@litfamily/litopencode 1.0.7 → 1.0.9

package/skills/lit-diagram-drawer/scripts/excalidraw-extract.mjs

@@ -0,0 +1,151 @@
+#!/usr/bin/env node
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { cleanLabel, cli, digest, MAX_DEPTH, MAX_NODES, MAX_RELATIONSHIPS, readBounded, reject, safeId } from './import-shared.mjs';
+
+const MAX_INPUT = 16 * 1024 * 1024;
+const MAX_ELEMENTS = 10_000;
+const shapes = new Map([['rectangle', 'rectangle'], ['ellipse', 'ellipse'], ['diamond', 'diamond'], ['image', 'image'], ['embeddable', 'embed'], ['iframe', 'embed']]);
+const edgeTypes = new Set(['arrow', 'line']);
+const frameTypes = new Set(['frame', 'magicframe']);
+
+function checkJsonDepth(text) {
+  let depth = 0;
+  let quoted = false;
+  let escaped = false;
+  for (const character of text) {
+    if (quoted) {
+      if (escaped) escaped = false;
+      else if (character === '\\') escaped = true;
+      else if (character === '"') quoted = false;
+    } else if (character === '"') quoted = true;
+    else if (character === '[' || character === '{') {
+      depth += 1;
+      if (depth > MAX_DEPTH) reject('scene nesting exceeds the depth limit (64)');
+    } else if (character === ']' || character === '}') {
+      depth -= 1;
+      if (depth < 0) reject('scene has malformed JSON nesting');
+    }
+  }
+  if (quoted || depth !== 0) reject('scene has malformed JSON nesting');
+}
+
+function extract(file) {
+  const filename = path.basename(file);
+  const name = filename.toLowerCase();
+  if (!name.endsWith('.excalidraw') && !name.endsWith('.excalidraw.json')) reject('provide a saved .excalidraw scene');
+  const data = readBounded(file, MAX_INPUT);
+  let text;
+  try { text = new TextDecoder('utf-8', { fatal: true }).decode(data); }
+  catch { reject('scene is not valid UTF-8 JSON'); }
+  checkJsonDepth(text);
+  let document;
+  try { document = JSON.parse(text); } catch { reject('scene is malformed JSON'); }
+  if (!document || Array.isArray(document) || document.type !== 'excalidraw') reject('input is not an Excalidraw scene');
+  if (!Array.isArray(document.elements)) reject('scene has no elements array');
+  if (document.elements.length > MAX_ELEMENTS) reject('element limit exceeded (max 10,000)');
+  const ids = new Map();
+  const used = new Set();
+  const live = [];
+  const discarded = { styles: 0, links: 0, urls: 0, scripts: 0, assets: 0, unsupportedElements: 0, deletedElements: 0, freehandStrokes: 0, danglingRelationships: 0 };
+  const title = cleanLabel(filename.replace(/\.excalidraw(?:\.json)?$/iu, ''));
+  discarded.urls += title.urls;
+  for (const element of document.elements) {
+    if (!element || Array.isArray(element) || typeof element !== 'object') reject('scene element must be an object');
+    if (typeof element.id !== 'string' || typeof element.type !== 'string') reject('scene elements require string id and type fields');
+    if (ids.has(element.id)) reject('scene contains duplicate element ids');
+    ids.set(element.id, safeId(element.id, used));
+    for (const key of ['x', 'y', 'width', 'height']) {
+      const value = element[key];
+      if (value === undefined || value === null) continue;
+      if (typeof value !== 'number' || !Number.isFinite(value)) reject(`element geometry field ${key} must be finite numeric data`);
+      if (Math.abs(value) > 10_000_000) reject(`element geometry field ${key} is outside the supported range`);
+    }
+    if (element.isDeleted === true) discarded.deletedElements += 1;
+    else live.push(element);
+  }
+  const frameIds = new Set(live.filter((element) => frameTypes.has(element.type)).map((element) => element.id));
+  const labels = new Map();
+  for (const element of live) {
+    if (element.type !== 'text') continue;
+    if (element.text !== undefined && typeof element.text !== 'string') reject('text element content must be a string');
+    const cleaned = cleanLabel(element.text ?? '');
+    discarded.urls += cleaned.urls;
+    if (typeof element.containerId === 'string' && ids.has(element.containerId) && cleaned.text) {
+      labels.set(element.containerId, [...(labels.get(element.containerId) ?? []), cleaned.text]);
+    }
+  }
+  const nodeIds = new Set();
+  const nodes = [];
+  for (const element of live) {
+    if (edgeTypes.has(element.type) || (element.type === 'text' && typeof element.containerId === 'string')) continue;
+    if (['selection', 'laser'].includes(element.type)) continue;
+    if (element.type === 'freedraw') { discarded.freehandStrokes += 1; continue; }
+    let shape;
+    let kind;
+    let label;
+    if (frameTypes.has(element.type)) {
