# Third-party notices — TrophyMed / Trace_Tool

**Compiled 2026-08-14** against `main`; **revised 2026-08-19** — added the
distribution posture in §0.1 (counsel's question), corrected the `html2pdf`
inner versions against the shipped bytes (§2.3), and published the notices
where the recipients of the code can read them (§5). **Revised 2026-08-20** —
recorded the scholarly bibliographic sources behind FINDER Literature (§6.1)
and the abstract-copyright question they raise (§6.2). No npm dependency
changed, so §§1–2 and the counts in §0 are unaffected. This is the complete
inventory of
third-party software, fonts, icons and data incorporated into or distributed
with the TrophyMed platform, together with the licence each is used under and
the obligations that attach.

> **Status: internal compliance record and drafting input for counsel.** It
> was compiled by resolving the actual dependency trees and reading the actual
> licence identifiers, not from recollection. It has not been reviewed by an
> attorney.

**Nothing here is copyleft-binding on TrophyMed's own source.** Every
component is permissive (MIT / ISC / BSD / Apache-2.0 / OFL / Zlib), or is
dual-licensed with a permissive option that we elect. TrophyMed's own code
remains proprietary and unpublished.

---

## 0. Summary for counsel

| | Count |
|---|---|
| npm packages, server side (run in Vercel Functions) | **26** |
| npm packages, browser side (bundled into vendored libraries) | **73** \* |
| Icon set (vendored SVGs) | 1 (95 files) |
| Typeface | 1 (14 subset files) |
| Reference data corpora | 3 bundled + 1 local-only |

\* 71 resolved from registry metadata, plus `tslib` and `core-js-pure`, which
only the shipped bytes reveal (§2.3).

**Six items need a decision or an action, and are listed here rather than
buried below:**

1. **`dompurify` — `MPL-2.0 OR Apache-2.0`. ★ We elect Apache-2.0.** This is
   the only weak-copyleft option anywhere in the tree: under MPL-2.0,
   modifications to *those files* would have to be published. We do not modify
   it, and electing Apache-2.0 removes the question entirely. Reached via
   `jspdf` → `canvg` inside the html2pdf bundle.
2. **`jszip` 2.7.0 and `pizzip` 3.2.0 — `MIT OR GPL-3.0`. ★ We elect MIT.**
   Two separate components. An automated scan will report "GPL-3.0" for both;
   the election is what answers it.
3. **Apache-2.0 components carry real obligations** the MIT ones do not —
   attribution, a copy of the licence, and a statement of changes if modified.
   Eleven components: `xlsx` and its eight SheetJS dependencies, Mozilla
   `pdf.js` embedded inside `pdf-parse`, and the Microsoft TypeScript helper
   runtime inside the `html2pdf` bundle (§2.3). Plus `dompurify` by election.
   The licence copy is at
   [`licenses/Apache-2.0.txt`](licenses/Apache-2.0.txt), and is served to
   users at `/legal/licenses/Apache-2.0.txt` (§5).
4. **`pdf-parse` declares MIT but embeds Mozilla `pdf.js`, which is
   Apache-2.0.** The npm metadata does not surface this. It is a whole
   Apache-2.0 library inside an MIT package, and a scanner reading metadata
   alone will miss it.
5. **`rgbcolor@1.0.1` declares `MIT OR SEE LICENSE IN FEEL-FREE.md`** — a
   non-standard identifier (the file says the author does not care what you
   do with it). Effectively permissive; flagged because it is the one licence
   string in 97 packages that a human should read rather than parse.
6. **`atob` / `btoa` — `MIT OR Apache-2.0`. We elect MIT** (simplest, no
   NOTICE obligation).

