  if (!width || !height) {
-    return null
-  }
-
   const actionRows = data?.actionRows || []
 
-  // Calculate minimum height based on rows (no header needed)
   const minHeight = useMemo(() => {
     const rowsHeight = actionRows.length * LAYOUT.DEFAULT_ATTRIBUTE_HEIGHT
-    // Ensure minimum height for at least one row
     return Math.max(rowsHeight, LAYOUT.DEFAULT_ATTRIBUTE_HEIGHT)
   }, [actionRows.length])
 
@@ -59,6 +53,10 @@ export function SfcActionTable({
     }
   }, [minHeight, height, id, setNodes])
 
+  if (!width || !height) {
+    return null
+  }
+
   return (
     <DefaultNodeWrapper width={width} height={height} elementId={id}>
       <NodeToolbar elementId={id} />

library/lib/nodes/sfcDiagram/SfcJump.tsx

@@ -25,18 +25,13 @@ export function SfcJump({
     }))
   )
 
-  if (!width || !height) {
-    return null
-  }
+  const fixedHeight = 32 // Fixed height for compact appearance
 
-  // Calculate minimum width based on text
   const minWidth = useMemo(() => {
     const textWidth = measureTextWidth(name || "", LAYOUT.DEFAULT_FONT) + 8
-    return calculateMinWidth(textWidth, LAYOUT.DEFAULT_PADDING) + 12 // Extra space for the diamond and padding
+    return calculateMinWidth(textWidth, LAYOUT.DEFAULT_PADDING) + 12
   }, [name])
 
-  const fixedHeight = 32 // Fixed height for compact appearance
-
   // Auto-expand/shrink width when text changes
   useEffect(() => {
     if (width && width !== minWidth) {
@@ -60,7 +55,11 @@ export function SfcJump({
     }
   }, [minWidth, width, id, setNodes])
 
-  const finalWidth = Math.max(width ?? 0, minWidth)
+  if (!width || !height) {
+    return null
+  }
+
+  const finalWidth = Math.max(width, minWidth)
   const finalHeight = fixedHeight
 
   return (

library/lib/utils/index.ts

@@ -12,7 +12,9 @@ export * from "./diagramTypeUtils"
 export * from "./storeUtils"
 export * from "./deepPartial"
 export * from "./bpmnConstraints"
-export * from "./versionConverter"
+// Only `importDiagram` is public; the V2/V3 convert helpers and format
+// detectors live in `@tumaet/apollon/internals` (internal/unstable).
+export { importDiagram } from "./versionConverter"
 export * from "./alignmentUtils"
 export * from "./requiredInterfaceUtils"
 // Deliberately narrow: only the helpers that node SVGs genuinely need to

library/package.json

@@ -64,8 +64,26 @@
     "lint:fix": "eslint --fix .",
     "test": "vitest run",
     "test:watch": "vitest",
-    "test:coverage": "vitest run --coverage"
+    "test:coverage": "vitest run --coverage",
+    "size": "size-limit"
   },
+  "size-limit": [
+    {
+      "name": "standalone entry (peers inlined)",
+      "path": "dist/index.js",
+      "limit": "220 kB"
+    },
+    {
+      "name": "/react entry (peers external)",
+      "path": "dist/react/index.js",
+      "limit": "50 kB"
+    },
+    {
+      "name": "yjs sync chunk",
+      "path": "dist/yjsSyncClass-*.js",
+      "limit": "210 kB"
+    }
+  ],
   "peerDependencies": {
     "@emotion/react": "^11.11.0",
     "@emotion/styled": "^11.11.0",
@@ -124,6 +142,8 @@
     "jsdom": "catalog:",
     "react": "catalog:",
     "react-dom": "catalog:",
+    "size-limit": "11.2.0",
+    "@size-limit/preset-big-lib": "11.2.0",
     "typescript": "catalog:",
     "typescript-eslint": "catalog:",
     "vite": "catalog:",

package.json

@@ -37,13 +37,13 @@
     "test": "pnpm --filter @tumaet/apollon run test",
     "test:e2e": "pnpm --filter @tumaet/webapp run test:e2e",
     "prepare": "husky || true",
-    "capacitor:add:android": "cap add android",
-    "capacitor:add:ios": "cap add ios --packagemanager CocoaPods",
-    "capacitor:sync": "cap sync",
-    "capacitor:open:android": "cap open android",
-    "capacitor:open:ios": "cap open ios",
-    "capacitor:assets:generate:ios": "capacitor-assets generate --ios",
-    "capacitor:assets:generate:android": "capacitor-assets generate --android",
+    "capacitor:add:android": "pnpm --filter @tumaet/webapp run capacitor:add:android",
+    "capacitor:add:ios": "pnpm --filter @tumaet/webapp run capacitor:add:ios",
+    "capacitor:sync": "pnpm --filter @tumaet/webapp run capacitor:sync",
+    "capacitor:open:android": "pnpm --filter @tumaet/webapp run capacitor:open:android",
+    "capacitor:open:ios": "pnpm --filter @tumaet/webapp run capacitor:open:ios",
+    "capacitor:assets:generate:ios": "pnpm --filter @tumaet/webapp run capacitor:assets:generate:ios",
+    "capacitor:assets:generate:android": "pnpm --filter @tumaet/webapp run capacitor:assets:generate:android",
     "package:vscode": "pnpm --filter apollon-vscode run package:vsix"
   },
   "license": "MIT",
@@ -52,19 +52,18 @@
     "pnpm": ">=11.1.0"
   },
   "devDependencies": {
-    "@capacitor/assets": "3.0.5",
-    "@capacitor/cli": "8.3.0",
     "@commitlint/cli": "19.6.0",
     "@commitlint/config-conventional": "19.6.0",
-    "@types/node": "24.12.4",
+    "@types/node": "catalog:",
     "concurrently": "9.1.0",
     "husky": "9.1.7",
     "lint-staged": "15.5.2",
     "prettier": "3.4.2"
   },
   "lint-staged": {
     "*.{js,jsx,mjs,cjs,ts,tsx}": [
-      "prettier --ignore-unknown --write"
+      "prettier --ignore-unknown --write",
+      "eslint --fix --no-warn-ignored"
     ],
     "*.{json,md,yml,yaml}": "prettier --ignore-unknown --write"
   }