+      shape = 'container'; kind = 'container'; label = typeof element.name === 'string' ? element.name : '';
+    } else if (element.type === 'text') {
+      shape = 'text'; kind = 'annotation'; label = typeof element.text === 'string' ? element.text : '';
+    } else if (shapes.has(element.type)) {
+      shape = shapes.get(element.type); kind = 'component'; label = '';
+      if (['image', 'embeddable', 'iframe'].includes(element.type)) discarded.assets += 1;
+    } else { discarded.unsupportedElements += 1; continue; }
+    const cleaned = cleanLabel(label);
+    discarded.urls += cleaned.urls;
+    label = labels.get(element.id)?.join('\n').slice(0, 2_000) ?? cleaned.text;
+    discarded.links += Number(typeof element.link === 'string' && element.link.length > 0);
+    if (nodes.length >= MAX_NODES) reject('node limit exceeded (max 2,000)');
+    const node = { id: ids.get(element.id), label, kind, shape };
+    if (typeof element.frameId === 'string' && frameIds.has(element.frameId)) node.parentId = ids.get(element.frameId);
+    nodes.push(node);
+    nodeIds.add(element.id);
+    discarded.styles += Number(['backgroundColor', 'strokeColor', 'strokeStyle', 'roughness'].some((key) => key in element));
+  }
+  const relationships = [];
+  for (const element of live.filter((item) => edgeTypes.has(item.type))) {
+    const from = element.startBinding?.elementId;
+    const to = element.endBinding?.elementId;
+    if (typeof from !== 'string' || typeof to !== 'string' || !nodeIds.has(from) || !nodeIds.has(to)) {
+      discarded.danglingRelationships += 1;
+      continue;
+    }
+    if (relationships.length >= MAX_RELATIONSHIPS) reject('relationship limit exceeded (max 5,000)');
+    const cleaned = cleanLabel((labels.get(element.id) ?? []).join('\n'));
+    discarded.urls += cleaned.urls;
+    const start = typeof element.startArrowhead === 'string' && !['', 'none'].includes(element.startArrowhead);
+    const end = typeof element.endArrowhead === 'string' && !['', 'none'].includes(element.endArrowhead);
+    relationships.push({ from: ids.get(from), to: ids.get(to), label: cleaned.text, kind: element.type === 'arrow' ? 'flow' : 'association', direction: start && end ? 'both' : start ? 'reverse' : end || element.type === 'arrow' ? 'forward' : 'none' });
+  }
+  const groups = [];
+  for (const frameId of [...frameIds].sort()) {
+    const members = live.filter((element) => element.frameId === frameId && nodeIds.has(element.id));
+    if (members.length) groups.push({ id: ids.get(frameId), label: nodes.find((node) => node.id === ids.get(frameId))?.label ?? 'Frame', nodeIds: members.map((item) => ids.get(item.id)) });
+  }
+  const sourceGroups = new Map();
+  for (const element of live) {
+    if (!nodeIds.has(element.id) || !Array.isArray(element.groupIds)) continue;
+    for (const groupId of element.groupIds.slice(0, MAX_DEPTH)) {
+      if (typeof groupId !== 'string') continue;
+      if (!sourceGroups.has(groupId) && sourceGroups.size >= MAX_NODES) reject('group limit exceeded (max 2,000)');
+      sourceGroups.set(groupId, [...(sourceGroups.get(groupId) ?? []), element.id]);
+    }
+  }
+  for (const [groupId, members] of sourceGroups) {
+    const id = `g-${digest(Buffer.from(groupId)).slice(0, 16)}`;
+    if (used.has(id)) reject('group id collides with an element id');
+    groups.push({ id, label: 'Group', nodeIds: members.map((item) => ids.get(item)) });
+  }
+  if (document.files && typeof document.files === 'object' && !Array.isArray(document.files)) discarded.assets += Object.keys(document.files).length;
+  if (!nodes.length) reject('scene contains no supported diagram elements');
+  return { schemaVersion: 1, sourceFormat: 'excalidraw', sourceDigest: digest(data), title: title.text || 'Imported diagram', suggestedType: relationships.length ? 'flowchart' : 'architecture', nodes, relationships, groups, discarded, warnings: ['Source coordinates and styling are omitted; imported labels are inert data.'] };
+}
+
+function main() {
+  const file = process.argv.slice(2).find((arg) => !arg.startsWith('--'));
+  if (!file) reject('Usage: node scripts/excalidraw-extract.mjs <file.excalidraw>');
+  return extract(file);
+}
+
+if (process.argv[1] && pathToFileURL(path.resolve(process.argv[1])).href === import.meta.url) process.exitCode = cli(main, 'excalidraw-extract');

package/skills/lit-diagram-drawer/scripts/export.mjs

@@ -0,0 +1,133 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { buildBlockRegistry } from './block-registry.mjs';
+import { decodeXmlCharacterReferences, officeCssUrlsAreSafe, officeHrefRefsAreSafe } from './office-safety.mjs';
