# Third-party notices

The production application uses:

- `@add-ideas/toolbox-contract` 0.1.1, Apache-2.0;
- `@add-ideas/toolbox-shell-react` 0.1.1, Apache-2.0;
- fflate 0.8.3, MIT;
- React, React DOM, and Scheduler, MIT.

The release packager collects the complete installed runtime licence texts into
`LICENSES/THIRD-PARTY-LICENSES.txt`.

The native TypeScript OneStore/MS-ONE parser follows selected structures and
traversal from `onenote.rs` (MPL-2.0), pinned at
`5138a39a3f4e72b840932f9872fecde52fa9da60`. Adapted source files carry MPL
provenance headers.

The browser-native CAB parser/checksum implementation is a translated and
security-bounded adaptation of `rust-cab` (MIT), pinned at
`c5839f5fdfa4c4e7cc9b22f570c79c96af0560e2`. The LZX decoder is a translated
adaptation of `lzxd` 0.2.5 (MIT OR Apache-2.0), pinned at
`4748e43594e3e30cff2ace3a6ad7a376c9816fdd`; this project uses it under the MIT
option. Adapted modules carry provenance headers and the licence texts are in
`LICENSES/rust-cab-MIT.txt` and `LICENSES/lzxd-MIT.txt`.

MSZIP raw DEFLATE decoding uses fflate 0.8.3 (MIT). Its complete installed
licence text is included in the generated runtime licence bundle.

The Base64-encoded `onenote_desktop.one` test fixture comes from Joplin at
commit `28eb53bd9f0cd4ae0dec0c59a08037075a38302b` and is distributed under
AGPL-3.0-or-later. Its licence text is in `LICENSES/AGPL-3.0.txt`.

The Base64-encoded Joplin `test.onepkg` fixture is pinned at commit
`1e73aad7eb08fde5d9e4cb533df40052a5cd32d7` and is likewise test-only data
distributed under AGPL-3.0-or-later.

The Base64-encoded Joplin `Simple notebook/Quick Notes.one` fixture is copied
from the pinned `onenote.rs` test corpus at revision
`5138a39a3f4e72b840932f9872fecde52fa9da60`. Its adjacent upstream notice
attributes the data to Joplin under AGPL-3.0-or-later; it is test-only and its
hash and provenance are recorded in `tests/fixtures/README.md`.

The encoded fixture bytes are excluded from `dist` and the release ZIP. The
release retains the fixture provenance document and AGPL text so these notices
remain complete.

The remaining npm packages are build and test tooling and are not shipped as
runtime modules in the static application.