// The third-party licence inventory: what a released nxdns artifact actually
// contains, in the order `zig build dist` concatenates it into
// THIRD-PARTY-NOTICES. Hand-written and reviewed on purpose — a notices file
// scraped from the dependency tree at build time rots into a false statement
// without anyone noticing (milestone-14 ruling 3).
//
// "Artifact" means the two tarballs *and* the container image. The image is
// built FROM scratch and carries one third-party file the binary does not
// contain, the Mozilla CA bundle; distributing the image is distribution, so
// that file is inventoried here like anything else. licenses/preamble.txt says
// so at the head of the assembled notices.
//
// Each entry: the component, the version(s) actually shipped, why it is here
// and which licence option was taken, and the file under licenses/ holding the
// licence text. tools/dist_stage.zig parses exactly this shape and
// src/licenses_drift_test.zig type-checks the same file, so the two must agree.
//
// Order matters. The full Apache License 2.0 text is carried once, by the
// Mbed TLS entry; the Project Everest and p256-m entries that follow refer back
// to it. src/licenses_drift_test.zig enforces that ordering, and fails when the
// dependency sets change without a matching change under licenses/.
//
// For npm packages the `.version` field spells `<package> <version>` for every
// package the entry covers. src/licenses_drift_test.zig compares those pairs
// against licenses/dependency-identity.txt, so a version bump that touches only
// the identity file fails.
//
// The web entries are the packages whose code is actually in admin/dist, read off
// a `vite build --sourcemap`: the sourcemap `sources` lists give the packages
// whose modules were bundled, and the regions of each chunk that *no* sourcemap
// segment maps back to a source file give the code the toolchain injected on
// its own. That second half is how vite and rolldown got here — neither appears
// in any `sources` list, and both emit their own runtime source verbatim.
//
// Four packages of the lockfile's non-dev closure contribute no module to any
// chunk and are therefore not inventoried: cookie-es, isbot, seroval,
// seroval-plugins — all four reach the tree only through @tanstack/router-core's
// server-side paths, which this SPA never imports, and rollup drops them. They
// stay listed in licenses/dependency-identity.txt so that a future build which
// does pull them in trips the guard.
//
// Four more joined that list with the StyleX build integration: css-mediaquery,
// invariant, and loose-envify with js-tokens under it. @stylexjs/stylex
// declares them, but its published runtime imports none of them — a sourcemap
// build of a component calling stylex.props shows no trace of any of the four,
// so they are dead entries of the published manifest rather than code with a
// job here. css-mediaquery is the one that matters: it is BSD, and it reaching
// admin/dist would force a licence decision this project has not made.
//
// Seven more joined that list with React Aria, and the sourcemap build is again
// what settled which: @internationalized/date, @internationalized/number,
// @react-types/shared, @swc/helpers, aria-hidden, client-only and tslib are in
// the runtime closure but contribute no module to any chunk. The date and number
// packages serve the calendar and number-field components ruling 4 keeps out of
// scope; @react-types/shared is types only and emits no runtime code;
// client-only is a build-time marker for React Server Components; @swc/helpers
// and tslib are downlevelling helpers the published ESM builds never reach for;
// and aria-hidden sits behind a react-aria path the four adopted components do
// not take. Their licences differ and are recorded one by one in
// src/licenses_drift_test.zig rather than lumped together: @internationalized/
// date, @internationalized/number, @react-types/shared and @swc/helpers are
// Apache-2.0, tslib is 0BSD, aria-hidden and client-only are MIT. Keeping all
// seven out of the bundle is a fact worth re-checking rather than assuming, so
// the guard fails if any of them turns up in a `sources` list.
//
// StyleX now ships: the converted pages call stylex.props, and a sourcemap build
// puts @stylexjs/stylex in the bundle. What that build settles is not the
// obvious answer, though: only @stylexjs/stylex appears as a bundled package,
// and styleq arrives inside it. The published lib/es/stylex.mjs vendors styleq's source
// instead of importing it, so styleq's bytes ship while styleq never appears in
// a `sources` list — no guard would raise it, which is why it is written down
// here.
