Seven renderers make sdf-js much larger than a shape library
The README describes 7 renderers that consume signed-distance geometry in 2D or 3D. Shapes are mathematical functions, then union, intersection, difference, repetition, bending, or extrusion composes them into a scene. One scene can feed flat silhouettes, line output, stippled canvas art, shaded 3D views, or GPU effects. The practical benefit is controlled revision: changing one radius or position preserves the rest of the structure instead of asking an image model to redraw everything.
Atlas now surrounds that library with far more application code. Our checkout contained 2,768 files, about 172,200 source lines, and 71 MB before dependencies. It includes a browser compositor, editors, a presentation product, PDF handling, LLM prompt paths, scene serialization, shader code, asset libraries, and many regression scripts. Anyone arriving for a chainable SDF helper should understand the scale first. The repository name describes its origin better than its current product boundary.
What happened when we ran it
Our sandbox installed 116 npm packages in 14 seconds, taking 189 MB on disk. The repository had no build script or target, so that step was skipped. Tests succeeded in 31 seconds. We measured commit 0a1d537 in an unprivileged Node 22 container with 3 CPUs and 8 GB of RAM. The passing command is meaningful for this script-heavy project, although it does not establish visual quality or browser and GPU compatibility.
Npm audit reported 2 known vulnerabilities, both high severity, with 0 critical, moderate, or low findings. The supplied lab result does not name the affected packages or reachable code paths, so we cannot say how exploitable they are. Our scan found 1 CI workflow, no Dockerfile, and no tests directory even though the root test script runs checks from other paths. Production evaluation should begin by reproducing the audit and tracing both advisories through the application path you intend to expose.
Version 0.1.0 is private and GitHub has no release
The root manifest names the package Atlas, marks version 0.1.0 as private, and requires Node 20 or newer. GitHub's latest-release endpoint returned no release. This is therefore a repository you clone and operate, rather than a versioned library you add from npm with a documented compatibility promise. The lack of a build target is consistent with many browser examples loading source modules directly, but it leaves packaging and deployment choices to each adopter.
Local demos use a Python 3 server on port 8001, then open pages under the examples directory. The README offers a public gallery with 8 prepared 3D scenes and says it needs no API key. The editable MVP takes a text prompt, calls Anthropic Claude, receives JavaScript SDF code, and renders it in the browser. That path needs an Anthropic credential and appropriate controls around generated code, network errors, usage limits, and content sent to the provider.
More than 40 primitives feed both canvas and GPU output
The current capability list names more than 40 SDF primitives across 2D and 3D. It also documents extrusion and revolution from 2D into 3D, shape operations, repetition, SVG paths from the line renderer, WebGL fly-through views, and SceneData as a serializable description of subjects, camera, lighting, and regions. These are useful building blocks for icons, charts, diagrams, geometric editorial art, and presentations where exact placement survives repeated rendering.
Some prominent outputs remain aspirations. The README labels STL export for 3D printing and GIF or MP4 animation as planned. Its roadmap also separates shipped, pending, and deferred editor work, although the main page spends many paragraphs describing the intended world-simulator direction. Read STATUS.md and the code path for the feature you need before treating a roadmap argument as an available API. The long thesis is interesting, but it can obscure the smaller set of interfaces an adopter can rely on now.
PolyForm 1.0.0 allows noncommercial use, not ordinary product use
Atlas original work is under PolyForm Noncommercial 1.0.0. COMMERCIAL.md says personal projects, teaching, academic research, and qualifying public-interest work can use it without a separate agreement. It also says charged products, commercial publications, internal company tooling, and hosted paid generators require a commercial license. Third-party pieces, including portions derived from fogleman/sdf, retain their listed licenses. A public repository and readable source do not grant the MIT-style product rights many JavaScript teams expect.
That boundary deserves review before a prototype becomes company work. The commercial document asks prospective users to contact the project for terms, but it does not publish standard pricing. JSCAD is a cleaner alternative for an MIT-licensed parametric JavaScript workflow, while three.js is the broader choice for custom browser 3D. Noncommercial artists and researchers face less friction, provided they are comfortable operating a private 0.1.0 package directly from its repository.
Two high advisories sit beside same-day development
The 2 high-severity audit findings are the largest technical reason to pause before exposing Atlas to untrusted documents or prompts. Two open pull requests separately propose updates to PDF and lockfile dependencies for reported security problems, but the lab result does not prove those proposals correspond one-for-one with our audit findings. Neither pull request was merged when fetched. Re-run the audit after any dependency change, then test the PDF and browser paths instead of assuming an updated lockfile settles application risk.
The last push was September 13, 2026, and GitHub listed 14 combined open issues and pull requests. Every open entry returned by the API was a pull request, including recent fixes for query-parameter handling and geometric correctness. The project had 269 stars and 8 forks, modest outside adoption for a codebase of 172,200 source lines. Development is plainly active. External review, release discipline, and stable consumer boundaries have not caught up with its rate of expansion.