# Third-party notices

Generated from package-lock.json (SHA-256 2ab84ec39381963e81ffb2f64e2257718a0507747673b2c849dc2dd209a7416a).

Installed non-dev package-lock dependencies (conservative superset; Node CLI/types/optional packages are not necessarily shipped in browser chunks). Package metadata does not establish the licensing of every bundled asset. Retained license files, notices, source archives and SHA-256 checksums are under licenses/.

## HEIC source and licensing

HEIC release review remains required: the bundled JS identifies libheif 1.23.7 and libde265 1.0.16. Matching upstream native source archives and installed wrapper source are included. The exact native/Emscripten build flags, complete transitive codec inventory, and a successful reconstruction/relinking workflow have not been independently established. These notices are not a blanket legal compliance certification.

- [Upstream heic-to 1.6.7, repository snapshot](licenses/sources/heic-to-v1.6.7-upstream.tar.gz) — [upstream](https://codeload.github.com/hoppergee/heic-to/tar.gz/refs/tags/v1.6.7); SHA-256: 4ff1f10fda1ba04a68317fdc1577599d727926953727d45c808c98c5fbff10ad
- [Native libheif sources 1.23.7, version stated in bundled JS](licenses/sources/libheif-v1.23.7-upstream.tar.gz) — [upstream](https://codeload.github.com/strukturag/libheif/tar.gz/refs/tags/v1.23.7); SHA-256: 90e389caad285ca4946461d56d1c115e56bcbb5141d9038050282af91064fbc7
- [Native libde265 sources 1.0.16, version stated in bundled JS](licenses/sources/libde265-v1.0.16-upstream.tar.gz) — [upstream](https://codeload.github.com/strukturag/libde265/tar.gz/refs/tags/v1.0.16); SHA-256: ed12c931759c1575848832f70db5071a001ac813db4e4f568ee08aef6e234d4e
- [Installed npm JS source, prebuilt libheif JS and wrapper build script; not a replacement for the native C++ source](licenses/sources/heic-to-1.6.7-installed-source.zip); SHA-256: 140dbe112d1d78e43241bd12db8ca3f2d66c40f8d59e04752c639ab5438ceaa7

The application must permit users to modify/recombine the LGPL-covered parts and debug such modifications under the applicable license conditions. Do not publish the HEIC decoder until the release reviewer has verified how these conditions are met for the final bundle.