//
// Twenty-three more joined the not-shipped list with visx, and the sourcemap
// build settled which. Fourteen are types only and emit no runtime code at all:
// @types/d3-array, @types/d3-color, @types/d3-delaunay, @types/d3-format,
// @types/d3-geo, @types/d3-interpolate, @types/d3-path, @types/d3-scale,
// @types/d3-shape, @types/d3-time, @types/d3-time-format, @types/geojson,
// @types/react and @types/react-dom, with csstype under them. They are in the
// runtime closure rather than among the devDependencies only because the @visx
// packages declare them as ordinary dependencies. @visx/curve is the curve
// factory the line and area shapes take, which these charts do not draw.
// @visx/vendor is the one worth stating plainly: it is a re-export shim over the
// d3 modules, npm records it as `MIT and ISC` because of what it re-exports, and
// the bundler resolves straight through it to the d3 packages themselves — so
// its own bytes never reach admin/dist and the d3 entry below is what covers the
// code that does. d3-delaunay, d3-geo, d3-time-format, delaunator and
// robust-predicates are the map and Voronoi half of that shim, which no chart
// here imports; the first four are ISC and robust-predicates is Unlicense.
// react-use-measure is the resize hook @visx/responsive uses, and this app keeps
// its own, so nothing pulls it in.
//
// Of the remaining devDependencies, none puts a byte in admin/dist: @vitejs/
// plugin-react and typescript only transform our own sources (react-refresh is
// dev-server only, and tslib is optional and unused), lightningcss only
// minifies, and @testing-library/*, jsdom, vitest, oxlint and prettier
// never touch the build output.
.{
    .{
        .component = "musl libc",
        .version = "1.2.5 (as bundled with Zig 0.16.0)",
        .note = "Statically linked into both released binaries: every nxdns build targets *-linux-musl with .linkage = .static. In the tarballs and in the image.",
        .file = "musl-copyright.txt",
    },
    .{
        .component = "Zig standard library, compiler-rt and runtime",
        .version = "0.16.0",
        .note = "The standard library, compiler-rt and the safety runtime are compiled into the binary, so the Zig licence travels with the artifact and not only with the toolchain. Parts of Zig's compiler-rt are ported from LLVM's compiler-rt, which the LLVM project licenses under Apache-2.0 WITH LLVM-exception; that exception waives Sections 4(a), 4(b) and 4(d) of the Apache licence for portions embedded in object form, which is the only form nxdns ships, so no further LLVM notice is required here. Zig redistributes those ports under the MIT text below. In the tarballs and in the image.",
        .file = "zig-mit.txt",
    },
    .{
        .component = "SQLite",
        .version = "3.53.4",
        .note = "Vendored amalgamation, statically linked. Public domain: listed for completeness, no obligation attaches. In the tarballs and in the image.",
        .file = "sqlite-public-domain.txt",
    },
    .{
        .component = "Mbed TLS",
        .version = "3.6.7",
        .note = "Vendored, statically linked. Dual Apache-2.0 OR GPL-2.0-or-later; nxdns takes the Apache-2.0 option, and the full Apache-2.0 text is reproduced below. In the tarballs and in the image.",
        .file = "mbedtls-apache-2.0.txt",
    },
    .{
        .component = "Project Everest (Curve25519, HACL*)",
        .version = "as vendored in Mbed TLS 3.6.7 (3rdparty/everest)",
        .note = "Compiled in through build.zig's mbedtls_3rdparty_sources even though the stock config leaves MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED off: the object code is in the binary either way.",
        .file = "everest-apache-2.0.txt",
    },
    .{
        .component = "p256-m",
        .version = "as vendored in Mbed TLS 3.6.7 (3rdparty/p256-m)",
        .note = "Compiled in through build.zig's mbedtls_3rdparty_sources even though the P-256 driver is not enabled. Dual Apache-2.0 OR GPL-2.0-or-later; nxdns takes the Apache-2.0 option.",
        .file = "p256-m-apache-2.0.txt",
