Leofix(editor): adopt Tiptap 3.33.0 with the @tiptap/react patch carried forward (#646)dc053a41 day agoHistory
24215 lines · 1.2 MB · MarkdownRawDownload

Third-party notices

Lattice itself is licensed Apache-2.0 (see LICENSE and NOTICE). This file records the separate terms of components that are bundled, vendored, or adapted into it. It ships with the application: Settings › About › Acknowledgements shows it whole and lists every package of its generated half (src/settings/third-party-notices.ts reads that half, so a change to the generator's output format must keep that parser working).

It has two halves. Everything above the generated boundary is written by hand and covers components that need a human explanation — vendored code, adapted code, and dependencies whose terms raise a question. Everything below that boundary is produced by scripts/generate-notices.mjs and covers the four dependency closures Lattice ships: the npm production tree, the crates linked into the Rust binary, and the npm trees staged into the Synara and Open Slide sidecars and bundled as Tauri resources. Regenerate it with pnpm notices; pnpm notices:check fails if it has drifted. The generator never touches the hand-written half. When a package's published artifact omits its license text, pnpm notices --fetch-upstream copies the file from the package's repository into licenses/upstream/, where the generator reads it from then on.

The gaps section lists what is shipped but still not attributed. The generator resolved most of what used to be listed there; the entries that remain are the ones it genuinely cannot answer.

Cuelume

Lattice uses Cuelume for synthesized interface sounds.

MIT License

Copyright (c) 2026 Daniel Belyi

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

Trellis

The workspace's dockable panel layout is built with Trellis by Dan Fessler, pinned at @danfessler/trellis@0.2.0 and @danfessler/trellis-react@0.2.0 in package.json.

Uses Trellis by DanFessler - github.com/DanFessler/trellis

Trellis is not covered by Lattice's Apache License. @danfessler/trellis is licensed under its own non-commercial license (with a commercial tier), not Apache-2.0. Its terms, as the packages ship them:

  • Non-commercial (free): use, modification and distribution for non-commercial purposes only. It excludes use that generates revenue, use developed within a for-profit organization, and use at a company with more than one employee or developer unless explicitly licensed; it forbids distributing a fork or derivative under a different license; and it requires the license file and attribution to be retained.
  • Commercial: an active GitHub sponsorship of the author (github.com/sponsors/danfessler) at the individual or small-studio tier, for organizations with 10 or fewer developers; the rights last while the sponsorship is active, and the attribution above is required.
  • Enterprise: more than 10 developers, by arrangement with the author.

These terms apply to anyone using Lattice, because Lattice ships Trellis to its users: someone using Lattice at a company or for a for-profit organization needs a Trellis license from its author.

The three license files are copied verbatim to public/licenses/trellis-LICENSE.md, public/licenses/trellis-LICENSE-NONCOMMERCIAL.md and public/licenses/trellis-LICENSE-COMMERCIAL.md, which Vite copies into the shipped application; the generated section below also reproduces the texts the packages ship. Lattice modifies Trellis only through the pnpm patch patches/@danfessler__trellis@0.2.0.patch (layout fixes); the packages' own license files are left untouched. The macOS About panel shows the attribution.

tldraw

The board editor is built with the tldraw SDK, pinned at tldraw@5.2.5 in package.json.

The verbatim license text is vendored at public/licenses/tldraw-LICENSE.md. It has to be: the published npm packages do not contain it. node_modules/tldraw/LICENSE.md is 104 bytes and reads, in full, "This code is licensed under the tldraw license" — a link, not a license — while the license itself lists among its conditions:

To include a verbatim copy of this License in any distribution of the Software.

Vite copies public/ into dist/, and src-tauri/tauri.conf.json sets frontendDist: "../dist", so the vendored copy is embedded in the shipped application binary as well as tracked in the source tree. scripts/generate-notices.mjs fails if the file goes missing, and reproduces it in the generated section below.

