# Third-Party Notices — Ninebloom (root)

> This file aggregates the open-source components used across **client**,
> **landing**, and **server**. Each subproject also ships a copy as
> `client/THIRD_PARTY_NOTICES.md`, `landing/THIRD_PARTY_NOTICES.md`,
> `server/THIRD_PARTY_NOTICES.md`. The application source itself is
> proprietary (see `LICENSE`), while the dependencies below remain under
> their own licences.

Generated: 2026-09-16 (manual audit). Re-generate after dependency bumps
via `npx license-checker --production --summary` (client/landing) and
`pip-licenses --format=json --with-urls` (server).

---

## How compliance works

- **MIT / ISC / Apache-2.0 / BSD / CC0-1.0 / Unlicense / OFL-1.1** — permissive.
  You must retain the licence text when distributing a bundle. All are
  compatible with a proprietary application that *uses* them via npm/pip
  (dynamic linking). No source disclosure required.
- **LGPL-3.0-only** (`fpdf2`, `psycopg*`) — weak copyleft. Using unmodified
  pip wheels as a library is allowed in a proprietary app. If you modify
  the LGPL library itself, you must publish the modified library source
  and allow relinking. Do not statically vendor/fork these packages without
  legal review. Included LGPL notice in `server/THIRD_PARTY_NOTICES.md`.
- **GPL-2.0** (`pyphen` via `weasyprint`) — strong copyleft, but **only
  triggered on distribution** of the binary containing it. Running as SaaS
  (no customer-distributed Docker image) is NOT distribution under GPL-2.0.
  If you distribute a Docker image / on-prem build that contains `pyphen`,
  you must either (a) provide pyphen source + GPL text, or (b) build
  `weasyprint` without hyphenation (`-E "weasyprint[no-hyphenation]"` or
  `pip install weasyprint --no-deps` without `pyphen`). See server notice.
- **Unsplash Licence** — photos hotlinked from `images.unsplash.com` are
  NOT code; Unsplash Licence permits commercial use, no attribution required,
  but forbids compiling photos to replicate Unsplash. See
  `landing/ATTRIBUTION_IMAGES.md`.
- **OFL-1.1** (Manrope, Instrument Serif via Google Fonts) — permissive,
  requires retaining OFL text if you self-host the font files.
- **CC BY-SA 4.0** (MaxMind GeoLite2) — only applies if you ship the
  `GeoLite2-City.mmdb` file. Current deployment loads it from an env path;
  the file itself is not in git. Attribute MaxMind if you bundle it.

---

## Client — `client/package.json` (prod deps)

All MIT unless noted:

| Package | Version | Licence | Notes |
|---|---|---|---|
| `@hookform/resolvers` | ^5.2.2 | MIT | |
| `@radix-ui/react-*` (18 pkgs) | ^1–2 | MIT | headless primitives |
| `@tailwindcss/vite` / `tailwindcss` / `tw-animate-css` | ^4.2.1 / ^1.3.4 | MIT | |
| `@tanstack/react-query` / `react-router` / `react-start` / `router-plugin` | ^5.101 / 1.170 | MIT | |
| `class-variance-authority` / `clsx` / `tailwind-merge` | MIT | | |
| `cmdk` | MIT | | |
| `lucide-react` | **ISC** | MIT-compatible; tree-shaken | https://github.com/lucide-icons/lucide/blob/main/LICENSE |
| `thesvg` | **MIT** | SVG paths for brand icons; **brand trademarks** (Microsoft, Google, Zoho) remain property of their owners – see `client/TRADEMARK_NOTICE.md` |
| `country-list` | MIT | | |
| `libphonenumber-js` | MIT | | |
| `date-fns` | MIT | | |
| `dompurify` | Apache-2.0 / MIT (dual) | | |
| `embla-carousel-react` | MIT | | |
| `input-otp` | MIT | | |
| `qrcode` | MIT | generates data-URI client-side | |
| `react` / `react-dom` | MIT | | |
| `react-day-picker` | MIT | | |
| `react-hook-form` | MIT | | |
| `react-resizable-panels` | MIT | | |
| `recharts` | MIT | | |
| `sonner` | MIT | | |
| `vaul` | MIT | | |
| `vite-tsconfig-paths` | MIT | | |
| `zod` | MIT | | |

External SDK CDN: **Cloudflare Turnstile** (`https://challenges.cloudflare.com/turnstile/v0/api.js`) – governed by Cloudflare Terms – not an npm licence; CSP allow-listed.

