TIRAZIS 3.1 - Security maintenance update (2026-09-24)

RUN
Extract the entire ZIP and open index.html. Keep assets, dist and vendor
beside index.html. On a web server, replace the complete application folder,
including vendor, and refresh cached copies of index.html and app.bundle.js.

CHANGES
- Imported node and relation IDs are restricted to safe characters. Unsafe
  IDs are remapped and relation endpoints follow the new node IDs.
- Dynamic data-id attributes are HTML-encoded as a second protection layer.
- Component types and relation statuses use own-property enum checks.
- AI keys are retained only in page memory. Provider/model/endpoint settings
  persist. Re-enter the key after reloading or closing the page.
- The previous stored AI configuration is replaced with non-secret settings
  on startup; the old localStorage copy is removed too. This migration affects
  only the browser profile/origin where the updated application runs. It cannot
  erase keys from other profiles, old file locations or other origins.
- AI requests require HTTPS with no embedded URL credentials. Redirects are
  rejected to avoid forwarding credentials to a different endpoint.
- A Content Security Policy blocks inline scripts, plugins, base URL changes
  and form submissions. HTTPS AI connections remain available.
- D3 7.8.5 and Dagre 0.8.5 are bundled locally, with license files. The
  existing CDN font stylesheets remain for visual compatibility; therefore
  fonts may fall back when offline. No external JavaScript library is needed.

VALIDATION
JavaScript syntax check passed. 33 Node/VM checks passed, covering all five
built-in project samples, graph round-trip, hostile/reserved IDs, relationship
remapping, enum validation, relationship/autocomplete HTML output, HTTPS URL
validation, legacy key migration in IndexedDB and localStorage fallback,
secret-free persistence, in-memory key retention and CSP configuration.
Application CSS and both original SVG assets are byte-for-byte unchanged.

LIMITS OF VERIFICATION
These checks do not constitute a complete security audit or browser test.
Browser installation failed in the build environment, so interactive testing
of file:// execution, CSP behavior, diagram editing, PDF/PNG/SVG exports and
live AI providers was not completed. No real API credentials were used.
Before broad redistribution, test the package on the target browser and ask
the reporting IT team to re-evaluate it. No claim of antivirus clearance is made.

HOSTING
Apply this update to both the download and the hosted application. For extra
server protection, consider a matching CSP response header with frame-ancestors
appropriate to the site's embedding requirements, X-Content-Type-Options:
nosniff, and Referrer-Policy: no-referrer. Keep executable dependencies updated
through a reviewed release process. Custom AI services must allow browser CORS.

The application must still send the user's requested analysis to their chosen
AI provider when AI is used. The provider/model/analysis workflow is unchanged.
