- commit
- 9dbc413e11af9e9a1249d0a13338517f267fbeb7
- parent
- bd4ea4467edbbc876d37b13ab08671ed18bb2745
- author
- Dami <dami.etoile@gmail.com>
@@ -1,20 +1,116 @@
1-# Third-party notices1+# Third-party notices and component manifest22 3-DiagramZip contains and adapts third-party software. This file records project-level provenance; component-specific notices and complete license texts live beside the relevant source or under `licenses/`.3+## License scope44 5-## Kroki renderer foundation5+Except where otherwise noted, original DiagramZip code is licensed under the6+root [MIT License](LICENSE). This repository is a multi-license distribution:7+third-party source, generated artifacts, fonts, and visual assets retain their8+own licenses and terms. A license listed below applies to the identified9+component or combined deployable unit; it does not automatically relicense an10+independent service or the repository as a whole.611 7-The initial renderer foundation was imported from [Kroki](https://github.com/yuzutech/kroki) v0.32.1, commit `99f285a0d50c3882e20dc449b63c5358aa889b83`, under the MIT License.12+The component and path mapping below is the repository-level source of truth.13+Nested notices provide versions, revisions, hashes, modifications, dependency14+details, and complete legal texts. Lockfile presence alone is not treated as15+evidence that a dependency is included in a shipped artifact.16+17+## Project history18+19+DiagramZip began with an import of [Kroki](https://github.com/yuzutech/kroki)20+v0.32.1 at commit `99f285a0d50c3882e20dc449b63c5358aa889b83`,21+under the MIT License.822 923 Copyright (c) 2020-present Kroki and its contributors.1024 11-Retained foundation code may continue to use `io.kroki`, `KROKI_*`, `@kroki/*`, or Kroki-compatible HTTP names where changing them would break compatibility or obscure upstream provenance. Those identifiers do not identify the DiagramZip product, repository, or hosted service.25+Retained foundation code may continue to use `io.kroki`, `KROKI_*`, `@kroki/*`,26+or Kroki-compatible HTTP names where changing them would break compatibility27+or obscure upstream provenance. Those identifiers do not identify the28+DiagramZip product, repository, or hosted service.29+30+## Application and service manifest31+32+| Paths or deliverable | Material | License and scope | Detailed record |33+| --- | --- | --- | --- |34+| `apps/editor/`, `services/`, `renderers/catalog/`, `renderers/shared/`, `shared/` | Original DiagramZip application and service code | MIT | [LICENSE](LICENSE) |35+| Editor browser bundle | Monaco Editor, pako, saxes, and emitted transitive runtime code | Permissive upstream licenses; the current build does not emit a consolidated artifact notice | `package-lock.json` is a dependency inventory, not a shipped-artifact manifest |36+| `apps/docs/` | Docusaurus and documentation runtime dependencies | Permissive upstream licenses; the current build does not emit a consolidated artifact notice | `apps/docs/package-lock.json` is a dependency inventory, not a shipped-artifact manifest |37+| Retained Kroki foundation | Source retained from the recorded Kroki import | MIT | This file and [LICENSE](LICENSE) |38+39+## Renderer component manifest40+41+| Renderer paths or deployable unit | Third-party material | License and effective boundary | Detailed record or full text |42+| --- | --- | --- | --- |43+| `renderers/client/mermaid/` | Mermaid 11.17.0 and its emitted browser dependencies | Mermaid is MIT; browser bundle is delivered to recipients | [Mermaid text](licenses/mermaid-license.txt), package lock |44+| `renderers/client/bpmn/` | bpmn-js 18.25.1 | Custom bpmn.io MIT-like terms, including its watermark condition; browser bundle is delivered to recipients | [bpmn.io