# License inventory and review limits

Generated: 2026-10-23T10:08:17.846Z

## What was checked

- Installed package.json files and package-lock.json for 478 direct/transitive npm packages (112 runtime; 366 development). Platform-specific optional packages not installed are listed separately in inventory.json.
- Actual LICENSE, LICENCE, COPYING, NOTICE, COPYRIGHT and third-party notice files anywhere inside each installed package, including Next.js bundled vendor notices; nested node_modules are handled as separate packages. All found texts are preserved in THIRD-PARTY-NOTICES.txt with original source paths and SHA-256 hashes in inventory.json. Where a package omits a license file, full license text embedded in its README, same-project installed package texts, or explicitly pinned official upstream texts are preserved as supplements and labeled separately in inventory.json. These supplements do not prove complete binary component coverage.
- 8 locally distributed JS/WASM files from @litert-lm/core 0.18.0. Hashes are recorded and compared with the installed npm package. npm package resolved URLs and integrity values are retained.
- Official LiteRT-LM v0.18.0 source tag b2f686e2ed4718fb84ec398a61dd59ca0f0aff27, its entire untruncated repository tree, root Apache license, and WASM download script. License/notice paths found: LICENSE. No binary-specific third-party notice bundle was found in the npm package or this source tree.
- Official LiteRT wasm-utils 2.5.3 source snapshot 3448dcddc7810ee1fccd3b4c3c8df18c7b0d36ed, matching package metadata and root Apache text. This is a same-version source snapshot, not a verified reproduction of the npm build.
- Model conversion card and file inventory pinned to e301f74d5551b0c2641bd5cb4652a76239d5c5f8; the Google base card is pinned to 914f7f89142e33e77833254d9c9b90c3cef7303b. Full cards and original upstream texts are distributed under upstream/, with fetch dates and SHA-256 provenance.
- Official shadcn/ui registry source is preserved with its MIT text pinned to c6bcc126efb9ffa28218f39a931b6cc572fa8473; component styling changes use shared semantic color tokens and stronger focus indicators. The react-remove-scroll-bar package omits a license file, so its official upstream MIT text is supplied from snapshot 8ca9ba5ea52de03308fe8ced94f7b159a44d28ff as a supplemental source, without claiming an exact npm build mapping.

## Mediabunny source and MPL notice

Mediabunny 1.61.3 is used without editing its package files. Its original MPL-2.0 text is preserved in THIRD-PARTY-NOTICES.txt. Version source: https://github.com/Vanilagy/mediabunny/tree/v1.61.3. The npm archive also contains the source directory: https://registry.npmjs.org/mediabunny/-/mediabunny-1.61.3.tgz. Recipients can obtain the version's source through those addresses. If covered files are modified and distributed, preserve their MPL notices and make the covered source/modifications available under MPL-2.0. The application has its own separate source files.

## Model terms

EmbeddingGemma 2 is authored by Google DeepMind. The pinned conversion declares Apache-2.0 and links the Google base model card. MODEL-LICENSE.txt supplies the actual Apache license text, also included in the notice bundle. No separate LICENSE/NOTICE file was present in the pinned conversion's file inventory; none was fabricated. The base card states that deployments must adhere to the Gemma Prohibited Use Policy: https://ai.google.dev/gemma/prohibited_use_policy. Read the upstream policy when using or distributing a deployment.

The model is downloaded from the pinned public Hugging Face revision at runtime; it is not checked into this application. Publisher LFS hash/size is recorded when available, rather than represented as a byte inspection by this audit.

## Items requiring further distribution review

- The npm LiteRT-LM package and official v0.18.0 repository tree do not provide a binary-specific third-party notice bundle or a complete component/version inventory for these WASM files. Apache metadata and matching file hashes do not establish the licenses of every linked component. Obtain the binary-specific upstream inventory and required notices before distributing the runtime commercially.
- The LiteRT-LM v0.18.0 source tag and matching-version wasm-utils source snapshot are documented, but the npm publisher provides no gitHead linking the exact packaged binaries to a source build configuration. The WASM build was not reproduced or symbol-audited.
- The converted model is Apache-2.0 according to its pinned model card; its repository provides no separate LICENSE or NOTICE. The actual Apache text is supplied here from Google's repository, with authorship retained from the base card. Model bytes were not examined by this license audit.

## Package warnings

- missing-license-text: @esbuild/darwin-arm64@0.28.2 (development; MIT)
- missing-license-text: @humanfs/types@0.15.0 (development; Apache-2.0)
- missing-license-text: @img/sharp-libvips-darwin-arm64@1.3.4 (runtime; LGPL-3.0-or-later)
- missing-license-text: @next/env@16.4.2 (runtime; MIT)
- missing-license-text: @next/eslint-plugin-next@16.4.2 (development; MIT)
- missing-license-text: @next/swc-darwin-arm64@16.4.2 (runtime; MIT)
- missing-license-text: @rolldown/binding-darwin-arm64@1.2.13 (development; MIT)
- missing-license-text: @types/json5@0.0.29 (development; MIT)
- missing-license-text: @unrs/resolver-binding-darwin-arm64@1.12.2 (development; MIT)
- missing-license-text: eslint-config-next@16.4.2 (development; MIT)
- missing-license-text: keyv@4.5.4 (development; MIT)
- missing-license-text: language-subtag-registry@0.3.23 (development; CC0-1.0)
- missing-license-text: language-tags@1.0.9 (development; MIT)
- missing-license-text: natural-compare@1.4.0 (development; MIT)
- missing-license-text: stable-hash@0.0.5 (development; MIT)
- missing-license-text: unrs-resolver@1.12.2 (development; MIT)

## Reproducing the inventory

Run npm run licenses after npm ci and the runtime copy step. Checked-in pinned upstream snapshots are reused, so normal regeneration does not require a network connection. Pass --refresh-upstream to the script to re-fetch those exact pinned sources. The Gemma policy link remains online and may change independently.

This is a package/file inventory and preservation report. It does not certify that every component linked into a binary has been identified or that a commercial distribution is cleared.