Open Source
Libraries
These packages run on the server. Each is used under the license shown. Copyright notices are preserved internally.
| Package | License | What it does |
|---|---|---|
| Express | MIT | HTTP layer — routing, middleware, static serving |
| Passport.js | MIT | OAuth authentication framework · Jared Hanson |
| passport-google-oauth20 | MIT | Google Sign-In · Jared Hanson |
| passport-microsoft | — | Microsoft Sign-In |
| passport-apple | MIT | Apple Sign In |
| express-session | MIT | Session management |
| session-file-store | Apache-2.0 | Persistent session store |
| memorystore | MIT | In-memory session store |
| helmet | MIT | HTTP security headers |
| express-rate-limit | MIT | Rate limiting on AI and sensitive endpoints |
| compression | MIT | Gzip response compression |
| cors | MIT | Cross-Origin Resource Sharing headers |
| dotenv | BSD-2-Clause | Environment variable loading · Scott Motte |
| openai | Apache-2.0 | AI API client |
| web-push | MPL-2.0 | Web Push notifications via VAPID · Marco Castelluccio |
| zod | MIT | Runtime schema validation · Colin McDonnell |
| @sentry/node | MIT | Production error tracking and performance monitoring |
| @aws-sdk/client-s3 | Apache-2.0 | Cloudflare R2 backup storage (S3-compatible) |
| nodemon | MIT | Dev server auto-reload · Remy Sharp |
| vitest | MIT | Test runner · Anthony Fu, Patak, the Vite team |
| supertest | MIT | HTTP integration testing |
Science
Algorithms
These ideas, published by researchers whose names deserve to be attached to them, run inside SigmaList every time a list is sorted or data is protected.
Dijkstra's Shortest Path
The algorithm that routes you through the store — finding the shortest path through a weighted graph of sections so your list follows the natural flow of the aisles.
Kendall τ & Kemeny Consensus
These three works shaped how we think about learning store layouts from real shopping trips — finding a consensus order from many observed sequences. The foundation of GeoSync.
AES & GCM
Your list data is encrypted at rest using industry-standard authenticated encryption. Daemen and Rijmen designed the cipher; NIST standardized both the algorithm and its authenticated mode.
PBKDF2
Encryption keys are derived using a password-based key derivation function designed to be computationally expensive — making brute-force attacks impractical.
SHA-2 (SHA-256)
Used for cryptographic hashing throughout the application.
Binary Min-Heap
The data structure powering the Dijkstra priority queue. Williams introduced the heap in this 1964 paper.
Foundations
Standards & Protocols
SigmaList runs on open standards representing years of careful committee work by people who made the web interoperable.
| Standard | Body | Our use |
|---|---|---|
| OAuth 2.0 — RFC 6749 | IETF · 2012 | Authentication via Google, Microsoft, Apple |
| OpenID Connect | OpenID Foundation · 2014 | Identity layer on top of OAuth |
| Server-Sent Events | W3C / WHATWG · Ian Hickson | Real-time push to collaborators |
| Web Push — RFC 8030 | IETF · 2016 | Push notifications |
| VAPID — RFC 8292 | IETF · 2017 | Push notification server identification |
| ES Modules | TC39 / ECMA · ES2015 | The entire client architecture — no bundler needed |
| Canvas 2D API | W3C | Float game physics canvas |
| Geolocation API | W3C | GeoSync nearby-store detection |
| Web App Manifest | W3C | PWA install support on Android and iOS |
| SameSite cookie — RFC 6265bis | IETF | Session cookie security across mobile browsers |
| Gzip / DEFLATE — RFC 1952 | P. Deutsch · IETF · 1996 | Response compression |
| CSRF protection | OWASP | Request forgery prevention |
Infrastructure
Services & Platforms
| Service | Provider | Role |
|---|---|---|
| Grok | xAI | AI backbone — store identification, aisle assignment, item generation, title suggestions |
| Claude | Anthropic | Co-builder — designed and implemented the majority of the codebase |
| Google Sign-In | OAuth provider | |
| Microsoft Sign-In | Microsoft | OAuth provider |
| Apple Sign In | Apple | OAuth provider |
| Cloudflare Turnstile | Cloudflare | Bot-resistant challenge on the landing page |
| Cloudflare R2 | Cloudflare | Encrypted backup storage |
| Sentry | Sentry | Production error tracking |
| Railway | Railway | Deployment platform |
| Overpass API | OpenStreetMap Foundation | Nearby store discovery for GeoSync |
| OpenStreetMap | OSM contributors · ODbL | Geographic data powering store discovery |
| Google Fonts | Font delivery CDN | |
| GitHub | Microsoft | Repository hosting |
The store data returned by GeoSync comes from OpenStreetMap — a free, editable map of the world built by volunteers, available under the Open Database License (ODbL). We are grateful to the tens of thousands of contributors who have mapped stores worldwide. Attribution per ODbL §4.3.
Design
Typography
| Typeface | Designer | License | Used in |
|---|---|---|---|
| DM Serif Display | Colophon Foundry for Google Fonts | SIL OFL 1.1 | Landing page headings |
| DM Sans | Colophon Foundry for Google Fonts | SIL OFL 1.1 | Landing page body |
Lineage
Standing on Shoulders
Some debts are not to a library or a paper but to a body of work that shaped how we approached problems.
Edsger W. Dijkstra — not only for the shortest path algorithm but for the broader conviction that programs are mathematical objects to be reasoned about carefully.
Fred Reichheld (Bain & Company) — the Net Promoter Score methodology (HBR, 2003), which underpins the NPS feedback system in the app.
Donald Knuth — The Art of Computer Programming and foundational analysis of heaps, sorting, and algorithm complexity.
Ryan Dahl — Node.js (2009), which made it possible to write the entire server in JavaScript and share logic across client and server.
TJ Holowaychuk — Express (2010), Passport (2011), and much of the Node.js middleware ecosystem the server is built on.
Tim Berners-Lee & the W3C — the web itself, and the philosophy that information should be universally accessible.
Brendan Eich — JavaScript (1995), the language the entire client runs in.
The open-source community at large — every Stack Overflow answer, every GitHub issue resolved, every blog post explaining a subtle browser behavior. Software is cumulative. We stand on what came before.