Which tldraw packages are actually covered

The scope is narrower than the package names suggest, and the license fields are not a reliable guide:

  • tldraw, @tldraw/editor and @tldraw/driver declare "SEE LICENSE IN LICENSE.md" and ship the link stub. These are the packages the tldraw license governs.
  • @tldraw/utils and @tldraw/validate also declare "SEE LICENSE IN LICENSE.md", but the file they point at is an ordinary MIT license, Copyright (c) 2024 tldraw Inc. The declaration is misleading; the shipped text governs.
  • @tldraw/state, @tldraw/state-react, @tldraw/store and @tldraw/tlschema declare "MIT" and ship the MIT text.
  • @tldraw/assets declares "SEE LICENSE IN LICENSE.md" and ships the link stub, so its icons, translations and embed icons are covered by the tldraw license too. Its fonts are not tldraw's: see the next section.

Board fonts (@tldraw/assets)

tldraw's defaults load the board's fonts, icons, translations and embed icons from cdn.tldraw.com. Lattice instead bundles them from @tldraw/assets@5.2.5 (pinned to the tldraw version) through src/editor/board/board-asset-urls.ts; Vite emits them into dist/assets/, so they ship inside the application. The sixteen .woff2 files are IBM Plex Sans, Serif and Mono (Copyright © 2017 IBM Corp. with Reserved Font Name "Plex") and Shantell Sans (Copyright 2022 The Shantell Sans Project Authors), all under the SIL Open Font License 1.1 and bundled unmodified. Their metadata carries the copyright lines and a pointer to the OFL but not its text, so the license ships separately at public/licenses/tldraw-fonts-OFL.txt (both copyright notices plus the OFL), which Vite copies into the shipped application.

Terms that bear on redistribution

tldraw 5.x is not Apache-2.0 and not an OSI-approved license. Quoting the text (see the vendored copy for the whole document):

  • Permissions are limited to using the Software in "Development Environments", modifying it, and bundling it "with your own projects".
  • Among the conditions: "Not to use the Software in Production Environments"; "Not to disable, change, or interfere with the Software's License Key enforcement"; "Not to remove any copyright or other notices from the Software"; and "Not to make the Software available under a license that supersedes or negates the effect of this License."
  • Production use is reached only through the separate "Trial license" and "Commercial license" sections, each of which turns on a License Key issued by tldraw.
  • Both the warranty disclaimer and the liability limitation say "You must pass this […] on whenever you distribute the Software or derivative works."

Carve-out. Lattice is Apache-2.0, but the tldraw, @tldraw/editor and @tldraw/driver packages (and the parts of @tldraw/assets listed above) are licensed under the tldraw license, not Apache-2.0; NOTICE says so explicitly. Lattice does not relicense them, so the condition against making the Software "available under a license that supersedes or negates the effect of this License" is respected. The license key stays out of this repository: forks build tldraw in its unlicensed, watermarked mode, which does not interfere with key enforcement. (While Lattice was GPL-3.0, these restrictions conflicted with GPL-3.0 §7; that conflict ended with the relicense.)

What this repository can and cannot verify about its own grant

The board editor reads a license key from the VITE_TLDRAW_LICENSE_KEY environment variable at build time; the release workflow passes it from the VITE_TLDRAW_LICENSE_KEY repository secret. Builds without that key, including release builds when the secret is unset, run tldraw in its unlicensed, watermarked mode. The specific grant the maintainer holds is not recorded anywhere in this repository and needs confirming against whatever tldraw issued with the key.

An earlier revision of this file asserted that Lattice "ships under a tldraw Hobby license key". That claim is withdrawn: the license text defines only Development, Trial and Commercial categories and never uses the word "Hobby". A "Hobby" tier exists on tldraw's pricing page as a free, application-gated offering, but its watermark and commercial-use conditions are not published in the legal text, so nothing here can state what they are.

Lucide file glyphs (src/components/ui/file-glyphs.ts, src/project/project-tree-css.ts)

The file and folder glyphs in the project tree, the workspace tabs and the pickers are adapted from Lucide icons (ISC). Lucide's license and copyright notice are reproduced with the lucide-react package in the generated notices below.

