# Third-Party Notices

This project includes or references third‑party software. The following notices are provided for attribution and license compliance.

## Self-hosted, hash-pinned vendored dependencies (Range Twin competition client)

The `range.primox.net` competition origin holds the Supabase session JWT + refresh token in
localStorage, so it must contain ZERO live-CDN runtime code (Slice 4 D-C10): every runtime dep is
SELF-HOSTED under `web/competition/vendor/` and pinned by SHA-256. The `constants.generated.js`
config is the only per-deploy value; the vendored code is fixed at these hashes. Re-vendor via
`scripts/vendor-deps.mjs` (records versions + hashes) and update this block if a version changes.

| File | Package | Version | License | SHA-256 |
|------|---------|---------|---------|---------|
| `web/competition/vendor/supabase.js` | `@supabase/supabase-js` (bundled ESM: auth-js, postgrest-js, realtime-js, storage-js, functions-js, all 2.110.7) | 2.110.7 | MIT | `3cffec9fa9673aa62f2f42929eba4f0a91847ff702e4dc77c09a6db74702ff13` |
| `web/competition/vendor/three.module.js` | three.js (build/three.module.js; re-exports `./three.core.js`) | 0.180.0 | MIT | `c8211c69345d2e9949dc7a8ac969380497aa0600a5a8ac6a459c8cd02dd9cb8a` |
| `web/competition/vendor/three.core.js` | three.js (build/three.core.js) | 0.180.0 | MIT | `eb077d2417f61d3e6d9264c317cabc4ea35769ed6b0ab533067292a550784c20` |

`supabase.js` is a fully self-contained browser ESM produced by esbuild 0.25.0
(`--bundle --format=esm --platform=browser --target=es2020`, legal comments inlined) from
`@supabase/supabase-js@2.110.7`; it contains ZERO transitive `https://`/`//` import specifiers
(grep-asserted by `scripts/check-no-cdn.mjs`, D-C10). No `@supabase/node-fetch` is bundled, the
browser build uses the platform `fetch`/`WebSocket` globals.

## Three.js (legacy CDN pages)
- Project: three.js (used via unpkg CDN on the fork's OTHER origin, NOT range.primox.net)
- Version: 0.180.0 (fclass-sim, steel-sim, wind-gen, how-it-works importmaps)
- License: MIT
- Website: https://threejs.org/
- Source: https://github.com/mrdoob/three.js
- CDN: https://unpkg.com/three@0.180.0/
- NOTE: the Range Twin competition client does NOT use this CDN copy, it self-hosts three@0.180.0
  (see the hash-pinned block at the top of this file). These CDN references apply only to the legacy
  simulator pages, which are excluded from the range.primox.net deploy artifact (P1).

## PeerJS
- Project: PeerJS (WebRTC peer-to-peer connections; used for F-Class Remote Play)
- Version: 1.5.4
- License: MIT
- Website: https://peerjs.com/
- Source: https://github.com/peers/peerjs
- CDN: https://esm.sh/peerjs@1.5.4

## KaTeX
- Project: KaTeX (math typesetting; used on the How It Works page)
- Version: 0.16.9
- License: MIT
- Website: https://katex.org/
- Source: https://github.com/KaTeX/KaTeX
- CDN: https://cdn.jsdelivr.net/npm/katex@0.16.9/

## Referenced network services (Remote Play)
- PeerJS broker (signaling): the PeerJS library's default PeerServer Cloud is used to negotiate peer connections. Operated by the PeerJS project; not bundled with this software.
- Google public STUN servers (NAT traversal): stun:stun.l.google.com:19302 and stun1–stun3.l.google.com:19302. Operated by Google; referenced for connectivity only.
- WebRTC media/data transport is provided by the user's browser (a W3C/IETF standard); no third-party software is bundled for it.

## WebGL Noise (Simplex/Perlin)
- Authors: Stefan Gustavson; Ashima Arts (Ian McEwan et al.)
- License: MIT
- Source: https://github.com/stegu/webgl-noise and https://github.com/ashima/webgl-noise
- Usage: GLSL simplex noise functions used in shaders.

## Emscripten / LLVM Toolchain
- Project: Emscripten SDK (build toolchain)
- Licenses: Various (MIT/LLVM)
- Website: https://emscripten.org/

If you believe an attribution is missing or incorrect, please open an issue in the repository.