# GAHUM third-party inventory

Reviewed September 28–30, 2026 for PUB-05/PUB-06. GAHUM-owned code is proprietary under
[LICENSE.txt](LICENSE.txt). This inventory does not extend that restriction to
third-party material or grant rights its owners have not granted. Copyright
holders, conditions and disclaimers appear in the linked original notices.
The public reading page is [Third-party notices](notices.html).

This is an inventory, not a legal clearance certificate. **Open rights checks**
are stated below; public availability and correct attribution alone do not
establish permission to redistribute a dataset, drawing or standards table.

## Browser libraries and fonts

PUB-01 moved the existing browser libraries and typefaces off remote CDNs.
Leaflet, osmtogeojson and font bytes are unmodified. MapLibre has leading
GAHUM source comments and normalized line endings; its executable/CSS content
matches the npm 5.24.0 distribution. Leaflet CSS changes are listed below.

| Asset | Source / version | License included with this build |
|---|---|---|
| `leaflet.js`, `leaflet.css`, `vendor/leaflet-1.9.4/images/` | [Leaflet 1.9.4 distribution](https://unpkg.com/leaflet@1.9.4/dist/) | [BSD-2-Clause](vendor/leaflet-1.9.4/LICENSE) |
| `osmtogeojson.js` | [osmtogeojson 3.0.0-beta.5 browser bundle](https://unpkg.com/osmtogeojson@3.0.0-beta.5/osmtogeojson.js) | [MIT](vendor/osmtogeojson-3.0.0-beta.5/LICENSE) |
| Bundled Lodash custom build, version 4.15.0 in its source | Included in osmtogeojson | [MIT and bundled notices](vendor/osmtogeojson-3.0.0-beta.5/lodash-LICENSE) |
| Bundled @mapbox/geojson-rewind | osmtogeojson dependency 0.5.2 | [ISC](vendor/osmtogeojson-3.0.0-beta.5/geojson-rewind-LICENSE.txt) |
| Bundled osm-polygon-features data | Included in osmtogeojson | [CC0](vendor/osmtogeojson-3.0.0-beta.5/osm-polygon-features-LICENSE) |
| `maplibre-gl.js`, `maplibre-gl.css` | [MapLibre GL JS v5.24.0](https://github.com/maplibre/maplibre-gl-js/tree/v5.24.0), already vendored | [BSD-3-Clause and bundled notices](vendor/MapLibre-LICENSE.txt) |
| Inter WOFF2 subsets, weights 400–700 | Google Fonts Inter v20, fetched 2026-09-27; original content-named files in `fonts/` | [SIL OFL 1.1](fonts/Inter-OFL.txt) |
| JetBrains Mono WOFF2 subsets, weights 400–600 | Google Fonts JetBrains Mono v24, fetched 2026-09-27; original content-named files in `fonts/` | [SIL OFL 1.1](fonts/JetBrainsMono-OFL.txt) |

Leaflet JS and osmtogeojson bytes match the SHA-256 integrity values previously
loaded from unpkg in `index.html`:

- Leaflet JS: `db49d009c841f5ca34a888c96511ae936fd9f5533e90d8b2c4d57596f4e5641a`
- osmtogeojson: `663bb5bbae47d5d12bff9cf1c87b8f973e85fab4b1f83453810aae99add54592`

Leaflet CSS is the upstream file with only its three image URLs changed to
`vendor/leaflet-1.9.4/images/`. Its original SHA-256 was
`a7837102824184820dfa198d1ebcd109ff6d0ff9a2672a074b9a1b4d147d04c6`.

The Google Fonts stylesheet was requested with
`family=Inter:wght@400..700&family=JetBrains+Mono:wght@400..600&display=swap`.
`fonts.css` retains its weights and Unicode ranges and replaces each remote
font URL with a local file. Font bytes are unmodified. Exported Study Reports
use system fallback fonts and make no font requests.

