# Third-party notices (identified components only) This is a partial inventory based on files and URLs currently visible in the project. It is not a complete software bill of materials. Confirm exact versions and license texts before publication or redistribution. ## qrcode-generator - Upstream: https://github.com/kazuhikoarase/qrcode-generator - Vendored files: `assets/vendor/qrcode.js`, `assets/vendor/qrcode_UTF8.js` - Version recorded by the previous project notice: 1.4.4; verify against the vendored source before changing or redistributing it. - License: MIT. The headers identify Kazuhiko Arase and MIT. `qrcode.js` carries a 2009 copyright line; the optional UTF-8 helper carries a 2011 line. Both are listed separately below. - npm registry archive SHA-256 (recorded by the previous project notice): `AB6ED47D378877441DEAE95972E07B2716C26545A735A23AA6B9D442B33026ED` - `qrcode.js` SHA-256: `4B6133CBB5A13ECDC26CFA897D0DAF7BB9B08232032CDD381E82F2BAF3653B5F` - `qrcode_UTF8.js` SHA-256: `AE2FEFD4033DFD21EC9171A2176A698A3AB4839AD99D1D0521CA5305E55DD840` Copyright (c) 2009 Kazuhiko Arase Copyright (c) 2011 Kazuhiko Arase Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. ## disable-devtool - Upstream: https://github.com/theajack/disable-devtool - Package: `disable-devtool@0.3.8`, official npm distribution, adapted under MIT. - Vendored file: `assets/vendor/disable-devtool-0.3.8.min.js` - Official upstream file SHA-256: `8a23f92a25922d13437d67f25ba2269b64080b5ec030f5cba982e0261abbfe04` - Local adapted file SHA-256: `9d7b0e9ccae93ae479c476aff46ed02d98945365c27cdbe228ef96889cb88057` - npm registry integrity: `sha512-spwifiBbcgDTVEdzoWyH3NjZ1he/OgJmUNXvMgEffJ8Fh2B6mEJjCCEV25wlJSyNXEdGyzKFFRXh4kVDRK/wCg==` - The public site's saved detector body matched the official npm file after its leading site comment was removed. The site-specific initializer and bypass values are not included. - Local adaptation: the upstream capture-phase key handler now leaves events from inputs, textareas, selects and contenteditable regions alone, and bypasses IME composition events (`isComposing` / key code 229). The upstream F12 and developer-tools shortcut handling remains active elsewhere. The detector's original alert/confirm/prompt wrappers remain unchanged; they call the original function and return its result. - License: MIT. Copyright (c) 2019 - present Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. ## Browser-loaded components requiring license verification These references appear in `index.html` or the optional feature loader; verify the applicable license and notice requirements against the selected release before making this an exhaustive notice: - Swiper, URL requests major version 11, through jsDelivr (`swiper-bundle`), loaded only when an album is opened. A local fallback is used while loading or if the CDN is unavailable. The unused Fancybox request was removed. - Font Awesome Free CSS, CDN URL pins 6.5.1 in the app page; legal pages use 6.4.0. Confirm the actual assets and applicable license/terms. - Google Fonts CSS requests Caveat, Dancing Script, Patrick Hand, Playfair Display, Quicksand and Reenie Beanie in the app; legal pages request Quicksand. Fonts may be served as separate webfont files. Check each font's license and the Google Fonts terms for the actual files in use. These are external browser requests, not copies whose complete license texts have been verified in this repository. This inventory does not establish that the licenses permit every use or that all notices have been satisfied. ## Server-side package dependencies `package.json` and `package-lock.json` declare direct dependencies including `@distube/ytdl-core`, `bcrypt`, `google-auth-library`, `nodemailer`, `youtubei.js`, and development dependency `esbuild`, plus their transitive dependencies. Their package metadata and included license files should be inventoried for the exact production lockfile before distributing a server bundle. The dependency tree in the development workspace is not a verified production inventory; no exhaustive per-package licenses are asserted here. ## Default audio tracks (Bundled licensed music) The default music tracks shipped with this application are licensed from primary licensor Kevin MacLeod (Incompetech) under the Creative Commons Attribution 4.0 International License (CC BY 4.0). Older unverified default audio files (`G2VSwKOfKhI.webm`, `H3bwuP_xLLU.webm`, `jPjQJYKhhk4.webm`) have been retired and archived out of shipping assets. 