@zombie-mermaid/core 2.2.1

package/src/__tests__/theme.test.ts

@@ -0,0 +1,162 @@
+/**
+ * Tests for the theme/color-math helpers in packages/core/src/theme.ts.
+ */
+import { describe, it, expect } from 'vitest'
+import { getReadableTextColor, buildStyleBlock } from '@zombie-mermaid/core'
+
+describe('getReadableTextColor', () => {
+  it('returns dark text for a light pastel fill (6-digit hex)', () => {
+    expect(getReadableTextColor('#FF6B6B', 'var(--_text)')).toBe('#000000')
+    expect(getReadableTextColor('#90EE90', 'var(--_text)')).toBe('#000000')
+  })
+
+  it('returns light text for a dark fill (6-digit hex)', () => {
+    expect(getReadableTextColor('#111111', 'var(--_text)')).toBe('#FFFFFF')
+    expect(getReadableTextColor('#000000', 'var(--_text)')).toBe('#FFFFFF')
+  })
+
+  it('handles 3-digit shorthand hex', () => {
+    expect(getReadableTextColor('#fff', 'var(--_text)')).toBe('#000000')
+    expect(getReadableTextColor('#000', 'var(--_text)')).toBe('#FFFFFF')
+  })
+
+  it('ignores alpha channel in 4/8-digit hex and uses RGB luminance', () => {
+    expect(getReadableTextColor('#ffffffff', 'var(--_text)')).toBe('#000000')
+    expect(getReadableTextColor('#000000ff', 'var(--_text)')).toBe('#FFFFFF')
+  })
+
+  it('falls back when fill is undefined', () => {
+    expect(getReadableTextColor(undefined, 'var(--_text)')).toBe('var(--_text)')
+  })
+
+  it('falls back when fill is a CSS variable reference', () => {
+    expect(getReadableTextColor('var(--surface)', 'var(--_text)')).toBe(
+      'var(--_text)',
+    )
+  })
+
+  it('falls back when fill is a named CSS color', () => {
+    expect(getReadableTextColor('lightpink', 'var(--_text)')).toBe(
+      'var(--_text)',
+    )
+  })
+
+  it('falls back when fill is malformed or an injection attempt', () => {
+    expect(
+      getReadableTextColor('red" onmouseover="alert(1)', 'var(--_text)'),
+    ).toBe('var(--_text)')
+    expect(getReadableTextColor('#gggggg', 'var(--_text)')).toBe('var(--_text)')
+  })
+})
+
+describe('buildStyleBlock – font handling', () => {
+  it('quotes a normal font name and emits a Google Fonts @import (no regression)', () => {
+    const block = buildStyleBlock('Inter', false)
+    expect(block).toContain(
+      "@import url('https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&display=swap');",
+    )
+    expect(block).toContain(
+      "text { font-family: 'Inter', system-ui, sans-serif; }",
+    )
+  })
+
+  it('skips the Google Fonts @import and emits an unquoted value for a CSS var() reference', () => {
+    const block = buildStyleBlock('var(--font-family-body)', false)
+    expect(block).not.toContain('fonts.googleapis.com')
+    expect(block).toContain(
+      'text { font-family: var(--font-family-body), system-ui, sans-serif; }',
+    )
+  })
+
+  it('handles a var() reference with a quoted fallback argument', () => {
+    const block = buildStyleBlock("var(--font, 'Fallback Font')", false)
+    expect(block).not.toContain('fonts.googleapis.com')
+    expect(block).toContain(
+      "text { font-family: var(--font, 'Fallback Font'), system-ui, sans-serif; }",
+    )
+  })
+
+  it('treats a var()-like value with unbalanced parens/semicolons as untrusted and falls back to a quoted literal', () => {
+    const block = buildStyleBlock('var(--x); } .evil{color:red', false)
+    // Not treated as a var() reference: still gets a (sanitized) Google Fonts import + quoting.
+    expect(block).toContain('fonts.googleapis.com')
+    expect(block).not.toMatch(/text \{ font-family: var\(/)
+    // The sanitizer stripped the `;` and `{`/`}`, so the payload can't
+    // terminate the declaration/rule early — exactly one <style> block.
+    expect(block.match(/<style>/g)?.length).toBe(1)
+    expect(block.match(/<\/style>/g)?.length).toBe(1)
+  })
+
+  it('sanitizes a malicious font value so it cannot break out of the generated <style> block', () => {
+    const malicious = '</style><script>alert(1)</script><style>'
+    const block = buildStyleBlock(malicious, false)
+    expect(block).not.toContain('</style><script>')
+    expect(block).not.toContain('<script>')
+    // The <style> block must still be well-formed: exactly one open/close pair.
+    expect(block.match(/<style>/g)?.length).toBe(1)
+    expect(block.match(/<\/style>/g)?.length).toBe(1)
+  })
+
+  it('sanitizes an attempted CSS-injection payload disguised as a var() reference', () => {
+    const malicious = "var(--x, 'y'); } .evil { fill: red } /*"
+    const block = buildStyleBlock(malicious, false)
+    // Contains a semicolon, so it fails the strict var() check and is
+    // treated (and sanitized) as a literal, quoted font name instead.
+    expect(block).not.toMatch(/text \{ font-family: var\(/)
+    expect(block).not.toContain('.evil { fill: red }')
+  })
+
+  it('skips the Google Fonts @import for a comma-separated font stack (#223)', () => {
+    const block = buildStyleBlock('ui-sans-serif, system-ui, sans-serif', false)
+    expect(block).not.toContain('fonts.googleapis.com')
+  })
+
+  it('skips the Google Fonts @import for a bare CSS generic family keyword', () => {
+    const block = buildStyleBlock('system-ui', false)
+    expect(block).not.toContain('fonts.googleapis.com')
+  })
+
+  it('still emits the Google Fonts @import for a single real font name (regression guard)', () => {
+    const block = buildStyleBlock('Roboto', false)
+    expect(block).toContain(
+      "@import url('https://fonts.googleapis.com/css2?family=Roboto:wght@400;500;600;700&amp;display=swap');",
+    )
+  })
+
+  it('still renders a font stack literally in the text { font-family: ... } rule', () => {
+    const block = buildStyleBlock('ui-sans-serif, system-ui, sans-serif', false)
+    expect(block).toContain(
+      "text { font-family: 'ui-sans-serif, system-ui, sans-serif', system-ui, sans-serif; }",
+    )
+  })
+})
+
+describe('buildStyleBlock – mono font (#1061)', () => {
+  it('never reaches out to Google Fonts for the .mono rule', () => {
+    const block = buildStyleBlock('Inter', true)
+    // The main `font` still gets its own Google Fonts @import (unrelated to
+    // this regression test), but nothing in the block should ever request
+    // JetBrains Mono from a third-party CDN.
