@base_bit/vmg-cli 0.0.2 → 0.0.3

package/THIRD_PARTY_NOTICES.md

@@ -236,3 +236,22 @@ Their presence in the repository is not evidence of permission for public
 redistribution. They are not covered by Apache-2.0 and are not cleared for a
 public release until provenance and redistribution rights are documented, or
 the files are replaced with cleared assets.
+
+## Controlled Three.js source builds (2026-09-13)
+
+The refactored Builder now supplies `three@0.180.0` and
+`@types/three@0.180.0`, both under the MIT License, from its fixed host
+installation. Author code may import only `three`,
+`three/addons/loaders/GLTFLoader.js`, and
+`three/addons/loaders/EXRLoader.js`. Builder does not install uploaded
+package declarations or run their scripts. Exact versions and the installed
+runtime/type dependency closure are included in its build fingerprint.
+
+VMGC artifacts that use these runtime entries contain
+`docs/third-party/three.txt`: the Three.js license, EXRLoader's retained
+TinyEXR/OpenEXR notices, and the MIT license for fflate 0.8.2 vendored in
+Three's loader support. Runtime JavaScript is bundled from the captured host
+files; no Three.js CDN or separately installed browser dependency is required.
+The declaration package and its transitive type dependencies remain in the
+host toolchain under their accompanying licenses; they are not author SDK
+runtime implementations.

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.0.2",
+  "version": "0.0.3",
   "license": "Apache-2.0",
   "type": "module",
   "engines": {
@@ -15,7 +15,7 @@
     "vmg": "bin/vmg.mjs"
   },
   "optionalDependencies": {
-    "@base_bit/vmg-cli-darwin-arm64": "0.0.2"
+    "@base_bit/vmg-cli-darwin-arm64": "0.0.3"
   },
   "files": [
     "bin/vmg.mjs",