1. **Heartwarming** - File: `assets/audio/Heartwarming.mp3` - Artist: Kevin MacLeod (incompetech.com) - ISRC: USUAN1100207 - License: Creative Commons Attribution 4.0 International (CC BY 4.0) - Primary Catalog URL: https://incompetech.com/music/royalty-free/index.html?isrc=USUAN1100207 - Primary Download URL: https://incompetech.com/music/royalty-free/mp3-royaltyfree/Heartwarming.mp3 - Primary License Terms: https://incompetech.com/music/royalty-free/licenses/ - Legal Deed: https://creativecommons.org/licenses/by/4.0/ - SHA-256: `a621a943ab940567f4136060e0f1f0637038b8a03c10ff8926f956e1b2ef34e7` (2,971,312 bytes) 2. **Water Lily** - File: `assets/audio/Water-Lily.mp3` - Artist: Kevin MacLeod (incompetech.com) - ISRC: USUAN1400035 - License: Creative Commons Attribution 4.0 International (CC BY 4.0) - Primary Catalog URL: https://incompetech.com/music/royalty-free/index.html?Search=Search&isrc=USUAN1400035 - Primary Download URL: https://incompetech.com/music/royalty-free/mp3-royaltyfree/Water%20Lily.mp3 - Primary License Terms: https://incompetech.com/music/royalty-free/licenses/ - Legal Deed: https://creativecommons.org/licenses/by/4.0/ - SHA-256: `b8c4f3b03a50af34c01a3f3b986a3d411f56a6c0c9a5b00807ccb5d83c74e8c6` (4,612,305 bytes) License notice and machine-readable metadata are packaged in `assets/audio/CC-BY-4.0.txt` and `assets/audio/licenses.json`. ## User-supplied demo media The Classic template sample images (`assets/images/classic-demo-1.jpg` through `classic-demo-6.jpg`), demo avatars (`assets/images/classic-demo-boy.png`, `assets/images/classic-demo-girl.png`), and catalog thumbnail (`assets/images/classic-thumbnail.png`) are user-supplied demonstration assets explicitly authorized by the user for this application. No third-party open-source license is asserted for user-supplied demonstration images. ## User and external media User-uploaded photographs and custom audio uploaded through creator tools require rights verification based on user authorization. They are not covered by the first-party LICENSE or third-party bundled licenses above. ## Generated artwork provenance (Love Garden template) The following visual artworks were generated using the authorized Gemini image generation toolchain (`image-generator` subagents running on `gemini-3.1-flash-image`): 1. **Rose in Glass Dome (Hoa Pha Lê Trong Lồng Kính)** - Destination Path: `assets/images/garden-rose-dome.jpg` - Generated Artifact: `C:\Users\tranv\.gemini\antigravity-cli\brain\52a77a81-f4e8-4127-b58c-bd720bff6a23\garden_rose_dome_1791987329533.jpg` - Generating Agent / Session: `image-generator` subagent ID `07f2793b-d84c-4b6a-aee7-f89ba35150e6` (Turn 1 / Turn 2, Coordinator session `52a77a81-f4e8-4127-b58c-bd720bff6a23`). - Prompt: "Generate an image of a single enchanted glowing pink-red rose inside a glass dome bell jar (cloche) with a dark wooden base on a deep dark burgundy background, romantic fairy tale style, high resolution." - Verification: Inspected visually via artifact inspection; depicts an enchanted luminous rose beneath a glass cloche on a dark burgundy background. 2. **Heart-Silhouette Flowering Tree (Cây Tình Yêu Tán Trái Tim)** - Destination Path: `assets/images/garden-tree-heart.jpg` - Generated Artifact: `C:\Users\tranv\.gemini\antigravity-cli\brain\52a77a81-f4e8-4127-b58c-bd720bff6a23\garden_tree_heart_1791987843844.jpg` - Generating Agent / Session: `image-generator` subagent ID `a455392d-a64d-458d-9194-d0b4afc5a662` (Single bounded retry turn, Coordinator session `52a77a81-f4e8-4127-b58c-bd720bff6a23`). - Prompt: "Single bounded retry: Generate an illustration of a fantasy romantic tree whose canopy of leaves and blooming flowers forms a distinct heart silhouette (heart-shaped canopy, natural romantic flowering tree with gentle roots and blooming branches, transparent or soft dark background)." - Verification: Inspected visually via artifact inspection; depicts a blossoming tree whose canopy forms a heart silhouette with natural floral foreground and gentle roots. 