archyne 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Dario (dariodd)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,249 @@
+<p align="center">
+  <img src="public/logo.svg" alt="Archyne" width="120">
+</p>
+
+# Archyne — a visual editor for Mermaid diagrams
+
+A draw.io-style diagram editor with **two-way sync to Mermaid code**. Edit visually
+(drag-and-drop, connect, rename) or edit the Mermaid text — each side updates the
+other. Because the document _is_ standard Mermaid, LLMs can generate, read, and
+modify your diagrams as plain text, and anything they produce opens on the canvas.
+
+Runs entirely in the browser — no server, no accounts, nothing leaves your machine.
+Self-host by serving the `dist/` folder from any static file server.
+
+<p align="center">
+  <a href="https://github.com/dariodd/archyne/actions/workflows/ci.yml"><img src="https://github.com/dariodd/archyne/actions/workflows/ci.yml/badge.svg" alt="CI"></a>
+  <a href="https://www.npmjs.com/package/archyne"><img src="https://img.shields.io/npm/v/archyne.svg" alt="npm"></a>
+  <a href="LICENSE"><img src="https://img.shields.io/badge/license-MIT-blue.svg" alt="MIT"></a>
+</p>
+
+## Try it
+
+**[Open the live demo →](https://dariodd.github.io/archyne/)** — it is the same
+static build, running in your browser. Nothing is uploaded.
+
+Or run it locally, with no clone and no build:
+
+```sh
+npx archyne                 # opens http://localhost:4173
+npx archyne diagram.mmd     # …with a diagram already loaded
+```
+
+Desktop builds for Windows, macOS and Linux are attached to every
+[release](https://github.com/dariodd/archyne/releases/latest). They are **not
+yet code-signed** — Windows warns, macOS needs one `xattr` command — and each
+release page says so; the web version and `npx archyne` avoid the question
+entirely.
+
+<p align="center">
+  <img src="docs/images/editor-flowchart-light.png" alt="Archyne editing a flowchart: shape palette on the left, canvas in the middle, Mermaid source on the right" width="100%">
+</p>
+
+<table>
+<tr>
+<td width="50%">
+<img src="docs/images/editor-architecture-dark.png" alt="An architecture diagram with vendor icons for Cloudflare, AWS, Node.js, Redis and Postgres, grouped inside a VPC" width="100%">
+<p align="center"><em>Architecture diagrams with 13 000+ searchable vendor icons</em></p>
+</td>
+<td width="50%">
+<img src="docs/images/editor-sequence-dark.png" alt="A sequence diagram with participants, activations, a note and numbered messages" width="100%">
+<p align="center"><em>Sequence diagrams — drag participants to reorder</em></p>
+</td>
+</tr>
+</table>
+
+The screenshots are generated from the real app by
+`node scripts/screenshots.mjs`, so they cannot quietly go stale.
+
+## Run
+
+```sh
+npm install
+npm run dev            # development, http://localhost:5173
+npm run build          # production build into dist/ (static, any web server)
+npm start              # serve the build locally (same as npx archyne)
+npm test               # round-trip parser/serializer tests
+npm run mcp            # MCP server (stdio) for LLM agents
+npm run mcp:smoke      # end-to-end MCP server test
+npm run desktop        # desktop app (Electron shell around the build)
+npm run desktop:build  # Windows installer (NSIS) into release/
+```
+
+There is no backend: the web build is static files, the desktop app is the
+same build in an Electron window, and diagrams live in your files. Opening a
+`.mmd` file with the desktop app loads it directly (the installer registers
+the file association), and **Save writes back to that same file** — as it does
+in the browser too, on engines with the File System Access API. Elsewhere,
+Save falls back to a download.
+
+Diagram families Archyne has no visual editor for — `gantt`, `pie`, `mindmap`
+and friends — still open, rendered read-only, with the Mermaid code fully
+editable and the file untouched on save.
+
+> Windows note: if `desktop:build` fails with `EPERM … rename win-unpacked`,
+> your project sits in a Defender-protected folder (e.g. Documents). Build
+> with the output elsewhere:
+> `npx electron-builder --win -c.directories.output=%LOCALAPPDATA%\archyne-release`
+
+## Embedding Archyne in another app
+
+Load the app with `?embed=1` inside an iframe and talk to it over
+`postMessage`. In embed mode Archyne never touches localStorage — the host
+owns the data.
+
+The bridge is **default-deny**: you must name your origin with
+`&origin=https://your.app`, and diagram content is only ever posted back to an
+origin on that list. Comma-separate several if you need to. `origin=*` accepts
+any parent frame and is for local development only.
