# Third party software

This application is independently implemented. The original Vibe-3D repository, img2threejs, Modly and LinearAbiltyCastingThreeJS were inspected as design references; their implementation and separately licensed art assets are not copied here.

The vendored `src/vendor/three-mf` is three-mf-kit 0.3.0 from [3mfPaintSplit](https://github.com/EllsworOpan/3mfPaintSplit/tree/39e75f85c31eaa4e6daf31d0d2d3fde167f562c0/src/vendor/three-mf), commit `39e75f85c31eaa4e6daf31d0d2d3fde167f562c0`, sourceHash `50d2a10c886542838926716ba627dc49a877e8c2a964fa2d106e55b97d035110`. The MIT license and its dependencies' notices are retained in that directory. It is used for clean manufacturing models; compatibility requires separate slicer validation.

RepliCAD 1.1.0 is MIT. replicad-opencascadejs 1.1.0 and opencascade.js 2.0.0-beta.fdece36 are LGPL 2.1; they load as separate WebAssembly modules. Their licenses are retained in npm packages and src/vendor/occt. Corresponding source and build recipes: [RepliCAD pinned source](https://github.com/sgenoud/replicad/tree/e4b05f67dc4e2393a876ce8c5064a9c93db05bf1/packages/replicad-opencascadejs), [OpenCascade.js](https://github.com/donalffons/opencascade.js/tree/fdece36). A fixed author metadata shim is documented with its reproducible source patch in src/vendor/occt/README.md. Production packaging must include module licenses, pinned build manifests and working source links, and permit replacing these separate modules.

Manifold is Apache 2.0. Three.js, React, React Three Fiber, Drei, Zustand, fflate, Zod, Fastify, lucide and application development tools use their respective licenses from the pinned package lock. Do not remove package licenses when assembling releases.

meshoptimizer 1.1.1 is MIT, Copyright Arseny Kapoulkine. The pinned JavaScript/WASM simplifier generates display-only LOD in the browser Worker; manufacturing geometry is retained. [Pinned source](https://github.com/zeux/meshoptimizer/tree/v1.1.1), license retained in its npm package.

## Independent X3D / VRML validation

X_ITE 16.5.0 (MIT), pinned as a development-only npm dependency. Official source: https://github.com/create3000/x_ite. Its distribution and third-party notices remain in the development package; it is neither included in the product bundle nor installed on the production server. Tests serve it locally and block requests to other origins.

PNG screenshot validation uses development-only pngjs 7.0.0 (MIT) and @types/pngjs 6.0.5 (MIT). Package versions and integrity hashes are fixed in package-lock.json; neither is used by the production runtime.