# Third-Party Licenses - Reelora

This product uses the following open-source packages. Each remains under its own license.

| Ecosystem | Package | Version | License |
|---|---|---|---|
| npm | @hono/node-server | 2.1.6 | MIT |
| npm | base64-js | 1.5.1 | MIT |
| npm | better-sqlite3 | 12.11.1 | MIT |
| npm | bindings | 1.5.0 | MIT |
| npm | bl | 4.1.0 | MIT |
| npm | buffer | 5.7.1 | MIT |
| npm | chownr | 1.1.4 | ISC |
| npm | decompress-response | 6.0.0 | MIT |
| npm | deep-extend | 0.6.0 | MIT |
| npm | detect-libc | 2.1.2 | Apache-2.0 |
| npm | end-of-stream | 1.4.5 | MIT |
| npm | expand-template | 2.0.3 | (MIT OR WTFPL) |
| npm | file-uri-to-path | 1.0.0 | MIT |
| npm | fs-constants | 1.0.0 | MIT |
| npm | github-from-package | 0.0.0 | MIT |
| npm | hls.js | 1.7.4 | Apache-2.0 |
| npm | hono | 4.13.17 | MIT |
| npm | ieee754 | 1.2.1 | BSD-3-Clause |
| npm | inherits | 2.0.4 | ISC |
| npm | ini | 1.3.8 | ISC |
| npm | mimic-response | 3.1.0 | MIT |
| npm | minimist | 1.2.8 | MIT |
| npm | mkdirp-classic | 0.5.3 | MIT |
| npm | napi-build-utils | 2.0.0 | MIT |
| npm | node-abi | 3.101.0 | MIT |
| npm | once | 1.4.0 | ISC |
| npm | prebuild-install | 7.1.3 | MIT |
| npm | pump | 3.0.4 | MIT |
| npm | rc | 1.2.8 | (BSD-2-Clause OR MIT OR Apache-2.0) |
| npm | readable-stream | 3.6.2 | MIT |
| npm | safe-buffer | 5.2.1 | MIT |
| npm | semver | 7.8.6 | ISC |
| npm | simple-concat | 1.0.1 | MIT |
| npm | simple-get | 4.0.1 | MIT |
| npm | string_decoder | 1.3.0 | MIT |
| npm | strip-json-comments | 2.0.1 | MIT |
| npm | tar-fs | 2.1.5 | MIT |
| npm | tar-stream | 2.2.0 | MIT |
| npm | tunnel-agent | 0.6.0 | Apache-2.0 |
| npm | util-deprecate | 1.0.2 | MIT |
| npm | wrappy | 1.0.2 | ISC |
| pub | _flutterfire_internals | 1.3.77 | BSD |
| pub | app_links | 7.0.0 | Apache-2.0 |
| pub | app_links_linux | 1.0.3 | Apache-2.0 |
| pub | app_links_platform_interface | 2.0.2 | Apache-2.0 |
| pub | app_links_web | 1.0.4 | Apache-2.0 |
| pub | args | 2.7.0 | BSD |
| pub | async | 2.13.1 | BSD |
| pub | boolean_selector | 2.1.2 | BSD |
| pub | cached_network_image | 3.4.1 | MIT |
| pub | cached_network_image_platform_interface | 4.1.1 | MIT |
| pub | cached_network_image_web | 1.3.1 | MIT |
| pub | characters | 1.4.1 | BSD |
| pub | clock | 1.1.2 | Apache-2.0 |
| pub | code_assets | 1.2.1 | BSD |
| pub | collection | 1.19.1 | BSD |
| pub | cross_file | 0.3.5+5 | BSD |
| pub | crypto | 3.0.8 | BSD |
| pub | csslib | 1.0.2 | BSD |
| pub | cupertino_icons | 1.0.9 | MIT |
| pub | fake_async | 1.3.3 | Apache-2.0 |
| pub | ffi | 2.2.0 | BSD |
| pub | ffi_leak_tracker | 0.1.2 | BSD |
| pub | file | 7.0.1 | BSD |
| pub | firebase_core | 4.15.2 | BSD |
| pub | firebase_core_platform_interface | 8.1.1 | BSD |
| pub | firebase_core_web | 3.12.0 | BSD |
| pub | firebase_messaging | 16.7.1 | BSD |
| pub | firebase_messaging_platform_interface | 4.10.0 | BSD |
| pub | firebase_messaging_web | 4.2.5 | BSD |
| pub | fixnum | 1.1.1 | BSD |
| pub | flutter_cache_manager | 3.5.0 | MIT |
| pub | flutter_lints | 6.0.0 | BSD |
| pub | google_mobile_ads | 9.2.0 | Apache-2.0 |
| pub | gtk | 2.2.0 | MPL-2.0 |
| pub | hooks | 2.0.2 | BSD |
| pub | html | 0.15.7 | MIT |
| pub | http | 1.6.0 | BSD |
| pub | http_parser | 4.1.2 | BSD |
| pub | in_app_purchase | 3.3.1 | BSD |
