fix(vscode-extension): unblock vsce release + theme bug

Release blockers caught by `vsce package`:

- `@types/vscode 1.110.0` greater than `engines.vscode ^1.86.0` →
  vsce errors at package time. Pin types to `~1.86.0` to match the
  broadest installable base.
- `LICENSE.txt` was 0 bytes; populate from repo LICENSE.
- `CHANGELOG.md` was 0 bytes; delete (Marketplace will render an
  empty Changelog tab otherwise).

User-visible bug:

- `editor/src/index.tsx` called `setTheme("light")` unconditionally,
  forcing white background regardless of VS Code's actual theme.
  Replace JS-based theme application with CSS variables scoped under
  the `body.vscode-light` / `body.vscode-dark` / `.vscode-high-contrast`
  classes VS Code applies automatically to webviews. The editor now
  follows live theme switches without any JS.
- Delete the dead `theme-switcher/` directory entirely (the
  `toggleTheme` helper had inverted logic and was never called).

Cleanup the round-3 audit caught:

- Drop dead deps: `@vscode/codicons` (both webviews, 0 references),
  `uuid` (replaced with `crypto.randomUUID()` / `node:crypto`
  randomUUID — VS Code's bundled Chromium 92+ and Node 24 both
  support it natively), `@types/uuid` (both workspaces).
- `vscode-extension/menu/package.json`: add `@tumaet/apollon` to
  dependencies — `App.tsx` imports `UMLDiagramType` and was relying
  on pnpm hoisting.
- `vscode-extension/src/types.ts`: replace hand-rolled `UMLDiagramType`
  / `UMLModel` with imports from `@tumaet/apollon`. The duplicate
  was already drifting (v4-pinned `version` template literal at
  library v5).
- `editor/tsconfig.json` / `menu/tsconfig.json`: drop dead cross-
  package includes (`../src/util.ts`, `../editor/src/types.ts`).
- Root `tsconfig.json`: `noEmit: true`, drop stale `outDir: "out"`,
  exclude `dist` + `.vscode-test.mjs` + `vite.config.ts`.
- `.vscodeignore`: drop dead `.vscode-test-web/**`, `dist/test/**`,
  `.yarnrc`, `vsc-extension-quickstart.md`, `**/.eslintrc.json`,
  `../**`. Add `eslint.config.mjs`, `*.tsbuildinfo`.
- `.gitignore`: drop stale `out` (Vite writes to `dist/`).
- `release-vscode-extension.yml`: backfill race — when `publish`
  is skipped (Marketplace already has this version) but the GitHub
  Release tag is missing, the `release` job was gated on
  `publish.result == 'success'` only. Accept `'skipped'` too.

Bundle effect: `dist/extension.js` smaller (uuid package gone),
editor + menu drop `@vscode/codicons` weight too.

Author: FelixTJDietrich

.editorconfig

@@ -0,0 +1,15 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+indent_style = space
+indent_size = 2
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[*.md]
+trim_trailing_whitespace = false
+
+[Makefile]
+indent_style = tab

.github/workflows/release-vscode-extension.yml

@@ -191,11 +191,14 @@ jobs:
   release:
     name: Tag + GitHub Release
     needs: [check, build, publish]
+    # Backfill case: marketplace already has this version (publish skipped)
+    # but the GitHub Release tag is missing. We still need to cut the
+    # Release. Accept publish.result in {success, skipped}.
     if: |
       !cancelled() && !inputs.dry_run &&
       needs.check.outputs.release == 'true' &&
       needs.build.result == 'success' &&
-      needs.publish.result == 'success'
+      (needs.publish.result == 'success' || needs.publish.result == 'skipped')
     runs-on: ubuntu-latest
     timeout-minutes: 5
     permissions:

SECURITY.md

@@ -0,0 +1,32 @@
+# Security Policy
+
+## Reporting a vulnerability
+
+Please report security issues privately via [GitHub Security Advisories](https://github.com/ls1intum/Apollon/security/advisories/new). Do not open public GitHub issues for vulnerabilities.
+
+We aim to acknowledge reports within 5 working days and to coordinate a fix and disclosure timeline with you.
+
+## Supported versions
+
+Only the latest minor of each major is supported with security fixes.
+
+| Package                                             | Supported        |
+| --------------------------------------------------- | ---------------- |
+| `@tumaet/apollon` (npm)                             | `5.x`            |
+| Standalone Docker images (server + webapp)          | latest `vX.Y.Z`  |
+| `tumaet.apollon-vscode` (VS Marketplace / Open VSX) | latest published |
+
+Older majors are end-of-life and will not receive backports.
+
+## Scope
+
+In scope:
+
+- `@tumaet/apollon` library code and its public API.
+- The standalone server (`standalone/server`) and webapp (`standalone/webapp`).
+- The VS Code extension (`vscode-extension`).
+
+Out of scope:
+
+- Third-party services the deployment connects to (e.g., Artemis instances).
+- Self-XSS that requires a privileged user to paste an attacker-controlled payload into a diagram body inside the same browser session.