Fluid Functionalism and Lina (src/components/ui/)

Several UI primitives are adapted from Fluid Functionalism (MIT, Copyright (c) 2026 Micka Touillaud): scroll-area.tsx, scroll-area.css, radio-group.tsx, switch.tsx, use-fluid-hover.ts, fluid-hover-highlight.tsx, and the spring presets in motion-values.ts. Fluid Functionalism's scrollbar is itself adapted from Lina (MIT, Copyright (c) 2025 Sameer Singh), so scroll-area.tsx and scroll-area.css carry both notices. Each file's header names what it was adapted from; preserve those headers. Both projects use the same MIT text:

MIT License

Copyright (c) 2026 Micka Touillaud

Copyright (c) 2025 Sameer Singh

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

Open Slide create-theme skill (src-tauri/src/embedded_skills/create-theme/SKILL.md)

The bundled agent skill for creating presentation themes is adapted from Open Slide's own create-theme skill (packages/core/skills/create-theme/SKILL.md in open-slide/open-slide). It keeps upstream's theme-specification layout (palette, typography, layout, fixed Title and Footer components, motion, aesthetic, example usage) and some of its example code, rewritten for Lattice projects. Open Slide is MIT licensed, Copyright (c) 2026 Yiwei Ho, under the same MIT text as the section above. The Open Slide runtime package itself is attributed in the generated Open Slide section below.

Ioskeley Mono (src/assets/fonts/ioskeley-mono/)

The editor and code face is Ioskeley Mono v2.0.0, Copyright (c) 2025 Ahmed Hatem, a custom build of Iosevka, Copyright (c) 2015-2026 Renzhi Li. Both are licensed under the SIL Open Font License 1.1, and neither declares a Reserved Font Name. Lattice bundles a subset of the .woff2 files (see the header of ioskeley-mono.css); under the OFL a subset is a Modified Version, which may be bundled with any software provided the copyright notice and license travel with it. The subset's metadata keeps only the Iosevka copyright line and no license text, so the license ships separately: src/assets/fonts/ioskeley-mono/OFL.txt in the source tree, and public/licenses/ioskeley-mono-OFL.txt (both copyright lines plus the OFL), which Vite copies into the shipped application.

Timeless type family (release builds only; not in this repository)

Release builds set the interface and reading surfaces in the Timeless type family, Copyright 2026 Timeless Ventures Private Limited, Chennai, under the Timeless Free Font License 1.2. That license allows embedding the fonts in an application but forbids putting "the fonts", which it defines to include their documentation, on a public repository, so neither the fonts nor the license is here: the release job reads both from a private repository, the build embeds the unmodified WOFF2 files and the unmodified LICENSE.pdf in the app's web assets, and Settings › About › Acknowledgements opens that license. See docs/design-system.md, "Private interface fonts".

Conference LaTeX templates (src-tauri/templates/)

iclr-2026/, icml-2026/, neurips-2026/, acl/, cvpr-2027/ and aaai-2027/ bundle .sty and .bst files copied unchanged from the official conference packages, and the app copies them into new projects. Each directory's UPSTREAM.md records the source URL, fetch date and SHA-256 of every copied file. None of the six packages ships a separate license file. What the files themselves carry:

  • iclr2026_conference.bst and icml2026.bst derive from the natbib plainnat family and state that they "can be redistributed and/or modified under the terms of the LaTeX Project Public License" (version 1 or later; https://www.latex-project.org/lppl/), with copyright notices for Patrick W Daly (1993-2007) and Hal Daumé III (2010) and modification credits for J. Fürnkranz and, in the ICML file, Iain Murray.
  • acl_natbib.bst (Copyright 1994-2011 Patrick W Daly; urlbst modifications Copyright 2002–23 Norman Gray), ieeenat_fullname.bst (derived from abbrvnat.bst, Copyright 1993-2007 Patrick W Daly) and aaai2027.bst (generated from Patrick W Daly's merlin.mbs) carry the same LPPL grant, version 1 or later.
  • iclr2026_conference.sty, icml2026.sty and neurips_2026.sty carry author credits in their header comments (Hugo Larochelle and the NIPS style authors; the ICML program chairs listed in the file; Roman Garnett and the nips15submit_e.sty authors) but no license grant.
  • acl.sty (from the Association for Computational Linguistics' acl-style-files), cvpr.sty (from the CVPR author kit) and aaai2027.sty (from the AAAI-27 author kit, which warns that an AAAI paper may not modify it) carry no license grant either.

