perf(apollo-wind): use cnfast for class merging

[SreedharAvvari]

Summary

• Replace Apollo Wind's shared cn implementation with cnfast.
• Remove Apollo Wind's direct runtime dependency on clsx and tailwind-merge.
• Keep the final diff focused on the production migration; the temporary benchmark harness was removed before this PR.

Benchmarking

Benchmarks were run locally before removing the harness from the final diff.

Command:

pnpm --filter @uipath/apollo-wind bench:cn

Benchmark corpus:

• packages/apollo-wind/src: 155 files
• packages/apollo-react/src/canvas: 387 files
• Apollo React perf stories: CanvasPerformance.stories.tsx, Flow.stories.tsx
• Total source profiles: 544 files
• Harvested class strings: 2,934
• Parity: 0 mismatches across 17,241 generated Apollo cases

Workload	Cases/pass	Old twMerge(clsx) time/pass	cnfast time/pass	Speedup	Saved/pass
Apollo cn() call-site replay	707	3.53 ms	0.06 ms	54.73x	3.47 ms
Apollo class corpus/cache pressure	2,934	44.99 ms	15.03 ms	2.99x	29.96 ms
Consumer override matrix	1,600	25.97 ms	6.77 ms	3.83x	19.20 ms
Live grid frame stress	12,000	252.24 ms	75.85 ms	3.33x	176.38 ms

Notes:

• The call-site replay is the closest profile to real Apollo code shape: it materializes actual cn(...) calls from Apollo Wind and Apollo React canvas sources, including the existing perf stories.
• The class corpus/cache-pressure profile stresses broad Tailwind conflict resolution across harvested Apollo class strings plus arbitrary values and consumer overrides.
• The consumer override matrix models Apollo base component classes merged with likely downstream className overrides.
• These numbers isolate class merging cost only. They do not include React reconciliation, layout, paint, browser scheduling, or FPS.

Supply-chain and compatibility checks

• cnfast is pinned to exact version 0.0.8 in packages/apollo-wind/package.json and pnpm-lock.yaml.
• The package has no runtime dependencies and no install-time lifecycle scripts in its published package.json.
• It does expose a CLI binary via bin, but Apollo Wind imports only the package entrypoint. The binary is not executed by this change.
• cnfast publishes conditional exports for both ESM and CJS:
  • import -> dist/index.mjs
  • require -> dist/index.cjs
• Apollo Wind build output was checked:
  • ESM output imports cnfast.
  • CJS output requires cnfast.
  • Generated declarations keep a local Apollo Wind cn(...inputs): string wrapper signature.
• Local smoke checks passed for both module modes:
  • require('cnfast').cn('px-2', 'px-4') === 'px-4'
  • import { cn } from 'cnfast'; cn('px-2', 'px-4') === 'px-4'
• Automated PR supply-chain/security checks passed on GitHub, including dependency review, production dependency audit, package signature audit, license check, Socket Security, and CodeQL. If a separate manual third-party approval is required, this PR should remain draft until that approval is complete.

Validation

• pnpm --filter @uipath/apollo-wind exec biome lint src/lib/utils.ts package.json
• pnpm --filter @uipath/apollo-wind test -- src/lib/utils.test.ts
  • 60 files passed
  • 982 tests passed
• pnpm --filter @uipath/apollo-wind build

[github-actions]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Review	Updated (PT)
apollo-design	🟢 Ready	Preview, Logs	Jul 09, 2026, 11:14:42 AM
apollo-docs	🟢 Ready	Preview, Logs	Jul 09, 2026, 11:14:42 AM
apollo-landing	🟢 Ready	Preview, Logs	Jul 09, 2026, 11:14:42 AM
apollo-vertex	🟢 Ready	Preview, Logs	Jul 09, 2026, 11:14:42 AM

[github-actions]

Dependency License Review

• ✅ 1949 package(s) scanned
• ✅ No license issues found
• ⚠️ 2 package(s) excluded (see details below)

License distribution

License	Packages
MIT	1719
ISC	89
Apache-2.0	55
BSD-3-Clause	27
BSD-2-Clause	23
BlueOak-1.0.0	8
MPL-2.0	4
MIT-0	3
CC0-1.0	3
MIT OR Apache-2.0	2
(MIT OR Apache-2.0)	2
Unlicense	2
LGPL-3.0-or-later	1
Python-2.0	1
CC-BY-4.0	1
(MPL-2.0 OR Apache-2.0)	1
Unknown	1
Artistic-2.0	1
(WTFPL OR MIT)	1
(BSD-2-Clause OR MIT OR Apache-2.0)	1
CC-BY-3.0	1
0BSD	1
(MIT OR CC0-1.0)	1
MIT AND ISC	1

Excluded packages

Package	Version	License	Reason
@img/sharp-libvips-linux-x64	1.2.4	LGPL-3.0-or-later	LGPL pre-built binary, not linked
khroma	2.1.0	Unknown	MIT per GitHub repo, missing license field in package.json

[Copilot]

Pull request overview

This PR updates @uipath/apollo-wind’s cn (class merging) utility to use cnfast, aiming to improve class merge performance while removing the previous clsx + tailwind-merge implementation.

Changes:

• Replace local cn implementation with cnfast.
• Remove clsx and tailwind-merge from packages/apollo-wind dependencies; add cnfast@0.0.8.
• Update pnpm-lock.yaml to reflect the dependency swap.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 2 comments.

File	Description
pnpm-lock.yaml	Removes clsx/tailwind-merge from the apollo-wind importer and adds cnfast@0.0.8 snapshot/package entry.
packages/apollo-wind/src/lib/utils.ts	Switches cn export to come from cnfast rather than a local implementation.
packages/apollo-wind/package.json	Updates runtime dependencies: adds cnfast, removes clsx and tailwind-merge.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

[github-actions]

📊 Coverage + size by package

Per-package coverage and bundle size on this PR. New-line coverage = of the source lines this PR adds or changes, the % hit by tests.

Package	Coverage	New-line coverage	Packed (gzip)	Unpacked	vs main
@uipath/apollo-core	9.0%	—	43.82 MB	57.31 MB	±0
@uipath/apollo-react	34.5%	—	7.27 MB	27.60 MB	±0
@uipath/apollo-wind	40.3%	100.0% (1/1)	394.9 KB	2.57 MB	−51 B
@uipath/ap-chat	85.8%	—	43.41 MB	55.85 MB	±0

_{"Coverage" is each package's own coverage.include scope (e.g. apollo-core instruments only scripts/). "Packed"/"Unpacked" come from npm pack --dry-run and only cover built packages — "—" means not measured this run (package not affected / not built). "vs main" is the packed (gzipped) delta against the last successful main build (the package-sizes artifact from the Release workflow); "—" there means no main baseline was available this run. The baseline is main's latest build, not this PR's exact merge-base, so it includes any drift since the branch diverged. Packages with no vitest config are omitted.}

[Copilot]

Pull request overview

Copilot reviewed 2 out of 3 changed files in this pull request and generated no new comments.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file