Third-party notices

Production release inventories reproduce exact dependency licence texts under LICENSES/npm-runtime-licenses.txt.

@zip.js/zip.js 2.9.0 — BSD-3-Clause — bounded ZIP reading and EPUB rebuilding.
dompurify 3.4.14 — MPL-2.0 OR Apache-2.0 — active-content sanitization before sandboxed rendering.
Toolbox contract, shell, and test packages 0.3.0 — Apache-2.0.
@add-ideas/toolbox-helpers 0.2.0 — GPL-3.0-or-later — bounded decoding, filenames, and browser downloads.
React and React DOM 19.2.8 — MIT.

EPUB publications opened by a user are not bundled and retain their own copyright and licence terms.