+    expect(block).not.toContain('fonts.googleapis.com/css2?family=JetBrains')
+  })
+
+  it('embeds a self-hosted @font-face as a base64 woff2 data URI for the mono font', () => {
+    const block = buildStyleBlock('Inter', true)
+    expect(block).toContain('@font-face')
+    expect(block).toContain('data:font/woff2;base64,')
+    expect(block).toContain("font-family: 'JetBrains Mono NL';")
+  })
+
+  it("leads the .mono rule's font stack with the self-hosted family name", () => {
+    const block = buildStyleBlock('Inter', true)
+    expect(block).toContain(
+      "  .mono { font-family: 'JetBrains Mono NL', 'SF Mono', 'Fira Code', ui-monospace, monospace; }",
+    )
+  })
+
+  it('emits neither the @font-face embed nor the .mono rule when hasMonoFont is false', () => {
+    const block = buildStyleBlock('Inter', false)
+    expect(block).not.toContain('@font-face')
+    expect(block).not.toContain('.mono')
+  })
+})

package/src/click-directive.ts

@@ -0,0 +1,106 @@
+import type { NodeInteraction } from './types.ts'
+
+// ============================================================================
+// Shared `click` directive parsing and href sanitization.
+//
+// Every diagram type that recognizes Mermaid's `click` statement (flowchart/
+// state via src/parser.ts, class diagrams via
+// packages/mermaid-parser/src/class/parser.ts) shares this exact grammar
+// and the same href-safety rules — pulled out here so
+// neither copy can drift from the other. See
+// docs/decisions/no-script-interactivity.md for the tier model this
+// implements: an `href` becomes a real `<a>` link (tier 2), a tooltip
+// becomes a `<title>` (tier 1), and a `call`/`callback` binding is recorded
+// as data but never executed (tier 3 stays unimplemented, permanently).
+// ============================================================================
+
+/**
+ * Parse a `click <id> ...` statement and record the resulting
+ * {@link NodeInteraction} in `interactions`, keyed by whatever id scheme the
+ * caller's diagram type uses (flowchart/state node id, class diagram class
+ * id, ...).
+ *
+ * Supported forms:
+ *   click id "url" ["tooltip"] [_blank|_self|_parent|_top]
+ *   click id href "url" ["tooltip"] [_blank|_self|_parent|_top]
+ *   click id call fn() ["tooltip"]
+ *   click id callback fn() ["tooltip"]
+ *
+ * A line that doesn't match `click <id> ...` at all is a no-op — callers are
+ * expected to have already gated on a leading `click` keyword before calling
+ * this (see the `/^click\s+/i` checks at each call site) purely so this
+ * function's own regex can stay anchored to the id capture.
+ */
+export function applyClickStatement(
+  line: string,
+  interactions: Map<string, NodeInteraction>,
+): void {
+  const match = line.match(/^click\s+([\w\p{L}-]+)\s+(.*)$/iu)
+  if (!match) return
+
+  const nodeId = match[1]!
+  let rest = match[2]!.trim()
+
+  const interaction: NodeInteraction = { ...interactions.get(nodeId) }
+
+  // `call fn()` / `callback fn()` — a script binding.
+  const callMatch = rest.match(/^(?:call|callback)\s+(.+?)\s*$/i)
+  if (callMatch) {
+    // A trailing quoted tooltip may follow the callback expression.
+    const withTooltip = callMatch[1]!.match(/^(.*?\))\s+"([^"]*)"\s*$/)
+    if (withTooltip) {
+      interaction.callback = withTooltip[1]!.trim()
+      interaction.tooltip = withTooltip[2]
+    } else {
+      interaction.callback = callMatch[1]!.trim()
+    }
+    interactions.set(nodeId, interaction)
+    return
+  }
+
+  // Optional explicit `href` keyword.
+  rest = rest.replace(/^href\s+/i, '')
+
+  // Remaining tokens: "url" ["tooltip"] [_target]
+  const quoted = [...rest.matchAll(/"([^"]*)"/g)].map((m) => m[1]!)
+  if (quoted.length > 0) interaction.href = quoted[0]
+  if (quoted.length > 1) interaction.tooltip = quoted[1]
+
+  const targetMatch = rest.match(/(_blank|_self|_parent|_top)\s*$/i)
+  if (targetMatch) interaction.target = targetMatch[1]!.toLowerCase()
+
+  if (interaction.href !== undefined || interaction.tooltip !== undefined) {
+    interactions.set(nodeId, interaction)
+  }
+}
+
+/**
+ * Accept only link schemes that cannot execute script.
+ *
+ * A `click` target comes from diagram text, which may be untrusted. An
+ * `href` of `javascript:...` (or a `data:` URL containing markup) would turn
+ * a rendered diagram into an XSS vector for any page that inlines the SVG, so
+ * anything but http/https/mailto and same-document or relative references is
+ * dropped rather than emitted.
+ *
+ * C0 controls are rejected outright, before any other check. The URL parser
+ * strips tab and newline from *anywhere* in a URL, so `java\tscript:` reaches
+ * a browser as `javascript:` — while the scheme match below sees `java\t…`,
+ * finds no scheme, and waves it through as a relative reference. Splitting a
+ * blocked scheme with a control character is the whole bypass; there is no
+ * legitimate URL with a raw control in it, so the entire range goes.
+ */
+export function safeHref(href: string | undefined): string | undefined {
+  if (!href) return undefined
+
+  if (/[\x00-\x1F\x7F]/.test(href)) return undefined
+
+  const trimmed = href.trim()
+  // Relative, absolute-path, and fragment references carry no scheme.
+  if (/^[./#?]/.test(trimmed)) return trimmed
+
+  const scheme = trimmed.match(/^([a-zA-Z][a-zA-Z0-9+.-]*):/)?.[1]
+  if (scheme === undefined) return trimmed
+
+  return /^(https?|mailto)$/i.test(scheme) ? trimmed : undefined
+}

package/src/color-utils.ts

@@ -0,0 +1,205 @@
+// ============================================================================
+// CSS color primitives — parse, mix, and format sRGB colors.
