Licenses

Drawbridge’s own code is licensed under the PolyForm Shield License 1.0.0. Drawbridge is free: use it at home or at work, for anything, commercially, for as long as you like, without paying and without asking. Copy it, share it, change it, run it on your own servers. The one thing you may not do is use it to provide a product that competes with Drawbridge.

The license covers copyright and patents, not the name or the logo — see the trademark policy. Releases up to and including v0.70.0 were published under Apache 2.0 and stay that way; the change applies from v0.71.0 onwards.

Full license texts: PolyForm Shield 1.0.0 · LGPL-2.1 (libavoid) · EPL-2.0 (elkjs)

Third-party licenses

Drawbridge Network Architecture's own code is licensed under the PolyForm Shield License 1.0.0 (see LICENSE) — free to use for any purpose, including commercially, except to provide a product that competes with Drawbridge. It was Apache-2.0 up to and including v0.70.0; see docs/08-LICENSING.md for why that changed and what it means for versions already released. It builds on the following third-party projects:

libavoid (Adaptagrams) — LGPL-2.1

Vendored as a git submodule at vendor/adaptagrams, pinned to an upstream commit. We build only cola/libavoid/.

Modified. Since 2026-10-03 the libavoid.wasm we ship is built from that commit with the patches in src/wasm/patches/ applied (performance only — they skip work whose result is provably empty and change no route). Each patch file states what it changes and why; src/wasm/build.sh applies them to a generated copy, so the submodule itself stays upstream's.

LGPL compliance model: libavoid is compiled with emscripten to a standalone, dynamically loaded libavoid.wasm fetched by the application at runtime. It is never statically inlined into any JavaScript bundle. Users can replace the .wasm file with their own build. Source: https://github.com/mjwybrow/adaptagrams; our build scripts: src/wasm/.

Full license text: the complete GNU LGPL-2.1 is reproduced in LGPL-2.1.txt, shipped alongside this file in every distribution bundle (verbatim copy of vendor/adaptagrams/cola/LICENSE).

Written offer for source: the exact libavoid source we build from is the Adaptagrams submodule pinned in this repository. For three years from the date you received this software, you may obtain the corresponding source — including any modifications and the build scripts under src/wasm/ — from https://github.com/mjwybrow/adaptagrams (upstream) or by requesting it from the distributor of this bundle. Because libavoid.wasm is a separate, user- replaceable file, you may relink the application against your own build of libavoid without any assistance from us.

elkjs (Eclipse Layout Kernel) — EPL-2.0 (elected)

Used by the auto-layout pass behind the device Import flow (tidyUp in app/src/layout.ts, called only from runImport in app/main.ts). It arrived as the "Tidy up" toolbar button (task 2.55); the button was removed in task 2.110 and the engine kept the one case it is good at — a pasted device list that arrives with no positions at all (task 2.56). Distributed via npm as elkjs, unmodified.

Dual-licensed, and we elect EPL-2.0. The upstream package.json declares "EPL-2.0 OR GPL-3.0-or-later", which is the licensee's choice, not a conjunction. We take the EPL-2.0 option and never the GPL one. This is a deliberate election, not an oversight: choosing GPL-3.0-or-later would impose its terms on the application and force this repository off its own licence.

Why this does not affect the app's own licence. EPL-2.0's copyleft is file-scoped, not work-wide. Its "Modified Works" definition covers additions to or modifications of the Program's own files and explicitly excludes files that merely link to, bind by name, or subclass it without containing Program contents. Drawbridge's own code calls elkjs's API; it contains none of its source. Our code therefore stays under its own licence (see LICENSE) and elkjs stays EPL-2.0, side by side — the same arrangement as libavoid above. Neither boundary depends on which licence we choose for our own code, which is why the 2026-08-29 relicensing left both untouched.

Boundary we maintain, mirroring the libavoid model: elkjs is loaded lazily and separately and is never inlined into the application bundle. We do not modify it, so no reciprocal obligation attaches to us beyond attribution and pointing at the upstream source. Users can replace it with their own build of the same version.