### 0.1 Distribution posture — what is shipped, what merely runs

Asked by counsel 2026-08-19: *are these packages distributed to end users, or
merely run remotely?* **Both, and the split is exactly the §1 / §2 boundary.**
The dividing line is not "open source or not" but **does a verbatim copy reach
the user's machine** — that is what every licence here uses as its trigger
word (MIT "copies or substantial portions", Apache-2.0 §4 "reproduce and
distribute copies", OFL "distributed").

| | **Tier A — run remotely** | **Tier B — distributed** |
|---|---|---|
| What | §1: 26 npm packages | §2–4: 73 npm packages in 5 vendored files, 95 Lucide SVGs, 14 Inter subsets |
| How it reaches a user | It does not | `<script src>` / `<link>` on every load of `/app` (`public/app/index.html:4065–4081`) |
| Where it runs | Vercel serverless functions | The user's browser |
| Attribution owed | **No** | **Yes — and it must travel with the copy** |

**Tier A — executed remotely, never distributed.** Four direct dependencies
resolving to 26 packages, installed by Vercel at build time and executed only
inside our functions. No copy leaves our infrastructure, so no
distribution-triggered obligation fires. ★ This is safe **only because nothing
in the tree has a network-use clause** — AGPL-3.0, SSPL, OSL and Commons
Clause treat remote interaction itself as the trigger and would attach here.
That, not "it is server side", is the test. Everything in §1 is MIT, BSD-3 or
Zlib. The Apache-2.0 Mozilla `pdf.js` inside `pdf-parse` sits in this tier, so
its §4 duties are dormant — dormant, not discharged. ★ `pizzip` is the same
`MIT OR GPL-3.0` dual licence as its browser-side twin `jszip`, and we elect
MIT for both; note that on this side even the GPL option would not bite,
because GPL-3.0 obligations attach to **conveying** and nothing here is
conveyed. The election matters for `jszip` (Tier B) and is belt-and-braces
for `pizzip`.

**Tier B — distributed.** Every page load of `/app` transmits verbatim copies
of the five vendored bundles, the icon set and the font to the user's machine.
Serving over HTTP rather than shipping on a disk changes nothing about the
analysis. All of the attribution obligations in §5 live here.

★ **This is why the elections in items 1, 2 and 6 above are load-bearing, and
why they are load-bearing only in this tier.** `jszip` (`MIT OR GPL-3.0`) is
inside `html-docx-js`, and `dompurify` (`MPL-2.0 OR Apache-2.0`) is inside
`html2pdf` — both are shipped to browsers. Electing GPL-3.0 on the first would
make that a conveyance of a combined work. Had those two packages been server
side, the same dual licences would have been academic.

**Exports are not distribution.** The `.docx`, `.xlsx` and `.pdf` files users
download contain library *output*, not library *code*. No obligation attaches
to a generated document.

★ **The A/B boundary is a build-time fact, not a property of a package.**
Moving a library from a function to the browser, shipping a desktop or mobile
build, or open-sourcing this repository moves packages into Tier B and reopens
the elections. Re-run this section, not just §1 and §2, if any of that happens.

---

## 1. Server-side npm dependencies

Installed by Vercel at build time and executed in serverless functions.
Four direct dependencies; 26 packages resolved. Exact versions are pinned in
`package-lock.json` (committed 2026-08-14 — before that date the tree was
re-resolved on every build and was not reproducible).

**Direct:** `docxtemplater` 3.69.3 (MIT) · `pdf-parse` 1.1.4 (MIT, see the
Apache-2.0 note below) · `pizzip` 3.2.0 (MIT OR GPL-3.0 → **MIT elected**) ·
`stripe` 18.5.0 (MIT).

**Full resolved set:**

| Licence | Packages |
|---|---|
| MIT (23) | `@xmldom/xmldom` 0.9.11 · `call-bind-apply-helpers` 1.0.2 · `call-bound` 1.0.4 · `docxtemplater` 3.69.3 · `dunder-proto` 1.0.1 · `es-define-property` 1.0.1 · `es-errors` 1.3.0 · `es-object-atoms` 1.1.2 · `function-bind` 1.1.2 · `get-intrinsic` 1.3.0 · `get-proto` 1.0.1 · `gopd` 1.2.0 · `has-symbols` 1.1.0 · `hasown` 2.0.4 · `math-intrinsics` 1.1.0 · `node-ensure` 0.0.0 · `object-inspect` 1.13.4 · `pdf-parse` 1.1.4 · `side-channel` 1.1.1 · `side-channel-list` 1.0.1 · `side-channel-map` 1.0.1 · `side-channel-weakmap` 1.0.2 · `stripe` 18.5.0 |
| MIT AND Zlib | `pako` 2.2.0 |
| MIT OR GPL-3.0 → **MIT** | `pizzip` 3.2.0 |
| BSD-3-Clause | `qs` 6.15.3 |

★ **`pdf-parse` embeds Mozilla PDF.js v1.10.100** at
`lib/pdf.js/v1.10.100/build/pdf.js`, carrying `Copyright 2017 Mozilla
Foundation`, licensed **Apache-2.0**. Attribution for it is given in §5 below.

