Appearance

Open Source Notices ​

Effective Date: 2026-07-09 · Document ID: OSN-MMA-001 · Contact: info@mapsted.com · Contact Us

Document ID: OSN-MMA-001 Version: 1.0 Effective Date: 2026-07-09 Contact: info@mapsted.com

Cross-reference (normative): This document constitutes the Open Source Notices referenced in the section "THIRD-PARTY COMPONENTS" of LA-MMA-001. Specifically, LA-MMA-001 states: "A list of such components and their licences is maintained separately in the project documentation under 'Open Source Notices'." That list is this document (OSN-MMA-001).

Scope — Definition of "Software" ​

For the purposes of this document, "Software" has the same meaning as in LA-MMA-001:

@mapsted/maps-js-api, together with its source code, built distributions (ESM, CommonJS, IIFE/CDN), TypeScript declarations, documentation, and any accompanying materials (collectively, the "Software").

Mapsted proprietary software depends on the third-party open-source components listed in this document, but is NOT itself open-source. The component licences listed below do not extend to the Software as a whole. The Software is proprietary commercial software licensed under the terms of the Licence Agreement.

Pre-Publish Requirements (Internal Maintenance Checklist) ​

The following checks have been completed and signed off by Mapsted Legal as part of the approval of this document. This checklist is maintained as an internal record and updated as part of the ongoing compliance process.

  • C-1 (HIGH) — Bundle analysis: Run npm run analyze against the production build and confirm which, if any, third-party source code is inlined into the dist/ artefacts. The tslib inlining determination in particular (see below) is confirmed via tsconfig.json importHelpers: true combined with tsup's external: [] / noExternal: [] configuration; the full bundle-analysis output must be appended to this document or cited as an appendix before final approval.
  • C-2 (HIGH) — eslint provenance confirmed: eslint is a declared devDependency of @mapsted/maps-js-api (node_modules/eslint, resolved version 9.39.4). Reorg Phase 4 merged the former workspace-root lint devDeps into the single package package.json; see the Lint Toolchain devDependencies section below.
  • C-3 — CI publication gate: A CI gate prevents publication of any legal document that is not in Approved status. Verified as part of the approval process for this release.
  • C-4 (HIGH) — Source scan of src/: The @mapsted/maps-js-api package.json declares "files": ["dist", "src"], meaning the raw TypeScript source in src/ is shipped in the npm tarball alongside the compiled dist/. A licence scan of src/ (e.g., via license-checker, ort, or fossa) must be performed pre-publish to confirm that no vendored third-party OSS code is present unattributed in the source files.

Runtime Dependencies (Shipped in dist/) ​

The compiled @mapsted/maps-js-api distributions (ESM, CommonJS, and IIFE/CDN bundles) in the dist/ directory are the artefacts distributed to consumers via npm and CDN.

At the time of this draft, the @mapsted/maps-js-api package has zero dependencies declared in package.json. The published dist/ bundle contains only Mapsted-authored code and any code inlined at build time by the tsup bundler.

tslib helpers are inlined into the dist/ bundle at build time via tsup/esbuild as a consequence of importHelpers: true in tsconfig.json combined with the external: [] / noExternal: [] build configuration. Because tslib is licensed under 0BSD, this inlining creates no consumer-facing attribution obligation (0BSD requires no attribution, no notice, and no reproduction of licence text). Bundle-analysis output confirming this finding will be appended as an appendix before final approval.

No additional third-party open-source components are therefore required to be attributed in connection with the shipped runtime bundle, subject to C-1 completion.

Build and Development Toolchain (Not Shipped to Consumers) ​

The following packages are listed as devDependencies in package.json. They are used to build, test, lint, type-check, and document the Software. They are not bundled into or distributed as part of the published dist/ artefacts and are therefore not required to be included in consumer-facing attribution. They are listed here for completeness.

Resolved versions are taken from package-lock.json (lockfile version 3). The ^-range declared versions in package.json are not used in this table.

The storage inventory below reflects the Software's current disclosed behaviour for the outer-page wrapper and the inner map iframe at the date of publication. Mapsted reviews and updates this inventory as part of its ongoing compliance process; Licensees may request the latest inventory from privacy@mapsted.com.