## Installed production dependency inventory

| Package | Version | Declared license | Retained notices |
| --- | --- | --- | --- |
| @jsquash/avif | 2.1.1 | Apache-2.0 | [1](licenses/packages/jsquash--avif@2.1.1/LICENSE) |
| @mixmark-io/domino | 2.2.0 | BSD-2-Clause | [1](licenses/packages/mixmark-io--domino@2.2.0/LICENSE) |
| @napi-rs/canvas | 1.0.13 | MIT | [1](licenses/packages/napi-rs--canvas@1.0.13/LICENSE) |
| @napi-rs/canvas-win32-x64-msvc | 1.0.13 | MIT | [1](licenses/packages/napi-rs--canvas-win32-x64-msvc@1.0.13/README.md) |
| @pdf-lib/fontkit | 1.1.1 | MIT | [1](licenses/packages/pdf-lib--fontkit@1.1.1/README.md) |
| @pdf-lib/standard-fonts | 1.0.0 | MIT | [1](licenses/packages/pdf-lib--standard-fonts@1.0.0/LICENSE.md) |
| @pdf-lib/upng | 1.0.1 | MIT | [1](licenses/packages/pdf-lib--upng@1.0.1/LICENSE) |
| @types/diff | 7.0.2 | MIT | [1](licenses/packages/types--diff@7.0.2/LICENSE) |
| @types/node | 26.6.6 | MIT | [1](licenses/packages/types--node@26.6.6/LICENSE) |
| @types/trusted-types | 2.0.7 | MIT | [1](licenses/packages/types--trusted-types@2.0.7/LICENSE) |
| ansi-regex | 5.0.1 | MIT | [1](licenses/packages/ansi-regex@5.0.1/license) |
| ansi-styles | 4.3.0 | MIT | [1](licenses/packages/ansi-styles@4.3.0/license) |
| argparse | 2.0.1 | Python-2.0 | [1](licenses/packages/argparse@2.0.1/LICENSE) |
| camelcase | 5.3.1 | MIT | [1](licenses/packages/camelcase@5.3.1/license) |
| cliui | 6.0.0 | ISC | [1](licenses/packages/cliui@6.0.0/LICENSE.txt) |
| color-convert | 2.0.1 | MIT | [1](licenses/packages/color-convert@2.0.1/LICENSE) |
| color-name | 1.1.4 | MIT | [1](licenses/packages/color-name@1.1.4/LICENSE) |
| commander | 2.20.3 | MIT | [1](licenses/packages/commander@2.20.3/LICENSE) |
| decamelize | 1.2.0 | MIT | [1](licenses/packages/decamelize@1.2.0/license) |
| diff | 9.0.0 | BSD-3-Clause | [1](licenses/packages/diff@9.0.0/LICENSE) |
| dijkstrajs | 1.0.3 | MIT | [1](licenses/packages/dijkstrajs@1.0.3/LICENSE.md) |
| discontinuous-range | 1.0.0 | MIT | [1](licenses/packages/discontinuous-range@1.0.0/LICENSE) |
| docx | 9.15.0 | MIT | [1](licenses/packages/docx@9.15.0/LICENSE) |
| dompurify | 3.4.17 | (MPL-2.0 OR Apache-2.0) | [1](licenses/packages/dompurify@3.4.17/LICENSE), [2](licenses/packages/dompurify@3.4.17/LICENSE-MPL), [3](licenses/packages/dompurify@3.4.17/src/license_header) |
| emoji-regex | 8.0.0 | MIT | [1](licenses/packages/emoji-regex@8.0.0/LICENSE-MIT.txt) |
| fflate | 0.8.3 | MIT | [1](licenses/packages/fflate@0.8.3/LICENSE) |
| find-up | 4.1.0 | MIT | [1](licenses/packages/find-up@4.1.0/license) |
| get-caller-file | 2.0.5 | ISC | [1](licenses/packages/get-caller-file@2.0.5/LICENSE.md) |
| heic-to | 1.6.7 | LGPL-3.0 | [1](licenses/packages/heic-to@1.6.7/LICENSE) |
| is-fullwidth-code-point | 3.0.0 | MIT | [1](licenses/packages/is-fullwidth-code-point@3.0.0/license) |
| locate-path | 5.0.0 | MIT | [1](licenses/packages/locate-path@5.0.0/license) |
| marked | 18.1.2 | MIT | [1](licenses/packages/marked@18.1.2/LICENSE) |
| moo | 0.5.3 | BSD-3-Clause | [1](licenses/packages/moo@0.5.3/LICENSE) |
| nanoid | 6.0.2 | MIT | [1](licenses/packages/nanoid@6.0.2/LICENSE) |
| nearley | 2.20.1 | MIT | [1](licenses/packages/nearley@2.20.1/LICENSE.txt) |