---

## 2. Browser-side libraries (vendored)

Served from our own origin at `/vendor/` since 2026-08-14; previously loaded
from jsdelivr and unpkg at runtime. Provenance and SHA-384 integrity hashes:
[`public/vendor/README.md`](public/vendor/README.md).

The five vendored files are **bundles** — each contains its dependency tree,
so attribution is owed for the contents, not merely the named library. 71
packages resolved across all five — a **metadata** resolution, which §2.3
shows is not the same thing as reading the shipped bytes.

### 2.1 Named libraries

| Library | Version | Licence | Purpose |
|---|---|---|---|
| `@supabase/supabase-js` | 2.50.5 | MIT | Database, auth, storage and realtime client |
| `chart.js` | 4.4.0 | MIT | Admin dashboard charts |
| `html2pdf.js` | 0.10.1 | MIT | Client-side HTML → PDF (FINDER report export) |
| `xlsx` (SheetJS CE) | 0.18.5 | **Apache-2.0** | XLSX export (**write-only**) |
| `html-docx-js` | 0.3.1 | MIT | HTML → DOCX export |

### 2.2 Bundled dependencies, by licence

**Apache-2.0 (9)** — all SheetJS components inside `xlsx`:
`adler-32` 1.3.1 · `cfb` 1.2.2 · `codepage` 1.15.0 · `crc-32` 1.2.2 ·
`frac` 1.1.2 · `ssf` 0.11.2 · `wmf` 1.0.2 · `word` 0.3.0 · `xlsx` 0.18.5

**MPL-2.0 OR Apache-2.0 → Apache-2.0 elected (1)** — `dompurify` **2.3.0**

**MIT OR GPL-3.0 → MIT elected (1)** — `jszip` 2.7.0 (inside `html-docx-js`)

**MIT OR Apache-2.0 → MIT elected (2)** — `atob` 2.1.2 · `btoa` 1.2.1

**MIT AND Zlib (1)** — `pako` 1.0.11

**Apache-2.0 (1, inside `html2pdf`)** — the Microsoft TypeScript helper
runtime (`tslib`). Its banner carries the Apache-2.0 grant but does not name
the package; it appears twice in the bundle's `LICENSE.txt`.

**BSD-3-Clause (1, inside `jspdf`)** — Adobe standard-font metrics,
© 2008 Adobe Systems Incorporated. Carries the "redistributions in binary
form must reproduce the above copyright notice" condition, which the vendored
`LICENSE.txt` (§2.3) satisfies.

