# Third-party dependencies and licensing

Direct PHP dependencies declared in `composer.json`:
- `laravel/framework` (MIT license; use the exact version resolved in the production Composer lockfile).
- `laravel/sanctum` (MIT license; inspect resolved package metadata before release).
- `google/auth` (BSD-3-Clause for the Google Auth PHP library; inspect current package metadata and transitive licenses).
- Development dependencies: PHPUnit (BSD-3-Clause) and Laravel Pint (MIT), version ranges declared in Composer.

Android dependencies declared in Gradle: AndroidX Activity, Compose Material 3/UI, Lifecycle, Navigation, DataStore, Security Crypto, Retrofit, Gson converter, Firebase Cloud Messaging/Firebase BoM. Each upstream has its own license and transitive notices. Add generated license/attribution notices and run `composer licenses`/Gradle dependency-license reporting against the exact resolved lockfiles before distribution. No external image assets are included; marketplace photos are user uploads and must have uploader authorization. No package lockfiles or generated third-party license report are present because dependency installation was not possible in the inspected sandbox.