| pub | in_app_purchase_android | 0.5.0 | BSD |
| pub | in_app_purchase_platform_interface | 1.4.1 | BSD |
| pub | in_app_purchase_storekit | 0.4.17 | BSD |
| pub | intl | 0.20.2 | BSD |
| pub | jni | 1.1.2 | BSD |
| pub | jni_flutter | 1.0.4+1 | BSD |
| pub | jni_util | 1.0.0 | BSD |
| pub | json_annotation | 4.12.0 | BSD |
| pub | leak_tracker | 11.0.2 | BSD |
| pub | leak_tracker_flutter_testing | 3.0.10 | BSD |
| pub | leak_tracker_testing | 3.0.2 | BSD |
| pub | lints | 6.1.0 | BSD |
| pub | logging | 1.3.0 | BSD |
| pub | matcher | 0.12.19 | BSD |
| pub | material_color_utilities | 0.13.0 | Apache-2.0 |
| pub | meta | 1.17.0 | BSD |
| pub | mime | 2.1.0 | BSD |
| pub | nested | 1.0.0 | MIT |
| pub | objective_c | 9.5.0 | BSD |
| pub | octo_image | 2.1.3 | MIT |
| pub | package_config | 3.0.0 | BSD |
| pub | path | 1.9.1 | BSD |
| pub | path_provider | 2.1.6 | BSD |
| pub | path_provider_android | 2.3.1 | BSD |
| pub | path_provider_foundation | 2.6.0 | BSD |
| pub | path_provider_linux | 2.2.2 | BSD |
| pub | path_provider_platform_interface | 2.1.3 | BSD |
| pub | path_provider_windows | 2.3.0 | BSD |
| pub | platform | 3.1.6 | BSD |
| pub | plugin_platform_interface | 2.1.8 | BSD |
| pub | provider | 6.1.5+1 | MIT |
| pub | pub_semver | 2.2.1 | BSD |
| pub | record_use | 0.6.0 | BSD |
| pub | rxdart | 0.28.0 | Apache-2.0 |
| pub | share_plus | 13.3.1 | BSD |
| pub | share_plus_platform_interface | 7.2.0 | BSD |
| pub | shared_preferences | 2.5.6 | BSD |
| pub | shared_preferences_android | 2.4.23 | BSD |
| pub | shared_preferences_foundation | 2.5.7 | BSD |
| pub | shared_preferences_linux | 2.4.1 | BSD |
| pub | shared_preferences_platform_interface | 2.4.2 | BSD |
| pub | shared_preferences_web | 2.4.3 | BSD |
| pub | shared_preferences_windows | 2.4.1 | BSD |
| pub | source_span | 1.10.2 | BSD |
| pub | sqflite | 2.4.2+1 | BSD |
| pub | sqflite_android | 2.4.2+3 | BSD |
| pub | sqflite_common | 2.5.8 | BSD |
| pub | sqflite_darwin | 2.4.2 | BSD |
| pub | sqflite_platform_interface | 2.4.0 | BSD |
| pub | stack_trace | 1.12.1 | BSD |
| pub | stream_channel | 2.1.4 | BSD |
| pub | string_scanner | 1.4.1 | BSD |
| pub | synchronized | 3.4.0+1 | MIT |
| pub | term_glyph | 1.2.2 | BSD |
| pub | test_api | 0.7.10 | BSD |
| pub | typed_data | 1.4.0 | BSD |
| pub | url_launcher | 6.3.3 | BSD |
| pub | url_launcher_android | 6.3.30 | BSD |
| pub | url_launcher_ios | 6.4.2 | BSD |
| pub | url_launcher_linux | 3.2.3 | BSD |
| pub | url_launcher_macos | 3.2.6 | BSD |
| pub | url_launcher_platform_interface | 2.3.2 | BSD |
| pub | url_launcher_web | 2.4.3 | BSD |
| pub | url_launcher_windows | 3.1.6 | BSD |
| pub | uuid | 4.6.0 | MIT |
| pub | vector_math | 2.2.0 | BSD |
| pub | video_player | 2.11.1 | BSD |
| pub | video_player_android | 2.9.5 | BSD |
| pub | video_player_avfoundation | 2.12.1 | BSD |
| pub | video_player_platform_interface | 6.9.0 | BSD |
| pub | video_player_web | 2.4.0 | BSD |
| pub | vm_service | 15.4.0 | BSD |
| pub | web | 1.1.1 | BSD |
| pub | webview_flutter | 4.14.1 | BSD |
| pub | webview_flutter_android | 4.12.0 | BSD |
| pub | webview_flutter_platform_interface | 2.15.1 | BSD |
| pub | webview_flutter_wkwebview | 3.25.1 | BSD |
| pub | win32 | 6.4.0 | BSD |
| pub | xdg_directories | 1.1.0 | BSD |
| pub | yaml | 3.1.4 | MIT |