+
+```html
+<iframe id="mf" src="https://archyne.your.host/?embed=1&origin=https://your.app"></iframe>
+<script>
+  const MF = "https://archyne.your.host";
+  const mf = document.getElementById("mf").contentWindow;
+  window.addEventListener("message", (e) => {
+    if (e.origin !== MF) return; // verify the sender, too
+    if (e.data.type === "ready")
+      mf.postMessage({ type: "load", code: "flowchart TD\n a-->b" }, MF);
+    if (e.data.type === "change") save(e.data.code); // live edits, debounced
+    if (e.data.type === "exported") show(e.data.dataUrl); // png/svg data URL
+  });
+  // on demand:
+  mf.postMessage({ type: "getCode" }, MF); // → { type:"code", code }
+  mf.postMessage({ type: "export", options: { format: "png", background: "light" } }, MF);
+</script>
+```
+
+Messages from the editor: `ready`, `loaded`, `change {code}`, `code {code}`,
+`exported {format, dataUrl}`, `error {message}`. A working example ships at
+`/embed-demo.html`.
+
+## MCP server — let agents edit your diagrams
+
+`mcp/server.ts` exposes the diagrams as MCP tools, so Claude Code (or any MCP
+client) can work with them directly. The included `.mcp.json` registers it
+automatically when you open this project in Claude Code; elsewhere:
+
+```sh
+claude mcp add archyne -- npx tsx mcp/server.ts
+```
+
+| Tool               | What it does                                               |
+| ------------------ | ---------------------------------------------------------- |
+| `list_diagrams`    | Find all `.mmd` files under `GRAPH_DIR` (default: cwd)     |
+| `read_diagram`     | Raw mermaid source + parsed structure (nodes/edges/groups) |
+| `validate_mermaid` | Parse-check code without writing                           |
+| `write_diagram`    | Validated write; rejects broken mermaid outright           |
+
+Writes are safe by construction: invalid code never touches disk, paths can't
+escape the root, and if an agent rewrites a diagram without the
+`%% graph:positions` line, the previous manual layout is carried over for the
+nodes that still exist — an LLM restructuring your diagram won't scramble
+your hand-arranged layout.
+
+## How it works
+
+- **Canvas → code**: structural edits (add/delete/connect/rename/reshape) regenerate
+  the Mermaid text; dragging a node only rewrites the positions comment, leaving the
+  rest of your text untouched.
+- **Code → canvas**: the text is parsed with mermaid's own parser, so anything
+  mermaid accepts renders on the canvas. Parse errors are shown without destroying
+  the last good canvas state.
+- **Positions** live in a single trailing comment the rest of the world ignores:
+
+  ```
+  %% graph:positions {"start":{"x":0,"y":0},...}
+  ```
+
+  So the file stays a 100% valid Mermaid diagram (GitHub, Notion, LLMs, mermaid-cli
+  all render it), while your manual layout survives save/reload/LLM-edit cycles.
+  Diagrams without a positions line are auto-laid-out with ELK.
+
+## Current scope
+
+Five Mermaid diagram families, all with visual editing and two-way sync:
+
+- **Flowcharts** — all 14 vertex shapes, all edge stroke/arrow types,
+  subgraphs as groups (create/dissolve from the toolbar), and full
+  `classDef`/`style` round-trip with color pickers in the inspector.
+- **State diagrams** (`stateDiagram-v2`) — states, start/end pseudo-states,
+  transitions with labels, composite states as groups (nested transitions
+  round-trip correctly).
+- **ER diagrams** — entities with typed attributes/keys/comments, crow's-foot
+  cardinalities, identifying vs non-identifying relationships.
+- **Class diagrams** — fields and methods (with abstract/static classifiers),
+  «interface» annotations, generics, namespaces as groups, sticky notes,
+  inheritance/composition/aggregation/dependency markers, cardinalities,
+  dotted relations.
+- **Sequence diagrams** — participants/actors as draggable columns with
+  lifelines (drag horizontally to reorder), messages as ordered horizontal
+  arrows with all eight operators; reorder from the inspector. Notes and
+  loop/alt/opt blocks are created from the palette (drop them at a row),
+  renamed and deleted in place; par/critical/break blocks, activations, and
+  autonumber are rendered and fully preserved through any canvas edit.
+- **Architecture diagrams** (`architecture-beta`) — cloud/solution
+  architecture with **vendor icons** (AWS, Azure, GCP, Kubernetes, … — the
+  Iconify `logos`, `devicon`, `carbon`, `tabler` and `simple-icons`
+  collections are bundled and searchable from the
+  palette), nested groups for VPCs/subnets, junctions, and side-anchored
+  connections with per-end arrows.
+- **C4 models** (`C4Context`/`C4Container`/`C4Component`) — persons,
+  systems, containers, components (with `_Ext`/db/queue variants),
+  enterprise/system/container boundaries as groups, relations with
+  technology labels and bidirectional arrows. The original C4 flavor and
+  title round-trip.
+
+The palette, inspector, and "New…" menu adapt to the active diagram kind.
