Supply chain
Open dependencies. Proprietary product. Clear boundaries.
A reviewed core inventory of the libraries, datasets and hosted services behind Farleda. It is an orientation document, not a machine-generated complete SBOM or legal opinion.
Editorial review
Dependency overview · manifests checked 2026-10-12 · manifests and lockfiles remain authoritative for exact transitive versions
Position
Credit the infrastructure. Do not overstate the licence.
Farleda depends on open-source software, public data and hosted public infrastructure. Each layer has its own rights and usage conditions; one open dependency does not relicense the proprietary Farleda product.
The current root licence is proprietary and all-rights-reserved. Public factor and metric responses carry their own CC BY 4.0 envelope. For calculation sources and accounting limits, use the data inventory and methodology.
01
Farleda product licence
Open-source dependencies do not make Farleda itself open source. The repository root licence is the controlling product licence.
| Name | Licence / terms | Role and boundary |
|---|---|---|
| Farleda application, website and product assets | Proprietary · all rights reserved | Product code, schemas, design assets and accompanying material. Review access does not grant permission to copy, deploy or redistribute. |
| Public v1 JSON responses | CC BY 4.0 stated in response envelope | Farleda-produced mode, grid and aggregate-metric JSON. Third-party source rights and attribution still apply where embedded. |
| This public methodology | Publicly readable; no code licence granted | Versioned explanation of the current calculation chain and limits. |
02
Product surfaces and runtimes
| Name | Licence / terms | Role and boundary |
|---|---|---|
| Astro 7 | MIT | Official static marketing and documentation website. |
| Next.js 16 | MIT | Authenticated Farleda application and public application API. |
| React 19 | MIT | Application UI runtime; not the renderer for every Astro page. |
| Fastify 5 | MIT | Separate website signup, inquiry and application API. |
| Node.js 22+ | Node.js licence set | Runtime for the application and website API. Individual bundled components carry their own notices. |
| TypeScript | Apache-2.0 | Static type system; manifests use v5 in the app, v6 on the website and v7 in the website API. |
03
Data, validation, auth and mail
| Name | Licence / terms | Role and boundary |
|---|---|---|
| PostgreSQL 17 | PostgreSQL Licence | Primary database in the application and website API. |
| Drizzle ORM 0.45 | Apache-2.0 | Application SQL schema and query layer. |
| postgres 3 | Unlicense | Application PostgreSQL driver. |
| node-postgres 8 | MIT | Website API PostgreSQL driver. |
| Auth.js v5 beta | ISC | Passwordless application authentication. Beta status is declared because it affects upgrade risk. |
| Zod 4 | MIT | Input and payload validation in both server projects. |
| Pino 10 | MIT | Structured application logging. |
| Nodemailer 10 | MIT-0 | Transactional SMTP delivery for app login and website workflows. |
04
Application UI, maps and offline support
| Name | Licence / terms | Role and boundary |
|---|---|---|
| Tailwind CSS 4 | MIT | Application styling utilities. |
| Lucide React | ISC | Application icon components. |
| MapLibre GL JS 6 | BSD-3-Clause | Interactive trip-map renderer. |
| date-fns 4 | MIT | Date formatting and date calculations. |
| qrcode 1 | MIT | QR rendering for Trip Carbon Passport views. |
| Serwist 9 | MIT | Application service worker and offline shell. |
05
Build and quality tooling
| Name | Licence / terms | Role and boundary |
|---|---|---|
| pnpm 10 | MIT | Package manager and lockfile for the website and application. |
| ESLint 9 | MIT | Application static analysis. |
| Vitest 4 | MIT | Unit and integration tests. Test counts are intentionally not hard-coded on this page. |
| Playwright | Apache-2.0 | Browser-level application tests. |
| Remotion 4 | Remotion commercial/source-available terms | Development tooling for the rendered brand video; it does not run in the visitor's browser. |
Remotion is not described as FOSS. The applicable commercial threshold and licence must be checked against the organisation and team size before every production use; this page does not assert that a paid licence has been purchased.
