# Third-Party Notices

AgntSpace is proprietary software (see [LICENSE](LICENSE)). It is built on a
foundation of permissively-licensed open-source software. This file
acknowledges those projects and notes their licenses.

We ship only dependencies whose licenses are compatible with proprietary
redistribution: MIT, Apache 2.0, BSD, ISC, MPL-2.0, LGPL. We deliberately
avoid AGPL/GPL dependencies because their copyleft terms would force
re-licensing of the AgntSpace wheel.

---

## Policy

- Every direct dependency in [`server/pyproject.toml`](server/pyproject.toml)
  and [`ui/package.json`](ui/package.json) carries a permissive license.
- New dependencies must be reviewed for license compatibility before being
  added. MIT is preferred for code imports per project policy.
- Full license texts for transitive dependencies are available via
  `pip show <pkg>` (Python) and `npm view <pkg> license` (Node). Auto-
  generated full-text bundling is on the pre-release checklist; see
  [tasks/todo.md](tasks/todo.md).

---

## Major Direct Dependencies — Frontend (`ui/`)

| Package                            | License | Use                              |
|------------------------------------|---------|----------------------------------|
| react, react-dom                   | MIT     | UI framework                     |
| react-router-dom                   | MIT     | Client-side routing              |
| zustand                            | MIT     | State management                 |
| react-i18next, i18next             | MIT     | Localisation                     |
| d3                                 | ISC     | Data viz primitives, force layout|
| sigma                              | MIT     | WebGL graph renderer             |
| graphology                         | MIT     | In-memory graph data structure   |
| graphology-layout                  | MIT     | Random/circular layouts          |
| graphology-layout-forceatlas2      | MIT     | ForceAtlas2 layout               |
| graphology-layout-noverlap         | MIT     | No-overlap post-pass             |
| graphology-types                   | MIT     | TypeScript types for graphology  |
| @dagrejs/dagre                     | MIT     | Hierarchical (DAG) layout        |
| react-markdown                     | MIT     | Markdown rendering               |
| remark-math, rehype-katex          | MIT     | LaTeX rendering                  |
| katex                              | MIT     | Math typesetting                 |
| lucide-react                       | ISC     | Icon set                         |
| @tiptap/*                          | MIT     | Rich-text editor                 |
| prism-react-renderer               | MIT     | Code-block syntax highlighting   |
| lowlight                           | MIT     | Syntax highlighting (TipTap)     |
| qrcode.react                       | ISC     | QR code rendering                |
| turndown                           | MIT     | HTML → Markdown conversion       |
| @tanstack/react-virtual            | MIT     | List virtualisation              |
| @vercel/analytics                  | MIT     | Web analytics (deploy-only)      |
| @clerk/react                       | MIT     | Auth (landing page only)         |
| @fontsource/*                      | OFL-1.1 | Self-hosted fonts                |
| vite                               | MIT     | Build tool                       |
| typescript                         | Apache-2.0 | Type system                   |
| vitest                             | MIT     | Test runner                      |
| puppeteer                          | Apache-2.0 | Dev: e2e browser automation   |
| @axe-core/puppeteer                | MPL-2.0 | Dev: a11y audits in CI           |
| lighthouse                         | Apache-2.0 | Dev: perf/quality audits      |
| chrome-launcher                    | Apache-2.0 | Dev: launches Chrome for audits |

## Major Direct Dependencies — Backend (`server/`)

| Package                  | License    | Use                                     |
|--------------------------|------------|-----------------------------------------|
| fastapi                  | MIT        | Web framework                           |
| uvicorn                  | BSD-3      | ASGI server                             |
| pydantic                 | MIT        | Data validation                         |
| aiosqlite                | MIT        | Async SQLite driver                     |
| litellm                  | MIT        | LLM provider abstraction (100+ models)  |
| anthropic                | MIT        | Anthropic SDK (via LiteLLM)             |
| openai                   | Apache-2.0 | OpenAI SDK (via LiteLLM)                |
| ollama                   | MIT        | Local LLM (Ollama) client               |
| python-frontmatter       | MIT        | YAML frontmatter parsing                |
| markdown-it-py           | MIT        | Markdown parsing                        |
| pyyaml                   | MIT        | YAML serialisation                      |
| httpx                    | BSD-3      | Async HTTP client                       |
| cryptography             | Apache-2.0 / BSD | Fernet AES encryption (creds)     |
| pdfplumber               | MIT        | PDF text extraction                     |
| pillow                   | MIT-CMU    | Image handling                          |
| pytesseract              | Apache-2.0 | OCR bridge (optional)                   |
| python-docx              | MIT        | DOCX extraction (optional)              |
| python-pptx              | MIT        | PowerPoint extraction (optional)        |
| markitdown               | MIT        | EPUB → markdown extraction (optional)   |
| faster-whisper           | MIT        | Local speech-to-text (optional)         |
| openai-whisper           | MIT        | Speech-to-text fallback (optional)      |
| piper-tts                | MIT        | Local TTS — primary (optional)          |
| pyttsx3                  | MPL-2.0    | OS-native TTS fallback (optional)       |
| moviepy                  | MIT        | Video composition (optional)            |
| playwright               | Apache-2.0 | Browser automation (video, scraping)    |
| dagre                    | n/a        | (frontend only, see ui table)            |