All twelve files are shipped byte-for-byte, so every notice and credit in them reaches users intact. Do not edit or strip their header comments; the LPPL in particular requires a modified .bst to be renamed and its changes identified. The project keeps these templates bundled. The absence of a license grant on the six .sty files remains recorded in the gaps below.

Chinese university thesis templates (src-tauri/templates/thuthesis/, src-tauri/templates/ustcthesis/)

Both directories bundle files copied unchanged from the templates' official releases, and the app copies them into new projects. Each directory's UPSTREAM.md records the release, its SHA-256 and the SHA-256 of every copied file.

  • ThuThesis 7.7.1 (https://github.com/tuna/thuthesis, also on CTAN as thuthesis): thuthesis.cls, Copyright (C) 2005-2026 by Tsinghua University TUNA Association, and thuthesis-numeric.bst and thuthesis-author-year.bst, Copyright (C) 2016--2024 by Zeping Lee. All three may be distributed and/or modified under the LaTeX Project Public License, version 1.3c or later (https://www.latex-project.org/lppl.txt). The release also ships thu-fig-logo.pdf and thu-text-logo.pdf, which the class draws on undergraduate thesis covers. They carry the emblem and name of Tsinghua University, taken unmodified (apart from cropping) from the university's visual identity system; the ThuThesis README notes that they are registered trademarks of Tsinghua University, to be used only for this template.
  • ustcthesis 5.0.2 (https://github.com/ustctug/ustcthesis): ustcthesis.cls, Copyright (C) 2015-2026 by USTC TeX Users Group, and ustcthesis-numeric.bst and ustcthesis-authoryear.bst, Copyright (C) 2016-2026 by Zeping Lee, under the LaTeX Project Public License, version 1.3c or later; the repository is licensed LPPL 1.3c as a whole. The four PDFs under figures/ (ustc-logo.pdf, ustc-name.pdf, ustc-name-stxingkai.pdf, ustc-title-page-heading.pdf) are the cover artwork the class draws at those fixed paths and carry the emblem and name of the University of Science and Technology of China.

Every file ships byte-for-byte; the LPPL requires a modified file to be renamed and its changes identified, so do not edit them in place.

Realtime TeX live preview renderer (src/live-preview/)

The LuaLaTeX live preview draws rtex's display lists with code adapted from the Realtime TeX VS Code plugin (webview/render.ts, webview/model.ts, webview/opentype.d.ts, src/fontKey.ts, src/type1.ts, src/edits.ts, src/protocol.ts, src/resources.ts). Each adapted file names its source in its header.

MIT License

Copyright (c) 2026 Henry Yang

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

The engine itself, rtex (realtime-tex) 0.0.6, is not shipped with Lattice: turning the live preview on downloads its release archive (verified by SHA-256) into Lattice's Application Support folder, together with the archive's own LICENSE. It is licensed MIT, Copyright (c) 2026 Henry Yang and the realtime-tex contributors.

Claude Agent SDK (bundled in the Synara sidecar)

scripts/prepare-synara-sidecar.mjs installs the Synara server's production dependencies into src-tauri/synara-runtime/server/node_modules/, and tauri.conf.json bundles that directory whole. Two of the packages that land there are proprietary, and this is called out by hand rather than left in the generated list because it is the one closure finding that is not a formality:

The versions below are the ones in the last generated Synara sidecar section; that section is authoritative when the pin moves.

