Licences¶
vibe-sketch is proprietary today; see LICENSE at the repository root. An
open-source release under MPL-2.0 may follow, so every dependency has to be
compatible with MPL-2.0: Apache-2.0, BSD, MIT and MPL are fine; GPL is not
(no Open Babel, no ChemDoodle). This page records each third-party
component’s licence. Pin a version here when you have read its licence
file as shipped; an unpinned row records the licence the package index
reports and nothing more.
Distributed notices and source¶
The browser’s Licences link opens the full notices, dependency inventory
and source downloads. Packaged desktop apps provide Help → Third-party
Notices and retain the browser and desktop inventories, source archives,
Electron LICENSE and LICENSES.chromium.html under their resources directory.
Source-installed macOS apps also retain the runtime’s original notices inside
the app bundle. Their browser bundle carries its own notices.
scripts/generate_notices.py reads the installed production trees after
npm ci. A normal build refuses missing licence texts, changed inventories,
changed upstream supplements, or a different Indigo binary/source checksum.
CI checks the generated files again. To review a dependency update, run
python3 scripts/generate_notices.py web --update-lock (or electron), inspect
the changed inventory in third_party/notices/, and resolve any new licence
questions before committing it. Updating an inventory does not approve a licence.
The maintainer approved distributing the current unmodified Indigo WASM with its corresponding source and notices. Builds include the pinned complete Indigo source archive and a separate archive of the byte-identical, uncombined InChI source. The build identifier embedded in the npm binary matches the recorded source revision. The first build downloads that source; subsequent builds verify the cached copy. Redistribute these archives with the bundle, including offline copies. Build instructions and checksums accompany them; this is source provenance, not a claim of a bit-for-bit local rebuild.
Reviewed supplements resolve omissions in npm tarballs: Ketcher’s exact
release LICENSE and NOTICE, and remark-parse’s exact release MIT text.
intersection-observer declares Apache-2.0 in metadata but its code carries
the W3C Software and Document Licence (2015); both texts and the Google
copyright notice are retained. element-closest-polyfill and lazy-val
declare ISC and MIT respectively but omit full texts from their published
sources. The maintainer approved clearly identified canonical SPDX supplements,
with the published attribution preserved and no invented copyright holders
or years. third_party/notices/provenance.json records original URLs and hashes.
Python¶
Package |
Licence |
Checked |
Role |
|---|---|---|---|
click |
BSD-3-Clause |
index metadata |
CLI |
pydantic |
MIT |
index metadata |
Document model |
fastapi |
MIT |
index metadata |
REST API |
starlette (via fastapi) |
BSD-3-Clause |
index metadata |
ASGI toolkit |
uvicorn |
BSD-3-Clause |
index metadata |
ASGI server |
numpy |
BSD-3-Clause |
index metadata; required by RDKit as well |
Geometry (drawing clean-up) |
rdkit |
BSD-3-Clause |
index metadata; the 2026.9.1 wheel bundles InChI 1.07.3 (MIT) |
Chemistry engine |
qvf-writer (optional) |
Apache-2.0 |
toolkit v0.4.0: Python distribution LICENSE and NOTICE |
QVF document import and export |
RDKit’s wheel is more than BSD code. Besides InChI it ships Boost (BSL-1.0), and its drawing library, which renders every SVG and PNG vibe-sketch exports, has cairo (LGPL-2.1 or MPL-1.1), pixman (MIT), FreeType (FreeType licence or GPL-2.0) and libpng linked in: statically in the 2026.9.1 macOS wheel, as bundled libraries that need the system’s libXrender and libXext in the Linux wheel. Installing RDKit from PyPI redistributes none of it; a bundle that ships RDKit, such as a desktop app with its own Python, would have to carry these notices and, for cairo, take the MPL-1.1 option (roadmap, section 7, decision 7).
Tooling (not shipped)¶
Package |
Licence |
Role |
|---|---|---|
ruff |
MIT |
Linter |
mypy |
MIT |
Type checker |
pytest |
MIT |
Test runner |
httpx |
BSD-3-Clause |
Test client |
PyYAML |
MIT |
CI-rule tests |
jsonschema |
MIT |
Validates fixtures against the committed JSON schema |
build |
MIT |
Wheel build |
twine 6.2.0 |
Apache-2.0; shipped LICENSE checked |
Release metadata validation |
sphinx |
BSD-2-Clause |
Documentation |
furo |
MIT |
Documentation theme |
myst-parser |
MIT |
Markdown for Sphinx |
linkify-it-py |
MIT |
Markdown autolinks |
sphinx-copybutton |
MIT |
Documentation |
sphinx-design |
MIT |
Documentation |
The release artifact builder, wheel wrapper and their original tests are
adapted from vibe-view revision 6154af26c3ca4d66c1ab8c971a33c281ab9f9d27
under MPL-2.0. The complete licence is retained in scripts/LICENSE.vibe-view
and accompanies these files in the source distribution.
