Dependencies & Licenses

Pocket Gull is released under the MIT License. However, to deliver clinical-grade AI consults, real-time telemetry tracking, and interactive 3D visualizations, the application imports external libraries, some of which are licensed under the Apache License 2.0.

This document details our engineering approach to dependency management—aligned with Software Engineering at Google paradigms—and acts as our canonical registry for third-party compliance.

1. Considerations When Importing

Before any external software is added to the Pocket Gull codebase, we evaluate it against three core dimensions:

A. Compliance & Licensing

Because Apache 2.0-licensed software has stricter attribution rules than MIT, we must ensure we preserve copyright notices, log significant modifications, and include NOTICE files where applicable. The two licenses are permissive and compatible, meaning Apache 2.0 code can be bundled within our MIT-licensed software, provided attribution requirements are satisfied.

B. Security & HIPAA Safeguards

Any package processing user inputs or AI outputs must be audited. We utilize:

  • DOMPurifyCure53DOM-purify HTML sanitizer. Prevents Cross-Site Scripting (XSS) from malicious inputs or unstable LLM output fragments.GitHub Repository →Click to explore with AI to scrub raw HTML inputs and generated markdown strings prior to rendering.
  • Ephemeral payload mapping for AI client connectors (@google/genaiGoogleOfficial Google GenAI SDK. Ephemeral inference payloads, no retention for standard API keys.GitHub →Click to explore with AI and @google/adkGoogleAgent Development Kit. Coordinates agent communication and system instructions.ADK Docs →Click to explore with AI), ensuring clinical data is processed transiently and not stored on third-party servers.

C. Maintenance & Dependency Overhead

We evaluate the maintainability, package size, and deprecation rates of dependencies. We avoid dependencies with overly bloated trees to minimize vulnerability surfaces.

2. Managing Compatibility Promises

To protect the codebase from downstream breaking changes and security vulnerabilities, we enforce several engineering safeguards:

  • Automated Scanning: Automated vulnerability trackers (such as Dependabot) are integrated into our CI/CD pipeline to flag vulnerable sub-packages.
  • Dependency Overrides: When transient dependencies contain security flaws, we override their versions explicitly in package.json resolutions (e.g., locking versions of esbuild, hono, and express-rate-limit).
  • Strict Typing Contracts: All external interactions are strongly typed. Missing types are supplemented with custom TypeScript declarations (.d.ts), preventing API drift from introducing silent runtime errors.

3. Canonical Registry & Attributions

To ensure legal compliance and absolute transparency, we maintain this registry of the primary dependencies that form the Pocket Gull multi-platform ecosystem.

A. Core Web Application (Angular)

Apache License 2.0 Dependencies

Dependency Author Purpose Attribution / Link
genkitGoogleGoogle's open-source framework for building, running, and debugging GenAI applications.Genkit Docs →Click to explore with AI Google LLC Multimodal agent flows and model orchestration Copyright 2024 Google LLC. Firebase Genkit
@google/adkGoogleGoogle Agent Development Kit. Powers the Live Assist chat routing engine.ADK Docs →Click to explore with AI Google LLC Live consult duplex audio streams Copyright Google LLC. ADK Docs
@google/genaiGoogleOfficial Google GenAI SDK. Ephemeral inference payloads, no retention for standard API keys.GitHub →Click to explore with AI Google LLC Standard client-side/server-side Gemini model calls Copyright Google LLC. Google GenAI
@opentelemetry/apiCNCFOpen-source observability framework for cloud-native software. Collects metrics, traces, and logs.opentelemetry.io →Click to explore with AI OpenTelemetry Authors Diagnostic tracing and performance metrics Copyright The OpenTelemetry Authors. OpenTelemetry
@aws-sdk/client-healthlakeAmazonAWS SDK for JavaScript. Handles interactions with AWS HealthLake and Bedrock.AWS SDK →Click to explore with AI Amazon.com, Inc. Connecting with AWS FHIR health databases Copyright Amazon.com, Inc. AWS JS SDK
dompurifyCure53Fast, portable HTML sanitizer for HTML5, SVG and MathML. Written by Mario Heiderich.GitHub →Click to explore with AI Mario Heiderich HTML sanitization for dynamic rendering safety Copyright 2015 Mario Heiderich. Cure53 DOMPurify
rxjsReactiveXReactive Extensions Library for JavaScript. Uses Observables to coordinate asynchronous streams.rxjs.dev →Click to explore with AI Google LLC / Contributors State streaming and pub-sub communications Copyright Google LLC. RxJS

Key MIT-Licensed Dependencies

  • Angular Framework (@angular/core, etc.) — Copyright (c) Google LLC. Main UI architecture.
  • Three.jsRicardo CabelloWebGL 3D Library used to render the interactive anatomical pain selection model.threejs.org →Click to explore with AI (three) — Copyright (c) Ricardo Cabello (mrdoob). Interactive 3D pain models.
  • Express.js (express) — Copyright (c) TJ Holowaychuk. Server and API proxy.
  • TailwindCSS (tailwindcss) — Copyright (c) Tailwind Labs. Responsive layouts.
  • Chart.js (chart.js) — Copyright (c) Chart.js Contributors. Telemetry and biometric charts.
  • Socket.io (socket.io) — Copyright (c) Guillermo Rauch. Bidirectional real-time websocket connections.

