# Third-party notices

Release preparation collates licence files for the exact locked runtime
packages into `LICENSES/npm-runtime-licenses.txt` inside the static artifact.

| Package                          | Version | Licence    | Role                                 | Source                                      |
| -------------------------------- | ------- | ---------- | ------------------------------------ | ------------------------------------------- |
| `@add-ideas/toolbox-contract`    | 0.2.3   | Apache-2.0 | manifest and context contract        | https://git.add-ideas.de/lotobo/toolbox-sdk |
| `@add-ideas/toolbox-shell-react` | 0.2.3   | Apache-2.0 | shared shell, theme and actions      | https://git.add-ideas.de/lotobo/toolbox-sdk |
| `colorjs.io`                     | 0.7.1   | MIT        | parsing, conversion and colour maths | https://github.com/color-js/color.js        |
| `react`                          | 19.2.8  | MIT        | application UI                       | https://github.com/facebook/react           |
| `react-dom`                      | 19.2.8  | MIT        | browser rendering                    | https://github.com/facebook/react           |

`scheduler` 0.27.0, distributed by the React project under MIT, is the only
transitive runtime package. Development-only packages build and test the
source but are not shipped as runtime modules.

The exact Color.js notice is retained at
`LICENSES/colorjs.io-MIT.txt`. Apache-2.0 and MIT texts from all installed
runtime packages are reproduced by the deterministic release-preparation step.

CSS Color, CSS Compositing and Blending, WCAG and the linked web utilities that
informed the product requirements are specification or research references
only. Their source code, artwork and documentation wording are not bundled or
copied into Colour Tools.