Skip to content

THIRD_PARTY.md

Latest commit

 

History

History
95 lines (76 loc) · 8.08 KB

THIRD_PARTY.md

File metadata and controls

95 lines (76 loc) · 8.08 KB
Raw

Third-party code and assets

Every third-party package, font, image or code snippet used in this repository is listed here with its license. Versions and licenses below are read from the installed packages (node_modules/<name>/package.json). The full dependency tree, including transitive packages, is pinned in package-lock.json.

Last updated: 2026-10-02 (the user's own wallet; FHFA house price index).

Runtime dependencies

Package Version License Source
next 16.3.8 MIT https://github.com/vercel/next.js
react 19.2.8 MIT https://github.com/react/react
react-dom 19.2.8 MIT https://github.com/react/react
@google/genai 2.25.0 Apache-2.0 https://github.com/googleapis/js-genai
@solana/kit 8.4.0 MIT https://github.com/anza-xyz/kit
@solana-program/token-2022 0.19.0 Apache-2.0 https://github.com/solana-program/token-2022
@solana-program/system 0.15.0 Apache-2.0 https://github.com/solana-program/system
@solana-program/memo 0.15.0 Apache-2.0 https://github.com/solana-program/memo
lucide-react 1.50.0 ISC; icons derived from Feather are MIT (both texts in node_modules/lucide-react/LICENSE) https://github.com/lucide-icons/lucide
@solana/kit-plugin-wallet 0.20.0 MIT https://github.com/anza-xyz/kit-plugins
@solana/react 8.4.0 MIT (an optional peer of @solana/kit-plugin-wallet's React hooks) https://github.com/anza-xyz/kit
@solana/sysvars 8.4.0 MIT https://github.com/anza-xyz/kit
sas-lib 2.0.0-beta.1 MIT, Copyright (c) 2025 Solana Foundation (the repository's LICENSE; the package itself has no license field). Installed with an npm overrides entry so it uses our @solana/kit 8.4 instead of its declared peer ^7 (checked: it builds and runs) https://github.com/solana-foundation/solana-attestation-service
server-only 0.0.1 MIT https://www.npmjs.com/package/server-only (keeps lib/web/server.ts out of browser bundles)

Notable licenses further down the dependency tree (none is shipped as our code): caniuse-lite (CC-BY-4.0, browser data used at build time), lightningcss and axe-core (MPL-2.0, build and lint tools), @img/sharp-libvips (LGPL-3.0-or-later, an optional part of Next.js image handling, which this app does not use), argparse (Python-2.0, a development tool).

Development dependencies

Package Version License Source
@tailwindcss/postcss 4.3.3 MIT https://github.com/tailwindlabs/tailwindcss
tailwindcss 4.3.3 MIT https://github.com/tailwindlabs/tailwindcss
postcss 8.5.28 MIT https://github.com/postcss/postcss
typescript 5.9.3 Apache-2.0 https://github.com/microsoft/TypeScript
eslint 9.39.5 MIT https://github.com/eslint/eslint
eslint-config-next 16.3.8 MIT https://github.com/vercel/next.js
vitest 5.0.3 MIT https://github.com/vitest-dev/vitest
tsx 4.23.15 MIT https://github.com/privatenumber/tsx
@types/node 22.20.4 MIT https://github.com/DefinitelyTyped/DefinitelyTyped
@types/react 19.3.0 MIT https://github.com/DefinitelyTyped/DefinitelyTyped
@types/react-dom 19.3.0 MIT https://github.com/DefinitelyTyped/DefinitelyTyped

Fonts

Font License Source How it is used
Inter SIL Open Font License 1.1 https://github.com/rsms/inter The UI font. Loaded with next/font/google and self-hosted at build time
Geist Mono SIL Open Font License 1.1 (OFL.txt) https://github.com/vercel/geist-font Monospaced text (hashes, ids). Loaded with next/font/google and self-hosted at build time

Generated files

The initial project files (app/, eslint.config.mjs, next.config.ts, postcss.config.mjs, tsconfig.json, AGENTS.md) were generated by create-next-app 16.3.8 (MIT, part of https://github.com/vercel/next.js). The template's logo images and favicon were removed.

