1# Third-party notices and component manifest23## License scope45Except where otherwise noted, original DiagramZip code is licensed under the6root [MIT License](LICENSE). This repository is a multi-license distribution:7third-party source, generated artifacts, fonts, and visual assets retain their8own licenses and terms. A license listed below applies to the identified9component or combined deployable unit; it does not automatically relicense an10independent service or the repository as a whole.1112The component and path mapping below is the repository-level source of truth.13Nested notices provide versions, revisions, hashes, modifications, dependency14details, and complete legal texts. Lockfile presence alone is not treated as15evidence that a dependency is included in a shipped artifact.1617## Project history1819DiagramZip began with an import of [Kroki](https://github.com/yuzutech/kroki)20v0.32.1 at commit `99f285a0d50c3882e20dc449b63c5358aa889b83`,21under the MIT License.2223Copyright (c) 2020-present Kroki and its contributors.2425Retained foundation code may continue to use `io.kroki`, `KROKI_*`, `@kroki/*`,26or Kroki-compatible HTTP names where changing them would break compatibility27or obscure upstream provenance. Those identifiers do not identify the28DiagramZip product, repository, or hosted service.2930## Application and service manifest3132| Paths or deliverable | Material | License and scope | Detailed record |33| --- | --- | --- | --- |34| `apps/editor/`, `services/`, `renderers/catalog/`, `renderers/shared/`, `shared/` | Original DiagramZip application and service code | MIT | [LICENSE](LICENSE) |35| Editor browser bundle | Monaco Editor, pako, saxes, and emitted transitive runtime code | Permissive upstream licenses; the current build does not emit a consolidated artifact notice | `package-lock.json` is a dependency inventory, not a shipped-artifact manifest |36| `apps/docs/` | Docusaurus and documentation runtime dependencies | Permissive upstream licenses; the current build does not emit a consolidated artifact notice | `apps/docs/package-lock.json` is a dependency inventory, not a shipped-artifact manifest |37| Retained Kroki foundation | Source retained from the recorded Kroki import | MIT | This file and [LICENSE](LICENSE) |3839## Renderer component manifest4041| Renderer paths or deployable unit | Third-party material | License and effective boundary | Detailed record or full text |42| --- | --- | --- | --- |43| `renderers/browser-run/frames/mermaid/` | Mermaid 11.17.0 and its emitted browser dependencies | Mermaid is MIT; browser bundle is delivered to recipients | [Mermaid text](licenses/mermaid-license.txt), package lock |44| Excalidraw Worker | Excalidraw 0.18.1, RoughJS, linkedom, and emitted runtime dependencies | Excalidraw and its runtime dependencies retain their upstream permissive licenses inside the emitted Worker | [Excalidraw text](licenses/excalidraw-license.txt), [generated npm runtime notice](renderers/edge/artifacts/licenses/npm-runtime-NOTICE.md) |45| `renderers/browser-run/frames/diagramsnet/` | diagrams.net 29.6.1 export runtime, shapes, stencils, images, and math assets | Application code is Apache-2.0; visual assets retain the additional diagrams.net terms. The built Browser Run frame publishes both beside the bundle | [renderer notice](renderers/browser-run/frames/diagramsnet/README.md), nested `vendor/assets/*/LICENSE` files |46| TikZ edge Worker and `renderers/edge/artifacts/tikz/` | `@planktimerr/tikzjax` 1.0.63 plus TeX/TikZ assets | The Worker adapter and derived TikZJax core are GPL-3.0-or-later; bundled TeX/TikZ material is LPPL-1.3c. Corresponding source, provenance, and terms are kept with the artifact | [artifact provenance](renderers/edge/artifacts/tikz/provenance.md), `renderers/edge/artifacts/tikz/licenses/` |47| `renderers/python/wireviz-translator/` | Vendored WireViz release source and PyYAML | The in-process combined Worker unit is GPL-3.0-only; PyYAML is MIT. Separate services reached over HTTP or a service binding are outside this Python program | [unit scope](renderers/python/wireviz-translator/README.md), [notices](renderers/python/wireviz-translator/THIRD_PARTY_NOTICES.md) |48| `renderers/python/blockdiag-family/` | Vendored BlockDiag, SeqDiag, ActDiag, NwDiag family; Pillow, funcparserlib, webcolors, defusedxml; DejaVu Serif | Apache-2.0 renderer sources with HPND, BSD-3-Clause, PSF, and Bitstream/public-domain dependency and font terms | [notices](renderers/python/blockdiag-family/THIRD_PARTY_NOTICES.md), `vendor-licenses/` |49| `renderers/python/symbolator/` | Symbolator is the compatibility target only | DiagramZip reimplementation is MIT; no upstream Cairo/Pango implementation is vendored | [notice](renderers/python/symbolator/THIRD_PARTY_NOTICES.md) |50| Bytefield Worker | `bytefield-svg` 1.11.0 | EPL-2.0 dependency inside the emitted Worker; EPL scope remains with the covered program/files | [EPL text](licenses/bytefield-license.txt), generated npm runtime notice |51| D2 Worker and `renderers/edge/artifacts/d2/` | D2 0.7.1 custom Wasm build and locked Go dependencies | D2 is MPL-2.0 file-level copyleft; other compiled modules retain their permissive licenses | [provenance](renderers/edge/artifacts/d2/provenance.md), `toolchains/d2/source/go.mod`, `go.sum` |52| GoAT Worker and `renderers/edge/artifacts/goat/` | GoAT 0.5.1, parse/v2, and TinyGo-produced Wasm | GoAT and parse/v2 are permissively licensed; vendored modifications retain those terms | [provenance](renderers/edge/artifacts/goat/provenance.md), nested vendor licenses |53| GraphViz family Worker | GraphViz 15.1.1, Viz.js, Expat, DBML renderer, Zod | GraphViz and Bytefield portions are EPL-2.0; Viz.js, Expat, and Zod are MIT; DBML renderer is ISC | [Viz notice](renderers/edge/artifacts/licenses/viz-js-NOTICE), [DBML notice](renderers/edge/artifacts/licenses/dbml-renderer-NOTICE), generated npm runtime notice |54| PlantUML family Worker | `@plantuml/core` 1.2026.6 with embedded GraphViz 14.1.1 | PlantUML core is MIT; the embedded GraphViz portion remains EPL-2.0 | [PlantUML notice](renderers/edge/artifacts/licenses/plantuml-core-NOTICE), generated npm runtime notice |55| Svgbob/Ditaa Worker and `renderers/edge/artifacts/svgbob/` | Svgbob 0.7.6 Wasm and its locked Rust dependency graph | Svgbob is Apache-2.0; compiled crates retain their recorded licenses. Ditaa syntax is translated without bundling Ditaa | [provenance](renderers/edge/artifacts/svgbob/svgbob-provenance.md), [Apache text](renderers/edge/artifacts/svgbob/svgbob-LICENSE.txt), `toolchains/svgbob/Cargo.lock` |56| Pikchr Worker and `renderers/edge/artifacts/pikchr/` | Pikchr Wasm | 0BSD | [provenance](renderers/edge/artifacts/pikchr/pikchr-provenance.md), [text](licenses/pikchr-license.txt) |57| Nomnoml Worker | Nomnoml and Graphre | MIT | [Nomnoml text](licenses/nomnoml-license.txt), generated npm runtime notice |58| Vega family Worker | Vega 6.3.1, Vega-Lite 6.4.3, D3 and emitted transitive runtime packages | BSD-3-Clause, ISC, MIT, and other permissive terms, scoped to their packages | [Vega](licenses/vega-license.txt), [Vega-Lite](licenses/vega-lite-license.txt), generated npm runtime notice |59| WaveDrom Worker | WaveDrom 3.6.2 and emitted runtime packages | MIT and other permissive package terms | [WaveDrom text](licenses/wavedrom-license.txt), generated npm runtime notice |60| UMLet, ERD, Structurizr, and C4 lowering code under `renderers/edge/src/` | Format-compatible DiagramZip implementations | Original implementation code is MIT unless a file says otherwise; no UMLet, ERD, Structurizr, or C4 reference implementation is vendored | [LICENSE](LICENSE) |61| Remaining edge adapters and runtime | Original DiagramZip orchestration and sanitization code | MIT; dependencies used by each emitted Worker are determined from its bundle, not the entire edge lockfile | [generated npm runtime notice](renderers/edge/artifacts/licenses/npm-runtime-NOTICE.md) |6263## Reference-only license texts6465Some files under `licenses/` record the license of a compatibility target even66though its implementation is not included. They are retained to make that67distinction explicit, not because their copyleft terms govern the DiagramZip68implementation:6970- `licenses/ditaa-mini-license.txt`: Ditaa is a syntax-compatibility path that71 translates to Svgbob; no Ditaa Java/native runtime is bundled.72- `licenses/umlet-license.txt`: the UMLet renderer is an original TypeScript73 implementation and does not vendor UMLet GPL source.74- `licenses/erd-unlicense.txt`: the ERD parser/lowerer is an original75 TypeScript implementation; the text records the compatibility target.76- `licenses/excalidraw-license.txt`: Excalidraw is bundled into the dedicated77 edge Worker. Its emitted npm dependencies and license texts are recorded in78 `renderers/edge/artifacts/licenses/npm-runtime-NOTICE.md`.7980The Symbolator relationship is documented beside that Worker rather than in81the root license directory.8283## Artifact-specific notice generation8485`renderers/edge/artifacts/licenses/npm-runtime-NOTICE.md` is generated from86Wrangler deploy metafiles for every `renderers/edge/config/units/*.jsonc`87configuration. It includes locked versions, declared licenses, consuming88Worker units, and complete license/notice texts for npm packages present in89the emitted bundles. Dependencies used only by Wrangler, tests, type checking,90or local builds are deliberately excluded.9192Regenerate and verify it from `renderers/edge/`:9394```sh95npm run generate:licenses96npm run check:licenses97```9899Python units maintain deployment-specific notices beside their source.100TikZ keeps corresponding source, transformation provenance, and license texts101in `renderers/edge/artifacts/tikz/`. Diagrams.net publishes source and license102material directly in its built static asset directory.103104The editor and documentation builds do not yet generate bundle-derived legal105notices. Their lockfiles are useful inputs to a future artifact-specific check,106but they contain development and build dependencies as well as code that may107reach the deployed bundles. This manifest deliberately does not present those108lockfiles as complete redistribution notices.109110## Redistribution111112This manifest is not a substitute for the referenced legal texts. A113redistributor should include the root MIT license plus the notices, source114availability statements, and complete terms for every renderer or artifact it115actually ships. A redistributor that omits a renderer should omit neither the116license of material it still ships nor claim that a reference-only license117applies to unrelated DiagramZip code.