+Plus: **undo/redo** (Ctrl+Z/Y — the code being the source of truth makes
+history a stack of snapshots), **copy/paste** (Ctrl+C/V, id-remapped, edges
+included), group resizing with drag handles, snap-to-grid, double-click any
+node or edge to rename it, drag-and-drop, direction switch, ELK auto-layout,
+`.mmd` open/save, **PNG/SVG export** of the canvas, copy code, localStorage
+autosave, live Mermaid preview tab.
+
+## Roadmap
+
+- Open files from disk in the app and watch for MCP-side changes (live
+  agent ↔ human co-editing)
+- Alignment guides; edge waypoints; resize for non-group nodes
+
+## For reviewers and buyers
+
+Archyne is local-first by construction — no backend, no accounts, no
+telemetry — which answers most of a security review before it starts. The
+documents that answer the rest:
+
+| Document                                                                     | What it covers                                                                                                                            |
+| ---------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- |
+| [Security architecture](docs/security-whitepaper.md)                         | Data flows, threat model, the sanitizer and CSP layers and how they are verified, supply-chain posture, and a plainly-stated list of gaps |
+| [Security policy](SECURITY.md)                                               | How to report a vulnerability, and what is in scope                                                                                       |
+| [Accessibility Conformance Report](docs/accessibility-conformance-report.md) | WCAG 2.2 A/AA, criterion by criterion, with the evidence for each — and an explicit account of what has **not** been tested               |
+| [THIRD-PARTY-NOTICES.md](THIRD-PARTY-NOTICES.md)                             | Dependency licences; `npm run sbom` emits a CycloneDX SBOM                                                                                |
+| [Roadmap](docs/PLAN.md)                                                      | What is done, what is not, and why                                                                                                        |
+
+Two things stated up front rather than discovered later: the desktop
+installers are **not yet code-signed**, and the accessibility report is a
+self-assessment, **not a signed VPAT**.
+
+## License
+
+[MIT](LICENSE). Third-party dependency licenses are listed in
+[THIRD-PARTY-NOTICES.md](THIRD-PARTY-NOTICES.md) — all are compatible with
+MIT distribution (elkjs is EPL-2.0, consumed unmodified as a library; icon
+collections are CC0, with depicted logos remaining their owners' trademarks).
+The full breakdown is also available in-app: click the Archyne logo.
+
+## Trademarks
+
+Archyne is an independent project. It is **not affiliated with, endorsed by,
+or sponsored by** Mermaid or Mermaid Chart.
+
+"Mermaid" is a trademark of its respective owner. It appears here and in the
+interface only to describe the file format Archyne reads and writes — the
+kind of use that identifies compatibility, not origin. The Mermaid library
+itself is used under its [MIT licence](https://github.com/mermaid-js/mermaid),
+which grants rights over the code and none over the name.
+
+Vendor logos in the bundled icon collections likewise remain trademarks of
+their respective owners.

package/THIRD-PARTY-NOTICES.md

@@ -0,0 +1,302 @@
+# Third-party notices
+
+> **Trademarks.** Archyne is an independent project, not affiliated with,
+> endorsed by, or sponsored by any project listed here. Product and library
+> names — including "Mermaid" — are trademarks of their respective owners and
+> are used only to identify the software concerned. The licences below grant
