THIRD-PARTY NOTICES — Pitch to Staff, October 23, 2026
======================================================

DISTRIBUTION-LEVEL SOURCE AND LICENCE RECORD
--------------------------------------------
This file describes components that are actually distributed in the static
Pitch to Staff website package, rather than unrelated build-time packages.
The upstream source links document their licence terms. The full Apache 2.0
and MIT licence notices are distributed alongside the website files.

1. Spotify Basic Pitch TypeScript: local inference/decoder adaptation
   Copyright 2022 Spotify AB.
   Upstream source: https://github.com/spotify/basic-pitch-ts
   Recorded basis: @spotify/basic-pitch 1.0.1 (application header).
   Distribution file: vendor/basic-pitch-local.js.
   Licence: Apache License, Version 2.0 (LICENSE-APACHE-2.0.txt).
   Modified: locally adapted inference and decoder; omits upstream MIDI
   writer/@tonejs/midi; later locally developed compatibility and decoding
   logic. See the adaptation's introductory source comment.
   Spotify neither endorses nor sponsors this independent project.

2. Spotify Basic Pitch model assets
   Upstream model directory: https://github.com/spotify/basic-pitch-ts/tree/main/model
   Distribution files: model/model.json, model/group1-shard1of1.bin,
   model/basic-pitch-model.js (base64 embedded copies).
   Attribution: Copyright 2022 Spotify AB; Apache License 2.0.
   Verified: base64 embedded JSON matches delivered model.json exactly,
   and base64 embedded weights match delivered group1-shard1of1.bin exactly.
   The upstream GitHub model directory lists the same asset names and sizes
   approximately 170KB (JSON) and 725KB (binary).
   Evidence boundary: no independently downloaded upstream weight binary was
   available to compare byte-for-byte with the distributed shard; the model
   source identification and local hashes remain traceable below.

3. TensorFlow.js, embedded runtime version 3.2.0
   Copyright 2021 Google LLC and contributors.
   Upstream source: https://github.com/tensorflow/tfjs
   Distribution file: vendor/tf.min.js, including its original Apache 2.0
   @license banner.
   Licence: Apache License, Version 2.0 (LICENSE-APACHE-2.0.txt).
   Contains TensorFlow.js package modules and third-party modules listed
   below; the shipped bundle is not distributed as editable source modules.

4. MIT components visible in the bundled TensorFlow.js runtime
   core-js 3.6.5 — Copyright Denis Pushkarev (zloirock.ru).
     https://github.com/zloirock/core-js
     Marker: __core-js_shared__ and embedded version 3.6.5.
   seedrandom — Copyright David Bau.
     https://github.com/davidbau/seedrandom
     Marker: seedrandom; TensorFlow.js backend-cpu v3.2.0 upstream manifest
     declares dependency seedrandom 2.4.3. Exact byte-level bundle build
     version has not been independently fingerprinted.
   regenerator-runtime — Copyright Facebook, Inc.
     https://github.com/facebook/regenerator
     Marker: regenerator runtime functionality; @tensorflow/tfjs package
     depends on regenerator-runtime ^0.13.5; exact installed patch release
     cannot be determined from the minified artifact alone.
   Licence: MIT; all three copyright notices and complete MIT permission
   and disclaimer text appear in LICENSE-MIT-COMPONENTS.txt.

5. Local project-created browser helpers
   vendor/score-corrections.js and vendor/tempo-assistant.js are maintained
   project code and do not claim an upstream open-source licence.

NOT PRESENT IN DEPLOYED PACKAGE
-------------------------------
The @tonejs/midi library from the standard Spotify npm package, Python Basic
Pitch dependencies, development/test dependencies, and diagnostic build tools
are not shipped to site visitors in this package. Their licences should not
be mistaken for licences of code bundled into this website.

DISTRIBUTED FILE SHA-256 RECORD (refreshed November 5, 2026)
--------------------------------------------------------
vendor/basic-pitch-local.js
  2239e7bb55d30506df39a77747adff98ef2519b985c733c26bdf3375e2208b75
vendor/tf.min.js
  674c1a2f42247a1cbe42f12961b2e046e8be2d80148f73bdce2f151b973f37f7
model/model.json
  1ed1aaee3409ec1dc098c8b01f430c0911f6fe9412e7af8086750f9e8f302f68
model/group1-shard1of1.bin
  b142a95737a52e1e412d5f92e73d8bb80dfe8d04941acc0702f11f4524fb377c
model/basic-pitch-model.js
  05503c19ebd4b9d55fbaed792291264734fde28a1f2e3603d00ec04b18fcc116
vendor/score-corrections.js
  65ec5ba03e75b28a3de6e189003bf343871991cef5c269c4c028d4e3c3fea439
vendor/tempo-assistant.js
  c9f9cef94396e4de6c70bf7fd1420de96575e23fe7f8bb2d984ba3467fe706d3

LIMITS OF THIS AUDIT
--------------------
This is a completed inspection of the website's observable shipped runtime
files and a distributed attribution/notice set, not a legal opinion, proof of
copyright ownership in model weights, or exhaustive bill of all tree-shaken
upstream source modules. A cryptographic match against upstream source
archives has not been established. These limitations must not be represented
as independently certified. The package carries copyright and attribution
notices for every separately identified third-party runtime family.

Upstream references:
https://github.com/spotify/basic-pitch-ts
https://github.com/tensorflow/tfjs
https://www.npmjs.com/package/@tensorflow/tfjs/v/3.2.0
https://www.npmjs.com/package/@tensorflow/tfjs-backend-cpu/v/3.2.0