# Runtime licence inventory

`npm run release:prepare` generates `npm-runtime-licenses.txt` from the exact
runtime packages in `package-lock.json`. The generated inventory is included in
the static build and release ZIP together with the project licence and
third-party notices.

The reviewed Silurus OOXML licence and its bundled-code/data notices are also
kept as stable files because the npm package contains Rust/WebAssembly and data
whose complete provenance is broader than its top-level MIT licence.

Review dependency licence changes whenever the lockfile changes. Generation is
an inventory aid, not a substitute for legal review.