    },
    .{
        .component = "React (react, react-dom, scheduler, use-sync-external-store)",
        .version = "react 19.2.8, react-dom 19.2.8, scheduler 0.27.0, use-sync-external-store 1.6.0",
        .note = "Bundled into the admin UI JavaScript that is embedded in the binary. All four ship under the same Meta MIT text.",
        .file = "react-mit.txt",
    },
    .{
        .component = "TanStack Query, Router and History",
        .version = "@tanstack/react-query 5.101.4, @tanstack/query-core 5.101.4, @tanstack/react-router 1.170.18, @tanstack/router-core 1.171.15, @tanstack/history 1.162.0",
        .note = "Bundled into the admin UI JavaScript. Grouped because all five carry the identical MIT text and copyright line.",
        .file = "tanstack-mit.txt",
    },
    .{
        .component = "React Aria (react-aria-components, react-aria, react-stately, @internationalized/string)",
        .version = "react-aria-components 1.20.0, react-aria 3.51.0, react-stately 3.49.0, @internationalized/string 3.2.10",
        .note = "The dialog, alert dialog, tab and select behaviour of the admin UI, bundled into the JavaScript embedded in the binary. The first Apache-2.0 npm dependency this project has taken, and the first non-MIT one: Mokhtar Mial accepted Apache-2.0 inbound for nxdns on 2026-08-12, which is the decision that let these four ship. Apache-2.0 Section 4 attribution is satisfied by carrying the licence text in THIRD-PARTY-NOTICES, which the file below does; none of the four ships a NOTICE file, so 4(d) adds nothing. All four carry a byte-identical LICENSE. In the tarballs and in the image.",
        .file = "react-aria-apache-2.0.txt",
    },
    .{
        .component = "clsx",
        .version = "clsx 2.1.1",
        .note = "The class-name joiner React Aria calls when it merges a render-prop class name with its own. Bundled into the admin UI JavaScript. Separate entry from the other MIT packages: same MIT text, different copyright line.",
        .file = "clsx-mit.txt",
    },
    .{
        .component = "StyleX",
        .version = "@stylexjs/stylex 0.19.0",
        .note = "The style runtime for the admin UI. Its published dist vendors styleq's source, so the styleq entry below covers bytes that arrive inside this package. The npm tarball ships no licence file of its own; this text is the LICENSE of facebook/stylex at tag 0.19.0, which is byte-identical to the one on main.",
        .file = "stylex-mit.txt",
    },
    .{
        .component = "styleq",
        .version = "styleq 0.2.1",
        .note = "The class-name merger StyleX calls at runtime. Never a bundled package in its own right: @stylexjs/stylex vendors its source into lib/es/stylex.mjs, so it reaches admin/dist without appearing in any sourcemap `sources` list. Separate entry from StyleX: same MIT text, different copyright line.",
        .file = "styleq-mit.txt",
    },
    .{
        .component = "TanStack Store",
        .version = "@tanstack/store 0.9.3, @tanstack/react-store 0.9.3",
        .note = "Bundled into the admin UI JavaScript. Separate entry from the other TanStack packages: same MIT text, different copyright line.",
        .file = "tanstack-store-mit.txt",
    },
    .{
        .component = "visx (@visx/axis, @visx/bounds, @visx/grid, @visx/group, @visx/point, @visx/scale, @visx/shape, @visx/text, @visx/tooltip)",
        .version = "@visx/axis 4.0.0, @visx/bounds 4.0.0, @visx/grid 4.0.0, @visx/group 4.0.0, @visx/point 4.0.0, @visx/scale 4.0.0, @visx/shape 4.0.0, @visx/text 4.0.0, @visx/tooltip 4.0.0",
        .note = "The chart primitives the Overview charts are drawn with — scales, stacked bars, pie arcs, axes, grid and tooltip — bundled into the admin UI JavaScript. Nine of the eleven @visx packages in the closure ship; @visx/curve and @visx/vendor do not (see the note at the head of this file). All nine carry a byte-identical MIT text. In the tarballs and in the image.",
        .file = "visx-mit.txt",
    },
    .{
        .component = "d3 (d3-array, d3-color, d3-format, d3-interpolate, d3-path, d3-scale, d3-shape, d3-time, internmap)",