B. AI/ML & Clinical API Sidecar (Python & FastAPI)

Apache License 2.0 Dependencies

Dependency Author Purpose Attribution / Link
python-multipartMultipartStreaming multipart parser for Python FastAPI. Processes form-data uploads.GitHub →Click to explore with AI Andrew Halberstadt Multipart form-data parsing for document uploads Copyright Andrew Halberstadt. python-multipart

BSD-3-Clause & MIT-Licensed Dependencies

  • FastAPITiangoloModern, fast, high-performance web framework for building APIs with Python.FastAPI Docs →Click to explore with AI — MIT. Core high-performance sidecar web API.
  • PydanticPydanticData validation and settings management using Python type annotations.Pydantic Docs →Click to explore with AI — MIT. Strong typing validator.
  • Uvicorn (uvicorn[standard]) — BSD-3-Clause. Copyright Encode. High-performance ASGI server.
  • NumPy (numpy) — BSD-3-Clause. Copyright NumPy Developers. Scientific computing and matrix math.
  • Pandas (pandas) — BSD-3-Clause. Copyright PyData Team. Telemetry dataframe processing.
  • FHIR Resources (fhir.resources) — BSD-3-Clause. Copyright FHIR Resources Team. FHIR R4 schema models.
  • h5py (h5py) — BSD-3-Clause. Copyright Andrew Collette. HDF5 biological archive reader.
  • SciPy (scipy) — BSD-3-Clause. Copyright SciPy Developers. Signal processing algorithms.
  • Scikit-Learn (scikit-learn) — BSD-3-Clause. Copyright Scikit-learn developers. ML risk scoring.
  • HTTPX (httpx) — BSD-3-Clause. Copyright Encode. Async HTTP client for mock integration testing.

C. Mobile Suite & Companion Apps (Flutter & Dart)

Apache License 2.0 Dependencies

Dependency Author Purpose Attribution / Link
pdfKaelinPDF creation and layout library for Dart and Flutter.pub.dev →Click to explore with AI David Kaelin Clinical summary PDF document generation Copyright David Kaelin. pdf on pub.dev
printingKaelinFlutter plugin to print documents or display layout previews.pub.dev →Click to explore with AI David Kaelin OS-level printing and document preview interface Copyright David Kaelin. printing on pub.dev
mediapipe_genaiGoogleOn-device generative AI task coordination library by Google MediaPipe.pub.dev →Click to explore with AI Google LLC Local on-device Gemini Nano inference Copyright Google LLC. MediaPipe GenAI
hiveLeierLightweight and ultra-fast key-value database written in pure Dart.pub.dev →Click to explore with AI Simon Leier Lightweight, local NoSQL storage Copyright Simon Leier. hive on pub.dev

BSD-3-Clause & MIT-Licensed Dependencies

  • google_generative_aiGoogleOfficial Dart SDK for the Gemini API.pub.dev →Click to explore with AI — BSD-3-Clause. Official Dart SDK for cloud Gemini.
  • Firebase Core & Messaging (firebase_core, firebase_messaging) — BSD-3-Clause. Push notification channel.
  • Speech to Text (speech_to_text) — BSD-3-Clause. Translates patient voice to text.
  • Flutter Text-to-Speech (flutter_tts) — BSD-3-Clause. Synthesizes voice output for consults.
  • Flutter Bloc (flutter_bloc, bloc) — MIT. Business Logic Component architecture.
  • Equatable (equatable) — MIT. Value comparisons.
  • Shared Preferences (shared_preferences) — BSD-3-Clause. Local settings state cache.
  • Flutter 3D Controller (flutter_3d_controller) — MIT. 3D skeletal canvas engine.
  • DiTreDi (ditredi) — MIT. 3D object rendering.
  • WebView Flutter (webview_flutter, webview_flutter_web) — BSD-3-Clause. Embedded browser.
  • Path Provider (path_provider) — BSD-3-Clause. File location mapping.
  • Flutter Markdown (flutter_markdown) — BSD-3-Clause. Rich markdown rendering.
  • HTTP Client (http) — BSD-3-Clause. HTTP client gateway.
  • URL Launcher (url_launcher) — BSD-3-Clause. Deep linking.
  • Vector Math (vector_math) — BSD-3-Clause. Matrix and vector mathematics.
  • Flutter SVG (flutter_svg) — MIT. SVG rendering for companion dashboard assets.
  • Cupertino Icons (cupertino_icons) — MIT. iOS visual graphics.

Apache License 2.0 Compliance Notice: You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0. Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an “AS IS” BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations.