THIRD-PARTY NOTICES - Reflexor

This file identifies third-party components related to the Reflexor distribution.
It is an attribution and notice inventory, not a legal opinion.
LEGAL REVIEW REQUIRED BEFORE PUBLICATION. Compatibility conclusions are not asserted.

==============================================================================
1. LICENSE OF REFLEXOR (PROPRIETARY)
==============================================================================

Reflexor's own code and branding are proprietary.
See LICENSE.txt, TERMS.md, and PRIVACY.md.

Reflexor is free to use in this version, but is NOT open source.

==============================================================================
2. NPM RUNTIME DEPENDENCIES (EXTENSION HOST / WEBVIEW)
==============================================================================

The following packages may be present in the packaged extension runtime:

  code-chunk
    License: MIT
    https://www.npmjs.com/package/code-chunk

  dompurify
    License: MPL-2.0 OR Apache-2.0
    https://www.npmjs.com/package/dompurify
    NOTE: Dual-licensed. MPL-2.0 is a weak file-level copyleft license.
    Legal review should confirm the intended license election for distribution.

  highlight.js
    License: BSD-3-Clause
    https://www.npmjs.com/package/highlight.js

  marked
    License: MIT
    https://www.npmjs.com/package/marked

Transitive npm dependencies remain under their own licenses as declared by their publishers.
See package-lock.json in the private source tree for the full graph.

DevDependencies (TypeScript, ESLint, Prettier, vsce, test tooling, etc.) are
build-time only and are not intended to ship inside the Marketplace VSIX
except where the packaging tool necessarily includes tooling output.

==============================================================================
3. RUST BACKEND CRATES (BUNDLED BINARY)
==============================================================================

Each platform release binary under `extension/bin/` is built from the private
Reflexor backend crate and statically/dynamically links
third-party Rust crates, including (non-exhaustive):

  tokio           - MIT
  axum            - MIT
  serde / serde_json - MIT OR Apache-2.0
  reqwest         - MIT OR Apache-2.0
  anyhow          - MIT OR Apache-2.0
  tower / tower-http - MIT
  async-stream    - MIT OR Apache-2.0
  futures         - MIT OR Apache-2.0
  chrono          - MIT OR Apache-2.0
  tracing / tracing-subscriber - MIT
  once_cell       - MIT OR Apache-2.0
  rusqlite (+ bundled SQLite) - MIT
  r2d2 / r2d2_sqlite - MIT / MIT
  uuid            - MIT OR Apache-2.0
  url             - MIT OR Apache-2.0
  subtle          - BSD-3-Clause
  nu-ansi-term    - MIT
  async-trait     - MIT OR Apache-2.0

Exact crate versions and the complete graph are maintained in the private
backend Cargo.lock. No GPL/AGPL dependency is intentionally declared in the
backend Cargo.toml direct dependencies list; transitive audit remains required
before concluding copyleft exposure.

==============================================================================
4. OLLAMA
==============================================================================

Ollama is a separate product. Reflexor integrates with a locally installed
Ollama instance over localhost.

  Product: Ollama
  Site: https://ollama.com
  License / terms: governed by Ollama's own license and terms
  Distribution: NOT licensed or redistributed by Reflexor under LICENSE.txt

Optional embedded/managed Ollama download flows (when enabled by the user)
fetch Ollama from its official channels (for example GitHub releases) under
Ollama's terms, not under Reflexor's proprietary license.

==============================================================================
5. AI MODELS (INCLUDING RECOMMENDED MODELS)
==============================================================================

Models such as (examples used in product docs / recommendations):

  qwen2.5-coder:* (Alibaba / Qwen model family via Ollama)
  nomic-embed-text (Nomic embedding model via Ollama)
  other Ollama library models selected by the user

are NOT licensed by Reflexor. Each model remains under its own model license,
acceptable-use policy, and Ollama library terms. Users must review those terms
before downloading or using a model.

==============================================================================
6. EDITOR HOSTS
==============================================================================

  Visual Studio Code - Microsoft terms / licenses
  Cursor - Cursor terms / licenses

Reflexor is an extension hosted by those products and does not relicense them.

==============================================================================
7. ASSETS
==============================================================================

Product icon and brand assets under media/ are Reflexor proprietary assets
unless a specific third-party notice is listed here.

No third-party font packages are intentionally shipped as separate
redistributable font files in this alpha package beyond what transitive
web/runtime dependencies may embed under their own notices.

==============================================================================
8. COPYLEFT / WEAK-COPYLEFT WATCHLIST
==============================================================================

Items requiring explicit legal review before Marketplace publication:

  - dompurify (MPL-2.0 OR Apache-2.0 dual license) - confirm elected terms
  - Full transitive npm + Cargo license scan for strong copyleft (GPL/AGPL)
  - Any native backend binary redistribution for a target platform

This file does NOT conclude legal compatibility for proprietary distribution.

==============================================================================
9. CONTACT
==============================================================================

contato@reflexor.com.br
https://reflexor.com.br
