# Third-party components

Exact versions and integrity hashes are recorded in package-lock.json.

| Component | Version | License | Source |
| --- | --- | --- | --- |
| Scramjet | 2.0.67-alpha.2, build c26bfc6 | AGPL-3.0-only | https://github.com/MercuryWorkshop/scramjet/tree/c26bfc6 |
| Scramjet controller | 0.0.14 | AGPL-3.0-only | https://github.com/MercuryWorkshop/scramjet |
| Bare transport | 1.0.0 | LGPL-3.0 | https://github.com/MercuryWorkshop/bare-transport |
| Wrangler and Workers test plugin | pinned in lockfile | MIT/Apache upstream licenses | https://github.com/cloudflare/workers-sdk |
| libcurl-transport (local experiment only) | 2.0.6 | AGPL-3.0-only | https://github.com/MercuryWorkshop/libcurl-transport |
| wisp-js (local experiment only) | 0.5.1 | LGPL-3.0-or-later | https://github.com/MercuryWorkshop/wisp-js |

The browser distributions in public/vendor are copied from the pinned npm
packages without modifying them. public/inject.js prepends a small diagnostic
listener to the unmodified controller injection bundle. That wrapper's source
is generated by scripts/prepare-assets.mjs.

Source for the Worker and launch page is provided under AGPL-3.0-only. See
https://www.gnu.org/licenses/agpl-3.0.html for the license text. Upstream
components retain their own copyright notices and licenses.

App brand icons: Simple Icons (https://simpleicons.org), CC0. Brand marks remain subject to their owners' trademark rules. Icon sprite sheets supplied by the user are preserved as provided.