| p-limit | 2.3.0 | MIT | [1](licenses/packages/p-limit@2.3.0/license) |
| p-locate | 4.1.0 | MIT | [1](licenses/packages/p-locate@4.1.0/license) |
| p-try | 2.2.0 | MIT | [1](licenses/packages/p-try@2.2.0/license) |
| pako | 1.0.11 | (MIT AND Zlib) | [1](licenses/packages/pako@1.0.11/LICENSE) |
| papaparse | 5.7.0 | MIT | [1](licenses/packages/papaparse@5.7.0/LICENSE) |
| path-exists | 4.0.0 | MIT | [1](licenses/packages/path-exists@4.0.0/license) |
| pdf-lib | 1.17.1 | MIT | [1](licenses/packages/pdf-lib@1.17.1/LICENSE.md) |
| pdfjs-dist | 6.4.299 | Apache-2.0 | [1](licenses/packages/pdfjs-dist@6.4.299/cmaps/LICENSE), [2](licenses/packages/pdfjs-dist@6.4.299/iccs/LICENSE), [3](licenses/packages/pdfjs-dist@6.4.299/LICENSE), [4](licenses/packages/pdfjs-dist@6.4.299/standard_fonts/LICENSE_FOXIT), [5](licenses/packages/pdfjs-dist@6.4.299/standard_fonts/LICENSE_LIBERATION), [6](licenses/packages/pdfjs-dist@6.4.299/wasm/LICENSE_JBIG2), [7](licenses/packages/pdfjs-dist@6.4.299/wasm/LICENSE_OPENJPEG), [8](licenses/packages/pdfjs-dist@6.4.299/wasm/LICENSE_PDFJS_JBIG2), [9](licenses/packages/pdfjs-dist@6.4.299/wasm/LICENSE_PDFJS_OPENJPEG), [10](licenses/packages/pdfjs-dist@6.4.299/wasm/LICENSE_PDFJS_QCMS), [11](licenses/packages/pdfjs-dist@6.4.299/wasm/LICENSE_QCMS) |
| pngjs | 5.0.0 | MIT | [1](licenses/packages/pngjs@5.0.0/LICENSE) |
| qrcode | 1.5.4 | MIT | [1](licenses/packages/qrcode@1.5.4/license) |
| railroad-diagrams | 1.0.0 | CC0-1.0 | [1](licenses/packages/railroad-diagrams@1.0.0/README.md) |
| randexp | 0.4.6 | MIT | [1](licenses/packages/randexp@0.4.6/LICENSE) |
| require-directory | 2.1.1 | MIT | [1](licenses/packages/require-directory@2.1.1/LICENSE) |
| require-main-filename | 2.0.0 | ISC | [1](licenses/packages/require-main-filename@2.0.0/LICENSE.txt) |
| ret | 0.1.15 | MIT | [1](licenses/packages/ret@0.1.15/LICENSE) |
| set-blocking | 2.0.0 | ISC | [1](licenses/packages/set-blocking@2.0.0/LICENSE.txt) |
| sql-formatter | 15.9.0 | MIT | [1](licenses/packages/sql-formatter@15.9.0/LICENSE) |
| string-width | 4.2.3 | MIT | [1](licenses/packages/string-width@4.2.3/license) |
| strip-ansi | 6.0.1 | MIT | [1](licenses/packages/strip-ansi@6.0.1/license) |
| tslib | 1.14.1 | 0BSD | [1](licenses/packages/tslib@1.14.1/LICENSE.txt) |
| turndown | 7.2.4 | MIT | [1](licenses/packages/turndown@7.2.4/LICENSE) |
| turndown-plugin-gfm | 1.0.2 | MIT | [1](licenses/packages/turndown-plugin-gfm@1.0.2/LICENSE) |
| undici-types | 8.9.0 | MIT | [1](licenses/packages/undici-types@8.9.0/LICENSE) |
| wasm-feature-detect | 1.9.0 | Apache-2.0 | [1](licenses/packages/wasm-feature-detect@1.9.0/LICENSE) |
| which-module | 2.0.1 | ISC | [1](licenses/packages/which-module@2.0.1/LICENSE) |
| wrap-ansi | 6.2.0 | MIT | [1](licenses/packages/wrap-ansi@6.2.0/license) |
| y18n | 4.0.3 | ISC | [1](licenses/packages/y18n@4.0.3/LICENSE) |
| yaml | 2.9.1 | ISC | [1](licenses/packages/yaml@2.9.1/LICENSE) |
| yargs | 15.4.1 | MIT | [1](licenses/packages/yargs@15.4.1/LICENSE) |
| yargs-parser | 18.1.3 | ISC | [1](licenses/packages/yargs-parser@18.1.3/LICENSE.txt) |

No third-party code was modified by this script. It only copies notices and packages the installed HEIC wrapper source.