chore: monorepo cleanup — correct override floors, healthchecks, hygiene

- pnpm-workspace.yaml override floors: previously over-applied
  patches mass-bumped transitive consumers to unblessed branches.
  Tighten to the minimum fixed version per advisory:
  - lodash ">=4.18.0" → ">=4.17.21" (CVE-2019-10744 fixed in 4.17.12)
  - tar ">=7.5.11" → ">=6.2.1" (CVE-2024-28863 fixed in 6.2.1; was
    forcing every consumer through a tar 6→7 major)
  - minimatch ">=5.0.0" → ">=3.0.5" (GHSA fixed in 3.0.5; was
    forcing a two-major jump)
  - brace-expansion ">=2.0.3" → ">=2.0.2" (GHSA fixed in 2.0.2)
  Drop redundant pnpm 11 defaults (linkWorkspacePackages: deep,
  preferWorkspacePackages, saveWorkspaceProtocol, dedupePeerDependents).
  Relabel the esbuild pin as "regression workaround, not CVE" — it
  was misleadingly grouped with vuln overrides.

- Root package.json: relocate misplaced deps to where they're used.
  All @capacitor/* runtime deps + capacitor-plugin-safe-area moved
  to standalone/webapp. @resvg/resvg-js moved to webapp devDeps
  (only used by tests/helpers/resvgRender.ts). @emotion/* removed
  from root (library already devDeps them; webapp now has them as
  direct deps so MUI's styled-engine resolves). Removed `yaml`
  (zero usages) and `iobuffer` (zero usages). @types/pdfmake at
  root (v0.3.2) removed — server uses the correct pinned v0.2.x.
  vite at root removed — each workspace has its own pin.

- Library theatre tests cut: textUtils.test.ts deleted (tested the
  jsdom mock equal to itself); storeUtils.test.ts engine-dependent
  "may be true or false" assertion removed. 772 → 772 useful tests.

- Library: trim long getBBox comment block in conversion-service.ts
  (now in extracted jsdom-shims.ts), kill file-wide eslint-disable.
  Pre-call patches hoisted to one-time worker init.

- Library: narrow esbuild `drop` to `["debugger"]`. `console`-drop
  was silently stripping React/MUI runtime warnings from the
  formerly-inlined standalone bundle.

- Library: ditch 5-line JSDoc bloat in lib/utils/textUtils.ts that
  duplicated the function signature.

- Library description trimmed from keyword-stuffed paragraph to one
  factual sentence.

- Library engines.node stays at >=22 (public package supports Node
  22 LTS through 2027); rest of monorepo pinned at >=24.15.0.

- Server, webapp Dockerfiles: HEALTHCHECK directives added so
  orchestrators get liveness signals from the image directly, not
  only from compose.

- .dockerignore tightened — excludes **/tests, **/__tests__,
  **/*.test.ts, vscode-extension/{src,*/src,*/dist,dist}, scripts/,
  .husky/, .changeset/. Saves cache layer hits.

- Webapp eslint warning: remove unused-disable-directive in
  LegalPage.tsx (no-console rule no longer fires here).

- release-library.yml: replace brittle `pnpm pack | tail -n 1`
  (pnpm/pnpm#10200 — pnpm warnings on stdout) with
  `pnpm pack --json | jq -r '.filename // .[0].filename'`.

- commitlint: add scope-enum (library | server | webapp | vscode |
  vscode-extension | deps | ci | docker | docs | release).

- Add .gitattributes: pnpm-lock.yaml as linguist-generated + binary
  merge, LF normalization, common binary types.

- Add lint-staged "ts/tsx prettier only" + json/md/yml prettier
  rules to root package.json (ESLint stays out of pre-commit; runs
  in CI).

- VS Code extension pre-existing lint errors fixed:
  - menu-provider.ts: drop unused `context`/`token` params from
    resolveWebviewView signature; drop unused `error` catch binding.
  - extension.ts: drop unused `error` catch binding.

