Third-party licenses
Fonts, design assets and open-source code this product includes or adapts, with their licenses.
This product includes or adapts the third-party works below. Each keeps its own license; the required notices are reproduced or linked here and preserved in the source files they came from.
Adapted source code
| Component | Source | License | Copyright holder | Files | Notice |
|---|---|---|---|---|---|
| none |
Fonts and design assets
| Asset | Source | License |
|---|---|---|
| Geologica (display, weight 800) | Google Fonts: https://fonts.google.com/specimen/Geologica | SIL Open Font License 1.1 |
| Inter (body, weight 400) | Google Fonts: https://fonts.google.com/specimen/Inter | SIL Open Font License 1.1 |
| JetBrains Mono (numbers, addresses, weight 400/500) | Google Fonts: https://fonts.google.com/specimen/JetBrains+Mono | SIL Open Font License 1.1 |
Logo (mark + wordmark, public/brand/logo/final/) |
Original work made for this project: 4 concepts generated with Codex (OpenAI) image generation, harshly critiqued, 2 refined, one selected (c1r); vectorised from the black-on-white master with potrace (GPL-2.0 tool, the traced SVG output it produces is not itself GPL-covered) |
Owner-owned original work; no third-party mark reused |
npm dependencies
Installed packages keep their own licenses (see each package's LICENSE file). Packages needing attention,
from scan.mjs --only licenses: run in Stage 2F (QA/Security), see SECURITY_NOTES.md.
The utility packages selected in Stage 2B (docs/process/OSS_EVALUATION.md) and installed in Stage 2D for
CORE features F1-F5, none adapted/copied, ordinary npm dependencies, license kept as published:
| Package | License | Selected for |
|---|---|---|
@nktkas/hyperliquid |
MIT | F3 keeper (server-only) + F2 SSR snapshot: Hyperliquid exchange + info client. Stage 2C chose Hyperliquid as the venue |
viem |
MIT | F3 keeper: viem/accounts for the Hyperliquid agent-wallet signer |
@solana/web3.js |
MIT | F4 buyback-and-burn signer flow (tx building, keypairs, RPC) |
@solana/spl-token |
Apache-2.0 | F4 SPL token burn instruction |
bs58 |
MIT | F4: decoding the buyback wallet's base58 secret key. Not evaluated in 2B (a small, single-purpose transitive dependency of @solana/web3.js promoted to a direct one in 2D rather than relied on implicitly) |
drizzle-orm / drizzle-kit (dev) |
Apache-2.0 / MIT | F3 cycle-state persistence, F5 round history, on Cloudflare D1 |
zod |
MIT | Env validation and external-response validation |
@opennextjs/cloudflare / wrangler (dev) |
MIT / Apache-2.0-or-MIT | Build and deploy to Cloudflare Workers; D1 binding; scheduled keeper handler |
@cloudflare/workers-types (dev) |
MIT | Type declarations only (D1Database, ExportedHandler, …), not bundled into the shipped app |
vitest (dev) |
MIT | Unit tests for F3's pure PnL/coin-selection logic |
Dropped in Stage 2C (evaluated in 2B, not installed): @pythnetwork/hermes-client (the venue supplies mark
price) and node-cron (Cloudflare Cron Triggers replace it). @vercel/og (F8, OPTIONAL) was not installed:
2D built only the CORE feature set (F1-F5); F8 stays unbuilt for a later pass.
Copyleft / special obligations
potrace (used only as a local dev-time vectorising tool in logo.mjs, not shipped in the product) is GPL-2.0.
Its traced SVG output is original artwork, not a derivative work of potrace itself, so no obligation attaches to
the shipped logo files. No GPL/AGPL code is bundled into the product. Otherwise none: all reused assets
(Geologica, Inter) are permissively licensed (SIL OFL 1.1), and the logo is original work.
@vercel/og (MPL-2.0, F8 share card, OPTIONAL) was the only copyleft item selected in Stage 2B; it was not
installed in this 2D pass since 2D built only the CORE feature set (F1-F5), F8 is OPTIONAL. If a later pass
builds F8: MPL-2.0 is file-level copyleft, only obliging releasing modifications to its own source files, and
it would be installed as an ordinary, unmodified npm dependency, so no obligation would attach to this product's
own source. jup-ag/jupiter-quote-api-node was evaluated for the F4 buy leg and REJECTed: its npm
package.json self-declares MIT but the GitHub repo has no LICENSE file, and it depends on the deprecated
@project-serum/anchor. Not depended on; the buy leg calls Jupiter's public REST API directly instead, see
the Decisions log for the verified-live endpoint correction (/ultra/v1/order + /ultra/v1/execute, not the
/swap/v2/order path ARCHITECTURE.md's 2C decision named).