# Third-party notices

MIRAnnot Platform is licensed as a whole under `AGPL-3.0-or-later`. This file
records third-party material that needs an additional, prominent notice. It
does not replace the exact dependency locks or the release SBOM.

## openDAW

MIRAnnot includes and adapts openDAW, copyright © 2025 André Michelle;
individual contributors retain copyright in their contributions. The upstream
project offers openDAW under AGPL v3 (or later) or a separately negotiated
commercial license. MIRAnnot deliberately elects the
**AGPL-3.0-or-later** option for its internal, source-available deployment; it
does not claim a commercial-license grant.

Upstream source and notices:

- <https://github.com/andremichelle/openDAW>
- <https://github.com/andremichelle/openDAW/blob/main/README.md#dual-licensing-model>
- <https://github.com/andremichelle/openDAW/blob/main/packages/studio/sdk/README.md>

The pinned direct openDAW packages used by the Web application are:

| Package | Version |
| --- | ---: |
| `@opendaw/studio-sdk` | `0.0.167` |
| `@opendaw/studio-core` | `0.2.1` |
| `@opendaw/studio-adapters` | `0.2.1` |
| `@opendaw/studio-boxes` | `0.0.105` |
| `@opendaw/studio-core-wasm` | `0.0.12` |
| `@opendaw/lib-dom` | `0.0.87` |
| `@opendaw/lib-dsp` | `0.0.90` |
| `@opendaw/lib-std` | `0.0.82` |

The published openDAW package metadata, including the SDK, currently says
`LGPL-3.0-or-later`, while the same-revision upstream repository and SDK README
state the AGPL/commercial dual-license terms. MIRAnnot does not rely on those
inconsistent package fields:
the project applies the upstream AGPL option to the openDAW integration and to
the combined Corresponding Source it offers to application users.

The synced WASM device table contains the upstream Compressor and Neural Amp
artifacts even though the current MIRAnnot transport does not instantiate
those devices. Upstream identifies the CTAGDRC/LookAhead-derived Compressor
code (Phillip Lamp, 2020; Daniel Rudrich, 2019) as GPL v3.0 and Tone3000
models/services as separately governed material. The GPL text is retained in
[`LICENSES/GPL-3.0-only.txt`](LICENSES/GPL-3.0-only.txt). MIRAnnot's AGPL path
preserves those notices; using the Tone3000 service or third-party models would
require a separate terms and model-license review.

## Signalsmith Stretch

The synced openDAW WASM assets include Signalsmith Stretch.

Copyright © 2022 Geraint Luff / Signalsmith Audio Ltd.

Signalsmith Stretch is distributed under the MIT License. Its complete notice
and permission text is retained in
[`LICENSES/MIT-signalsmith-stretch.txt`](LICENSES/MIT-signalsmith-stretch.txt).

## Web application framework and waveform UI

The browser application directly ships the following additional packages:

| Package | Version | License | Preserved text |
| --- | ---: | --- | --- |
| `next` | `16.2.10` | MIT | [`LICENSES/MIT-nextjs.txt`](LICENSES/MIT-nextjs.txt) |
| `react` | `19.2.7` | MIT | [`LICENSES/MIT-react.txt`](LICENSES/MIT-react.txt) |
| `react-dom` | `19.2.7` | MIT | [`LICENSES/MIT-react.txt`](LICENSES/MIT-react.txt) |
| `wavesurfer.js` | `7.12.11` | BSD-3-Clause | [`LICENSES/BSD-3-Clause-wavesurfer.txt`](LICENSES/BSD-3-Clause-wavesurfer.txt) |

Next.js is copyright © 2025 Vercel, Inc. React and ReactDOM are copyright
© Meta Platforms, Inc. and affiliates. wavesurfer.js is copyright © 2012-2023
katspaugh and contributors. Their grants and warranty disclaimers remain in
force independently of MIRAnnot's AGPL license.

## REAPER Toolkit (rtk)

The MIRAnnot REAPER client bundles REAPER Toolkit (rtk) `1.4.0`, copyright
© 2017-2023 Jason Tackaberry and contributors, under the Apache License 2.0.
The unmodified stable single-file distribution has SHA-256
`c8bd2b8c092a0f0639541f0e42832948755a68334b6aca3ddb1f77a27031fd84`.
Its notice and complete Apache license are included in every REAPER client
release as `RTK-NOTICE.txt` and `RTK-LICENSE.txt`.

Upstream source and documentation:

- <https://github.com/jtackaberry/rtk>
- <https://reapertoolkit.dev/>

## Other dependencies

MIRAnnot also uses Python, JavaScript, Lua, container, and operating-system
dependencies under their own licenses. Exact shipped versions and package-
native license evidence are recorded in the release CycloneDX SBOM and
repository-owned lock files. The Web build additionally publishes a
manifest-bound `npm-production-license-evidence.json` file containing the
exact production dependency closure, package-metadata hash, declared license,
and the unmodified bytes of every package-root LICENSE, COPYING, NOTICE, or
COPYRIGHT file supplied by those packages. Packages that publish only a
package-metadata declaration are identified explicitly instead of being
credited with a license text they did not ship. Python and npm evidence comes
from installed package metadata, Alpine evidence comes from its installed
package database, and Debian evidence is bound to each installed copyright
file. When a Debian copyright file has no machine-readable `License:` field,
the SBOM uses a
content-bound `LicenseRef-Debian-Copyright-*` value and retains the evidence
SHA-256 instead of inventing an SPDX conclusion. Release-record verification
fails closed if any runtime component lacks this evidence. Those dependencies
remain governed by their respective licenses; the MIRAnnot AGPL grant does not
replace their notices or terms.