Third-Party Code & Dependency Documentation

Application Dependencies

Package	Declared range	License metadata	Integration
@solidjs/meta	^0.29.4	MIT	Page metadata
@solidjs/router	^1.0.0	MIT	Routing
@solidjs/start	^2.0.0	Not recorded in checked lockfile/package metadata	Full-stack framework
@tailwindcss/vite	^4.3.3	MIT	Tailwind build plugin
@y/websocket-server	^0.1.0	MIT	Yjs server utilities; room ownership is in the standalone service
better-auth	^1.7.0	MIT	Sessions, GitHub/Google OAuth
codemirror	^6.0.2	MIT	Source/test editors
cors	^2.8.6	MIT	Declared; not the main SolidStart API routing layer
dotenv	^17.4.2	BSD-2-Clause	Server environment loading
express	^5.2.1	MIT	Declared; no separate main-app Express server in the inspected routes
marked	^18.1.0	MIT	Markdown content rendering
nitro	^3.0.260610-beta	MIT	Server/build runtime
pg	^8.23.0	MIT	PostgreSQL pools and SQL
solid-js	^1.9.14	MIT	Reactive UI and state
tailwindcss	^4.3.3	MIT	Utility styling
vite	^8.0.0	MIT	App development/build tooling
y-codemirror.next	^0.3.6	MIT	CodeMirror/Yjs binding and collaborative selections
y-protocols	^1.0.7	MIT	Awareness protocol
y-websocket	^3.1.0	MIT	Browser room transport
yjs	^13.6.33	MIT	CRDT text/maps

Development Dependencies

Package	Declared range	License metadata	Purpose
@eslint/js	^10.0.1	MIT	ESLint JavaScript rules
@solidjs/testing-library	^0.8.10	MIT	Component rendering/assertions
@types/cors	^2.8.19	MIT	CORS declarations
@types/express	^5.0.6	MIT	Express declarations
@types/node	^26.2.0	MIT	Node declarations; not the required Node runtime version
@types/pg	^8.23.1	MIT	PostgreSQL declarations
@vitest/coverage-v8	^5.0.0	MIT	V8 coverage provider
concurrently	^10.0.5	MIT	Vite and Yjs development processes
dotenv-cli	^11.0.0	MIT	Environment-loading command utility
eslint	^10.10.0	MIT	Lint engine
eslint-plugin-solid	^0.18.0	MIT	SolidJS lint rules
globals	^17.12.0	MIT	Linter environment definitions
jsdom	^29.1.1	MIT	DOM test environment
tsx	^4.23.12	MIT	TypeScript execution tooling
typescript-eslint	^8.70.0	MIT	TypeScript lint integration
vite-plugin-solid	^2.11.14	MIT	Solid transform in the test configuration
vitest	^5.0.0	MIT	Unit, component, repository, route tests

The root manifest does not directly declare typescript, @testing-library/jest-dom, or solid-devtools. Their earlier documented versions were not a reliable description of this branch. CodeMirror subpackages such as @codemirror/state and @codemirror/view are directly imported by code but supplied through the installed dependency graph rather than individually listed in the root manifest.

Standalone Yjs Service Dependencies

Package	Declared range	License metadata source	Purpose
ws	^8.18.0	MIT, Yjs lockfile	WebSocket server
y-protocols	^1.0.7	MIT, Yjs lockfile	Awareness/sync protocol
yjs	^13.6.33	MIT, Yjs lockfile	Room documents
lib0	^0.2.99	MIT, Yjs lockfile	Protocol utilities
@y/websocket-server	^0.1.0	MIT, root lockfile; absent from Yjs lockfile	Room setup and persistence hooks
pg	^8.23.0	MIT, root lockfile; absent from Yjs lockfile	Update log and replay
dotenv	^17.4.2	BSD-2-Clause, root lockfile; absent from Yjs lockfile	Environment loading

The Yjs lockfile is not synchronized with its manifest. Do not treat its older resolved package list as the complete runtime inventory. Dependency restoration or reproducibility fixes belong in the application repository, not this docs update.

External Services and Workflow Components

• GitHub and Google OAuth: configured through Better Auth. Provider service terms are distinct from the authentication library's license.
• Groq: HTTP chat-completions service called by api/ai/chat.ts. Requests include conversation messages and current editor content in the system prompt. API service terms and credential handling are not covered by an MIT package license.
• External file storage: invoked through FILE_SERVER_URL with an internal key. Its server source is not in the inspected application tree; do not infer its implementation or license solely from the client's HTTP contract.
• Node/Docker: node:24-alpine and node:24-slim base images and their operating-system packages have their own notices.
• Gitea Actions: .gitea/workflows/coverage.yml, deploy.yml, and deploy_local.yml use actions/checkout@v4, actions/setup-node@v4, and actions/upload-artifact@v3; the local deploy runner uses catthehacker/ubuntu:act-latest. Retain the upstream notices when distributing action or container components.
• Vercel CLI/service: used by the alternative deployment workflow; the workflow installs the CLI separately from application dependencies.

Documentation Site Dependencies

The separate documentation repository uses Docusaurus core/preset/module type packages 3.10.2, the Mermaid theme ^3.10.2, React/React DOM ^19.0.0, @mdx-js/react ^3.0.0, clsx ^2.0.0, Mermaid ^11.17.1, panzoom ^9.4.4, prism-react-renderer ^2.3.0, @types/react ^19.0.0, and TypeScript ~6.0.2. These ranges are documentation tooling, not application dependencies. Consult this repository's lockfile and package notices for its own licensing inventory.

Attribution Boundaries

The canvas editor, compiler, simulator, grader, puzzle authoring, and store modules are project source that integrate the libraries above. The checked tree does not establish the provenance of every algorithm or prove that all copied snippets have been attributed. Earlier blanket claims about legal compliance and a specific textbook-derived tape-padding algorithm have been removed.

Preserve copyright and license notices for redistributed dependencies, inspect transitive notices in production artifacts, and verify the SolidStart license from the upstream distribution before relying on this inventory for release compliance. This document records observed dependencies; it does not certify license compliance.