# Third-party notices

Production release inventories reproduce exact dependency licence texts under `LICENSES/npm-runtime-licenses.txt`.

- `@zip.js/zip.js` 2.9.0 — BSD-3-Clause — bounded ZIP reading and EPUB rebuilding.
- `dompurify` 3.4.14 — MPL-2.0 OR Apache-2.0 — active-content sanitization before sandboxed rendering.
- Toolbox contract, shell, and test packages 0.2.3 — Apache-2.0.
- `@add-ideas/toolbox-helpers` 0.1.0 — GPL-3.0-or-later — bounded decoding, filenames, and browser downloads.
- React and React DOM 19.2.8 — MIT.

EPUB publications opened by a user are not bundled and retain their own copyright and licence terms.