+> rights over code, not over names.
+
+Archyne is MIT-licensed. It bundles or depends on the following packages
+(production dependency tree, generated with license-checker):
+
+<!-- notices:table:start -->
+
+| Package | License | Repository |
+|---|---|---|
+| @antfu/install-pkg@1.1.0 | MIT | https://github.com/antfu/install-pkg |
+| @braintree/sanitize-url@7.1.2 | MIT | https://github.com/braintree/sanitize-url |
+| @chevrotain/types@11.1.2 | Apache-2.0 | git://github.com/Chevrotain/chevrotain |
+| @codemirror/autocomplete@6.20.3 | MIT | https://code.haverbeke.berlin/codemirror/autocomplete |
+| @codemirror/commands@6.10.4 | MIT | https://code.haverbeke.berlin/codemirror/commands |
+| @codemirror/language@6.12.4 | MIT | https://code.haverbeke.berlin/codemirror/language |
+| @codemirror/lint@6.9.7 | MIT | https://code.haverbeke.berlin/codemirror/lint |
+| @codemirror/search@6.7.1 | MIT | https://code.haverbeke.berlin/codemirror/search |
+| @codemirror/state@6.7.1 | MIT | https://code.haverbeke.berlin/codemirror/state |
+| @codemirror/theme-one-dark@6.1.3 | MIT | https://github.com/codemirror/theme-one-dark |
+| @codemirror/view@6.43.6 | MIT | https://code.haverbeke.berlin/codemirror/view |
+| @esbuild/aix-ppc64@0.28.1 | MIT |  |
+| @esbuild/android-arm@0.28.1 | MIT |  |
+| @esbuild/android-arm64@0.28.1 | MIT |  |
+| @esbuild/android-x64@0.28.1 | MIT |  |
+| @esbuild/darwin-arm64@0.28.1 | MIT |  |
+| @esbuild/darwin-x64@0.28.1 | MIT |  |
+| @esbuild/freebsd-arm64@0.28.1 | MIT |  |
+| @esbuild/freebsd-x64@0.28.1 | MIT |  |
+| @esbuild/linux-arm@0.28.1 | MIT |  |
+| @esbuild/linux-arm64@0.28.1 | MIT |  |
+| @esbuild/linux-ia32@0.28.1 | MIT |  |
+| @esbuild/linux-loong64@0.28.1 | MIT |  |
+| @esbuild/linux-mips64el@0.28.1 | MIT |  |
+| @esbuild/linux-ppc64@0.28.1 | MIT |  |
+| @esbuild/linux-riscv64@0.28.1 | MIT |  |
+| @esbuild/linux-s390x@0.28.1 | MIT |  |
+| @esbuild/linux-x64@0.28.1 | MIT |  |
+| @esbuild/netbsd-arm64@0.28.1 | MIT |  |
+| @esbuild/netbsd-x64@0.28.1 | MIT |  |
+| @esbuild/openbsd-arm64@0.28.1 | MIT |  |
+| @esbuild/openbsd-x64@0.28.1 | MIT |  |
+| @esbuild/openharmony-arm64@0.28.1 | MIT |  |
+| @esbuild/sunos-x64@0.28.1 | MIT |  |
+| @esbuild/win32-arm64@0.28.1 | MIT |  |
+| @esbuild/win32-ia32@0.28.1 | MIT |  |
+| @esbuild/win32-x64@0.28.1 | MIT | https://github.com/evanw/esbuild |
+| @hono/node-server@2.0.12 | MIT | https://github.com/honojs/node-server |
+| @iconify-json/carbon@1.2.24 | Apache-2.0 |  |
+| @iconify-json/devicon@1.2.62 | MIT |  |
+| @iconify-json/logos@1.2.11 | CC0-1.0 |  |
+| @iconify-json/simple-icons@1.2.92 | CC0-1.0 |  |
+| @iconify-json/tabler@1.2.38 | MIT |  |
+| @iconify/types@2.0.0 | MIT | https://github.com/iconify/iconify |
+| @iconify/utils@3.1.4 | MIT | https://github.com/iconify/iconify |
+| @lezer/common@1.5.2 | MIT | https://github.com/lezer-parser/common |
+| @lezer/highlight@1.2.3 | MIT | https://github.com/lezer-parser/highlight |
+| @lezer/lr@1.4.10 | MIT | https://code.haverbeke.berlin/lezer/lr |
+| @marijn/find-cluster-break@1.0.3 | MIT | https://code.haverbeke.berlin/marijn/find-cluster-break |
+| @mermaid-js/parser@1.2.0 | MIT | https://github.com/mermaid-js/mermaid |
+| @modelcontextprotocol/sdk@1.30.0 | MIT | https://github.com/modelcontextprotocol/typescript-sdk |
+| @types/d3@7.4.3 | MIT | https://github.com/DefinitelyTyped/DefinitelyTyped |
+| @types/d3-array@3.2.2 | MIT | https://github.com/DefinitelyTyped/DefinitelyTyped |
+| @types/d3-axis@3.0.6 | MIT | https://github.com/DefinitelyTyped/DefinitelyTyped |
+| @types/d3-brush@3.0.6 | MIT | https://github.com/DefinitelyTyped/DefinitelyTyped |
+| @types/d3-chord@3.0.6 | MIT | https://github.com/DefinitelyTyped/DefinitelyTyped |
+| @types/d3-color@3.1.3 | MIT | https://github.com/DefinitelyTyped/DefinitelyTyped |
