59 lines
2.7 KiB
Markdown
59 lines
2.7 KiB
Markdown
# Third-party vendored crates
|
||
|
||
This directory holds **upstream source** vendored into the repository. It is
|
||
**not** first-party application code.
|
||
|
||
## Why vendor
|
||
|
||
These crates sit on the path that renders **untrusted model output** (diagram
|
||
source → SVG). Vendoring gives a full audit surface, pins exact source, and
|
||
avoids crates.io yanks. Local patches and upgrade checklists live in each
|
||
crate’s `Cargo.toml` header comments — treat those as the source of truth when
|
||
re-vendoring.
|
||
|
||
## Mermaid layout stack
|
||
|
||
| Crate | Version | License | Upstream | Full license text |
|
||
|-------|---------|---------|----------|-------------------|
|
||
| [`mermaid-to-svg`](./mermaid-to-svg/) | (path) | MIT | [warpdotdev/mermaid-to-svg](https://github.com/warpdotdev/mermaid-to-svg) | [`LICENSE`](./mermaid-to-svg/LICENSE) |
|
||
| [`dagre_rust`](./dagre_rust/) | 0.0.5 | Apache-2.0 | [r3alst/dagre-rust](https://github.com/r3alst/dagre-rust) / Warp re-vendor | [`LICENCE`](./dagre_rust/LICENCE) |
|
||
| [`graphlib_rust`](./graphlib_rust/) | 0.0.2 | Apache-2.0 | [r3alst/graphlib-rust](https://github.com/r3alst/graphlib-rust) | [`LICENCE`](./graphlib_rust/LICENCE) |
|
||
| [`ordered_hashmap`](./ordered_hashmap/) | 0.0.3 | Apache-2.0 | [r3alst/ordered-hashmap](https://github.com/r3alst/ordered-hashmap) | [`LICENCE`](./ordered_hashmap/LICENCE) |
|
||
|
||
Dependency shape:
|
||
|
||
```text
|
||
xai-grok-mermaid
|
||
└── mermaid-to-svg (MIT)
|
||
├── dagre_rust (Apache-2.0)
|
||
│ ├── graphlib_rust
|
||
│ └── ordered_hashmap
|
||
└── graphlib_rust (Apache-2.0)
|
||
└── ordered_hashmap
|
||
```
|
||
|
||
## Notices and ancestry
|
||
|
||
- **[`NOTICE`](./NOTICE)** — short index of the crates above (names, licenses,
|
||
upstream links, paths to full text). Prefer that file for a one-page overview.
|
||
- **[`mermaid-to-svg/THIRD_PARTY_NOTICES`](./mermaid-to-svg/THIRD_PARTY_NOTICES)** —
|
||
additional ancestry for the SVG engine (e.g. mermaid.js, dagre.js MIT notices).
|
||
|
||
British spelling **`LICENCE`** is intentional on the Apache crates (as upstream
|
||
vendored); grepping only for `LICENSE` will miss them.
|
||
|
||
## crates.io dependencies
|
||
|
||
Normal Cargo dependencies (tokio, serde, …) are **not** under `third_party/`.
|
||
They resolve via `Cargo.lock` / crates.io. Full attribution and license texts
|
||
for the Grok CLI dependency closure are maintained in
|
||
[`THIRD-PARTY-NOTICES`](../THIRD-PARTY-NOTICES).
|
||
|
||
This directory is only for **in-tree vendored** sources.
|
||
|
||
## Upgrading
|
||
|
||
1. Read the `VENDORING NOTES` block at the top of the crate’s `Cargo.toml`.
|
||
2. Re-apply listed local patches (fmt, hermetic env, unsafe fixes, dropped bins/tests).
|
||
3. Confirm the license file still matches the declared `license =` field.
|
||
4. Refresh [`NOTICE`](./NOTICE) if versions or upstream URLs change.
|