Third-Party Software Notices and Attribution
============================================

This file aggregates license notices for third-party software bundled with
the cnpg4vscode VS Code extension. It is populated as runtime dependencies
are added (constitution §Security: every shipped dep is listed). The
`scripts/audit-deps.mjs` script enforces a license allowlist on every CI
run; adding a new runtime dep to `package.json` MUST be accompanied by an
entry here, otherwise the audit gate fails.

Scope
-----
"Runtime dependency" means anything `pnpm` resolves under `dependencies`
in `package.json` and that consequently lands in `dist/extension.js` after
esbuild bundling (or is left as an external `require()` resolved against
the VSIX's `node_modules/`). Devtime-only packages (TypeScript, Vitest,
ESLint, esbuild, @vscode/test-electron, etc.) are excluded — they neither
ship in the VSIX nor run on the user's machine.

Top-level runtime dependencies
------------------------------

  - @kubernetes/client-node@0.21.0 — Apache-2.0
    https://github.com/kubernetes-client/javascript
    Purpose: discovers kubeconfig contexts, lists CNPG Cluster custom
    resources, lists Pods/Secrets, opens SPDY port-forward streams to
    cluster pods. The extension MUST NOT shell out to `kubectl`
    (constitution §II); this library is how it talks to the Kubernetes API.

  - pg@8.20.0 — MIT
    https://github.com/brianc/node-postgres
    Purpose: PostgreSQL client. Used over the local end of the port-forward
    tunnel with `ssl.ca` pinned to the CNPG-issued cluster CA. No raw
    credentials are persisted; the pool is in-memory per ActiveConnection
    and torn down on disconnect (FR-026, FR-031).

Transitive dependencies
-----------------------
Every transitive dep pulled into the bundle is also under the allowlist
in `scripts/audit-deps.mjs` (MIT / ISC / Apache-2.0 / BSD-* / 0BSD /
Unlicense / CC0-1.0 / CC-BY-4.0 / Python-2.0 / BlueOak-1.0.0). The
license-checker step of that script fails CI if any production-tree dep
ever introduces a license outside that set. Run it locally with:

    pnpm audit:deps

to see the current complete tree. We do not vendor the per-package LICENSE
text in this file because (a) the full set is large and changes on every
upgrade, (b) it is reproducible from the resolved lockfile, and (c) the
audit script is the load-bearing gate, not this attribution document.

VS Code-bundled extension dependencies (extensionDependencies)
--------------------------------------------------------------

  - bierner.markdown-mermaid
    Mermaid renderer for VS Code's built-in Markdown preview. Required so
    the ER diagram surface (US6) renders inline rather than showing raw
    Mermaid source. Installed automatically alongside cnpg4vscode by the
    Marketplace; VSIX/dev users see a one-time prompt on first ER open.
    Not bundled into our VSIX — VS Code resolves it independently.

Bundled webview dependencies
----------------------------
These packages are bundled INTO `dist/webviews/grid/bundle.js` by esbuild
at extension build time. They are listed as `devDependencies` in
`package.json` because the extension never `require()`s them at runtime
— esbuild inlines them — but the resulting bundle bytes ship inside the
VSIX and execute in the Grid Editor webview's CSP-locked iframe, so they
warrant attribution here. The `audit-deps.mjs` license-checker scans
only `--production` deps; this section is the manual companion for
bundled-but-devDependency packages.

  - react@18.3.1 — MIT
    https://reactjs.org/
    Purpose: UI framework for the Grid Editor webview (T136 + T153).

  - react-dom@18.3.1 — MIT
    https://reactjs.org/
    Purpose: React renderer for the browser DOM in the webview.

  - @glideapps/glide-data-grid@6.0.3 — MIT
    https://grid.glideapps.com
    Purpose: Canvas-rendered data grid. Handles ≥100k rows at 60fps;
    used by Hex and PostHog at production scale. See research §6 for
    the library-selection decision and bundle-weight rationale.

Bundled binaries / prebuilds
----------------------------
None at this time. If a future change introduces a native module with
prebuilt binaries (e.g. better-sqlite3, sharp), each prebuild MUST be
listed here under "Bundled binaries" with its individual license, and the
packaging step MUST emit `dist/THIRD_PARTY_NOTICES.txt` alongside the
VSIX so the per-platform attribution travels with the artifact.

Reporting an attribution gap
----------------------------
If a dependency is missing from this file, please file an issue at
https://github.com/irulast/cnpg4vscode/issues — the audit-deps gate is the
mechanical check, but it cannot catch a stale prose summary.
