Dependencies and assets are served locally. No CDN is needed at runtime.

@google/model-viewer 4.4.0 (unmodified distribution)
https://github.com/google/model-viewer
https://registry.npmjs.org/@google/model-viewer/-/model-viewer-4.4.0.tgz
Apache-2.0; see model-viewer-LICENSE.txt.
The distribution bundles Three.js (MIT; three-LICENSE.txt), Lit (BSD-3-Clause;
lit-LICENSE.txt), and gainmap-js (MIT; gainmap-LICENSE.txt). Copyright and
license headers inside the original bundle are retained.

Draco and Basis Universal runtime decoders, from Three.js 0.183.0
https://registry.npmjs.org/three/-/three-0.183.0.tgz
https://github.com/google/draco — Apache-2.0; draco-LICENSE.txt
https://github.com/BinomialLLC/basis_universal — Apache-2.0; basis-LICENSE.txt
The encoder is not necessary and is not included.

Meshoptimizer 1.0.0 decoder (unmodified CJS/UMD distribution)
https://registry.npmjs.org/meshoptimizer/-/meshoptimizer-1.0.0.tgz
https://github.com/zeux/meshoptimizer/tree/v1.0
MIT; meshoptimizer-LICENSE.txt.

BoomBox.glb, Microsoft, © 2017, Public
Khronos glTF Sample Assets; CC0 1.0 Universal.
https://github.com/KhronosGroup/glTF-Sample-Assets/tree/main/Models/BoomBox
Unmodified model. See BoomBox-README.txt and CC0-1.0.txt.