# External build dependencies

Dependencies are fetched at build time, not duplicated here. package-lock.json
pins registry versions and integrity hashes. Runtime licenses are in ../licenses/.

- @lit-labs/ssr-dom-shim 1.6.0: https://www.npmjs.com/package/@lit-labs/ssr-dom-shim/v/1.6.0
- @lit/reactive-element 2.1.2: https://www.npmjs.com/package/@lit/reactive-element/v/2.1.2
- @met4citizen/talkinghead 1.7.0: https://www.npmjs.com/package/@met4citizen/talkinghead/v/1.7.0
- @types/trusted-types 2.0.7: https://www.npmjs.com/package/@types/trusted-types/v/2.0.7
- lit 3.3.3: https://www.npmjs.com/package/lit/v/3.3.3
- lit-element 4.2.2: https://www.npmjs.com/package/lit-element/v/4.2.2
- lit-html 3.3.3: https://www.npmjs.com/package/lit-html/v/3.3.3
- three 0.180.0: https://www.npmjs.com/package/three/v/0.180.0
- toastify-js 1.12.0: https://www.npmjs.com/package/toastify-js/v/1.12.0
- xstate 5.32.6: https://www.npmjs.com/package/xstate/v/5.32.6

HeadAudio's original editable modules are in modules/ in this pinned archive:
https://codeload.github.com/met4citizen/HeadAudio/zip/d3af5f9ff86ab6b2b1913d411a4e1922ec101953
SHA-256: 79d655b87a52f9b57b237739b7128e7f636036ed2547b2e471e9cd1a672403a9
prepare-inputs.mjs verifies that archive before restoring build inputs.

XState's original TypeScript and build inputs:
https://github.com/statelyai/xstate/tree/xstate%405.32.6/packages/core

Three.js, TalkingHead and Toastify include editable JavaScript in their pinned
npm distributions. Lit's npm source maps retain original TypeScript as
sourcesContent. These external sources can be inspected and modified after npm ci.
WordPress supplies @wordpress/abilities at runtime.