**BSD-2-Clause (1)** — `webidl-conversions` 3.0.1

**Non-standard (1)** — `rgbcolor` 1.0.1, declared
`MIT OR SEE LICENSE IN FEEL-FREE.md`

**MIT (56)** — `@babel/runtime` 7.29.7 · `@kurkle/color` 0.3.4 ·
`@supabase/auth-js` 2.70.0 · `@supabase/functions-js` 2.4.5 ·
`@supabase/node-fetch` 2.6.15 · `@supabase/postgrest-js` 1.19.4 ·
`@supabase/realtime-js` 2.11.15 · `@supabase/storage-js` 2.7.1 ·
`@supabase/supabase-js` 2.50.5 · `@types/node` 26.2.0 · `@types/phoenix` 1.6.7 ·
`@types/raf` 3.4.3 · `@types/ws` 8.18.1 · `base64-arraybuffer` 1.0.2 ·
`canvg` 3.0.11 · `chart.js` 4.4.0 · `core-js` **3.16.0** · `core-js-pure` **3.15.2** · `css-line-break` 2.1.0 ·
`es6-promise` 4.2.8 · `fflate` 0.8.3 · `html-docx-js` 0.3.1 ·
`html2canvas` **1.0.0** · `html2pdf.js` 0.10.1 · `isows` 1.0.7 · `jspdf` **2.3.1** ·
`lodash._arraycopy` 3.0.0 · `lodash._arrayeach` 3.0.0 · `lodash._basecopy` 3.0.1 ·
`lodash._basefor` 3.0.3 · `lodash._bindcallback` 3.0.1 ·
`lodash._createassigner` 3.1.1 · `lodash._getnative` 3.9.1 ·
`lodash._isiterateecall` 3.0.9 · `lodash._root` 3.0.1 · `lodash.escape` 3.2.0 ·
`lodash.isarguments` 3.1.0 · `lodash.isarray` 3.0.4 ·
`lodash.isplainobject` 3.2.0 · `lodash.istypedarray` 3.0.6 · `lodash.keys` 3.1.2 ·
`lodash.keysin` 3.0.8 · `lodash.merge` 3.3.2 · `lodash.restparam` 3.6.1 ·
`lodash.toplainobject` 3.0.0 · `performance-now` 2.1.0 · `raf` 3.4.1 ·
`regenerator-runtime` 0.13.11 · `stackblur-canvas` 2.7.0 · `svg-pathdata` 6.0.3 ·
`text-segmentation` 1.0.3 · `tr46` 0.0.3 · `undici-types` 8.3.0 · `utrie` 1.0.2 ·
`whatwg-url` 5.0.0 · `ws` 8.21.3

### 2.3 ★ `html2pdf` ships a frozen 2021 build — read its LICENSE.txt, not npm

`html2pdf-0.10.1.bundle.min.js` is a **prebuilt webpack bundle**. Its contents
were frozen when upstream published it; they do not move when npm resolves a
semver range today. §2.2 was originally compiled by resolving the dependency
tree from registry metadata, so for this one file it named versions **newer
than the bytes we serve**. Corrected above, each verified against the shipped
file:

| Component | §2.2 said | Actually shipped | Verified by |
|---|---|---|---|
| `dompurify` | 2.5.9 | **2.3.0** | `r.version="2.3.0"` in the bundle |
| `jspdf` | 2.5.2 | **2.3.1** | `H.version="2.3.1"` in the bundle |
| `core-js` | 3.50.0 | **3.16.0** (pure: 3.15.2) | `version:"3.16.0"` in the bundle |
| `html2canvas` | 1.4.1 | **1.0.0** | banner in the bundle's `LICENSE.txt` |

Two real packages were missing from §2.2 entirely — `tslib` (Apache-2.0)
and `core-js-pure` — and one component inside `jspdf` declares only
`@license Use it if you like it`, which is a banner rather than a licence
identifier and is covered by jsPDF's own MIT grant.

★ The remaining `html2pdf`-internal rows in §2.2 were resolved the same way
and are likely to be similarly newer than what ships. **The authoritative
attribution for that bundle is the bundle's own licence sidecar**, which
webpack emits and which the minifier's banner points at:

> `/*! For license information please see html2pdf.bundle.min.js.LICENSE.txt */`

That sidecar was **not vendored with the bundle on 2026-08-14, so the pointer
dangled** — the file carrying attribution for jsPDF's dozen-plus individual
copyright holders, the Adobe metrics notice, the Microsoft Apache-2.0 grant
and the DOMPurify dual-licence line was simply absent. Fixed 2026-08-19: it is
vendored verbatim at
[`public/vendor/html2pdf.bundle.min.js.LICENSE.txt`](public/vendor/html2pdf.bundle.min.js.LICENSE.txt)
(143,251 bytes, hashed in `public/vendor/README.md`), under the exact filename
the banner names, so `/vendor/html2pdf.bundle.min.js.LICENSE.txt` resolves for
anyone who follows it.

★ The other four vendored files are single-library builds whose inner versions
were resolved close to their own publication date; spot-checking
`supabase-js` 2.50.5 against `storage-js/2.7.1` in its bytes matches §2.2.
Only `html2pdf` — a 2021 bundle listed with 2026 metadata — drifted.

