# Third party notices

CoreLinks owns this prototype's UI, file policies, worker protocol, integration,
conversion disclosures, and validation code. The following standard libraries
are distributed as local dependencies. No external viewer application is embedded.

| Component | Pinned source | License notice |
| --- | --- | --- |
| Three.js renderer and selected format/controls/utilities addons | three 0.186.1 (npm registry; lockfile integrity retained) | [MIT](vendor/three/LICENSE) |
| fflate compression library (official security override for Three.js addon) | fflate 0.8.3 (unmodified npm esm/browser.js; lockfile integrity retained) | [MIT, Arjun Barrett](vendor/three/FFLATE-LICENSE) |
| XML DOM parser | @xmldom/xmldom 0.9.12 (npm registry) | [MIT](vendor/xmldom/LICENSE) |
| PDF.js display/worker runtime | pdfjs-dist 6.4.299 (npm registry; isolated lockfile integrity retained) | [Apache-2.0](vendor/pdfjs/LICENSE) |
| PDFium/Foxit standard font replacements (10 unmodified .pfb files) | pdfjs-dist 6.4.299 | [PDFium BSD-style notice](vendor/pdfjs/standard_fonts/LICENSE_FOXIT) |
| Liberation Sans standard-font fallbacks | unmodified official upstream1.07.4 release, with same-version preferred source | [GPLv2 plus font exception](vendor/pdfjs/standard_fonts/LICENSE_LIBERATION); [complete preferred source](vendor/pdfjs/font-source/liberation-fonts-1.07.4.tar.gz) |
| Adobe predefined CMaps | pdfjs-dist 6.4.299 | [Adobe redistribution notice](vendor/pdfjs/cmaps/LICENSE) |
| OCCT import wrapper, preserved originals and identified loader/memory derivatives | occt-import-js 0.0.23; wrapper c2148e54b456b571238d35cac037d304053d64b2, OCCT d2abb6d844231cb8f29be6894440874a4700e4a5 | [Wrapper LGPL-2.1](vendor/occt/license.occt-import-js.txt), [OCCT LGPL-2.1](vendor/occt/license.occt.txt), [OCCT header exception](vendor/occt/OCCT_LGPL_EXCEPTION.txt), [changes/date](vendor/occt/MODIFICATIONS-0.7.md) |
| Emscripten runtime and CSP closure adaptation reference | Emscripten 3.1.69 | [MIT/NCSA](vendor/occt/license.emscripten.txt) |

`tools/vendor.mjs` maps bare Three.js imports to local modules and wraps the
unchanged xmldom CommonJS modules in static function factories. These packaging
changes use no eval. `vendor/manifest.json` records exact source and SHA-256.
The fflate module and license are copied unmodified from its official v0.8.3 npm package; the Three.js addon import path is retained.

PDF.js runtime remains unmodified. The fixed package standard14 fonts are selected with their license notices. Four Liberation Sans1.07.4 fonts are taken unmodified from the official upstream TTF release and supplied alongside the same upstream release preferredSFD source and build files. Earlier Mozilla-supplied font bytes and their acquisition receipt remain historical private checkpoints. No byte-identical rebuild or pixel equality is claimed. See docs/font-official-release-0.7.json.

Preserve these notices and the license files when redistributing the source or
eventual binaries. No paid SDK, royalty contract, hosted converter, or CDN is used.


## Source-built CAD release0.7

The active runtime is independently compiled from the fixed wrapper/kernel source plus identified CoreLinks CMake/C++ modifications. Link-time512MiB memory maximum and DYNAMIC_EXECUTION0 replace the historicalbinary/JS patches. The delivered CAD source kit, Emscripten source asset and product source/replacement helper are offered beside the binaries; the previous0.5/0.6 originals remain private checkpoints. Source and recipient replacement verification receipts describe the actual scope.

Emscripten SDK release8fe01288bc35668c13316324336ea00195dfb814 reports3.1.69 and installedsource revisionc55ff404dbe1eb9f263c48b584d5ba627224763a. Runtime/generator/system sources match the official3.1.69 tag; SDK version/package metadata differences are retained and explained in the source archive. The selected embedded-runtime notices are under vendor/occt/runtime-notices; preservingextra notices does not assert every listed component is linked.