# Third-party notices

The release preparation step collates licence files for the exact locked runtime packages into `LICENSES/npm-runtime-licenses.txt` inside the static artifact.

## Direct runtime packages

| Package                          | Version | Licence    | Role                            | Source                                      |
| -------------------------------- | ------- | ---------- | ------------------------------- | ------------------------------------------- |
| `@add-ideas/toolbox-contract`    | 0.2.3   | Apache-2.0 | manifest and context contract   | https://git.add-ideas.de/lotobo/toolbox-sdk |
| `@add-ideas/toolbox-shell-react` | 0.2.3   | Apache-2.0 | shared shell, theme and actions | https://git.add-ideas.de/lotobo/toolbox-sdk |
| `@noble/hashes`                  | 2.3.0   | MIT        | local Aegis scrypt derivation   | https://github.com/paulmillr/noble-hashes   |
| `jsqr`                           | 1.4.0   | Apache-2.0 | local QR image decoding         | https://github.com/cozmo/jsQR               |
| `react`                          | 19.2.6  | MIT        | application UI                  | https://github.com/facebook/react           |
| `react-dom`                      | 19.2.6  | MIT        | browser rendering               | https://github.com/facebook/react           |

`scheduler`, distributed by the React project under MIT, is the only transitive runtime package. Exact licence texts, including jsQR's Apache-2.0 and noble-hashes' MIT terms, are collated from the locked install into the release.

## QR construction

`src/qr/encoder.ts` is a bounded TypeScript rewrite following the QRCode for JavaScript construction algorithm by Kazuhiko Arase (copyright 2009), used under the MIT License. The licence text is in `LICENSES/QRCode-MIT.txt`. The rewrite supports byte mode, error correction M, versions 1–10, and contains no upstream branding or UI.

## Standards material

RFC interoperability values are facts used as tests. The OCRA implementation is project-authored from RFC 6287; its Java reference implementation is not shipped. W3C WebAuthn, IETF CBOR/COSE and OTP specifications are implementation references, not bundled runtime software.

Development-only packages listed in `package-lock.json` build and test the source but are not shipped as runtime modules.