MapLibre's upstream file includes Mapbox, Evan Wallace and d3 notices. The
additional [dependency notices](vendor/MapLibre-DEPENDENCY-NOTICES.txt) cover
**27 packages** from its v5.24.0 release lock, including type/build extras.
Each archive was verified against the lock's integrity value; the notices
retain versions, source URLs and integrity values. MurmurHash's MIT text comes
from its published README. jsonlint 2.0.2 omits license metadata and a license
file: its MIT README notice is recovered from commit
`21c821af6c176bc0b8d240d715d416223d1deb7b`, whose `lib/jsonlint.js` matches
the npm 2.0.2 parser byte for byte. The ledger retains the source link,
parser hash and v2.0.2 comparison; it does not misrepresent this as a file
found in the npm tarball.
The vendored bundle matches the published 5.24.0 distribution after the
leading GAHUM comments and line-ending normalization. This resolved graph
is a conservative notice inventory, not a code-level license clearance.
Do not infer permission for a font, dataset or map style from a JS license.

## Rust dependencies and toolchain

[RUST_THIRD_PARTY_NOTICES.txt](vendor/RUST_THIRD_PARTY_NOTICES.txt) contains
**61 versioned packages**, their declared licenses, upstream source/repository
URLs, package authors where recorded, and full original license/notice files.
It covers the WASM dependency/build graph plus explicitly labelled additional
test dependencies. It is a conservative resolved-graph inventory, not a claim
that every package's code survives linking. Cached crate sources are unmodified.

Generate/check it with `node tests/js/rust-notices.js --write` / without
`--write`. The script reads `cargo metadata --locked --offline
--filter-platform wasm32-unknown-unknown`, then copies each crate's top-level
LICENSE, COPYING, COPYRIGHT and NOTICE files, including the declared license
file if different. All alternatives are retained, including unicode-ident's
additional Unicode terms. Review new packages and nested notices separately
when dependencies change; a metadata declaration alone is not legal analysis.

The compiler-provided [Rust library notices](vendor/rust-library-notices.html)
are an unmodified copy of `share/doc/rust/COPYRIGHT-library.html` from
`rustc 1.95.0 (59807616e 2026-04-14)`. This upstream library-wide collection
also includes code not linked into this app. SHA-256:
`90567e2718bf7fd65a71a3a43c5596488e80e5f51ed02bfea6fec54458b5f3d1`.
Refresh it from the release toolchain when that toolchain changes.

ESLint, its npm dependencies and local browser-test tools are development
tools, not shipped app dependencies. `package-lock.json` records npm tooling;
its packages keep their own notices in their installed distributions. The
project does not redistribute those installed tool directories in `dist/`.

## Maps and geographic data

| Material | Source and rights | Changes / notice / outstanding check |
|---|---|---|
| OSM geographic data, including 5-bus coordinates and corridor data | © OpenStreetMap contributors; [ODbL and attribution](https://www.openstreetmap.org/copyright) | The complete bundled [five-point extract](5bus-osm-geography.json) and [live alteration-method account](osm-geography-method.md) are offered under ODbL without additional GAHUM restrictions. Problem JSON carries a conditional geographic notice. Electrical and SLD values are separate original study material. |
| Light basemap | [OSM tile service](https://operations.osmfoundation.org/policies/tiles/), OSM data | External, unmodified tiles, on map opt-in; on-map credit now links the OSM copyright/license page. PUB-10 verifies the official endpoint and provider-managed HTTP caching locally. |
| Dark basemap and style resources | [OpenFreeMap](https://openfreemap.org/quick_start/), OpenMapTiles, OSM | Linked OpenMapTiles and OSM map credits, plus an accessible design-notices link. Dark Matter code is BSD-3-Clause and design CC BY 4.0, derived from CartoDB Basemaps by Stamen and Paul Norman (CC BY 3.0). Original notices are retained in [map-resource-notices.txt](vendor/map-resource-notices.txt). Live resources are not version-pinned; recheck when changed. |
| Dark-map label glyphs | Noto Sans Regular from MapLibre demotiles | Externally served SIL OFL 1.1 font. Separate from GAHUM's local UI fonts; original notice retained in the map-resource ledger. |
| Dark-map shared sprite | OpenFreeMap collection of Liberty/Maki, arrow and Bright assets | Mixed sources: Maki CC0, public-domain arrow, Bright BSD/CC BY design terms. Retain the source notices and design credits rather than labelling the entire sprite MIT. |
| Natural Earth II raster | [Natural Earth terms](https://www.naturalearthdata.com/about/terms-of-use/) | Public-domain shaded relief declared by the dark style; credited as useful provenance. |
| Infrastructure queries | [Overpass API](https://overpass-api.de/), OSM data | OSM elements filtered and converted for map display/import. Endpoint service policy is separate from the database license. |