+import { inspectDiagramCapabilities, runDiagramCommand } from './capability-probe.mjs';
+import { ImportFailure, readBounded } from './import-shared.mjs';
+import { rendererSourceIssue } from './renderer-safety.mjs';
+
+const root=path.resolve(path.dirname(fileURLToPath(import.meta.url)),'..');
+const bundledFont=path.join(root,'assets/fonts/PretendardVariable.woff2');
+const maxSourceBytes=16*1024*1024;
+const args=process.argv.slice(2);
+const value=(flag,fallback)=>{const i=args.indexOf(flag);return i>=0?args[i+1]:fallback;};
+const input=value('--input',args.find((x)=>!x.startsWith('--')));
+const output=path.resolve(value('--out',path.join(process.cwd(),'diagram-exports')));
+const all=args.includes('--all-scales');
+const office=args.includes('--office-safe');
+const registry=args.includes('--registry');
+const selected=Number(value('--scale','3'));
+if(!input||(!all&&![1,2,3].includes(selected))){console.error('Usage: node scripts/export.mjs --input <file.html|file.svg> [--out DIR] [--scale 1|2|3|--all-scales] [--office-safe] [--registry]');process.exit(2);}
+if(path.basename(input)==='index.html'){console.error('EXPORT_SOURCE_REJECTED gallery pages are not diagram sources');process.exit(2);}
+const resolved=path.resolve(input);
+if(!fs.existsSync(resolved)){console.error('INPUT_MISSING '+resolved);process.exit(2);}
+if(!/\.(?:html|svg)$/iu.test(resolved)){console.error('EXPORT_SOURCE_REJECTED only .html and .svg sources are supported');process.exit(2);}
+let source;
+try { source = new TextDecoder('utf-8',{fatal:true}).decode(readBounded(resolved,maxSourceBytes,'export source')); }
+catch(error) {
+  console.error('EXPORT_SOURCE_REJECTED '+(error instanceof ImportFailure?error.message:'source is not valid UTF-8'));
+  process.exit(2);
+}
+const safetyIssue=rendererSourceIssue(source,{sourceFile:resolved,fontFile:bundledFont});
+if(safetyIssue){console.error('EXPORT_SOURCE_REJECTED '+safetyIssue);process.exit(2);}
+const svgMatch=source.match(/<svg\b[^>]*>[\s\S]*?<\/svg>/i);
+if(!svgMatch){console.error('SVG_MISSING '+resolved);process.exit(2);}
+const svg=svgMatch[0];
+let registryData=null;
+if(registry){try{registryData=buildBlockRegistry(svg,resolved);}catch(e){console.error('REGISTRY_FAILED '+e.message);process.exit(2);}}
+const view=svg.match(/\bviewBox\s*=\s*["']([^"']+)["']/i)?.[1]?.trim().split(/[\s,]+/).map(Number);
+if(!view||view.length!==4||view.some((x)=>!Number.isFinite(x))){console.error('VIEWBOX_REQUIRED '+resolved);process.exit(2);}
+let officeSvg=null;
+if(office){
+  const font=bundledFont;
+  if(!fs.existsSync(font)){console.error('FONT_MISSING '+font);process.exit(2);}
+  const normalizedOfficeSource=decodeXmlCharacterReferences(svg);
+  if(normalizedOfficeSource===null){console.error('OFFICE_UNSAFE_ACTIVE_OR_EXTERNAL_CONTENT');process.exit(2);}
+  officeSvg=svg.replace(/<script\b[^>]*>[\s\S]*?<\/script>/gi,'');
+  if(/<foreignObject\b|\bon[a-z]+\s*=|<script\b/i.test(normalizedOfficeSource)||!officeHrefRefsAreSafe(normalizedOfficeSource)){console.error('OFFICE_UNSAFE_ACTIVE_OR_EXTERNAL_CONTENT');process.exit(2);}
+  if(/\bvar\s*\(|@import/i.test(normalizedOfficeSource)||!officeCssUrlsAreSafe(normalizedOfficeSource)){console.error('OFFICE_UNSUPPORTED_CSS_URL_OR_VARIABLE');process.exit(2);}
+  officeSvg=officeSvg.replace(/<filter\b[^>]*>[\s\S]*?<\/filter>/gi,'');
+  officeSvg=officeSvg.replace(/\s+(?:filter|mask)\s*=\s*(["'])url\(#.*?\)\1/gi,'');
+  officeSvg=officeSvg.replace(/<(rect|circle|ellipse|line|path|polygon|polyline|text)\b([^>]*)>/gi,(tag,name,attributes)=>{
+    let extra='';
+    const converted=attributes.replace(/(\b(?:fill|stroke)\s*=\s*)(["'])(.*?)\2/gi,(whole,prefix,quote,value)=>{
+      if(value.toLowerCase()==='transparent')return prefix+quote+'none'+quote;
+      const rgba=value.match(/^rgba?\(\s*(\d+)\s*,\s*(\d+)\s*,\s*(\d+)(?:\s*,\s*([\d.]+))?\s*\)$/i);
+      if(!rgba)return whole;
+      const channels=rgba.slice(1,4).map((n)=>Math.max(0,Math.min(255,Number(n))).toString(16).padStart(2,'0'));
+      const alpha=rgba[4]===undefined?1:Math.max(0,Math.min(1,Number(rgba[4])));
+      if(alpha<1)extra+=' '+prefix.trim().split('=')[0]+'-opacity="'+alpha+'"';
+      return prefix+quote+'#'+channels.join('')+quote;
+    });
+    return '<'+name+converted+extra+'>';
+  });
+  const rootOpen=officeSvg.match(/<svg\b[^>]*>/i)?.[0];
+  if(!rootOpen){console.error('OFFICE_SVG_ROOT_MISSING');process.exit(2);}
+  let nextRoot=rootOpen;
+  if(!/\bxmlns\s*=/.test(nextRoot))nextRoot=nextRoot.replace(/<svg\b/,'<svg xmlns="http://www.w3.org/2000/svg"');