Package license field LICENSE.md, in full
@anthropic-ai/claude-agent-sdk@0.3.259 SEE LICENSE IN README.md "© Anthropic PBC. All rights reserved. Use is subject to the Legal Agreements outlined here: https://code.claude.com/docs/en/legal-and-compliance."
@anthropic-ai/claude-agent-sdk-darwin-arm64@0.3.259 SEE LICENSE IN LICENSE.md same text

Two observations, both checkable against the staged tree:

  • What ships is the SDK, not the CLI. The platform package's claude executable is a 27-byte shim — #!/bin/sh / exec claude "$@" — written by the prepare script so that sessions run the user's own Claude Code installation. Anthropic's CLI binary is not redistributed. pnpm build enforces this through CLAUDE_PATH_LAUNCHER_BUDGET_BYTES in scripts/app-size-report.mjs.
  • The JavaScript SDK itself is still redistributed. Its JavaScript entry points (sdk.mjs, bridge.mjs and browser-sdk.js, each around a megabyte when this was last measured) are copied into the application bundle under an all-rights-reserved notice. Anthropic's published terms are the ones linked above; nothing in this repository records a grant to redistribute those files inside a third-party application.

That question has to be answered before a public release: either confirm the redistribution grant with Anthropic, or stop bundling the SDK and resolve it from the user's environment the way the claude executable already is.

The SEE LICENSE IN README.md field on the first package is also a dead reference — the README it names contains no license text at all — so the LICENSE.md quoted above is the only statement of terms in the artifact.

tantivy and jieba-rs (paper full-text search, src-tauri/src/papers/search_index.rs)

The Papers panel's full-text search and the agent's search_library tool run on tantivy (tantivy@0.27, MIT), with Chinese word segmentation from jieba-rs (jieba-rs@0.11, MIT), which compiles in the word-frequency dictionary (dict.txt) of the original Python jieba project (MIT).

tantivy's sub-crates (tantivy-bitpacker, tantivy-columnar, tantivy-common, tantivy-query-grammar, tantivy-sstable, tantivy-stacker, tantivy-tokenizer-api, ownedbytes) and jieba-rs publish no license file in their crate archives; the generated section reproduces the license each has in its repository, recovered by pnpm notices --fetch-upstream. The jieba dictionary is not a crate, so the generator never sees it. jieba-rs and the jieba dictionary are under these licenses, from their repositories:

MIT License

Copyright (c) 2018 - 2019 messense Copyright (c) 2019 Paul Meng

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

The MIT License (MIT)

Copyright (c) 2013 Sun Junyi

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

Font Awesome Free and VS Code Codicons icons (bundled in the Synara web client)

The Synara web client staged into the sidecar (synara-runtime/server/dist/client) renders icons from react-icons 5.6.0, the version Synara's lockfile pins at the revision in scripts/synara-runtime.json. Two of the packs it imports carry icons under the Creative Commons Attribution 4.0 International license (CC BY 4.0), which requires this attribution:

Modifications: react-icons converts each icon's SVG path data into a React component. Neither icon set has been otherwise changed. The licensors provide the icons as-is and make no warranties; see section 5 of the license.

Known attribution gaps (TODO)

Everything below is shipped in the app or the repository but is not yet properly attributed above. This list exists so the gap is visible rather than silent. Appearing here does not by itself mean an item is a problem — for most of them it only means nobody has checked; a few (tldraw, the conference templates, the Claude Agent SDK, the Synara client's Central icons) are flagged because a real question was found. Remove an entry when it has been given a real section.

Items that used to be on this list and are now covered by the generated section — the npm and crates.io closures, the Synara sidecar's node_modules, ExcelJS, @pierre/trees and @pierre/diffs, and the bulk of Univer — were removed rather than kept as reassurance. What remains is what a machine reading the installed packages cannot answer.