terms](licenses/bpmn-license.txt) |45+| `renderers/client/diagramsnet/` | diagrams.net 29.6.1 export runtime, shapes, stencils, images, and math assets | Application code is Apache-2.0; visual assets retain the additional diagrams.net terms. The built client publishes both beside the bundle | [renderer notice](renderers/client/diagramsnet/README.md), nested `vendor/assets/*/LICENSE` files |46+| `renderers/client/tikz/` | `@planktimerr/tikzjax` 1.0.63 plus TeX/TikZ assets | The deployable browser unit is GPL-3.0-or-later; bundled TeX/TikZ material is LPPL-1.3c. Corresponding source and terms are published on the renderer origin | [renderer notice](renderers/client/tikz/README.md), `vendor-licenses/` |47+| `renderers/python/wireviz-translator/` | Vendored WireViz release source and PyYAML | The in-process combined Worker unit is GPL-3.0-only; PyYAML is MIT. Separate services reached over HTTP or a service binding are outside this Python program | [unit scope](renderers/python/wireviz-translator/README.md), [notices](renderers/python/wireviz-translator/THIRD_PARTY_NOTICES.md) |48+| `renderers/python/blockdiag-family/` | Vendored BlockDiag, SeqDiag, ActDiag, NwDiag family; Pillow, funcparserlib, webcolors, defusedxml; DejaVu Serif | Apache-2.0 renderer sources with HPND, BSD-3-Clause, PSF, and Bitstream/public-domain dependency and font terms | [notices](renderers/python/blockdiag-family/THIRD_PARTY_NOTICES.md), `vendor-licenses/` |49+| `renderers/python/symbolator/` | Symbolator is the compatibility target only | DiagramZip reimplementation is MIT; no upstream Cairo/Pango implementation is vendored | [notice](renderers/python/symbolator/THIRD_PARTY_NOTICES.md) |50+| Bytefield Worker | `bytefield-svg` 1.11.0 | EPL-2.0 dependency inside the emitted Worker; EPL scope remains with the covered program/files | [EPL text](licenses/bytefield-license.txt), generated npm runtime notice |51+| D2 Worker and `renderers/edge/artifacts/d2/` | D2 0.7.1 custom Wasm build and locked Go dependencies | D2 is MPL-2.0 file-level copyleft; other compiled modules retain their permissive licenses | [provenance](renderers/edge/artifacts/d2/provenance.md), `toolchains/d2/source/go.mod`, `go.sum` |52+| GoAT Worker and `renderers/edge/artifacts/goat/` | GoAT 0.5.1, parse/v2, and TinyGo-produced Wasm | GoAT and parse/v2 are permissively licensed; vendored modifications retain those terms | [provenance](renderers/edge/artifacts/goat/provenance.md), nested vendor licenses |53+| GraphViz family Worker | GraphViz 15.1.1, Viz.js, Expat, DBML renderer, Zod | GraphViz and Bytefield portions are EPL-2.0; Viz.js, Expat, and Zod are MIT; DBML renderer is ISC | [Viz notice](renderers/edge/artifacts/licenses/viz-js-NOTICE), [DBML notice](renderers/edge/artifacts/licenses/dbml-renderer-NOTICE), generated npm runtime notice |54+| PlantUML family Worker | `@plantuml/core` 1.2026.6 with embedded GraphViz 14.1.1 | PlantUML core is MIT; the embedded GraphViz portion remains EPL-2.0 | [PlantUML notice](renderers/edge/artifacts/licenses/plantuml-core-NOTICE), generated npm runtime notice |55+| Svgbob/Ditaa Worker and `renderers/edge/artifacts/svgbob/` | Svgbob 0.7.6 Wasm and its locked Rust dependency graph | Svgbob is Apache-2.0; compiled crates retain their recorded licenses. Ditaa syntax is translated without bundling Ditaa | [provenance](renderers/edge/artifacts/svgbob/svgbob-provenance.md), [Apache text](renderers/edge/artifacts/svgbob/svgbob-LICENSE.txt), `toolchains/svgbob/Cargo.lock` |56+| Pikchr Worker and `renderers/edge/artifacts/pikchr/` | Pikchr Wasm | 0BSD | [provenance](renderers/edge/artifacts/pikchr/pikchr-provenance.md), [text](licenses/pikchr-license.txt) |57+| Nomnoml Worker | Nomnoml and Graphre | MIT | [Nomnoml text](licenses/nomnoml-license.txt), generated npm runtime notice |58+| Vega family Worker | Vega 6.3.1, Vega-Lite 6.4.3, D3 and emitted transitive runtime packages | BSD-3-Clause, ISC, MIT, and other permissive terms, scoped to their packages | [Vega](licenses/vega-license.txt), [Vega-Lite](licenses/vega-lite-license.txt), generated npm runtime notice |59+| WaveDrom Worker | WaveDrom 3.6.2 and emitted runtime packages | MIT and other permissive package terms | [WaveDrom text](licenses/wavedrom-license.txt), generated npm runtime notice |60+| UMLet, ERD, Structurizr, and C4 lowering code under `renderers/edge/src/` | Format-compatible DiagramZip implementations | Original implementation code is MIT unless a file says otherwise; no UMLet, ERD, Structurizr, or C4 reference implementation is vendored | [LICENSE](LICENSE) |61+| Remaining edge adapters and runtime | Original DiagramZip orchestration and sanitization code | MIT; dependencies used by each emitted Worker are determined from its bundle, not the entire edge lockfile | [generated npm runtime notice](renderers/edge/artifacts/licenses/npm-runtime-NOTICE.md) |62+63+## Reference-only license texts64+65+Some files under `licenses/` record the license of a compatibility target even66+though its implementation is not included. They are retained to make that67+distinction explicit, not because their copyleft terms govern the DiagramZip68+implementation:69+70+- `licenses/ditaa-mini-license.txt`: Ditaa is a syntax-compatibility path that71+ translates to Svgbob; no Ditaa Java/native runtime is bundled.72+- `licenses/umlet-license.txt`: the UMLet renderer is an original TypeScript73+ implementation and does not vendor UMLet GPL source.74+- `licenses/erd-unlicense.txt`: the ERD parser/lowerer is an original75+ TypeScript implementation; the text records the compatibility target.76+- `licenses/excalidraw-license.txt`: the catalog references a separately77+ deployed Excalidraw client renderer whose source is not present in this78+ repository. Its deployment must retain its own source and notice record.79+80+The Symbolator relationship is documented beside that Worker rather than in81+the root license directory.82+83+## Artifact-specific notice generation84+85+`renderers/edge/artifacts/licenses/npm-runtime-NOTICE.md` is generated from86+Wrangler deploy metafiles for every `renderers/edge/config/units/*.jsonc`87+configuration. It includes locked versions, declared licenses, consuming88+Worker units, and complete license/notice texts for npm packages present in89+the emitted bundles. Dependencies used only by Wrangler, tests, type checking,90+or local builds are deliberately excluded.91+92+Regenerate and verify it from `renderers/edge/`:93+94+```sh95+npm run generate:licenses96+npm run check:licenses97+```98+99+Python units maintain deployment-specific notices beside their source.100+TikZ and diagrams.net publish source and license material directly in their101+built static asset directories.12102 13-## Renderer and vendored dependencies103+The editor and documentation builds do not yet generate bundle-derived legal104+notices. Their lockfiles are useful inputs to a future artifact-specific check,105+but they contain development and build dependencies as well as code that may106+reach the deployed bundles. This manifest deliberately does not present those107+lockfiles as complete redistribution notices.14108 15-- License texts for top-level renderer dependencies are in `licenses/`.16-- Python units include their own `THIRD_PARTY_NOTICES.md` and `vendor-licenses/` directories where required.17-- JavaScript dependency licenses are recorded by the relevant lockfiles and upstream packages.18-- Generated type declarations retain their embedded upstream license notices.109+## Redistribution19110 20-This notice is not a substitute for the component license files. Distributors should include all applicable notices for the components they ship.111+This manifest is not a substitute for the referenced legal texts. A112+redistributor should include the root MIT license plus the notices, source113+availability statements, and complete terms for every renderer or artifact it114+actually ships. A redistributor that omits a renderer should omit neither the115+license of material it still ships nor claim that a reference-only license116+applies to unrelated DiagramZip code.