# Boundary lookup provenance and distribution obligations

This is engineering provenance/compliance documentation, not legal advice.
Pulse does not alter tz-lookup 6.1.25's lookup data or weaken its independent
geographic cross-check. The GeoNames postal derivative remains a separate CC BY
4.0 dataset; missing postal time zones are not invented.

## Exact artifact and declared generation path

The lockfile identifies the npm 6.1.25 package and integrity digest. The package
contains `tz.js` (the complete compressed lookup and executable reader),
`tz_template.js`, `pack.js`, `rebuild.sh`, README and CC0 license.
Its README says data updated 6 January 2019, while its executable rebuild script
explicitly sets `TZ="2019b"`. These are inconsistent upstream metadata: the
rebuild declaration is not claimed to prove byte-for-byte regeneration.

The declared inputs are timezone-boundary-builder release 2019b's
`timezones.geojson.zip` (`dist/combined.json`) and Natural Earth's 1:10m urban
areas. `pack.js` converts polygons to an approximate compressed quadtree,
using urban-area adjustments and embedded correction coordinates, then inserts
the data and zone list into `tz_template.js` and minifies it.
This exact algorithm is shipped beside the complete installed derivative.

The boundary source is OpenStreetMap through timezone-boundary-builder.
The upstream data license is ODbL, separate from the CC0 tz-lookup code
([upstream data license mirror](https://android.googlesource.com/platform/external/timezone-boundary-builder/+/refs/tags/android-platform-13.0.0_r36/DATA_LICENSE)).
Natural Earth declares all versions of its vector/raster data public domain
([Natural Earth terms](https://www.naturalearthdata.com/about/terms-of-use/)).

## Conservative distribution treatment

Treat the complete compressed lookup as an ODbL derivative database, not as
unrestricted CC0 data merely because the reader code is CC0. ODbL section 4.6
permits offering the entire derivative in machine-readable form, rather than
only a regeneration method; sections 4.2–4.4 require notices and applicable
share-alike treatment ([ODbL](https://opendatacommons.org/licenses/odbl/1-0/)).

The build publishes the exact installed complete `tz.js`, its readable lookup
template, packer, rebuild script and original notices under
`/vendor/timezone-boundary/`, together with this notice. The file is not merely
an API or a sample of query results: it contains the entire compressed database
and reader. Its hash is recorded during build. No database content is withheld.
This is the section 4.6(a) whole-derivative availability approach; it does not
claim the upstream inputs can be reproduced byte-for-byte from today's downloads.

Attribution: contains OpenStreetMap contributor data via Evan Siroky's
timezone-boundary-builder and the unmodified tz-lookup 6.1.25 compressed
derivative. Data is available under ODbL:
https://opendatacommons.org/licenses/odbl/1-0/.
OpenStreetMap attribution: https://www.openstreetmap.org/copyright.
Reader/packer code: CC0-1.0, The Dark Sky Company, LLC.
Natural Earth input: public domain.
Pulse modifications to the boundary database: none.

## Owner obligations

Retain these notices, upstream notices and the full derivative offer when
distributing the build or publicly using its outputs. Keep the same-origin
download free and accessible to recipients, and do not place database-use
restrictions on that copy. Include the directory in offline distributions.
The application shell links to its data notices; deployments must not remove it.
If the boundary data is changed later, update attribution and offer the complete
changed derivative under the applicable data license. The application and its
unrelated private operational database are not being licensed as this boundary
database by this document.