clone

a browser-first diagram editor with live svg previews, local drafts and encrypted, accountless sharing

chore: establish standalone DiagramZip repository

Dami committed 009770e
Replace inherited project surfaces with DiagramZip documentation, package coordinates, licensing, security guidance, contribution guidance, and CI. Preserve Kroki provenance in the third-party notice while making the product and hosted repository independent.
commit
009770e230a7b7fa0d2165fe75586a93ce3f22f5
parent
1f6e7cfd6820a324dd612e2634c1fe589de06525
author
Dami <dami.etoile@gmail.com>
33 files changed, +266 -363
A.github/workflows/ci.yml56+++++++++
MCHANGELOG.md110++----------------
ACONTRIBUTING.md21+++
ALICENSE22+++
DREADME.adoc193------------------------------
AREADME.md56+++++++++
ASECURITY.md7+
ATHIRD_PARTY_NOTICES.md20+++
Mbpmn/package-lock.json10+-
Mbpmn/package.json6+-
Mbpmn/src/browser-instance.js2+-
Mbytefield/package-lock.json4+-
Mbytefield/package.json4+-
Mdbml/package-lock.json4+-
Mdbml/package.json4+-
Mdiagrams.net/package-lock.json10+-
Mdiagrams.net/package.json6+-
Mdiagrams.net/src/browser-instance.js2+-
Mexcalidraw/package-lock.json10+-
Mexcalidraw/package.json6+-
Mexcalidraw/src/browser-instance.js2+-
Mlib/browser-instance/package.json6+-
Mmermaid/package-lock.json10+-
Mmermaid/package.json6+-
Mmermaid/src/browser-instance.js2+-
Mnomnoml/package-lock.json4+-
Mnomnoml/package.json4+-
Mpackage-lock.json8+-
Mpackage.json10+-
Mpom.xml8+-
Mserver/pom.xml8+-
Mwavedrom/package-lock.json4+-
Mwavedrom/package.json4+-
A .github/workflows/ci.yml +56 -0
M CHANGELOG.md +10 -100
@@ -1,113 +1,23 @@
11 # Changelog22 3-All notable changes to this project are documented in this file.4-5-The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),6-and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).7-8-Changes land in the `Unreleased` section as part of the pull request that introduces them.9-On release, the [Release workflow](.github/workflows/release.yml) rolls this section into a10-versioned entry and uses it as the GitHub release notes.3+All notable DiagramZip changes are documented in this file. The project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html) and the structure from [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).114 125 ## [Unreleased]136 14-### Added15-16-- Add the diagram.zip browser editor with syntax highlighting, live SVG preview, zoom and minimap navigation, and URL-based sharing without server-side document storage17-18-## [0.32.1] - 2026-08-1219-20-### Security21-22-- Prevent Vega diagrams from bypassing `KROKI_SAFE_MODE=SECURE`'s URL-loading restriction: the guard only inspected `spec.data` and the direct children of `spec.marks`, so a URL-bearing data definition nested inside a group mark (`marks[].marks[].data[].url`) reached Vega's loader unchecked, allowing SSRF and local file reads (e.g. `file:///etc/passwd`); separately, an `image` mark's `encode.*.url` (e.g. `encode.enter.url`) is fetched directly by the renderer and wasn't inspected at all, allowing SSRF (e.g. against cloud metadata endpoints) even without any `data` block. Fixed by recursively scanning every mark, however deeply nested, for a `url` on either `data` or `encode`23-24-### Diagram libraries25-26-- Update bpmn-js to 18.22.127-28-## [0.32.0] - 2026-08-0329-30-### Added31-32-- Add `background` and `transparent` options to Ditaa diagrams, to set the background colour of the image or make it transparent33-34-### Security35-36-- Prevent unauthenticated remote code execution on `/tikz/svg` via `\special{ps:...