# Third-party notices

av-tools 0.2.1 is Copyright © 2026 Albrecht Degering and licensed
GPL-3.0-or-later; see the root `LICENSE`. This inventory describes third-party
inputs. It is informational, not legal advice, and does not replace their
terms. Files under `LICENSES/` reproduce available terms. A packaged ZIP also
receives licence files shipped by installed runtime npm packages under
`LICENSES/npm/`.

## Browser runtime

| Package                          | Version                    | Licence declared upstream | Project source                                | Role                                                    | Distribution                                              |
| -------------------------------- | -------------------------- | ------------------------- | --------------------------------------------- | ------------------------------------------------------- | --------------------------------------------------------- |
| `@add-ideas/toolbox-contract`    | 0.2.3                      | Apache-2.0                | `https://git.add-ideas.de/lotobo/toolbox-sdk` | typed manifest/context contract                         | shipped, bundled                                          |
| `@add-ideas/toolbox-shell-react` | 0.2.3                      | Apache-2.0                | `https://git.add-ideas.de/lotobo/toolbox-sdk` | shared Toolbox application shell                        | shipped, bundled                                          |
| `@ffmpeg/ffmpeg`                 | 0.12.15                    | MIT                       | `https://github.com/ffmpegwasm/ffmpeg.wasm`   | browser worker and high-level FFmpeg API                | shipped, bundled                                          |
| `@ffmpeg/util`                   | 0.12.2                     | MIT                       | `https://github.com/ffmpegwasm/ffmpeg.wasm`   | byte/blob helpers                                       | shipped, bundled                                          |
| `@ffmpeg/types`                  | 0.12.4                     | MIT                       | `https://github.com/ffmpegwasm/ffmpeg.wasm`   | transitive runtime API types                            | shipped as compiled/bundled references                    |
| reviewed FFmpeg WASM cores       | 0.12.10-reviewed-stack5m.1 | GPL-enabled combined work | `https://github.com/ffmpegwasm/ffmpeg.wasm`   | ST/MT FFmpeg JavaScript, WebAssembly and pthread worker | rebuilt from locked source and shipped as verified assets |
| `fflate`                         | 0.8.3                      | MIT                       | `https://github.com/101arrowz/fflate`         | in-browser ZIP creation                                 | shipped, bundled                                          |
| DejaVu Sans                      | 2.37                       | Bitstream Vera/Arev terms | `https://dejavu-fonts.github.io/`             | deterministic local contact-sheet labels                | shipped unmodified as reviewed TTF                        |
| `react`                          | 19.2.7                     | MIT                       | `https://github.com/facebook/react`           | user-interface runtime                                  | shipped, bundled                                          |
| `react-dom`                      | 19.2.7                     | MIT                       | `https://github.com/facebook/react`           | browser rendering                                       | shipped, bundled                                          |
| `scheduler`                      | 0.27.0                     | MIT                       | `https://github.com/facebook/react`           | transitive React scheduling runtime                     | shipped, bundled                                          |

The MIT text inspected in the ffmpeg.wasm source is
`LICENSES/ffmpeg.wasm-MIT.txt`. The reviewed cores enable GPL FFmpeg features
and statically link GPL components; `LICENSES/GPL-2.0-or-later.txt` reproduces
GPL version 2. These notices do not make the complete application “MIT-only.”

The reviewed DejaVu file is identified byte-for-byte in `SOURCE.md`; its full
embedded terms are in `LICENSES/DEJAVU_FONTS.txt`. No remote or system font is
used as a runtime fallback.

## Native components linked into the WebAssembly cores

The following list is derived from the `v12.15` ffmpeg.wasm Dockerfile, the
configuration embedded in the reviewed 0.12.10 WASM and the resolved histories
of its source repositories. Branch-based inputs are recorded below as exact
commits. The combined core is GPL-enabled. Individual projects retain their
own terms, notices, patent considerations and corresponding-source
requirements.