+//
+// Shared by the SVG theme system (packages/core/src/theme.ts), the ASCII renderer's
+// DiagramColors → AsciiTheme bridge (src/ascii/ansi.ts), and the
+// `resolveColors` post-processor (packages/svg-renderer/src/resolve-colors.ts). All three need
+// the same answer to "what does `color-mix(in srgb, fg 50%, bg)` come out
+// to?", so the arithmetic lives here exactly once — the MIX percentages in
+// packages/core/src/theme.ts stay the single source of truth for *which* percentages the
+// renderer uses, and this module is the single source of truth for what a
+// percentage *means*.
+// ============================================================================
+
+/** An sRGB color: 0-255 channels plus a 0-1 alpha. */
+export interface RgbaColor {
+  r: number
+  g: number
+  b: number
+  a: number
+}
+
+/** Matches #rgb, #rgba, #rrggbb, #rrggbbaa hex color literals. */
+const HEX_COLOR_RE =
+  /^#([0-9a-fA-F]{3}|[0-9a-fA-F]{4}|[0-9a-fA-F]{6}|[0-9a-fA-F]{8})$/
+
+/**
+ * Matches `rgb()` / `rgba()` in both the legacy comma syntax
+ * (`rgb(1, 2, 3)`, `rgba(1, 2, 3, 0.5)`) and the modern space syntax
+ * (`rgb(1 2 3 / 50%)`). Channels may be integers or percentages; alpha may
+ * be a 0-1 number or a percentage.
+ */
+const RGB_FUNC_RE =
+  /^rgba?\(\s*([\d.]+%?)\s*[, ]\s*([\d.]+%?)\s*[, ]\s*([\d.]+%?)\s*(?:[,/]\s*([\d.]+%?)\s*)?\)$/i
+
+/**
+ * Parse a hex color string into 0-255 RGB components, ignoring any alpha
+ * digits. Returns null for anything that isn't a well-formed hex literal
+ * (e.g. `var(--foo)`, named CSS colors, or attribute-injection payloads) —
+ * the caller should treat those as unresolvable and fall back.
+ */
+export function parseHexColor(value: string): [number, number, number] | null {
+  const rgba = parseHexRgba(value)
+  return rgba ? [rgba.r, rgba.g, rgba.b] : null
+}
+
+/** Parse a hex color literal (3/4/6/8 digits) into an RgbaColor, or null. */
+export function parseHexRgba(value: string): RgbaColor | null {
+  const match = HEX_COLOR_RE.exec(value.trim())
+  if (!match) return null
+  // HEX_COLOR_RE has exactly one, non-optional capture group, so it's always
+  // populated when `match` is non-null — but that's a fact about the regex's
+  // construction, not something the type checker can see. Guard explicitly
+  // (falling back to "unresolvable", same as a non-match) rather than
+  // asserting past it, so a future edit to the pattern can't silently turn
+  // this into a runtime `undefined`.
+  const captured = match[1]
+  if (captured === undefined) return null
+  let hex = captured
+  if (hex.length === 3 || hex.length === 4) {
+    hex = hex
+      .split('')
+      .map((c) => c + c)
+      .join('')
+  }
+  return {
+    r: parseInt(hex.slice(0, 2), 16),
+    g: parseInt(hex.slice(2, 4), 16),
+    b: parseInt(hex.slice(4, 6), 16),
+    a: hex.length === 8 ? parseInt(hex.slice(6, 8), 16) / 255 : 1,
+  }
+}
+
+/** Parse one rgb()/rgba() channel token: an integer/decimal or a percentage of 255. */
+function parseRgbChannel(token: string): number {
+  return token.endsWith('%')
+    ? (Number(token.slice(0, -1)) / 100) * 255
+    : Number(token)
+}
+
+/** Parse an alpha token: a 0-1 number or a percentage. */
+function parseAlpha(token: string | undefined): number {
+  if (token === undefined) return 1
+  return token.endsWith('%') ? Number(token.slice(0, -1)) / 100 : Number(token)
+}
+
+/**
+ * Parse a concrete CSS color value into sRGB components.
+ *
+ * Accepts the forms this library's own theme system produces or documents:
+ * hex literals (`#rgb`, `#rgba`, `#rrggbb`, `#rrggbbaa`), `rgb()`/`rgba()`,
+ * and the `transparent` keyword. Anything else — CSS named colors, `hsl()`,
+ * `var(...)`, an unresolved `color-mix(...)` — returns null so the caller
+ * can leave it untouched rather than guess.
+ */
+export function parseCssColor(value: string): RgbaColor | null {
+  const trimmed = value.trim()
+  if (trimmed.toLowerCase() === 'transparent') {
+    return { r: 0, g: 0, b: 0, a: 0 }
+  }
+  const hex = parseHexRgba(trimmed)
+  if (hex) return hex
+  const rgb = RGB_FUNC_RE.exec(trimmed)
+  if (rgb) {
+    const [, rTok, gTok, bTok, aTok] = rgb
+    if (rTok === undefined || gTok === undefined || bTok === undefined) {
+      return null
+    }
+    const color = {
+      r: parseRgbChannel(rTok),
+      g: parseRgbChannel(gTok),
+      b: parseRgbChannel(bTok),
+      a: parseAlpha(aTok),
+    }
+    if ([color.r, color.g, color.b, color.a].some((n) => Number.isNaN(n))) {
+      return null
+    }
+    return color
+  }
+  return null
+}
+
+/**
+ * Evaluate `color-mix(in srgb, c1 p1%, c2 p2%)` per CSS Color Module
+ * Level 5 (https://www.w3.org/TR/css-color-5/#color-mix): percentages are
+ * normalized so they sum to 100 (a sum under 100 additionally scales the
+ * result's alpha by `sum / 100`), and the two colors are interpolated in
+ * premultiplied-alpha space, so mixing an opaque color toward
+ * `transparent` fades its alpha without darkening it.
+ *
+ * `p1`/`p2` follow the spec's omission rules: pass `undefined` for an
+ * omitted percentage (both omitted → 50/50; one omitted → 100 minus the
+ * other). Returns null when both percentages are zero, which the spec
+ * defines as invalid.
