# Third-party notices What Splashery Lite ships that is not its own code, with each license. Every library is vendored (a plain copy in the repo, no CDN, no bundler) and loaded only when something needs it. The captures, sounds, and other assets have their credits in [CREDITS.md](CREDITS.md), not here (the CC BY captures this site edited itself are listed below too). The code is MIT ([LICENSE](LICENSE)). `node tools/license-audit.mjs` checks that every directory under `vendor/` and `src/splashery/vendor/` is named here. A new library is added to this file in the same pull request that adds it (a copyleft license, a library that calls a server, or one over 2 MB goes to the owner first, through the Operator). ## WebP codec (splat-transform, with libwebp) - Files: `src/vendor/webp/` (`webp.mjs`, `webp.wasm`, `LICENSE`, `README.md`), the one copy (it was two until October 19, 2026: Lite's own `vendor/playcanvas-webp/`, the same bytes, is gone). The two code files are byte-for-byte the ones the main repo ships as `vendor/webp/`, copied unchanged from `@playcanvas/splat-transform@3.6.1` (`lib/`), which compiles libwebp to WebAssembly. Lite's SOG reader (`src/lib/sog.js`) loads them to read the WebP-coded textures of a capture, and the Splat toolkit (lane LSTUDIO) to open or save a .sog file inside its worker: SOG keeps splats in lossless WebP pictures whose bytes must come back exactly, and the browser's own decoder, read through a canvas, premultiplies alpha and changes them. - Sources: https://github.com/playcanvas/splat-transform (PlayCanvas Ltd.) and https://chromium.googlesource.com/webm/libwebp (Google Inc.), as the main repo's `LICENSES.md` records them (checked there on October 5, 2026). - Licenses: MIT (splat-transform) and BSD-3-Clause with Google's patent grant (libwebp). Both texts are in `src/vendor/webp/LICENSE` (the main repo's `vendor/webp/LICENSE`, checked on October 5, 2026) and are repeated below. ``` Copyright (c) 2011-2026 PlayCanvas Ltd. Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. ----- libwebp (compiled into webp.wasm) ----- Copyright (c) 2010, Google Inc. All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. * Neither the name of Google nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. Additional IP Rights Grant (Patents) ------------------------------------ "These implementations" means the copyrightable works that implement the WebM codecs distributed by Google as part of the WebM Project. Google hereby grants to you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, transfer, and otherwise run, modify and propagate the contents of these implementations of WebM, where such license applies only to those patent claims, both currently owned by Google and acquired in the future, licensable by Google that are necessarily infringed by these implementations of WebM. This grant does not include claims that would be infringed only as a consequence of further modification of these implementations. If you or your agent or exclusive licensee institute or order or agree to the institution of patent litigation or any other patent enforcement activity against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that any of these implementations of WebM or any code incorporated within any of these implementations of WebM constitute direct or contributory patent infringement, or inducement of patent infringement, then any patent rights granted to you under this License for these implementations of WebM shall terminate as of the date such litigation is filed. ``` ## Splashery's own code (vendor/splashery/) - Files: `vendor/splashery/`, copied unchanged from ryanjosephkamp/splashery at commit `57b0c3aa` on October 18, 2026 (the list and SHA-256 of each file are in `vendor/splashery/VENDOR.json`; `node tools/check-vendor.mjs` fails if one differs). This copy is being retired: the same code is now synced into `src/splashery/` (`src/splashery/PROVENANCE.json`), and `vendor/splashery/` goes with it. - Source: Splashery (https://splashery.app/); the copied files are served at https://ryanjosephkamp.github.io/splashery-assets/ - License: MIT (Ryan Kamp; the code is the project's own) ``` MIT License Copyright (c) 2026 Ryan Kamp Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. ``` ## gifenc 1.0.3 - Files: `src/splashery/vendor/gifenc/` (`gifenc.esm.js`, `LICENSE.md`): the GIF encoder that the synced code's exports import (`src/splashery/exports.js`), from the npm package `gifenc@1.0.3`. The only change is that the source-map comment was removed from `gifenc.esm.js`, because the map is not shipped. - Source: https://github.com/mattdesl/gifenc - License: MIT ``` The MIT License (MIT) Copyright (c) 2017 Matt DesLauriers Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. ``` ## pdf-lib 1.17.1 (lane LSHELL, copied from Splashery) - Files: `src/splashery/vendor/pdf-lib/` (`pdf-lib.esm.min.js`, the package's `dist/pdf-lib.esm.min.js`, unchanged, 523 KB, and `LICENSE.md`), brought along by `tools/sync-from-main.mjs` from the main repo's `vendor/pdf-lib/` for the synced `src/splashery/pdf-export/pdf.js`, which imports it by a relative path (`index.html`'s import map sends that to the copy). - Source: https://github.com/Hopding/pdf-lib (Andrew Dillon). - Loaded only when someone makes a PDF with Save PDF on the Share tab (a dynamic import). Never on first paint, on the shelf, or in an embed. - License: MIT (checked on the live repository's `LICENSE.md` and the npm package on October 19, 2026; the full text is in `src/splashery/vendor/pdf-lib/LICENSE.md`). The bundle includes its dependencies, all permissive: `pako` (MIT and Zlib), `@pdf-lib/standard-fonts` and `@pdf-lib/upng` (MIT), and `tslib` (Apache License 2.0, its notice kept at the top of the file). It uses only the 14 standard PDF fonts; no font file is embedded. ## QR Code generator library (Project Nayuki) - Files: `src/splashery/vendor/qrcodegen/` (`qrcodegen.js`, `LICENSE`), synced from the main repo's `vendor/qrcodegen/` (`src/splashery/PROVENANCE.json` has its hash). It is Project Nayuki's library, https://www.nayuki.io/page/qr-code-generator-library, from https://github.com/nayuki/QR-Code-generator at commit `3c6d0b3cefb4e049dc337e82237c9644399716a8` (`typescript-javascript/qrcodegen.ts`), compiled to JavaScript with TypeScript 5.6.3 (`tsc --target ES2020 --module none`); Splashery added only a header comment and one `export default qrcodegen;` line at the end, so it loads as an ES module. - Used by: `src/splashery/qr/encode.js`, which the Manual's share-link demo and the QR toys load. Nothing loads it until one of them opens. - License: MIT (checked on the live project page by the main repo on October 3, 2026). ``` QR Code generator library (TypeScript) Copyright (c) Project Nayuki. (MIT License) https://www.nayuki.io/page/qr-code-generator-library Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: - The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. - The Software is provided "as is", without warranty of any kind, express or implied, including but not limited to the warranties of merchantability, fitness for a particular purpose and noninfringement. In no event shall the authors or copyright holders be liable for any claim, damages or other liability, whether in an action of contract, tort or otherwise, arising from, out of or in connection with the Software or the use or other dealings in the Software. ``` ## jsQR 1.4.0 (lane LSTUDIO) - Package: `jsqr@1.4.0` (file: `src/vendor/jsqr/jsQR.js`, the package's `dist/jsQR.js`, unchanged, copied from Splashery's `vendor/jsqr/`; the license is in `src/vendor/jsqr/LICENSE`). - Source: https://github.com/cozmo/jsQR (Cosmo Wolfe). - Why `src/vendor/`: Splashery's code (copied unchanged to `src/splashery/`) asks for it by the relative path `../../vendor/jsqr/jsQR.js`, from a script tag and from a worker, and neither can use the import map. - Loaded only when a QR tool checks that a code scans. - License: Apache License 2.0 (the full text is in `src/vendor/jsqr/LICENSE`). ## ZXing for JavaScript 0.21.3 (lane LSTUDIO) - Package: `@zxing/library@0.21.3` (file: `src/vendor/zxing-js/zxing.min.js`, the package's `umd/index.min.js`, unchanged, 332 KB, copied from Splashery's `vendor/zxing-js/`; the license is in `src/vendor/zxing-js/LICENSE`). - Source: https://github.com/zxing-js/library (the ZXing for JS authors, a port of ZXing). - Loaded only when a QR tool or the Other barcodes toy reads a code back, and for the Data Matrix and Aztec writers. - License: Apache License 2.0 (the full text is in `src/vendor/zxing-js/LICENSE`). The package's `package.json` says "MIT"; both are permissive and allowed here, and we follow the LICENSE file. ## zxing-wasm 3.1.4, with zxing-cpp (copied from Splashery) - Package: `zxing-wasm@3.1.4`'s read-only build (files: `src/splashery/qr-craft/vendor/zxing/share.js` and `reader/index.js`, unchanged ES modules copied with Splashery's code; the licenses are in `src/splashery/qr-craft/vendor/zxing/`: `LICENSE`, `LICENSE-wrapper`, and `LICENSE-zxing-cpp`). - Source: https://github.com/Sec-ant/zxing-wasm (Ze-Zheng Wu), wrapping zxing-cpp (https://github.com/zxing-cpp/zxing-cpp, its source pinned at commit `0b2d9a8`). - Its 953,527-byte reader binary (`reader/zxing_reader.wasm`) is not copied: the code asks for it on Splashery's site, as the sync's one rewrite sends every file a module finds beside itself. - Loaded only when Picture QR's Most detail checks a code with a second, independent reader. - License: MIT for the wrapper (the repository's license, checked on its live page on October 23, 2026) and Apache License 2.0 for zxing-cpp (the full texts are beside the modules). ## Splat.js 0.1.0 (lane LSTUDIO, copied from Splashery) - Source: https://github.com/arrival-space/splat.js, commit `88efe9aaf32279b0b9bcb781ea0deb4d60c49dff` (September 23, 2026; package version 0.1.0). Files in `src/vendor/splatjs/src/`: the modules that `session.js` and its two workers reach (structure from motion, the WebGPU trainer, frame decoding and the PLY writer), unchanged except for the local changes below; the list and what was left out are in `src/vendor/splatjs/VERSION.md`. The library's own video reader (`src/io/video.js`, which loads Mediabunny, MPL-2.0) is not vendored: Splashery picks the frames itself. - Loaded only when someone opens a video in the Video to 3D toy (a dynamic import in `src/video3d/run.js`); never on the shelf, in another toy or in an embed. Labs only. - License: MIT (Copyright (c) 2026 Stratum1 GmbH; checked on the live repository page on September 30, 2026; the full text is in `src/vendor/splatjs/LICENSE`). - Local change by Ryan Kamp for task 40 (October 12, 2026): `src/session.js` accepts `refineStart`, an opt-in first-refinement threshold for short offline build-tool passes. It replaces the hardcoded `trainer.iter > 1500` check with `trainer.iter > (this.opts.refineStart ?? 1500)` so a build tool can refine a short run explicitly. Omitted or null values retain the original 1,500-step threshold. Task 88's browser integration now passes a threshold that fits each tier's budget. The original vendor edit is isolated in commit `ffcc71cc`. The MIT notice is retained. - Local change by Ryan Kamp for task 55 (October 13, 2026): `src/gs/trainer.js` binds the existing camera-gradient buffer at binding 8 in the optional D-SSIM backward pass. Its shader requires that buffer even when camera optimization is off; the missing binding invalidated every command buffer while the iteration counter continued advancing. The offline tool requests the nine storage bindings this pass needs and rejects GPU validation errors. The browser toy still uses the original MSE training default. The MIT notice is retained. - Local changes by Ryan Kamp for task 88 (October 15, 2026): a session owns its outstanding worker, frame-decoder, and GPU resources through disposal. An abort-safe worker queue terminates both feature and pair workers on cancellation or error. The optional `seedLimit` reserves room for appended surface samples without increasing the requested seed count or changing default Gaussian parameters. Trainer buffers are released separately from a host-owned GPU device. The last training batch is limited to the remaining iteration budget. `src/vendor/splatjs/VERSION.md` records the patched files. The upstream MIT notice is retained; original task 88 code is offered under this repository's MIT license. ## laz-perf 0.0.7 (lane LSTUDIO, copied from Splashery) - Package: `laz-perf@0.0.7` (files: `src/vendor/laz-perf/laz-perf.js` and `src/vendor/laz-perf/laz-perf.wasm`, the package's `lib/worker/` build, with two comment lines added at the top of the JavaScript and one `export default createLazPerf;` line at its end, so it loads as an ES module; nothing else changed). - Source: https://github.com/hobuinc/laz-perf (Hobu, Inc.), a LAZ (compressed LAS) reader compiled to WebAssembly. It is the permissive choice the brief asked for, so no LGPL library is used. - Loaded only when someone opens a .laz file in the Point clouds toy (inside its worker). Labs only. - License: Apache License 2.0 (checked on the npm package and the live repository's COPYING on October 5, 2026; the full text is in `src/vendor/laz-perf/LICENSE`). ## dicom-parser 1.8.21 (lane LSTUDIO, copied from Splashery) - Package: `dicom-parser@1.8.21` (file: `src/vendor/dicom-parser/dicomParser.min.js`, the package's `dist/dicomParser.min.js`, unchanged, 32 KB; the license is copied to `src/vendor/dicom-parser/LICENSE`). - Source: https://github.com/cornerstonejs/dicomParser (Chris Hafey and the Cornerstone contributors). It parses DICOM files' elements; the volume viewer reads the pixels itself (uncompressed and RLE Lossless). - Loaded only when someone opens a DICOM file in the Volume viewer (labs). It makes no network calls. - License: MIT (checked on the npm package and the live repository's LICENSE on October 8, 2026; the full text is in `src/vendor/dicom-parser/LICENSE`). ## PDF.js 6.3.289 - Package: `pdfjs-dist@6.3.289`. Files in `src/vendor/pdfjs/` (4.7 MB): the legacy build's `pdf.min.mjs` and `pdf.worker.min.mjs`, and the package's `standard_fonts/`, `cmaps/`, `iccs/`, and three decoders in `wasm/`, all unmodified, copied from the main repo's `vendor/pdfjs/` (its `LICENSES.md` has the full list). The license is in `src/vendor/pdfjs/LICENSE`. - Loaded only when a picture toy opens a PDF (Your book, Picture lab: a dynamic import in the copied `src/splashery/media.js`). It is in `src/vendor/` because main's code finds it by a relative path from `src/`, which a worker can't take through the import map (lane LLAB, October 19, 2026). - Approved for Splashery by the owner on September 28, 2026, and the approval carries to Lite. - Source: https://github.com/mozilla/pdf.js - License: Apache License 2.0 (the full text is in `src/vendor/pdfjs/LICENSE`). The wasm decoders are under their own licenses, in `src/vendor/pdfjs/wasm/LICENSE_*` (OpenJPEG: BSD 2-clause; jbig2 from PDFium: BSD 3-clause and Apache 2.0; qcms: MIT). ## omggif 1.0.10 - Package: `omggif@1.0.10`, as the main repo ships it in `vendor/omggif/`: `omggif.js` with two comment lines at the top and one `export { GifWriter, GifReader };` line at the end, so it loads as an ES module. Copied to `src/vendor/omggif/` with its license notice (`LICENSE`). - Loaded only when a picture toy opens a GIF in a browser without ImageDecoder (Safari). - Approved for Splashery by the owner on September 28, 2026. - Source: https://github.com/deanm/omggif - License: MIT. ## ONNX Runtime Web 1.30.0 (its modules) - Package: `onnxruntime-web@1.30.0`. Files in `src/vendor/onnxruntime-web/` (14 MB): the two JavaScript modules, `ort.wasm.min.mjs` and `ort-wasm-simd-threaded.mjs`, and the WebAssembly file `ort-wasm-simd-threaded.wasm` (14 MB), all unmodified, with the license in `LICENSE`. The depth worker (`src/splashery/depth/engine.js`) asks for the runtime and the depth model by a relative path and needs both on one origin, so all of it is in Lite (lane LSTUDIO, October 19, 2026: the Operator's decision that the code and what it fetches in the depth worker are vendored). - Loaded only when a picture toy pops a photo out of a PDF page (a dynamic import in the copied `src/splashery/packs/photo-3d-depth.js`), and for the depth toys of lane LSTUDIO, and (lane Audio piano) when a piano toy hears a recording's notes (`src/splashery/transcribe/engine.js`). - Approved for Splashery by the owner on September 29, 2026, with the depth model. - WebGPU build (lane video stability, October 20, 2026): `ort.webgpu.min.mjs` (66 KB), `ort-wasm-simd-threaded.asyncify.mjs` (53 KB), and `ort-wasm-simd-threaded.asyncify.wasm` (26.8 MB), from the same `onnxruntime-web@1.30.0` package's `dist/`, unmodified, beside the WASM build in `src/vendor/onnxruntime-web/` (same license). The depth worker loads them only when Moving photo to 3D asks for the WebGPU provider and the browser has a WebGPU adapter with shader-f16; otherwise it loads the WASM build as before. `?old=video-wasm` never asks. - Source: https://github.com/microsoft/onnxruntime - License: MIT (Copyright (c) Microsoft Corporation). ## Depth Anything V2 Small, quantized ONNX (lane LSTUDIO, copied from Splashery) - File: `src/vendor/depth-anything-v2-small/model_quantized.onnx` (27,258,801 bytes), the int8 build from https://huggingface.co/onnx-community/depth-anything-v2-small, unmodified, as Splashery ships it in `vendor/depth-anything-v2-small/`; its model card is `MODEL-CARD.md` and the license `LICENSE` beside it. - Loaded only when a depth tool (Photo to 3D, Moving photo to 3D, Step inside a 360° photo, Room echo meter, Splat mirror) estimates a depth, once, inside a worker; never on the shelf. It runs on this device through the WASM provider; nothing is sent anywhere. - Approved for Splashery by the owner on September 29, 2026, with ONNX Runtime Web. - License: Apache License 2.0 (model card and the full text in `src/vendor/depth-anything-v2-small/LICENSE`). - Half-precision build (lane video stability, October 20, 2026): `src/vendor/depth-anything-v2-small/model_fp16.onnx` (49,642,442 bytes, SHA-256 `2df6223f206b5164e21f664ace61dabeb9bb6a49b8b5a3e00510b4807d0f5b04`), `onnx/model_fp16.onnx` of the same repository at commit `4472b7362082ad9968fee890ca0f1e5aca36b93d`, unmodified; the repository's license is Apache-2.0 (checked on its page on October 20, 2026), as the int8 build's. Loaded by the depth worker's WebGPU provider only (Moving photo to 3D, and Photo to 3D's own photos since lane photo depth, October 21, 2026); the int8 build stays the WASM model. ## Piano transcription note model, ONNX (lane Audio piano, October 21, 2026) - File: `src/vendor/piano-transcription/note_h16.onnx` (40,540,255 bytes, SHA-256 `881300dc7ad7b8aec4bc914b097053c5d2998f07f105eca70749d99bd7b10ad1`), made by `tools/piano-model-export.py` from the checkpoint `CRNN_note_F1=0.9677_pedal_F1=0.9186.pth` by Qiuqiang Kong (https://zenodo.org/records/4034264): the note model of Kong et al., "High-resolution Piano Transcription with Pedals by Regressing Onset and Offset Times" (2021). Changes: only the note model is kept, exported to ONNX without its log-mel front end, with its weights stored as 16-bit floats (cast back to 32 bits when it loads). Its model card is `MODEL-CARD.md` and the license, with the changes, `LICENSE`, beside it. - License: Creative Commons Attribution 4.0 International (CC BY 4.0), as the Zenodo record states (checked on the live page on October 21, 2026). Credited in `CREDITS.md` and in the piano toys' song panel. - The model code restated in `tools/piano-model-export.py` and the note-making restated in `src/splashery/transcribe/notes.js` come from https://github.com/bytedance/piano_transcription (Apache License 2.0, as its README states; checked October 21, 2026) and https://github.com/qiuqiangkong/piano_transcription_inference (MIT, as its `setup.py` states). - Loaded only when a piano toy's song panel opens a recording with Recordings: Piano chosen, inside a worker; it runs on this device through the vendored ONNX Runtime (WebGPU or WASM), and nothing is sent anywhere. Needs the owner's approval before it goes to Splashery. ## Basic Pitch, ONNX (lane Audio piano, October 21, 2026) - File: `src/vendor/basic-pitch/nmp.onnx` (230,444 bytes, SHA-256 `2c3c1d144bfa61ad236e92e169c13535c880469a12a047d4e73451f2c059a0ec`), unmodified, from `basic_pitch/saved_models/icassp_2022/nmp.onnx` of https://github.com/spotify/basic-pitch at commit `fa5997af0a8210982619003269994a1be25eddf3` (version 0.4.0). Its model card is `MODEL-CARD.md`, and the repository's `LICENSE` and `NOTICE` are beside it. - License: Apache License 2.0 (Copyright 2022 Spotify AB), checked on the repository's page on October 21, 2026. The windows and note-making in `src/splashery/transcribe/basic-pitch.js` are restated from its `inference.py` and `note_creation.py` (same license). - Loaded only when a piano toy's song panel opens a recording with Recordings: Any instrument chosen, inside a worker, through the vendored ONNX Runtime; nothing is sent anywhere. Needs the owner's approval before it goes to Splashery. ## Instrument Serif and JetBrains Mono (the Pitch page, ported by lane LSHELL2) - Files: `site/assets/pitch/instrument-serif.woff2`, `instrument-serif-italic.woff2`, and `jetbrains-mono-500.woff2` (35 KB in all), copied unchanged from Splashery's