+  if(!/\bwidth\s*=/.test(nextRoot))nextRoot=nextRoot.replace(/>$/,' width="'+view[2]+'" height="'+view[3]+'">');
+  officeSvg=officeSvg.replace(rootOpen,nextRoot);
+  const fontData=fs.readFileSync(font).toString('base64');
+  const style='<style>@font-face{font-family:Pretendard;src:url(data:font/woff2;base64,'+fontData+') format("woff2");font-weight:100 900}text{font-family:Pretendard,Arial,sans-serif}</style>';
+  officeSvg=officeSvg.replace(/(<svg\b[^>]*>)/i,'$1'+style);
+}
+const capabilities=inspectDiagramCapabilities({writeDirectory:output});
+if(!capabilities.ready||!capabilities.driverCommand){
+  const missing=capabilities.checks.filter((check)=>['agent-browser','chrome-for-testing','pretendard-font','pretendard-license','lit-humanizer-detector','write-access'].includes(check.id)&&check.status!=='pass').map((check)=>check.id+': '+check.detail);
+  console.error('EXPORT_CAPABILITY_BLOCKED '+missing.join('; '));
+  console.error('User-run setup (not executed): npm install -g agent-browser@0.38.1 && agent-browser install');
+  console.error('Then run node scripts/doctor.mjs and rerun this export.');
+  process.exit(2);
+}
+const driverCommand=capabilities.driverCommand;
+function run(commandArgs, env={}) {
+  const r=runDiagramCommand(driverCommand,commandArgs,{encoding:'utf8',env:{...process.env,AGENT_BROWSER_ALLOW_FILE_ACCESS:'true',...env},timeout:30_000,maxBuffer:2*1024*1024});
+  if(r.status!==0) throw new Error((r.stderr||r.stdout||'agent-browser failed').trim());
+  return (r.stdout||'').trim();
+}
+fs.mkdirSync(output,{recursive:true});
+const session='lit-diagram-export-'+process.pid+'-'+Date.now();
+const url=pathToFileURL(resolved).href;
+let opened=false;
+try{
+  run(['--session',session,'open',url]);opened=true;
+  run(['--session',session,'set','media','light','reduced-motion']);
+  const outputs=[];
+  const scales=all?[1,2,3]:[selected];
+  for(const scale of scales){
+    const width=Math.round(view[2]*scale), height=Math.round(view[3]*scale);
+    run(['--session',session,'set','viewport',String(Math.max(width+8,640)),String(Math.max(height+8,480))]);
+    run(['--session',session,'eval','document.fonts.ready.then(()=>true)']);
+    const script='(async()=>{const s=document.querySelector("svg");if(!s)throw new Error("SVG missing");document.documentElement.style.margin="0";document.body.style.margin="0";document.body.style.padding="0";const main=s.closest("main");if(main){main.style.width="'+width+'px";main.style.maxWidth="none";main.style.margin="0";main.style.padding="0"}s.style.width="'+width+'px";s.style.height="'+height+'px";s.style.maxWidth="none";s.style.display="block";await document.fonts.ready;const t=s.querySelector("text"),family=t?getComputedStyle(t).fontFamily:"",size=t?getComputedStyle(t).fontSize:"16px",face=[...document.fonts].find(f=>f.family.replace(/[\"\']/g,"").toLowerCase()==="pretendard"),r=s.getBoundingClientRect();const font=Boolean(t&&/Pretendard/i.test(family)&&face?.status==="loaded"&&document.fonts.check(size+" Pretendard"));return JSON.stringify({width:r.width,height:r.height,x:r.x,y:r.y,viewportWidth:innerWidth,viewportHeight:innerHeight,font,family,fontFaceStatus:face?.status||"missing"})})()';
+    const dimensions=run(['--session',session,'eval',script]);
+    let measurement;
+    try{const outer=JSON.parse(dimensions);measurement=typeof outer==='string'?JSON.parse(outer):outer;}catch{throw new Error('FONT_PROOF_INVALID '+dimensions);}
+    if(Math.abs(measurement.width-width)>0.5||Math.abs(measurement.height-height)>0.5)throw new Error('SVG_DIMENSIONS_MISMATCH '+JSON.stringify(measurement));
+    if(measurement.x<0||measurement.y<0||measurement.x+measurement.width>measurement.viewportWidth||measurement.y+measurement.height>measurement.viewportHeight)throw new Error('SVG_OUTSIDE_VIEWPORT '+JSON.stringify(measurement));
+    if(!measurement.font)throw new Error('PRETENDARD_NOT_LOADED_OR_COMPUTED '+JSON.stringify(measurement));
+    const filename=path.join(output,path.basename(resolved).replace(/\.(?:html|svg)$/i,'')+'-'+scale+'x.png');
+    run(['--session',session,'screenshot','svg',filename]);
+    if(!fs.existsSync(filename)||fs.statSync(filename).size===0) throw new Error('PNG_WRITE_FAILED '+filename+' '+dimensions);
+    outputs.push({file:filename,bytes:fs.statSync(filename).size,scale,dimensions});
+  }
+  for(const out of outputs) console.log('PNG '+out.scale+'x '+out.bytes+' bytes '+out.file+' '+out.dimensions);
+} catch(e) {
+  console.error('EXPORT_FAILED '+e.message);
+  process.exitCode=1;
+} finally {
+  if(opened) {
