# Third-party materials and license inventory

Source inventory checked on 14 September 2026. This is a map to retained notices,
not a substitute for their full text or an assertion that every asset and
transitive dependency has been cleared. Third-party material is not relicensed
by The Pit's [VPL grant](LICENSE-SCOPE.md).

## Contracts and protocol artifacts

| Material | Observed license and attribution | Retained evidence |
| --- | --- | --- |
| OpenZeppelin Contracts 5.7.0 | MIT; Copyright (c) 2016-2026 Zeppelin Group Ltd | `contracts/lib/openzeppelin-contracts/LICENSE`; preserve file-level notices too. |
| Compound code vendored by OpenZeppelin | BSD-3-Clause; Copyright 2020 Compound Labs, Inc. | `contracts/lib/openzeppelin-contracts/contracts/vendor/compound/LICENSE`; not replaced by the library's top-level MIT license. |
| Forge Standard Library 1.16.2 (test tooling) | Apache-2.0 OR MIT; Contributors to Forge Standard Library | `contracts/lib/forge-std/LICENSE-APACHE`, `LICENSE-MIT`, `package.json`. |
| Canonical Uniswap V2 core 1.0.1 and periphery 1.1.0-beta.0 | Retained package licenses are GPL version 3; source-level notices also remain in the source archives | `contracts/art/uniswap-v2/v2-core-LICENSE`, `v2-periphery-LICENSE`, `v2-core-sources.json`, `v2-periphery-sources.json`, and `README.md` with exact provenance. Factory, pair, Router02 and WETH9 artifacts are not The Pit's original bytecode. |
| Minimal Chainlink-compatible AggregatorV3 and V2 interfaces | Local files carry MIT SPDX markers; these remain unchanged. This is not a new license grant over Chainlink or Uniswap implementations. | `contracts/src/interfaces/IAggregatorV3.sol`, `IPitLaunchV2.sol`. Verify any copied upstream portions/provenance before making broader claims. |

The two retained Uniswap package license files have the same SHA-256:
`3972dc9744f6499f0f9b2dbf76696f2ae7ad8af9b23dde66d6af86c9dfb36986`.
Preserve the canonical source archives and their individual notices alongside
the artifacts. This inventory does not decide whether a particular integration
or combined binary triggers further GPL obligations.

## Fonts

All three bundled fonts use **SIL Open Font License 1.1**, not VPL. Their
copyright/license texts are already retained under `engine/assets/fonts/`:

| Font | Attribution | License file |
| --- | --- | --- |
| Nunito | Copyright 2014 The Nunito Project Authors | `OFL-Nunito.txt` |
| JetBrains Mono | Copyright 2020 The JetBrains Mono Project Authors | `OFL-JetBrainsMono.txt` |
| Gochi Hand | Copyright (c) 2011 Juan Pablo del Peral; Reserved Font Names "Gochi" and "Gochi Hand" | `OFL-GochiHand.txt` |

The OFL texts require retention with redistributed font software and preserve
their own terms, including reserved-name conditions. A font's presence in an
original page or image does not make the font file VPL. Ship those notices with
the font files; retaining them only in a private source tree is not a substitute
for checking the published artifact.

## Direct JavaScript dependencies

Versions below are from locally installed package manifests, not an assumption
that every declared dependency is shipped in every browser/Worker artifact.
Licenses are the package declarations, supplemented by actual license files where
present. Nested/bundled components may have additional licenses.