Since task 16.60 the layout runs in a worker, which made that boundary stricter rather than looser. Two of elkjs's own build outputs ship, in two forms:

• elk-worker.min.js is the worker, emitted verbatim as a hashed asset (?url: vite copies the file — not bundled, not minified again, not merged with any code of ours) and loaded by URL at runtime, exactly as libavoid.mjs is. This is the engine the app normally uses, and it is a byte-for-byte copy of the npm file.
• elk.bundled.js is the in-thread fallback, for a runtime that cannot create a worker, loaded through a dynamic import() into its own lazy chunk — the arrangement that has been here since task 2.56.

elk-api.js (10 kB of API, no layout code) is the only elkjs file bundled alongside ours. See app/src/layout-elk.ts and app/src/elk-worker-engine.ts.

Source: https://github.com/kieler/elkjs (upstream ELK: https://github.com/eclipse/elk). Full license text: EPL-2.0.txt, shipped alongside this file in every distribution bundle.

Bundled fonts — SIL Open Font License 1.1

Three typefaces ship as latin-subset .woff2 files in app/src/fonts/, offered in the editor's typeface list and embedded into SVG, PNG, PDF and HTML exports so a drawing renders the same on a machine that does not have them (task 11.379). They are not npm dependencies, so the license-checker counts below do not see them — these rows are maintained by hand.

Each notice file is complete on its own — the font's copyright line followed by the full text of the OFL 1.1 — and all three are copied into every desktop artifact under resources/fonts/ by electron-builder.yml, the same way LGPL-2.1.txt accompanies libavoid.

All three are unmodified apart from subsetting to the latin range, which the OFL permits. The OFL's conditions are met by shipping each font's copyright and licence notice, by not selling the fonts on their own, and by not using the Reserved Font Names for any modified version. The OFL is copyleft only over the FONTS themselves — it places no obligation on Drawbridge's own code, and none on a document that embeds them.

Roboto Mono shipped under Apache-2.0 for years and was relicensed to OFL 1.1 upstream (google/fonts issue 9143); the notice above is the current one, taken from ofl/robotomono/OFL.txt. If that ever needs re-checking, the question to ask is which directory of google/fonts the family lives in.

The Studio layout's chrome faces

Two more typefaces ship the same way for the Studio layout's own chrome (task 17.2, docs/11-STUDIO.md Type). They are not in the editor's typeface list and never reach an export: they set the app's labels, panels and the identifiers in them, never a drawing. Latin-subset .woff2 from Google Fonts, unmodified apart from that subsetting; Fira Sans in three static weights (400, 500, 600), Fira Code as one variable file covering 400 to 500.

Both notices are google/fonts' own (ofl/firasans/OFL.txt, ofl/firacode/OFL.txt), complete in the same way as the three above, and copied into every desktop artifact under resources/fonts/ by electron-builder.yml. Neither declares a Reserved Font Name.

The Studio themes' faces

Each Studio theme (task 17.16, docs/11-STUDIO.md Tokens) may bring its own chrome faces, shipped exactly as the two above: latin-subset .woff2 from Google Fonts, unmodified apart from that subsetting, never in the editor's typeface list and never in an export.

Each notice is google/fonts' own (ofl/b612/OFL.txt, ofl/barlow/OFL.txt, ofl/archivo/OFL.txt, ofl/redhatmono/OFL.txt; B612 Mono and Barlow Condensed are the same projects under the same notices, identical files), copied into every desktop artifact under resources/fonts/ by electron-builder.yml. None declares a Reserved Font Name — which is why Blueprint's identifiers are the bundled Roboto Mono rather than the board's Source Code Pro: Adobe reserves the name "Source", and a subset is a Modified Version under the OFL that could not keep it.

draw.io file format

The app reads and writes draw.io-compatible XML files for interoperability. No draw.io/mxGraph code is bundled or vendored. "draw.io" is a trademark of JGraph Ltd; this project is not affiliated with or endorsed by JGraph.

