Third-party notices and component manifest
License scope
Except where otherwise noted, original DiagramZip code is licensed under the root MIT License. This repository is a multi-license distribution: third-party source, generated artifacts, fonts, and visual assets retain their own licenses and terms. A license listed below applies to the identified component or combined deployable unit; it does not automatically relicense an independent service or the repository as a whole.
The component and path mapping below is the repository-level source of truth. Nested notices provide versions, revisions, hashes, modifications, dependency details, and complete legal texts. Lockfile presence alone is not treated as evidence that a dependency is included in a shipped artifact.
Project history
DiagramZip began with an import of Kroki
v0.32.1 at commit 99f285a0d50c3882e20dc449b63c5358aa889b83,
under the MIT License.
Copyright (c) 2020-present Kroki and its contributors.
Retained foundation code may continue to use io.kroki, KROKI_*, @kroki/,
or Kroki-compatible HTTP names where changing them would break compatibility
or obscure upstream provenance. Those identifiers do not identify the
DiagramZip product, repository, or hosted service.
Application and service manifest
| Paths or deliverable | Material | License and scope | Detailed record |
|---|---|---|---|
apps/, services/, renderers/, renderers/, shared/ |
Original DiagramZip application and service code | MIT | LICENSE |
| Editor browser bundle | Monaco Editor, pako, saxes, and emitted transitive runtime code | Permissive upstream licenses; the current build does not emit a consolidated artifact notice | package-lock.json is a dependency inventory, not a shipped-artifact manifest |
apps/ |
Docusaurus and documentation runtime dependencies | Permissive upstream licenses; the current build does not emit a consolidated artifact notice | apps/ is a dependency inventory, not a shipped-artifact manifest |
| Retained Kroki foundation | Source retained from the recorded Kroki import | MIT | This file and LICENSE |
Renderer component manifest
| Renderer paths or deployable unit | Third-party material | License and effective boundary | Detailed record or full text |
|---|---|---|---|
renderers/ |
Mermaid 11.17.0 and its emitted browser dependencies | Mermaid is MIT; browser bundle is delivered to recipients | Mermaid text, package lock |
| Excalidraw Worker | Excalidraw 0.18.1, RoughJS, linkedom, and emitted runtime dependencies | Excalidraw and its runtime dependencies retain their upstream permissive licenses inside the emitted Worker | Excalidraw text, generated npm runtime notice |
renderers/ |
diagrams.net 29.6.1 export runtime, shapes, stencils, images, and math assets | Application code is Apache-2.0; visual assets retain the additional diagrams.net terms. The built Browser Run frame publishes both beside the bundle | renderer notice, nested vendor/ files |
TikZ edge Worker and renderers/ |
@planktimerr/ 1.0.63 plus TeX/TikZ assets |
The Worker adapter and derived TikZJax core are GPL-3.0-or-later; bundled TeX/TikZ material is LPPL-1.3c. Corresponding source, provenance, and terms are kept with the artifact | artifact provenance, renderers/ |
renderers/ |
Vendored WireViz release source and PyYAML | The in-process combined Worker unit is GPL-3.0-only; PyYAML is MIT. Separate services reached over HTTP or a service binding are outside this Python program | unit scope, notices |
renderers/ |
Vendored BlockDiag, SeqDiag, ActDiag, NwDiag family; Pillow, funcparserlib, webcolors, defusedxml; DejaVu Serif | Apache-2.0 renderer sources with HPND, BSD-3-Clause, PSF, and Bitstream/public-domain dependency and font terms | notices, vendor-licenses/ |
renderers/ |
Symbolator is the compatibility target only | DiagramZip reimplementation is MIT; no upstream Cairo/Pango implementation is vendored | notice |
| Bytefield Worker | bytefield-svg 1.11.0 |
EPL-2.0 dependency inside the emitted Worker; EPL scope remains with the covered program/files | EPL text, generated npm runtime notice |
D2 Worker and renderers/ |
D2 0.7.1 custom Wasm build and locked Go dependencies | D2 is MPL-2.0 file-level copyleft; other compiled modules retain their permissive licenses | provenance, toolchains/, go.sum |
GoAT Worker and renderers/ |
