Third-party components

External checkouts are downloaded by setup into ignored .tools/vendor/ and the configured SDK directory. Their original licenses continue to apply; they are not relicensed by the application.

Component	Pinned version / revision	License and upstream
ESP-IDF	5.5.3, 2c211b236707889e8400c4dc5644dd5c4ee071e0	Primarily Apache-2.0; component notices in Espressif's repository
esp-idf-hal	0.46.2	MIT OR Apache-2.0; HAL
esp-idf-sys	0.37.2	MIT OR Apache-2.0; SDK bindings
embuild	0.33.5	MIT OR Apache-2.0; ESP Rust build support
str0m	0.23.1	MIT option; local source and patch
sctp-proto	0.10.4	MIT OR Apache-2.0; local source and patch
str0m-rust-crypto	0.6.0	MIT option; local source and patch
dimpl	0.7.3	MIT OR Apache-2.0; algesten/dimpl
ESP-DSP	3c8ac0fdfec83740b783e200862c8d0c056de0ad	Apache-2.0; Espressif DSP library
esp_audio_codec	2.6.2, da256e5f462a8e010667d35314a5ba5cdc4a8d9a	Espressif Modified MIT; audio codec component
led_strip	3.0.3	Apache-2.0, resolved by the ESP-IDF component manager
esp-rs Rust compiler	1.97.0.0	Rust/LLVM licenses; esp-rs/rust-build
espup	0.17.1	MIT OR Apache-2.0; esp-rs/espup
clang-format	23.1.1	Apache-2.0; Python distribution of the LLVM formatter
serde / serde_json	Cargo.lock	MIT OR Apache-2.0; serde-rs
crc32fast	1.5.2	MIT OR Apache-2.0; srijs/rust-crc32fast

The web application uses React, Hono, Zod, Floating UI, Tailwind CSS, Vite, Prettier, and Cloudflare's Vite plugin (MIT), TypeScript (Apache-2.0), and Wrangler (MIT OR Apache-2.0). Their package metadata contains the original licenses. The self-hosted IBM Plex fonts come from Fontsource's Sans and Mono packages (SIL Open Font License 1.1). Vite bundles the font assets; copyright and license notices are distributed in worker/public/fonts/LICENSE.txt.

scripts/project.py pins external native sources and toolchains. firmware/dependencies.lock, firmware/Cargo.lock, and worker/package-lock.json record the managed component, Rust, and web dependency versions. The Cloudflare examples at cloudflare/realtime-examples informed the signaling/data-channel flows; the local reference checkout under .tools/references/ is not required for building this application.

Versioned experiments record their historical dependency set separately in archive/dependencies.json, archive/requirements.txt, and their firmware lockfiles. The Python host probes use aiortc (BSD-3-Clause), PyAV (BSD-3-Clause), NumPy (BSD-3-Clause), pyserial (BSD), and esptool (GPL-2.0-or-later); these tools are installed locally rather than copied into the source archive. The archived hardware experiments also use esp_peer 1.5.5 (Espressif Modified MIT, including a native transport binary) and esp_libsrtp 1.0.0 with its bundled license notices. The str0m probe preserves its own copy of the patched RustCrypto provider.

Music inputs and generated packs stay private. Test fixtures contain Opus silence, synthetic metadata, and spectrum bytes.