Full: add secure lazy Mermaid rendering with pan and zoom

[trsdn]

Goal

Add complete offline Mermaid support to Full while keeping ordinary Markdown editing and preview rendering as light and fast as Lite.

Inspired by sdkks/mdviewer and jnscnn/mdviewer-plus-plus; implementation must retain MDViewer+'s stricter security and editable-document lifecycle. Diagram export is explicitly out of scope.

Packaging and loading

• Use Mermaid's official modular ESM distribution rather than the multi-megabyte all-in-one IIFE bundle.
• Bundle all supported diagram modules locally in Full so compatibility remains complete and offline; do not create a reduced custom Mermaid fork.
• Load the small ESM entry only after detecting a Mermaid fence, then allow Mermaid to load only the required diagram chunks.
• Bundle pinned svg-pan-zoom only in Full and initialize it only after a diagram is rendered.
• No CDN, runtime download, network entitlement, or remotely supplied code.
• Lite must physically contain none of these assets.

Security and licensing

• Configure Mermaid with strict security, HTML labels disabled, and no external resource loading.
• Sanitize generated SVG separately with DOMPurify's SVG profile before insertion.
• Preserve restrictive CSP and never enable eval, unsafe scripts, remote connections, foreignObject, or event handlers.
• Include Mermaid's MIT notice, svg-pan-zoom's BSD-2-Clause notice, and all required notices for code included from transitive dependencies.
• Record exact versions, checksums, provenance, and edition membership in third-party notices.

Interaction and reliability

• Render diagrams lazily near the viewport without disrupting preview debounce or editor/preview scroll synchronization.
• Provide accessible zoom in/out, pan, fit/reset, keyboard controls, and pointer/touch support without stealing editor or page scrolling.
• Display parse failures inline without breaking editing or the rest of the preview.
• Add defensive limits for pathological source size, diagram count, and render work.
• Follow every appearance palette and produce stable fitted diagrams when printing.
• Measure initial module cost, per-diagram chunk loading, memory, render time, live-preview latency, bundle size, and compressed DMG impact.

Acceptance criteria

• Documents without Mermaid never import or initialize Mermaid or svg-pan-zoom.
• Each supported diagram type works offline from bundled ESM chunks.
• Malicious Mermaid/SVG fixtures cannot execute script, navigate, load remote content, or escape the resource boundary.
• Multiple diagrams remain responsive without degrading typing.
• Full contains complete Mermaid support; Lite contains no Mermaid assets.

Cross-variant implementation notes

• Use fenced mermaid code blocks as the only activation surface. After marked output has passed through the existing Markdown DOMPurify policy, find only pre > code.language-mermaid, read definitions through textContent, and replace those blocks with dedicated diagram containers. Do not add SVG elements or Mermaid-specific attributes to the Markdown allowlist.
• Render into those dedicated containers with mermaid.render()/mermaid.run() using securityLevel: "strict", then apply the separate SVG sanitization policy above before insertion. Keep the original definition on the container so appearance changes, live-preview updates, printing, and retries can rerender safely.
• Cancel or discard stale asynchronous diagram results using the preview render generation so an older Mermaid render cannot overwrite newer editor content.
• Treat invalid diagrams as local failures: retain or restore the original fenced code and show a compact accessible error without failing editing or the document render.
• The smaller @mermaid-js/tiny build was evaluated, but it omits diagram families and features such as mindmaps, architecture diagrams, and KaTeX. It is therefore inappropriate while this issue requires complete Mermaid compatibility; reconsider it only if the scope changes to a documented core subset.
• The macOS viewer and editor use nearly identical marked/DOMPurify WKWebView templates. Keep this integration structurally identical in both repositories so security tests and future dependency updates can be mirrored.

[trsdn]

Implemented and released in MDViewer+ v2.0.0.