# Third-party notices

Generated from package-lock.json (SHA-256 2ab84ec39381963e81ffb2f64e2257718a0507747673b2c849dc2dd209a7416a).

Installed non-dev package-lock dependencies (conservative superset; Node CLI/types/optional packages are not necessarily shipped in browser chunks). Package metadata does not establish the licensing of every bundled asset. Retained license files, notices, source archives and SHA-256 checksums are under licenses/. Each site build isolates its codec assets to the tool that uses them.

## HEIC source and licensing

The HEIC converter is confined to private-heic-jpg. Its heic-to 1.6.7 package declares LGPL-3.0; the bundled source identifies libheif 1.23.7 and libde265 1.0.16. The installed wrapper source, versioned upstream source archives, and applicable license texts are included below. The libheif archive contains its Emscripten build script and CI toolchain version. The exact compiled HEIC binary was not independently reproduced in this workspace; this notice is not a patent clearance or legal opinion.

- [Upstream heic-to 1.6.7, repository snapshot](licenses/sources/heic-to-v1.6.7-upstream.tar.gz) — [upstream](https://codeload.github.com/hoppergee/heic-to/tar.gz/refs/tags/v1.6.7); SHA-256: 4ff1f10fda1ba04a68317fdc1577599d727926953727d45c808c98c5fbff10ad
- [Native libheif sources 1.23.7, version stated in bundled JS](licenses/sources/libheif-v1.23.7-upstream.tar.gz) — [upstream](https://codeload.github.com/strukturag/libheif/tar.gz/refs/tags/v1.23.7); SHA-256: 90e389caad285ca4946461d56d1c115e56bcbb5141d9038050282af91064fbc7
- [Native libde265 sources 1.0.16, version stated in bundled JS](licenses/sources/libde265-v1.0.16-upstream.tar.gz) — [upstream](https://codeload.github.com/strukturag/libde265/tar.gz/refs/tags/v1.0.16); SHA-256: ed12c931759c1575848832f70db5071a001ac813db4e4f568ee08aef6e234d4e
- [Installed npm JS source, prebuilt libheif JS and wrapper build script; not a replacement for the native C++ source](licenses/sources/heic-to-1.6.7-installed-source.zip); SHA-256: f0af001740a9c71d10579be4c9536191ce73ec66abf7d3b268d72171b40594af

## AVIF decoder components

The AVIF fallback is confined to avif-jpeg-tool. @jsquash/avif 2.1.1 declares Apache-2.0 and bundles a decoder built from libavif 1.0.1 and libaom 3.7.0. The distributed WASM matches the pinned upstream package binary by SHA-256. Apache, BSD, AOM patent, Emscripten, musl, and LLVM runtime license texts are included below. The binary was not independently rebuilt in this workspace; this notice is not a patent clearance or legal opinion.

- [jSquash AVIF decoder source and pinned build recipe](https://github.com/jamsinclair/jSquash/tree/b7fa9ac9ec02f224847ad23d19d115f9e296a368/packages/avif)
- [libavif 1.0.1 source](https://github.com/AOMediaCodec/libavif/tree/v1.0.1)
- [libaom 3.7.0 source](https://aomedia.googlesource.com/aom/+archive/v3.7.0.tar.gz)

