onenote-tools/THIRD_PARTY_NOTICES.md

Third-party notices

The production application uses:

• @add-ideas/toolbox-contract 0.1.1, Apache-2.0;
• @add-ideas/toolbox-shell-react 0.1.1, Apache-2.0;
• React, React DOM, and Scheduler, MIT.

The release packager collects the complete installed runtime licence texts into LICENSES/THIRD-PARTY-LICENSES.txt.

The native TypeScript OneStore/MS-ONE parser follows selected structures and traversal from onenote.rs (MPL-2.0), pinned at 5138a39a3f4e72b840932f9872fecde52fa9da60. Adapted source files carry MPL provenance headers.

The browser-native CAB parser/checksum implementation is a translated and security-bounded adaptation of rust-cab (MIT), pinned at c5839f5fdfa4c4e7cc9b22f570c79c96af0560e2. The LZX decoder is a translated adaptation of lzxd 0.2.5 (MIT OR Apache-2.0), pinned at 4748e43594e3e30cff2ace3a6ad7a376c9816fdd; this project uses it under the MIT option. Adapted modules carry provenance headers and the licence texts are in LICENSES/rust-cab-MIT.txt and LICENSES/lzxd-MIT.txt.

The Base64-encoded onenote_desktop.one test fixture comes from Joplin at commit 28eb53bd9f0cd4ae0dec0c59a08037075a38302b and is distributed under AGPL-3.0-or-later. Its licence text is in LICENSES/AGPL-3.0.txt.

The Base64-encoded Joplin test.onepkg fixture is pinned at commit 1e73aad7eb08fde5d9e4cb533df40052a5cd32d7 and is likewise test-only data distributed under AGPL-3.0-or-later.

The encoded fixture bytes are excluded from dist and the release ZIP. The release retains the fixture provenance document and AGPL text so these notices remain complete.

The remaining npm packages are build and test tooling and are not shipped as runtime modules in the static application.