  • Conference LaTeX template style files (src-tauri/templates/*/*.sty). Attribution is now recorded in the section above: the files ship unmodified with every in-file credit, and the five .bst files carry an LPPL grant. What stays open is that the six .sty files (ICLR, ICML, NeurIPS, ACL, CVPR and AAAI) carry no license grant at all, so nothing on disk records permission to redistribute them. The project has chosen to keep them bundled; fetching them on demand or obtaining permission from the conference organisers would close this entry. (tutorial/ is Lattice's own content, and the LPPL thesis templates are licensed; neither is affected.)
  • The Synara web client bundle. generate-notices scans the Synara sidecar's node_modules, but the prebuilt web client under synara-runtime/server/dist/client bundles its own third-party code, and none of that is attributed here yet. Known items, from an audit of Lattice 0.1.341 and the pinned Synara source (scripts/synara-runtime.json):
    • Synara's web app depends on react-icons (and @tabler/icons-react). At the pinned revision it imports eleven react-icons packs: fa6, fi, go, hi2, io, lu, pi, ri, si, tb and vsc. The two packs with CC BY 4.0 icons, Font Awesome Free (fa6) and VS Code Codicons (vsc), are now attributed in the section above. The rest are under the MIT, ISC, Apache-2.0 or CC0 licenses of their icon sets and still need their notices reproduced; the Simple Icons brand logos (si) are CC0 but remain their owners' trademarks.
    • The client ships raw SVGs from apps/web/public/central-icons-fill/ and central-icons-reversed/ ("Central icons", rendered by apps/web/src/lib/central-icons.tsx). The Synara repository records no license or provenance for them. If they are the commercial Central Icon System, redistributing the raw SVGs may not be permitted. This needs an answer from the Synara upstream.
    • Every other package compiled into the client bundle (rather than installed in node_modules) is likewise unattributed until the generator, or Synara's own build, emits a notices file for it.
  • The Claude Agent SDK's redistribution grant. See the section above. Attribution is now complete — the terms are quoted in full — but whether Lattice may redistribute proprietary, all-rights-reserved JavaScript inside its application is a question only Anthropic can close.
  • tldraw's license grant (tldraw@5.2.5). See the tldraw section above. Attribution and the Apache-2.0 carve-out are resolved: the verbatim license is vendored at public/licenses/tldraw-LICENSE.md, reaches the shipped binary, and NOTICE excludes the tldraw packages from the Apache License. Still open: which grant the project's VITE_TLDRAW_LICENSE_KEY corresponds to, which only tldraw can confirm.
  • Packages that declare a license but ship no text, and found none upstream. The generated "Unresolved attribution" sections list these, each with what pnpm notices --fetch-upstream found when it looked in the package's repository. Most packages that ship no text — nearly all of them crates whose published archive omits the LICENSE file at the root of their workspace — now have that file recovered from their repository, at the commit they were published from where one is recorded, and reproduced in the generated section: 115 in the npm and crates closures and 2 in the Open Slide runtime. The Synara sidecar section is carried over from a staging of an older pin, so it still lists five; four of those texts are already recovered in licenses/upstream/ and leave the list when pnpm prepare:synara and pnpm notices next regenerate it. What remains has no license file in its repository at all: the SPDX identifier is known, but MIT, BSD and ISC require the copyright notice specifically, and nothing upstream states one. The packages that used to declare no license at all are resolved: buffers@0.1.1 left the tree when ExcelJS's unzipper was moved to a release without it (a pnpm.overrides entry; ExcelJS's browser build, which is what Vite bundles, never contained it), khroma@2.1.0 is no longer a dependency, and @univerjs/telemetry@0.25.1 ships the Apache-2.0 license of the Univer repository, which the generator now records for it.
  • harper-core's dictionary data (src-tauri/Cargo.toml). The crate itself is now attributed (Apache-2.0, though it ships no license text — see above). Its bundled dictionary and corpus data (dictionary.dict, annotations.json, the irregular-verb and proper-noun tables) may carry separate terms from the code; that has not been checked, and the generator only reads a crate's own license files.
  • Phosphor Icons (src/animated-icons/bakai/*). These components are hand-rebuilt from Phosphor glyphs (each file's header names the source glyph and weight, e.g. Faders, FILL weight). Phosphor Icons is MIT; the required copyright notice is not reproduced anywhere in this repository. Not a dependency, so not covered by the generator.
  • The @pierre/trees patch (patches/@pierre__trees@1.0.0-beta.6.patch). The package's own terms are now attributed (Apache-2.0). The patch is a modification, and Apache-2.0 §4(b) requires modified files to carry prominent notices of the change; whether the patch satisfies that has not been checked.
  • Univer's commercial tier (@univerjs/*). Every Univer package in the tree declares Apache-2.0 and is attributed in the generated section. Univer is also marketed with a commercial tier, so confirm that the Apache-2.0 packages Lattice actually depends on are the whole story and that no feature in use falls under separate terms.