## Installed production dependency inventory

| Package | Version | Declared license | Retained notices |
| --- | --- | --- | --- |
| @jsquash/avif | 2.1.1 | Apache-2.0 | [1](licenses/packages/jsquash--avif@2.1.1/LICENSE) |
| @mixmark-io/domino | 2.2.0 | BSD-2-Clause | [1](licenses/packages/mixmark-io--domino@2.2.0/LICENSE) |
| @napi-rs/canvas | 1.0.13 | MIT | [1](licenses/packages/napi-rs--canvas@1.0.13/LICENSE) |
| @napi-rs/canvas-win32-x64-msvc | 1.0.13 | MIT | [1](licenses/packages/napi-rs--canvas-win32-x64-msvc@1.0.13/README.md) |
| @pdf-lib/fontkit | 1.1.1 | MIT | [1](licenses/packages/pdf-lib--fontkit@1.1.1/README.md) |
| @pdf-lib/standard-fonts | 1.0.0 | MIT | [1](licenses/packages/pdf-lib--standard-fonts@1.0.0/LICENSE.md) |
| @pdf-lib/upng | 1.0.1 | MIT | [1](licenses/packages/pdf-lib--upng@1.0.1/LICENSE) |
| @types/diff | 7.0.2 | MIT | [1](licenses/packages/types--diff@7.0.2/LICENSE) |
| @types/node | 26.6.6 | MIT | [1](licenses/packages/types--node@26.6.6/LICENSE) |
| @types/trusted-types | 2.0.7 | MIT | [1](licenses/packages/types--trusted-types@2.0.7/LICENSE) |
| ansi-regex | 5.0.1 | MIT | [1](licenses/packages/ansi-regex@5.0.1/license) |
| ansi-styles | 4.3.0 | MIT | [1](licenses/packages/ansi-styles@4.3.0/license) |
| argparse | 2.0.1 | Python-2.0 | [1](licenses/packages/argparse@2.0.1/LICENSE) |
| camelcase | 5.3.1 | MIT | [1](licenses/packages/camelcase@5.3.1/license) |
| cliui | 6.0.0 | ISC | [1](licenses/packages/cliui@6.0.0/LICENSE.txt) |
| color-convert | 2.0.1 | MIT | [1](licenses/packages/color-convert@2.0.1/LICENSE) |
| color-name | 1.1.4 | MIT | [1](licenses/packages/color-name@1.1.4/LICENSE) |
| commander | 2.20.3 | MIT | [1](licenses/packages/commander@2.20.3/LICENSE) |
| decamelize | 1.2.0 | MIT | [1](licenses/packages/decamelize@1.2.0/license) |
| diff | 9.0.0 | BSD-3-Clause | [1](licenses/packages/diff@9.0.0/LICENSE) |
| dijkstrajs | 1.0.3 | MIT | [1](licenses/packages/dijkstrajs@1.0.3/LICENSE.md) |
| discontinuous-range | 1.0.0 | MIT | [1](licenses/packages/discontinuous-range@1.0.0/LICENSE) |
| docx | 9.15.0 | MIT | [1](licenses/packages/docx@9.15.0/LICENSE) |
| dompurify | 3.4.17 | (MPL-2.0 OR Apache-2.0) | [1](licenses/packages/dompurify@3.4.17/LICENSE), [2](licenses/packages/dompurify@3.4.17/LICENSE-MPL), [3](licenses/packages/dompurify@3.4.17/src/license_header) |
| emoji-regex | 8.0.0 | MIT | [1](licenses/packages/emoji-regex@8.0.0/LICENSE-MIT.txt) |
| fflate | 0.8.3 | MIT | [1](licenses/packages/fflate@0.8.3/LICENSE) |
| find-up | 4.1.0 | MIT | [1](licenses/packages/find-up@4.1.0/license) |
| get-caller-file | 2.0.5 | ISC | [1](licenses/packages/get-caller-file@2.0.5/LICENSE.md) |
| heic-to | 1.6.7 | LGPL-3.0 | [1](licenses/packages/heic-to@1.6.7/LICENSE) |
| is-fullwidth-code-point | 3.0.0 | MIT | [1](licenses/packages/is-fullwidth-code-point@3.0.0/license) |
| locate-path | 5.0.0 | MIT | [1](licenses/packages/locate-path@5.0.0/license) |
| marked | 18.1.2 | MIT | [1](licenses/packages/marked@18.1.2/LICENSE) |
| moo | 0.5.3 | BSD-3-Clause | [1](licenses/packages/moo@0.5.3/LICENSE) |
| nanoid | 6.0.2 | MIT | [1](licenses/packages/nanoid@6.0.2/LICENSE) |
| nearley | 2.20.1 | MIT | [1](licenses/packages/nearley@2.20.1/LICENSE.txt) |
| p-limit | 2.3.0 | MIT | [1](licenses/packages/p-limit@2.3.0/license) |
| p-locate | 4.1.0 | MIT | [1](licenses/packages/p-locate@4.1.0/license) |
| p-try | 2.2.0 | MIT | [1](licenses/packages/p-try@2.2.0/license) |