+| @types/d3-contour@3.0.6 | MIT | https://github.com/DefinitelyTyped/DefinitelyTyped |
+| @types/d3-delaunay@6.0.4 | MIT | https://github.com/DefinitelyTyped/DefinitelyTyped |
+| @types/d3-dispatch@3.0.7 | MIT | https://github.com/DefinitelyTyped/DefinitelyTyped |
+| @types/d3-drag@3.0.7 | MIT | https://github.com/DefinitelyTyped/DefinitelyTyped |
+| @types/d3-dsv@3.0.7 | MIT | https://github.com/DefinitelyTyped/DefinitelyTyped |
+| @types/d3-ease@3.0.2 | MIT | https://github.com/DefinitelyTyped/DefinitelyTyped |
+| @types/d3-fetch@3.0.7 | MIT | https://github.com/DefinitelyTyped/DefinitelyTyped |
+| @types/d3-force@3.0.10 | MIT | https://github.com/DefinitelyTyped/DefinitelyTyped |
+| @types/d3-format@3.0.4 | MIT | https://github.com/DefinitelyTyped/DefinitelyTyped |
+| @types/d3-geo@3.1.0 | MIT | https://github.com/DefinitelyTyped/DefinitelyTyped |
+| @types/d3-hierarchy@3.1.7 | MIT | https://github.com/DefinitelyTyped/DefinitelyTyped |
+| @types/d3-interpolate@3.0.4 | MIT | https://github.com/DefinitelyTyped/DefinitelyTyped |
+| @types/d3-path@3.1.1 | MIT | https://github.com/DefinitelyTyped/DefinitelyTyped |
+| @types/d3-polygon@3.0.2 | MIT | https://github.com/DefinitelyTyped/DefinitelyTyped |
+| @types/d3-quadtree@3.0.6 | MIT | https://github.com/DefinitelyTyped/DefinitelyTyped |
+| @types/d3-random@3.0.4 | MIT | https://github.com/DefinitelyTyped/DefinitelyTyped |
+| @types/d3-scale@4.0.9 | MIT | https://github.com/DefinitelyTyped/DefinitelyTyped |
+| @types/d3-scale-chromatic@3.1.0 | MIT | https://github.com/DefinitelyTyped/DefinitelyTyped |
+| @types/d3-selection@3.0.11 | MIT | https://github.com/DefinitelyTyped/DefinitelyTyped |
+| @types/d3-shape@3.1.8 | MIT | https://github.com/DefinitelyTyped/DefinitelyTyped |
+| @types/d3-time@3.0.4 | MIT | https://github.com/DefinitelyTyped/DefinitelyTyped |
+| @types/d3-time-format@4.0.3 | MIT | https://github.com/DefinitelyTyped/DefinitelyTyped |
+| @types/d3-timer@3.0.2 | MIT | https://github.com/DefinitelyTyped/DefinitelyTyped |
+| @types/d3-transition@3.0.9 | MIT | https://github.com/DefinitelyTyped/DefinitelyTyped |
+| @types/d3-zoom@3.0.8 | MIT | https://github.com/DefinitelyTyped/DefinitelyTyped |
+| @types/geojson@7946.0.16 | MIT | https://github.com/DefinitelyTyped/DefinitelyTyped |
+| @types/react@19.2.17 | MIT | https://github.com/DefinitelyTyped/DefinitelyTyped |
+| @types/react-dom@19.2.3 | MIT | https://github.com/DefinitelyTyped/DefinitelyTyped |
+| @types/trusted-types@2.0.7 | MIT | https://github.com/DefinitelyTyped/DefinitelyTyped |
+| @upsetjs/venn.js@2.0.0 | MIT | https://github.com/upsetjs/venn.js |
+| @xyflow/react@12.11.2 | MIT | https://github.com/xyflow/xyflow |
+| @xyflow/system@0.0.79 | MIT | https://github.com/xyflow/xyflow |
+| accepts@2.0.0 | MIT | jshttp/accepts |
+| ajv@8.20.0 | MIT | ajv-validator/ajv |
+| ajv-formats@3.0.1 | MIT | https://github.com/ajv-validator/ajv-formats |
+| body-parser@2.3.0 | MIT | expressjs/body-parser |
+| bytes@3.1.2 | MIT | visionmedia/bytes.js |
+| call-bind-apply-helpers@1.0.2 | MIT | https://github.com/ljharb/call-bind-apply-helpers |
+| call-bound@1.0.4 | MIT | https://github.com/ljharb/call-bound |
+| classcat@5.0.5 | MIT | jorgebucaran/classcat |
+| codemirror@6.0.2 | MIT | https://github.com/codemirror/basic-setup |
+| codemirror-lang-mermaid@0.5.0 | MIT | https://github.com/inspirnathan/codemirror-lang-mermaid |
+| commander@7.2.0 | MIT | https://github.com/tj/commander.js |
+| commander@8.3.0 | MIT | https://github.com/tj/commander.js |
+| content-disposition@1.1.0 | MIT | jshttp/content-disposition |
+| content-type@1.0.5 | MIT | jshttp/content-type |
+| content-type@2.0.0 | MIT | jshttp/content-type |
+| content-type@2.0.0 | MIT | jshttp/content-type |
+| cookie@0.7.2 | MIT | jshttp/cookie |