+    const close=runDiagramCommand(driverCommand,['--session',session,'close'],{encoding:'utf8',timeout:10_000,maxBuffer:64*1024});
+    if(close.status!==0) console.error('BROWSER_CLOSE_WARNING '+(close.stderr||''));
+  }
+}
+if(officeSvg&&!process.exitCode){
+  const target=path.join(output,path.basename(resolved).replace(/\.(?:html|svg)$/i,'')+'-office.svg');
+  fs.writeFileSync(target,'<?xml version="1.0" encoding="UTF-8"?>\n'+officeSvg);
+  console.log('OFFICE_SVG '+fs.statSync(target).size+' bytes '+target+' text=live font=embedded-woff2');
+}
+if(registry) {
+  const target=path.join(output,path.basename(resolved).replace(/\.(?:html|svg)$/i,'')+'.registry.json');
+  if(!process.exitCode){fs.writeFileSync(target,JSON.stringify(registryData,null,2)+'\n');console.log('REGISTRY '+registryData.blocks.length+' blocks '+target);}
+}

package/skills/lit-diagram-drawer/scripts/import-shared.mjs

@@ -0,0 +1,130 @@
+#!/usr/bin/env node
+import { createHash } from 'node:crypto';
+import fs from 'node:fs';
+
+export const MAX_NODES = 2_000;
+export const MAX_RELATIONSHIPS = 5_000;
+export const MAX_DEPTH = 64;
+const URL_RE = /\b(?:https?|ftp|file|javascript|data):[^\s<>"']+/giu;
+const EXEC_RE = /<\s*(?:script|iframe|object|embed)\b|\bon[a-z]+\s*=/iu;
+
+export class ImportFailure extends Error {
+  constructor(message) { super(message); this.name = 'ImportFailure'; }
+}
+
+export function reject(message) { throw new ImportFailure(message); }
+
+export function readBounded(file, limit, label = 'input') {
+  if (!Number.isSafeInteger(limit) || limit < 1) reject('invalid input size limit');
+  let before;
+  try { before = fs.lstatSync(file, { bigint: true }); }
+  catch { reject(`cannot open ${label} as a regular file`); }
+  if (!before.isFile()) reject(`${label} must be a regular file; symlinks and special files are unsupported`);
+  if (before.size > BigInt(limit)) reject(`${label} exceeds the ${Math.floor(limit / 1024 / 1024)} MiB limit`);
+
+  let fd;
+  try {
+    const flags = fs.constants.O_RDONLY | (fs.constants.O_NONBLOCK ?? 0) | (fs.constants.O_NOFOLLOW ?? 0);
+    fd = fs.openSync(file, flags);
+    const opened = fs.fstatSync(fd, { bigint: true });
+    if (!opened.isFile() || opened.dev !== before.dev || opened.ino !== before.ino) {
+      reject(`${label} changed while opening; symlinks and special files are unsupported`);
+    }
+    if (opened.size > BigInt(limit)) reject(`${label} exceeds the ${Math.floor(limit / 1024 / 1024)} MiB limit`);
+
+    const data = Buffer.allocUnsafe(limit + 1);
+    let bytesRead = 0;
+    while (bytesRead < data.length) {
+      const count = fs.readSync(fd, data, bytesRead, Math.min(64 * 1024, data.length - bytesRead), null);
+      if (!count) break;
+      bytesRead += count;
+    }
+    if (bytesRead > limit) reject(`${label} exceeds the ${Math.floor(limit / 1024 / 1024)} MiB limit`);
+
+    const after = fs.fstatSync(fd, { bigint: true });
+    const pathAfter = fs.lstatSync(file, { bigint: true });
+    const stable = after.dev === opened.dev && after.ino === opened.ino
+      && after.size === opened.size && after.mtimeNs === opened.mtimeNs && after.ctimeNs === opened.ctimeNs
+      && pathAfter.isFile() && pathAfter.dev === opened.dev && pathAfter.ino === opened.ino;
+    if (!stable || BigInt(bytesRead) !== opened.size) reject(`${label} changed while being read`);
+    return data.subarray(0, bytesRead);
+  } catch (error) {
+    if (error instanceof ImportFailure) throw error;
+    reject(`cannot safely read ${label}`);
+  } finally {
+    if (fd !== undefined) {
+      try { fs.closeSync(fd); } catch { /* Preserve the original read result. */ }
+    }
+  }
+}
+
+export function digest(data) { return createHash('sha256').update(data).digest('hex'); }
+
+export function safeId(sourceId, used) {
+  if (!sourceId) reject('diagram contains an element without an id');
+  const candidate = /^[A-Za-z][A-Za-z0-9_-]{0,63}$/u.test(sourceId)
+    ? sourceId
+    : `n-${digest(Buffer.from(sourceId)).slice(0, 16)}`;
+  if (used.has(candidate)) reject('diagram contains duplicate or colliding element ids');
+  used.add(candidate);
+  return candidate;
+}
+
+export function decodeEntities(value) {
+  return value.replace(/&(#x[\da-f]+|#\d+|amp|lt|gt|quot|apos|nbsp);/giu, (whole, entity) => {
+    const token = entity.toLowerCase();
+    if (token === 'amp') return '&';
+    if (token === 'lt') return '<';
+    if (token === 'gt') return '>';
+    if (token === 'quot') return '"';
+    if (token === 'apos') return "'";
+    if (token === 'nbsp') return ' ';
