agentic-mermaid 0.4.1 → 0.5.3

package/SECURITY.md

@@ -28,10 +28,11 @@ Types):
 
 In strict mode the SVG output contains **zero external-fetch references**:
 
-- The Google Fonts `@import` is removed (the only external-fetch vector our
-  output otherwise emits). The font family is still declared via the `--font`
-  CSS variable, so a host that *does* have the font shows it; otherwise the
-  browser falls back to `system-ui, sans-serif`.
+- No Google Fonts `@import` is emitted, even if the caller passes
+  `embedFontImport: true` (that opt-in import is the only external-fetch
+  vector our output otherwise emits). The font family is still declared via
+  the `--font` CSS variable, so a host that *does* have the font shows it;
+  otherwise the browser falls back to `system-ui, sans-serif`.
 - We emit no `<image>`, no `<script>`, no `<foreignObject>`, no external
   `href`/`src`/`url(http…)`/`url(//…)`.
 
@@ -49,16 +50,28 @@ gate or an agent self-check after rendering.
 - **Deterministic renderer, no ambient network or code execution.** SVG/ASCII
   rendering is pure-functional TypeScript with no DOM, no `eval`, no network,
   and no user-controlled filesystem access. PNG rendering may read bundled
-  font assets from the package before offline rasterization. Code Mode snippets
-  run in a `node:vm` context where `process`, `require`,
+  font assets from the package before offline rasterization. Local Code Mode
+  snippets run in a `node:vm` context where `process`, `require`,
   `fetch`, `eval`, `Function`, and host-constructor escape paths are tested
-  absent and dynamic code generation is disabled.
+  absent and dynamic code generation is disabled. Hosted `execute` at
+  `agentic-mermaid.dev/mcp` does not use `node:vm`: each snippet runs in a
+  Cloudflare Dynamic Worker isolate with no network (`globalOutbound: null`),
+  an empty env, and a CPU budget.
 - **HTTP/SSE MCP defaults are local-first.** `agentic-mermaid-mcp --transport
   http` binds to `127.0.0.1` by default. Non-loopback binding requires
   `--auth-token`; `/rpc` and `/message` require `content-type:
   application/json`; cross-origin browser posts are rejected; request bodies,
   artifact bytes, and sandbox timeouts are capped.
 
+### Graph work budgets
+
+Graph parsing bounds expanded edges and nodes at 5,000 each. Cartesian edge
+statements such as `A & B --> C & D` are checked before allocating their
+expanded edges. Graph layout also counts container nodes and rejects nesting
+deeper than 64 levels before recursive conversion or ELK execution. These host
+budgets apply in every security mode; diagram configuration cannot raise them.
+Exceeding a budget throws `DIAGRAM_WORK_LIMIT` without drawing a partial graph.
+
 ## What we do NOT guarantee
 
 - **`node:vm` is not an OS/container security boundary.** Code Mode containment
@@ -66,12 +79,15 @@ gate or an agent self-check after rendering.
   `execute(code)` to arbitrary hostile users without process/container
   isolation and normal resource controls. HTTP/SSE transport improves
   reachability for trusted clients; it is not a hosted multi-tenant sandbox.
-- **Default mode emits the Google Fonts `@import`.** This is back-compat
-  behavior for existing consumers who render SVGs into pages that expect the
-  Inter webfont. **For agent/untrusted SVG contexts, use strict mode.** MCP
+- **Default mode does not enforce the no-external-refs guarantee.** It omits
+  the Google Fonts `@import` unless the caller opts in with
+  `embedFontImport: true` (back-compat for pages that expect the Inter
+  webfont), and it does not reject a render that carries an external
+  reference. **For agent/untrusted SVG contexts, use strict mode.** MCP
   `render_png` is already offline (the PNG rasterizer has no network). SVG via
-  Code Mode `execute()` lets the agent pass `security: 'strict'`; ASCII output
-  has no external-reference surface.
+  local Code Mode `execute()` lets the agent pass `security: 'strict'`; hosted
+  `render_svg` and hosted `execute` force it. ASCII output has no
+  external-reference surface.
 - **We do not sanitize arbitrary third-party SVG.** `verifyNoExternalRefs`
   is a scanner for *our* output shape, not a general SVG sanitizer. Don't
   feed it untrusted SVG and treat a pass as safe.

