# Essential Tools 1.0.0 source kit

This kit contains three working browser tools, their shared validation/calculations, local CLI, schemas, fictional examples and tests. It deliberately excludes the private Essential Designs website and corporate assets. The local demo is a minimal test host, not a reproduction of the company website.

Verified with **Node.js 24.19.0 LTS and npm 10.9.0**. Install the locked dependencies, build, and install the pinned local browser:

```sh
npm ci
npm run build
npm run browsers
npm test
npm run preview
```

The local demo opens at `http://127.0.0.1:4390`. `npm run dev` runs the same host with source updates. PDF rendering uses the included openly licensed Noto Sans font. The corporate Poppins fonts, logos and site frame are not included. The tools work in memory by default; browser saving requires opt-in. The CLI has no telemetry.

`npm test` includes independent calculation/security fixtures, real PDF/diagram rendering, Day/Week/Month chart geometry and all documented CLI commands. Conditional corporate-route browser regressions are skipped in this standalone kit; they require the separate integrated website and are not needed to run the local tools. Representative files produced by this release are included in `examples/outputs/`.

## CLI

```sh
node dist/cli.mjs --help
node dist/cli.mjs capabilities
node dist/cli.mjs validate document --input examples/document-quotation.json
node dist/cli.mjs validate plan --input examples/plan-customer-portal.json
node dist/cli.mjs validate process --input examples/process-onboarding.json
node dist/cli.mjs document pdf --input examples/document-quotation.json --output quote.pdf
node dist/cli.mjs plan calculate --input examples/plan-customer-portal.json
node dist/cli.mjs plan export --input examples/plan-customer-portal.json --format csv --output tasks.csv
node dist/cli.mjs plan export --input examples/plan-customer-portal.json --format json --output plan.json
node dist/cli.mjs plan export --input examples/plan-customer-portal.json --format pdf --output plan.pdf
node dist/cli.mjs process render --input examples/process-onboarding.json --format mermaid --output process.mmd
node dist/cli.mjs process render --input examples/process-onboarding.json --format json --output process.json
node dist/cli.mjs process render --input examples/process-onboarding.json --format svg --output process.svg
node dist/cli.mjs process render --input examples/process-onboarding.json --format png --output process.png
node dist/cli.mjs process render --input examples/process-onboarding.json --format pdf --output process.pdf
```

`--input -` accepts UTF-8 JSON on stdin. The outer limit is 3 MB; each model has stricter field/array/complexity limits. Output paths are explicit. Existing outputs are refused unless `--force` is supplied; the input file is never overwritten. Structured success/calculation output goes to stdout, structured errors to stderr. Exit codes are 0 (success), 2 (invalid input/usage) and 1 (runtime/export failure). Source-render errors preserve the input and do not report an output as complete.

Process SVG/PNG/PDF uses the same safe Mermaid adapter as the browser, in a local Playwright Chromium. A server binds to an ephemeral **127.0.0.1** port for that operation, serves only the bundled renderer/font, blocks external requests, and closes afterwards. Browser engines are downloaded by the explicit install command; rendering does not use external services. Mermaid/JSON exports and structural validation do not require Chromium. There is no hosted API or MCP server.

## Models, assumptions and limits

See `schemas/` and `examples/`. JSON Schema describes the versioned shape; the shared validators additionally check arithmetic constraints, real dates, dependencies and supported Mermaid syntax. Future versions and unexpected executable settings are rejected.

Document prices use decimal half-up line rounding, a fixed discount and up to two independent user-specified taxes. Currency labels do not convert amounts. Hidden pricing removes monetary fields. PDF text supports English and French; unsupported glyphs produce an error, with JSON retained. PNG/JPEG logos are bounded; no remote logo fetching is provided.

Plans contain up to 100 tasks. Both dates are inclusive; working days mean Monday–Friday without statutory holidays. Hours are independent of duration. Finish-to-start conflicts are warnings, cycles are rejected, and dependent tasks never move automatically. Sample hours and rates are illustrative, not Essential Designs prices. Long PDF timelines use numbered landscape pages with a common date scale.

Processes allow up to 100 nodes and 200 edges. Guided graphs and a documented restricted Mermaid flowchart/sequence source grammar are supported; remote images, links, HTML labels, directives and arbitrary styles are rejected. Returning from source mode uses the preserved guided graph, not a claimed arbitrary parser. SVG is sanitized and embeds its font.

## Reuse and review

The new code is MIT; see `LICENSE`. Third-party inventory, licence texts and patches are under `notices/`. Noto Sans is OFL-1.1 and its unchanged licence accompanies the font. Engines are pdfme 6.1.12, Frappe Gantt 1.2.2 and Mermaid 11.17.2. This is built on those engines; it is not a fork of Mermaid Live Editor. No upstream source patches are required. Frappe is isolated in a sandboxed iframe to dispose its document-level listener; labels are escaped and dependent movement/popups are disabled.

Dependency licences include MIT, Apache-2.0 and others listed in the inventory. The Brotli decoder includes Google Apache-2.0 code, and pdfme embeds an unchanged Apache-2.0 Roboto font in its library bundle; their original notices and full licence texts are included. Where a package published only an MIT declaration, its original README and authorship metadata are retained alongside the standard licence text, with that limitation documented in the provenance. Optional platform packages in the lockfile remain visible even when they were not installed on the review machine.

See `RELEASE.json`, `SOURCE_FILES.sha256` and `CHANGELOG.md` for exact release provenance. The outer ZIP checksum is published beside the downloadable ZIP (a ZIP cannot contain its own checksum). Automated tests and dependency inspection do not constitute an independent security audit. Report issues through the existing Essential Designs contact page, sharing only information you choose to disclose.
