# Third-party notices for the compiled Blueprint

This directory is the license and provenance bundle for the static site under
`blueprint/web/`. `scripts/build_blueprint_site.py` copies it byte-for-byte to
`blueprint/web/third-party/` after every render. It covers the renderer output,
the browser libraries copied into that output, and the native libraries inside
the WebAssembly files. Project-authored Blueprint prose and
`styles/extra_styles.css` remain covered by the repository's Apache-2.0
license.

## Renderer packages

The release render uses these exact Python distributions:

The complete transitive environment, including all renderer-library versions
and accepted distribution SHA-256 hashes, is locked in
[`blueprint/renderer-requirements.txt`](https://github.com/gersh/ternary-goldbach-lean/blob/main/blueprint/renderer-requirements.txt).
The four
components below are the packages that generate or copy material into the
served site; their transitive Python dependencies do not themselves contribute
shipped browser assets.

| Component | Version | Generated or copied site material | License/source |
| --- | ---: | --- | --- |
| LeanBlueprint | 0.0.20 | HTML templates and `styles/blueprint.css` | Apache-2.0; [tag `v0.0.20`](https://github.com/PatrickMassot/leanblueprint/tree/v0.0.20) |
| plasTeX | 3.1 | HTML, generated theorem CSS, themes, `plastex.js`, `symbol-defs.svg` | MIT; [tag `3.1`](https://github.com/plastex/plastex/tree/3.1) |
| plastexdepgraph | 0.0.5 | dependency-graph HTML/CSS and the D3/Graphviz runtime below | Apache-2.0; [tag `0.0.5`](https://github.com/PatrickMassot/plastexdepgraph/tree/0.0.5) |
| plastexshowmore | 0.0.2 | `showmore.js`, `showmore.css`, and js-cookie below | Apache-2.0; [tag `0.0.2`](https://github.com/PatrickMassot/plastexshowmore/tree/0.0.2) |

LeanBlueprint and plastexdepgraph each ship this required NOTICE text:

> Copyright 2020-2024, Patrick Massot

plastexshowmore 0.0.2 ships no NOTICE file. The PyPI classifiers for these
three Patrick Massot packages say MIT, but the actual `LICENSE` files in the
sdists/wheels and corresponding tags are Apache-2.0. The copied license files
are the authority used here.

## Bundled browser and WebAssembly components

| Component | Version or exact identification | Site files | License/source |
| --- | --- | --- | --- |
| jQuery | 1.11.1, exact npm release with the dangling map directive removed as described below | `js/jquery.min.js` | MIT; [release source](https://github.com/jquery/jquery/tree/1.11.1) |
| svgxuse | 1.1.20, exact upstream bytes | `js/svgxuse.js` | MIT; [tag `v1.1.20`](https://github.com/Keyamoon/svgxuse/tree/v1.1.20) |
| D3 | 5.15.0, exact npm bytes | `js/d3.min.js` | BSD-3-Clause; [tag `v5.15.0`](https://github.com/d3/d3/tree/v5.15.0) |
| d3-graphviz | source-equivalent to 3.0.4-alpha.1, 3.0.4, and 3.0.5; see notes below | `js/d3-graphviz.js` | BSD-3-Clause; [releases](https://github.com/magjac/d3-graphviz/releases) |
| @hpcc-js/wasm | 0.3.13, exact npm bytes | `js/hpcc.min.js`, `js/graphvizlib.wasm`, `js/expatlib.wasm` | Apache-2.0; [tag `v0.3.13`](https://github.com/hpcc-systems/hpcc-js-wasm/tree/v0.3.13) |
| Graphviz | 2.44.0, pinned by the hpcc-js/wasm 0.3.13 build script | inside `graphvizlib.wasm` | EPL-1.0; [release source](https://gitlab.com/graphviz/graphviz/-/tree/stable_release_2.44.0) |
| Expat | 2.2.9, pinned by the hpcc-js/wasm 0.3.13 build script | inside both WASM modules | MIT; [tag `R_2_2_9`](https://github.com/libexpat/libexpat/tree/R_2_2_9) |
| js-cookie | 3.0.1, exact npm bytes | `js/js.cookie.min.js` | MIT; [tag `v3.0.1`](https://github.com/js-cookie/js-cookie/tree/v3.0.1) |
| IcoMoon-Free | 2016 upstream snapshot | selected glyphs in `symbol-defs.svg` | CC BY 4.0 (chosen from the upstream CC BY 4.0/GPL dual license); [source snapshot](https://github.com/Keyamoon/IcoMoon-Free/tree/d006795ede82361e1bac1ee76f215cf1dc51e4ca) |