+    const number = token.startsWith('#x') ? Number.parseInt(token.slice(2), 16) : Number.parseInt(token.slice(1), 10);
+    try { return Number.isInteger(number) && number > 0 && number <= 0x10ffff ? String.fromCodePoint(number) : '\uFFFD'; }
+    catch { return '\uFFFD'; }
+  });
+}
+
+export function cleanLabel(raw) {
+  const decoded = decodeEntities(String(raw));
+  if (EXEC_RE.test(decoded)) reject('executable markup or event attributes in labels are unsupported');
+  const urls = [...decoded.matchAll(URL_RE)].length;
+  const value = decoded.replace(URL_RE, '').replace(/<br\s*\/?>|<\/(?:p|div)\s*>/giu, '\n');
+  const text = value.replace(/<[^>]*>/gu, '').replace(/\r\n?/gu, '\n').replace(/\u00a0/gu, ' ');
+  return { text: text.split('\n').map((line) => line.replace(/[\t ]+/gu, ' ').trim()).filter(Boolean).join('\n').slice(0, 2_000), urls };
+}
+
+export function parseAttributes(source) {
+  const attributes = Object.create(null);
+  const expression = /([A-Za-z_:][\w:.-]*)\s*=\s*(?:"([^"]*)"|'([^']*)')/gu;
+  for (const match of source.matchAll(expression)) attributes[match[1]] = decodeEntities(match[2] ?? match[3] ?? '');
+  return attributes;
+}
+
+export function validateInertXml(source) {
+  if (/<!DOCTYPE|<!ENTITY/iu.test(source)) reject('DTD and entity declarations are unsupported');
+  if (/<\s*(?:script|iframe|object|embed)\b|\bon[a-z]+\s*=/iu.test(source)) reject('active XML markup or event attributes are unsupported');
+  if (/&(?!(?:amp|lt|gt|quot|apos|nbsp|#x[\da-f]+|#\d+);)/iu.test(source)) reject('XML contains an unsupported entity reference');
+  const stack = [];
+  for (const match of source.matchAll(/<\s*(\/?)\s*([A-Za-z_][\w:.-]*)\b([^>]*)>/gu)) {
+    const [, closing, rawName, tail] = match;
+    const name = rawName.toLowerCase();
+    if (closing) {
+      if (stack.pop() !== name) reject('XML element nesting is malformed');
+    } else if (!/\/\s*$/u.test(tail)) {
+      stack.push(name);
+      if (stack.length > MAX_DEPTH) reject('XML nesting exceeds the depth limit (64)');
+    }
+  }
+  if (stack.length) reject('XML element nesting is malformed');
+}
+
+export function emit(result) { process.stdout.write(`${JSON.stringify(result, null, 2)}\n`); }
+
+export function cli(run, toolName) {
+  try { emit(run()); return 0; }
+  catch (error) {
+    process.stderr.write(`${toolName}: ${error instanceof ImportFailure ? error.message : 'input could not be safely parsed'}\n`);
+    return 2;
+  }
+}

package/skills/lit-diagram-drawer/scripts/mermaid-extract.mjs

@@ -0,0 +1,173 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { cleanLabel, cli, digest, MAX_DEPTH, MAX_NODES, MAX_RELATIONSHIPS, readBounded, reject, safeId } from './import-shared.mjs';
+
+const MAX_INPUT = 4 * 1024 * 1024;
+const headerPattern = /^(flowchart|graph|sequenceDiagram|stateDiagram-v2|erDiagram)\b(.*)$/iu;
+const kinds = new Map([['flowchart', 'flowchart'], ['graph', 'flowchart'], ['sequencediagram', 'sequence'], ['statediagram-v2', 'state'], ['erdiagram', 'er']]);
+
+function readBlocks(file) {
+  const data = readBounded(file, MAX_INPUT);
+  let source;
+  try { source = new TextDecoder('utf-8', { fatal: true }).decode(data); }
+  catch { reject('input is not valid UTF-8'); }
+  if (['.mmd', '.mermaid'].includes(path.extname(file).toLowerCase())) return { data, blocks: [{ source, line: 1 }] };
+  if (!['.md', '.markdown', '.mdown', '.mkd'].includes(path.extname(file).toLowerCase())) reject('provide .mmd, .mermaid, or Markdown');
+  const blocks = [];
+  let active = false;
+  let fence = '';
+  let lines = [];
+  let firstLine = 0;
+  for (const [index, line] of source.split(/\r?\n/u).entries()) {
+    if (!active) {
+      const match = /^\s*(`{3,}|~{3,})\s*mermaid\s*$/iu.exec(line);
+      if (match) { active = true; fence = match[1]; lines = []; firstLine = index + 2; }
+    } else if (new RegExp(`^\\s*${fence[0]}{${fence.length},}\\s*$`, 'u').test(line)) {
+      blocks.push({ source: lines.join('\n'), line: firstLine });
+      active = false;
+      fence = '';
+    } else lines.push(line);
+  }
+  if (active) reject(`unterminated Mermaid fence at line ${firstLine - 1}`);
+  if (!blocks.length) reject('Markdown contains no fenced Mermaid block');
+  return { data, blocks };
+}
+
+function extract(file, index = 0) {
+  const { data, blocks } = readBlocks(file);
+  if (!Number.isInteger(index) || index < 0 || index >= blocks.length) reject(`diagram index out of range (${blocks.length} block(s))`);
+  let lines = blocks[index].source.split(/\r?\n/u);
+  let firstLine = blocks[index].line;
+  if (lines[0]?.trim() === '---') {