Web shell¶
Shipped to the browser. Versions are pinned exactly in web/package.json;
“as shipped” means the files inside the npm tarball at that version were
read. scripts/check_npm_licenses.mjs checks the licence of every package
in the production tree on every CI run. The notices inventory records the
complete installed package list and licence-text checksums.
Package |
Version |
Licence |
Checked |
Role |
|---|---|---|---|---|
ketcher-core |
3.18.0 |
Apache-2.0 |
exact release LICENSE and NOTICE vendored; npm tarball omits them |
Canvas engine |
ketcher-react |
3.18.0 |
Apache-2.0 |
same release notices as ketcher-core |
Canvas engine |
ketcher-standalone |
3.18.0 |
Apache-2.0 |
same release notices as ketcher-core |
Canvas engine, offline mode |
indigo-ketcher |
1.46.0 |
Apache-2.0 |
as shipped: LICENSE (Apache-2.0 text) |
Chemistry toolkit, WebAssembly |
react |
18.3.1 |
MIT |
as shipped: LICENSE |
Runtime the canvas engine needs |
react-dom |
18.3.1 |
MIT |
as shipped: LICENSE |
Runtime the canvas engine needs |
events |
3.3.0 |
MIT |
as shipped: LICENSE |
Browser stand-in for Node’s |
Ketcher’s repository carries a LICENSE and a NOTICE file that its npm packages do not; Apache-2.0 asks redistributors to pass both on. Ketcher 1.x was AGPL-3.0; version 2 and later, including 3.18.0, are Apache-2.0.
Libraries inside the Indigo WebAssembly¶
Read from the strings in the shipped .wasm files. The shell uses the
no-render build.
Library |
Licence |
In the render build |
In the no-render build |
|---|---|---|---|
InChI 1.06 |
IUPAC/InChI-Trust Licence 1.0 (LGPL-2.1-style) |
yes |
yes |
libpng |
libpng licence |
yes |
yes |
zlib |
Zlib |
yes |
yes |
RapidJSON |
MIT |
yes |
yes |
TinyXML-2 |
Zlib |
yes |
yes |
cairo |
LGPL-2.1 or MPL-1.1 |
yes |
no |
pixman |
MIT |
yes |
no |
FreeType |
FreeType licence or GPL-2.0 |
yes |
no |
lunasvg |
MIT |
yes |
no |
InChI 1.06’s licence lets a proprietary program use the library if the program says so, includes the licence and the copyright notice, and gives access to the library’s source or lets the user replace it. The shell loads Indigo as a separate, unmodified file. Distribution now includes the full licence, copyright notices and corresponding source as described above; separate loading alone is not the basis for compliance. InChI 1.07 and later are MIT. The embedded-library inventory also includes cppcodec (MIT) and object_threadsafe (Apache-2.0), Emscripten’s glue and musl runtime (MIT), and its C++/compiler runtime notices (Apache-2.0 with LLVM exceptions and retained legacy MIT/BSD texts). The full RapidJSON notice includes its third-party terms; JSON_checker test code is not linked into this WASM.
Build tools (not shipped)¶
Package |
Version |
Licence |
Role |
|---|---|---|---|
vite |
8.3.4 |
MIT |
Build tool |
@vitejs/plugin-react |
6.1.2 |
MIT |
Compiles the adapter’s TSX |
typescript |
5.9.3 |
Apache-2.0 |
Compiler |
@types/react, @types/react-dom, @types/node |
18.3.31, 18.3.7, 24.19.2 |
MIT |
Type declarations |
Browser acceptance tools (not shipped)¶
The optional browser extra pins Playwright 1.64.0 (Apache-2.0),
pyee 14.0.0 (MIT) and greenlet 3.5.6 (MIT, with PSF-2.0 for its
Stackless-derived platform code). Their wheel LICENSE files and greenlet’s
LICENSE.PSF were checked. Playwright downloads its version-matched Chromium
test browser separately; the browser and test tooling are not included in
vibe-sketch distributions.
The web development dependencies pin axe-core 4.14.0 (MPL-2.0, LICENSE
checked in the npm package). Playwright injects it only for accessibility
checks. It is not imported into the browser app or shipped in web/dist.
Desktop shell¶
Package |
Version |
Licence |
Checked |
Role |
|---|---|---|---|---|
electron |
43.3.0 |
MIT |
index metadata |
Runtime |
electron-builder |
26.15.3 |
MIT |
index metadata |
Packaging (not shipped) |
electron-updater |
6.8.9 |
MIT |
index metadata |
Update feed |
electron-updater and its production dependency tree are bundled into the
redistributed app; electron/PUBLISHING.md lists them with their licences.