# Sekura JS Third-Party Notices

This file describes libraries and tools used to build, test, and run Sekura JS. It does not change the proprietary terms of the project or grant additional rights. Jupiter Soft does not claim ownership of user-created source files, data, or output artifacts solely because Sekura JS tools create, compile, generate, sign, process, or verify them. Examples include `.sasm`, `.sdef`, `.sobj`, `.smod`, and SJP files. Rights in those files depend on applicable agreements among their creators, users, customers, employers, and other rights holders. Pre-existing Jupiter Soft materials and third-party components remain subject to their own license terms.

## Libraries linked into executables

| Component | Verified version | Use and distribution | License and primary source |
| --- | --- | --- | --- |
| ZLIB | 1.3.2 (Homebrew on macOS and vcpkg on Windows x64); the macOS build uses the system `/usr/lib/libz.1.dylib` (reported by macOS as version 1.2.12) | Required for SJP containers. The Windows x64 package includes `z.dll`. | zlib license: <https://www.zlib.net/zlib_license.html> |
| libsodium | 1.0.22 (local Windows x64 build) | Required for Ed25519. The Windows x64 package includes `libsodium.dll`. | ISC: <https://github.com/jedisct1/libsodium/blob/master/LICENSE> |
| Boost Multiprecision | 1.91.0 (Windows x64 build) | Header-only `int128_t` provides portable overflow checks; Boost code is compiled into the Windows binaries. | Boost Software License 1.0: <https://www.boost.org/LICENSE_1_0.txt> |

The library sources are not stored in this repository; the build environment provides them separately. The Windows x64 distribution includes the listed DLLs, with license texts in `licenses/`.

## External executables

| Component | Verified version | Use and distribution | License and primary source |
| --- | --- | --- | --- |
| Z3 | 5.1.0 (previous local build); 4.16.0 (Windows x64) | Used to check SMT obligations. The Windows x64 package includes `z3.exe` and `libz3.dll`. | MIT: <https://github.com/Z3Prover/z3/blob/master/LICENSE.txt> |
| CVC5 | 1.4.0 (local build; `cln=no`, `glpk=no`) | Optional external tool for cross-checking with `--cross-check-cvc5`; its executable is not included in the repository. Check the dependencies and build options of other distributions; some configurations may include GPL components. | Modified BSD: <https://github.com/cvc5/cvc5/blob/main/COPYING> |

The versions in this table describe environments used for migration checks; they are not minimum or universal requirements. For each release, record the solver versions used to verify and build its artifacts.

## VS Code extension development and test dependencies

| Package | Locked version | Use and distribution | License and primary source |
| --- | --- | --- | --- |
| `vscode-textmate` | 9.3.2 | Grammar-test dependency in `sekura-sjs/package-lock.json`; `node_modules` is excluded from the VSIX. | MIT: <https://github.com/microsoft/vscode-textmate/blob/main/LICENSE.md> |
| `vscode-oniguruma` | 2.0.1 | Grammar-test dependency in `sekura-sjs/package-lock.json`; `node_modules` is excluded from the VSIX. | MIT and third-party notices: <https://github.com/microsoft/vscode-oniguruma/blob/main/LICENSE.txt> and <https://github.com/microsoft/vscode-oniguruma/blob/main/NOTICES.txt> |

## Project-authored code

`src-sjv/hash/blake3.cpp` was transferred unchanged from the baseline Sekura JS project. In the available history, `mr8sim/blake3.cpp` first appeared in commit `0132b2d1f02726220efc6b786b592e481c6a1bd6`, dated July 28, 2026. The project owner confirmed that Codex authored the implementation for that baseline project and that it was not copied from a third-party library. The available history shows this as the file's first appearance.

The implementation follows the published BLAKE3 algorithm. The official reference implementation was consulted afterward to compare algorithm constants and steps; no direct code copying was found. This provenance statement records the project owner's confirmation. The official BLAKE3 source is available under CC0-1.0 or Apache-2.0; those licenses are not attributed to this project implementation. See the [BLAKE3 project](https://github.com/BLAKE3-team/BLAKE3) and its [reference implementation](https://github.com/BLAKE3-team/BLAKE3/blob/master/reference_impl/reference_impl.rs).

## Proprietary terms

The root [`LICENSE`](LICENSE) contains the proprietary terms provided by the owner and names Jupiter Soft as the rights holder. `sekura-sjs/LICENSE` contains the same terms so they are available in the extension package. This file describes components and tools used in the verified local builds; review the exact components and licenses again for each release distribution.