feat(about): show open-source licences and check them at build time

[MerciHanrim]

Problem

Loop Studio ships third-party code and fonts without their notices. Measured on main d97ae72, with the three builds made with source maps:

What is shipped	Count	Licences
npm packages inside the scripts	28 (one in two versions)	MIT, ISC, BSD-3-Clause
of those, in the PWA build only	7 (idb and six workbox-*)	MIT, ISC
font packages (IBM Plex Sans, Mono, Sans Thai), 14 files	3	OFL-1.1
runtime code the build tools write into the output (vite, rolldown)	2	MIT

The built files contain no licence text at all: no licence comment in the scripts or the stylesheet, no licence or notice file in any build. MIT, ISC and BSD ask that the copyright notice and the permission text travel with the distribution, and OFL-1.1 asks the same for each copy of a font.

Nothing installed is under GPL, LGPL or AGPL, and no shipped package carries a NOTICE file, so this is a matter of showing notices, not of changing dependencies.

Proposal

The About dialog becomes:

• app name, version, build
• the current copyright line and the link to the source repository
• an Open-source licences button

The button opens a separate scrollable screen that lists, for every shipped item, the name, the version, the copyright holder and the full licence text. It works offline in the web, PWA and portable builds, and it covers fonts, icons, copied code and image assets, not only npm packages.

Separate from #296 and #300. #300 adds no library: it uses Web Crypto only.

Contract

The screen

• Reached from About, in every build flavour, with no network: the notices are part of the build, inlined in the portable file and precached in the PWA.
• One entry per shipped item: name, version, SPDX identifier, copyright lines, and the licence text as published. Licence texts are shown verbatim and are not translated; the surrounding UI strings follow the app language.
• Identical licence texts may be shown once and referenced by several entries, as long as each entry keeps its own copyright lines.
• An item that is not a package (a font, an icon, adapted code, an image) has the same fields plus its source.

The generated file

• The build writes THIRD_PARTY_NOTICES from what is really bundled: the bundler's module graph and the font files the build emits. It is not written by hand and not derived from the lockfile alone.
• The lockfile is not a substitute. Today it lists six packages that are not shipped (type declarations) and misses seven that are (the service-worker runtime comes from a development dependency).
• Non-package items come from a small registry in the repository that records source, copyright holder and licence for each.

The check fails the build on:

• a dependency whose licence is missing or cannot be identified
• a licence outside the allow-list
• a missing copyright line, or a NOTICE file that exists in the package but is not carried
• a difference between the real bundle and the notice list
• a new external asset with no source and licence recorded in the registry
• a registry entry whose provenance is still marked unresolved

GPL, LGPL and AGPL are never auto-allowed: they stop the build and go to a manual review, because a notice may not be all they ask for.

Decisions

1. The pure-JS inflate in src/model/share.ts — a blocking precondition. Its comment says it is adapted from "tiny inflate (public domain)". The words "public domain" are removed: tinf is under the zlib licence. Structure alone does not settle whether the code derives from tinf or from zlib's contrib/puff/puff.c, so neither is asserted as the origin. Either the code is replaced by an implementation whose origin is clear, or the origin is established from the repository's own record and then the exact zlib notice and an "altered" mark are added to the source. No notice list is generated before this is closed.
2. Loop Studio's own licence. About keeps the current copyright line; there is no separate licence link. The project's own licence is undecided and does not block the third-party notices. Opening the source under a licence is a separate decision by the owner.
3. Build-tool runtime. vite and rolldown are in the notice list: their code is in the shipped files and listing them costs two entries.
4. The allow-list. Only what is shipped today is auto-allowed: MIT, ISC, BSD-3-Clause, OFL-1.1. BSD-2-Clause, 0BSD and Apache-2.0 are not allowed in advance. A new licence is reviewed by hand once and then added; Apache-2.0 is added only together with its NOTICE handling.
5. The 20 inline SVG drawings. Until the author confirms where they come from they are recorded as provenance unresolved, not as own work. Drawings the author made, or that were generated for this project, go into the own-work registry. Any that followed an external icon is recorded with its source and licence.
6. The analytics script. It is injected by the host on the production origin and is in no build, so it is outside the licence screen. What it collects, whether it sets cookies and where it sends data is a separate privacy and analytics investigation. No wording about it goes into About before that is known.

Inventory (the full table is kept outside the repository until this is implemented)

• Scripts: react, react-dom, scheduler, use-sync-external-store, @xyflow/react, @xyflow/system, zustand (two versions), classcat, nine d3-* packages, intl-messageformat, three @formatjs/* packages; in the PWA also idb and six workbox-* packages.
• Build-tool runtime: the module-preload helper from vite and the module wrapper from rolldown.
• Fonts: 14 files from three @fontsource/ibm-plex-* packages, copyright IBM Corp., no Reserved Font Name declared.
• Own work with no third-party source: the four app icons (drawn by scripts/gen-icons.mjs), the bundled templates and examples.
• Provenance unresolved: the 20 inline SVG drawings; the pure-JS inflate.
• Twelve distinct licence texts among the packages, about 33 KB before compression.

