@danielsimonjr/sciengjs 0.1.1 → 0.3.0

package/README.md

@@ -10,14 +10,19 @@ sciengjs turns diagram source into images on your own machine. It sends no sourc
 
 ## What this release does
 
-Release 0.1.0 holds the first input type: **Graphviz DOT**.
+Release 0.3.0 holds three input types: **Graphviz DOT**, **Mermaid** (every diagram type) and **HTML** (to PNG and PDF). The browser stage draws the Mermaid types other than class, state and sequence, and every PDF.
 
 | Input | Output | Engine |
 |---|---|---|
 | DOT | SVG | Graphviz 16.1.0, compiled to WASM (`@viz-js/viz`) |
 | DOT | PNG | Graphviz, then resvg compiled to WASM (`@resvg/resvg-wasm`), with a bundled font |
+| Mermaid (class, state, sequence) | SVG | The engine's own parsers and layouts. Class and state diagrams go through Graphviz. |
+| Mermaid (class, state, sequence) | PNG | The same SVG, then resvg compiled to WASM (`@resvg/resvg-wasm`), with a bundled font |
+| Mermaid (all other types) | SVG, PNG, PDF | The pinned Mermaid 11.17.2 build in the browser stage. The engine serves the build from the package. |
+| DOT, Mermaid | PDF | The SVG, printed by the browser stage |
+| HTML | PNG, PDF | The browser stage |
 
-- **No network.** The DOT path makes no network request.
+- **No network.** The DOT and Mermaid paths make no network request. The browser stage starts Chrome or Chromium from `SCIENG_BROWSER` with a new profile. Its flags stop every connection out of the host. The client refuses every request except the page and the pinned Mermaid build. CI checks the browser process tree on Linux, macOS and Windows.
 - **Unsafe attributes are removed.** The engine removes each `image` and `stylesheet` attribute before the layout and gives a warning for each one. A DOT file cannot make the engine or a browser fetch a file or a URL. A `URL` attribute stays as a link in the SVG.
 - **The same text on every machine.** PNG text uses the bundled Liberation Serif font, not the fonts of the host. The engine gives a warning when the drawing asks for bold, italic or a character that the font does not have.
 - **Limits.** Each render has a time limit, a source size limit and a heap limit. A PNG has a pixel limit of 1024 MB.
@@ -137,6 +142,21 @@ const png = await svgToPng(svg, { scale: 1, maxMemoryMb: 512 });
 
 A subpath call runs in the calling thread, without the worker and its limits. Use `render` for input that you do not trust.
 
+## Mermaid
+
+The `mermaid` input draws class, state and sequence diagrams without a browser. A line outside the grammar rejects the render with `E_INPUT`, and the message names the line. Set `lenient` to `true` to skip such a line and get a warning instead.
+
+Other Mermaid types, for example `flowchart` and `gantt`, need the browser stage. A `png` takes the option `scale` (above 0, not more than 8, default 1) on both paths. The browser path sizes the page from the `viewBox` of the diagram. The `svg` of the browser path has an explicit `width` and `height`. Any other `png` option rejects with `E_INPUT`.
+
+```js
+import { render } from "@danielsimonjr/sciengjs";
+
+const source = "sequenceDiagram\nAlice->>Bob: Hello Bob\nBob-->>Alice: Hi Alice";
+const { bytes, warnings } = await render({ type: "mermaid", source, format: "svg" }, {});
+```
+
+Other Mermaid diagram types (for example flowchart and gantt) go through the browser stage. They need `SCIENG_BROWSER`. Without it they reject with `E_STAGE_MISSING`. The pinned Mermaid build ships in the package, and the browser stage serves it to the page, so no request leaves the process.
+
 ## Roadmap
 
 The [build plan](docs/superpowers/plans/2026-11-01-scieng-engine-build.md) gives the order of the increments. Each increment adds one input type, its tests and one release. The [design](docs/superpowers/specs/2026-11-01-scieng-engine-design.md) gives the API, the stages, the security controls and the licence of each engine.
@@ -144,13 +164,13 @@ The [build plan](docs/superpowers/plans/2026-11-01-scieng-engine-build.md) gives
 | Input type | Stage | Status |
 |---|---|---|
 | DOT | graph, raster | released in 0.1.0 |
-| Mermaid | mermaid, browser | planned |
+| Mermaid | graph, mermaid, browser | class, state and sequence: released in 0.2.0; other types: released in 0.3.0 |
 | LaTeX math | math (MathJax) | planned |
 | TikZ, circuitikz, LaTeX | tex (an own WASM build of `tex.web`) | trial builds pass |
 | Plots | plot | planned |
 | SysML v2 | sysml | planned |
 | STEP, IGES, BREP | mesh (OpenCascade WASM) | trial build passes |
-| HTML to PNG, PDF and Markdown | html, browser | planned |
+| HTML to PNG, PDF and Markdown | html, browser | PNG and PDF: released in 0.3.0; Markdown: planned |
 
 ## Use from an agent
 

package/THIRD_PARTY_NOTICES.md

@@ -17,6 +17,7 @@ Version: each row gives the version that the engine pins.
 | mesh | `occt-import-js` (OpenCascade compiled to WASM) | LGPL-2.1 | not yet a dependency |
 | mesh | `manifold-3d` | Apache-2.0 | not yet a dependency |
 | mesh (viewer page) | `three` | MIT | not yet a dependency |
+| browser | `mermaid` 11.17.2 (the pinned build `dist/mermaid.min.js`, copied into the assets folder at build) | MIT | a devDependency. The browser stage serves the copy to pages |
 | raster | `@resvg/resvg-wasm` 2.6.2 | MPL-2.0 | a dependency |
 | raster | Liberation Serif Regular 2.1.5 (font, in `assets/fonts/`) | SIL Open Font License 1.1 | bundled |
 | html | `parse5` | MIT | not yet a dependency |
@@ -26,7 +27,22 @@ Version: each row gives the version that the engine pins.
 
 ### Graphviz (EPL-2.0)
 
-The Eclipse Public License 2.0 applies to Graphviz. The wrapper `@viz-js/viz` is licensed under MIT. The package does not ship a Graphviz licence file. The licence text of Graphviz is in `assets/licenses/EPL-2.0.txt`. The source repository of the wrapper is https://github.com/mdaines/viz-js.
+The Eclipse Public License 2.0 applies to Graphviz. The MIT licence applies to the wrapper `@viz-js/viz`. The package does not ship a Graphviz licence file. The licence text of Graphviz is in `assets/licenses/EPL-2.0.txt`. The MIT licence text of the wrapper is in `assets/licenses/MIT-viz-js.txt`, copied from the tag `release-viz-3.31.0` of the source repository https://github.com/mdaines/viz-js. The npm package does not ship this file.
+
+### Mermaid (MIT)
+
+The MIT licence applies to `mermaid` 11.17.2. The build writes the file mermaid.min.js into the assets folder. That file is generated at build time and is not committed. The licence text is in `assets/licenses/MIT-mermaid.txt`.
+
+The file mermaid.min.js also holds the code of the runtime dependencies of `mermaid`. Each of these packages keeps its own licence:
+
+- MIT: `cytoscape`, `cytoscape-cose-bilkent`, `cytoscape-fcose`, `dagre-d3-es`, `dayjs`, `katex`, `khroma`, `marked`, `roughjs`, `stylis`, `ts-dedent`, `uuid`, `es-toolkit`, `fastdom`, `@braintree/sanitize-url`, `@iconify/utils`, `@upsetjs/venn.js`, `@mermaid-js/parser` and `lodash-es`.
+- ISC: `d3` and most of the `d3-*` modules.
+- BSD-3-Clause: `d3-sankey`, `d3-ease`, `rw` and the older copies of `d3-array`, `d3-shape` and `d3-path` that `d3-sankey` uses.
+- MPL-2.0 OR Apache-2.0: `dompurify`. The engine uses it under the Apache-2.0 licence.
+- Apache-2.0: `@chevrotain/types`.
+- Unlicense: `robust-predicates`.
+
+The file `assets/licenses/mermaid-bundle.txt` holds the licence text of each of the 79 packages, with its name and version. The script `scripts/mermaid-licenses.mjs` writes that file from the installed `mermaid` package. Run the script again after a change of the pinned Mermaid version.
 
 ### OpenCascade (LGPL-2.1)
 

package/assets/licenses/MIT-mermaid.txt

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2014 - 2022 Knut Sveidqvist
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/assets/licenses/MIT-viz-js.txt

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) Michael Daines
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.