Pitch page (lane Pitch2), which subset them with fontTools to the characters the page uses; JetBrains Mono is pinned to weight 500. Their license texts are beside them (`OFL-instrument-serif.txt` and `OFL-jetbrains-mono.txt`). - Sources: https://github.com/Instrument/instrument-serif (The Instrument Serif Project Authors) and https://github.com/JetBrains/JetBrainsMono (The JetBrains Mono Project Authors), both taken from https://github.com/google/fonts on October 14, 2026. - Loaded only by the Pitch page (`site/about/splashery/`, through `site/assets/pitch.css`), with system fonts as the fallback. - License: SIL Open Font License 1.1, checked on October 14, 2026. Neither font declares a Reserved Font Name; the page names the subsets "Pit Serif" and "Pit Mono". ## Lato and Source Code Pro (the Observatory look's fonts) - Files, in `design/fonts/`: `sx-night-light-ascii.woff2` (9,788 bytes, Lato Light, the Playground's names), and for the pages `sx-night-light-latin.woff2` (15,528 bytes), `sx-night-regular-latin.woff2` (15,584 bytes), and `sx-night-mono-latin.woff2` (7,136 bytes, Source Code Pro Regular). Their license texts are beside them (`OFL-lato.txt` and `OFL-source-code-pro.txt`). - Sources: Lato 1.105 and Source Code Pro 2.038, the copies in RDoc 7.0.4's `darkfish` template, cut by `tools/design-font.mjs` ([design/FONTS.md](design/FONTS.md)). - License: SIL Open Font License 1.1, checked at https://github.com/google/fonts on October 31, 2026. Lato's license reserves the name "Lato" and Source Code Pro's reserves "Source", so these subsets are renamed "SX Night Sans" and "SX Night Mono". ## Fredoka, bold, Latin subset (Splat Name's letters) - File: `vendor/fredoka/fredoka-700.woff2` on the assets site (about 15 KB), weight 700, with its license text beside it (`vendor/fredoka/OFL.txt`); classic Splashery's copy, served unchanged. - Source: https://github.com/hafontia/Fredoka-One (Copyright 2016 The Fredoka Project Authors). - Loaded only when Splat Name opens (`src/splashery/packs/name-toy.js`, `loadFont`), as the face "Splashery Fredoka", with the device's fonts as the fallback. - License: SIL Open Font License 1.1, checked on October 26, 2026. It declares no Reserved Font Name. ## CC BY 4.0 captures edited here (October 24, 2026) Five photoreal captures from SuperSplat, each under the [Creative Commons Attribution 4.0 license](https://creativecommons.org/licenses/by/4.0/) ("CC BY 4.0" on its live page, checked October 24, 2026): its SOG and a 100,000-splat light file, served from Cloudflare R2 (the bucket `splashery-assets` at https://assets.splashery.app/, `toys//`) since the evening of October 24, and a shelf picture rendered from it in `assets/toys//`. Each was made by `tools/capture-edit.mjs` from its recipe in `tools/capture-edit.json`, and is credited beside the toy and in [CREDITS.md](CREDITS.md). Since that evening the captures here are made without the edits that hid a mark; the first files, with them, are served with `?old=redactions`, and [docs/licenses/redactions.csv](docs/licenses/redactions.csv) lists each one, the changes below included. The changes, for all five: converted to SOG with the spherical harmonics removed (base colors only), turned upright, recentered and scaled, and loose floaters removed; and for each: - Ship model: "Soleil Royal" by Deutsches Schifffahrtsmuseum (German Maritime Museum), https://superspl.at/scene/9047eb5d. No other change. - Typewriter: "TypeWriter-02" by Kevin Lai, https://superspl.at/scene/e5914782. No other change (the first files: the maker's name painted out on the paper table and the front badge, and the model number on the frame). - Vanadinite: "Vanadinite" by Yann de Couëssin, https://superspl.at/scene/663d6a97. The few splats under the coin it stands on cropped away (the first files: the coin cropped away). - Rangefinder camera: "Kiev Camera (improved)" by Mykhailo Moroz, https://superspl.at/scene/18d5032c. The tripod cropped and the bottom plate under its mount filled in (the first files: the maker's name and logos, the lens's name and markings, and the serial numbers painted out too). - Cherry tree: "Cherry Blossom" by Garrett Nelli, https://superspl.at/scene/722a5496. The lawn around it cropped to a round patch. Eight more, made the same way and