+| cookie-signature@1.2.2 | MIT | https://github.com/visionmedia/node-cookie-signature |
+| cors@2.8.6 | MIT | expressjs/cors |
+| cose-base@1.0.3 | MIT | https://github.com/iVis-at-Bilkent/cose-base |
+| cose-base@2.2.0 | MIT | https://github.com/iVis-at-Bilkent/cose-base |
+| crelt@1.0.7 | MIT | https://code.haverbeke.berlin/marijn/crelt |
+| cross-spawn@7.0.6 | MIT | git@github.com:moxystudio/node-cross-spawn |
+| csstype@3.2.3 | MIT | https://github.com/frenic/csstype |
+| cytoscape@3.34.0 | MIT | https://github.com/cytoscape/cytoscape.js |
+| cytoscape-cose-bilkent@4.1.0 | MIT | https://github.com/cytoscape/cytoscape.js-cose-bilkent |
+| cytoscape-fcose@2.2.0 | MIT | https://github.com/iVis-at-Bilkent/cytoscape.js-fcose |
+| d3@7.9.0 | ISC | https://github.com/d3/d3 |
+| d3-array@2.12.1 | BSD-3-Clause | https://github.com/d3/d3-array |
+| d3-array@3.2.4 | ISC | https://github.com/d3/d3-array |
+| d3-axis@3.0.0 | ISC | https://github.com/d3/d3-axis |
+| d3-brush@3.0.0 | ISC | https://github.com/d3/d3-brush |
+| d3-chord@3.0.1 | ISC | https://github.com/d3/d3-chord |
+| d3-color@3.1.0 | ISC | https://github.com/d3/d3-color |
+| d3-contour@4.0.2 | ISC | https://github.com/d3/d3-contour |
+| d3-delaunay@6.0.4 | ISC | https://github.com/d3/d3-delaunay |
+| d3-dispatch@3.0.1 | ISC | https://github.com/d3/d3-dispatch |
+| d3-drag@3.0.0 | ISC | https://github.com/d3/d3-drag |
+| d3-dsv@3.0.1 | ISC | https://github.com/d3/d3-dsv |
+| d3-ease@3.0.1 | BSD-3-Clause | https://github.com/d3/d3-ease |
+| d3-fetch@3.0.1 | ISC | https://github.com/d3/d3-fetch |
+| d3-force@3.0.0 | ISC | https://github.com/d3/d3-force |
+| d3-format@3.1.2 | ISC | https://github.com/d3/d3-format |
+| d3-geo@3.1.1 | ISC | https://github.com/d3/d3-geo |
+| d3-hierarchy@3.1.2 | ISC | https://github.com/d3/d3-hierarchy |
+| d3-interpolate@3.0.1 | ISC | https://github.com/d3/d3-interpolate |
+| d3-path@1.0.9 | BSD-3-Clause | https://github.com/d3/d3-path |
+| d3-path@3.1.0 | ISC | https://github.com/d3/d3-path |
+| d3-polygon@3.0.1 | ISC | https://github.com/d3/d3-polygon |
+| d3-quadtree@3.0.1 | ISC | https://github.com/d3/d3-quadtree |
+| d3-random@3.0.1 | ISC | https://github.com/d3/d3-random |
+| d3-sankey@0.12.3 | BSD-3-Clause | https://github.com/d3/d3-sankey |
+| d3-scale@4.0.2 | ISC | https://github.com/d3/d3-scale |
+| d3-scale-chromatic@3.1.0 | ISC | https://github.com/d3/d3-scale-chromatic |
+| d3-selection@3.0.0 | ISC | https://github.com/d3/d3-selection |
+| d3-shape@1.3.7 | BSD-3-Clause | https://github.com/d3/d3-shape |
+| d3-shape@3.2.0 | ISC | https://github.com/d3/d3-shape |
+| d3-time@3.1.0 | ISC | https://github.com/d3/d3-time |
+| d3-time-format@4.1.0 | ISC | https://github.com/d3/d3-time-format |
+| d3-timer@3.0.1 | ISC | https://github.com/d3/d3-timer |
+| d3-transition@3.0.1 | ISC | https://github.com/d3/d3-transition |
+| d3-zoom@3.0.0 | ISC | https://github.com/d3/d3-zoom |
+| dagre-d3-es@7.0.14 | MIT | https://github.com/tbo47/dagre-es |
+| dayjs@1.11.21 | MIT | https://github.com/iamkun/dayjs |
+| debug@4.4.3 | MIT | git://github.com/debug-js/debug |
+| delaunator@5.1.0 | ISC | https://github.com/mapbox/delaunator |
+| depd@2.0.0 | MIT | dougwilson/nodejs-depd |
+| dompurify@3.4.12 | (MPL-2.0 OR Apache-2.0) | git://github.com/cure53/DOMPurify |
+| dunder-proto@1.0.1 | MIT | https://github.com/es-shims/dunder-proto |
+| ee-first@1.1.1 | MIT | jonathanong/ee-first |
+| elkjs@0.12.0 | EPL-2.0 OR GPL-3.0-or-later | https://github.com/kieler/elkjs |
+| encodeurl@2.0.0 | MIT | pillarjs/encodeurl |
+| es-define-property@1.0.1 | MIT | https://github.com/ljharb/es-define-property |
+| es-errors@1.3.0 | MIT | https://github.com/ljharb/es-errors |
+| es-object-atoms@1.1.2 | MIT | https://github.com/ljharb/es-object-atoms |
