MeowWa third-party notices and licence position

Status: release-candidate inventory; the complete bundled notice file is still a release gate

Compiled from the installed dependency tree and the Mac packaging script on 2026-08-18. MeowWa ships no licence or notice file to users today: scripts/build-macos-beta.sh never copies one into the .app bundle, and the web app served none until this page existed. That is the gap this document exists to close, and closing it fully needs one build change outside this document — copying the notice text into the packaged bundle.

MeowWa's own software is proprietary. The shipped Mac bundle asserts "Copyright © 2026 Haiming Ni. All rights reserved." in apps/desktop/Resources/Info.plist, which is the only place the operator is currently named — the privacy notice and terms still carry a blank operator identity, and counsel must reconcile the two before publication.

What MeowWa distributes

• The signed Mac app: MeowWa's own Swift code, plus one third-party binary framework in copies distributed outside the Mac App Store. Builds made with MEOWWA_APP_STORE_BUILD=1 contain no third-party framework at all.
• The web application served to the browser, built from the JavaScript dependency tree below. The Mac app is a WKWebView shell over that same application, so its notices apply to both.

Server-side images (API and workers) are run by MeowWa rather than handed to users. Their dependency licences still matter if an image is ever distributed, and the LGPL and MPL components noted below live there.

Mac app — bundled third-party component

Sparkle 2.9.2, from github.com/sparkle-project/Sparkle, embedded as Contents/Frameworks/Sparkle.framework and used for signed application updates. MIT-style licence. The copyright holders named in its licence file are Andy Matuschak; Elgato Systems GmbH; Kornel Lesiński; Mayur Pawashe; C.W. Betts; Petroules Corporation; and Big Nerd Ranch. That licence file also covers further components Sparkle vendors.

The licence requires the copyright and permission notice to accompany every copy of the software. The verbatim text sits at apps/desktop/.build/artifacts/sparkle/Sparkle/LICENSE after a build. Release gate: copy that text into the packaged app (for example Contents/Resources/NOTICES.txt) and into this page, and add a packaging check that fails when it is missing.

Web application — direct dependencies

• next 16.3.0-preview.8 — MIT
• react 19.2.7 — MIT
• react-dom 19.2.7 — MIT
• viem 2.55.2 — MIT
• @solana/kit 6.10.0 — MIT
• qrcode 1.5.4 — MIT
• lucide-react 0.468.0 — ISC
• @privy-io/react-auth 3.37.1 — Apache-2.0
• @solana-program/memo 0.11.2 — Apache-2.0
• @solana-program/system 0.12.2 — Apache-2.0
• @solana-program/token 0.14.0 — Apache-2.0

Transitive tree — what a generated notice file must resolve

The web application's production dependency tree resolves to 452 packages, almost all of them pulled in by the sign-in SDK. By declared licence: MIT 261, Apache-2.0 47, ISC 25, BSD-3-Clause 11, 0BSD 2, MPL-2.0 4, LGPL-3.0-or-later 1, CC-BY-4.0 1, three dual or combined grants, forty declaring only "SEE LICENSE IN LICENSE.md", and fifty-seven with no licence field in their manifest at all.

Four groups need a decision rather than a copy-paste.

• "SEE LICENSE IN LICENSE.md", forty packages, all WalletConnect and Reown. The declared licence is a pointer; each file has to be read and the actual terms recorded. These are the same parties the subprocessor register lists as contacted from the owner's browser, so disabling external-wallet sign-in in the SDK would shrink the notice work and the subprocessor list together.
• No licence field, fifty-seven packages, including React Native, Expo, the MetaMask SDK, x402, and platform-specific optional binaries. A missing field is not permission: each needs its repository licence checked, or the package excluded from the shipped bundle.
• MPL-2.0: @ethereumjs/tx, @ethereumjs/util, @ethereumjs/rlp, and webextension-polyfill. File-level copyleft, so distributing them obliges MeowWa to offer the source of those files.
• LGPL-3.0-or-later (@img/sharp-libvips) and CC-BY-4.0 (caniuse-lite). These reach the server image through Next's image optimization and build tooling, not the browser bundle and not the Mac app. They stay clear of the distribution obligation only while the container image is not distributed.

Release gate: the published notice file must be generated from what the release build actually bundles rather than from node_modules, and regenerated with every dependency change. The command npm ls --omit=dev --all -w @meowwa/web produces the tree these numbers came from; the shipped bundle is the subset the Next build traces.

What needs a lawyer

• Whether the MPL-2.0 source-offer obligation is triggered by serving a browser bundle, and how the offer should be worded.
• Whether the "SEE LICENSE IN LICENSE.md" and missing-field packages may be shipped at all.
• The MeowWa proprietary licence grant in the terms of use, and the operator identity that must match the bundle's copyright line.