---

## 3. Icons

**Lucide** (`lucide-static` v1.14.0) — **ISC**. 95 SVG files vendored under
`public/icons/`, each retaining its `@license lucide-static v1.14.0 - ISC`
header. Lucide is a community fork of Feather Icons (also ISC), and the
Lucide copyright notice covers both lineages.

> ISC © Lucide Contributors, and © 2013–2022 Cole Bemis (Feather).
> Permission to use, copy, modify, and/or distribute this software for any
> purpose with or without fee is hereby granted, provided that the above
> copyright notice and this permission notice appear in all copies.

---

## 4. Typeface

**Inter** (v20, variable, 14 subset files) — **SIL Open Font License 1.1**,
© The Inter Project Authors (<https://github.com/rsms/inter>). Self-hosted at
`public/vendor/fonts/` since 2026-08-14; previously loaded from Google Fonts.
Licence text: [`licenses/OFL-1.1.txt`](licenses/OFL-1.1.txt).

★ OFL obligations we meet: the font is distributed unmodified, under its
original name, is not sold on its own, and this notice accompanies it. ★ The
OFL's Reserved Font Name clause means a *modified* Inter could not be called
"Inter" — relevant only if we ever subset or hint it ourselves.

---

## 5. Required attributions

### Apache-2.0 components

Licensed under the Apache License, Version 2.0 (the "License"); you may not
use these files except in compliance with the License. A copy is at
[`licenses/Apache-2.0.txt`](licenses/Apache-2.0.txt) and at
<http://www.apache.org/licenses/LICENSE-2.0>. Unless required by applicable
law or agreed to in writing, software distributed under the License is
distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
either express or implied.

- **SheetJS Community Edition** (`xlsx`, `cfb`, `codepage`, `crc-32`,
  `adler-32`, `ssf`, `wmf`, `word`, `frac`) — © SheetJS LLC.
- **Mozilla PDF.js** v1.10.100, embedded within `pdf-parse` — © 2017 Mozilla
  Foundation.
- **TypeScript helper runtime** (`tslib`) inside the `html2pdf` bundle —
  © Microsoft Corporation.
- **DOMPurify** 2.3.0 — © Mario Heiderich, used under the Apache-2.0 option of
  its dual licence. MPL-2.0 text retained at
  [`licenses/MPL-2.0.txt`](licenses/MPL-2.0.txt) for the record of what was
  *not* elected.

★ None of these components has been modified, so the Apache-2.0 §4(b)
"stating changes" obligation does not currently apply. **It would apply the
moment anyone edits a file under `public/vendor/`** — which is why that
directory's README forbids it.

### Where these notices are actually delivered

Attribution is owed **to the recipient of the copy** (§0.1, Tier B), so an
internal record is not enough — it has to be reachable by the person whose
browser just downloaded the code. Since 2026-08-19:

| Served at | Content |
|---|---|
| `/legal/third-party-notices.txt` | This file, verbatim |
| `/legal/licenses/Apache-2.0.txt` | Apache-2.0, discharging §4(a) |
| `/legal/licenses/MPL-2.0.txt` | MPL-2.0, the option *not* elected |
| `/legal/licenses/OFL-1.1.txt` | SIL OFL 1.1, for Inter |
| `/vendor/html2pdf.bundle.min.js.LICENSE.txt` | The html2pdf bundle's own aggregated notices |

★ Served with a `.txt` extension **on purpose**: every host and browser
renders `text/plain` inline, so the notice is readable without a
`Content-Type` override in `vercel.json` that a platform change could quietly
stop honouring. The content is this file byte-for-byte. Linked from the
marketing footer
(**Open source**) and from the in-app footer next to Security / Privacy /
Terms — both the signed-out auth screen and the signed-in status bar, because
the code is served to both.

★ **The public copies under `public/legal/` are copies.** This file at the
repo root stays canonical; `scripts/oss-notices.test.mjs` fails the build if
they drift, and §8 lists the copy step.

★ Three components carry no usable notice in their own bytes —
`supabase-js-2.50.5.min.js` has no copyright line at all (only a jsdelivr
build comment), `xlsx-0.18.5.full.min.js` has a one-line SheetJS banner and no
Apache text, and `html2pdf` pointed at a sidecar that was not there. Those
files must not be edited to add one (`public/vendor/README.md`, and §4(b) for
`xlsx`), so the served notices above are how attribution reaches the user.

