# Third-party software notices

P&ID Class Audit 1.1.5 is distributed under GPL-2.0-or-later; the full plugin license is in `LICENSE.txt`. The application also distributes the runtime components below. All runtime files are served from the plugin itself, without a CDN.

## Runtime components

- **sql.js 1.14.1** — compiles SQLite to JavaScript/WebAssembly and reads selected P&ID databases locally in a Web Worker. License: MIT. Source: https://github.com/sql-js/sql.js/tree/v1.14.1. Full license: `app/vendor/sql.js-LICENSE.txt`. Author list: `app/vendor/sql.js-AUTHORS.txt`.
- **SQLite** — database engine compiled into sql.js. SQLite is dedicated to the public domain. Upstream information: https://www.sqlite.org/copyright.html. Local notice: `app/vendor/SQLite-PUBLIC-DOMAIN.txt`.
- **fflate 0.8.3** — reads selected project ZIP files locally in the visitor's browser. The build also uses it to create the sample and plugin archives. License: MIT. Source: https://github.com/101arrowz/fflate/tree/v0.8.3. Full license: `app/vendor/fflate-LICENSE.txt`.
- **Inter Variable 4.1** — application/report font, also embedded in standalone HTML reports. License: SIL Open Font License 1.1. Source: https://github.com/rsms/inter/releases/tag/v4.1. Full license: `app/fonts/Inter-LICENSE.txt`. The distributed WOFF2 file has SHA-256 `693b77d4f32ee9b8bfc995589b5fad5e99adf2832738661f5402f9978429a8e3`.

The offline report template contains the complete Inter copyright and OFL text alongside the embedded font. The licenses apply to the respective components, not to project data or audit reports produced with the tool. Third-party components are provided without warranties under their respective terms.

## Development-only packages

The Node.js, jsdom, WordPress Playground, PHP/WASM, and related packages in `package-lock.json` are used only to build or verify the plugin. They are not included in the public plugin ZIP and do not run in visitors' browsers. The packaging check rejects missing runtime license files.

## Privacy

Selected project files are read into browser memory. This plugin has no upload endpoint, telemetry, remote processing, project storage, database tables, or background service. Downloaded reports contain project information and should be shared intentionally. The surrounding website and other same-origin code remain part of the website trust boundary.