## Landing — `landing/package.json` (prod deps)

Same as client minus `thesvg`/`qrcode` plus:

| Package | Version | Licence | Notes |
|---|---|---|---|
| `simple-icons` | ^16.30.0 | **CC0-1.0** | Brand SVGs under CC0; trademarks of brands retained |
| `lucide-react` | ISC | as above | |

Google Fonts: **Manrope** + **Instrument Serif** via `fonts.googleapis.com/css2?family=Instrument+Serif:ital@0;1&family=Manrope:…` – **SIL OFL-1.1** – https://openfontlicense.org – permitted; if self-hosted, ship `OFL.txt`.

## Server — `server/pyproject.toml` / `uv.lock` (109 packages)

Direct + key transitive:

| Package | Ver | Licence | Notes |
|---|---|---|---|
| `boto3` / `botocore` / `s3transfer` | 1.43.90 | Apache-2.0 | AWS SDK |
| `cryptography` | 50.0.1 | Apache-2.0 OR BSD | |
| `python-dotenv` | 1.2.3 | BSD-3-Clause | |
| `email-validator` | 2.3.0 | Unlicense | via Pydantic EmailStr |
| `fastapi` / `starlette` | 0.141.1 / 1.6.0 | MIT / BSD | |
| `geoip2` / `maxminddb` | 5.3.0 / 3.2.0 | Apache-2.0 | DB file CC BY-SA 4.0 if bundled |
| `httpx` / `httpcore` | 0.28.1 | BSD | |
| `langchain` / `langchain-core` / `langchain-openai` / `langgraph` / `langgraph-checkpoint-postgres` / `langsmith` | MIT | | |
| `openai` | 3.13.0 | Apache-2.0 | via langchain-openai |
| `psycopg` / `psycopg-binary` / `psycopg-pool` | 3.3.5 / 3.3.1 | **LGPL-3.0-only** | see LGPL notice |
| `supabase*` (`supabase`, `postgrest`, `storage3`, `realtime`, `supabase-auth`) | 2.31.0 | MIT | |
| `uvicorn` | 0.52.4 | BSD | |
| `fpdf2` | 2.8.8 | **LGPL-3.0-only** | |
| `weasyprint` | 70.0 | BSD | pulls `pyphen` GPL |
| `pyphen` | 0.18.1 | **GPL-2.0** | via weasyprint – SaaS OK; see note |
| `pillow` | 12.3.0 | MIT-CMU | via weasyprint |
| `fonttools` / `pydyf` / `tinycss2` / `cssselect2` / `pyphen` etc. | BSD/MIT | via weasyprint | |
| `pydantic` / `pyjwt` / `orjson` / `tenacity` / `tiktoken` | MIT / BSD / MPL | | |
| `pytest` (dev) | 9.1.1 | MIT | not shipped |

Full SBOM: `uv.lock` pins 109 packages with hashes. Reproduce via `uv pip compile` / `pip-licenses`.

---

## LGPL-3.0 Notice (fpdf2, psycopg)

This product uses `fpdf2` and `psycopg` under **GNU Lesser General Public
License v3.0**. You may obtain the source for these libraries from their
upstream repositories:
- https://github.com/PyFPDF/fpdf2
- https://github.com/psycopg/psycopg

They are used unmodified as dynamically linked libraries (pip wheels) in
accordance with LGPL §4. If you modify these libraries, you must make the
modified source available under LGPL-3.0.

## GPL-2.0 Notice (pyphen)

`weasyprint` optionally depends on `pyphen` (GPL-2.0) for hyphenation.
Running this server as a hosted service is **not** distribution and does not
trigger GPL source-distribution obligations. If you distribute a Docker image
or binary containing `pyphen`, you must comply with GPL-2.0 (provide source
and licence text) or rebuild `weasyprint` without `pyphen`.

## Attribution for non-code assets

- Fonts: see `client/ATTRIBUTION_FONTS.md`, `landing/ATTRIBUTION_FONTS.md`
- Images: see `client/ATTRIBUTION_IMAGES.md`, `landing/ATTRIBUTION_IMAGES.md`
- Icons/trademarks: see `client/TRADEMARK_NOTICE.md`, `landing/TRADEMARK_NOTICE.md`

## How to regenerate

```bash
# client / landing
npx license-checker --production --json --out /tmp/licenses.json
npx license-checker --production --customPath ./scripts/license-format.json

# server
pip install pip-licenses
pip-licenses --format=json --with-urls --with-license-file > /tmp/server-licenses.json
pip-licenses --format=markdown --with-urls > server/THIRD_PARTY_NOTICES.auto.md
```