### BSD-3-Clause component

Adobe standard-font metrics inside `jspdf` — © 2008 Adobe Systems
Incorporated. Redistribution in binary form must reproduce the copyright
notice, this list of conditions and the disclaimer **in the documentation or
other materials provided with the distribution**, and the Adobe name may not
be used to endorse. Both are satisfied by shipping
`public/vendor/html2pdf.bundle.min.js.LICENSE.txt` alongside the bundle, where
the full text sits verbatim.

### MIT / ISC / BSD components

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files, to deal in the Software
without restriction, subject to the condition that the above copyright notice
and this permission notice be included in all copies or substantial portions
of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY
KIND. Copyright is held by the respective authors of each package listed in
§§1–3.

---

## 6. Reference data (not software)

Third-party *data* incorporated into the product. Different rights regime from
software licensing, and the reason it is listed here is that the exclusions
matter more than the inclusions.

| Corpus | Source | Rights | Where |
|---|---|---|---|
| HCPCS Level II descriptors | CMS Alpha-Numeric HCPCS File | **US Government work — public domain** | `api/_data/` (~14 MB, bundled into functions) |
| ICD-10-CM descriptors | CDC / NCHS | **Public domain** | `api/_data/` |
| ICD-10-PCS descriptors | CMS | **Public domain** | `api/_data/` |
| FDA device data (510(k), TPLC, recalls, product codes) | openFDA API + accessdata.fda.gov | US Government work; openFDA terms permit reuse with no endorsement implied | Fetched + cached |
| HCUP NASS | AHRQ | **Data Use Agreement — restricted** | Local analysis only; **not** shipped, not in the repo |

### 6.1 Scholarly bibliographic sources (FINDER Literature)

Queried live per user action; none of it is bundled into the repo or the
browser bundles, so none of it changes the distribution posture in §0.1.
Verified against each provider's own terms on the dates shown.

| Source | Used for | Rights | Added |
|---|---|---|---|
| **OpenAlex** (OurResearch) | Citation edges both directions, canonical title/authors/journal/year, abstracts | **CC0 1.0 public-domain dedication** on OpenAlex's own data. See §6.2 on abstracts. | 2026-08-20 |
| **Crossref** REST API | Reference lists where OpenAlex has none; author/journal gap-fill | *"Almost none of the metadata is subject to copyright, and you may use it for any purpose."* See §6.2 on abstracts. | 2026-08-20 |
| **PubMed / NCBI E-utilities** | Topic search, abstracts (efetch) | US Government work; NLM records are public domain, **but individual abstracts frequently are not** — see §6.2 | 2026-05-11 |
| **Semantic Scholar** Graph API | Paper search, `tldr` snippets | Allen Institute API terms; free tier, optional key | 2026-05-11 |
| **arXiv** API | Preprint search | arXiv metadata is CC0; full texts carry per-submission licences and are **not** ingested | 2026-05-11 |
| **Publisher pages** | `citation_*` meta tags on a pasted URL | Highwire Press tags, published by the publisher for indexing; title/DOI only | 2026-07-20 |

★ The last four predate this section — they shipped with the Literature tab
and were simply never recorded here. Listed now rather than left implicit.

### 6.2 ★★ Abstracts are the one live rights question in this section

Every other row above is metadata that nobody claims copyright in. Abstracts
are different, and all three providers say so in their own words:

- **Crossref:** *"Some abstracts contained in the metadata may be subject to
  copyright by publishers or authors."*
- **OpenAlex** does not ship plaintext abstracts at all. It ships an
  **inverted index** — `{word: [positions]}` — and its documentation states
  plainly: *"OpenAlex doesn't include plaintext abstracts due to legal
  constraints."* The format is a deliberate legal safeguard, not an
  optimisation.
- **NLM** treats PubMed *records* as public domain while the abstract text
  within them may remain the publisher's.

**What we do with that.** `api/_lit/scholar.js` reconstructs plaintext from
OpenAlex's inverted index (`inflateAbstract`) and stores the result in
`literature_references.abstract`, where it is displayed to the user who saved
the paper and included in the prompt sent to Anthropic for a summary.