+    const end = lines.slice(1).findIndex((line) => line.trim() === '---');
+    if (end < 0) reject('unterminated Mermaid frontmatter');
+    lines = lines.slice(end + 2);
+    firstLine += end + 2;
+  }
+  lines = lines.map((text, i) => ({ line: firstLine + i, text: text.trim() })).filter((item) => item.text && !item.text.startsWith('%%'));
+  const declaration = lines.findIndex((item) => headerPattern.test(item.text));
+  if (declaration < 0) reject('unsupported or missing Mermaid diagram declaration');
+  const header = headerPattern.exec(lines[declaration].text);
+  if (!header) reject(`malformed diagram declaration at line ${lines[declaration].line}`);
+  const grammar = kinds.get(header[1].toLowerCase());
+  if (!grammar) reject(`unsupported Mermaid grammar at line ${lines[declaration].line}`);
+  const nodes = new Map();
+  const groups = new Map();
+  const relations = [];
+  const stack = [];
+  const fields = new Map();
+  const discarded = { styles: 0, links: 0, urls: 0, scripts: 0, directives: 0, unsupportedElements: 0 };
+  let title = '';
+  let direction = /\b(TD|TB|BT|LR|RL)\b/iu.exec(header[2])?.[1]?.toUpperCase() ?? '';
+  let entity;
+  function add(id, rawLabel = '', shape = 'rectangle', kind = 'component') {
+    if (!nodes.has(id)) {
+      if (nodes.size >= MAX_NODES) reject('node limit exceeded (max 2,000)');
+      const cleaned = cleanLabel(rawLabel || id);
+      discarded.urls += cleaned.urls;
+      nodes.set(id, { label: cleaned.text, shape, kind, parent: stack.at(-1) ?? null });
+    } else if (rawLabel && nodes.get(id).label === id) {
+      const cleaned = cleanLabel(rawLabel);
+      discarded.urls += cleaned.urls;
+      nodes.set(id, { ...nodes.get(id), label: cleaned.text });
+    }
+  }
+  function connect(from, to, rawLabel, kind, arrow) {
+    if (relations.length >= MAX_RELATIONSHIPS) reject('relationship limit exceeded (max 5,000)');
+    const cleaned = cleanLabel(rawLabel ?? '');
+    discarded.urls += cleaned.urls;
+    relations.push({ from, to, label: cleaned.text, kind, direction: arrow });
+  }
+  for (const { line, text } of lines.slice(declaration + 1)) {
+    if (text.startsWith('%%{')) { discarded.directives += 1; continue; }
+    if (/^(click|href|link)\b/iu.test(text)) { discarded.links += 1; continue; }
+    if (/^(style|classDef|class|linkStyle)\b/iu.test(text)) { discarded.styles += 1; continue; }
+    if (text.startsWith('title ')) { const cleaned = cleanLabel(text.slice(6)); title = cleaned.text; discarded.urls += cleaned.urls; continue; }
+    if (/^direction\s+/iu.test(text)) {
+      direction = text.split(/\s+/u)[1].toUpperCase();
+      if (!['TD', 'TB', 'BT', 'LR', 'RL'].includes(direction)) reject(`invalid direction at line ${line}`);
+      continue;
+    }
+    if (grammar === 'flowchart') {
+      if (text.toLowerCase() === 'end') { if (!stack.length) reject(`unexpected subgraph end at line ${line}`); stack.pop(); continue; }
+      const sub = /^subgraph\s+([\w.-]+)(?:\s*\[([^\]]*)\])?$/iu.exec(text);
+      if (sub) {
+        const cleaned = cleanLabel(sub[2] || sub[1]);
+        discarded.urls += cleaned.urls;
+        groups.set(sub[1], cleaned.text);
+        add(sub[1], cleaned.text, 'container', 'container');
+        stack.push(sub[1]);
+        if (stack.length > MAX_DEPTH) reject('subgraph depth exceeds 64');
+        continue;
+      }
+      const edge = /^([\w.-]+)(?:\[([^\]]*)\]|\{([^}]*)\}|\(([^)]*)\))?\s*(<-->|<--|-->|---|-\.->|==>|->|--o|--x)\s*(?:\|([^|]*)\|\s*)?([\w.-]+)(?:\[([^\]]*)\]|\{([^}]*)\}|\(([^)]*)\))?$/u.exec(text);
+      if (edge) {
+        const [, from, leftRect, leftDiamond, leftEllipse, arrow, caption, to, rightRect, rightDiamond, rightEllipse] = edge;
+        add(from, leftRect || leftDiamond || leftEllipse || from, leftDiamond ? 'diamond' : leftEllipse ? 'ellipse' : 'rectangle');
+        add(to, rightRect || rightDiamond || rightEllipse || to, rightDiamond ? 'diamond' : rightEllipse ? 'ellipse' : 'rectangle');
+        connect(from, to, caption, 'flow', arrow === '<-->' ? 'both' : arrow === '<--' ? 'reverse' : arrow === '---' ? 'none' : 'forward');
+        continue;
+      }
+      const node = /^([\w.-]+)(?:\[([^\]]*)\]|\{([^}]*)\}|\(([^)]*)\))?$/u.exec(text);
+      if (node) { add(node[1], node[2] || node[3] || node[4] || node[1], node[3] ? 'diamond' : node[4] ? 'ellipse' : 'rectangle'); continue; }
+      reject(`unsupported flowchart syntax at line ${line}`);
+    }
+    if (grammar === 'sequence') {
+      const participant = /^(?:participant|actor)\s+(?:"([^"]+)"\s+as\s+)?([\w.-]+)(?:\s+as\s+(?:"([^"]+)"|([\w.-]+)))?$/iu.exec(text);