## License Compatibility Notes

- **No AGPL/GPL deps** (2026-04-28 cleanup, version 1.41.0). The earlier
  practice of including `ebooklib` (AGPL-3.0), `edge-tts` (GPL-3.0), and
  `mutagen` (GPL-2.0+) behind optional extras was reconsidered: under the
  FSF interpretation (and most cautious legal counsel), proprietary code
  that imports AGPL code creates a derivative work, and AGPL §13 then
  triggers source-disclosure on network use. We removed all three:
  - **`ebooklib` → `markitdown`** (Microsoft, MIT). EPUB body extraction
    flows through `markitdown.MarkItDown().convert(...)`; metadata is
    read directly from `content.opf` via stdlib `zipfile` + `lxml`.
  - **`edge-tts` → `piper-tts`** (MIT) primary + `pyttsx3` (MPL-2.0)
    fallback. Same `synthesize_scene` API; no caller change.
  - **`mutagen` → `ffprobe`** (system dep, ships with ffmpeg). MP3
    duration probed via subprocess; `0.0` on any failure (best-effort
    metadata, never breaks synthesis).
  CI guard at `tests/arch/test_no_copyleft_deps.py` AST-walks
  `pyproject.toml` and fails the build on any new AGPL/GPL dep.
- **`agntspace-plugin-api`** (separate package) is published under MIT
  intentionally, so community plugins can develop against it freely.
- **`agntspace`** (the wheel itself, this repo) is proprietary as of
  2026-04-23 — see [memory/project_public_private_split.md](memory/project_public_private_split.md)
  for the rationale and AGPL releases up to 1.29.1 that remain forkable.

---

## MarkItDown Attribution

This software incorporates Microsoft's MarkItDown library
(<https://github.com/microsoft/markitdown>), used for EPUB body
extraction in the `epub_markitdown` file-type extractor.

```
MIT License

Copyright (c) Microsoft Corporation.

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
```

---

## Reproducing License Texts

For the canonical list of all transitive dependencies and their license
texts, run:

```bash
# Frontend
cd ui && npx license-checker --json > licenses-ui.json

# Backend
cd server && pip install pip-licenses && pip-licenses --format=json > licenses-py.json
```

A pre-release task tracks bundling these into a generated
`THIRD_PARTY_LICENSES.md` file shipped with the wheel. See
[tasks/todo.md](tasks/todo.md) for status.

---

## Reporting Issues

If you believe a dependency is mislicensed in this file, or AgntSpace is
infringing on an open-source project's license terms, please open an issue
at the project's repository or email the maintainer directly. We aim to
respond within 7 days.

---

*Last updated: 2026-04-28 (license cleanup, two passes):*

*Pass 1 — copyleft removal (1.41.0): removed ebooklib AGPL-3.0,
edge-tts GPL-3.0, mutagen GPL-2.0+. Replaced with markitdown MIT,
piper-tts MIT, pyttsx3 MPL-2.0, ffprobe system dep. See "License
Compatibility Notes" above + CI guard at tests/arch/test_no_copyleft_deps.py.*

*Pass 2 — non-MIT pruning (1.42.0): removed `networkx` (BSD-3) — replaced
with in-house `agntspace.memory._graph_lite` (~300 LoC, MIT by being our
own code). Removed `PyPDF2` fallback (was BSD-3 dead code, never in
pyproject.toml — pdfplumber is the actual extractor). No functional
change in either case.*