Implementation gates

• Decision 1 is closed first. It is a product-code change of its own and needs its own approval.
• The registry of non-package items exists before the check is switched on, with the items above entered and no entry left unresolved.
• User-facing, so the PR carries a version bump and a release-note entry (feat(help): in-product What's new - release notes, the versioning rule and the Help menu #296).

Verification

• The list on the screen equals the generated file, and the generated file equals the packages found in the bundle, in each of the three builds.
• Adding a dependency with an unknown licence, a licence outside the four allowed, or a package with a NOTICE file that is not carried fails the build. So does adding a font or an image without a registry entry, and a registry entry marked unresolved.
• The PWA-only packages appear in the PWA build's list and not in the web build's.
• vite and rolldown appear in every build's list.
• The screen opens with the network off in the web, PWA and portable builds.
• Keyboard and screen-reader path, forced colours, right-to-left; licence texts keep their left-to-right direction inside a right-to-left UI.

Out of scope

• Choosing Loop Studio's own licence.
• The analytics script and anything else about privacy: a separate investigation.
• Replacing any dependency other than what Decision 1 may require.
• Legal review. This issue records the product structure; it is not legal advice.

Not verified

• The licence metadata inside the .woff2 files (the three .woff files do carry a copyright line and the OFL address).
• Which original, if any, the inflate was written from.

[MerciHanrim]

Decision 1 is closed: shipped in #316 (44af9a4), version 0.17.1, release date 2026-10-04. This issue stays open for the licence screen, the generated notice file, the build check, and the origin of the pure-JS SHA-256.

What was decided and done. The repository's own record does not establish where the pure-JS inflate in src/model/share.ts came from: the commit that added it cites no source, and its comment's "public domain" was not accurate. The inflate and the pure-JS deflate written beside it were therefore removed, not listed. Share links now use only the browser's own CompressionStream / DecompressionStream; every browser the build targets has both, and so does Chromium on a file:// page. On a page without them no plain or protected link is made or copied and no key is derived, and opening a #g1= or #p1= link shows one sentence, asks for no password, leaves the working diagram untouched and keeps the fragment in the address bar. docs/specs/SEMANTICS-U.md records the change in U13; the link format did not change.

Compatibility, both ways. Seven payloads made by the removed encoders on main at 938aae3 are pinned as test data and open through the native path, including an 18-node diagram opened as a link on the hosted build and in the portable file. In the other direction, a link made with the new build's Share button opened the same 18-node diagram in the 938aae3 build on the web and in its portable file, with DecompressionStream and with it removed so that the old build used its own inflater.

Verified. Pull request CI and main CI passed on the first attempt, all ten checks, with the five shards an exact partition of the 1,875 listed tests and no test retried. On the production deployment's own hash origin, in throwaway profiles with other origins blocked: plain and protected links are made and opened as before; an old link opens; without Compression Streams the outcomes above hold; About shows v0.17.1 and What's new starts with its three lines. Production serves the same index, entry and app chunk as that deployment, and none of its 42 scripts and stylesheets contains the removed code's tables or the words "public domain"; the previous deployment, used as a control, does contain the tables.

Not verified. Firefox and WebKit on file://. The browser versions that first shipped Compression Streams come from public compatibility data. The new message and the three release-note lines in the 16 languages other than English and Korean have had no native review.

Next, each with its own kickoff. The licence screen, the generated notice file and the build check. The pure-JS SHA-256 in src/model/workspace.ts goes into the list of non-package items as an in-repository implementation of unconfirmed origin; whether it is kept, replaced or removed is still open.

[MerciHanrim]

The second step is shipped: #317 (1ec21ee), still version 0.17.1, declared internal with no release note. This issue stays open for the licence screen, the generated notice file and the build check.

What was decided and done. The pure-JS SHA-256 in src/model/workspace.ts cited only FIPS 180-4, and the repository's record does not establish where its text came from. It is also the path the synchronous revision and proposal digest always takes, so it was replaced rather than removed: sha256Js keeps its name and synchronous signature and now calls sha256 from @noble/hashes/sha2.js. sha256Hex still uses Web Crypto first. fullContentDigest, which has no product caller, is unchanged.

The dependency. @noble/hashes 2.4.0, exact, MIT, "Copyright (c) 2022 Paul Miller", no dependencies of its own and no NOTICE file. The lockfile gained that one package. Four of its modules are bundled (sha2.js, _md.js, _u64.js, utils.js), adding 3,731 bytes of JavaScript, 1,444 gzipped. Its licence text is kept as input for the notice list.

The digests did not change. A baseline recorded with the replaced code on main at 44af9a4, before the change, is checked against the new code: 205 hash vectors and the 4 published ones, the digests of the 12 example diagrams, and the reader's outcome on the 8 example revision and proposal files.

Protected links stay Web Crypto only. check:share-crypto allows exactly this package, at this version, imported once in src/model/workspace.ts as sha256 from sha2.js. No other file may import it, and src/model/shareProtected.ts may not reach it, the workspace hash or the revision hash, directly or through another module. These conditions are tested with counter-examples.