06
Datasets and content sources
This table separates source-specific rights. “Open data” is not one universal licence; consult the linked source and the data inventory for the pinned product version.
| Name | Licence / terms | Role and boundary |
|---|---|---|
| UK DESNZ GHG factors 2026 | Open Government Licence v3.0 | Primary rounded transport factors; revised flat file updated 31 July 2026. |
| Ember electricity data | CC BY 4.0 for Ember datasets | Attribution source for the embedded annual country snapshot; accounting and version boundaries documented separately. |
| electricityMaps | Dataset/API terms vary; zones repository ODbL | Optional current and recent-history grid source. Provider terms and accounting methodology apply. |
| OpenStreetMap data | ODbL 1.0 | Roads, geocoding context, map attribution and points of interest. |
| OurAirports | Public domain | Airport coordinates and IATA codes; publisher gives no accuracy or fitness warranty. |
| Wikidata | CC0 for structured data | Structured destination context where queried. |
| Wikipedia and Wikivoyage | CC BY-SA; version and attribution depend on project | Destination context where used. Content licences are not simplified into one blanket database licence. |
07
Remote public and hosted services
A remote service can combine software, database and usage-policy terms. Calling a service does not mean Farleda redistributes its server binary, but returned data can still carry attribution or share-alike obligations.
| Name | Licence / terms | Role and boundary |
|---|---|---|
| Transitous / MOTIS | Service code and each source feed have separate licences | Public-transport routing. Feed licences and freshness must be read per source; no blanket CC BY claim. |
| OSRM | BSD-2-Clause software; OSM data ODbL | Road geometry from the configured driving profile; reused as a walking/cycling approximation, not dedicated pedestrian or cycle routing. |
| Nominatim | GPL-2.0+ software; OSM data ODbL; service policy | Geocoding. Public-instance usage policy is separate from the software licence. |
| Overpass API | AGPL software; OSM data ODbL; instance policy | POI and accommodation-candidate discovery. |
| Open-Meteo | CC BY 4.0 data; free API non-commercial; paid commercial plans | Weather and air-quality context. The current keyless implementation is not suitable for commercial launch without a paid customer endpoint or compliant self-hosting. |
08
Optional language-model providers
Provider terms, model licences, privacy location and availability are deployment decisions — not open-source properties of Farleda.
| Name | Licence / terms | Role and boundary |
|---|---|---|
| Groq-hosted Llama | Groq Services Agreement + applicable model terms | Optional narrative generation when configured; not used as the numeric source of distance or emissions. |
| Pollinations | Hosted-service terms; model may vary | Optional fallback narrative service. Public access does not itself mean open source or EU-only processing. |
What is public
Useful transparency without a false open-source claim.
- Versioned JSON: current mode, grid and aggregate-metric responses disclose schema version, licence envelope, units and source notes.
- Versioned methods: methodology v1.1 documents factors, algorithms and known limits in human-readable form.
- Attribution: upstream datasets and services are linked by name, with per-source licensing where a blanket label would be misleading.
- Enterprise evidence: a generated dependency SBOM, vulnerability scan and deployment-specific subprocessor list should be produced for the reviewed release rather than inferred from this page.
09
Short licence glossary
- MIT / ISC / BSD
- Permissive software licences with notice conditions; exact text controls.
- Apache-2.0
- Permissive software licence with explicit patent provisions and notice requirements.
- GPL / AGPL
- Copyleft software licences. Obligations depend on distribution, modification and, for AGPL, network interaction with modified programs; obtain legal advice for a deployment.
- ODbL 1.0
- Database licence used by OpenStreetMap. Attribution and share-alike rules can apply to databases and produced works.
- CC BY 4.0
- Content/data licence requiring attribution and other stated conditions. It is not a software licence.
- CC BY-SA
- Attribution plus share-alike for adapted material under the licence's conditions.
- OGL v3.0
- UK Open Government Licence used by the DESNZ conversion-factor publication.
- Public domain / CC0
- Broad reuse posture, but source accuracy, trademarks and third-party rights remain separate questions.
- Proprietary
- No reuse, deployment or redistribution right unless the rights holder grants one.
Need release-specific evidence?
Discuss which pinned manifests, test results and dependency evidence are available for the relevant release. A complete SBOM, independent audit and deployment-specific data-flow annex must be agreed separately.
security@farleda.euStoicera Group · statutory operator: Raphael Lugmayr & Sebastian Kern GesbR (§ 1175 ABGB) · Allerheiligen im Mühlkreis 7, 4320 Allerheiligen im Mühlkreis, Austria
