# Third-Party Notices This inventory covers dependencies referenced by the application as of 2026-08-28. Polyquote itself is private and marked `UNLICENSED`; that marker does not replace the licenses of third-party components. ## Server runtime packages | Package | Version | License | Upstream | | --- | ---: | --- | --- | | `@supabase/supabase-js` | 2.112.4 | MIT | | | `svix` | 2.1.0 | MIT | | Their locked transitive production packages declare MIT, 0BSD, or Unlicense terms. `package-lock.json` is the authoritative version and integrity inventory; `npm run check:licenses` rejects missing integrity/license metadata and production packages with GPL, AGPL, SSPL, or BUSL markers pending manual review. ## Self-hosted browser components | Component | Version | License | Deployed license text | Upstream | | --- | ---: | --- | --- | --- | | Supabase browser client | 2.112.4 | MIT | `assets/vendor/license.supabase-js.txt` | | | fflate | 0.8.3 | MIT | `assets/vendor/license.fflate.txt` | | | three.js and OrbitControls | r128 / 0.128.0 | MIT | `assets/vendor/license.three.txt` | | | occt-import-js | 0.0.22 | LGPL-2.1 | `assets/vendor/license.occt-import-js.txt` | | | Open CASCADE Technology code compiled into the OCCT WebAssembly binary | version supplied by occt-import-js 0.0.22 | LGPL-2.1 | `assets/vendor/license.occt.txt` | | | IBM Plex Sans and IBM Plex Mono | Fontsource 5.3.0 | OFL-1.1 | `assets/fonts/OFL.txt` | | The deployed copies are reproducibly generated from the exact npm packages; CRLF-only text distributions are normalized to LF for the repository. `assets/vendor/manifest.json` records their package origin, deployed byte length, and SHA-384 digest; `npm run check:vendor` verifies every copy against the lockfile installation. ## Compliance actions before distribution or self-hosting 1. Preserve the deployed license files and this notice with every copied or bundled asset. 2. Keep the LGPL statement below accurate. `occt-import-js` and the Open CASCADE code inside its WebAssembly binary are LGPL-2.1, and Polyquote distributes that binary publicly. If the deployed copy ever stops matching the published package, the "unmodified" statement no longer holds and Polyquote owes the corresponding source of its own build. 3. When adding or self-hosting fonts, retain the applicable font license and copyright metadata, and check reserved font-name restrictions before modification. 4. Re-run `npm run check:vendor` and `npm run check:licenses`, review the lockfile and manifest diffs, and update this file whenever a browser asset, runtime dependency, or version changes. 5. Do not assume a security upgrade preserves license terms. Review both the security advisory and the new release's license before deployment. This file is an engineering inventory, not legal advice. ## LGPL-2.1 statement for Open CASCADE Polyquote serves `assets/vendor/occt-import-js.wasm` publicly, so it distributes LGPL-2.1 code and owes recipients the rights that licence grants. This section records how those rights are satisfied. **What is distributed.** `occt-import-js` 0.0.22, and the Open CASCADE Technology code compiled into its WebAssembly binary. Both are LGPL-2.1. The full licence text ships alongside the binary as `assets/vendor/license.occt-import-js.txt` and `assets/vendor/license.occt.txt`. **The binary is unmodified.** The deployed files are byte-identical to the published npm package. `assets/vendor/manifest.json` records the SHA-384 digest and length of each, and `npm run check:vendor` re-verifies them against the lockfile installation on every CI run. The corresponding source is therefore upstream's, unchanged: at 0.0.22, which in turn builds Open CASCADE from . Polyquote holds no modified source to publish because it has made no modifications. **How the library can be replaced.** LGPL-2.1 section 6 exists so a recipient can modify the library and relink the combined work. The binary is not linked into Polyquote's bundle: it is a standalone file fetched at runtime by its own URL, and the loader takes that URL as a parameter. A recipient who builds their own `occt-import-js.wasm` — modified or not — can substitute it by serving their build in place of that file, with no change to and no rebuild of Polyquote's code. That is the section 6(b) shared-library mechanism rather than a static link, which is why no object files or relinking kit are required. **Written offer.** For three years from distribution, Polyquote will supply the complete corresponding source of the LGPL components above, at no more than the cost of distribution, on request to the address in the imprint. Because the binary is unmodified, that source is upstream's at the versions recorded here. **If a modified build is ever shipped**, this statement stops being true. The modified source must then be published, `npm run check:vendor` will fail against the manifest, and both this section and the manifest must be updated before distribution.