# Third-party notices

The production application uses:

- `@add-ideas/toolbox-contract` 0.2.0, Apache-2.0;
- `@add-ideas/toolbox-shell-react` 0.2.0, Apache-2.0;
- fflate 0.8.3, MIT;
- React, React DOM, and Scheduler, MIT.

The release packager collects the complete installed runtime licence texts into
`LICENSES/THIRD-PARTY-LICENSES.txt`.

The native TypeScript OneStore/MS-ONE parser follows selected structures and
traversal from `onenote.rs` (MPL-2.0), pinned at
`5138a39a3f4e72b840932f9872fecde52fa9da60`. Adapted source files carry MPL
provenance headers.

The browser-native CAB parser/checksum implementation is a translated and
security-bounded adaptation of `rust-cab` (MIT), pinned at
`c5839f5fdfa4c4e7cc9b22f570c79c96af0560e2`. The LZX decoder is a translated
adaptation of `lzxd` 0.2.5 (MIT OR Apache-2.0), pinned at
`4748e43594e3e30cff2ace3a6ad7a376c9816fdd`; this project uses it under the MIT
option. Adapted modules carry provenance headers and the licence texts are in
`LICENSES/rust-cab-MIT.txt` and `LICENSES/lzxd-MIT.txt`.

The browser-native Quantum decoder adapts compcol's MIT-licensed Quantum
modules, pinned at `04a6db2aa7bd487a89c559631d79d1b384139f50`. Its adapted
modules carry provenance headers and its licence is in
`LICENSES/compcol-MIT.txt`.

Multi-cabinet chain construction, split CFDATA handling, and spanning-file
semantics adapt libmspack's LGPL-2.1-only CAB decompressor, pinned at
`55d501976171397ccd5d5a7a1ca7da065b1d9a06`. The adapted module carries its
copyright/provenance header and the complete licence is in
`LICENSES/libmspack-LGPL-2.1.txt`.

`one2html` (MIT), pinned at
`59930ad309004030f812790c6749efe4265bb6bd`, was inspected as a behavioral
reference for rich-content rendering. No one2html source, template, stylesheet,
binary, or runtime dependency is shipped in this application.

MSZIP raw DEFLATE decoding uses fflate 0.8.3 (MIT). Its complete installed
licence text is included in the generated runtime licence bundle.

The Base64-encoded `onenote_desktop.one` test fixture comes from Joplin at
commit `28eb53bd9f0cd4ae0dec0c59a08037075a38302b` and is distributed under
AGPL-3.0-or-later. Its licence text is in `LICENSES/AGPL-3.0.txt`.

The Base64-encoded Joplin `test.onepkg` fixture is pinned at commit
`1e73aad7eb08fde5d9e4cb533df40052a5cd32d7` and is likewise test-only data
distributed under AGPL-3.0-or-later.

The Base64-encoded Joplin `Simple notebook/Quick Notes.one` fixture is copied
from the pinned `onenote.rs` test corpus at revision
`5138a39a3f4e72b840932f9872fecde52fa9da60`. Its adjacent upstream notice
attributes the data to Joplin under AGPL-3.0-or-later; it is test-only and its
hash and provenance are recorded in `tests/fixtures/README.md`.

The encoded fixture bytes are excluded from `dist` and the release ZIP. The
release retains the fixture provenance document and AGPL text so these notices
remain complete.

Vite and the remaining npm packages are build/test tooling rather than runtime
modules. Vite's optional modulepreload runtime polyfill is explicitly disabled
for this baseline-browser build.