+      if (participant) { add(participant[2], participant[3] || participant[4] || participant[1] || participant[2], 'rectangle', 'participant'); continue; }
+      const message = /^([\w.-]+)\s*(<<->>|<-->|->>|-->>|->|-->|-x|--x)(?:[+-])?\s*([\w.-]+)(?:\s*:\s*(.*))?$/u.exec(text);
+      if (message) { const [, from, arrow, to, label] = message; add(from, from, 'rectangle', 'participant'); add(to, to, 'rectangle', 'participant'); connect(from, to, label, 'message', arrow.includes('<<') || arrow === '<-->' ? 'both' : 'forward'); continue; }
+      reject(`unsupported sequence syntax at line ${line}`);
+    }
+    if (grammar === 'state') {
+      const alias = /^state\s+"([^"]+)"\s+as\s+([\w.-]+)$/iu.exec(text);
+      if (alias) { add(alias[2], alias[1], 'ellipse', 'state'); continue; }
+      const transition = /^(\[\s*\*\s*\]|[\w.-]+)\s*(-->|-[.])\s*(\[\s*\*\s*\]|[\w.-]+)(?:\s*:\s*(.*))?$/u.exec(text);
+      if (transition) {
+        let [, from, , to, label] = transition;
+        from = from.includes('*') ? 'initial' : from; to = to.includes('*') ? 'final' : to;
+        add(from, from === 'initial' ? 'Initial' : from, 'ellipse', 'state'); add(to, to === 'final' ? 'Final' : to, 'ellipse', 'state');
+        connect(from, to, label, 'transition', 'forward'); continue;
+      }
+      if (/^[\w.-]+$/u.test(text)) { add(text, text, 'ellipse', 'state'); continue; }
+      reject(`unsupported state syntax at line ${line}`);
+    }
+    if (grammar === 'er') {
+      if (text === '}') { entity = undefined; continue; }
+      const declarationMatch = /^([\w.-]+)\s*\{$/u.exec(text);
+      if (declarationMatch) { entity = declarationMatch[1]; fields.set(entity, []); add(entity, entity, 'rectangle', 'entity'); continue; }
+      const relation = /^([\w.-]+)\s+([|}o{.]+--[|}o{.]+)\s+([\w.-]+)(?:\s*:\s*(.*))?$/u.exec(text);
+      if (relation) { const [, from, cardinality, to, label] = relation; add(from, from, 'rectangle', 'entity'); add(to, to, 'rectangle', 'entity'); connect(from, to, label ? `${cardinality}: ${label}` : cardinality, 'association', 'forward'); continue; }
+      const field = entity && /^[\w.-]+\s+([\w.-]+)(?:\s+\w+)?$/u.exec(text);
+      if (field) { fields.get(entity).push(field[1]); continue; }
+      reject(`unsupported ER syntax at line ${line}`);
+    }
+  }
+  if (stack.length) reject('flowchart has an unterminated subgraph');
+  if (entity) reject('ER diagram has an unterminated entity');
+  if (!nodes.size) reject('diagram contains no supported nodes');
+  const fallbackTitle = cleanLabel(path.basename(file, path.extname(file)));
+  if (!title) discarded.urls += fallbackTitle.urls;
+  const used = new Set();
+  const ids = new Map([...nodes.keys()].map((id) => [id, safeId(id, used)]));
+  const outputNodes = [...nodes].map(([id, value]) => {
+    const fieldsText = fields.get(id) ?? [];
+    return { id: ids.get(id), label: [value.label, ...fieldsText].filter(Boolean).join('\n').slice(0, 2_000), kind: value.kind, shape: value.shape, ...(ids.has(value.parent) ? { parentId: ids.get(value.parent) } : {}) };
+  });
+  const outputGroups = [...groups].filter(([id]) => [...nodes.values()].some((node) => node.parent === id)).map(([id, label]) => ({ id: ids.get(id), label, nodeIds: [...nodes].filter(([, node]) => node.parent === id).map(([nodeId]) => ids.get(nodeId)) }));
+  const outputRelations = relations.filter((item) => ids.has(item.from) && ids.has(item.to)).map((item) => ({ from: ids.get(item.from), to: ids.get(item.to), label: item.label, kind: item.kind, direction: item.direction }));
+  return { schemaVersion: 1, sourceFormat: 'mermaid', sourceDigest: digest(data), title: title || fallbackTitle.text || 'Imported diagram', suggestedType: grammar === 'flowchart' && outputGroups.length ? 'architecture' : grammar, nodes: outputNodes, relationships: outputRelations, groups: outputGroups, discarded, warnings: ['Source layout and styling are omitted; imported labels are inert data.', ...(direction ? [`Declared direction: ${direction}.`] : [])] };
+}
+
+function main() {
+  const args = process.argv.slice(2);
+  const file = args.find((arg) => !arg.startsWith('--'));
+  const index = args.indexOf('--diagram');
+  const diagram = index < 0 ? 0 : Number(args[index + 1]);
+  if (!file || (index >= 0 && (!args[index + 1] || !Number.isInteger(diagram)))) reject('Usage: node scripts/mermaid-extract.mjs <file.mmd|file.md> [--diagram 0]');
+  return extract(file, diagram);
+}
+
+if (process.argv[1] && pathToFileURL(path.resolve(process.argv[1])).href === import.meta.url) process.exitCode = cli(main, 'mermaid-extract');