# Retiam third-party notices These notices describe third-party code, fonts, generated font data, and weights used by Retiam. Each component retains its own license; Retiam's own license does not replace or restrict the rights those licenses grant. Original license and notice texts are reproduced in [`THIRD_PARTY_LICENSES.txt`](THIRD_PARTY_LICENSES.txt). Identical texts are stored once; the section references below identify the applicable texts for each component. Distinct copyright notices are preserved. For upstream READMEs, only reviewed licensing and attribution passages are included. Those excerpts are reproduced unchanged and marked in the text file. This inventory conservatively includes non-optional production packages from the root lockfile, explicitly bundled packages and their dependencies even when marked development-only, WebGPU declaration types, and the pinned Monaco editor used by Studio. Some packages are CLI/server dependencies rather than browser bundle contents. Optional platform binaries, development-only tools, downloaded browsers, and externally served CDN resources are not claimed to be included in every Retiam distribution. Their distributors provide their own terms. Applications that add dependencies or media need their own inventory. Keep this file and `THIRD_PARTY_LICENSES.txt` together when redistributing Retiam bundles, alongside Retiam's own `LICENSE` and `COMMERCIAL_LICENSE.md`. Retiam's own code is free for noncommercial use; commercial use requires the separate paid agreement described in those files. These restrictions do not replace or limit the rights granted by the third-party licenses reproduced here. Do not remove embedded upstream license notices. Generated projects additionally copy the installed engine's notices to `public/vendor/retiam/` and copy the actual installed TypeScript and Monaco notices beside their vendor files before builds. ## Fonts, generated font data, weights, and vendored components | Component | License | Text sections | | --- | --- | --- | | Roboto | Apache-2.0 | [L001, L002](THIRD_PARTY_LICENSES.txt) | | Fira Code | OFL-1.1 | [L003, L004](THIRD_PARTY_LICENSES.txt) | | Fredericka the Great | OFL-1.1 | [L005, L006](THIRD_PARTY_LICENSES.txt) | | Excalifont | OFL-1.1 | [L007, L008](THIRD_PARTY_LICENSES.txt) | | Intel Open Image Denoise weights | Apache-2.0 | [L009, L010](THIRD_PARTY_LICENSES.txt) | | WOFF2/Brotli implementations used by woff2-encoder | MIT | [L011, L012, L013](THIRD_PARTY_LICENSES.txt) | | Emscripten, musl and LLVM WebAssembly runtime notices | MIT AND (Apache-2.0 WITH