# thirdparty/

Vendored third-party libraries, per AGENTS.md §2. Every library is copied
in-tree (no git submodules) and carries three things:

- a verbatim upstream `LICENSE` file (never stubbed),
- an `UPSTREAM` file recording the source URL and pinned commit SHA,
- a row in the provenance table below.

## Provenance table

| name | version | license | SHA |
| --- | --- | --- | --- |
| lua | 5.4.9 | MIT | 312b9efaa1061c2c4cad08554dbc1351c3270eef (git tag `v5.4.9` on the lua/lua mirror; tarball sha256 `2335b6c582a52654f94612bf10d2f4672805d05329aa6568b1d8cd9e5c6fb8e6`) |
| munit | 0.2.0 | MIT | ad67a3a2ca6b0e106c9c8d515772359eadcefad6 (git tag `v0.2.0`) |