+ */
+export function mixSrgb(
+  c1: RgbaColor,
+  c2: RgbaColor,
+  p1?: number,
+  p2?: number,
+): RgbaColor | null {
+  let w1: number
+  let w2: number
+  if (p1 === undefined && p2 === undefined) {
+    w1 = 50
+    w2 = 50
+  } else if (p1 === undefined) {
+    w2 = p2 ?? 50
+    w1 = 100 - w2
+  } else if (p2 === undefined) {
+    w1 = p1
+    w2 = 100 - w1
+  } else {
+    w1 = p1
+    w2 = p2
+  }
+  const sum = w1 + w2
+  if (sum === 0) return null
+  const alphaMultiplier = sum < 100 ? sum / 100 : 1
+  w1 /= sum
+  w2 /= sum
+
+  const alpha = c1.a * w1 + c2.a * w2
+  const premul = (ch1: number, ch2: number): number =>
+    alpha === 0 ? 0 : (ch1 * c1.a * w1 + ch2 * c2.a * w2) / alpha
+
+  return {
+    r: premul(c1.r, c2.r),
+    g: premul(c1.g, c2.g),
+    b: premul(c1.b, c2.b),
+    a: alpha * alphaMultiplier,
+  }
+}
+
+/**
+ * Mix `fg` into `bg` at `pct` percent — the shape every MIX entry in
+ * packages/core/src/theme.ts uses (`color-mix(in srgb, var(--fg) N%, var(--bg))`).
+ * Returns `fg` unchanged when either input isn't a concrete color this
+ * module can parse (a `var(...)` reference, a named color).
+ */
+export function mixHexColors(fg: string, bg: string, pct: number): string {
+  const f = parseCssColor(fg)
+  const b = parseCssColor(bg)
+  if (!f || !b) return fg
+  const mixed = mixSrgb(f, b, pct, 100 - pct)
+  return mixed ? formatCssColor(mixed) : fg
+}
+
+const clampByte = (n: number): number =>
+  Math.min(255, Math.max(0, Math.round(n)))
+
+/**
+ * Serialize a color as `#rrggbb` when fully opaque, otherwise as
+ * `rgba(r, g, b, a)` — the two forms every SVG consumer (browsers, resvg,
+ * librsvg, Inkscape) agrees on.
+ */
+export function formatCssColor(c: RgbaColor): string {
+  const r = clampByte(c.r)
+  const g = clampByte(c.g)
+  const b = clampByte(c.b)
+  const a = Math.min(1, Math.max(0, c.a))
+  if (a >= 1) {
+    return '#' + [r, g, b].map((n) => n.toString(16).padStart(2, '0')).join('')
+  }
+  return `rgba(${r}, ${g}, ${b}, ${Number(a.toFixed(3))})`
+}

package/src/diagram-type.ts

@@ -0,0 +1,35 @@
+// ============================================================================
+// zombie-mermaid — shared diagram-type detection
+//
+// Both the SVG renderer (src/index.ts) and the ASCII renderer
+// (src/ascii/index.ts) need to classify Mermaid source text before
+// dispatching to the right parse/layout/render pipeline. This module is the
+// single source of truth for that classification so the two backends can
+// never drift out of sync with each other again.
+// ============================================================================
+
+import { splitStatements } from './statements.ts'
+
+/** The diagram types this library can detect and route to a renderer. */
+export type DiagramType = 'flowchart' | 'sequence' | 'class' | 'er' | 'xychart'
+
+/**
+ * Detect the diagram type from the mermaid source text.
+ * Returns the type keyword used for routing to the correct pipeline.
+ *
+ * The header keyword is the first *statement*, not the first line: Mermaid
+ * allows `;` as a statement separator, so `flowchart TD;A-->B` has its header
+ * and first edge on one line. Uses the same splitter every parser uses, so
+ * routing and parsing can never disagree about where the header ends.
+ */
+export function detectDiagramType(text: string): DiagramType {
+  const firstLine = splitStatements(text)[0]?.text.toLowerCase() ?? ''
+
+  if (/^xychart(?:-beta)?(?:\s|$)/.test(firstLine)) return 'xychart'
+  if (/^sequencediagram\s*$/.test(firstLine)) return 'sequence'
+  if (/^classdiagram\s*$/.test(firstLine)) return 'class'
+  if (/^erdiagram\s*$/.test(firstLine)) return 'er'
+
+  // Default: flowchart/state (handled by parseMermaid internally)
+  return 'flowchart'
+}

package/src/direction-override.ts

@@ -0,0 +1,46 @@
+// ============================================================================
+// Render-time direction override (issue #276)
+//
+// `RenderOptions.direction` / `AsciiRenderOptions.direction` replace the
+// *top-level* direction a diagram declared in its source (a flowchart's
+// `graph LR` header, a state diagram's or ER diagram's `direction LR`
+// line) after parsing and before layout. Nothing here touches the source
+// text, and nothing here touches a nested subgraph's or composite state's
+// own `direction` — those live on the subgraph objects, not on the field
+// replaced below, so they keep winning locally over the top-level
+// direction exactly as they do relative to the diagram's own header.
+//
+// Shared by the SVG entry (src/index.ts) and the ASCII entry
+// (src/ascii/index.ts). Deliberately dependency-free beyond the
+// `isDirection` guard so the `zombie-mermaid/ascii` subpath stays free of
+// elkjs — the guard itself moved out of `src/parser.ts` and into this
+// package (see `direction.ts`) so that staying dependency-free survives
+// the workspace split (zombie-mermaid#625).
+// ============================================================================
+
+import type { Direction } from './types.ts'
+import { isDirection } from './direction.ts'
+
+/**
+ * Return `diagram` with its top-level `direction` replaced by `override`,
+ * or `diagram` itself (same reference) when there is nothing to apply.
+ *
+ * The parsed diagram is never mutated — a shallow clone carries the new
+ * direction, so `parseMermaid()` output a caller holds on to stays exactly
+ * what the parser produced, and a second render of the same parsed object
+ * without the option sees the source direction again.
+ *
+ * `isDirection` re-checks the value at runtime because `Direction` is only
+ * a compile-time guarantee: a plain-JavaScript caller can pass any string.
+ * An unrecognized value is ignored (the diagram's own direction stands)
+ * rather than thrown on — the same lenient treatment every other
+ * `RenderOptions` value gets, e.g. an unknown `interactivity` or `curve`
+ * string falls back to its default instead of failing the render.
+ */
+export function withDirectionOverride<T extends { direction?: Direction }>(
+  diagram: T,
+  override: Direction | undefined,
+): T {
+  if (override === undefined || !isDirection(override)) return diagram
+  return { ...diagram, direction: override }
+}

package/src/direction.ts

@@ -0,0 +1,56 @@
+// ============================================================================
+// Direction token guard
+//
+// Lives in `core` rather than beside the flowchart parser that used to own
+// it (`src/parser.ts`) because `direction-override.ts` — also `core`, and
+// reached from the ASCII entry — needs it. Left in the parser, `core` would
+// import `mermaid-parser`, i.e. the shared package would depend on one of
+// its own consumers (zombie-mermaid#625, umbrella #620).