LLVM-exception) | [L014, L015, L016, L017, L018, L019](THIRD_PARTY_LICENSES.txt) | | Inigo Quilez SDF technical snippets (WGSL adaptations) | MIT | [L020, L021](THIRD_PARTY_LICENSES.txt) | Font coverage includes the corresponding MSDF PNG/JSON atlases and generated glyph outlines in `excalifontMathJaxData.ts`. These remain font-derived data under the respective font license. Reserved Font Name conditions apply to modified font distributions. See the individual source notes for provenance, copyright information, and the verified OIDN checksum. ## npm dependencies and Studio Versions refer to this repository's inventory snapshot. Installed dependencies also supply their own terms. MIT is the selected alternative for `xmldom-sre`, which offers MIT or LGPL; both upstream options are preserved in its notice. | Package | Version | Declared license | Text sections | | --- | --- | --- | --- | | @babel/code-frame | 7.27.1 | MIT | [L022](THIRD_PARTY_LICENSES.txt) | | @babel/helper-validator-identifier | 7.28.5 | MIT | [L022](THIRD_PARTY_LICENSES.txt) | | @dimforge/rapier2d-compat | 0.20.0 | Apache-2.0 | [L023](THIRD_PARTY_LICENSES.txt) | | @dimforge/rapier3d-compat | 0.20.0 | Apache-2.0 | [L023](THIRD_PARTY_LICENSES.txt) | | @petamoriken/float16 | 3.9.3 | MIT | [L024](THIRD_PARTY_LICENSES.txt) | | @puppeteer/browsers | 1.9.1 | Apache-2.0 | [L025, L026, L027](THIRD_PARTY_LICENSES.txt) | | @tensorflow/tfjs-backend-cpu | 4.20.0 | Apache-2.0 | [L030, L031, L009](THIRD_PARTY_LICENSES.txt) | | @tensorflow/tfjs-backend-webgl | 4.20.0 | Apache-2.0 | [L032, L033, L009](THIRD_PARTY_LICENSES.txt) | | @tensorflow/tfjs-backend-webgpu | 4.20.0 | Apache-2.0 | [L034, L035, L009](THIRD_PARTY_LICENSES.txt) | | @tensorflow/tfjs-converter | 4.20.0 | Apache-2.0 | [L036, L037, L009](THIRD_PARTY_LICENSES.txt) | | @tensorflow/tfjs-core | 4.20.0 | Apache-2.0 | [L038, L039, L009](THIRD_PARTY_LICENSES.txt) | | @tensorflow/tfjs-data | 4.20.0 | Apache-2.0 | [L043, L044, L009](THIRD_PARTY_LICENSES.txt) | | @tensorflow/tfjs-layers | 4.20.0 | Apache-2.0 AND MIT | [L045, L046, L047](THIRD_PARTY_LICENSES.txt) | | @tensorflow/tfjs | 4.20.0 | Apache-2.0 | [L028, L029, L009](THIRD_PARTY_LICENSES.txt) | | @tootallnate/quickjs-emscripten | 0.23.0 | MIT | [L052](THIRD_PARTY_LICENSES.txt) | | @types/dom-webcodecs | 0.1.18 | MIT | [L040](THIRD_PARTY_LICENSES.txt) | | @types/estree | 1.0.7 | MIT | [L040](THIRD_PARTY_LICENSES.txt) | | @types/libtess | 1.2.0 | MIT | [L040](THIRD_PARTY_LICENSES.txt) | | @types/long | 4.0.2 | MIT | [L040](THIRD_PARTY_LICENSES.txt) | | @types/node-fetch | 2.6.13 | MIT | [L040](THIRD_PARTY_LICENSES.txt) | | @types/node | 22.7.4 | MIT | [L040](THIRD_PARTY_LICENSES.txt) | | @types/offscreencanvas | 2019.3.0 | MIT | [L053](THIRD_PARTY_LICENSES.txt) | | @types/offscreencanvas | 2019.7.3 | MIT | [L040](THIRD_PARTY_LICENSES.txt) | | @types/prismjs | 1.26.6 | MIT | [L040](THIRD_PARTY_LICENSES.txt) | | @types/seedrandom | 2.4.34 | MIT | [L040](THIRD_PARTY_LICENSES.txt) | | @types/wicg-file-system-access | 2020.9.8 | MIT | [L040](THIRD_PARTY_LICENSES.txt) | | @webgpu/types | 0.1.38 | BSD-3-Clause | [L041](THIRD_PARTY_LICENSES.txt) | | @webgpu/types | 0.1.40 | BSD-3-Clause | [L041](THIRD_PARTY_LICENSES.txt) | | @zappar/msdf-generator | 1.2.4 | MIT AND BSD-3-Clause | [L054](THIRD_PARTY_LICENSES.txt) | | agent-base | 6.0.2 | MIT | [L062, L063](THIRD_PARTY_LICENSES.txt) | | agent-base | 7.1.3 | MIT | [L055](THIRD_PARTY_LICENSES.txt) | | ansi-regex | 5.0.1 | MIT | [L056](THIRD_PARTY_LICENSES.txt) | | ansi-styles | 4.3.0 | MIT | [L056](THIRD_PARTY_LICENSES.txt) | | argparse | 1.0.10 | MIT | [L057](THIRD_PARTY_LICENSES.txt) | | argparse | 2.0.1 | Python-2.0 | [L079](THIRD_PARTY_LICENSES.txt) | | as-number | 1.0.0 | MIT | [L058](THIRD_PARTY_LICENSES.txt) | | ast-types | 0.13.4 | MIT | [L059](THIRD_PARTY_LICENSES.txt) | | asynckit | 0.4.0 | MIT | [L060](THIRD_PARTY_LICENSES.txt) | | axios | 1.20.0 | MIT | [L061](THIRD_PARTY_LICENSES.txt) | | b4a | 1.6.7 | Apache-2.0 | [L001](THIRD_PARTY_LICENSES.txt) | | base64-js | 1.5.1 | MIT | [L066](THIRD_PARTY_LICENSES.txt) | | basic-ftp | 5.0.5 | MIT | [L067](THIRD_PARTY_LICENSES.txt) | | box3d-wasm | 0.2.0 | MIT | [L068, L069](THIRD_PARTY_LICENSES.txt) | | buffer-crc32 | 0.2.13 | MIT | [L071](THIRD_PARTY_LICENSES.txt) | | buffer | 5.7.1 | MIT | [L070](THIRD_PARTY_LICENSES.txt) | | buffer | 6.0.3 | MIT | [L070](THIRD_PARTY_LICENSES.txt) | | call-bind-apply-helpers | 1.0.2 | MIT | [L072](THIRD_PARTY_LICENSES.txt) | | callsites | 3.1.0 | MIT | [L056](THIRD_PARTY_LICENSES.txt) | | chalk | 4.1.2 | MIT | [L056](THIRD_PARTY_LICENSES.txt) | | chromium-bidi | 0.5.8 | Apache-2.0 | [L001](THIRD_PARTY_LICENSES.txt) | | cli-progress | 3.12.0 | MIT | [L073](THIRD_PARTY_LICENSES.txt) | | cliui | 7.0.4 | ISC | [L048](THIRD_PARTY_LICENSES.txt) | | cliui | 8.0.1 | ISC | [L048](THIRD_PARTY_LICENSES.txt) | | color-convert | 2.0.1 | MIT | [L074](THIRD_PARTY_LICENSES.txt) | | color-name | 1.1.4 | MIT | [L075](THIRD_PARTY_LICENSES.txt) | | combined-stream | 1.0.8 | MIT | [L076](THIRD_PARTY_LICENSES.txt) | | comlink | 4.4.2 | Apache-2.0 | [L077](THIRD_PARTY_LICENSES.txt) | | commander | 9.2.0 | MIT | [L180](THIRD_PARTY_LICENSES.txt) | | core-js | 3.29.1 | MIT | [L049](THIRD_PARTY_LICENSES.txt) | | cosmiconfig | 9.0.0 | MIT | [L078](THIRD_PARTY_LICENSES.txt) | | cross-fetch | 4.0.0 | MIT | [L081](THIRD_PARTY_LICENSES.txt) | | data-uri-to-buffer | 6.0.2 | MIT | [L082](THIRD_PARTY_LICENSES.txt) | | debug | 4.3.4 | MIT | [L083](THIRD_PARTY_LICENSES.txt) | | degenerator | 5.0.1 | MIT | [L084, L063](THIRD_PARTY_LICENSES.txt) | | delayed-stream | 1.0.0 | MIT | [L076](THIRD_PARTY_LICENSES.txt) | | devtools-protocol | 0.0.1232444 | BSD-3-Clause | [L085](THIRD_PARTY_LICENSES.txt) | | dunder-proto | 1.0.1 | MIT | [L086](THIRD_PARTY_LICENSES.txt) | | earcut | 3.0.2 | ISC | [L087](THIRD_PARTY_LICENSES.txt) | | emoji-regex | 8.0.0 | MIT | [L088](THIRD_PARTY_LICENSES.txt) | | end-of-stream | 1.4.4 | MIT | [L089](THIRD_PARTY_LICENSES.txt) | | env-paths | 2.2.1 | MIT | [L056](THIRD_PARTY_LICENSES.txt) | | error-ex | 1.3.2 | MIT | [L090](THIRD_PARTY_LICENSES.txt) | | es-define-property | 1.0.1 | MIT | [L072](THIRD_PARTY_LICENSES.txt) | | es-errors | 1.3.0 | MIT | [L072](THIRD_PARTY_LICENSES.txt) | | es-object-atoms | 1.1.2 | MIT | [L072](THIRD_PARTY_LICENSES.txt) | | es-set-tostringtag | 2.1.0 | MIT | [L091](THIRD_PARTY_LICENSES.txt) | | esbuild | 0.25.5 | MIT | [L092](THIRD_PARTY_LICENSES.txt) | | esbuild | 0.28.1 | MIT | [L092](THIRD_PARTY_LICENSES.txt) | | escalade | 3.2.0 | MIT | [L093](THIRD_PARTY_LICENSES.txt) | | escodegen | 2.1.0 | BSD-2-Clause | [L094](THIRD_PARTY_LICENSES.txt) | | esm | 3.2.25 | MIT | [L095](THIRD_PARTY_LICENSES.txt) | | esprima | 4.0.1 | BSD-2-Clause | [L096](THIRD_PARTY_LICENSES.txt) | | estraverse | 5.3.0 | BSD-2-Clause | [L097](THIRD_PARTY_LICENSES.txt) | | esutils | 2.0.3 | BSD-2-Clause | [L097](THIRD_PARTY_LICENSES.txt) | | events | 3.3.0 | MIT | [L098](THIRD_PARTY_LICENSES.txt) | | extract-zip | 2.0.1 | BSD-2-Clause | [L099](THIRD_PARTY_LICENSES.txt) | | extrude-polyline | 1.0.6 | MIT | [L058](THIRD_PARTY_LICENSES.txt) | | fast-fifo | 1.3.2 | MIT | [L101](THIRD_PARTY_LICENSES.txt) | | fd-slicer | 1.1.0 | MIT | [L102](THIRD_PARTY_LICENSES.txt) | | fdir | 6.4.5 | MIT | [L196](THIRD_PARTY_LICENSES.txt) | | fdir | 6.5.0 | MIT | [L196](THIRD_PARTY_LICENSES.txt) | | follow-redirects | 1.16.0 | MIT | [L103](THIRD_PARTY_LICENSES.txt) | | form-data | 4.0.6 | MIT | [L104](THIRD_PARTY_LICENSES.txt) | | function-bind | 1.1.2 | MIT | [L105](THIRD_PARTY_LICENSES.txt) | | get-caller-file | 2.0.5 | ISC | [L106](THIRD_PARTY_LICENSES.txt) | | get-intrinsic | 1.3.0 | MIT | [L107](THIRD_PARTY_LICENSES.txt) | | get-proto | 1.0.1 | MIT | [L108](THIRD_PARTY_LICENSES.txt) | | get-stream | 5.2.0 | MIT | [L100](THIRD_PARTY_LICENSES.txt) | | get-uri | 6.0.4 | MIT | [L082](THIRD_PARTY_LICENSES.txt) | | gl-vec2 | 1.3.0 | zlib | [L109](THIRD_PARTY_LICENSES.txt) | | gopd | 1.2.0 | MIT | [L110](THIRD_PARTY_LICENSES.txt) | | hachure-fill | 0.5.2 | MIT | [L111](THIRD_PARTY_LICENSES.txt) | | has-flag | 4.0.0 | MIT | [L056](THIRD_PARTY_LICENSES.txt) | | has-symbols | 1.1.0 | MIT | [L112](THIRD_PARTY_LICENSES.txt) | | has-tostringtag | 1.0.2 | MIT | [L113](THIRD_PARTY_LICENSES.txt) | | hasown | 2.0.4 | MIT | [L114](THIRD_PARTY_LICENSES.txt) | | http-proxy-agent | 7.0.2 | MIT | [L115](THIRD_PARTY_LICENSES.txt) | | https-proxy-agent | 5.0.1 | MIT | [L064, L063](THIRD_PARTY_LICENSES.txt) | | https-proxy-agent | 7.0.6 | MIT | [L055](THIRD_PARTY_LICENSES.txt) | | ieee754 | 1.2.1 | BSD-3-Clause | [L116](THIRD_PARTY_LICENSES.txt) | | import-fresh | 3.3.1 | MIT | [L100](THIRD_PARTY_LICENSES.txt) | | inherits | 2.0.4 | ISC | [L117](THIRD_PARTY_LICENSES.txt) | | ip-address | 9.0.5 | MIT | [L118](THIRD_PARTY_LICENSES.txt) | | is-arrayish | 0.2.1 | MIT | [L090](THIRD_PARTY_LICENSES.txt) | | is-fullwidth-code-point | 3.0.0 | MIT | [L056](THIRD_PARTY_LICENSES.txt) | | isomorphic-ws | 5.0.0 | MIT | [L120](THIRD_PARTY_LICENSES.txt) | | jolt-physics | 1.1.0 | MIT | [L121](THIRD_PARTY_LICENSES.txt) | | js-tokens | 4.0.0 | MIT | [L122](THIRD_PARTY_LICENSES.txt) | | js-yaml | 4.1.0 | MIT | [L080](THIRD_PARTY_LICENSES.txt) | | jsbn | 1.1.0 | MIT | [L123](THIRD_PARTY_LICENSES.txt) | | json-parse-even-better-errors | 2.3.1 | MIT | [L124](THIRD_PARTY_LICENSES.txt) | | libtess | 1.2.2 | SGI-B-2.0 | [L125](THIRD_PARTY_LICENSES.txt) | | lines-and-columns | 1.2.4 | MIT | [L126](THIRD_PARTY_LICENSES.txt) | | long | 4.0.0 | Apache-2.0 | [L127](THIRD_PARTY_LICENSES.txt) | | lru-cache | 7.18.3 | ISC | [L160](THIRD_PARTY_LICENSES.txt) | | math-intrinsics | 1.1.0 | MIT | [L086](THIRD_PARTY_LICENSES.txt) | | mathjax-full | 3.2.2 | Apache-2.0 | [L009](THIRD_PARTY_LICENSES.txt) | | matter-js | 0.20.0 | MIT | [L128, L129](THIRD_PARTY_LICENSES.txt) | | mhchemparser | 4.2.1 | Apache-2.0 | [L130](THIRD_PARTY_LICENSES.txt) | | mime-db | 1.52.0 | MIT | [L131](THIRD_PARTY_LICENSES.txt) | | mime-types | 2.1.35 | MIT | [L132](THIRD_PARTY_LICENSES.txt) | | mitt | 3.0.1 | MIT | [L133](THIRD_PARTY_LICENSES.txt) | | mj-context-menu | 0.6.1 | Apache-2.0 | [L134, L001, L135](THIRD_PARTY_LICENSES.txt) | | mkdirp-classic | 0.5.3 | MIT | [L136](THIRD_PARTY_LICENSES.txt) | | monaco-editor | 0.45.0 | MIT | [L223, L224](THIRD_PARTY_LICENSES.txt) | | mp4-muxer | 5.2.2 | MIT | [L137](THIRD_PARTY_LICENSES.txt) | | ms | 2.1.2 | MIT | [L138](THIRD_PARTY_LICENSES.txt) | | msedge-tts | 2.0.8 | MIT | [L139](THIRD_PARTY_LICENSES.txt) | | nanoid | 3.3.11 | MIT | [L141](THIRD_PARTY_LICENSES.txt) | | netmask | 2.0.2 | MIT | [L142, L143, L144](THIRD_PARTY_LICENSES.txt) | | node-fetch | 2.6.13 | MIT | [L042](THIRD_PARTY_LICENSES.txt) | | node-fetch | 2.6.13 | MIT | [L042](THIRD_PARTY_LICENSES.txt) | | node-fetch | 2.7.0 | MIT | [L042](THIRD_PARTY_LICENSES.txt) | | oidn-web | 0.3.5 | MIT | [L145](THIRD_PARTY_LICENSES.txt) | | once | 1.4.0 | ISC | [L146](THIRD_PARTY_LICENSES.txt) | | opentype.js | 1.3.4 | MIT | [L147](THIRD_PARTY_LICENSES.txt) | | pac-proxy-agent | 7.2.0 | MIT | [L148](THIRD_PARTY_LICENSES.txt) | | pac-resolver | 7.0.1 | MIT | [L055](THIRD_PARTY_LICENSES.txt) | | pako | 1.0.11 | (MIT AND Zlib) | [L149](THIRD_PARTY_LICENSES.txt) | | parent-module | 1.0.1 | MIT | [L056](THIRD_PARTY_LICENSES.txt) | | parse-json | 5.2.0 | MIT | [L100](THIRD_PARTY_LICENSES.txt) | | path-data-parser | 0.1.0 | MIT | [L150](THIRD_PARTY_LICENSES.txt) | | pend | 1.2.0 | MIT | [L151](THIRD_PARTY_LICENSES.txt) | | picocolors | 1.1.1 | ISC | [L152](THIRD_PARTY_LICENSES.txt) | | picomatch | 4.0.2 | MIT | [L197](THIRD_PARTY_LICENSES.txt) | | picomatch | 4.0.3 | MIT | [L197](THIRD_PARTY_LICENSES.txt) | | planck | 1.5.0 | MIT | [L153](THIRD_PARTY_LICENSES.txt) | | points-on-curve | 0.2.0 | MIT | [L150](THIRD_PARTY_LICENSES.txt) | | points-on-path | 0.2.1 | MIT | [L154](THIRD_PARTY_LICENSES.txt) | | polygon-clipping | 0.15.7 | MIT | [L155](THIRD_PARTY_LICENSES.txt) | | polyline-miter-util | 1.0.1 | MIT | [L058](THIRD_PARTY_LICENSES.txt) | | postcss | 8.5.6 | MIT | [L156](THIRD_PARTY_LICENSES.txt) | | prismjs | 1.30.0 | MIT | [L157](THIRD_PARTY_LICENSES.txt) | | progress | 2.0.3 | MIT | [L158](THIRD_PARTY_LICENSES.txt) | | proxy-agent | 6.3.1 | MIT | [L159, L063](THIRD_PARTY_LICENSES.txt) | | proxy-from-env | 1.1.0 | MIT | [L065](THIRD_PARTY_LICENSES.txt) | | proxy-from-env | 2.1.0 | MIT | [L065](THIRD_PARTY_LICENSES.txt) | | pump | 3.0.2 | MIT | [L089](THIRD_PARTY_LICENSES.txt) | | puppeteer-core | 21.11.0 | Apache-2.0 | [L163, L164, L027](THIRD_PARTY_LICENSES.txt) | | puppeteer | 21.11.0 | Apache-2.0 | [L161, L162, L027](THIRD_PARTY_LICENSES.txt) | | readable-stream | 3.6.2 | MIT | [L165](THIRD_PARTY_LICENSES.txt) | | regenerator-runtime | 0.13.11 | MIT | [L166](THIRD_PARTY_LICENSES.txt) | | require-directory | 2.1.1 | MIT | [L167](THIRD_PARTY_LICENSES.txt) | | resolve-from | 4.0.0 | MIT | [L056](THIRD_PARTY_LICENSES.txt) | | robust-predicates | 3.0.3 | Unlicense | [L168](THIRD_PARTY_LICENSES.txt) | | rollup | 4.41.1 | MIT | [L169](THIRD_PARTY_LICENSES.txt) | | roughjs | 4.6.6 | MIT | [L170](THIRD_PARTY_LICENSES.txt) | | safe-buffer | 5.2.1 | MIT | [L171](THIRD_PARTY_LICENSES.txt) | | seedrandom | 3.0.5 | MIT | [L172, L173, L174, L175](THIRD_PARTY_LICENSES.txt) | | smart-buffer | 4.2.0 | MIT | [L176](THIRD_PARTY_LICENSES.txt) | | socks-proxy-agent | 8.0.5 | MIT | [L055](THIRD_PARTY_LICENSES.txt) | | socks | 2.8.5 | MIT | [L177](THIRD_PARTY_LICENSES.txt) | | source-map-js | 1.2.1 | BSD-3-Clause | [L178](THIRD_PARTY_LICENSES.txt) | | source-map | 0.6.1 | BSD-3-Clause | [L178](THIRD_PARTY_LICENSES.txt) | | speech-rule-engine | 4.0.7 | Apache-2.0 | [L179](THIRD_PARTY_LICENSES.txt) | | splaytree | 3.2.3 | MIT | [L181, L182, L183, L184](THIRD_PARTY_LICENSES.txt) | | sprintf-js | 1.0.3 | BSD-3-Clause | [L185](THIRD_PARTY_LICENSES.txt) | | sprintf-js | 1.1.3 | BSD-3-Clause | [L119](THIRD_PARTY_LICENSES.txt) | | stage-js | 1.0.2 | MIT | [L186](THIRD_PARTY_LICENSES.txt) | | stream-browserify | 3.0.0 | MIT | [L187](THIRD_PARTY_LICENSES.txt) | | streamx | 2.22.1 | MIT | [L101](THIRD_PARTY_LICENSES.txt) | | string_decoder | 1.3.0 | MIT | [L188](THIRD_PARTY_LICENSES.txt) | | string-width | 4.2.3 | MIT | [L056](THIRD_PARTY_LICENSES.txt) | | string.prototype.codepointat | 0.2.1 | MIT | [L088](THIRD_PARTY_LICENSES.txt) | | strip-ansi | 6.0.1 | MIT | [L056](THIRD_PARTY_LICENSES.txt) | | supports-color | 7.2.0 | MIT | [L056](THIRD_PARTY_LICENSES.txt) | | svg-parser | 2.0.4 | MIT | [L189, L190](THIRD_PARTY_LICENSES.txt) | | svg-pathdata | 7.1.0 | MIT | [L191](THIRD_PARTY_LICENSES.txt) | | tar-fs | 3.0.4 | MIT | [L089](THIRD_PARTY_LICENSES.txt) | | tar-stream | 3.1.7 | MIT | [L089](THIRD_PARTY_LICENSES.txt) | | text-decoder | 1.2.3 | Apache-2.0 | [L001](THIRD_PARTY_LICENSES.txt) | | through | 2.3.8 | MIT | [L192, L193](THIRD_PARTY_LICENSES.txt) | | tiny-inflate | 1.0.3 | MIT | [L194](THIRD_PARTY_LICENSES.txt) | | tinyglobby | 0.2.15 | MIT | [L195](THIRD_PARTY_LICENSES.txt) | | tr46 | 0.0.3 | MIT | [L198, L199](THIRD_PARTY_LICENSES.txt) | | tslib | 2.8.1 | 0BSD | [L200](THIRD_PARTY_LICENSES.txt) | | tsx | 4.22.4 | MIT | [L201](THIRD_PARTY_LICENSES.txt) | | typescript | 5.4.5 | Apache-2.0 | [L202, L203](THIRD_PARTY_LICENSES.txt) | | unbzip2-stream | 1.4.3 | MIT | [L204](THIRD_PARTY_LICENSES.txt) | | undici-types | 6.19.8 | MIT | [L205](THIRD_PARTY_LICENSES.txt) | | urlpattern-polyfill | 10.0.0 | MIT | [L206](THIRD_PARTY_LICENSES.txt) | | utif | 2.0.1 | MIT | [L207](THIRD_PARTY_LICENSES.txt) | | util-deprecate | 1.0.2 | MIT | [L208](THIRD_PARTY_LICENSES.txt) | | vite | 6.3.6 | MIT | [L209](THIRD_PARTY_LICENSES.txt) | | webidl-conversions | 3.0.1 | BSD-2-Clause | [L210](THIRD_PARTY_LICENSES.txt) | | webm-muxer | 5.1.4 | MIT | [L211](THIRD_PARTY_LICENSES.txt) | | wgsl_reflect | 1.2.3 | MIT | [L212](THIRD_PARTY_LICENSES.txt) | | whatwg-url | 5.0.0 | MIT | [L213](THIRD_PARTY_LICENSES.txt) | | wicked-good-xpath | 1.3.0 | MIT | [L214](THIRD_PARTY_LICENSES.txt) | | woff2-encoder | 2.0.0 | MIT | [L215](THIRD_PARTY_LICENSES.txt) | | wrap-ansi | 7.0.0 | MIT | [L100](THIRD_PARTY_LICENSES.txt) | | wrappy | 1.0.2 | ISC | [L146](THIRD_PARTY_LICENSES.txt) | | ws | 8.16.0 | MIT | [L140](THIRD_PARTY_LICENSES.txt) | | ws | 8.22.0 | MIT | [L140](THIRD_PARTY_LICENSES.txt) | | xmldom-sre | 0.1.31 | MIT | [L216, L217, L218, L219](THIRD_PARTY_LICENSES.txt) | | y18n | 5.0.8 | ISC | [L220](THIRD_PARTY_LICENSES.txt) | | yargs-parser | 20.2.9 | ISC | [L051](THIRD_PARTY_LICENSES.txt) | | yargs-parser | 21.1.1 | ISC | [L051](THIRD_PARTY_LICENSES.txt) | | yargs | 16.2.0 | MIT | [L050](THIRD_PARTY_LICENSES.txt) | | yargs | 17.7.2 | MIT | [L050](THIRD_PARTY_LICENSES.txt) | | yauzl | 2.10.0 | MIT | [L221](THIRD_PARTY_LICENSES.txt) | | yerror | 8.0.0 | MIT | [L222](THIRD_PARTY_LICENSES.txt) | ## Review boundaries This inventory does not grant rights to demo photos, videos, models, SVGs, or research PDFs. Their provenance remains recorded as unresolved in `docs/THIRD_PARTY_ASSET_REVIEW.md` in the source repository. Do not treat them as covered by the code or font licenses listed here. They are excluded from the engine npm package by its existing package file allowlist. The SDF helper block adapts Inigo Quilez's technical snippets under the MIT permission stated on his article index. Its attribution and MIT terms are included in the component table and license texts above. That permission does not cover the author's separately protected mathematical/shader artwork. The review also records a verified match between the installed WOFF2 decoder's embedded WASM and upstream's version-tagged artifact, with documented toolchain/runtime notices. The exact historical Brotli revision and full build reproducibility are not asserted. An absent build hash alone does not add a permission requirement to the MIT license. ## Maintaining this inventory After dependency or asset changes, run `npm ci`, then `npm run licenses:generate` and review the result. Upstream text supplements for packages that omit license files, reviewed README excerpts, and asset provenance are recorded in `tools/third-party-sources.json` in the source repository. These internal maintenance records are not needed in distributions. Generation uses local files and checked-in originals; it does not execute package scripts or fetch new legal terms. Run `npm run licenses:check` to verify the committed input and file fingerprints. This command also runs before the library build.