+| es-toolkit@1.49.0 | MIT | https://github.com/toss/es-toolkit |
+| esbuild@0.28.1 | MIT | https://github.com/evanw/esbuild |
+| escape-html@1.0.3 | MIT | component/escape-html |
+| etag@1.8.1 | MIT | jshttp/etag |
+| eventsource@3.0.7 | MIT | git://git@github.com/EventSource/eventsource |
+| eventsource-parser@3.1.0 | MIT | ssh://git@github.com/rexxars/eventsource-parser |
+| express@5.2.1 | MIT | expressjs/express |
+| express-rate-limit@8.6.0 | MIT | https://github.com/express-rate-limit/express-rate-limit |
+| fast-deep-equal@3.1.3 | MIT | https://github.com/epoberezkin/fast-deep-equal |
+| fast-uri@3.1.5 | BSD-3-Clause | https://github.com/fastify/fast-uri |
+| finalhandler@2.1.1 | MIT | pillarjs/finalhandler |
+| forwarded@0.2.0 | MIT | jshttp/forwarded |
+| fresh@2.0.0 | MIT | jshttp/fresh |
+| fsevents@2.3.3 | MIT |  |
+| function-bind@1.1.2 | MIT | https://github.com/Raynos/function-bind |
+| get-intrinsic@1.3.0 | MIT | https://github.com/ljharb/get-intrinsic |
+| get-proto@1.0.1 | MIT | https://github.com/ljharb/get-proto |
+| gopd@1.2.0 | MIT | https://github.com/ljharb/gopd |
+| hachure-fill@0.5.2 | MIT | https://github.com/pshihn/hachure-fill |
+| has-symbols@1.1.0 | MIT | git://github.com/inspect-js/has-symbols |
+| hasown@2.0.4 | MIT | https://github.com/inspect-js/hasOwn |
+| hono@4.12.30 | MIT | https://github.com/honojs/hono |
+| html-to-image@1.11.13 | MIT | https://github.com/bubkoo/html-to-image |
+| http-errors@2.0.1 | MIT | jshttp/http-errors |
+| iconv-lite@0.6.3 | MIT | git://github.com/ashtuchkin/iconv-lite |
+| iconv-lite@0.7.3 | MIT | git://github.com/ashtuchkin/iconv-lite |
+| iconv-lite@0.7.3 | MIT | git://github.com/ashtuchkin/iconv-lite |
+| import-meta-resolve@4.2.0 | MIT | wooorm/import-meta-resolve |
+| inherits@2.0.4 | ISC | git://github.com/isaacs/inherits |
+| internmap@1.0.1 | ISC | https://github.com/mbostock/internmap |
+| internmap@2.0.3 | ISC | https://github.com/mbostock/internmap |
+| ip-address@10.2.0 | MIT | git://github.com/beaugunderson/ip-address |
+| ipaddr.js@1.9.1 | MIT | git://github.com/whitequark/ipaddr.js |
+| is-promise@4.0.0 | MIT | https://github.com/then/is-promise |
+| isexe@2.0.0 | ISC | https://github.com/isaacs/isexe |
+| jose@6.2.3 | MIT | panva/jose |
+| json-schema-traverse@1.0.0 | MIT | https://github.com/epoberezkin/json-schema-traverse |
+| json-schema-typed@8.0.2 | BSD-2-Clause | https://github.com/RemyRylan/json-schema-typed |
+| katex@0.16.47 | MIT | https://github.com/KaTeX/KaTeX |
+| khroma@2.1.0 | MIT | github:fabiospampinato/khroma |
+| layout-base@1.0.2 | MIT | https://github.com/iVis-at-Bilkent/layout-base |
+| layout-base@2.0.1 | MIT | https://github.com/iVis-at-Bilkent/layout-base |
+| lodash-es@4.18.1 | MIT | lodash/lodash |
+| marked@16.4.2 | MIT | git://github.com/markedjs/marked |
+| math-intrinsics@1.1.0 | MIT | https://github.com/es-shims/math-intrinsics |
+| media-typer@1.1.0 | MIT | jshttp/media-typer |
+| merge-descriptors@2.0.0 | MIT | sindresorhus/merge-descriptors |
+| mermaid@11.16.0 | MIT | https://github.com/mermaid-js/mermaid |
+| mime-db@1.54.0 | MIT | jshttp/mime-db |
+| mime-types@3.0.2 | MIT | jshttp/mime-types |
+| ms@2.1.3 | MIT | vercel/ms |
+| negotiator@1.0.0 | MIT | jshttp/negotiator |
+| object-assign@4.1.1 | MIT | sindresorhus/object-assign |
+| object-inspect@1.13.4 | MIT | git://github.com/inspect-js/object-inspect |
+| on-finished@2.4.1 | MIT | jshttp/on-finished |
+| once@1.4.0 | ISC | git://github.com/isaacs/once |
+| package-manager-detector@1.7.0 | MIT | https://github.com/antfu-collective/package-manager-detector |
+| parseurl@1.3.3 | MIT | pillarjs/parseurl |
+| path-data-parser@0.1.0 | MIT | https://github.com/pshihn/path-data-parser |
+| path-key@3.1.1 | MIT | sindresorhus/path-key |
