27 lines
2.3 KiB
Markdown
27 lines
2.3 KiB
Markdown
# Third-party notices
|
||
|
||
The release preparation step collates licence files for the exact locked runtime packages into `LICENSES/npm-runtime-licenses.txt` inside the static artifact.
|
||
|
||
## Direct runtime packages
|
||
|
||
| Package | Version | Licence | Role | Source |
|
||
| -------------------------------- | ------- | ---------- | ------------------------------- | ------------------------------------------- |
|
||
| `@add-ideas/toolbox-contract` | 0.2.3 | Apache-2.0 | manifest and context contract | https://git.add-ideas.de/lotobo/toolbox-sdk |
|
||
| `@add-ideas/toolbox-shell-react` | 0.2.3 | Apache-2.0 | shared shell, theme and actions | https://git.add-ideas.de/lotobo/toolbox-sdk |
|
||
| `@noble/hashes` | 2.3.0 | MIT | local Aegis scrypt derivation | https://github.com/paulmillr/noble-hashes |
|
||
| `jsqr` | 1.4.0 | Apache-2.0 | local QR image decoding | https://github.com/cozmo/jsQR |
|
||
| `react` | 19.2.6 | MIT | application UI | https://github.com/facebook/react |
|
||
| `react-dom` | 19.2.6 | MIT | browser rendering | https://github.com/facebook/react |
|
||
|
||
`scheduler`, distributed by the React project under MIT, is the only transitive runtime package. Exact licence texts, including jsQR's Apache-2.0 and noble-hashes' MIT terms, are collated from the locked install into the release.
|
||
|
||
## QR construction
|
||
|
||
`src/qr/encoder.ts` is a bounded TypeScript rewrite following the QRCode for JavaScript construction algorithm by Kazuhiko Arase (copyright 2009), used under the MIT License. The licence text is in `LICENSES/QRCode-MIT.txt`. The rewrite supports byte mode, error correction M, versions 1–10, and contains no upstream branding or UI.
|
||
|
||
## Standards material
|
||
|
||
RFC interoperability values are facts used as tests. The OCRA implementation is project-authored from RFC 6287; its Java reference implementation is not shipped. W3C WebAuthn, IETF CBOR/COSE and OTP specifications are implementation references, not bundled runtime software.
|
||
|
||
Development-only packages listed in `package-lock.json` build and test the source but are not shipped as runtime modules.
|