Third-party licences and inventory
On this page
Use this reference to find component licences and notices, refresh the dependency inventory and check its coverage before distributing your application. The seller’s Third-party notices summarize the distinction between the original kit and independently licensed components.
The kit includes original application code and uses independently licensed third-party components. Those licences apply to their respective components; the kit licence and purchase terms govern Alto Brio’s original material. Neither the dependency inventory nor this page grants a licence to the original kit.
Components and applicable texts
The exact package versions, declared licences and collected source paths are
recorded in current-dependencies.json (licenses/current-dependencies.json),
which identifies its lockfile and collection platform. Use it alongside
package-lock.json for the complete dependency list, including optional platform
variants and development tools.
| Component family | Purpose and notices |
|---|---|
| Next.js, React and React DOM | Application framework and interface. Installed root notices are in the current collection; retained Next.js bundled-component notices are in licenses/THIRD-PARTY-LICENSE-TEXTS.txt, with source associations in the source index (licenses/third-party-sources.json). |
| Tailwind CSS, shadcn/ui, Base UI, Lucide and cn | Interface styling, editable components, icons and class merging. Installed package notices are in the current collection; the shadcn/ui source licence (licenses/shadcn-ui/LICENSE.txt) also covers the copied component sources. |
| Better Auth, Kysely, pg and postgres | Identity, transactions and database access. Read the current root notices for Better Auth, Kysely and pg, and the retained authentication collection. The source index (licenses/third-party-sources.json) identifies the full Unlicense text for postgres and the remaining package-root gaps. |
| Stripe | Subscription-provider SDK. Read its installed root licence in the current collection; provider services have separate account terms. |
| IBM Plex Sans and IBM Plex Mono | Local interface and code fonts, distributed unmodified under the SIL Open Font License 1.1 (licenses/ibm-plex/OFL.txt). The source record (licenses/ibm-plex/sources.json) identifies the official revision and file hashes. |
| sharp and libvips | Native image processing and its component libraries. Read the installed root notices, supplemental attributions and retained source texts in licenses/texts/, with version-specific associations in the source index (licenses/third-party-sources.json). |
| TypeScript, ESLint, Playwright, esbuild and other development dependencies | Compilation and verification. Their licences and installed notice paths are recorded in the same inventory. |
| Platform bindings, embedded code and data | Optional packages, Next/SWC, resolver bindings, fonts and browser data can carry additional terms. The source index identifies the examined versions, source associations and gaps. |
The text collections preserve third-party documents verbatim:
- Current runtime dependency documents (
licenses/CURRENT-DEPENDENCY-NOTICES.txt). - Current development dependency documents (
licenses/CURRENT-DEVELOPMENT-NOTICES.txt). - Current README supplements (
licenses/CURRENT-SUPPLEMENTAL-NOTICES.txt), identifying licence text or component attributions where no root document supplied that information. - Retained bundled and native texts (
licenses/THIRD-PARTY-LICENSE-TEXTS.txt), with source paths and hashes (licenses/notice-source-sha256.json). - Retained authentication texts (
licenses/AUTH-DEPENDENCY-NOTICES.txt), with their versioned inventory (licenses/auth-dependencies.json).
The source index (licenses/third-party-sources.json) connects examined component
versions and upstream files to the supplied texts. Its document records identify
the delivered path, byte offset, length and hashes. These associations concern the
stated versions; use current-dependencies.json for the selected dependency list.
The index does not provide a complete component list for the binaries you install.
Refresh the installed collection
After installing your selected lockfile, run from the product directory:
npm run deps:notices
The collector uses only Node.js. It reads package-lock.json, inspects installed
package-root licence, COPYING and NOTICE files, and collects the identified
version-specific README supplements. It writes licenses/current-dependencies.json
and the three CURRENT-* collections. It records the lockfile hash, platform,
architecture, installation status and document hashes automatically. Review the
result when changing dependencies, platform or distributed content; retain
required third-party texts and the original acquired records separately.
Collection and distribution limits
The source kit contains no node_modules, compiled application or third-party
native binary. An installation downloads its applicable packages. Uninstalled
platform variants are listed from the lockfile without claiming their texts were
inspected. A package’s declared licence does not replace missing documents.
README component attributions do not supply every component’s full licence. The native and embedded records retain gaps, including nested Rust dependencies, applied patches, actual binary features and some per-file notices. Inspect the actual installed, built or separately distributed artifact and meet its applicable obligations, including attribution and any source or relinking requirements.