**Why that is probably fine, stated as an argument rather than a conclusion:**
reconstruction is the documented, expected use of the field (the official
client libraries do it); OpenAlex dedicates its own data CC0; the abstract is
shown only to the single user whose private library holds that paper, under
per-user RLS; we do not republish, syndicate or expose it to other tenants;
and an abstract is the part of a paper publishers themselves distribute
openly for indexing.

★★ **This is nonetheless a judgment call for counsel, not for engineering,**
and it is the reason this subsection exists. The narrow question is whether
storing a reconstructed abstract in a per-user database is materially
different from displaying it transiently. If the answer is no, nothing
changes. If it is yes, the cheap remedy already exists: store the inverted
index rather than the plaintext and inflate it at render time, which keeps
every feature working and never persists a plaintext copy.

★ Related and already handled: uploaded PDFs are the **user's own** documents,
and the Terms of Service already warn that standards and papers a user
uploads may carry third-party licence restrictions. We read those PDFs to
extract a DOI and to summarise on explicit request; we never redistribute
them, and storage is per-user under the bucket's owner-only RLS.

★★ **CPT is deliberately excluded.** Current Procedural Terminology is
copyrighted by the **American Medical Association** and requires a paid
licence to reproduce. The product does not bundle CPT descriptors: the code
resolver returns no descriptor for a 5-digit CPT code and emits the sentinel
"Unknown — verify against CMS / AMA tables" instead. This is the single
largest third-party IP exposure the product could have had, and it is
architecturally avoided rather than merely undocumented — see
`api/_code-descriptors.js` and `scripts/build-code-descriptors.js`.

★ **Clinical and regulatory content generated by Anthropic models** is
governed by the Anthropic commercial terms, not by an open-source licence.
Model outputs are not third-party works for attribution purposes, but the
service is a subprocessor — see `docs/security-whitepaper.md`.

---

## 7. Development-time tools (not distributed)

Used to build or verify, never shipped to a user, and therefore not
attribution-bearing — listed for completeness because a diligence
questionnaire usually asks:

- **`@mermaid-js/mermaid-cli`** (MIT), invoked via `npx` by
  `scripts/export-flowcharts-bw.mjs` to render the disclosure figures.
- **Node.js** (MIT) and **npm** (Artistic-2.0) — the runtime and package
  manager.
- **Vercel CLI** (Apache-2.0) — deployment, used interactively.

---

## 8. Maintaining this file

It will rot if the dependency set changes and nobody regenerates it.

**Server side** — after any change to `package.json`:

```sh
npm install --package-lock-only
node -e "const l=require('./package-lock.json');
  console.log(Object.keys(l.packages).filter(k=>k.startsWith('node_modules/')).length)"
```

then re-resolve licences from the registry (`https://registry.npmjs.org/<pkg>/<version>`,
field `license`) and update §1.

**Browser side** — after changing anything in `public/vendor/`: resolve the
library's transitive tree the same way, update §2, and update the hash table
in `public/vendor/README.md`. ★ For a **prebuilt bundle**, resolving the tree
is not enough — read the versions out of the shipped bytes and vendor the
build's own `*.LICENSE.txt` next to it (§2.3).

**After editing this file or `licenses/`** — refresh the served copies and
verify:

```sh
cp THIRD-PARTY-NOTICES.md public/legal/third-party-notices.txt
cp licenses/*.txt public/legal/licenses/
node --test scripts/oss-notices.test.mjs
```

★ **Dual-licensed packages are the part that needs a human.** A scanner
reports both options; only a person can record which one is elected. The four
current elections are in §0 and must survive any regeneration.

★ **A new external DATA source is not caught by any of the above.** Adding an
API call to a new provider adds nothing to `package.json`, so the npm
regeneration in this section will not notice it and neither will a dependency
scanner. Four sources ran unrecorded for three months for exactly that reason
(§6.1). When wiring a new provider, read its terms and add a §6.1 row in the
same commit — and if it returns abstracts or full text rather than
bibliographic fields, check it against §6.2 before storing anything.