Generated third-party notices

Everything below this line is produced by node scripts/generate-notices.mjs from the packages installed on disk. Do not edit it by hand — run pnpm notices instead. pnpm notices:check fails if it has drifted.

Each closure lists its packages by declared license, then reproduces every distinct license text once, together with all the copyright notices that share it. Grouping is by license body with the copyright lines removed and whitespace normalised, so the hundreds of MIT packages that differ only in their copyright line collapse to one reproduction of the text plus every one of their notices. Wording variants — MIT License versus (The MIT License), or different quote characters — stay in separate groups on purpose; each group reproduces one member's file verbatim.

Copyleft, reciprocal and source-available dependencies — npm and crates

Lattice ships under Apache-2.0. Everything below is a dependency whose terms are not plainly permissive, listed so the interaction with that license gets an answer rather than an assumption. A dual row offers a permissive alternative, which Lattice elects (Apache-2.0 where offered) and names in the row; a non-spdx row has a misleading license field but a permissive license in the file it points at.

The Synara sidecar has its own findings block further down; it is kept separate because that closure only exists once pnpm prepare:synara has staged it.

Package Closure Declared Finding
@danfessler/trellis-react@0.2.0 npm SEE LICENSE IN LICENSE.md source-available — non-SPDX license reference
@danfessler/trellis@0.2.0 npm SEE LICENSE IN LICENSE.md source-available — non-SPDX license reference
@tldraw/assets@5.2.5 npm SEE LICENSE IN LICENSE.md source-available — non-SPDX license reference
@tldraw/driver@5.2.5 npm SEE LICENSE IN LICENSE.md source-available — non-SPDX license reference
@tldraw/editor@5.2.5 npm SEE LICENSE IN LICENSE.md source-available — non-SPDX license reference
tldraw@5.2.5 npm SEE LICENSE IN LICENSE.md source-available — non-SPDX license reference
colored@3.1.1 crates MPL-2.0 weak-copyleft — file-level copyleft
cssparser-macros@0.6.1 crates MPL-2.0 weak-copyleft — file-level copyleft
cssparser-macros@0.7.1 crates MPL-2.0 weak-copyleft — file-level copyleft
cssparser@0.36.0 crates MPL-2.0 weak-copyleft — file-level copyleft
cssparser@0.37.0 crates MPL-2.0 weak-copyleft — file-level copyleft
dtoa-short@0.3.5 crates MPL-2.0 weak-copyleft — file-level copyleft
option-ext@0.2.0 crates MPL-2.0 weak-copyleft — file-level copyleft
selectors@0.36.1 crates MPL-2.0 weak-copyleft — file-level copyleft
selectors@0.38.0 crates MPL-2.0 weak-copyleft — file-level copyleft
lightningcss@1.32.0 npm MPL-2.0 weak-copyleft — file-level copyleft
lightningcss@1.33.0 npm MPL-2.0 weak-copyleft — file-level copyleft
@fontsource-variable/inter@5.3.0 npm OFL-1.1 reciprocal — SIL OFL (reserved-name and bundling terms)
@fontsource/instrument-serif@5.3.0 npm OFL-1.1 reciprocal — SIL OFL (reserved-name and bundling terms)
htmlescape@0.3.1 crates Apache-2.0 / MIT / MPL-2.0 dual — file-level copyleft offered as one alternative; Lattice elects Apache-2.0
r-efi@5.3.0 crates MIT OR Apache-2.0 OR LGPL-2.1-or-later dual — LGPL offered as one alternative; Lattice elects Apache-2.0
r-efi@6.0.0 crates MIT OR Apache-2.0 OR LGPL-2.1-or-later dual — LGPL offered as one alternative; Lattice elects Apache-2.0
jszip@3.10.1 npm (MIT OR GPL-3.0-or-later) dual — GPL offered as one alternative; Lattice elects MIT
@tldraw/utils@5.2.5 npm SEE LICENSE IN LICENSE.md non-spdx — non-SPDX license field; the file it points at is a permissive license
@tldraw/validate@5.2.5 npm SEE LICENSE IN LICENSE.md non-spdx — non-SPDX license field; the file it points at is a permissive license

