v2.3.0 — diagram-core 1.6.0

• Icon catalogs and resolver in the core (diagram-core 1.6.0):
  SERVICE_ICONS, SHAPE_ICONS, iconForService, iconForShape,
  withServiceIcon, iconFilterKind. lib/service-icons.json and
  lib/shape-icons.json move into the core as data; the MCP keeps only the
  fuzzy layer over the icon files on disk. LiveDiagram, SequencePlayer and
  FlowPlayer fill a missing icon from service, so a host no longer has to.
• Document schemas in the core: diagramSchema/validateDiagram
  (architecture) and sequenceDocSchema/validateSequence (UML sequence) —
  JSON Schema + dependency-free validators with referential integrity. A new
  test keeps them in step with the MCP's zod tool schemas; it found and fixed
  two gaps: the MCP now accepts fragments[].tone (the player already drew it),
  and the core schema accepts { en, pt } text where the MCP does.
• Canvas theme in the core: DIAGRAM_THEME + diagramThemeCss() /
  diagramBaseCss() — the light/dark tokens of LiveDiagram (the MCP's HTML
  and the slides host each kept their own copy).
• Fix: Icon no longer inverts colored Res_* glyphs in dark mode (only
  the navy ones without a *_Dark sibling, MONO_INVERT_RES); it also swaps
  pathed diagram icons and host-listed logos (brandDarkVariants) and takes
  named sizes (sizes) — the slides deck's Icon is now a wrapper around it.
• Accessible descriptions: describeArchitecture / describeSequence
  (en/pt/es, i18n text); LiveDiagram and SequencePlayer render as a figure
  described by a visually hidden summary (describe={false} to opt out).
• One inline mini-markdown grammar: parseInline / inlineHtml /
  safeHref (** / __ bold, * / _ italic at word boundaries,
  `code`, links through safeHref, linear on hostile input). The card
  text, the flow player and the slides deck's RichText and blog text all parse
  with it; each keeps its own styling.

Also in this release (2.2.2)

• Fix: the installed MCP starts. Run through npx or from a release
  tarball, the server crashed with ERR_MODULE_NOT_FOUND for
  @aws-sample-live-diagram/core (only present in a clone's workspace). The
  runtime now imports the core's sources by path, ships them all in files,
  and dagre (pulled by the shared layout engine) moved to dependencies. A
  test walks the runtime's imports so this cannot regress.
• Fix — serverInfo.version is read from package.json (it said 2.1.0);
  the plugin and marketplace manifests were still at 2.1.3. A test keeps them
  in sync with the package.

2.2.1

• One sequence layout. diagram-core 1.5.0 exports layoutSequence (pure):
  the React SequencePlayer and the self-contained sequence HTML player both
  lay out from it (the generator inlines it, as it already does for the flow
  layout). Output is unchanged — the SVG is identical element for element.
• Examples — the account-vend sequence example and two code comments no
  longer name a customer environment.

2.2.0

• Typed diagrams in the core and in the MCP's HTML. The 15 typed diagram
  kinds (ER, Gantt, swimlane, tree, timeline, Kanban, journey, quadrant, Venn,
  layers, fishbone, Wardley, flywheel, UML class, and the new decision
  workflow) move into diagram-core 1.4.0: specs, validator and registry in
  ./typed (pure, also exportable as JSON contracts for a server-side
  validator) and the SVG views in ./typed-react. A multi-tab document gains
  kind: "typed" tabs (diagram: { kind, … }), validated with the same specs
  before rendering.
• Fix — the sequence player sets its own text color (it inherited the
  host's, unreadable on a light card inside a dark page); flow and sequence
  players keep a .light / .force-light island light inside a dark page.

2.1.4

• diagram-core 1.3.0 — the players move into the core. FlowPlayer
  (workflow / data-flow / lifecycle) and SequencePlayer (UML sequence) are now
  core React components, alongside LiveDiagram. The MCP's sequence tab renders
  with SequencePlayer; apps (e.g. a slides deck) import both directly, so a
  flow or sequence reads exactly as in the MCP's HTML.
• One layout, one palette. The flow layout (layoutFlow), the player
  palette (PLAYER_TONES, DIAGRAM_TONES) and light/dark tokens
  (PLAYER_THEME, playerThemeCss) live in the core; the self-contained flow
  and sequence HTML players inline them instead of carrying copies. Edge labels
  sit at the arc-length midpoint in both renderers. Also new: AWS_ORANGE,
  STATUS_COLORS, and the UI chrome strings (UI_STRINGS, makeUi).
• Build — one file per core entry (no hashed chunks); the pure vocabulary
  is bundled once, in dist/index.js. packages/diagram-core/dist/ is no longer
  committed: npm test and build:standalone build it first, and the release
  workflow builds it before npm pack.
• Fix — the dagre fallback layout emitted nested groups innermost-first,
  so an outer container was drawn over its inner ones.
• Types — optional component props are typed optional; npm run typecheck
  runs in CI.
• Cleanup — removed the pre-core copies under src/components/ and
  src/lib/ (codegen, codeview, drawio/PNG export, compound layout, tone/group
  shims) and the tests that only exercised them; the group and membership tests
  now run against the core.

2.1.3

• The shared render package is renamed @aws-live-diagram/core →
  @aws-sample-live-diagram/core (same entry points: ., ./react,
  ./layout-engine).
• diagram-core 1.2.0 is attached to each GitHub Release as an npm tarball
  (aws-sample-live-diagram-core-<version>.tgz + .sha256), so apps can depend on a
  pinned release URL instead of vendoring dist/.
• diagram-core: stepLayout: "below" stacks the walkthrough card under the
  canvas. The attached and below layouts keep step zoom and refit whenever
  the canvas box changes, so the focused nodes are no longer clipped behind
  the card track.

Install the render package from this release:

npm install https://github.com/aws-samples/sample-architecture-diagram-mcp-server/releases/download/v2.1.3/aws-sample-live-diagram-core-1.2.0.tgz

2.1.2

• Security — dependency advisories cleared: @modelcontextprotocol/sdk
  1.32.2, zod 4 (memory exhaustion on oversized collections), hono,
  proxy-addr, body-parser, qs, fast-uri, ip-address, vite,
  source-map-js and vitest. npm audit reports 0 vulnerabilities. The tool
  schemas move to the two-argument z.record(key, value) form that zod 4 requires.
• Fix — setup_icons / scripts/fetch-icons.sh find the renamed AWS icon
  package (Icon-package_<date>.zip), gain --latest to download it, and refresh
  a stale shared icon cache.
• Hardening — the bullet lead split (Lead — detail), the caption stat split
  (Label: value) and the inline-markdown link pattern no longer backtrack
  quadratically on long author text (CodeQL js/polynomial-redos); icon src
  values are escaped in the flow and sequence players and limited to inlined
  data:image/ or same-origin paths in the React renderer (js/xss-through-dom).

2.1.1

• The doc tab gets a document layout and the walkthrough a sidebar.
• Long names and pills read in full; the author can pick the pill side.
• Fix — the icon for Users and the other external actors resolves.