GoAT 0.5.1, parse/v2, and TinyGo-produced Wasm | GoAT and parse/v2 are permissively licensed; vendored modifications retain those terms | provenance, nested vendor licenses |
| GraphViz family Worker | GraphViz 15.1.1, Viz.js, Expat, DBML renderer, Zod | GraphViz and Bytefield portions are EPL-2.0; Viz.js, Expat, and Zod are MIT; DBML renderer is ISC | Viz notice, DBML notice, generated npm runtime notice |
| PlantUML family Worker | @plantuml/ 1.2026.6 with embedded GraphViz 14.1.1 |
PlantUML core is MIT; the embedded GraphViz portion remains EPL-2.0 | PlantUML notice, generated npm runtime notice |
Svgbob/Ditaa Worker and renderers/ |
Svgbob 0.7.6 Wasm and its locked Rust dependency graph | Svgbob is Apache-2.0; compiled crates retain their recorded licenses. Ditaa syntax is translated without bundling Ditaa | provenance, Apache text, toolchains/ |
Pikchr Worker and renderers/ |
Pikchr Wasm | 0BSD | provenance, text |
| Nomnoml Worker | Nomnoml and Graphre | MIT | Nomnoml text, generated npm runtime notice |
| Vega family Worker | Vega 6.3.1, Vega-Lite 6.4.3, D3 and emitted transitive runtime packages | BSD-3-Clause, ISC, MIT, and other permissive terms, scoped to their packages | Vega, Vega-Lite, generated npm runtime notice |
| WaveDrom Worker | WaveDrom 3.6.2 and emitted runtime packages | MIT and other permissive package terms | WaveDrom text, generated npm runtime notice |
UMLet, ERD, Structurizr, and C4 lowering code under renderers/ |
Format-compatible DiagramZip implementations | Original implementation code is MIT unless a file says otherwise; no UMLet, ERD, Structurizr, or C4 reference implementation is vendored | LICENSE |
| Remaining edge adapters and runtime | Original DiagramZip orchestration and sanitization code | MIT; dependencies used by each emitted Worker are determined from its bundle, not the entire edge lockfile | generated npm runtime notice |
Reference-only license texts
Some files under licenses/ record the license of a compatibility target even
though its implementation is not included. They are retained to make that
distinction explicit, not because their copyleft terms govern the DiagramZip
implementation:
licenses/: Ditaa is a syntax-compatibility path that translates to Svgbob; no Ditaa Java/native runtime is bundled.ditaa-mini-license.txt licenses/: the UMLet renderer is an original TypeScript implementation and does not vendor UMLet GPL source.umlet-license.txt licenses/: the ERD parser/lowerer is an original TypeScript implementation; the text records the compatibility target.erd-unlicense.txt licenses/: Excalidraw is bundled into the dedicated edge Worker. Its emitted npm dependencies and license texts are recorded inexcalidraw-license.txt renderers/.edge/ artifacts/ licenses/ npm-runtime-NOTICE.md
The Symbolator relationship is documented beside that Worker rather than in the root license directory.
Artifact-specific notice generation
renderers/ is generated from
Wrangler deploy metafiles for every renderers/
configuration. It includes locked versions, declared licenses, consuming
Worker units, and complete license/notice texts for npm packages present in
the emitted bundles. Dependencies used only by Wrangler, tests, type checking,
or local builds are deliberately excluded.
Regenerate and verify it from renderers/:
npm run generate:licenses
npm run check:licenses
Python units maintain deployment-specific notices beside their source.
TikZ keeps corresponding source, transformation provenance, and license texts
in renderers/. Diagrams.net publishes source and license
material directly in its built static asset directory.
The editor and documentation builds do not yet generate bundle-derived legal notices. Their lockfiles are useful inputs to a future artifact-specific check, but they contain development and build dependencies as well as code that may reach the deployed bundles. This manifest deliberately does not present those lockfiles as complete redistribution notices.
Redistribution
This manifest is not a substitute for the referenced legal texts. A redistributor should include the root MIT license plus the notices, source availability statements, and complete terms for every renderer or artifact it actually ships. A redistributor that omits a renderer should omit neither the license of material it still ships nor claim that a reference-only license applies to unrelated DiagramZip code.