}`: `dvisvgm` hands PostScript specials embedded in the DVI off to Ghostscript, which `dvisvgm` starts with `-dDELAYSAFER` instead of `-dSAFER`, leaving the `%pipe%` device available and allowing arbitrary command execution regardless of `KROKI_SAFE_MODE` — including `SECURE`, since that setting only restricts kpathsea (LaTeX) file access and has no effect on Ghostscript. Fixed by passing `--no-specials=ps` to `dvisvgm` so PostScript specials are never processed37-- Prevent BPMN diagram source from executing arbitrary HTML/JavaScript in the companion's headless Chromium page: the diagram source was assigned to the rendering container via `innerHTML` before being handed to bpmn-js, so a crafted request to `/bpmn/svg` could inject an element (e.g. `<img onerror=...>`) that ran script in that page; combined with the browser's `--disable-web-security` flag (same-origin policy disabled), that script could issue cross-origin requests and read the responses. Fixed by clearing the container instead of parsing the diagram source as HTML, and by dropping `--disable-web-security` — the only reason it was set, local file access, is already covered by the shared `--allow-file-access-from-files` flag ([#2089](https://github.com/yuzutech/kroki/pull/2089))38-- Stop the headless Chromium instance shared by the Mermaid, BPMN, Excalidraw and diagrams.net companions from phoning home to Google (`update.googleapis.com`, `clients2.google.com`, `android.clients.google.com`, `accounts.google.com`, `www.google.com`) as soon as it launches: several independent Chromium subsystems (GCM device checkin, network-time sync, the component updater, ...) each reach out to their own Google endpoint, so disabling them one flag at a time (`--disable-component-update`, `--disable-domain-reliability`, `--no-pings`) still left some contacting Google — confirmed by packet capture. Fixed by blocking DNS resolution for those exact hosts at the browser level via `--host-resolver-rules` — not a `*.google.com`/`*.googleapis.com` wildcard, so it doesn't also block legitimate diagram-triggered subresources under the same domains (e.g. `fonts.googleapis.com`), which remain governed by the existing `KROKI_*_SAFE_MODE`/`*_ALLOWED_ORIGINS` request policy39-40-### Changed41-42-- Update Node.js base Docker images to 24.18 (Alpine 3.24) for the Mermaid, BPMN, Excalidraw and diagrams.net companions43-44-### Fixed45-46-- Prevent the headless Chromium instance shared by the Mermaid, BPMN, Excalidraw and diagrams.net companions from crashing once it exhausts Docker's default 64MB `/dev/shm`, by passing `--disable-dev-shm-usage` so Chromium falls back to `/tmp`47-- Raise the core's HTTP connection pool towards each companion from Vert.x's default of 5 to 10 (configurable via `KROKI_DELEGATE_MAX_POOL_SIZE`), so a degraded companion (e.g. Mermaid restarting Chromium after a crash) doesn't starve unrelated requests of a pooled connection and fail them with a `getting a connection` timeout before the companion itself is actually overloaded48-49-### Diagram libraries50-51-- Update Vega to 6.3.152-- Update bpmn-js to 18.22.0 ([#2114](https://github.com/yuzutech/kroki/pull/2114))53-- Update Mermaid to 11.16.0 ([#2119](https://github.com/yuzutech/kroki/pull/2119))54-- Update WaveDrom to 3.6.2 ([#2122](https://github.com/yuzutech/kroki/pull/2122))55-56-## [0.31.2] - 2026-07-2657-58-### Security59-60-- Prevent TikZ diagrams in secure mode from reading arbitrary files on the container filesystem via `\input`, `\include`, `\openin`/`\read`, `\lstinputlisting` and similar LaTeX file-access primitives, by restricting kpathsea's `openin_any`/`openout_any` to the current working directory instead of only blocklisting `\verbatiminput`61-- Prevent Mermaid flowchart image-shape nodes (`N@{ img: "URL" }`) from making the companion's headless Chromium fetch an attacker-controlled URL on `/svg` and `/png`, by wiring `KROKI_MERMAID_SAFE_MODE`/`KROKI_SAFE_MODE` into a shared Puppeteer request-interception policy (`applyNetworkPolicy`) that restricts requests to `file:`/`data:`/same-origin plus an optional operator-configured allowlist (`KROKI_MERMAID_ALLOWED_ORIGINS` / `KROKI_ALLOWED_ORIGINS`)62-637 ### Changed648 65-- Update Node.js base Docker images to 24.18 (Bookworm) ([#2097](https://github.com/yuzutech/kroki/pull/2097))66-67-### Fixed9+- Establish DiagramZip as an independent repository, package, and hosted project.6810 69-- Cap concurrent Mermaid conversions (`KROKI_MERMAID_MAX_CONCURRENCY`, default 6) to bound Chromium memory usage; a burst of simultaneous requests could otherwise spin up enough renderer processes to exceed the container's memory limit and crash the service70-71-### Diagram libraries72-73-- Update Structurizr to 6.2.2 ([#2099](https://github.com/yuzutech/kroki/pull/2099))74-75-## [0.31.1] - 2026-07-1576-77-### Changed78-79-- Update Node.js base Docker images to 24.18 (Alpine) and 24.17 (Bookworm) ([#2093](https://github.com/yuzutech/kroki/pull/2093))80-81-### Fixed82-83-- Preserve leading whitespace of the first line in GoAT diagrams ([#2086](https://github.com/yuzutech/kroki/pull/2086))84-85-### Diagram libraries86-87-- Update blockdiag to 3.4.2 ([#2085](https://github.com/yuzutech/kroki/pull/2085))88-89-## [0.31.0] - 2026-06-1190-91-This release adds support for GoAT diagrams and brings back the ELK and tidy-tree layouts in Mermaid 🎉11+## [0.1.0] - 2026-08-209212 9313 ### Added9414 95-- Integrate GoAT (Go ASCII diagrams) ([#2033](https://github.com/yuzutech/kroki/pull/2033))96-- Support ELK and tidy-tree alternate layouts in Mermaid ([#2080](https://github.com/yuzutech/kroki/pull/2080))97-98-### Fixed15+- Browser editor with Monaco, live SVG preview, diagram examples, zoom, and minimap navigation.16+- Accountless encrypted persistence backed by Cloudflare D1 and R2.17+- Documentation site and machine-readable renderer and skill catalogs.18+- Isolated JavaScript, Python, WebAssembly, and sandboxed-client renderer units for the complete catalog.19+- Shared SVG sanitization, normalization, storage, and presentation contracts.9920 100-- Prevent browser leak and bound resource usage in companion containers ([#2076](https://github.com/yuzutech/kroki/pull/2076))101-102-### Diagram libraries21+### Changed10322 104-- blockdiag (actdiag, nwdiag, packetdiag, rackdiag, seqdiag) 3.3.0105-- BPMN 18.18.0106-- diagrams.net 29.6.1107-- Excalidraw 0.18.1108-- GraphViz 14.1.3109-- Mermaid 11.15.0110-- PlantUML (and C4) 1.2026.6111-- Structurizr 6.2.1112-- Vega-Lite 6.4.3113-- WaveDrom 3.6.123+- Replaced the inherited gateway and renderer-sidecar deployment with Cloudflare-hosted shell, API, catalog, and renderer units.
A CONTRIBUTING.md +21 -0
A LICENSE +22 -0
D README.adoc +0 -193
@@ -1,193 +0,0 @@
1-:uri-kroki: https://kroki.io/2-:uri-kroki-docs: https://docs.kroki.io/3-:uri-maven: https://maven.apache.org/4-5-++++6-<a href="https://kroki.io/">7-<picture>8- <source media="(prefers-color-scheme: dark)" width="200" srcset="https://kroki.io/assets/logo-white.svg">9- <source media="(prefers-color-scheme: light)" width="200" srcset="https://kroki.io/assets/logo.svg">10- <img alt="Kroki logo" width="200" src="https://kroki.io/assets/logo.svg">11-</picture>12-</a>13-++++14----15-16-ifdef::env-github[]17-image:https://github.com/yuzutech/kroki/workflows/CI/badge.svg?branch=master[GitHub Actions build status, link=https://github.com/yuzutech/kroki/actions]18-image:https://img.shields.io/badge/zulip-join_chat-brightgreen.svg[Zulip chat, link=https://kroki.zulipchat.com/]19-endif::[]20-21-{uri-kroki}[Kroki] provides a unified API with support for BlockDiag (BlockDiag, SeqDiag, ActDiag, NwDiag, PacketDiag, RackDiag), BPMN, Bytefield, C4 (with PlantUML), D2, DBML, Diagrams.net (experimental), Ditaa, Erd, Excalidraw, GoAT, GraphViz, Mermaid, Nomnoml, Pikchr, PlantUML, SvgBob, Symbolator, UMLet, Vega, Vega-Lite, WaveDrom and WireViz... and more to come!22-23-== Quickstart24-25-This section offers a basic tutorial for evaluating Kroki.26-More comprehensive installation instructions are in the {uri-kroki-docs}[Kroki documentation].27-28-== Usage29-30-Kroki uses a simple algorithm (deflate + base64) to encode your diagram in the URL:31-32-`GET /plantuml/svg/SyfFKj2rKt3CoKnELR1Io4ZDoSa70000`33-34-You can also call Kroki with `POST`:35-36- POST /37-38-[source,json]39-----40-{41- "diagram_source": "Bob -> Alice : hello",42- "diagram_type": "plantuml",43- "output_format": "svg"44-}45-----46-47-In this case, you don't need to encode your diagram.48-49-It's also possible to send your diagram as plain text using the `Content-Type` header.50-The output format will be specified using the `Accept` header and the diagram source will be sent as the request body:51-52- POST /plantuml53-54-[source]55-----56-Accept: image/svg+xml57-Content-Type: text/plain58-59-Bob -> Alice : hello60-----61-62-You can also define the output format in the URL if you don't want to add an `Accept` header:63-64- POST /plantuml/svg65-66-[source]67-----68-Content-Type: text/plain69-70-Bob -> Alice : hello71-----72-73-The same concept applies when sending the diagram as JSON:74-75- POST /plantuml/svg76-[source,json]77-----78-{79- "diagram_source": "Bob -> Alice : hello"80-}81-----82-83-== Project layout84-85-Kroki has a modular architecture:86-87-server::88-A Java web server (powered by _Vert.x_) that acts as a gateway.89-Kroki server is built using {uri-maven}[Maven].90-91-umlet::92-A tiny Java API on top of _UMlet_ (mini) to generate diagrams.93-94-nomnoml::95-A Node.js CLI on top of the _Nomnoml_ diagram library.96-97-vega::98-A Node.js CLI on top of the _vega_ diagram library. Also supports Vega-Lite concise grammar.99-100-mermaid::101-A companion web server written in JavaScript (powered by _micro_) that provides _Mermaid_ diagram library.102-103-bpmn::104-A companion web server written in JavaScript (powered by _micro_) that provides _bpmn-js_ diagram library.105-106-bytefield::107-A Node.js CLI on top of the _bytefield-svg_ diagram library.108-109-wavedrom::110-A Node.js CLI on top of the _wavedrom_ diagram library.111-112-excalidraw::113-A companion web server written in JavaScript (powered by _micro_) that provides _Excalidraw_.114-115-diagrams.net::116-A companion web server written in JavaScript (powered by _micro_) that provides _diagrams.net_.117-118-== Build119-120-Install `task` command-line: https://taskfile.dev/installation/121-122-=== Gateway Server123-124-The first step is to build the project using Maven:125-126- $ task mavenBuild127-128-=== Docker Images129-130-To build all the Docker images, use the following command:131-132- $ sudo task dockerBuildImages133-134-NOTE: `sudo` might not be needed depending on your distribution and `docker` configuration.135-136-== Run137-138-Once the Docker images are built, you can run Kroki using `docker`:139-140- $ docker run -d -p 8000:8000 yuzutech/kroki141-142-=== Companion Containers143-144-If you want to use one of the following diagram libraries then you will also need to start the corresponding companion container:145-146-yuzutech/kroki-mermaid::147-Mermaid148-149-yuzutech/kroki-bpmn::150-BPMN151-152-yuzutech/kroki-excalidraw::153-Excalidraw154-155-yuzutech/kroki-diagramsnet (experimental)::156-diagrams.net157-158-You can use `docker-compose` to run multiple containers:159-160-.docker-compose.yml161-[source,yml]162-----163-services:164- core:165- image: yuzutech/kroki166- environment:167- - KROKI_MERMAID_HOST=mermaid168- - KROKI_BPMN_HOST=bpmn169- - KROKI_EXCALIDRAW_HOST=excalidraw170- # experimental!171- - KROKI_DIAGRAMSNET_HOST=diagramsnet172- ports:173- - "8000:8000"174- mermaid:175- image: yuzutech/kroki-mermaid176- expose:177- - "8002"178- bpmn:179- image: yuzutech/kroki-bpmn180- expose:181- - "8003"182- excalidraw:183- image: yuzutech/kroki-excalidraw184- expose:185- - "8004"186- # experimental!187- diagramsnet:188- image: yuzutech/kroki-diagramsnet189- expose:190- - "8005"191-----192-193- $ docker-compose up -d
A README.md +56 -0
@@ -0,0 +1,56 @@
