# Third-party notices

This file records direct runtime and development dependencies used by
`sv_remote`. Transitive dependency notices are generated from lockfiles during
release and must be reviewed before distribution.

No AGPL or GPL code is used as a product codebase.

## Control plane

| Component | Purpose | License | Source |
|---|---|---|---|
| Node.js | Runtime | MIT | https://github.com/nodejs/node |
| Fastify | HTTP API | MIT | https://github.com/fastify/fastify |
| @fastify/websocket | WebSocket integration | MIT | https://github.com/fastify/fastify-websocket |
| node-postgres (`pg`) | PostgreSQL client | MIT | https://github.com/brianc/node-postgres |
| node-redis (`redis`) | Redis client | MIT | https://github.com/redis/node-redis |
| ws | WebSocket client/server implementation | MIT | https://github.com/websockets/ws |
| Zod | Input validation | MIT | https://github.com/colinhacks/zod |
| Pino | Structured logging | MIT | https://github.com/pinojs/pino |
| TypeScript | Compiler | Apache-2.0 | https://github.com/microsoft/TypeScript |
| @types/ws | WebSocket TypeScript declarations | MIT | https://github.com/DefinitelyTyped/DefinitelyTyped |
| tsx | TypeScript runner | MIT | https://github.com/privatenumber/tsx |

## Infrastructure

| Component | Purpose | License | Source |
|---|---|---|---|
| PostgreSQL | Metadata and audit database | PostgreSQL License | https://www.postgresql.org/ |
| Redis 7.2.4 | Presence, replay protection, short-lived state | BSD-3-Clause | https://github.com/redis/redis/tree/7.2.4 |
| coturn | STUN/TURN relay | BSD-3-Clause | https://github.com/coturn/coturn |
| nginx | TLS reverse proxy | BSD-2-Clause | https://nginx.org/ |
| Eclipse Temurin OpenJDK 21 container | Isolated server-side Android signing tool; not linked into or distributed with the product | GPL-2.0-only WITH Classpath-exception-2.0 plus image component notices | https://adoptium.net/temurin/ |

## Rust clients

| Component | Purpose | License |
|---|---|---|
| anyhow 1.0.104 | Error context | MIT OR Apache-2.0 |
| async-trait 0.1.92 | Object-safe asynchronous WebRTC event handlers | MIT OR Apache-2.0 |
| base64 0.22.1 | Wire encoding | MIT OR Apache-2.0 |
| chacha20poly1305 0.10.1 | Authenticated frame encryption | MIT OR Apache-2.0 |
| clap 4.6.6 | Native CLI | MIT OR Apache-2.0 |
| ed25519-dalek 2.2.0 | Device signatures | BSD-3-Clause |
| eframe / egui 0.36.1 | Native Windows dashboard and connection tree | MIT OR Apache-2.0 |
| futures-util 0.3.34 | Async WebSocket support | MIT OR Apache-2.0 |
| hkdf 0.12.4 | Session key derivation | MIT OR Apache-2.0 |
| image 0.25.10 | Bounded JPEG screen-frame encoding and decoding | MIT OR Apache-2.0 |
| minifb 0.28.0 | Windows controller viewer | MIT |
| rand_core 0.6.4 | Cryptographic randomness adapter | MIT OR Apache-2.0 |
| reqwest 0.12.28 | HTTPS client (resolved lockfile version) | MIT OR Apache-2.0 |
| rfd 0.17.2 | Visible Windows consent dialog | MIT |
| serde 1.0.229 / serde_json 1.0.151 | Protocol serialization | MIT OR Apache-2.0 |
| sha2 0.10.9 | Hashing | MIT OR Apache-2.0 |
| thiserror 2.0.20 | Typed protocol errors | MIT OR Apache-2.0 |
| tokio 1.53.1 | Async runtime | MIT |
| tokio-tungstenite 0.30.0 | Secure signalling channel | MIT |
| tray-icon 0.24.2 | Persistent Windows session indicator | MIT OR Apache-2.0 |
| url 2.5.8 | URL handling | MIT OR Apache-2.0 |
| uuid 1.25.0 | Session identifiers | Apache-2.0 OR MIT |
| windows 0.62.2 | Windows DPAPI identity protection and consent-gated SendInput bindings | MIT OR Apache-2.0 |
| x25519-dalek 2.0.1 | Ephemeral session agreement | BSD-3-Clause |
| xcap 0.9.8 | Windows screen capture | Apache-2.0 |
| zeroize 1.9.0 | Secret memory clearing | MIT OR Apache-2.0 |
| zstd 0.13.3 | Frame compression | MIT |
| webrtc 0.20.3 (`webrtc-rs`) | ICE/STUN/TURN and WebRTC data channels | MIT OR Apache-2.0 |
| AccessKit (resolved Windows graph) | Native assistive-technology bridge enabled through eframe | MIT OR Apache-2.0 |

## Android client

| Component | Purpose | License | Source |
|---|---|---|---|
| Android Gradle Plugin 8.13.2 | Android build tooling | Apache-2.0 | https://developer.android.com/build |
| Kotlin 2.3.21 | Android application language and compiler | Apache-2.0 | https://github.com/JetBrains/kotlin |
| AndroidX Activity 1.13.0 | Compose activity integration | Apache-2.0 | https://developer.android.com/jetpack/androidx |
| AndroidX Core 1.17.0 | Android Kotlin extensions | Apache-2.0 | https://developer.android.com/jetpack/androidx |
| AndroidX Lifecycle 2.10.0 | View model, service, and lifecycle integration | Apache-2.0 | https://developer.android.com/jetpack/androidx |
| Jetpack Compose BOM 2026.04.01 and Compose UI/Material 3 | Native Android user interface | Apache-2.0 | https://developer.android.com/compose |
| kotlinx.coroutines 1.10.2 | Structured asynchronous operations | Apache-2.0 | https://github.com/Kotlin/kotlinx.coroutines |
| OkHttp 4.12.0 | HTTPS and WebSocket client | Apache-2.0 | https://github.com/square/okhttp |
| Bouncy Castle 1.81 | Ed25519, X25519, HKDF, and ChaCha20-Poly1305 | MIT-style Bouncy Castle License | https://www.bouncycastle.org |
| zstd-jni 1.5.7-4 | Android frame compression JNI bridge | BSD-2-Clause | https://github.com/luben/zstd-jni |
| Zstandard native library | Compression implementation embedded by zstd-jni | BSD-3-Clause (permissive option) | https://github.com/facebook/zstd |
| WebRTC Android SDK 144.7559.14 (`io.github.webrtc-sdk:android`) | ICE/STUN/TURN and WebRTC data channels | BSD-3-Clause | https://github.com/webrtc-sdk/android |

Exact transitive versions are pinned in `package-lock.json` and `Cargo.lock`.
Android direct versions are pinned in Gradle Kotlin build files and resolved by
the Gradle dependency graph used for the release artifact.
Release gates `scripts/check-node-licenses.mjs` and
`scripts/check-rust-licenses.sh` fail on missing license metadata, MPL, or
copyleft/source-available license families. Dependencies offering a permissive
SPDX `OR` choice are consumed under that permissive option. Cargo graphs are
checked independently for the distributed Linux and Windows target triples, so
dependencies that exist in the lockfile only for an unused third-party target
do not become part of an artifact's notices.