package/THIRD_PARTY_NOTICES.md

@@ -1,5 +1,26 @@
 # Third-party notices
 
+## Pele parser and fishbone layout adaptations
+
+The native Block and Requirement parsers and Ishikawa layout adapt browserless
+implementations from Pele, with Agentic Mermaid's typed bodies, editing,
+measurement, Scene, styling and output contracts applied locally.
+
+- Source: <https://github.com/kepano/pele/tree/8603bf3313add9143cd417015d4a6bd6c522dada>
+- Copyright: © 2026 kepano
+- License: **MIT**, reproduced in [`LICENSES/pele-MIT.txt`](LICENSES/pele-MIT.txt).
+
+## Mermaid 12.2.0 stable-family tests
+
+The six new family compatibility benches preserve pinned Mermaid test cases and
+documented examples from source commit
+`1fb7869866dd619168d840291c9c54b4f129758b`. They are verification inputs, not
+runtime code, and are excluded from the npm package.
+
+- Source: <https://github.com/mermaid-js/mermaid/tree/1fb7869866dd619168d840291c9c54b4f129758b>
+- Copyright: © 2014–2022 Knut Sveidqvist
+- License: **MIT**, reproduced in `LICENSES/Mermaid-MIT.txt`.
+
 ## Material Design Icons (curated Architecture icon paths)
 
 A size-bounded subset of SVG path data in `src/architecture/icons.ts` is
@@ -17,6 +38,16 @@ at runtime and does not bundle the full npm package. The published
 `@iconify-json/mdi@1.2.3` tarball contains no upstream `NOTICE` file to
 reproduce.
 
+## Mermaid syntax references
+
+The Mermaid syntax references under
+`skills/agentic-mermaid-diagram-workflow/references/upstream/` are copied from
+Mermaid 12.2.0, source commit `1fb7869866dd619168d840291c9c54b4f129758b`.
+
+- Source: <https://github.com/mermaid-js/mermaid/tree/1fb7869866dd619168d840291c9c54b4f129758b/docs/syntax>
+- Copyright: © 2014–2022 Knut Sveidqvist
+- License: **MIT**, reproduced in `LICENSES/Mermaid-MIT.txt` and included in the npm package.
+
 ## Mermaid pinned test specifications
 
 The revision-bound oracle vendors two upstream Mermaid test specifications at
@@ -27,3 +58,32 @@ The revision-bound oracle vendors two upstream Mermaid test specifications at
 - Copyright: © 2014–2022 Knut Sveidqvist
 - License: **MIT**
 - Repository license copy: `eval/mermaid-upstream-suite-bench/upstream-f3dea583/LICENSE.mermaid.txt` (the upstream specs are verification-only and excluded from the npm package)
+
+## Pinned Mermaid configuration compatibility program
+
+`src/shared/pinned-mermaid-config/runtime.js` contains the pure configuration,
+merge, appearance, theme and color programs from Mermaid 12.2.0 source
+`1fb7869866dd619168d840291c9c54b4f129758b`, Khroma 2.1.0 and lodash-es 4.18.1.
+It has no diagram parser, renderer or DOM implementation. Regenerate it with
+`scripts/build/generate-mermaid-config-runtime.ts` and the policy reference.
+
+- Mermaid: MIT, copyright 2014–2022 Knut Sveidqvist; `LICENSES/Mermaid-MIT.txt`.
+- Khroma: MIT, copyright 2019-present Fabio Spampinato, Andrew Maney; `LICENSES/Khroma-MIT.txt`.
+- lodash-es: MIT, copyright JS Foundation and other contributors; `LICENSES/lodash-MIT.txt`.
+
+## Optional ZenUML browser backend
+
+`dist/zenuml-frame.global.js` bundles **@zenuml/core 3.47.9** and its
+transitive browser dependencies. It is loaded only by the explicit asynchronous
+`agentic-mermaid/zenuml` API in a disposable iframe. The default SVG, agent,
+terminal and browser entries do not import it.
+
+- Source: <https://github.com/mermaid-js/zenuml-core>
+- License: **MIT**, reproduced in `LICENSES/zenuml-core-MIT.txt`.
+- Dependency notices are retained in the separately built browser script.
+
+The development-only Mermaid ZenUML addon 1.0.1 is the configured positive
+control; the product backend calls the same core native SVG API directly.
+Event Modeling tests and syntax investigation use the pinned Mermaid reference
+identified above. Its layout, text measurement and drawing implementation are
+Agentic Mermaid's.