# Sekura JS Third-Party Notices

This file describes libraries and tools used to build, test, and run Sekura JS. It does not change the proprietary terms of the project or grant additional rights. User-created SJP files do not become the property of Sekura JS's rights holder merely because they were created with Sekura JS tools; their rights are governed by the relationship between their creator, user, and customer.

## Libraries linked into executables

| Component | Verified version | Use and distribution | License and primary source |
| --- | --- | --- | --- |
| ZLIB | 1.3.2 (Homebrew on macOS and vcpkg on Windows x64); the macOS build uses the system `/usr/lib/libz.1.dylib` (reported by macOS as version 1.2.12) | Required for SJP containers. The Windows x64 package includes `z.dll`. | zlib license: <https://www.zlib.net/zlib_license.html> |
| libsodium | 1.0.22 (local Windows x64 build) | Required for Ed25519. The Windows x64 package includes `libsodium.dll`. | ISC: <https://github.com/jedisct1/libsodium/blob/master/LICENSE> |
| Boost Multiprecision | 1.91.0 (Windows x64 build) | Header-only `int128_t` provides portable overflow checks; Boost code is compiled into the Windows binaries. | Boost Software License 1.0: <https://www.boost.org/LICENSE_1_0.txt> |

The library sources are not stored in this repository; the build environment provides them separately. The Windows x64 distribution includes the listed DLLs, with license texts in `licenses/`.

## External executables

| Component | Verified version | Use and distribution | License and primary source |
| --- | --- | --- | --- |
| Z3 | 5.1.0 (previous local build); 4.16.0 (Windows x64) | Used to check SMT obligations. The Windows x64 package includes `z3.exe` and `libz3.dll`. | MIT: <https://github.com/Z3Prover/z3/blob/master/LICENSE.txt> |
| CVC5 | 1.4.0 (local build; `cln=no`, `glpk=no`) | Optional external tool for cross-checking with `--cross-check-cvc5`; its executable is not included in the repository. Check the dependencies and build options of other distributions; some configurations may include GPL components. | Modified BSD: <https://github.com/cvc5/cvc5/blob/main/COPYING> |

The versions in this table describe environments used for migration checks; they are not minimum or universal requirements. For each release, record the solver versions used to verify and build its artifacts.

## VS Code extension development and test dependencies

| Package | Locked version | Use and distribution | License and primary source |
| --- | --- | --- | --- |
| `vscode-textmate` | 9.3.2 | Grammar-test dependency in `sekura-sjs/package-lock.json`; `node_modules` is excluded from the VSIX. | MIT: <https://github.com/microsoft/vscode-textmate/blob/main/LICENSE.md> |
| `vscode-oniguruma` | 2.0.1 | Grammar-test dependency in `sekura-sjs/package-lock.json`; `node_modules` is excluded from the VSIX. | MIT and third-party notices: <https://github.com/microsoft/vscode-oniguruma/blob/main/LICENSE.txt> and <https://github.com/microsoft/vscode-oniguruma/blob/main/NOTICES.txt> |

## Project-authored code

`src-sjv/hash/blake3.cpp` was transferred unchanged from the base project at `/Users/atak/Projects/Sekura/SekuraJS`, where `mr8sim/blake3.cpp` first appeared in commit `0132b2d1f02726220efc6b786b592e481c6a1bd6` on July 28, 2026. The project owner confirmed that Codex authored the implementation for the base project and that it was not copied from a third-party library. This is the earliest appearance of the file in the available history.

The code implements the published BLAKE3 algorithm. The official reference implementation was consulted later to check algorithm constants and steps; direct code copying was not found. This provenance statement is based on information provided by the project owner. The official BLAKE3 source is available under CC0-1.0 or Apache-2.0; those licenses are not attributed to this implementation. See the [official BLAKE3 project](https://github.com/BLAKE3-team/BLAKE3) and its [reference implementation](https://github.com/BLAKE3-team/BLAKE3/blob/master/reference_impl/reference_impl.rs).

## Proprietary terms

The root [`LICENSE`](LICENSE) contains the proprietary terms provided by the owner and names Jupiter Soft as the rights holder. `sekura-sjs/LICENSE` contains the same terms so they are available in the extension package. This file describes components and tools used in the verified local builds; review the exact components and licenses again for each release distribution.