+//
+// `toDirection` joined `isDirection` here under #624 for the identical
+// reason: it used to live in `src/parser.ts` too, with that file as its
+// only caller, until splitting `er/parser.ts` out into
+// `packages/mermaid-parser/` gave it a second caller that cannot import the
+// umbrella's `src/parser.ts` without creating the same cycle `isDirection`
+// was moved to avoid. `src/parser.ts` now imports it from here instead of
+// defining it.
+//
+// `Direction` is only a compile-time guarantee, so every entry point that
+// accepts a direction from outside (`RenderOptions.direction`, the CLI's
+// `--direction` flag, a parsed `graph LR` header) re-checks it at runtime
+// through this guard.
+// ============================================================================
+
+import type { Direction } from './types.ts'
+
+/** True when `value` is one of the five directions Mermaid recognizes. */
+export function isDirection(value: string): value is Direction {
+  return (
+    value === 'TD' ||
+    value === 'TB' ||
+    value === 'LR' ||
+    value === 'BT' ||
+    value === 'RL'
+  )
+}
+
+/**
+ * Normalize a regex-captured direction token to a `Direction`.
+ *
+ * Accepts `string | undefined` because every call site passes a regex
+ * capture group value (`match[1]`, typed as possibly-`undefined` under
+ * `noUncheckedIndexedAccess`) straight through. Each call site's regex
+ * guards the capture with the same `(TD|TB|LR|BT|RL)` alternation
+ * (case-insensitively), so the group always participates in the match in
+ * practice — but that's a regex-structure guarantee the type checker can't
+ * see across the call site. Validating `undefined` here, instead of
+ * asserting non-null at each call site, turns a hypothetical violation into
+ * a clear, descriptive error rather than a raw `undefined` crash.
+ */
+export function toDirection(raw: string | undefined): Direction {
+  const upper = raw?.toUpperCase()
+  if (upper === undefined || !isDirection(upper)) {
+    throw new Error(`Invalid direction: "${raw}"`)
+  }
+  return upper
+}

package/src/generated/mono-font-subset.ts

@@ -0,0 +1,32 @@
+/**
+ * GENERATED FILE — do not edit by hand.
+ *
+ * Regenerate with `pnpm run build:mono-font`
+ * (scripts/build-mono-font-subset.ts), which subsets
+ * third_party/fonts/jetbrains-mono-nl/JetBrainsMonoNL-Regular.ttf down to
+ * Basic Latin + Latin-1 Supplement — the self-hosted, embeddable
+ * `@font-face` packages/core/src/theme.ts's `buildStyleBlock()` inlines
+ * into an SVG's own `<style>` for its `.mono` rule (class-diagram method
+ * signatures, ER-diagram attribute types), replacing a Google Fonts CDN
+ * `@import` this library's SVG output previously depended on by default
+ * (#1061). See that script's header comment for why this subset is
+ * deliberately narrower than the site's own (demo/components/generated/
+ * mono-font-subset.ts).
+ */
+
+/** The self-hosted family name every consumer's font stack should list
+ * first — matches this subset's own `name` table entry. */
+export const MONO_FONT_FAMILY = 'JetBrains Mono NL'
+
+/** The `@font-face` rule embedding the subset as a base64 `woff2` data
+ * URI — no separate network request, no page-depth-relative path to get