| Package | Installed version | Declared license / local evidence |
| --- | --- | --- |
| `@noble/curves` | 1.9.1 | MIT; `LICENSE`, Copyright (c) 2022 Paul Miller |
| `@noble/hashes` | 1.8.0 | MIT; `LICENSE`, Copyright (c) 2022 Paul Miller |
| `@scure/base` | 1.2.6 | MIT; `LICENSE`, Copyright (c) 2022 Paul Miller |
| `viem` | 2.56.1 | MIT; `LICENSE`, Copyright (c) 2023-present weth, LLC |
| `esbuild` | 0.28.2 | MIT; `LICENSE.md`, Copyright (c) 2020 Evan Wallace |
| `@resvg/resvg-wasm` | 2.6.2 | MPL-2.0 declared in `package.json`; no top-level license text included in this installed package. Fetch/retain the matching upstream notice and source provenance before distributing its WASM. |
| `@resvg/resvg-js` (development) | 2.6.2 | MPL-2.0; full `LICENSE` retained in the installed package. |
| `bip322-js` (development declaration) | 4.0.0 | MIT; `LICENSE`, Copyright (c) 2023 Ken Sze. Actual inclusion is determined by the build, not the dependency section. |
| `@cloudflare/vitest-pool-workers` (development) | 0.22.0 | MIT declared in `package.json`; verify distributed package/bundled notices if repackaged. |
| `@cloudflare/workers-types` (development) | 5.20260904.1 | MIT OR Apache-2.0 declared in `package.json`. |
| `@types/node` (development) | 24.13.3 | MIT; `LICENSE`, Microsoft Corporation. |
| `typescript` (development) | 7.0.2 | Apache-2.0; `LICENSE` and `NOTICE.txt` (includes additional upstream attributions). |
| `vitest` (development) | 4.1.11 | MIT core; `LICENSE.md` also identifies bundled BSD-3-Clause, ISC and MIT components. |
| `wrangler` (development) | 4.129.0 | MIT OR Apache-2.0 declared in `package.json`. |

Local package paths are `engine/node_modules/<package>/...`; these are an
inspection source, not a guaranteed part of a fresh clone or release. Keep
`engine/package-lock.json` and upstream license files/required notices when
reproducing or distributing dependencies. Do not rewrite third-party lockfile
license fields to VPL. MPL-covered source and executable distribution duties
must be reviewed separately; dependency metadata alone is not compliance.

## Transitive production dependencies

Inventory taken on 14 September 2026 from `engine/package-lock.json` (every
package the lockfile does not mark `dev`), read against the installed
`engine/node_modules` manifests. "License file" reports whether a `LICENSE`,
`COPYING` or `NOTICE` file is present at that installed package's root; it does
not judge the text. Optional or peer entries are marked; presence in the lockfile
does not mean the code is shipped (see the observed bundles below).

| Package | Version | Declared license | License file at package root |
| --- | --- | --- | --- |
| `@adraffy/ens-normalize` | 1.11.1 | MIT | `LICENSE` |
| `@esbuild/*` platform binaries (26 packages, all optional) | 0.28.2 | MIT | Absent in each installed platform package; the license lives in the `esbuild` package |
| `@noble/ciphers` | 1.3.0 | MIT | `LICENSE` |
| `@noble/curves` | 1.9.1 | MIT | `LICENSE` |
| `@noble/hashes` | 1.8.0 | MIT | `LICENSE` |
| `@resvg/resvg-wasm` | 2.6.2 | MPL-2.0 (declared only) | Absent; see the MPL note below |
| `@scure/base` | 1.2.6 | MIT | `LICENSE` |
| `@scure/bip32` | 1.7.0 | MIT | `LICENSE` |
| `@scure/bip39` | 1.6.0 | MIT | `LICENSE` |
| `abitype` | 1.2.3 | MIT | `LICENSE` |
| `esbuild` (peer) | 0.28.2 | MIT | `LICENSE.md` |
| `eventemitter3` | 5.0.1 | MIT | `LICENSE` |
| `isows` | 1.0.7 | MIT | `LICENSE` |
| `ox` | 0.14.34 | MIT | `LICENSE` |
| `typescript` (peer; also a development dependency) | 7.0.2 | Apache-2.0 | `LICENSE`, `NOTICE.txt` |
| `viem` | 2.56.1 | MIT | `LICENSE` |
| `ws` (peer) | 8.21.0 | MIT | `LICENSE` |
| `zod` (peer) | 4.4.3 | MIT | `LICENSE` |

### What the built artifacts actually contain

Observed on 14 September 2026 with the installed Wrangler, without deploying:

```text
cd engine
npx wrangler deploy --dry-run --outdir <scratch> --config service/wrangler.jsonc
npx wrangler deploy --dry-run --outdir <scratch> --config sandbox-cloud/wrangler.jsonc
npx wrangler deploy --dry-run --outdir <scratch> --config inference-gateway/wrangler.jsonc
npx wrangler deploy --dry-run --outdir <scratch> --config sock-review-cloud/wrangler.jsonc
```