1+# diagram.zip2+3+[diagram.zip](https://diagram.zip) is a browser-first diagram editor with live SVG previews, local drafts, and encrypted, accountless sharing. The repository contains the editor, documentation, persistence API, renderer catalog, and the isolated renderer units behind the service.4+5+## What is here6+7+| Path | Purpose |8+| --- | --- |9+| `diagramzip/` | Browser editor and local development entry point |10+| `diagramzip-api/` | Cloudflare Worker for encrypted, accountless persistence |11+| `diagramzip-docs/` | Docusaurus site published at [docs.diagram.zip](https://docs.diagram.zip) |12+| `diagramzip-render/` | Renderer catalog, shared contracts, and Worker-based renderer units |13+| `diagramzip-client-units/` | Sandboxed browser renderers |14+| `diagramzip-python-units/` | Python renderer and translation units |15+| `diagramzip-shell/` | Cloudflare shell and routing layer |16+| `diagramzip-svg/` | Shared SVG normalization and presentation logic |17+| `skills/` | Diagram-specific agent skills and reference material |18+19+The remaining top-level renderer and Java gateway directories are retained foundation sources while renderer extraction is completed. They are not the production application architecture.20+21+## Development22+23+The main workspace requires Node.js 24.24+25+```sh26+npm install27+npm run dev:diagramzip28+```29+30+Useful checks:31+32+```sh33+npm run test:diagramzip34+npm run build:diagramzip35+npm run build:diagramzip-docs36+npm --prefix diagramzip-render test37+npm --prefix diagramzip-api test38+```39+40+Individual services have their own README and package scripts. Run deployment commands from the service directory whose `wrangler.jsonc` you intend to use.41+42+## Architecture43+44+The editor runs at `diagram.zip`. Rendering is split into isolated units selected by hostname at `{engine}.render.diagram.zip`; the renderer catalog documents the contract and capabilities for all supported engines. Five renderers run in sandboxed browser frames, while the remaining renderers run in JavaScript, Python, or WebAssembly Workers.45+46+Saved diagrams use encrypted client-side content, mutable aliases in D1, and immutable content-addressed objects in R2. See [`diagramzip/PERSISTENCE.md`](diagramzip/PERSISTENCE.md) for the persistence and security contract.47+48+## Project history and licensing49+50+DiagramZip began with an import of the MIT-licensed Kroki v0.32.1 source tree and has since replaced the application, documentation, persistence, and renderer delivery architecture. The Git repository is maintained as an independent project; Kroki and other retained dependencies remain credited in [`THIRD_PARTY_NOTICES.md`](THIRD_PARTY_NOTICES.md) and the nested license files.51+52+DiagramZip is distributed under the [MIT License](LICENSE). Some bundled renderers and vendored components use other licenses; review `licenses/`, nested `THIRD_PARTY_NOTICES.md` files, and vendor-license directories before redistribution.53+54+## Contributing and security55+56+See [`CONTRIBUTING.md`](CONTRIBUTING.md) for the development workflow. Please report security issues according to [`SECURITY.md`](SECURITY.md), not through a public issue.
A SECURITY.md +7 -0
A THIRD_PARTY_NOTICES.md +20 -0
M bpmn/package-lock.json +5 -5
M bpmn/package.json +3 -3
M bpmn/src/browser-instance.js +1 -1
M bytefield/package-lock.json +2 -2
M bytefield/package.json +2 -2
M dbml/package-lock.json +2 -2
M dbml/package.json +2 -2
M diagrams.net/package-lock.json +5 -5
M diagrams.net/package.json +3 -3
M diagrams.net/src/browser-instance.js +1 -1
M excalidraw/package-lock.json +5 -5
M excalidraw/package.json +3 -3
M excalidraw/src/browser-instance.js +1 -1
M lib/browser-instance/package.json +3 -3
M mermaid/package-lock.json +5 -5
M mermaid/package.json +3 -3
M mermaid/src/browser-instance.js +1 -1
M nomnoml/package-lock.json +2 -2
M nomnoml/package.json +2 -2
M package-lock.json +4 -4
M package.json +7 -3
M pom.xml +4 -4
M server/pom.xml +4 -4
M wavedrom/package-lock.json +2 -2
M wavedrom/package.json +2 -2