# Third-party notices

Original project code is under the MIT license. Third-party components retain their own licenses and copyright notices.

- The extension started from Michael Xieyang Liu's [Chrome extension React boilerplate](https://github.com/lxieyang/chrome-extension-boilerplate-react). Its MIT notice is in `licenses/extension-boilerplate-MIT.txt`.
- The Gmail multipart request builder derives from Emil Tholin's [google-api-batch-utils](https://github.com/EmilTholin/google-api-batch-utils). Its MIT notice is in `licenses/google-api-batch-utils-MIT.txt`.
- Bundled Inter fonts are by the [Inter project](https://github.com/rsms/inter), under SIL Open Font License 1.1; see `licenses/Inter-OFL.txt`.
- Bundled iA Writer fonts derive from iA Writer and IBM Plex. Their SIL Open Font License 1.1 notice is in `licenses/iA-Writer-OFL.txt`.

`npm run licenses` checks every locked runtime npm package against the reviewed license list and requires its license text to exist. Production builds include `THIRD_PARTY_LICENSES.txt`, a package/version/license inventory, all notices in `licenses/`, and extracted JavaScript license comments. DOMPurify's Apache-2.0 option is selected from its dual license. Do not remove notices when distributing builds or source.

The inventory is a dependency and notice check, not a warranty about third-party intellectual property. No model weights, training datasets downloaded from third parties, or proprietary provider implementations are bundled. Classification fixtures are authored synthetic examples. Optional Chrome AI is supplied separately by Chrome, subject to Google's terms.

## Missing notices in upstream npm tarballs

The locked boolbase 1.0.0, regx 1.0.4, tempo-email-parser 0.7.7, and undici-types 5.26.5 tarballs omit license files. Copies are included in `licenses/` from their maintainers' upstream repositories or published license page. Tempo's npm metadata says ISC while its upstream LICENSE.md grants MIT; the shipped notice and inventory use that explicit MIT grant. Regx's README attributes its code to Shannon Moeller (2016); its linked MIT grant is included unchanged. Revisit these exceptions when upgrading those versions.

Sources: [boolbase](https://github.com/fb55/boolbase/blob/master/LICENSE), [regx](https://github.com/shannonmoeller/regx#readme), [Tempo](https://github.com/yourtempo/tempo-email-parser/blob/master/LICENSE.md), [undici 5.26.5](https://github.com/nodejs/undici/blob/v5.26.5/LICENSE).