# Third-party notices for the Bazi Rust/WASM client

The FateCat Rust core, shared client and derived reference table are covered by the repository-root `LICENSE` (MIT). The user authorization and its scope are recorded in `DISTRIBUTION-AUTHORIZATION.md`.

The WASM client uses the Rust target selected by `cargo build --target wasm32-unknown-unknown --release --locked --offline`. Its runtime dependency versions and SPDX license expressions are pinned by the crate `Cargo.toml`/`Cargo.lock`:

| Crate | Version | License expression |
| --- | --- | --- |
| `base64` | 0.22.1 | MIT OR Apache-2.0 |
| `fancy-regex` | 0.19.2 | MIT |
| `bit-set` | 0.8.0 | Apache-2.0 OR MIT |
| `bit-vec` | 0.8.0 | Apache-2.0 OR MIT |
| `regex-automata` | 0.4.18 | MIT OR Apache-2.0 |
| `aho-corasick` | 1.1.5 | Unlicense OR MIT |
| `memchr` | 2.8.3 | Unlicense OR MIT |
| `regex-syntax` | 0.8.11 | MIT OR Apache-2.0 |
| `jiff` | 0.2.38 | Unlicense OR MIT |
| `jiff-core` | 0.1.1 | Unlicense OR MIT |
| `jiff-tzdb` | 0.1.7 | Unlicense OR MIT |
| `lunar-rs` | 1.0.0-rc1 | MIT OR Apache-2.0 |
| `serde_json` | 1.0.154 | MIT OR Apache-2.0 |
| `itoa` | 1.0.18 | MIT OR Apache-2.0 |
| `serde_core` | 1.0.229 | MIT OR Apache-2.0 |
| `zmij` | 1.0.23 | MIT |
| `sha2` | 0.10.9 | MIT OR Apache-2.0 |
| `cfg-if` | 1.0.5 | MIT OR Apache-2.0 |
| `digest` | 0.10.7 | MIT OR Apache-2.0 |
| `block-buffer` | 0.10.4 | MIT OR Apache-2.0 |
| `generic-array` | 0.14.7 | MIT |
| `typenum` | 1.20.1 | MIT OR Apache-2.0 |
| `crypto-common` | 0.1.7 | MIT OR Apache-2.0 |
| `unicode_names2` | 4.0.0 | (MIT OR Apache-2.0) AND Unicode-DFS-2016 |
| `phf` | 0.11.3 | MIT |
| `phf_shared` | 0.11.3 | MIT |
| `siphasher` | 1.0.4 | MIT OR Apache-2.0 |

A release archive must include the corresponding license texts for these locked crates in `THIRD-PARTY-LICENSES/`. Their source code is not vendored in this repository; Cargo obtains each package from its registry source.

Other derived material:

- The true-solar adapter is derived from the `paipan-master` implementation, distributed under WTFPL 2.0. The client contains the derived adapter, not the raw reference-repository snapshot.
- The Unicode 15.0 name-alias data is derived from Unicode's `NameAliases.txt`; preserve the Unicode data-file license text with source distributions.
- The Cloudflare Workers Static Assets HTML embeds the canonical location catalog for browser-local lookup. That data derives from GeoNames Cities1000/CN under CC BY 4.0 and Administrative-divisions-of-China under WTFPL; attribution is published in `LOCATION-DATA-ATTRIBUTION.txt` and displayed on the page. The shared ESM/TypeScript client source alone does not bundle the catalog.
- The bone-weight table carries its source, revision and MIT license text in `bone_weight.json`.
- The climate transition rows record `sxtwl` 2.0.7 as their calculation provider. The client contains derived rows, not the `sxtwl` package source.
- The solar-term provider parity fixture in the source tests is derived from `lunar-python` 1.4.8 under its MIT license; preserve its license text with source distributions.
- Raw `bazi-1` and `sxwnl` vendor snapshots are not included.