Graphviz source-code availability statement (Eclipse Public License, Version 2.0)
==============================================================================

Product:   pWhois Maps, operated by VOSTROM (https://pwhois.org/maps/)
File:      /assets/vendor/viz-standalone.js  (Viz.js 3.31.0 distribution file
           "viz-global.js", npm package @viz-js/viz 3.31.0)

1. What is distributed
   The file above contains, in object-code form (WebAssembly, embedded in the
   JavaScript file), the following third-party programs:

   - Graphviz, version 16.1.0 (build 20260904.0139), https://graphviz.org
     Licensed under the Eclipse Public License, Version 2.0 ("EPL-2.0").
     A copy of the EPL-2.0 is at /maps/licenses/EPL-2.0.txt.
   - Expat, version 2.8.5, https://libexpat.github.io
     Licensed under the MIT License (/maps/licenses/MIT-expat.txt).
   - The Viz.js wrapper, Copyright (c) Michael Daines, MIT License
     (/maps/licenses/MIT-viz.txt).

2. Source Code is available
   In accordance with Section 3.1 of the EPL-2.0, VOSTROM states that the Source
   Code for the Graphviz program included in object-code form in
   /assets/vendor/viz-standalone.js is available under the terms of the EPL-2.0,
   and may be obtained from:

   - Graphviz 16.1.0 source release (tarball):
       https://gitlab.com/api/v4/projects/4207231/packages/generic/graphviz-releases/16.1.0/graphviz-16.1.0.tar.gz
       SHA-256: beea483ab130f456c1c3905f4f2e40778a9c493c3d73ae8012367d552d71ca84
   - Graphviz 16.1.0 repository tag:
       https://gitlab.com/graphviz/graphviz/-/tags/16.1.0
   - Expat 2.8.5 source release (tarball):
       https://github.com/libexpat/libexpat/releases/download/R_2_8_5/expat-2.8.5.tar.gz
       SHA-256: 920dde485e15eda0cce8d2310b41d492c534e5e3d89ad407a0b4176dd2ff88fe
   - The build scripts that compiled these sources to WebAssembly (Viz.js
     release viz 3.31.0, repository revision
     c8ce050d28eb0dc1ed1629ea32ab7f3dc117db0f, directory packages/viz/backend):
       https://github.com/mdaines/viz-js
       https://github.com/mdaines/viz-js/releases/tag/release-viz-3.31.0

   The tarball hashes are those recorded in the build-provenance attestation
   shipped with the @viz-js/viz 3.31.0 npm package (lib/provenance.json).

   VOSTROM has made no modifications to Graphviz. The viz-standalone.js file is
   the unmodified upstream distribution file; its upstream notice header is
   preserved. You may also request the Source Code by writing to VOSTROM through
   https://pwhois.org/contact.who.

3. Notices preserved
   The upstream copyright and license notices in viz-standalone.js and in the
   Graphviz source have not been removed or altered (EPL-2.0 Section 3.3).

4. Scope
   Graphviz is a separate work. pWhois Maps' own code only calls the Viz.js
   JavaScript API and is not a "Modified Work" of Graphviz under EPL-2.0; it
   remains under VOSTROM's own terms. The EPL-2.0 applies to Graphviz alone.

5. Warranty and indemnity
   Section 4 of the EPL-2.0 (Commercial Distribution) applies to VOSTROM as a
   Contributor distributing the Program in object-code form. See
   /maps/licenses/EPL-2.0.txt. The Program is provided "AS IS" as stated there.

Statement date: 2026-10-05