NetBox device-type library — CC0-1.0 (test fixtures only)

Four unmodified .yaml files from https://github.com/netbox-community/devicetype-library live under app/src/test/fixtures/devicetypes/, where they are read by app/src/devicetype.test.ts. That repository is published under CC0-1.0, a public-domain dedication that requires no attribution — this section is a courtesy and a record of where the files came from, not an obligation.

Nothing from that library is bundled into the application, and the app never fetches from it: a device type reaches Drawbridge because a user downloaded a file and opened it (app/src/devicetype.ts).

npm dependencies

Report generated with license-checker-rseidelsohn (task 5.3). Regenerate with:

npx license-checker-rseidelsohn --summary              # full tree
npx license-checker-rseidelsohn --production --summary  # what actually ships

Runtime dependencies (bundled into the app / Electron shell — the only third-party npm code we convey):

Every runtime license except elkjs is permissive (MIT / Apache-2.0) and imposes no copyleft obligation. elkjs is weak, file-scoped copyleft under the EPL-2.0 option we elect; it is shipped unmodified and loaded lazily and separately — as a verbatim worker asset, with its bundled build as the in-thread fallback's own chunk — and imposes no obligation on Drawbridge's own code.

Full dependency tree (prod + dev/build tooling, as of v0.50.0 — 784 packages). Re-run for v0.50.0 and unchanged from v0.49.0: no dependency was added or removed by that release, and the claim below was re-read rather than assumed. The three bundled fonts do NOT appear in these counts — they are assets, not npm packages, and are covered by their own section above.

No AGPL and no copyleft in the shipped set. Of the 13 packages that actually ship (--production), twelve are MIT or MIT OR Apache-2.0 and the thirteenth is elkjs, under the EPL-2.0 option we elect — weak, file-scoped copyleft, shipped unmodified. No AGPL anywhere, in either tree.

Re-verified at v0.49.0: no dependency changed since v0.48.0, so every count below is unchanged and the claim was re-read rather than merely re-run — still no AGPL anywhere, still elkjs alone in the shipped set.

A correction, recorded rather than quietly fixed (v0.48.0 census): this line said 812 while the table beneath it summed to 784, and 784 is what the tree reports. The per-licence counts were right and the total was not, so the error was in the header alone — but a wrong total is exactly the kind of thing "refresh the census" degenerates into when it means re-running a command and copying a number. The counts below are unchanged from the v0.47.0 refresh, which is itself worth stating: this release added no dependency.

One entry needs stating rather than glossing: khroma is reported as MIT*, where the asterisk means license-checker-rseidelsohn read MIT out of the package's LICENSE file instead of a declared license field. It is MIT, it is dev-only, and it does not ship — but "no unknown licenses" would be the wrong words for it, so these are the right ones.

This table is generated, and it goes stale silently. It was stamped v0.0.2 / 690 packages until task 11.168 — 27 minor versions, and the file is copied into every desktop artifact by electron-builder.yml extraResources, so distributed builds carried the old figures. Regenerating it is now step 8 of the pre-release checklist in docs/05-PUBLISHING-AND-THE-EDGE.md.

On GPL-3.0: a licence scanner will now report EPL-2.0 OR GPL-3.0-or-later for elkjs. That string is a choice offered to us, not a constraint imposed on us, and we elect EPL-2.0 — no GPL terms apply to anything we distribute. This note exists because the honest summary is "a dual-licensed package with GPL in its SPDX expression is present", not "no GPL string appears anywhere"; do not let a scanner's raw output be read as an AGPL/GPL contamination finding without checking this section first.

The two MPL-2.0 packages are lightningcss (a Vite CSS build tool) — weak, file-level copyleft on the tool's own source only; it is not distributed with the app. The single UNLICENSED entry is this project's own private package.json, not a third party.