DevMotion — third-party source and licenses (2026-10-25) Imported and used in the Canvas rendering pipeline: 1. Lucide / lucide-static 1.61.0 https://github.com/lucide-icons/lucide https://lucide.dev/license ISC, with MIT notices for icons derived from Feather. 44 selected SVG icons in assets/lucide/; their drawing primitives are adapted to Canvas in engine/oss-kit.js. Both license texts are retained in engine/vendor/lucide-LICENSE.txt. 2. Rough.js 4.6.6 https://github.com/rough-stuff/rough https://roughjs.com/ MIT. Copyright 2019 Preet Shihn. Used for hand-drawn diagram cards with fixed seeds. Generated shapes are cached, so seeking and exporting the same frame remain deterministic. Full notice: engine/vendor/roughjs-LICENSE.txt. 3. Anime.js 4.5.0 https://github.com/juliangarnier/anime https://animejs.com/documentation/easings/built-in-eases MIT. Copyright 2025 Julian Garnier. Used ONLY for pure easing functions (outCubic, inOutCubic, outExpo, outBack, inOutSine). The existing frame clock still controls the video. Full notice: engine/vendor/animejs-LICENSE.txt. These licenses allow commercial use subject to preserving their notices. The included distribution retains them. Runtime code and selected icons are served locally; rendering does not depend on a CDN. Provenance: engine/vendor/manifest.json records pinned versions, registry URLs, archive SHA-512 integrity and extracted file SHA-256 hashes. Package install scripts were not executed. pipeline/vendor_import.py repeats this exact import from the recorded archives and package metadata. Selection rationale: - Direct compatibility with the existing Canvas engine, permissive licenses, bounded download size and deterministic offline rendering. - These are focused additions, not a claim that they are universally the best animation projects. Rough.js is a mature library with less recent release activity; its version is deliberately pinned and tested here. - The detailed room, walking character, city, book and CPU illustrations are existing DevMotion components, not artwork supplied by these libraries. - Lottie was subsequently installed as an optional integration; see the extension notices below. Eight scene templates: study, journey, book, processor, flow, compare, sketch, takeaway. A model may select and parameterize these. It cannot create unsupported art styles, arbitrary new characters or execute JavaScript. Fonts retain their existing license files in engine/fonts/. No new license is asserted over the user's original engine or project. OPTIONAL EXTENSIONS — 2026-10-25 =============================== Open Peeps by Pablo Stanley: https://www.openpeeps.com/ — CC0-1.0. 93 direct ready-made SVG downloads, not the layered source kit. Sources/hashes: assets/open-peeps/manifest.json; notice: assets/open-peeps/LICENSE.txt. Lottie Web 5.13.0 — https://github.com/airbnb/lottie-web — MIT. engine/vendor/lottie-web-LICENSE.txt. Light Canvas player excludes expressions. The local pulse.json fixture is authored for DevMotion; asset licenses are separate. Konva 10.9.0 — https://github.com/konvajs/konva — MIT. engine/vendor/konva-LICENSE.txt. BullMQ 6.4.2 — https://github.com/taskforcesh/bullmq — MIT. engine/vendor/bullmq-LICENSE.txt. ioredis 6.0.0 — https://github.com/redis/ioredis — MIT. engine/vendor/ioredis-LICENSE.txt. Valkey 9.1.2 — https://github.com/valkey-io/valkey — see full COPYING notice: integrations/bullmq/valkey-COPYING.txt (BSD and bundled dependency notices). WhisperX 3.8.6 — https://github.com/m-bain/whisperX — BSD-2-Clause. integrations/whisperx/licenses/LICENSE. Model weights are not included and have separate licenses. Installed dependency notices remain in their distributions. Manim Community 0.22.0 — https://github.com/ManimCommunity/manim — MIT. integrations/manim/licenses/LICENSE and LICENSE.community. Node versions, integrity and browser-file hashes: engine/vendor/extensions-manifest.json. Transitive Node resolutions: package-lock.json. Python version snapshots: integrations/{whisperx,manim}/requirements.lock.txt (macOS arm64/Python 3.12). The release ZIP excludes installed runtimes, node_modules, model caches and secrets. Installed is distinct from integrated; see integrations/README.txt and ROADMAP.txt. BROAD ICON LIBRARY — 2026-10-25 ============================= 20,407 visible local SVG icons/illustrations; variants are counted individually. Tabler (MIT), Material Design Icons (Apache-2.0), Health Icons (MIT), Devicon (MIT), Fluent Emoji Flat (MIT), and a CC0-only Bioicons selection. Exact package versions, source links, counts and full notices: assets/icons/README.txt and assets/icons/licenses/. Per-asset authors/sources where applicable: assets/icons/catalog.json. Locked download integrity and science Git blob hashes: integrations/icons/sources-lock.json. Selection/rejection details: assets/icons/import-report.json. Sources retain their own licenses; no license is asserted over third-party marks. Compiler emits asset-credits.json alongside each episode using library assets. SERVER AUTHENTICATION AND WORKSPACE LOCKING — 2026-10-26 ====================================================== jose 6.2.13 — https://github.com/panva/jose — MIT. Copyright (c) 2018 Filip Skokan. Used on the server for Google OIDC signature and JWT claim verification. Full unmodified notice: docs/licenses/jose-LICENSE.txt. fs-ext 2.1.1 — https://github.com/baudehlo/node-fs-ext — MIT. Used on the server for operating-system advisory file locking. Full unmodified notice: docs/licenses/fs-ext-LICENSE.txt. NAN 2.30.0 — https://github.com/nodejs/nan — MIT. Copyright (c) 2018 NAN contributors. Native-addon dependency of fs-ext; full unmodified notice: docs/licenses/nan-LICENSE.txt. Exact Node package versions and archive integrity are recorded in package-lock.json. The fs-ext native build is explicitly enabled after dependency installation with other lifecycle scripts disabled. These server dependencies and their source licenses remain separate from the user's original project and uploaded media.