Package-Level devDependencies (package.json) ​

PackageResolved VersionDeclared RangeLicenceNotes
typescript5.9.3^5.9.3Apache-2.0TypeScript compiler (build-only). Apache-2.0 requires reproduction of the NOTICE file for binary distributions; Legal to confirm applicability given build-only use.
tsup8.5.1^8.0.0MITBuild/bundle toolchain (build-only)
vitest4.1.10^4.0.0MITTest runner (test-only)
@vitest/coverage-v84.1.10^4.0.0MITTest coverage (test-only). Wraps Node.js's V8 coverage engine. The underlying V8 coverage infrastructure is part of Node.js (MIT). No additional BSD-3-Clause obligation is introduced by this package alone; Legal to confirm.
jsdom29.0.2^29.0.2MITDOM simulation for tests (test-only)
vitepress1.6.4^1.6.4MITDocumentation site generator (docs-only)
typedoc0.28.19^0.28.19Apache-2.0API reference generator (docs-only). See Apache-2.0 NOTICE file note under typescript above.
typedoc-plugin-markdown4.11.0^4.11.0MITTypeDoc Markdown renderer (docs-only)
husky8.0.3^8.0.3MITGit hooks (dev-only)
size-limit12.1.0^12.1.0MITBundle-size CI guard (CI-only)
@size-limit/preset-small-lib12.1.0^12.1.0MITBundle-size preset (CI-only)
tslib2.8.1^2.5.00BSDTypeScript runtime helpers. Inlined into dist/ at build time (see Runtime Dependencies above). 0BSD requires no attribution, no notice, and no reproduction of licence text. No consumer-facing obligation arises from tslib inlining.
@playwright/test1.61.1^1.59.1Apache-2.0End-to-end browser test runner (test-only, dev environment only — not shipped in dist/). Apache-2.0; no consumer-facing obligation as it is not distributed in the published artefacts.
@axe-core/playwright4.11.2^4.11.2MPL-2.0Accessibility audit tooling (test-only, dev environment only — not shipped in dist/). MPL-2.0 (Mozilla Public Licence 2.0) is a weak copyleft licence that applies file-by-file to MPL-licensed source files only and does not contaminate unmodified third-party code bundled alongside it. Because @axe-core/playwright is a dev/test-only dependency and is not shipped in dist/, no consumer-facing MPL-2.0 obligation applies.

Postbuild Script Dependency Check (scripts/postbuild-iife-window-wire.mjs) ​

The postbuild script scripts/postbuild-iife-window-wire.mjs runs as part of the IIFE bundle build step (onSuccess hook in tsup.config.ts). It rewires the window.mapsted.maps global assignment to the correct position after the IIFE close (see script header for full rationale).

Dependency audit: The script imports only Node.js built-in modules — node:fs, node:path, and node:url. It has no third-party npm dependencies and introduces no additional OSS attribution obligations.

Lint Toolchain devDependencies ​

The following packages are declared as devDependencies of @mapsted/maps-js-api's package.json (merged from the former workspace root into the single package in reorg Phase 4). They run the lint script, which lints files including those in src/. They are not shipped as part of the published package.

PackageResolved VersionDeclared RangeLicenceNotes
eslint9.39.4^9.10.0MITLinter (lint-only).
@eslint/js9.39.4^9.10.0MITESLint core JS rules (lint-only).
typescript-eslint8.58.2^8.6.0MITTypeScript ESLint integration (lint-only).

Documentation Site Dependencies (Not Shipped as Part of the Package) ​

The documentation site (docs.mapsted.com/maps-js-api) built with VitePress bundles Vue, Vite, and their transitive dependencies into the static site assets. These are used solely to render the documentation website and are not distributed as part of the @mapsted/maps-js-api npm package. Legal to confirm whether the documentation site's own OSS attribution page is required and whether it should live here or as a separate page.

How This List Is Maintained ​

This document is intended to be updated as part of the pre-publish CI gate. Any new dependency introduced must be added to this document with its name, resolved lockfile version, licence identifier, and a determination of whether it is shipped in the dist/ bundle. Resolved versions must always be taken from package-lock.json, not from the declared semver range in package.json.

Automated licence-audit tooling (e.g., license-checker, ort, fossa) is under consideration as a CI gate before public launch; see also C-4 above regarding the src/ source scan.

Full licence texts for all packages listed above are reproduced in OSN-LICENCE-TEXTS.md within the npm package tarball (forthcoming). Per-package upstream text is available at the SPDX licence list.