3. **Ground Flora & Flower Clusters** - Subagent `69dce704-4d9d-4f02-9e4e-d5a650dff960` encountered a rate limit (429 RESOURCE_EXHAUSTED). In accordance with instructions ("no repeated retries, report bounded asset blocker, continue usable work with sourced assets"), the ground floral elements reuse the rich floral foreground of the generated heart tree and the existing botanical sample assets. ## particle-text-3d - Upstream: https://github.com/sebastianvasquezechavarria1234/particle-text-3d - Author: Sebastián Vásquez Echavarría - Upstream commit: cc21e75b4fe1771a066169d66311ab248d868884 - Upstream snapshot: `.work/garden-particle-repo/upstream/` (development evidence only) - Derived implementation: `assets/garden-particle-text.mjs` - License: MIT License Copyright (c) 2026 Sebastian V. Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. ### Adaptation notes for Love Garden The substantive Three.js Points / BufferGeometry particle architecture, sparkle 4-pointed star GLSL fragment shader, distance-scaling vertex shader, ambient background particle GLSL shaders, and text target coordinate sampling from `main.js` were reused and adapted into `assets/garden-particle-text.mjs`. The text sampling was enhanced to support responsive multi-line Vietnamese text for 1–10 phrases of up to 50 graphemes each (replacing upstream's 20-character single-line restriction). All interactive cursor attraction/repulsion forces, raycasting onto the mouse plane, click explosion, and OrbitControls were removed for the romantic intro story presentation. Automated phrase progression (converge -> hold -> scatter) is driven by the Love Garden renderer RAF lifecycle. ## Three.js - Upstream: https://github.com/mrdoob/three.js - Pinned version: 0.160.0 - Delivery: jsDelivr CDN (`https://cdn.jsdelivr.net/npm/three@0.160.0/build/three.module.js`) - License: MIT License The MIT License Copyright © 2010-2023 three.js authors Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. ## Heart-Galaxy-v27-full-project - Upstream Source: `Heart-Galaxy-v27-full-project` (user-supplied standalone raw WebGL project, v27) - Original Upstream `app.js` SHA-256: `4b59406b06829c16f7be79ac7519fd2fbc03c9a8bbfefe932753aa375c214dea` - Provenance: User-supplied source code; reuse and adaptation explicitly authorized by user. - License: Unknown / Unspecified. No upstream LICENSE file was included in the source package. - Derived Implementation: `assets/garden-galaxy.mjs` (raw WebGL particle galaxy, 3D orbit camera, shader pulses, and DOM float projection) - Reviewed Adapter Reference: `96A530E96394BBED7DB89AEF789B356D048B246CF32CECCC4C511BE62DACAB31` ### Adaptation notes for Love Garden (Template 2) The 15,000 raw WebGL particle geometry (implicit 3D volumetric heart surface of 2,500 particles, three independent orbital rings of 3,000 particles, inner halo of 1,000 particles, main spiral galaxy of 8,000 particles, and 500 starfield particles), GLSL vertex and fragment shaders with heart-rate pulse morphology, perspective 3D projection, and tap-vs-drag camera orbiting from `app.js` were reused and adapted into `assets/garden-galaxy.mjs`. Modifications made for Love Garden integration: 1. Converted to a clean ES module class (`LoveGardenGalaxyEngine`) with deterministic `init(canvas, floatLayer, ...)` and `dispose()` lifecycle methods, releasing WebGL buffers, shaders, programs, and losing WebGL context cleanly upon stage transition or unmount. 2. Removed all demo branding, particle density sliders, settings panels, tech explainer copy, and toggles. 3. Replaced upstream's fixed Unsplash landscape URLs with dynamic user album memories (40 entries) and 1–10 wish messages plus 3 builtin messages (`I love you`, `You are my universe`, `Forever with you`) cycled to 60 floating texts via `LoveTemplateSchema.buildGardenGalaxyContent`. 4. Added keyboard-accessible equivalents (`.galaxy-album-toggle-btn` and `.galaxy-sr-photo-btn`) so keyboard and screen-reader users can access all 40 memories without blocking the WebGL canvas orbit drag gestures. 5. Replaced upstream's modal with an accessible dialog (`.galaxy-photo-viewer`) featuring caption rendering via `textContent` (preserving literal text without HTML/XSS interpretation), date display, Escape key handling, and focus trapping/restoration.