Vendored license texts

Some packages point at a license they do not actually ship. The text is vendored into this repository so that it is distributed with both the source and the binary (public/ is copied into dist/, which tauri.conf.json embeds via frontendDist). It is reproduced below like any other notice.

  • public/licenses/tldraw-LICENSE.md — for @tldraw/assets@5.2.5, @tldraw/driver@5.2.5, @tldraw/editor@5.2.5, tldraw@5.2.5, because the published package ships a 104-byte LICENSE.md containing only a link, while the license it links to requires "a verbatim copy of this License in any distribution of the Software".

Unresolved attribution — npm and crates

These are the packages this generator could not attribute from what is installed on disk. They are listed rather than omitted: an unattributed dependency in a shipped binary is a gap, not a rounding error.

Declared a license but shipped no license text (9)

The SPDX identifier is known, but the package contains no LICENSE, COPYING or NOTICE file, so the copyright line those licenses require us to reproduce is not available from the artifact we distribute. Where pnpm notices --fetch-upstream looked for the text in the package's repository and found none, the line says what it found instead.

  • block@0.1.6 (crates) — declared MIT — upstream: https://github.com/SSheldon/rust-block has no license file on the path to /, at the release or on its default branch
  • htmlescape@0.3.1 (crates) — declared Apache-2.0 / MIT / MPL-2.0 — upstream: https://github.com/veddan/rust-htmlescape has no license file on the path to / of its default branch, and no commit or tag identifies the release
  • r-efi@5.3.0 (crates) — declared MIT OR Apache-2.0 OR LGPL-2.1-or-later — upstream: https://github.com/r-efi/r-efi has no license file on the path to /, at the release or on its default branch
  • r-efi@6.0.0 (crates) — declared MIT OR Apache-2.0 OR LGPL-2.1-or-later — upstream: https://github.com/r-efi/r-efi has no license file on the path to /, at the release or on its default branch
  • selectors@0.36.1 (crates) — declared MPL-2.0 — upstream: https://github.com/servo/stylo has no license file on the path to selectors, at the release or on its default branch
  • selectors@0.38.0 (crates) — declared MPL-2.0 — upstream: https://github.com/servo/stylo has no license file on the path to selectors, at the release or on its default branch
  • ot-json1@1.0.2 (npm) — declared ISC — upstream: https://github.com/josephg/json1 has no license file on the path to / of its default branch, and no commit or tag identifies the release
  • ot-text-unicode@4.0.0 (npm) — declared ISC — upstream: https://github.com/ottypes/text has no license file on the path to / of its default branch, and no commit or tag identifies the release
  • unicount@1.1.0 (npm) — declared ISC — upstream: https://github.com/josephg/unicount has no license file on the path to /, at the release or on its default branch

License texts recovered from upstream — npm and crates (115)

These packages declare a license but their published artifact omits the text — usually a crate in a workspace whose LICENSE sits at the repository root, which cargo package does not include. The verbatim file was taken from the package's Git repository at the commit it was published from and is kept in licenses/upstream/; it is reproduced in the license texts below like any other notice. An entry marked default branch was taken from the repository's current default branch instead, because no commit or tag identifies the release or the release commit had no license file; the source.json beside the file says which.

Lines 1–500 of 24215.