@@ -9,6 +9,7 @@ returns the SVG to the parent frame. It has no server-side or Fly fallback.
99 1010 - Package: `@planktimerr/tikzjax@1.0.63`1111 - Source: https://github.com/maker-jr/tikzjax12+- Source revision: `e4bb417fe574f58f6db611cefc6be4855ab9d345`1213 - Original project: https://github.com/kisonecat/tikzjax1314 - Package tarball: `@planktimerr/tikzjax@1.0.63`1415 - npm integrity: `sha512-W46i6+CZKPJ4P/08bQ/iCp8Vy0tof8hCaXGWrMetZ5DJPpkERaiW0r0L3jmUpFB1SWhNvp/uKaXAAMmDET3BKw==`@@ -22,6 +23,20 @@ The source package declares GPL-3.0+. Its upstream TeX/TikZ components are
2223 distributed under LPPL-1.3c. The applicable notices are vendored in2324 `vendor-licenses/`.2425 26+## Distributed source and licenses27+28+The browser unit is a GPL-3.0-or-later distribution. Its build modifies the29+pinned `tikzjax.js` asset to disable persistent browser storage, then executes30+it with the DiagramZip frame adapter. `npm run build` therefore publishes:31+32+- `/SOURCE.md` with the pinned upstream revision, tarball, integrity, and build description;33+- `/source/tikzjax-1.0.63.js`, the exact unmodified input to the storage patch;34+- `/source/build.mjs` and `/source/frame.js`, the build and adapter sources; and35+- `/licenses/`, containing GPL-3.0, LPPL-1.3c, and the DiagramZip MIT terms.36+37+These files are served beside the browser scripts so recipients can retrieve38+the corresponding source and applicable terms from the same renderer origin.39+2540 ## Security and limits2641 2742 The unit uses a script-only iframe with no same-origin access. CSP permits only@@ -9,6 +9,74 @@
99 "esbuild": "0.27.7"1010 }1111 },12+ "node_modules/@esbuild/aix-ppc64": {13+ "version": "0.27.7",14+ "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.27.7.tgz",15+ "integrity": "sha512-EKX3Qwmhz1eMdEJokhALr0YiD0lhQNwDqkPYyPhiSwKrh7/4KRjQc04sZ8db+5DVVnZ1LmbNDI1uAMPEUBnQPg==",16+ "cpu": [17+ "ppc64"18+ ],19+ "dev": true,20+ "license": "MIT",21+ "optional": true,22+ "os": [23+ "aix"24+ ],25+ "engines": {26+ "node": ">=18"27+ }28+ },29+ "node_modules/@esbuild/android-arm": {30+ "version": "0.27.7",31+ "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.27.7.tgz",32+ "integrity": "sha512-jbPXvB4Yj2yBV7HUfE2KHe4GJX51QplCN1pGbYjvsyCZbQmies29EoJbkEc+vYuU5o45AfQn37vZlyXy4YJ8RQ==",33+ "cpu": [34+ "arm"35+ ],36+ "dev": true,37+ "license": "MIT",38+ "optional": true,39+ "os": [40+ "android"41+ ],42+ "engines": {43+ "node": ">=18"44+ }45+ },46+ "node_modules/@esbuild/android-arm64": {47+ "version": "0.27.7",48+ "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.27.7.tgz",49+ "integrity": "sha512-62dPZHpIXzvChfvfLJow3q5dDtiNMkwiRzPylSCfriLvZeq0a1bWChrGx/BbUbPwOrsWKMn8idSllklzBy+dgQ==",50+ "cpu": [51+ "arm64"52+ ],53+ "dev": true,54+ "license": "MIT",55+ "optional": true,56+ "os": [57+ "android"58+ ],59+ "engines": {60+ "node": ">=18"61+ }62+ },63+ "node_modules/@esbuild/android-x64": {64+ "version": "0.27.7",65+ "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.27.7.tgz",66+ "integrity": "sha512-x5VpMODneVDb70PYV2VQOmIUUiBtY3D3mPBG8NxVk5CogneYhkR7MmM3yR/uMdITLrC1ml/NV1rj4bMJuy9MCg==",67+ "cpu": [68+ "x64"69+ ],70+ "dev": true,71+ "license": "MIT",72+ "optional": true,73+ "os": [74+ "android"75+ ],76+ "engines": {77+ "node": ">=18"78+ }79+ },1280 "node_modules/@esbuild/darwin-arm64": {1381 "version": "0.27.7",1482 "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.27.7.tgz",@@ -26,6 +94,363 @@