        .version = "d3-array 3.2.1, d3-color 3.1.0, d3-format 3.1.0, d3-interpolate 3.0.1, d3-path 3.1.0, d3-scale 4.0.2, d3-shape 3.2.0, d3-time 3.1.0, internmap 2.0.3",
        .note = "The scale, colour, number-format and path arithmetic behind visx, bundled into the admin UI JavaScript. They arrive through @visx/vendor, which re-exports them without contributing bytes of its own, so these nine are what the bundle actually carries. The first ISC dependencies this project has taken: Mokhtar Mial accepted ISC inbound for nxdns on 2026-08-24, which is the decision that let them ship. ISC asks only that the copyright notice and the permission notice travel with the copies; the nine notices differ in their copyright years alone, so the file below reproduces every notice above the single shared permission text. In the tarballs and in the image.",
        .file = "d3-isc.txt",
    },
    .{
        .component = "classnames",
        .version = "classnames 2.5.1",
        .note = "The class-name joiner visx uses to merge its own chart class names with a caller's. Bundled into the admin UI JavaScript. Separate entry from the other MIT packages: same MIT text, different copyright line.",
        .file = "classnames-mit.txt",
    },
    .{
        .component = "balanced-match",
        .version = "balanced-match 0.4.2, balanced-match 1.0.2",
        .note = "The bracket matcher reduce-function-call calls when it takes a CSS calc() expression apart. Bundled into the admin UI JavaScript. Two versions are installed, one under reduce-function-call and one at the root; both carry this text. Separate entry from the other MIT packages: same MIT text, different copyright line.",
        .file = "balanced-match-mit.txt",
    },
    .{
        .component = "math-expression-evaluator",
        .version = "math-expression-evaluator 1.4.0",
        .note = "The arithmetic evaluator reduce-css-calc reduces a calc() expression with, reached from @visx/text's width measurement. Bundled into the admin UI JavaScript. Separate entry from the other MIT packages: same MIT text, different copyright line.",
        .file = "math-expression-evaluator-mit.txt",
    },
    .{
        .component = "reduce-css-calc",
        .version = "reduce-css-calc 1.3.0",
        .note = "Resolves CSS calc() expressions for @visx/text. Bundled into the admin UI JavaScript. Separate entry from the other MIT packages: same MIT text, different copyright line.",
        .file = "reduce-css-calc-mit.txt",
    },
    .{
        .component = "reduce-function-call",
        .version = "reduce-function-call 1.0.3",
        .note = "The function-call walker reduce-css-calc is built on. Bundled into the admin UI JavaScript. Separate entry from reduce-css-calc: same MIT text, different copyright line.",
        .file = "reduce-function-call-mit.txt",
    },
    .{
        .component = "Vite",
        .version = "vite 8.1.5",
        .note = "A devDependency whose own runtime source ships: the preload helper and the modulepreload polyfill are injected verbatim into admin/dist/assets/index-*.js, which is embedded in the binary.",
        .file = "vite-mit.txt",
    },
    .{
        .component = "Rolldown",
        .version = "rolldown 1.1.5",
        .note = "A devDependency whose own runtime source ships: the bundler Vite 8 runs prepends its CommonJS interop helpers verbatim to admin/dist/assets/styles-*.js, which is embedded in the binary.",
        .file = "rolldown-mit.txt",
    },
    .{
        .component = "Mozilla CA certificate bundle (Alpine ca-certificates-bundle)",
        .version = "20260611-r0 (alpine 3.22)",
        .note = "In the container image only, at /etc/ssl/certs/ca-certificates.crt: deploy/docker/Dockerfile copies it out of the pinned base into the scratch image so DoH and DoT upstreams verify. apk records the package as MPL-2.0 AND MIT; the shipped bytes derive from Mozilla NSS certdata.txt under MPL-2.0, whose full text follows. Not in the tarballs and not in the binary.",
        .file = "mozilla-ca-bundle-mpl-2.0.txt",
    },
}