Data sources and required notices

scripts/refresh-params.ts reads four market series through the FRED API. Each source's terms require a notice wherever its data is presented (README, and the UI once these values are shown).

Data Owner Fetched from Terms Required notice / attribution
FRED API (all series below) Federal Reserve Bank of St. Louis https://api.stlouisfed.org https://fred.stlouisfed.org/docs/api/terms_of_use.html "This product uses the FRED® API but is not endorsed or certified by the Federal Reserve Bank of St. Louis."
30- and 15-year fixed mortgage averages (MORTGAGE30US, MORTGAGE15US) Freddie Mac, Primary Mortgage Market Survey (PMMS) FRED https://www.freddiemac.com/pmms ("may be used with proper attribution") "Source: Freddie Mac Primary Mortgage Market Survey."
FHFA All-Transactions House Price Index for the United States (USSTHPI) U.S. Federal Housing Finance Agency FRED https://fred.stlouisfed.org/series/USSTHPI (no third-party copyright note on the series) The FRED notice above (in the site footer). Used for the settlement demo's simulated appraisal and, over the past 10 years, as an HEI price scenario in the comparison.
SOFR Federal Reserve Bank of New York FRED https://www.newyorkfed.org/privacy/termsofuse "The SOFR is subject to the Terms of Use posted at newyorkfed.org. The New York Fed is not responsible for publication of the SOFR by Ownflow, does not sanction or endorse any particular republication, and has no liability for your use."

FRED's terms also ask for permission from the owner of a copyrighted third-party series; the owners' own terms above allow use with attribution. Re-check before a public launch.

Services

Service Used for Terms Notes
RentCast API Home records (owner check, last sale) and value range. Without a key, or with PROPERTY_DATA_SOURCE=demo, made-up demo data in data/demo/properties.json https://www.rentcast.io/terms-api Storing and showing the data to users is allowed; no attribution required. Free plan: 50 requests a month, so lookups are cached for 30 days in the git-ignored .cache/rentcast/.
Plaid Identity Verification (sandbox) Investor KYC before the on-chain attestation, with Plaid's published sandbox test identity (a made-up person). Only when PLAID_IDV_TEMPLATE_ID is set; otherwise a simulated check, labeled https://plaid.com/legal/ Sandbox only (free). Backend-only flow; nothing personal is stored: the attestation keeps a SHA-256 of the verification id.
Solana Attestation Service KYC attestations for investors' wallets on devnet, written by the demo issuer and checked on-chain before a share account is thawed https://github.com/solana-foundation/solana-attestation-service Program 22zoJMtdu4tQc2PzL74ZUT7FrwgB1Udec8DdW4yw4BdG. Ownflow (the simulated partner) is the attestation issuer, not a regulated KYC provider.
Plaid Liabilities (sandbox) Reading a mortgage's balance and terms from the lender, after the user approves https://plaid.com/legal/ Sandbox only: test data from Plaid's test institutions. The access token is used once and not stored. Production would use Plaid Link in the browser.
Google Gemini API The agent's conversation and tool calling, and reading watch photos (image input, JSON output) https://ai.google.dev/gemini-api/terms Users must be 18+. Our key is on the paid tier: Google does not use prompts to improve its products and keeps them only for a limited time to detect abuse.
Solana devnet (public RPC) Receipt memos and Token-2022 mints for the demo https://solana.com/docs/references/clusters Devnet only; rate limited. Test SOL from https://faucet.solana.com.
The Watch Register (stolen-watch registry) Not contacted. The check is simulated and labeled "SIMULATED" (no API could be verified) — —

Images, logos and other media

File Origin
app/icon.svg, the mark in components/AppHeader.tsx Made for this project.
data/demo/watch-photos/demo-warranty-card.png Made for this project: rendered from demo-warranty-card.svg (our own file) with macOS Quick Look. Made-up maker, reference and serial; no logos.