2694 "node": ">=18"2795 }2896 },97+ "node_modules/@esbuild/darwin-x64": {98+ "version": "0.27.7",99+ "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.27.7.tgz",100+ "integrity": "sha512-rYnXrKcXuT7Z+WL5K980jVFdvVKhCHhUwid+dDYQpH+qu+TefcomiMAJpIiC2EM3Rjtq0sO3StMV/+3w3MyyqQ==",101+ "cpu": [102+ "x64"103+ ],104+ "dev": true,105+ "license": "MIT",106+ "optional": true,107+ "os": [108+ "darwin"109+ ],110+ "engines": {111+ "node": ">=18"112+ }113+ },114+ "node_modules/@esbuild/freebsd-arm64": {115+ "version": "0.27.7",116+ "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.27.7.tgz",117+ "integrity": "sha512-B48PqeCsEgOtzME2GbNM2roU29AMTuOIN91dsMO30t+Ydis3z/3Ngoj5hhnsOSSwNzS+6JppqWsuhTp6E82l2w==",118+ "cpu": [119+ "arm64"120+ ],121+ "dev": true,122+ "license": "MIT",123+ "optional": true,124+ "os": [125+ "freebsd"126+ ],127+ "engines": {128+ "node": ">=18"129+ }130+ },131+ "node_modules/@esbuild/freebsd-x64": {132+ "version": "0.27.7",133+ "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.27.7.tgz",134+ "integrity": "sha512-jOBDK5XEjA4m5IJK3bpAQF9/Lelu/Z9ZcdhTRLf4cajlB+8VEhFFRjWgfy3M1O4rO2GQ/b2dLwCUGpiF/eATNQ==",135+ "cpu": [136+ "x64"137+ ],138+ "dev": true,139+ "license": "MIT",140+ "optional": true,141+ "os": [142+ "freebsd"143+ ],144+ "engines": {145+ "node": ">=18"146+ }147+ },148+ "node_modules/@esbuild/linux-arm": {149+ "version": "0.27.7",150+ "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.27.7.tgz",151+ "integrity": "sha512-RkT/YXYBTSULo3+af8Ib0ykH8u2MBh57o7q/DAs3lTJlyVQkgQvlrPTnjIzzRPQyavxtPtfg0EopvDyIt0j1rA==",152+ "cpu": [153+ "arm"154+ ],155+ "dev": true,156+ "license": "MIT",157+ "optional": true,158+ "os": [159+ "linux"160+ ],161+ "engines": {162+ "node": ">=18"163+ }164+ },165+ "node_modules/@esbuild/linux-arm64": {166+ "version": "0.27.7",167+ "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.27.7.tgz",168+ "integrity": "sha512-RZPHBoxXuNnPQO9rvjh5jdkRmVizktkT7TCDkDmQ0W2SwHInKCAV95GRuvdSvA7w4VMwfCjUiPwDi0ZO6Nfe9A==",169+ "cpu": [170+ "arm64"171+ ],172+ "dev": true,173+ "license": "MIT",174+ "optional": true,175+ "os": [176+ "linux"177+ ],178+ "engines": {179+ "node": ">=18"180+ }181+ },182+ "node_modules/@esbuild/linux-ia32": {183+ "version": "0.27.7",184+ "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.27.7.tgz",185+ "integrity": "sha512-GA48aKNkyQDbd3KtkplYWT102C5sn/EZTY4XROkxONgruHPU72l+gW+FfF8tf2cFjeHaRbWpOYa/uRBz/Xq1Pg==",186+ "cpu": [187+ "ia32"188+ ],189+ "dev": true,190+ "license": "MIT",191+ "optional": true,192+ "os": [193+ "linux"194+ ],195+ "engines": {196+ "node": ">=18"197+ }198+ },199+ "node_modules/@esbuild/linux-loong64": {200+ "version": "0.27.7",201+ "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.27.7.tgz",202+ "integrity": "sha512-a4POruNM2oWsD4WKvBSEKGIiWQF8fZOAsycHOt6JBpZ+JN2n2JH9WAv56SOyu9X5IqAjqSIPTaJkqN8F7XOQ5Q==",203+ "cpu": [204+ "loong64"205+ ],206+ "dev": true,207+ "license": "MIT",208+ "optional": true,209+ "os": [210+ "linux"211+ ],212+ "engines": {213+ "node": ">=18"214+ }215+ },216+ "node_modules/@esbuild/linux-mips64el": {217+ "version": "0.27.7",218+ "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.27.7.tgz",219+ "integrity": "sha512-KabT5I6StirGfIz0FMgl1I+R1H73Gp0ofL9A3nG3i/cYFJzKHhouBV5VWK1CSgKvVaG4q1RNpCTR2LuTVB3fIw==",220+ "cpu": [221+ "mips64el"222+ ],223+ "dev": true,224+ "license": "MIT",225+ "optional": true,226+ "os": [227+ "linux"228+ ],229+ "engines": {230+ "node": ">=18"231+ }232+ },233+ "node_modules/@esbuild/linux-ppc64": {234+ "version": "0.27.7",235+ "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.27.7.tgz",236+ "integrity": "sha512-gRsL4x6wsGHGRqhtI+ifpN/vpOFTQtnbsupUF5R5YTAg+y/lKelYR1hXbnBdzDjGbMYjVJLJTd2OFmMewAgwlQ==",237+ "cpu": [238+ "ppc64"239+ ],240+ "dev": true,241+ "license": "MIT",242+ "optional": true,243+ "os": [244+ "linux"245+ ],246+ "engines": {247+ "node": ">=18"248+ }249+ },250+ "node_modules/@esbuild/linux-riscv64": {251+ "version": "0.27.7",252+ "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.27.7.tgz",253+ "integrity": "sha512-hL25LbxO1QOngGzu2U5xeXtxXcW+/GvMN3ejANqXkxZ/opySAZMrc+9LY/WyjAan41unrR3YrmtTsUpwT66InQ==",254+ "cpu": [255+ "riscv64"256+ ],257+ "dev": true,258+ "license": "MIT",259+ "optional": true,260+ "os": [261+ "linux"262+ ],263+ "engines": {264+ "node": ">=18"265+ }266+ },267+ "node_modules/@esbuild/linux-s390x": {268+ "version": "0.27.7",269+ "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.27.7.tgz",270+ "integrity": "sha512-2k8go8Ycu1Kb46vEelhu1vqEP+UeRVj2zY1pSuPdgvbd5ykAw82Lrro28vXUrRmzEsUV0NzCf54yARIK8r0fdw==",271+ "cpu": [272+ "s390x"273+ ],274+ "dev": true,275+ "license": "MIT",276+ "optional": true,277+ "os": [278+ "linux"279+ ],280+ "engines": {281+ "node": ">=18"282+ }283+ },284+ "node_modules/@esbuild/linux-x64": {285+ "version": "0.27.7",286+ "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.27.7.tgz",287+ "integrity": "sha512-hzznmADPt+OmsYzw1EE33ccA+HPdIqiCRq7cQeL1Jlq2gb1+OyWBkMCrYGBJ+sxVzve2ZJEVeePbLM2iEIZSxA==",288+ "cpu": [289+ "x64"290+ ],291+ "dev": true,292+ "license": "MIT",293+ "optional": true,294+ "os": [295+ "linux"296+ ],297+ "engines": {298+ "node": ">=18"299+ }300+ },301+ "node_modules/@esbuild/netbsd-arm64": {302+ "version": "0.27.7",303+ "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.27.7.tgz",304+ "integrity": "sha512-b6pqtrQdigZBwZxAn1UpazEisvwaIDvdbMbmrly7cDTMFnw/+3lVxxCTGOrkPVnsYIosJJXAsILG9XcQS+Yu6w==",305+ "cpu": [306+ "arm64"307+ ],308+ "dev": true,309+ "license": "MIT",310+ "optional": true,311+ "os": [312+ "netbsd"313+ ],314+ "engines": {315+ "node": ">=18"316+ }317+ },318+ "node_modules/@esbuild/netbsd-x64": {319+ "version": "0.27.7",320+ "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.27.7.tgz",321+ "integrity": "sha512-OfatkLojr6U+WN5EDYuoQhtM+1xco+/6FSzJJnuWiUw5eVcicbyK3dq5EeV/QHT1uy6GoDhGbFpprUiHUYggrw==",322+ "cpu": [323+ "x64"324+ ],325+ "dev": true,326+ "license": "MIT",327+ "optional": true,328+ "os": [329+ "netbsd"330+ ],331+ "engines": {332+ "node": ">=18"333+ }334+ },335+ "node_modules/@esbuild/openbsd-arm64": {336+ "version": "0.27.7",337+ "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.27.7.tgz",338+ "integrity": "sha512-AFuojMQTxAz75Fo8idVcqoQWEHIXFRbOc1TrVcFSgCZtQfSdc1RXgB3tjOn/krRHENUB4j00bfGjyl2mJrU37A==",339+ "cpu": [340+ "arm64"341+ ],342+ "dev": true,343+ "license": "MIT",344+ "optional": true,345+ "os": [346+ "openbsd"347+ ],348+ "engines": {349+ "node": ">=18"350+ }351+ },352+ "node_modules/@esbuild/openbsd-x64": {353+ "version": "0.27.7",354+ "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.27.7.tgz",355+ "integrity": "sha512-+A1NJmfM8WNDv5CLVQYJ5PshuRm/4cI6WMZRg1by1GwPIQPCTs1GLEUHwiiQGT5zDdyLiRM/l1G0Pv54gvtKIg==",356+ "cpu": [357+ "x64"358+ ],359+ "dev": true,360+ "license": "MIT",361+ "optional": true,362+ "os": [363+ "openbsd"364+ ],365+ "engines": {366+ "node": ">=18"367+ }368+ },369+ "node_modules/@esbuild/openharmony-arm64": {370+ "version": "0.27.7",371+ "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.27.7.tgz",372+ "integrity": "sha512-+KrvYb/C8zA9CU/g0sR6w2RBw7IGc5J2BPnc3dYc5VJxHCSF1yNMxTV5LQ7GuKteQXZtspjFbiuW5/dOj7H4Yw==",373+ "cpu": [374+ "arm64"375+ ],376+ "dev": true,377+ "license": "MIT",378+ "optional": true,379+ "os": [380+ "openharmony"381+ ],382+ "engines": {383+ "node": ">=18"384+ }385+ },386+ "node_modules/@esbuild/sunos-x64": {387+ "version": "0.27.7",388+ "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.27.7.tgz",389+ "integrity": "sha512-ikktIhFBzQNt/QDyOL580ti9+5mL/YZeUPKU2ivGtGjdTYoqz6jObj6nOMfhASpS4GU4Q/Clh1QtxWAvcYKamA==",390+ "cpu": [391+ "x64"392+ ],393+ "dev": true,394+ "license": "MIT",395+ "optional": true,396+ "os": [397+ "sunos"398+ ],399+ "engines": {400+ "node": ">=18"401+ }402+ },403+ "node_modules/@esbuild/win32-arm64": {404+ "version": "0.27.7",405+ "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.27.7.tgz",406+ "integrity": "sha512-7yRhbHvPqSpRUV7Q20VuDwbjW5kIMwTHpptuUzV+AA46kiPze5Z7qgt6CLCK3pWFrHeNfDd1VKgyP4O+ng17CA==",407+ "cpu": [408+ "arm64"409+ ],410+ "dev": true,411+ "license": "MIT",412+ "optional": true,413+ "os": [414+ "win32"415+ ],416+ "engines": {417+ "node": ">=18"418+ }419+ },420+ "node_modules/@esbuild/win32-ia32": {421+ "version": "0.27.7",422+ "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.27.7.tgz",423+ "integrity": "sha512-SmwKXe6VHIyZYbBLJrhOoCJRB/Z1tckzmgTLfFYOfpMAx63BJEaL9ExI8x7v0oAO3Zh6D/Oi1gVxEYr5oUCFhw==",424+ "cpu": [425+ "ia32"426+ ],427+ "dev": true,428+ "license": "MIT",429+ "optional": true,430+ "os": [431+ "win32"432+ ],433+ "engines": {434+ "node": ">=18"435+ }436+ },437+ "node_modules/@esbuild/win32-x64": {438+ "version": "0.27.7",439+ "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.27.7.tgz",440+ "integrity": "sha512-56hiAJPhwQ1R4i+21FVF7V8kSD5zZTdHcVuRFMW0hn753vVfQN8xlx4uOPT4xoGH0Z/oVATuR82AiqSTDIpaHg==",441+ "cpu": [442+ "x64"443+ ],444+ "dev": true,445+ "license": "MIT",446+ "optional": true,447+ "os": [448+ "win32"449+ ],450+ "engines": {451+ "node": ">=18"452+ }453+ },29454 "node_modules/esbuild": {30455 "version": "0.27.7",31456 "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.27.7.tgz",@@ -5,8 +5,17 @@ const output = new URL('../dist/', import.meta.url)
55 await rm(output, { recursive: true, force: true })66 await mkdir(output, { recursive: true })77 await cp(new URL('../assets/', import.meta.url), output, { recursive: true })8+await mkdir(new URL('licenses/', output), { recursive: true })9+await mkdir(new URL('source/', output), { recursive: true })810 await cp(new URL('../unit/index.html', import.meta.url), new URL('index.html', output))911 await cp(new URL('../unit/_headers', import.meta.url), new URL('_headers', output))12+await cp(new URL('../README.md', import.meta.url), new URL('SOURCE.md', output))13+await cp(new URL('../vendor-licenses/GPL-3.0.txt', import.meta.url), new URL('licenses/GPL-3.0.txt', output))14+await cp(new URL('../vendor-licenses/LPPL-1.3c.txt', import.meta.url), new URL('licenses/LPPL-1.3c.txt', output))15+await cp(new URL('../../../../LICENSE', import.meta.url), new URL('licenses/DiagramZip-MIT.txt', output))16+await cp(new URL('./build.mjs', import.meta.url), new URL('source/build.mjs', output))17+await cp(new URL('../src/frame.js', import.meta.url), new URL('source/frame.js', output))18+await cp(new URL('../assets/tikzjax.js', import.meta.url), new URL('source/tikzjax-1.0.63.js', output))1019 1120 const tikzJaxPath = new URL('tikzjax.js', output)1221 const tikzJax = await readFile(tikzJaxPath, 'utf8')@@ -32,4 +32,18 @@ for (const marker of ['diagram.zip:renderer:v1', 'MAX_SOURCE_LENGTH', 'MAX_OUTPU
3232 const headers = await readFile(new URL('../unit/_headers', import.meta.url), 'utf8')3333 if (!headers.includes('Access-Control-Allow-Origin: *')) throw new Error('TikZ assets must allow the unique-origin worker to fetch the bundled files.')3434 35+for (const path of [36+ '../dist/SOURCE.md',37+ '../dist/licenses/GPL-3.0.txt',38+ '../dist/licenses/LPPL-1.3c.txt',39+ '../dist/licenses/DiagramZip-MIT.txt',40+ '../dist/source/build.mjs',41+ '../dist/source/frame.js',42+ '../dist/source/tikzjax-1.0.63.js',43+]) await readFile(new URL(path, import.meta.url))44+45+const originalTikzJax = await readFile(new URL('../assets/tikzjax.js', import.meta.url))46+const distributedSource = await readFile(new URL('../dist/source/tikzjax-1.0.63.js', import.meta.url))47+if (!originalTikzJax.equals(distributedSource)) throw new Error('The published TikZJax source input is not exact.')48+3549 console.log('TikZJax asset and protocol checks passed')@@ -7,6 +7,9 @@ const CAPABILITIES = Object.freeze({
