# Third-Party Notices

This file records libraries and tools used by Sekura JS for building, checking, and running the software. It does not modify the proprietary terms for Sekura JS or grant additional rights to its code. Jupiter Soft does not claim ownership of user-created source files, data, or output artifacts solely because Sekura JS tools create, compile, generate, sign, process, or verify them. Examples include `.sasm`, `.sdef`, `.sobj`, `.smod`, and SJP files. Rights in those files depend on applicable agreements among their creators, users, customers, employers, and other rights holders. Pre-existing Jupiter Soft materials and third-party components remain subject to their own license terms.

## Libraries linked to the executables

| Component | Version observed | Use and distribution | License and upstream source |
| --- | --- | --- | --- |
| ZLIB | Homebrew 1.3.2 was installed; the checked `sekura-sjv` binary links to the system `/usr/lib/libz.1.dylib` (macOS reports version 1.2.12). | Required for SJP containers and located through CMake `find_package(ZLIB)`. The checked binary uses the system library rather than the Homebrew copy. The target system may provide a different version. | [zlib license](https://www.zlib.net/zlib_license.html) |
| libsodium | 1.0.22 (local build). | Required for Ed25519 operations in `sekura-sjv`; dynamically linked as an external library. The target system may use a different version. | [ISC license](https://github.com/jedisct1/libsodium/blob/master/LICENSE) |

These libraries are not stored in the source repository. They are provided separately by the build environment. If a Sekura JS distribution includes or repackages their binaries, the release must retain the applicable notices and record the versions actually included.

## External command-line tools

| Component | Version observed | Use and distribution | License and upstream source |
| --- | --- | --- | --- |
| Z3 | 5.1.0 (local build). | Invoked through `PATH` to check SMT obligations; the executable is not included in the repository. | [MIT license](https://github.com/Z3Prover/z3/blob/master/LICENSE.txt) |
| CVC5 | 1.4.0 (local build; `cln=no`, `glpk=no`). | Optional external tool for the cross-check enabled with `--cross-check-cvc5`; the executable is not included in the repository. Other builds may have additional dependencies or build options; some configurations may include GPL components. | [Modified BSD license](https://github.com/cvc5/cvc5/blob/main/COPYING) |

The versions in this table describe the environment used to check the source transfer. They are not minimum or mandatory versions for all users. Release records should identify the solver versions used for release builds and verification.

## VS Code extension development and test dependencies

| Package | Locked version | Use and distribution | License and upstream notices |
| --- | --- | --- | --- |
| `vscode-textmate` | 9.3.2 | Grammar-test dependency recorded in `sekura-sjs/package-lock.json`; `node_modules` is excluded from the VSIX. | [MIT license](https://github.com/microsoft/vscode-textmate/blob/main/LICENSE.md) |
| `vscode-oniguruma` | 2.0.1 | Grammar-test dependency recorded in `sekura-sjs/package-lock.json`; `node_modules` is excluded from the VSIX. | [MIT license](https://github.com/microsoft/vscode-oniguruma/blob/main/LICENSE.txt) and [third-party notices](https://github.com/microsoft/vscode-oniguruma/blob/main/NOTICES.txt) |

## Project implementation provenance

`src-sjv/hash/blake3.cpp` was transferred unchanged from the baseline Sekura JS project. In the available history, `mr8sim/blake3.cpp` first appeared in commit `0132b2d1f02726220efc6b786b592e481c6a1bd6`, dated July 28, 2026. The project owner confirmed that Codex authored the implementation for that baseline project and that it was not copied from a third-party library. The available history shows this as the file's first appearance.

The implementation follows the published BLAKE3 algorithm. The official reference implementation was consulted afterward to compare algorithm constants and steps; no direct code copying was found. This provenance statement records the project owner's confirmation. The official BLAKE3 source is available under CC0-1.0 or Apache-2.0; those licenses are not attributed to this project implementation. See the [BLAKE3 project](https://github.com/BLAKE3-team/BLAKE3) and its [reference implementation](https://github.com/BLAKE3-team/BLAKE3/blob/master/reference_impl/reference_impl.rs).

## Sekura JS proprietary license

The root [`LICENSE`](LICENSE) contains the proprietary terms supplied by the project owner and identifies Jupiter Soft as the rights holder. `sekura-sjs/LICENSE` contains the same text so the terms are available with the extension package. This file records components and tools observed in the checked local build; before release, verify the components and licenses included in the specific release distribution.