under the same license ("CC BY 4.0" on each live page, checked October 24, 2026, when their files were downloaded). Their SOG and light files are served from Cloudflare R2 (the bucket `splashery-assets` at https://assets.splashery.app/, `toys//`) instead of the repo; their shelf pictures are in `assets/toys//`. The changes, for all eight: converted to SOG with any spherical harmonics removed (base colors only), turned upright, recentered and scaled, and loose floaters removed; and for each: - Space capsule: "Soyuz TMA-14, Seattle WA (XGRIDS PortalCam)" by Paolo Tosolini, https://superspl.at/scene/0896aa57. The exhibit's rail, panels, wall, and floor cropped away. - Antique car: "Tudhope Automobile" by SteveB, https://superspl.at/scene/761d9da2. The gravel cropped away along the ground's slope (the first files: cropped level, which cut off the bottoms of the wheels, and the maker's name painted out on the radiator and on the side plate). - Muscle car: "Superbird" by Kalvin (amberkalvin), https://superspl.at/scene/f02484bf. The asphalt cropped away along the ground's slope; the lettering, emblems, tire lettering, and rear plate painted over. - Mail biplane: "Boeing Model 40B assembled" by Paolo Tosolini, https://superspl.at/scene/aba8c704. The hall around it cropped away: its floor, rail, exhibit panels, beacon tower, mail truck, and a figure (the first files: the maker's roundel painted out on both sides too). - Model touring car: "Adler model car, built in 1905" by Alfred Duemlein, https://superspl.at/scene/b3f51b85. The wooden disc cropped away (the first files: the maker's name painted out on the radiator too). - Classic sports car: "porsche" by VODKIN, https://superspl.at/scene/815d7ba0. The cobbles cropped away (the first files: the maker's crest, its name on the rear, the tires' lettering, and both license plates painted out too). - Track car: "Porsche 992 GT3RS 2023" by Jakub Makar, https://superspl.at/scene/0b1ac6c1. No other change (the first files: the maker's crest, name, and model lettering painted out (hood, rear, side stripes, brake calipers, a seat, and wheel caps), the license plate blanked, and the driver figure's face blurred). - Cochem Castle: "Cochem Imperial Castle, Germany" by Dok11, https://superspl.at/scene/9b18007e (made by its author from videos by MARROS on Pexels). The hilltop cropped to a round patch around the castle. - Smederevo Fortress: "Smederevo Fortress wide" by Zeljko Devic, https://superspl.at/scene/9e14d283. The fortress cropped along its walls, without the river, the far bank, and the sky. And one more, the same way and under the same license ("CC BY 4.0" on its live page, checked October 24, 2026, when its files were downloaded), served from R2 like the eight: - Perseverance rover: "Perseverance rover - Synthetic scene" by tmate, https://superspl.at/scene/8d5c3046. A synthetic scene its author made in Blender from NASA's 3D models of Perseverance, Ingenuity, and a sample tube (NASA/JPL, from NASA's 3D resources: https://science.nasa.gov/3d-resources/mars-2020-perseverance-rover/) and trained into splats. The ground cropped to a round patch around the rover, without Ingenuity and the sky; thinned to 1,000,000 splats. Its labeled hotspots are the scene's annotations, their texts edited. It shows NASA's insignia and JPL's logo on the front and the Mars 2020 mission logo on the arm as captured; NASA's media guidelines (https://www.nasa.gov/nasa-brand-center/images-and-media/) keep its insignia out of the public domain and rule out implying its endorsement, so its first files, with the three painted out, are served with `?old=redactions`. The rover's name on its arm and two plaques on its side stay in both. ## Build tools (not shipped) The tools in `tools/` run on a developer's machine or in CI and are not part of the site. Their versions are pinned in `package.json`. - Playwright 1.56.1 (Microsoft; Apache-2.0): drives Chromium for the checks, the parity run, and the clips. - Prettier 3.8.1 (MIT): formats the generated site pages and the Manual's pages. - PlayCanvas's splat-transform CLI 3.10.3 (MIT; https://github.com/playcanvas/splat-transform), installed apart, not in `package.json`: reads a capture and packs SOG files for `tools/capture-edit.mjs` and `tools/blender/ply-to-toy.mjs`.