| Component | Upstream build ref                                  | Upstream term(s) to review                             | Source selected by the build              | Role                                               | Distribution               |
| --------- | --------------------------------------------------- | ------------------------------------------------------ | ----------------------------------------- | -------------------------------------------------- | -------------------------- |
| FFmpeg    | n5.1.4 (`4729204c17f756e186d622060088371d10b34f7e`) | LGPL-2.1-or-later; GPL features enabled for this build | `https://github.com/FFmpeg/FFmpeg`        | demuxing, decoding, filtering, encoding and muxing | shipped in both WASM cores |
| x264      | `33cac6b77d5b9259c552156013a817ab23119612`          | GPL-2.0-or-later/commercial alternatives               | `https://github.com/ffmpegwasm/x264`      | H.264 encoding                                     | shipped, statically linked |
| x265      | `2bb5520e9596f361bf0ed81b3b8da0d7fd999069`          | GPL-2.0-or-later/commercial alternatives               | `https://github.com/ffmpegwasm/x265`      | HEVC encoding                                      | shipped, statically linked |
| libvpx    | v1.13.1                                             | BSD-3-Clause                                           | `https://github.com/ffmpegwasm/libvpx`    | VP8/VP9 codecs                                     | shipped, statically linked |
| LAME      | `2badea1974ae36cb8312afe99cff1e6b3b5decee`          | LGPL-2.0-or-later                                      | `https://github.com/ffmpegwasm/lame`      | MP3 encoding                                       | shipped, statically linked |
| Ogg       | v1.3.4                                              | BSD-3-Clause                                           | `https://github.com/ffmpegwasm/Ogg`       | Ogg framing                                        | shipped, statically linked |
| Theora    | v1.1.1                                              | BSD-3-Clause                                           | `https://github.com/ffmpegwasm/theora`    | Theora codec                                       | shipped, statically linked |
| Opus      | v1.3.1                                              | BSD-3-Clause                                           | `https://github.com/ffmpegwasm/opus`      | Opus codec                                         | shipped, statically linked |
| Vorbis    | v1.3.3                                              | BSD-3-Clause                                           | `https://github.com/ffmpegwasm/vorbis`    | Vorbis codec                                       | shipped, statically linked |
| zlib      | v1.2.11                                             | Zlib                                                   | `https://github.com/ffmpegwasm/zlib`      | DEFLATE support                                    | shipped, statically linked |
| libwebp   | v1.3.2                                              | BSD-3-Clause                                           | `https://github.com/ffmpegwasm/libwebp`   | WebP codec/muxing                                  | shipped, statically linked |
| FreeType  | VER-2-10-4                                          | FTL or GPL-2.0-only                                    | `https://github.com/ffmpegwasm/freetype2` | font rendering                                     | shipped, statically linked |
| FriBidi   | v1.0.9                                              | LGPL-2.1-or-later                                      | `https://github.com/fribidi/fribidi`      | bidirectional text                                 | shipped, statically linked |
| HarfBuzz  | 5.2.0                                               | MIT                                                    | `https://github.com/harfbuzz/harfbuzz`    | text shaping                                       | shipped, statically linked |
| libass    | 0.15.0                                              | ISC                                                    | `https://github.com/libass/libass`        | ASS/SSA subtitle rendering                         | shipped, statically linked |
| zimg      | release-3.0.5                                       | WTFPL-2.0                                              | `https://github.com/sekrit-twc/zimg`      | image scaling/conversion                           | shipped, statically linked |

The publisher must make the reviewed Corresponding Source bundle and external
notices available with the core assets and assess applicable patent/licensing
constraints. Exact upstream legal files for these native components are
included under `LICENSES/native/` in both the source tree and production ZIP.
`SOURCE.md` records the immutable source identities and retrieval instructions.

## Development-only packages

These direct packages support building or testing and are not intentionally
shipped in the static ZIP:

| Package                       | Exact version | Licence    | Role                                  |
| ----------------------------- | ------------- | ---------- | ------------------------------------- |
| `@add-ideas/toolbox-testkit`  | 0.2.3         | Apache-2.0 | manifest and nested-path test helpers |
| `@eslint/js`                  | 10.0.1        | MIT        | lint rules                            |
| `@playwright/test`            | 1.61.1        | Apache-2.0 | browser tests                         |
| `@testing-library/jest-dom`   | 6.9.1         | MIT        | DOM assertions                        |
| `@testing-library/react`      | 16.3.2        | MIT        | component tests                       |
| `@testing-library/user-event` | 14.6.1        | MIT        | interaction tests                     |
| `@types/node`                 | 25.9.5        | MIT        | Node type declarations                |
| `@types/react`                | 19.2.17       | MIT        | React type declarations               |
| `@types/react-dom`            | 19.2.3        | MIT        | React DOM type declarations           |
| `@vitejs/plugin-react`        | 6.0.3         | MIT        | Vite React transform                  |
| `eslint`                      | 10.7.0        | MIT        | static analysis                       |
| `eslint-plugin-react-hooks`   | 7.1.1         | MIT        | hooks lint rules                      |
| `eslint-plugin-react-refresh` | 0.5.2         | MIT        | refresh lint rules                    |
| `globals`                     | 17.7.0        | MIT        | lint environment data                 |
| `jsdom`                       | 29.1.1        | MIT        | unit-test DOM                         |
| `prettier`                    | 3.9.5         | MIT        | formatting                            |
| `typescript`                  | 6.0.3         | Apache-2.0 | type checking                         |
| `typescript-eslint`           | 8.64.0        | MIT        | TypeScript lint support               |
| `vite`                        | 8.1.5         | MIT        | development and production bundling   |
| `vitest`                      | 4.1.10        | MIT        | unit/integration tests                |

Native FFmpeg 7.1.3 was development-only for fixture generation. It and its
host libraries are not an application runtime dependency and are not included
in the release ZIP. Generated fixture data is CC0-1.0 as described in
`tests/fixtures/README.md`.