library/CHANGELOG.md

@@ -0,0 +1,37 @@
+# Changelog
+
+All notable changes to `@tumaet/apollon` will be documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this package adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+GitHub Releases at <https://github.com/ls1intum/Apollon/releases> carry the full per-release notes; this file tracks breaking-change summaries.
+
+## [5.0.0]
+
+### Breaking
+
+- **Dropped the `@tumaet/apollon/react` subpath** and the standalone 2.4 MB bundle that inlined React/MUI/emotion/xyflow. The default `@tumaet/apollon` import now always externalizes those packages as **mandatory peer dependencies**.
+- **`peerDependenciesMeta` removed** — peers are no longer optional. Install React, ReactDOM, `@mui/material`, `@emotion/react`, `@emotion/styled`, and `@xyflow/react` explicitly.
+- **Internal sync exports moved** to a new `@tumaet/apollon/internals` subpath (`YjsSyncClass`, `MessageType`, `createHeadlessSync`). The new subpath is explicitly **not** covered by SemVer.
+
+### Migration from 4.x
+
+```diff
+- import { ApollonEditor } from "@tumaet/apollon/react"
++ import { ApollonEditor } from "@tumaet/apollon"
+```
+
+```sh
+npm install @tumaet/apollon@5 \
+  react react-dom \
+  @emotion/react @emotion/styled @mui/material @xyflow/react
+```
+
+Standalone (non-React) consumers who previously imported from `@tumaet/apollon` must now install the React peers as well. See `README.md`.
+
+### Other
+
+- Single Vite pass (`tsc -b && vite build`); the prior dual-build + `rm -rf dist/react/assets` hack is gone.
+- `dist/index.d.ts` is rolled up into a single self-contained file (no internal relative imports without `.js` suffix). NodeNext consumers resolve cleanly.
+- esbuild `drop` narrowed to `["debugger"]` — `console.warn` calls from React/MUI/emotion are no longer stripped at minification.
+- README rewritten: ~73 lines, React-only, one factual install command.
+
+[5.0.0]: https://github.com/ls1intum/Apollon/releases

library/lib/utils/quadrantUtils.ts

@@ -1,17 +1,16 @@
 import { Quadrant } from "@/enums"
 import { XYPosition } from "@xyflow/react"
 
+// Tiebreak on axis equality: `>=` on both axes means a target sitting
+// exactly on the reference line falls into the bottom-right quadrant.
 export const getQuadrant = (
   target: XYPosition,
   reference: XYPosition
 ): Quadrant => {
-  if (target.x > reference.x && target.y > reference.y) {
-    return Quadrant.BottomRight
-  } else if (target.x < reference.x && target.y > reference.y) {
-    return Quadrant.BottomLeft
-  } else if (target.x > reference.x && target.y < reference.y) {
-    return Quadrant.TopRight
-  } else {
-    return Quadrant.TopLeft
-  }
+  const right = target.x >= reference.x
+  const bottom = target.y >= reference.y
+  if (right && bottom) return Quadrant.BottomRight
+  if (!right && bottom) return Quadrant.BottomLeft
+  if (right && !bottom) return Quadrant.TopRight
+  return Quadrant.TopLeft
 }

library/lib/utils/storeUtils.ts

@@ -1,3 +1,32 @@
-export const deepEqual = <T>(a: T, b: T): boolean => {
-  return JSON.stringify(a) === JSON.stringify(b)
+// Structural deep-equal. Used by `diagramStore` to short-circuit nodes/edges
+// replays when no semantic change occurred. Tolerant of key-order differences
+// and treats `{a: undefined}` and `{}` as equal (matching the JSON wire format
+// the editor round-trips through).
+export const deepEqual = (a: unknown, b: unknown): boolean => {
+  if (Object.is(a, b)) return true
+  if (
+    typeof a !== "object" ||
+    typeof b !== "object" ||
+    a === null ||
+    b === null
+  ) {
+    return false
+  }
+  if (Array.isArray(a)) {
+    if (!Array.isArray(b) || a.length !== b.length) return false
+    for (let i = 0; i < a.length; i++) {
+      if (!deepEqual(a[i], b[i])) return false
+    }
+    return true
+  }
+  if (Array.isArray(b)) return false
+  const aObj = a as Record<string, unknown>
+  const bObj = b as Record<string, unknown>
+  const keys = new Set<string>()
+  for (const k of Object.keys(aObj)) if (aObj[k] !== undefined) keys.add(k)
+  for (const k of Object.keys(bObj)) if (bObj[k] !== undefined) keys.add(k)
+  for (const k of keys) {
+    if (!deepEqual(aObj[k], bObj[k])) return false
+  }
+  return true
 }

library/tests/unit/quadrantUtils.test.ts

@@ -21,27 +21,25 @@ describe("getQuadrant", () => {
     expect(getQuadrant({ x: 50, y: 50 }, ref)).toBe(Quadrant.TopLeft)
   })
 
-  // Boundary: same x or same y → falls into else (TopLeft)
-  it("returns TopLeft when x equals reference x and y < ref.y", () => {
-    expect(getQuadrant({ x: 100, y: 50 }, ref)).toBe(Quadrant.TopLeft)
+  // Axis-equality tiebreak: `>=` on both axes lands at BottomRight.
+  it("returns TopRight when x equals reference x and y < ref.y", () => {
+    expect(getQuadrant({ x: 100, y: 50 }, ref)).toBe(Quadrant.TopRight)
   })
 
-  it("returns TopLeft when y equals reference y and x < ref.x", () => {
-    expect(getQuadrant({ x: 50, y: 100 }, ref)).toBe(Quadrant.TopLeft)
+  it("returns BottomLeft when y equals reference y and x < ref.x", () => {
+    expect(getQuadrant({ x: 50, y: 100 }, ref)).toBe(Quadrant.BottomLeft)
   })
 
-  it("returns TopLeft when both x and y equal reference", () => {
-    expect(getQuadrant({ x: 100, y: 100 }, ref)).toBe(Quadrant.TopLeft)
+  it("returns BottomRight when target sits exactly on the reference", () => {
+    expect(getQuadrant({ x: 100, y: 100 }, ref)).toBe(Quadrant.BottomRight)
   })
 
-  it("returns TopLeft when x equals reference x and y > ref.y", () => {
-    // x == ref.x → first two conditions fail, third fails → else → TopLeft
-    expect(getQuadrant({ x: 100, y: 200 }, ref)).toBe(Quadrant.TopLeft)
+  it("returns BottomRight when x equals reference x and y > ref.y", () => {
+    expect(getQuadrant({ x: 100, y: 200 }, ref)).toBe(Quadrant.BottomRight)
   })
 
-  it("returns TopLeft when y equals reference y and x > ref.x", () => {
-    // y == ref.y → all conditions that check y fail → else → TopLeft
-    expect(getQuadrant({ x: 200, y: 100 }, ref)).toBe(Quadrant.TopLeft)
+  it("returns BottomRight when y equals reference y and x > ref.x", () => {
+    expect(getQuadrant({ x: 200, y: 100 }, ref)).toBe(Quadrant.BottomRight)
   })
 
   it("works with negative coordinates", () => {
@@ -60,12 +58,6 @@ describe("getQuadrant", () => {
     )
   })
 
-  it("works with large coordinate values", () => {
-    expect(getQuadrant({ x: 999999, y: 999999 }, { x: 0, y: 0 })).toBe(
-      Quadrant.BottomRight
-    )
-  })
-
   it("works with floating point coordinates", () => {
     expect(getQuadrant({ x: 100.001, y: 100.001 }, ref)).toBe(
       Quadrant.BottomRight

library/tests/unit/storeUtils.test.ts

@@ -96,4 +96,19 @@ describe("deepEqual", () => {
     const b = { nodes: [{ id: "1", pos: { x: 0, y: 0 } }], edges: [] }
     expect(deepEqual(a, b)).toBe(true)
   })
+
+  it("treats key insertion order as semantically irrelevant", () => {
+    expect(deepEqual({ x: 1, y: 2 }, { y: 2, x: 1 })).toBe(true)
+  })
+
+  it("treats explicit undefined as equal to missing property", () => {
+    expect(deepEqual({ a: 1, b: undefined }, { a: 1 })).toBe(true)
+    expect(deepEqual({ a: 1 }, { a: 1, b: undefined })).toBe(true)
+  })
+
+  it("returns false for primitive vs object", () => {
+    expect(deepEqual({}, null)).toBe(false)
+    expect(deepEqual(null, {})).toBe(false)
+    expect(deepEqual([1], 1)).toBe(false)
+  })
 })

library/vite.config.ts

@@ -42,7 +42,6 @@ export default defineConfig({
       },
     },
     minify: true,
-    commonjsOptions: { include: [/node_modules/] },
   },
   resolve: {
     alias: { "@": resolve(__dirname, "lib") },

package.json

@@ -3,7 +3,7 @@
   "version": "1.0.0",
   "description": "Apollon monorepo — UML modeling editor (library, webapp, server, VS Code extension).",
   "private": true,
-  "packageManager": "pnpm@11.1.3",
+  "packageManager": "pnpm@11.1.3+sha512.c85357fe17ca12dd23dd7071822666dfd7e3cb76fe214e3370b5ea2fb34f2a231185509b63e717f3cd0acb38dd3f8d82bcd5e8172400ae678b70ea4fbed0896d",
   "scripts": {
     "build": "pnpm run build:lib && concurrently \"pnpm run build:server\" \"pnpm run build:webapp\"",
     "build:lib": "pnpm --filter @tumaet/apollon run build",