# Third-party notices and source credits

This file documents third-party material included in or used by EnergyAccessDesigner. It does not grant new rights to weather, map or model data. The original license texts for locally redistributed browser assets are preserved alongside those assets.

| Material | Local file / use | Source and notice |
| --- | --- | --- |
| Leaflet 1.9.4 | `frontend/vendor/leaflet/` | Copyright (c) 2010-2023, Volodymyr Agafonkin; Copyright (c) 2010-2011, CloudMade, as stated in the bundled BSD 2-Clause license: [`frontend/vendor/leaflet/LICENSE`](frontend/vendor/leaflet/LICENSE). Source: [Leaflet v1.9.4](https://github.com/Leaflet/Leaflet/tree/v1.9.4). JavaScript, CSS and marker images are included unmodified. |
| DM Sans | `frontend/fonts/DMSans-variable.ttf` | Copyright and SIL Open Font License 1.1 as supplied with the font: [`frontend/fonts/DMSans-OFL.txt`](frontend/fonts/DMSans-OFL.txt). Source: [Google Fonts / DM Sans](https://github.com/google/fonts/tree/main/ofl/dmsans). |
| Manrope | `frontend/fonts/Manrope-variable.ttf` | Copyright and SIL Open Font License 1.1 as supplied with the font: [`frontend/fonts/Manrope-OFL.txt`](frontend/fonts/Manrope-OFL.txt). Font history: [`frontend/fonts/Manrope-FONTLOG.txt`](frontend/fonts/Manrope-FONTLOG.txt). Source: [Google Fonts / Manrope](https://github.com/google/fonts/tree/main/ofl/manrope). |
| Natural Earth Admin 0 Countries | Africa outline; possible source for map mask still unverified | [Natural Earth](https://www.naturalearthdata.com/) and [terms of use](https://www.naturalearthdata.com/about/terms-of-use/). Geographic boundaries are illustrative. |
| Stadia Maps Alidade Smooth Dark | Browser tile service, not bundled | Visible attribution on the Tool map to [Stadia Maps](https://stadiamaps.com/attribution/), [OpenMapTiles](https://openmaptiles.org/) and [OpenStreetMap](https://www.openstreetmap.org/copyright) is retained. Production domain/service entitlement must be configured separately. |
| Nominatim / OpenStreetMap | Server-side reverse geocoding | [OSM copyright](https://www.openstreetmap.org/copyright) and [Nominatim use policy](https://operations.osmfoundation.org/policies/nominatim/). |
| European Commission JRC PVGIS 5.2 TMY | Server-side weather source and stored representative TMYs | [PVGIS](https://joint-research-centre.ec.europa.eu/photovoltaic-geographical-information-system-pvgis_en), [usage conditions](https://joint-research-centre.ec.europa.eu/photovoltaic-geographical-information-system-pvgis/general-information/usage-conditions-data-protection_en), [TMY documentation](https://joint-research-centre.ec.europa.eu/photovoltaic-geographical-information-system-pvgis/using-pvgis-5/pvgis-5-tools/pvgis-typical-meteorological-year-tmy-generator_en). The 50 representative workbook metadata identify PVGIS-SARAH2 solar radiation (EUMETSAT CM SAF) and ERA5 meteorology (ECMWF/Copernicus). Nairobi provenance is incomplete; see [Data Sources & Licenses](/data-sources). |
| European Central Bank | Server-side EUR/USD reference-rate retrieval | [ECB reference rates](https://www.ecb.europa.eu/stats/policy_and_exchange_rates/euro_reference_exchange_rates/html/index.en.html), for informational currency display only. |

Production Python dependencies and exact versions are pinned in [`requirements-prod.txt`](requirements-prod.txt). They are installed from upstream distributions into the Linux image; their respective package metadata and upstream license files must remain with any redistributed container image. This project does not assert that a license applying to a software library also grants rights in weather datasets, training data or trained models. Review the final built image and dependency notices before distributing it to third parties.

Pinned Python runtime inventory (exact version and transitive dependency list remain authoritative in `requirements-prod.txt`): annotated-doc, annotated-types, anyio, certifi, charset-normalizer, click, et-xmlfile, FastAPI, h11, h5py, idna, importlib-metadata, joblib, narwhals, NumPy, openpyxl, OpenTelemetry API, pandas, Pydantic, pydantic-core, pvlib, python-dateutil, pytz, requests, scikit-learn, SciPy, six, Starlette, threadpoolctl, typing-inspection, typing-extensions, tzdata, urllib3, Uvicorn and zipp. The audit did not verify all upstream package notices inside a Linux image, so this list is an inventory rather than a blanket license clearance.