## Bundled in the operator console build

The console in `server/packages/admin-kit/ui/` is built from `server/packages/admin-kit/ui-src/` and contains these
packages (readable, not minified). Their source is downloaded by `npm ci` in `ui-src/`.

| Ecosystem | Package | Version | License |
|---|---|---|---|
| npm | @fontsource-variable/geist | 5.3.0 | OFL-1.1 |
| npm | @fontsource-variable/geist-mono | 5.3.0 | OFL-1.1 |
| npm | @radix-ui/primitive | 1.2.0 | MIT |
| npm | @radix-ui/react-compose-refs | 1.1.5 | MIT |
| npm | @radix-ui/react-context | 1.3.0 | MIT |
| npm | @radix-ui/react-dialog | 1.3.1 | MIT |
| npm | @radix-ui/react-dismissable-layer | 1.2.1 | MIT |
| npm | @radix-ui/react-focus-guards | 1.2.0 | MIT |
| npm | @radix-ui/react-focus-scope | 1.3.1 | MIT |
| npm | @radix-ui/react-id | 1.1.4 | MIT |
| npm | @radix-ui/react-portal | 1.2.0 | MIT |
| npm | @radix-ui/react-presence | 1.1.11 | MIT |
| npm | @radix-ui/react-primitive | 2.2.0 | MIT |
| npm | @radix-ui/react-slot | 1.5.0 | MIT |
| npm | @radix-ui/react-use-callback-ref | 1.1.5 | MIT |
| npm | @radix-ui/react-use-controllable-state | 1.3.0 | MIT |
| npm | @radix-ui/react-use-effect-event | 0.0.5 | MIT |
| npm | @radix-ui/react-use-layout-effect | 1.1.4 | MIT |
| npm | aria-hidden | 1.2.6 | MIT |
| npm | cmdk | 1.1.1 | MIT |
| npm | detect-node-es | 1.1.0 | MIT |
| npm | get-nonce | 1.0.1 | MIT |
| npm | lucide-react | 1.70.0 | ISC |
| npm | react | 19.3.1 | MIT |
| npm | react-dom | 19.3.1 | MIT |
| npm | react-remove-scroll | 2.7.2 | MIT |
| npm | react-remove-scroll-bar | 2.3.8 | MIT |
| npm | react-style-singleton | 2.2.3 | MIT |
| npm | scheduler | 0.28.0 | MIT |
| npm | tslib | 2.9.1 | 0BSD |
| npm | use-callback-ref | 1.3.3 | MIT |
| npm | use-sidecar | 1.1.3 | MIT |

## Fonts (bundled)

| Font | License | Where |
|---|---|---|
| Inter | SIL Open Font License 1.1 | `app/assets/fonts`, `web/public/fonts`, `server/studio/fonts`, `server/tools/fonts` (licence file `Inter-OFL.txt` next to the fonts) |
| Instrument Serif | SIL Open Font License 1.1 | same folders (`InstrumentSerif-OFL.txt`) |
| Geist, Geist Mono | SIL Open Font License 1.1 | `server/pages/fonts` (`Geist-OFL.txt`) and the console build |

## Notes

- `gtk` (MPL-2.0) is pulled in by `app_links` through `app_links_linux` and is used only for Linux desktop builds,
  which this app does not target. It is used unmodified.
- Apple Root CA - G3 is Apple's public root certificate. It is embedded in `server/src/payments/apple.ts`, checked by
  its SHA-256 fingerprint, and used only to verify App Store purchase signatures.