Verified. Pull request CI and main CI passed on the first attempt, all ten checks, with the five shards an exact partition of the 1,875 listed tests and no test retried. Production serves the same files as its deployment and shows v0.17.1 · build 1ec21ee. On the production deployment's own hash origin, in throwaway profiles with other origins blocked, a revision file opens with its stored digest verified and a proposal applies, both over HTTPS with Web Crypto and on a non-local plain-HTTP address where the browser exposes no Web Crypto. Plain and protected share links behave as before.

Not verified. The Node version of the Cloudflare build is not visible from here; it builds with Vite 8, which needs the same Node versions as the package.

[MerciHanrim]

The first of the two pull requests for this issue shipped: #318, merged as 401238a. The issue stays open for the second one: the licence screen, its documentation and the release note.

• Every build now carries the third-party notices. The web and PWA builds have THIRD_PARTY_NOTICES.txt, and the PWA precaches it. The portable file carries the same text inside its HTML, in <template id="third-party-notices">.
• The web build and the portable file list 28 components, with byte-identical text. The PWA lists 37: the same 28 plus the service worker's six Workbox packages, idb, the workbox-build template, and the reviewed Apache-2.0 loader.
• licenses/third-party-manifest.json pins each build. A change in what ships fails the build until the manifest is updated and reviewed.
• Declared internal; the version stays 0.17.1 and there is no release note.
• Production (deployment 3198c41f, v0.17.1 · build 401238a) serves the PWA notices: 37 components, the manifest's SHA-256, precached by the service worker with the file's own MD5 as its revision.

[MerciHanrim]

The work for this issue is complete and in production. Closing it with what shipped, what was checked, and what is still not verified.

What shipped

• fix(share): links use only the browser's own Compression Streams; the bundled pure-JS zlib is removed (v0.17.1) #316 (v0.17.1, 44af9a4): share links use only the browser's own Compression Streams. The bundled pure-JS zlib, whose origin the repository's record did not establish, is removed; links it made still open.
• chore(hash): the synchronous SHA-256 is @noble/hashes, not hand-written code of unrecorded origin #317 (1ec21ee): the synchronous SHA-256 is @noble/hashes 2.4.0 (MIT) instead of hand-written code of unrecorded origin; every digest is byte-identical, pinned by a baseline recorded before the change.
• build(licenses): every build carries its third-party notices, checked against a committed manifest #318 (401238a): every build carries its third-party notices. THIRD_PARTY_NOTICES.txt in the web and PWA builds (the PWA precaches it) and the same text inside the portable file; web and portable list 28 components, the PWA 37. licenses/third-party-manifest.json pins each build, and a change in what ships fails the build until the manifest is updated and reviewed.
• feat(about): the third-party open-source licenses, in the About dialog (v0.18.0) #321 (v0.18.0, 91c03b5): About Loop Studio → Third-party open-source licenses shows the build's notices as text, in English, in the same dialog; the web and PWA builds also open them as a text file. A source check keeps the notices out of every HTML sink.
• Loop Studio's own notice is unchanged: "Copyright © 2026 Hanrim. All rights reserved." It is not described as open source anywhere.

Checked in production

• Deployment 67b33ef8 is byte-identical to production (page, scripts, stylesheet, sw.js, the notices file) and reports v0.18.0 · build 91c03b5.
• The served THIRD_PARTY_NOTICES.txt has the manifest's PWA SHA-256 (37 components), and the service worker precaches it with the file's own MD5 as its revision.
• With the network down, the licence view showed that text as one text node with the same SHA-256, and its file link opened the same bytes from the precache. The app registers its service worker only on the production origin, which these checks touch with plain requests only; for this check the deployment's own sw.js was registered by the test on the deployment's hash address.
• The same comparison passes in CI on the dev server, the production bundle, the PWA with the network down and the portable file.

Not verified, or still open

• The interface strings and release-note lines are in 18 languages; the 16 other than English and Korean have not been reviewed by a native speaker.
• No real screen reader has read the licence view; its name, roles and focus order are checked from the accessibility tree only.
• Browser coverage was not limited to Chrome: desktop Edge operation was manually checked, the v0.18.0 license screen was manually checked in desktop Firefox, and iPhone Safari was manually checked for the v0.17.0 protected share-link and copy-fallback flows. The v0.18.0 license screen was automated in Chromium but was not manually verified in Safari.
• The inline SVG drawings: compared with eight outside icon sets, there is no icon-level or shape-level exact match. One shape matches in geometry only: the minimap chevron and the arrowhead of the Feather/Lucide download icon, which differ in stroke width. It was decided to give it no notice and not to replace it. The drawings' origin is recorded as "drawings in the repository whose outside source could not be established"; that is not a confirmation that the project made them.
• The notices are generated from the bundle at build time. A dependency change needs npm run licenses:update and a review of the manifest diff, and a new Apache-2.0 component needs its own review entry.