77 build: 'tikzjax-1.0.63-client-unit-4',88 pipeline: ['tikz'],99 frame: '/index.html?v=2',10+ license: 'GPL-3.0-or-later',11+ licenses: '/licenses/',12+ source: '/SOURCE.md',1013 knownLosses: [1114 'The browser unit uses the bundled TeX/PGF package set, not the full TeX Live installation.',1215 'Layout, fonts, and SVG details can differ from the native dvisvgm renderer.',@@ -6,6 +6,20 @@ uses commit `837d5425e72aa002bbe9cc60604dfeffab86d29c`. Its runtime version rema
66 It sends the DOT through the `GRAPHVIZ` service binding to the shared77 GraphViz-Wasm Worker.88 9+## License scope10+11+The vendored WireViz implementation is GPL-3.0-only. This Worker imports and12+executes that implementation in the same Python program, so the deployable13+WireViz unit is distributed as a GPL-3.0-only combined work. DiagramZip code14+outside this unit remains under its own applicable license. The HTTP service15+binding to the separately deployed GraphViz Worker does not place that Worker16+inside this combined Python program.17+18+The complete unit source is this directory, including `src/`, `pyproject.toml`,19+`uv.lock`, `pylock.toml`, `wrangler.jsonc`, and the build/deployment commands20+below. The full GPL text and exact upstream revision are recorded in21+`vendor-licenses/WireViz-LICENSE` and `THIRD_PARTY_NOTICES.md`.22+923 The Python `graphviz` package and external `dot` executable are intentionally absent. `src/graphviz.py` is the small DOT-builder interface required by WireViz.1024 1125 The edge contract supports SVG only. Filesystem/remote images, `tweak.append`, and `tweak.override` are rejected. BOM and HTML sidecars are not part of the rendering contract.@@ -1,6 +1,12 @@
11 # Third-party notices22 3-Pristine source from the `yuzutech/WireViz` v0.3.3 release tag (`837d5425e72aa002bbe9cc60604dfeffab86d29c`) is vendored under `src/wireviz/` and is licensed under GPL-3.0. See `vendor-licenses/WireViz-LICENSE`.3+Pristine source from the `yuzutech/WireViz` v0.3.3 release tag (`837d5425e72aa002bbe9cc60604dfeffab86d29c`) is vendored under `src/wireviz/` and is licensed under GPL-3.0-only. See `vendor-licenses/WireViz-LICENSE`.4+5+`src/render.py` imports and executes the vendored implementation in-process.6+Accordingly, the deployable Worker unit rooted in this directory is distributed7+as a GPL-3.0-only combined work. This scope statement does not apply the GPL to8+separate DiagramZip services that communicate with this unit over HTTP or a9+Cloudflare service binding.410 511 The upstream source and current container report version 0.3.2; Kroki's Dockerfile and Java service currently label the binary 0.3.3. The edge build reports the actual WireViz runtime version and identifies the DOT translator build separately.612 @@ -91,6 +91,8 @@ class Default(WorkerEntrypoint):
9191 'unit': UNIT_ID, 'id': UNIT_ID, 'kind': 'translate', 'format': 'svg',9292 'runtime': 'edge-python', 'version': WIREVIZ_VERSION,9393 'build': self.env.RENDERER_BUILD, 'pipeline': [UNIT_ID, 'graphviz-family', 'graphviz'],94+ 'license': 'GPL-3.0-only',95+ 'source': 'https://github.com/FelineStateMachine/diagramzip/tree/main/renderers/python/wireviz-translator',9496 'knownLosses': [9597 'Only SVG is supported; BOM and HTML sidecars are not exposed.',9698 'Filesystem and remote images are rejected.',