+ * wrong (see the script header comment for why data-URI over a static
+ * asset file). */
+export const MONO_FONT_FACE_CSS = `@font-face {
+  font-family: 'JetBrains Mono NL';
+  font-style: normal;
+  font-weight: 400;
+  font-display: swap;
+  src: url(data:font/woff2;base64,d09GMgABAAAAABvAAAwAAAAAPWAAABtwAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGkAGYACDNhEICuRsz2ELgyYAATYCJAOGPgQgBYREByAbWjAjEcHGARCEduZRlMfRhcj+eWAbMx8MXsFY1AMYgxQLh2GYMVuWSbQZOjzvQhHrXnbH28KzVPg3QpJZomrI6lliLI+KSSeVPYryGIWmPDYrgaI8OLLE8fIV9/c6y/e+ZNB7khbIPiKu+INtefkIygBJXcZuFw+Bd3fmquSqTJ+0GZ7fZg+wWJs7K0AUEQHJD5//iQ+S309/SlLBBtTtTnc7t3bhLlxduEx3nbtd9Lz0omqTc5mf7DQLP00WgKwmeiAKtX1uOXD1m1fn56okB8lB6wJO7Z8Opg7bqe/enmXs3EmWrFiWq4A+OTnKTz74OFCwi3by/3t2iVFFoK29qd2IthumsRuv5Xn6e1P/ycxLsdVgFa8K29qdH9DYWoB6t0RxwVKIsolbF+tMMrFCOoWXa82cBTkvrXqlGUCkBSmWlle2L8Cg7fNXktAIFKNoUCxjQbGaHYUWR7FZBsVRWY/ipJrCrkymZYO6nIcBR5tZcoafBSsL9MHZOmiHe0D1qMY169//GZD7sGUAoFx/yQfatPi2mSk5ooSsSbQx17Jy+Db1SxKE8aTWuFYD7VPayMwe5T74XysImHYWcGebWTc76pJ7HHCbGbucsMV+m91iqylnnXbGDnejcBCXr0KRYiXKVahUpVotlmZsLThaCbQTEpHY61b7XHSH50ihVDQwRiZmFnZOLm4eXmFRMXE9EgYMGjIsY7eH7HHBIdsddswRxz3sPs+634g7nXe7B7zgQeess97z5txr2mWTRt1low022SmbYEmwxSWxcsuVyldmpeuUWmoAhjr1GjU4iYmPqw2PWJNuCjIQJTkYQs1AR6+DDa4TQYsU5OMXEnBKl35JvfqkRKRRYGuWAzwD5AHwBgy9AuPzAHQsA6g2F22ArcaiJK4FLOGUTfjczAOi09DoW3devO+kaxMaMa8gmnNPE88T2D03jpQesXjo+WQRF27Tt5wdHcEoo7TDA4JxlJjjLGRDj8UmgjlF4RiYpa9Nr1NqlzlOnwlLqNR3aYDrlnrxyvJlfnUiwY7vVPolzqhkudc/tZz68DiHq/w+E/R2Bropp6LvsiryPX9oFRUdp8BvtcqR7CIEljGybitd4ruc7rukT/USp5/rkpd79y6sKFzS297oZdW3bV9AVbVqbEVWvNXyckZjXtK24167T7KvPySRHH0TsyHX4Hml8T5eBXzPCH+oy/YcP2IVSWmpc4SYu18gsbiXXbG/z+0x13MtaZIB68OiuoUN4HoPCFiBkC7evAOLOMZFDiFbAtd4cUuU46LESBDZpLWxINCKJI9F1FJgIEL+yPhsWiHIncwpme575DUoqWOTewANVUiYELRy/RO3pFfZItSupWVguD7kgQsIROA4PoueKBIyhIxjLNhimywSjBwj9IBsBpHtmAsdCvuxKeBMlnKiv2Y8kNlAyI1kz+BMSP9L+EnW7nZPJ1nXeWUqJwYLvTVsWDjXnC9fdrmY5Tmajwpnsl4El4XXsg1kznl9lEhYzay/WxAZZCqcsVEXnknVgaxQOfWpbhIXTCHqqHHqTNPdLCMpbjZYPaRTVaWcd/AGN0oQXW8dZw/x9B45OOD8Zlrtvv31r989wDzV7Re9OlifPAc5Vp2FqvZSb+NPhd5drG7JpyRbIS3b+aP99Q5uWjBuc9GDzR6ogjm7ZoyUgtGHepyrE9JBzNDVHQhdFpIxBJv3gSLZ98DXrgEIQshFnGarRL+9LOBhmQAWBiRNG29iEAHFGCQfEcER6/ERIw8A/t02Sq0rOixukCY4wmD+muTjZAhCQI4zkPWziP1rZCRyXUAjDcUDMNPcVh2nJRrNCw1I9eiOsNIIBe0a7gJw1SX69+e8n0n/If5h4GzQw/X/i107vaGDjEzRGfdx+kiNxz1AHPF7LqUkY41tnmBQ2BuZu8HVCKMR2gqB1yY53axDZkje4gE7kWbfb1oXKEbzO8zQWRH9dbmghC1bONNchvbTxSwvAehKLQtMuBCcptpZxrHVzKnbWgkdR/uICkx8z0wlGCTaE5HtZaO3OoQtaP0YEEZZlUOToc3G6E4/T1Zc9SZpt0VUMCDcVV3jH+1/ZMjlzzIEA4RkEmJ5wm5Yxg0JJmleMuYIHujwjnTO9L5IJtYfnyQ7QW8TIdRyu6MbhFOZdOvHjK+adNvnNrxXSmXq2GZObgLrtU0Fi9sZ68KCdoriWgKAhR3jcT0LMetcKHpIzLeBWwmdlVuj862GEKqYoUYXYI7J1aB0GDw7kQZT6GLUg1oHwvbQPSTRMI8yBl88Q8cJdO8IUnpDuuFBbozvlV0RXqMeuriJ1wMjC6aVlgeuagm0NzZPDjhTtWdmdO6CNd7mwhgpNrNJgzEOhtJgnzcXy1Z1g+qWMd0L8R9+Qsai1gJky00glgdozpR8yAyQBzSy60cQkhmSYVM7Ixm3UJJIGmV400psSVeuloAjOWB6Bs3kEYIuErS3mIG17CGtXHpqOgSgw3vBJ0oAZ665B5LZxtbQWEAYYb58CGFfBZzZdB7NHGmZQUqUv7SquY7z8jlZCNFB/vj1XGv6Bo3JgS6BCrFirdTDI8uRoeHfCgajzR5t9PHhMG3UscnQ3VFEhjCcOjEbbpQ8qg85RdNK6t1qrw6SYkP4MZ3ldKA0GSswd61+4R8bf+afGmeDuoGnbOxo61qqsEem1mi3xq5WVTfmCLJ8GA/S3UP0TRt91SEmu/gAudfkEfZG7X76sFz+XAw2ByxOTOk9CB8y/YHyKw1fvRQHK3HYFA/QA6XtzdqwVG4+d7PRrKS7g005zjSigW8fMnRxRfu9aeKG35+/Mgm5kE+1rjrQrG8qhS251jwORdt6nbozX9w0a+QlEJZTqql9cmMe5e/qatQcukutYVOwThBJmBoZHRJ1ACu1L/xlxz1VM57xn2C0Ssi7q5dnT2M09YWVe2kG6nzi+zjEA4OMZ0KrBf2Aw0eRMDXHwi8HZq3R65RZI9VqnWpc9oTgeSKQDVjrL9l8olXT1hzWhI2wqwmboeFovbK1MbSRkbPlDM3o8mITq5N7hVOIWwmeK6rT+8XT/W0CCALOUm73b3XLdyoTlBsMxsO0V8SD8Y9tOJqECYjqcq0DNobGQHPOSU/SgbXd6RhyRU1aH1Us0oxrerqYAx7oyzUVfA/pBXeZLm4Lna76lVVrleOc0PBMVfeW6esxHFyOU9ZUVYRDBZPaFDhmFh4KrkmM1GnXubN05M22m2OZMVjSlo8q2hsiZmIXZL65XOsiajVdjrO4VNa0UgkP1GrDWIVVskQjIAHiT6YxUHFq+lWC44HFIq/RuhSI0hHa2qxZbTUs0VGkk2Cdi9YWsb/bQlhX6J4Ou03T3EDnVIuQzta2ZS4O+3nC+m/v/Kz3mvhZs/rZsPxZ1/z9rJh0L/jpbhCMf/R+q0C9m+t/XctXffrIe+5/VdNB8er6/76rfeD6lfumU3J74wvC4htTEuCffzk6FPFIMM9W2mGE12BqDaT6ohsOjspUCqEQVcjGJONKvUom1xuU40BAj6YHw4awsCioh0IkjKggSKWCDTCgCSBFMmT9iIBXXxBjJUeX5if4KxH9ciJBMD+GMI2y+ea0rawObRMB3/zDurhQElLXqyVhvB5d2BpRGTpU9Wh3tUaAz0oYCYT6O/+xz9gHovOHCePHLJyVZSRAcP4s4fxZTsg0gGu6hsLGhLpVDUdvJb6/x/xG/zwp+VpC9lX8axzky28T3UZsBDVYSk+MjcRJNaZHEH0vqfPIvPiqEeCbJ2V9B6ThS8FHVnefwBOdYHKe3GwggH5+gw/qgjbMuzw86prsmwQjqyxDg7kd2eciHkDOr/pg6LosPRVv2OdaN3t/aCVNxdgH2PTw8HBSlMyscJlJiGshHIJ9BmApUwKiBwQajRv6FIbw8GDYN7TIrh3PExpPrs+RZOllUsWH2z7SnZOr8yqpm67e9AfwzX8TX5UJh/W1i+9qmdgFYXoFjOmgXYCcJ2f2qrp4Qo/cO9IX2Xspa68MRcQSlVK6FxyZi5/Mms6OjWbCSFjs2O4+qKURfeaxhb8grEOBwJgegtCBEYX3uQX++QU01C70Kw3GxKe3wpEdwtWiTZslakwGqbWSzYBLT04MhkmFWYPAHTpZSyvy4ECVptASx2QCl79NAQfahE4pyVfDQiEK81nHk8PV+kJ8wNS1ehhc2zwmviae2wzY9HjvUKiALJDLtAo5pJXHz2E4OQi+f/Cqb/zHJ1e4RKIC95NjP/gfugp6nVdtkvI2GpZVlIO16cpDaLRFLlZUlPXay8qt7qvDKINHQ/LzaQiKMQDr1eFnunuG3l7LJA3Mtam3I8+EXh3rHv9iLdNoZKyd+BJcy3/3ua7t7PteW7ny4/tK5id/PnCQeo6GuCv/w7UR4B+6igTMAo6xs1l4kt070v5bPpmFDNh90WTQeb0nSk05ZG1GlVkpNs+2RFtanwIX6Gin32iwkepOY5O8ptpZY0UNuJynbtPpkLZW1OrWTX+QZJlqanQ1dtTaibIR3tiYlpcxbzU1mmuq/Y27LbX9jUlrta2FvQ4Y6bBVHqMkyHlyljJOyeAK2BbqDx4IhPqHzNJ/1LOav6ViRAvPwIi2P4MxbSY8pgxmYlQX2YBKJBAmX3s3jKkhCSqtJ6muTAy8QoBjYuyHC9KoT090MZ0I9wcOBEP9NhhXZCiU8VlynkxQYlZ5tVmiNAR1r7VE+rdmVv0PaKZrusWSmFrdHg6IlC1HDiyT/noJIQ8a8TGxLtzz6C0aPNFmHnq0fTuCSXviUq0VMVlRlPsQuPACNj00mume7MYPegjtEgj9SNjdrtBiMj7C7CLzNGn8LSOoQFWYQqHCUPD2llliNo12GvQHiAOILL1ALGwBs3PEfq6dw6d4aEPmdsgR6g1kAqF+B2QWD1GDHqYt3uVZ0WB2KuHCqGRCAngc+FxWUuJGSGkLxdwpMgLDKpEE0SIB4CCenDxH0N+4nwCeOWIc1qgVd2cRgdzQ2HAMhObJ3Ym9H3efz36gOnHXr72/gfEOpx377hHiOmWds+YkAeRMSwdVs5TZUHqIEqEzhbBFedB+qPb3ivLfag8bpkx5xemBj0kmdK8bVirZuZFMumdNIp2KRtVJrOnxPGErpEKRm5GsAsnUOwStgIMPn1fPjCI7N/E+9NpGFnS7T54m7tjC/Syfc7n69za5Sg2vWSlXaRQzxfyXG/4G3rk4roBtob5ghDezKqK0Ax37o7UdufPE+jZp21rrkRaOfcdYOjDnNqJFraPBcB+R2Pt79Y8285n9CzmJ/AWGmGSCGjUqEKcvHuSS3FUjkEKNBEBxri9KmEgmyWvh97J0SN7u4jGFSakPd7pa8KhF6a1gNLW0Shtkuu2FU4XT5qjdB3wlinZfQKBU+lvbO8UQ4pHT5s3dernYGxaoZEQbbNLJZDqdU4q3ClWo8PkVqbSSEhDRdFpU6juJO/eT+xeIBXUFtXyWAM304PBQKEAG5EpMLEEw+YJnGeVPDzBCY8Oz/7Yh702XLOjdJljtYVjE6xh2sEIj1Kwj26IwWj5hO0O6zuBnROAboIEVYI0RvQHwnyi7Z1Gy70TyeXHj81h9z+LHS5Mjc8kX9ZJvrx8/kuDCHP7mi7TQTbb0u1zuu5FVtmD+VUCSgtUtxC5SulpLgPzHOYHGxgkeWbmyuapMWMvXPs8Tftj8JFdM2891NM5Vl5FiTkkpYD/U/hUX537Vni0VVwoqcTXgCQDf3DwZgCGtWAJr4QDJdCdoDX4Y/q8h9EcC2PRZQ4EKu8LtKpNcb+KiQj/miA/6uXxpRfmS8vYNr1gKnohnZE/f0n34+hs2HySA0/YzbTnb1SzXYJAC08MkNTyWjsRGh8PtkrRG99QVEwFq6LGRoRAp12rlhPPRWsFqufhwC3Gz/dwDnpzuAS8/NDoEpmcN2+mn48WPNf54kTwMGFUeAEeu1sqejWwgeJRHRmP9AzHO9mVsoWNJGdSjbauPfn68NTonqX2MV412SUQRFQYleyDMiuIOrRZ3oMULBR6hbSoZJZ97xU7ZANh0bUIo61JqLRF0EW2b2i2TCp1dbUokOMsxmV/dRkMXhYta5bG3R6g9J1GjQqGWJWLNiGBWUQCxGuQKC4G0Qv4NgSfnJLV3ETXKgEQYUemgRALS6hKm7WnAjs/jbRPotGabvSONdd2YRsH+CfM9d7RlSuq/rq9b3KAru0vT0NSiqdvR3HAHPDX6HgrYq3SeTpWOUcViVTEYlawmbcr1Jlqpz3jv0RtlKk8nyF556zX+6LeiohNvYlq5o7A394lSx59XF5AxjbaRXcmvbBvkhRqFSCJrnF99eaNPsOjAbSX9/EqbhYpfbHxMG7Fz+MRZ7caHVqQ98lfB3p0yrZQrLzVXV5lLi/tSWSXF4dv5b4vt6NNjzVyt9MrO813ufGw643I94wqjfTD1l8Grd4l4fVoeYO9v2l1Xt7sJ75915KQMavc2QzUna4oife7rkXK71LcWU5PtluJ3y/LLnKrKj4aVBWWg4uK5Hq+1Shcq1fHFVGIxFZhvneQjBgyCDBg64ZjA4u2SoErKJe3CVFBe3bVcrPipdEJg3JKFcc6eLlTG9QiyFs2IIc8HOB/XtCG+x58UzH1Ykmwst/Q2Zq/u78AKJ+wThc6OiURxr4FMX8mHc4I3ziO+k/fFf778/vvLLgAb81UXGq6dC6F9M8MSPvvV+dLhFczGvllg6C8RnA7qIDiz9346tqP69sv7Lu3LUKpy/R+w8cetlyz8icn7P0iNuZBlftvGsVyyWggRFlyM9wVc7nd3O3Msyw5p1qBpPI2u0eRo6+12ujk4hyuTkWtAMUNO46DmjhT5jGuVQaDfViaT1x3aLLWwGqXazTPydLORA7mZLR0Z8GXOohP4BPJI7KRbDIYCAi/2n/4N379k/01wGy6eyG+nwVQtjuAAihg/MoLLjY/+8MgPPU9+9+RPjjyZLIL8QO3Hx75PXHAHSnbfFwDO5LLjOWywYmq9nR7p88x4OpT+aVkvX2fPiUWonSRH/PTM02IOSe2MRew56/bZ2vnI/bfez20H3w85ne8p4G/t9vcJG1AiKxyO712ufyDl/zbbiwSxoKjO+8JuB0pJh1Eq7TBKGBfZTCb7IiiYWufPTfZQHCTvjDPnmKEE7+3Aw9223PXydURupBt0ktxFz/w5ri+x9huInl5X3ro9d3O46JXP7snesyTX29bSijw8B4zRVBGrtFzXgxuvviJhOtKRcCQVBe4gH4XEsj+F9anq7+/HD9WXsOv0DRMpHEBjxifLI8zet3bdijx79taNP7mKXAWuBbRH8UefdH+5YP+m+m114/a67dump+sjNDDBRgXYlxnv1NW9w2A+l17uc98dNk4bn/3hygfse/Gz+Jkf0vsH7IhLuJu1ZPimylzhHvLMW1FARRDF9Fa6Im81wLAHFvQ9toUHMHDnfZMQPv0a0P6PQTpMxigtOXq1iCvGHOsSTAfdPSZgtV3cYD+/oXOQkn6qSfrGuhQFvO9EDPql6NLORnYAdi/v/OmqId81+npVfTVaXV/1WELfOWLwqZQxCdeUmqq6p0x15X/JZXVAM+eYwDSTbvumnfvWpCYnU8stDtLQ4XTpMgYtjjQFp6iYw+7ByUi6xx5NpvwDxjoOc5o90nInk3lXS4Y9Dd7Kc8fibinuCRppc0JMrAu6zGKC22qXuvmWFsZ3zMannviHHI7uODf9UKTrxiOlBIuBS1MCdPyuKm5SIBWcBP/Pfe3o8Ztwc4/Pge8gd+A7QMFeb5LQBevGuHz+dlZD3UrvsrfVAkYHSybTiaiQ2CgxxJwuvjVmzlEFFQWN/FYjs1bx21gJtgQPKWRqzcdUtKsJEVgSpC/Lfo8YFdbfzehYcu+NAuaxYsDuN6UgZa9+Rq/sTUEm8/AJGL4tntzTynNIZ6Q8u4crlysaMWKOgAexSzRw+2R750gk6smHloOyclA+qW4ZKEfbX8cts7foB/G9kku+f56/AinRl23a+9HbENmUaNsjorL3ylq1CLAfVxM4ghJWtVqKKLIqVGLmRyzWApPxUzHrj+D//tPk6abHx8lxD5eV4KHNlbWVVXWVlXVVU/Qf7AL25trOaFOitpZ4jjqBan1qKto/BQbXJ6ZCA1Pgo/Vbp2xTU5FOs9UM2EERCgsEKkSF114OKioo5eUU99UB+GxLlX1/Jr+qvgqt4uSzTvZIAbM7jIgRbP3zdLy6gNT0p+hgvc4zbGGRoNmWhStpzeQIVYXNZL7/O5rLIlzyxeaYgAIAyAUWNQzOsm2qGzayTaol7pQLF8QyeaIPDIiGATaEKRIvsQMugUvgkni15nitBLgWroVr4Vq4FW6FW+HWuAhS0sNTavdZtkr1wyibUG1xrVzoIDB5qfBkLOoGGCFIWVJWge0wUDalDsfV8jgCQbBwSEgdj3usgr2wF/bCXuGFlBtOwAk4ASfiwyLRYS4tdyH8OUuGRRz2bFaWD1wNu/vGOeqdHx4refhUHpVnC89n2/n7+2FtJvN9/89F5G0AuOhdawXKP2Bd40fWdfzQpfP6e5mo3vPoLFSJj/ML9QVAjv78NXf7XYDzqIfOoYpcwf/Po7NorR6oLeqv/rXy4SE6FE1jCchlkXUR1A7MHEAt+D3Ug0vxYTPlSRjnXerILH+eKx5ycFz8UD6q6ehI1I6rDr7bgW/Jwt9z1LbU4duk7MzZPF/z/M2UfwQTJmpL3u2gw+HakAyNvoRqrnl1ue78o/rKlSbE3cpQgDp5aQzG+4PL5f/1Lrf+Afj6if8Ec6Vv/DP5/1D9Z3cBugmAQPcfnwd1erB8LfgM8doZB0ek7pevin+7D27RXlHBuHkfS0A4oibpQ8JebvVxYyQ8fpEivhDhK8Iq9Rz7Vau+69PJBXvMDnfF9jzHAUKqyItvL7v62GlxgaE4rp/CdZNIdfjHPkY6537+4JgpGDBCEFFhM24xdTcbzHvNVVfKgsmkaRrUxwjuTxonKGIm2xC5Kgw7/VUAN3b0ouqhEg9F/Rv0+i7WNrAuw0kpjTkcZGZ87WMVwB/DdgbTqvlK+2iETDiYL20eXxFpXm66pmu6lvs/CvCc+wywyupZ6VijjHP7Y50OgKc05FtoUMSW4Pt3y7LApS3bJJNbMVIrs+Jwf4FDMRkqKSEJA9LMBh3SJ2dhwkGI6TaiT0iKU0xKWoJ+/TX4Wgm0aQd5/oyMuJAREoP/k7YyIT/LKJ5WEk20zy7GIRQ9qrAm7YWa3K7Jt6YmrPHcNFCBHAifTVS3pYbykNWHyxO69bhj8Ql/ILLsb4nYhF0o41JgJS/ZEQkc9ZPuegalpIlkRNaQt3MZLq5uCap+ZWlYq0h0VP24evYJ1/16E5rXbdc24AMC) format('woff2');
+  unicode-range: U+0020-007E, U+00A0-00FF;
+}`