+| path-to-regexp@8.4.2 | MIT | https://github.com/pillarjs/path-to-regexp |
+| pkce-challenge@5.0.1 | MIT | https://github.com/crouchcd/pkce-challenge |
+| points-on-curve@0.2.0 | MIT | https://github.com/pshihn/bezier-points |
+| points-on-path@0.2.1 | MIT | https://github.com/pshihn/points-on-path |
+| proxy-addr@2.0.7 | MIT | jshttp/proxy-addr |
+| qs@6.15.3 | BSD-3-Clause | https://github.com/ljharb/qs |
+| range-parser@1.3.0 | MIT | jshttp/range-parser |
+| raw-body@3.0.2 | MIT | stream-utils/raw-body |
+| react@19.2.8 | MIT | https://github.com/react/react |
+| react-dom@19.2.8 | MIT | https://github.com/react/react |
+| require-from-string@2.0.2 | MIT | floatdrop/require-from-string |
+| robust-predicates@3.0.3 | Unlicense | https://github.com/mourner/robust-predicates |
+| roughjs@4.6.6 | MIT | https://github.com/pshihn/rough |
+| router@2.2.0 | MIT | pillarjs/router |
+| rw@1.3.3 | BSD-3-Clause | http://github.com/mbostock/rw |
+| safer-buffer@2.1.2 | MIT | https://github.com/ChALkeR/safer-buffer |
+| scheduler@0.27.0 | MIT | https://github.com/facebook/react |
+| send@1.2.1 | MIT | pillarjs/send |
+| serve-static@2.2.1 | MIT | expressjs/serve-static |
+| setprototypeof@1.2.0 | ISC | https://github.com/wesleytodd/setprototypeof |
+| shebang-command@2.0.0 | MIT | kevva/shebang-command |
+| shebang-regex@3.0.0 | MIT | sindresorhus/shebang-regex |
+| side-channel@1.1.1 | MIT | https://github.com/ljharb/side-channel |
+| side-channel-list@1.0.1 | MIT | https://github.com/ljharb/side-channel-list |
+| side-channel-map@1.0.1 | MIT | https://github.com/ljharb/side-channel-map |
+| side-channel-weakmap@1.0.2 | MIT | https://github.com/ljharb/side-channel-weakmap |
+| statuses@2.0.2 | MIT | jshttp/statuses |
+| style-mod@4.1.3 | MIT | https://github.com/marijnh/style-mod |
+| stylis@4.4.0 | MIT | https://github.com/thysultan/stylis.js |
+| tinyexec@1.2.4 | MIT | https://github.com/tinylibs/tinyexec |
+| toidentifier@1.0.1 | MIT | component/toidentifier |
+| ts-dedent@2.3.0 | MIT | https://github.com/tamino-martinius/node-ts-dedent |
+| tsx@4.23.1 | MIT | privatenumber/tsx |
+| type-is@2.1.0 | MIT | jshttp/type-is |
+| unpipe@1.0.0 | MIT | stream-utils/unpipe |
+| use-sync-external-store@1.6.0 | MIT | https://github.com/facebook/react |
+| uuid@14.0.1 | MIT | https://github.com/uuidjs/uuid |
+| vary@1.1.2 | MIT | jshttp/vary |
+| w3c-keyname@2.2.8 | MIT | https://github.com/marijnh/w3c-keyname |
+| which@2.0.2 | ISC | git://github.com/isaacs/node-which |
+| wrappy@1.0.2 | ISC | https://github.com/npm/wrappy |
+| zod@4.4.3 | MIT | https://github.com/colinhacks/zod |
+| zod-to-json-schema@3.25.2 | ISC | https://github.com/StefanTerdell/zod-to-json-schema |
+| zustand@4.5.7 | MIT | https://github.com/pmndrs/zustand |
+| zustand@5.0.14 | MIT | https://github.com/pmndrs/zustand |
+
+<!-- notices:table:end -->
+
+## Notes
+
+- **elkjs** is declared as `EPL-2.0 OR GPL-3.0-or-later`. That is the Eclipse
+  Public License 2.0 together with its standard Exhibit A notice, which makes
+  GPL-3.0-or-later _additionally_ available to a recipient who wants it — a
+  choice offered, not an obligation imposed. **Archyne relies on the EPL-2.0
+  arm**, unchanged from earlier versions: elkjs is used unmodified, as a
+  library, with no elkjs code copied into Archyne's own sources. The EPL's
+  copyleft reaches modifications to the library itself, which Archyne makes
+  none of, so this places no condition on Archyne's MIT distribution. Source
+  is available at <https://github.com/kieler/elkjs>.
+- Icon collections (**logos**, **simple-icons**: CC0-1.0; **devicon**,
+  **tabler**: MIT; **carbon**: Apache-2.0) are openly licensed. The vendor
+  logos they depict remain trademarks of their respective owners and are
+  shown nominatively.