# Chart Studio integration

Experimental local chart authoring with the mature RAWGraphs derivative, not an official RAWGraphs service. The original compiled candidate and application source are preserved in the source ZIP. Existing application README milestones are historical; the later singleton-palette compile succeeded. The integration itself does not recompile the application.

The hosted editor runs in an opaque-origin srcdoc iframe with only scripts and downloads allowed. All JS, CSS and icons are embedded. CSP disallows network connections, frames, workers, forms, external scripts and eval. No same-origin permission or parent-message bridge is granted. Links inside the editor are intercepted; use the surrounding page for credits/navigation. Two compiled D3 object converters are adapted to ordinary functions so CSV parsing works without eval. Normal properties remain own enumerable/writable/configurable fields, including unusual headers. Reserved __proto__, constructor and prototype headers are rejected earlier in the adapted converter; the application already rejects these through its table guard. Native Blob downloads remain inside the sandbox and need browser acceptance. CSP/sandbox are defense in depth, not security certification.

## Reproduce

Extract the source ZIP into an empty directory and run `python3 build.py`. It needs only Python's standard library and the bundled inputs/samples; it does not install dependencies, fetch remote code or recompile. Open the generated dist/tools/charts/index.html through a static web server. Run `node --max-old-space-size=128 test.mjs` for the bounded converter/isolation/asset/project checks. The application-source archive contains its full-build recipe and pinned dependency lock.

## Verification and limits

The short-label sample is a synthetic three-row treemap. Original renderer/core tests saved, reopened, revised width from 960 to 880, and reopened again with identical output; the SVG was rasterized separately and its labels inspected. This is not browser download or React lifecycle verification. Existing seven fixture readability failures remain: long labels in horizon, line, slope and treemap designs can clip or overlap, and sparse saved singleton colors can be black-on-black. Explicit saved colors are preserved. Inspect each output and choose readable colors, labels and margins.

The app retains 32 chart definitions, not 32 fully accepted workflows. Repeated imports, PNG/JPEG downloads, browser networking and editor accessibility require browser qualification. Use a fresh editor session when reopening a saved project; that is a conservative workflow, not a lifecycle-fix claim. No autosave, cloud sync, collaborative editing, dashboard hosting or paid-product parity is promised. Projects contain source data and should be shared deliberately. Data limits: 5 MB input, 20 MB project, 50,000 rows, 256 columns and 200,000 cells; performance can be lower.

## Rights

RAWGraphs app and modifications: Apache-2.0. All original dependency notices and source/licensing documents are retained. DensityDesign, Calibro, INMAGIK and upstream contributors are credited. A calendar package declares Apache-2.0 but its original separate NOTICE provenance could not be verified; no required missing notice has been demonstrated. This is not a legal-clearance claim. New wrapper code and guide are Apache-2.0; synthetic sample data is CC0. Existing app/assets retain their own licences.