SVGnest upstream record
=======================

Project: Jack000/SVGnest on GitHub
Repository: github.com/Jack000/SVGnest
Vendored commit: 1248dc21efd3f90d1aa52ba5785e27e5217ed2c9
Upstream branch at verification: master
License: MIT, Copyright 2015 Jack Qiao
Upstream license SHA-256: 63249e67e62c3c4142252688c170ab27fa401f55a96f12b54cd6187ba2f699af

The complete upstream license is preserved in LICENSE.txt.

Vendored runtime
----------------

Only the browser nesting engine and its required geometry dependencies were retained:

- svgnest.js
- svgparser.js
- util/pathsegpolyfill.js
- util/matrix.js
- util/clipper.js
- util/geometryutil.js
- util/placementworker.js

The interface, static worker adapter, and fixed worker pool were independently rebuilt for this site. The upstream fonts, images, demo payload, outbound links, Node support, dynamic callback worker, eval worker, JSON fallback, DOMParser fallback, and FileSaver fallback were not vendored.

Local adaptations
-----------------

The engine remains attributable to the verified upstream commit, with focused,
reviewable local changes for this static emergency build:

- svgparser.js removes active or externally loading SVG content before the
  document can be attached to the page. It accepts only inert geometry and
  presentation attributes in the SVG namespace, rejects declarations/entities
  and roots without the SVG namespace, validates finite bounded coordinates,
  and sanitizes every generated preview and download SVG again.
- svgparser.js and svgnest.js enforce encoded-document-independent budgets for
  source elements, geometry characters and numeric values, contours, parts,
  polygon points, per-contour points, and coordinate magnitude.
- util/geometryutil.js retains the upstream behavior for existing callers and
  adds one optional maximum-point argument to quadratic, cubic, and arc
  linearizers. The local parser supplies that argument so adaptive subdivision
  fails before its work arrays can exceed the per-contour budget.
- svgnest.js exposes read-only geometry statistics, propagates fixed-worker
  failures to the interface, validates derived, no-fit-polygon, and placement
  results, bounds pair and vertex-pair work, invalidates stale asynchronous
  work, calculates placed-part area with nested holes subtracted, and provides
  distinct run-reset and full-document-reset cleanup paths. Stop releases the
  current genetic population, polygon tree, bounds, and no-fit-polygon cache
  while leaving the application's already-rendered result DOM available.
- util/placementworker.js omits an unused, potentially large intermediate
  no-fit-polygon union from its data-only result. The placement result consumed
  by svgnest.js contains only placements, fitness, unplaced paths, and area.
- util/parallel.js and util/nesting-worker.js replace upstream callback
  serialization and dynamic evaluation with a fixed same-origin worker and a
  closed data-only protocol that accepts only the "nfp" and "place" tasks.
- index.html, svgnest.css, and app.js are a fresh Laser Everything interface;
  they are not upstream or legacy application code.