Packages were identified from the `node_modules/<package>` path markers that
esbuild leaves in each emitted `index.js`. Anything not listed was not found in
that bundle; tree shaking is version dependent, so repeat the check before a
release rather than reusing this table.

| Artifact | npm packages found in the emitted bundle |
| --- | --- |
| Browser app (`engine/app/*.mjs`, copied as source by `tools/build-app.mjs`) | None. The production modules import only relative files, `/arena/*.mjs` and `/sock/*.js`. `viem` appears only in Node test and smoke files, which are not copied. |
| Main game Worker (`service/wrangler.jsonc`) | `viem`, `ox`, `abitype`, `@noble/hashes`, `@noble/curves`, `@scure/base` |
| Public lab Worker (`sandbox-cloud/wrangler.jsonc`) | None |
| Inference gateway Worker (`inference-gateway/wrangler.jsonc`) | `viem`, `@noble/hashes` |
| Founder sock review Worker (`sock-review-cloud/wrangler.jsonc`) | `@resvg/resvg-wasm`, including its `index_bg.wasm` module emitted next to `index.js` |

Every package found in a bundle is MIT except `@resvg/resvg-wasm` (MPL-2.0).
The `@esbuild/*` binaries, `esbuild`, `ws`, `zod`, `isows`, `eventemitter3`,
`@noble/ciphers`, `@scure/bip32`, `@scure/bip39` and `@adraffy/ens-normalize`
were not found in any emitted bundle; they remain build-time or unused
transitive material.

### MPL-2.0 material: `@resvg/resvg-wasm`

The installed package declares MPL-2.0 and points at
`git@github.com:yisibl/resvg-js.git`, but ships no license text of its own. It is
bundled into the separately deployed founder review Worker
(`puppet-pit-sock-review`, see `engine/sock-review-cloud/README.md`) and is used by
local Node rendering tools. It is not part of the browser app, the main game
Worker, the public lab or the gateway.

The canonical MPL-2.0 text is now retained at `engine/assets/licenses/MPL-2.0.txt`,
fetched on 14 September 2026 from `https://www.mozilla.org/media/MPL/2.0/index.txt`
(16,726 bytes, SHA-256
`3f3d9e0024b1921b067d6f7f88deb4a60cbe7a78e76c64e3f1d7fc3b779b9d04`). MPL-2.0
requires that anyone who receives the Executable Form also be told how to obtain
the Covered Software's Source Code Form under the MPL, and that this notice and
the license accompany the distributed copy. The review Worker build does not yet
copy this text or a source pointer into its output, and this inventory does not
decide whether serving that private Worker counts as distribution. Before any
public distribution of an artifact that includes the WASM, ship this text, the
resvg-js/resvg source pointers and the matching version, or remove the module.

## Artwork, collections and community material

Affiliated collection images and names, `puppet-1306.png`, `puppet-2800.png`,
reference images, external video/audio and Discord-derived source material need
their own provenance/rights records. No automatic VPL grant is asserted for them.
The same applies to a derivative sock trait if it incorporates third-party work.
An original generator or animation implementation can be VPL without transferring
rights in every image it renders. Do not treat an NFT ownership check as copyright
clearance or as an assignment from the artist.

## Release checklist still open

- Determine the actual source/binary/media contents of each release; inspect
  transitives and bundled subcomponents, not only the direct dependencies above.
- Ship the unmodified VPL text plus all applicable upstream copyrights, licenses
  and notices with the artifacts that need them; check the public output, not
  just this repository. Provide corresponding source where required.
- Verify font notice packaging and the resvg WASM source/license distribution.
- Resolve VPL combination compatibility for the exact artifacts and obtain
  missing artwork/community-content permissions before declaring them cleared.

Nothing here claims that VPL compatibility of the whole dapp is resolved. This
document records scope and evidence; it does not provide a legal clearance.