Third-party licenses
This is our record of the third-party components Ceqio bundles and redistributes, and the licenses they are provided under. The curated attributions are also summarised on the open-source licenses page, and the complete per-package manifest, with the full text of every license, is at license manifest.
# Third-Party Licenses & Attributions Ceqio bundles and redistributes third-party components. This file is the **curated** repo-level record: the handful of components that carry a notice obligation worth reading in full, plus the shape of the dependency tree. **The complete per-package record is `THIRD_PARTY_MANIFEST.md`**, which carries the actual licence texts for every production dependency and every non-npm asset. It is generated, committed, and served to users at `/legal/licenses/manifest`. This file points at it and deliberately does not duplicate it — two copies of a licence record drift, and the one nobody regenerates is the one users are shown. | Where | What | |---|---| | `/legal/licenses` | the human-facing summary — DDS and Geist, the two obligations worth naming | | `/legal/licenses/third-party` | this file, served | | `/legal/licenses/manifest` | `THIRD_PARTY_MANIFEST.md` — every package, every licence text | Regenerate with `npm run licenses:manifest`; `npm run licenses:check` fails if the committed manifest has fallen behind the dependency tree, and runs in CI. --- ## DDS — Double Dummy Solver Ceqio ships `public/dds.js` / `public/dds.wasm`, an Emscripten/WebAssembly build of the DDS double dummy solver, and invokes it at runtime (web + Android APK, plus in-browser for board analysis and Deal Lab). Redistribution of this component requires retaining the notice below. - **Copyright** © Bo Haglund and Søren Hein. - **License:** Apache License, Version 2.0 — <https://www.apache.org/licenses/LICENSE-2.0> - **Source:** <https://github.com/dds-bridge/dds> > Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file > except in compliance with the License. You may obtain a copy of the License at > http://www.apache.org/licenses/LICENSE-2.0. Unless required by applicable law or agreed to > in writing, software distributed under the License is distributed on an "AS IS" BASIS, > WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. Apache-2.0 §4 requires that recipients be given a copy of the licence, not merely a link. The **full text** is reproduced in `THIRD_PARTY_MANIFEST.md` § 1. --- ## Geist & Geist Mono (fonts) Loaded through `next/font/google`, which **self-hosts** the files into the build output — so the `.woff2` bytes are served from our own origin. That is redistribution, and the OFL requires the copyright notice and licence to accompany the fonts. - **Copyright** © Vercel. - **License:** SIL Open Font License, Version 1.1 — <https://openfontlicense.org> Full text in `THIRD_PARTY_MANIFEST.md` § 1. ⚠️ The faces are bundled but not currently rendered for body text — `global.css` sets its own stack. **The notice stays anyway, because the files still ship.** Dropping a notice while continuing to serve the bytes is the mirror of the error `dfecc95` corrected; see `docs/UI_DESIGN.md` §0.9d. --- ## Non-npm assets (audio, artwork) The audio cues are **CC0** and the artwork is owner-created, so none of them carries an attribution obligation and none appears on `/legal/licenses`. They are nonetheless enumerated in `THIRD_PARTY_MANIFEST.md` § 1, because a manifest that omits owned work cannot answer "where did this file come from" — which is half of what the record is for. **Provenance is `docs/ASSET_SOURCES.md`**, and that file stays the authority: source URL, uploader, the licence as it read on the day, and what was changed. Record a new asset there the day you add it, and add it to `scripts/lib/license-manifest-data.mjs` in the same commit. ⚠️ **Naming a system font is not shipping one.** The playing cards resolve to `Tahoma, Geneva, Verdana, sans-serif` — faces the platform already licensed to the player — so nothing is redistributed and nothing is listed. The test for the next asset is the same one: *do we serve the file?* --- ## Application libraries (npm) 274 production entries in `package-lock.json`. devDependencies are excluded throughout: they build and test the app, they are not part of it, and they are never distributed. Composition, derived from the lockfile rather than a remembered scan: **MIT 190, Apache-2.0 27, ISC 12, LGPL-3.0-or-later 10, FSL-1.1-MIT 9, BSD-2-Clause 8, BSD-3-Clause 5, BlueOak-1.0.0 5, Apache-2.0 AND LGPL-3.0-or-later 3, Apache-2.0 AND LGPL-3.0-or-later AND MIT 1, CC-BY-4.0 1, MIT-0 1, 0BSD 1, (MIT OR CC0-1.0) 1.** No problematic copyleft reaches the client bundle. The non-permissive lines resolve to: - **`LGPL-3.0-or-later` (10) and the two `Apache-2.0 AND LGPL-…` combinations (4)** — every one is an `@img/sharp-*` / `@img/sharp-libvips-*` **platform-gated native binary** (libvips, behind Next.js image optimization). Server/build-side only, never bundled into the client or shipped in the APK, so the LGPL obligations do not bite for a hosted app or a Capacitor build. - **`FSL-1.1-MIT` (9)** — `@sentry/cli` and its per-platform binaries. A build/release tool; it converts to MIT on a schedule and is not distributed to users either way. - **`CC-BY-4.0` (1)** — `caniuse-lite`, build-time browser-support *data*, never served. - **`(MIT OR CC0-1.0)` (1)** — dual-licensed, taken as MIT. ⚠️ **The old "UNLICENSED" line is gone and its absence is not an omission.** It was `ceqio@0.1.0`, our own root package, which the manifest excludes along with the rest of the lockfile root — a manifest of *third-party* material should not list us. ⚠️ **A count is not a notice.** MIT, BSD and ISC each require the copyright notice and permission text to travel with copies of the software, and a summary like the one above carries not one copyright line. That is what `THIRD_PARTY_MANIFEST.md` exists to discharge, and why it became due at APK time: shipping a bundle containing React and the Next runtime is distribution in a way that serving a page from our own box arguably is not. --- _Body text uses the system font stack, which requires no attribution._