All provider requests require **Enable maps**. See [privacy](privacy.html#maps).
These services' software is not vendored by GAHUM merely because it is queried.
The repository record `docs/pub05-map-credits-research-2026-09-30.md` gives
the sampled style/source comparison, sprite build and exact notice revisions.
The dark style and sprite matched OpenFreeMap Styles revision
`72e1480dfc92858d334647037988bd2591fdb021`; the Noto notice comes from
MapLibre demotiles `601ae60796ceceda2cbd2ed3d2ea92d17a84be4b`.
GAHUM requests the provider's style JSON unchanged and draws its Power System
separately. PUB-10 still owns endpoint and cache-policy checks.

## Cases, arrangements and test data

Current inventory reviewed 2026-10-14. The owner chose independently authored
replacements for source material without a recovered reuse basis.

| Material | Source and modifications | Basis |
|---|---|---|
| Original 5/9/12-bus electrical examples | `tools/authored-presets-reference.py` defines original networks and prescribed voltage phasors, then derives injections by circuit laws. Static inputs are in `src/teaching_cases/`. | GAHUM-authored material under the project license. No retired textbook or unidentified online values are retained. |
| All preset SLD arrangements | Authored coordinate layouts, including the 14-bus arrangement. | Original project material; no traced source figures retained. |
| IEEE 14-bus electrical/reference data | [PGLib-OPF v17.08 case](https://github.com/power-grid-lib/pglib-opf/blob/bfaba141cc7173c9f719042f74076b1e9da2f592/pglib_opf_case14_ieee.m), © 1999 Richard D. Christie, University of Washington. Branches, loads, bus types, shunt and original-value generator/solution notes match. | Express [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/) data grant. Uniform 230 kV physical bases, costs, ratings, fault reactances and SLD positions are added teaching assumptions; this is not an unchanged OPF case. |
| Complete RAW/DGS fixtures | Independently authored five-bus RAW/DGS and three-bus DGS dispatch examples. | Original project material. Replaces complete ANDES/GridCal files whose separate data grant was not recovered. Functional grammar coverage does not certify complete vendor compatibility. |
| Adapted v33 excerpt | LANL-ANSI/grg-pssedata source and changes in [fixture rights](tests/fixtures/RIGHTS.md). | Retained PGLib CC BY 4.0 underlying data attribution and original LANL BSD-3 conversion notice. Precise conversion chain is not known. |
| Generated Envelope fixtures | Generated from current original/licensed cases and synthetic inputs. | Output retains underlying data rights; repository-only, not copied to the release. |

The historical source investigations remain in `docs/pub05-*-research-*.md`.
Retiring unresolved material does not claim permission for its old copies or
rewrite Git history. Current public [example sources](examples.html) identify
the supplied values and assumptions.

## Standards and names

`src/harmonics.rs` implements numerical voltage-THD reference bands attributed
to **IEEE 519-2014**; PUB-02 makes the edition and limited scope explicit in
panels and Study Reports. No complete standard or scan ships with the app.
[IEEE's permission guidance](https://standards.ieee.org/ipr/stdspermission/)
distinguishes references by title/designation from reuse of standard content.
On 2026-10-14 the full reference-band table, including its unused individual-
harmonic column, was removed from Study Reports. The implementation retains
independently calculated per-bus THD and its selected numerical reference,
edition attribution and method limitations. No standard prose, scan, figure
or complete table is reproduced. The [bounded source review](docs/pub05-ieee-case-followup-2026-10-14.md)
records the factual-rule/presentation distinction; it is not an IEEE permission
grant or a legal opinion. Reassess rights before adding reproduced content.

IEEE, DIgSILENT PowerFactory, Siemens PSS/E and other names identify sources,
formats or products of their respective owners. No trademark license,
affiliation, endorsement, certification or complete compatibility is claimed.