### d3-graphviz identification limit

`plastexdepgraph` does not record a d3-graphviz package manifest. Its unmodified
packaged file has SHA-256
`e268e178923f808d8af3d3bb1c523a1ba6361e5bae5f80998382ee8bca2f755f`.
The adjacent upstream source map (not served) has SHA-256
`1c5a7c103e7fb1a7f83031b9fb493c8f1ca22d5ed670f636c8d448d32c75af2`.
Its ordered `sourcesContent` digest is
`4138b1aaba08b7dd34b4cb2de508d4a172a04572fed38d140bb90ff8f535d9bf`,
which exactly matches npm releases 3.0.4-alpha.1, 3.0.4, and 3.0.5. Those
three releases contain identical source content, while this copy was produced
with different Rollup/transpiler output, so a more specific release label
cannot be established from the preserved artifacts. The code first entered
LeanBlueprint in commit
[`de904738b9723d84cb18acbe6f2b5998cf12e86a`](https://github.com/PatrickMassot/leanblueprint/commit/de904738b9723d84cb18acbe6f2b5998cf12e86a)
and moved to plastexdepgraph in commit
[`9d12a20057c76f028031e4418bab7d73d3402a9e`](https://github.com/PatrickMassot/plastexdepgraph/commit/9d12a20057c76f028031e4418bab7d73d3402a9e).
All three candidate releases use the same BSD-3-Clause license and copyright
notice reproduced here.

### Source-map normalization

The renderer copies a `d3-graphviz.js` directive for
`d3-graphviz.js.map`, but it does not copy that map into the site. Its jQuery
1.11.1 file likewise names `jquery.min.map`, which is not present in the
plasTeX 3.1 distribution. The site builder removes exactly those two final
`sourceMappingURL` comment lines and rejects every remaining JS/CSS map
directive. It does not alter executable code. Before this normalization, the
jQuery file has SHA-256
`4b940065e2a67c37e3bd02b23c651f4744a3c219aba2d4fb99a631113494d376`;
the unmodified d3-graphviz hash is recorded above. The byte inventory below
records the files actually shipped.

### IcoMoon-Free attribution

The selected icon work is **IcoMoon-Free** by **Keyamoon**. It is used under
[Creative Commons Attribution 4.0 International](https://creativecommons.org/licenses/by/4.0/).
plasTeX selected glyphs, rescaled their paths from a 16-unit to a 32-unit
viewbox, and combined them into `symbol-defs.svg`; the `mindmap` glyph is a
separate plasTeX theme contribution. No endorsement by Keyamoon is implied.

### Externally loaded MathJax

The HTML references MathJax 3.2.2 from jsDelivr with a fixed URL and SRI hash.
MathJax is Apache-2.0, but its bytes are not committed in or uploaded from this
site artifact. See [MathJax 3.2.2](https://github.com/mathjax/MathJax/tree/3.2.2).

## Byte inventory

These hashes describe the final normalized files served by the site:

| Site path | SHA-256 | Provenance |
| --- | --- | --- |
| `js/d3-graphviz.js` | `47316e8de2bc39b8ddc0f99d553c7cce4f96d7395bcb7f6ed2fc5edbc03bd6f6` | plastexdepgraph 0.0.5 / d3-graphviz and normalization notes above |
| `js/d3.min.js` | `9b442622c05770e322113466a53dea836210fe2d2a6b3240da68821f33a64b56` | D3 5.15.0 |
| `js/expatlib.wasm` | `3a97493daaa71c38c02f7b67b2d79a93845b0f8824403ae0c15dadb27cef1893` | hpcc-js/wasm 0.3.13 / Expat 2.2.9 |
| `js/graphvizlib.wasm` | `d0b94b72100d77383de7e2f2afc344c3f613d1cd453e9cbf264759d7d2c62d86` | hpcc-js/wasm 0.3.13 / Graphviz 2.44.0 / Expat 2.2.9 |
| `js/hpcc.min.js` | `5b89eaba7e26acaf24e50279dde60ef33a1833e037ea18dd3b465ba49456c369` | hpcc-js/wasm 0.3.13 |
| `js/jquery.min.js` | `540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441` | jQuery 1.11.1 after map-directive normalization |
| `js/js.cookie.min.js` | `d07dcdbb3ddaba0dda7d56d496cbb5d8fbb1bdadc23f812126d3c4c6ab39e158` | js-cookie 3.0.1 |
| `js/plastex.js` | `50906c5f6f4f2a5a908a8d4d239d0c7ba63efc672227c02a1c7295ae3d112a3e` | plasTeX 3.1 |
| `js/showmore.js` | `501931cec2f8a230c505494680a23522b9293459d38cdb806a030e4d058cb17a` | plastexshowmore 0.0.2 |
| `js/svgxuse.js` | `0babbf27b9a172566e74d8e3e282760dbeb4974240510a501cc7cf29ed720e80` | svgxuse 1.1.20 |
| `styles/amsthm.css` | `0f673aad2c52db8c76a321b550dbdd24adf6badb1d4822a04a9b6a0257cf6ba1` | generated by plasTeX 3.1 |
| `styles/blueprint.css` | `515a7d9e0f37cb3a7ee974f9a003efd172b64144dc1b0c074f68bdd34a79a580` | LeanBlueprint 0.0.20 |
| `styles/dep_graph.css` | `80625482aec24cfa4d93e59aa278e3e6f39ba7dbf5efdeefac9b866a8b5763d0` | plastexdepgraph 0.0.5 |
| `styles/showmore.css` | `ceae58e215ee0ddc45c3e062b6700c0c72425ce05d75507070af9e681d88d4d8` | plastexshowmore 0.0.2 |
| `styles/theme-blue.css` | `0971a0d82a77340b3224577d7a1a436a9823a2ffb55388d15c38df7b17a5ae54` | plasTeX 3.1 |
| `styles/theme-green.css` | `8ee1e7f7058175497cab53acf2d3eaf949f8f7627fdd69655c01c8d531368886` | plasTeX 3.1 |
| `styles/theme-white.css` | `c6296062b86c41fd8ece73838d319bedba0bacf5c59e0036b90d34c9d8e6592e` | plasTeX 3.1 |
| `symbol-defs.svg` | `4c67d8eee1e29b8faaec6b44685dc89d06a682a5b0107e7aadde087f2c7ebb3a` | plasTeX 3.1 / IcoMoon-Free attribution above |

## Included license texts

- [`LICENSE-Apache-2.0.txt`](LICENSE-Apache-2.0.txt): LeanBlueprint,
  plastexdepgraph, plastexshowmore, and @hpcc-js/wasm.
- [`LICENSE-plasTeX.txt`](LICENSE-plasTeX.txt): plasTeX.
- [`LICENSE-jQuery.txt`](LICENSE-jQuery.txt): jQuery.
- [`LICENSE-js-cookie.txt`](LICENSE-js-cookie.txt): js-cookie.
- [`LICENSE-svgxuse.txt`](LICENSE-svgxuse.txt): svgxuse.
- [`LICENSE-Expat.txt`](LICENSE-Expat.txt): Expat.
- [`LICENSE-D3.txt`](LICENSE-D3.txt): D3.
- [`LICENSE-d3-graphviz.txt`](LICENSE-d3-graphviz.txt): d3-graphviz.
- [`LICENSE-Graphviz-EPL-1.0.txt`](LICENSE-Graphviz-EPL-1.0.txt): Graphviz.
- [`LICENSE-IcoMoon-Free.txt`](LICENSE-IcoMoon-Free.txt): IcoMoon-Free's
  upstream dual-license notice; this distribution selects CC BY 4.0.