# Third-party notices

Projects & Notes uses independently licensed material. CUAL 1.0 applies to project-owned covered source; it does not replace the terms of these dependencies, copied components, tooling or assets.

- OpenAI's Sites Vite plugin and supplied build integration: preserve `build/sites-vite-plugin.LICENSE` (MIT)
- shadcn components and Tailwind stylesheet: preserve `vendor/shadcn-tailwind-4.13.0.LICENSE.md` (MIT)
- React and React DOM (MIT), Next.js (MIT), Vinext (MIT), Lucide React (ISC), jSquash PNG (Apache-2.0), Base UI (MIT), class-variance-authority (Apache-2.0), clsx (MIT), and tailwind-merge (MIT): unmodified installed license notices and package/version/file hashes are supplied in `third-party/`

## Image and connector subcomponents

- jpeg-js 0.4.4 is imported by the runtime image normalizer. Preserve its root BSD-3-Clause notice, the separate notmasteryet Apache-2.0 decoder header, and the Adobe BSD encoder header from that pinned package. The encoder notice is retained for the package export; this does not claim that the app invokes JPEG encoding.
- jSquash PNG 3.1.1 includes a separate Google BSD codec notice at codec/LICENSE.codec.md, in addition to its Apache-2.0 package license. Both are preserved for the PNG WASM codec used by the image normalizer.
- zod 3.25.76 supplies the zod/v4 connector-support import in lib/connector-errors.mts. Its MIT notice is preserved; this is not a claim that every connector-support module renders on every page.
- Drizzle ORM 0.45.2 supplies the SQLite schema declarations in db/schema.ts. This is a schema/build source dependency, not a claim of runtime ORM queries. Its npm package omits LICENSE, so the Apache-2.0 text is preserved from the official 0.45.2 tag at immutable revision 273c78071d4841b497f5144734b38294df7ec64b. The version was verified in that revision's package.json; provenance records both exact URLs.

Full notice bytes, versions, integrity references, header selections and source roles are recorded in third-party/PROVENANCE.json. Apache-2.0 full terms are included with the jSquash and Drizzle notices; the JPEG decoder's distinct copyright header is also preserved.

The dependency lock records exact resolved packages, integrity hashes and recorded license metadata, including separately licensed transitive and platform-specific build dependencies. A metadata label is not a replacement for a package's full terms. Dependencies are installed from their package distributions; node_modules and compiled dependency bundles are not included in the corresponding-source archive. Package versions and notices must be reviewed if dependencies change.

The four project previews are public interface screenshots. Their hashes and provenance are recorded in `ASSET_PROVENANCE.json`. The Linefeed preview displays its built-in generic script; the Mic Swap preview displays its synthetic demo; no private feedback, notebooks or user uploads are included. Referenced projects and independently licensed UI material retain their own terms.

Canonical original project and contributor records are in `ATTRIBUTION.md`. This notice does not assert ownership of third-party work or relicense it under CUAL.