Author: FelixTJDietrich

.dockerignore

@@ -1,6 +1,7 @@
 .git
 .github
 .gitignore
+.husky
 .context
 .env
 .env.*
@@ -16,15 +17,29 @@ test-results/
 *.log
 
 node_modules/
+**/node_modules/
 dist/
+**/dist/
+
+**/tests/
+**/__tests__/
+**/*.test.ts
+**/*.test.tsx
+**/*.spec.ts
+**/playwright.config.ts
+**/vitest.config.ts
 
-standalone/webapp/dist
-standalone/webapp/node_modules
 standalone/webapp/android
 standalone/webapp/ios
 
-standalone/server/dist
-standalone/server/node_modules
+# Keep the vscode-extension package.json files (pnpm install reads them
+# as workspace manifests), but drop the source.
+vscode-extension/src
+vscode-extension/menu/src
+vscode-extension/editor/src
+vscode-extension/menu/dist
+vscode-extension/editor/dist
+vscode-extension/dist
 
-library/node_modules
-library/dist
+scripts/
+.changeset/

.gitattributes

@@ -0,0 +1,11 @@
+* text=auto eol=lf
+
+pnpm-lock.yaml linguist-generated=true -diff merge=binary
+
+*.png binary
+*.jpg binary
+*.jpeg binary
+*.gif binary
+*.ico binary
+*.svg text
+*.vsix binary

.github/workflows/release-library.yml

@@ -86,8 +86,13 @@ jobs:
       - name: Pack
         id: pack
         working-directory: library
+        # `pnpm pack --json` writes the tarball path to stdout as structured
+        # output; previous `pnpm pack | tail -n 1` broke when pnpm logged
+        # warnings on stdout (pnpm/pnpm#10200).
         run: |
-          TARBALL=$(pnpm pack | tail -n 1)
+          set -euo pipefail
+          TARBALL=$(pnpm pack --json | jq -r '.filename // .[0].filename')
+          test -f "$TARBALL"
           echo "tarball=${TARBALL}" >> "$GITHUB_OUTPUT"
 
       - name: Publish to npm with OIDC trusted publishing

commitlint.config.mjs

@@ -1 +1,21 @@
-export default { extends: ['@commitlint/config-conventional'] };
+export default {
+  extends: ["@commitlint/config-conventional"],
+  rules: {
+    "scope-enum": [
+      2,
+      "always",
+      [
+        "library",
+        "server",
+        "webapp",
+        "vscode",
+        "vscode-extension",
+        "deps",
+        "ci",
+        "docker",
+        "docs",
+        "release",
+      ],
+    ],
+  },
+}

package.json

@@ -54,29 +54,16 @@
     "@capacitor/cli": "8.3.0",
     "@commitlint/cli": "19.6.0",
     "@commitlint/config-conventional": "19.6.0",
-    "@emotion/react": "11.11.1",
-    "@emotion/styled": "11.11.0",
-    "@resvg/resvg-js": "2.6.2",
     "@types/node": "24.12.4",
     "concurrently": "9.1.0",
     "husky": "9.1.7",
     "lint-staged": "15.5.2",
-    "prettier": "3.4.2",
-    "vite": "6.4.2",
-    "yaml": "2.8.3"
+    "prettier": "3.4.2"
   },
   "lint-staged": {
-    "*.{js,jsx,mjs,cjs,ts,tsx,json,md,yml,yaml}": "prettier --ignore-unknown --write"
-  },
-  "dependencies": {
-    "@capacitor/android": "8.3.0",
-    "@capacitor/core": "8.3.0",
-    "@capacitor/file-transfer": "2.0.4",
-    "@capacitor/filesystem": "8.1.2",
-    "@capacitor/ios": "8.3.0",
-    "@capacitor/share": "8.0.1",
-    "@capacitor/splash-screen": "8.0.1",
-    "@capacitor/status-bar": "8.0.2",
-    "capacitor-plugin-safe-area": "4.0.0"
+    "*.{js,jsx,mjs,cjs,ts,tsx}": [
+      "prettier --ignore-unknown --write"
+    ],
+    "*.{json,md,yml,yaml}": "prettier --ignore-unknown --write"
   }
 }