| pako | 1.0.11 | (MIT AND Zlib) | [1](licenses/packages/pako@1.0.11/LICENSE) |
| papaparse | 5.7.0 | MIT | [1](licenses/packages/papaparse@5.7.0/LICENSE) |
| path-exists | 4.0.0 | MIT | [1](licenses/packages/path-exists@4.0.0/license) |
| pdf-lib | 1.17.1 | MIT | [1](licenses/packages/pdf-lib@1.17.1/LICENSE.md) |
| pdfjs-dist | 6.4.299 | Apache-2.0 | [1](licenses/packages/pdfjs-dist@6.4.299/cmaps/LICENSE), [2](licenses/packages/pdfjs-dist@6.4.299/iccs/LICENSE), [3](licenses/packages/pdfjs-dist@6.4.299/LICENSE), [4](licenses/packages/pdfjs-dist@6.4.299/standard_fonts/LICENSE_FOXIT), [5](licenses/packages/pdfjs-dist@6.4.299/standard_fonts/LICENSE_LIBERATION), [6](licenses/packages/pdfjs-dist@6.4.299/wasm/LICENSE_JBIG2), [7](licenses/packages/pdfjs-dist@6.4.299/wasm/LICENSE_OPENJPEG), [8](licenses/packages/pdfjs-dist@6.4.299/wasm/LICENSE_PDFJS_JBIG2), [9](licenses/packages/pdfjs-dist@6.4.299/wasm/LICENSE_PDFJS_OPENJPEG), [10](licenses/packages/pdfjs-dist@6.4.299/wasm/LICENSE_PDFJS_QCMS), [11](licenses/packages/pdfjs-dist@6.4.299/wasm/LICENSE_QCMS) |
| pngjs | 5.0.0 | MIT | [1](licenses/packages/pngjs@5.0.0/LICENSE) |
| qrcode | 1.5.4 | MIT | [1](licenses/packages/qrcode@1.5.4/license) |
| railroad-diagrams | 1.0.0 | CC0-1.0 | [1](licenses/packages/railroad-diagrams@1.0.0/README.md) |
| randexp | 0.4.6 | MIT | [1](licenses/packages/randexp@0.4.6/LICENSE) |
| require-directory | 2.1.1 | MIT | [1](licenses/packages/require-directory@2.1.1/LICENSE) |
| require-main-filename | 2.0.0 | ISC | [1](licenses/packages/require-main-filename@2.0.0/LICENSE.txt) |
| ret | 0.1.15 | MIT | [1](licenses/packages/ret@0.1.15/LICENSE) |
| set-blocking | 2.0.0 | ISC | [1](licenses/packages/set-blocking@2.0.0/LICENSE.txt) |
| sql-formatter | 15.9.0 | MIT | [1](licenses/packages/sql-formatter@15.9.0/LICENSE) |
| string-width | 4.2.3 | MIT | [1](licenses/packages/string-width@4.2.3/license) |
| strip-ansi | 6.0.1 | MIT | [1](licenses/packages/strip-ansi@6.0.1/license) |
| tslib | 1.14.1 | 0BSD | [1](licenses/packages/tslib@1.14.1/LICENSE.txt) |
| turndown | 7.2.4 | MIT | [1](licenses/packages/turndown@7.2.4/LICENSE) |
| turndown-plugin-gfm | 1.0.2 | MIT | [1](licenses/packages/turndown-plugin-gfm@1.0.2/LICENSE) |
| undici-types | 8.9.0 | MIT | [1](licenses/packages/undici-types@8.9.0/LICENSE) |
| wasm-feature-detect | 1.9.0 | Apache-2.0 | [1](licenses/packages/wasm-feature-detect@1.9.0/LICENSE) |
| which-module | 2.0.1 | ISC | [1](licenses/packages/which-module@2.0.1/LICENSE) |
| wrap-ansi | 6.2.0 | MIT | [1](licenses/packages/wrap-ansi@6.2.0/license) |
| y18n | 4.0.3 | ISC | [1](licenses/packages/y18n@4.0.3/LICENSE) |
| yaml | 2.9.1 | ISC | [1](licenses/packages/yaml@2.9.1/LICENSE) |
| yargs | 15.4.1 | MIT | [1](licenses/packages/yargs@15.4.1/LICENSE) |
| yargs-parser | 18.1.3 | ISC | [1](licenses/packages/yargs-parser@18.1.3/LICENSE.txt) |

## Additional native and runtime license texts

- [Emscripten-3.1.57-LICENSE.txt](licenses/texts/Emscripten-3.1.57-LICENSE.txt); SHA-256: 620a78084fc7ca97c0b5dea9abf891f3ffcadfdbf305276f099c9c4e12fc1d86
- [GPL-3.0.txt](licenses/texts/GPL-3.0.txt); SHA-256: 3972dc9744f6499f0f9b2dbf76696f2ae7ad8af9b23dde66d6af86c9dfb36986
- [jsquash-apache-2.0.txt](licenses/texts/jsquash-apache-2.0.txt); SHA-256: 8c3690b09c168f196446cf5904332023bbc15eb92b6a7cee470ac829e6a65d20
- [libaom-license.txt](licenses/texts/libaom-license.txt); SHA-256: 4764a286d8b2faeaf42f4418e7d7a28d58fc8fd4d00a3d0a7f44b0a4099de7f2
- [libaom-patents.txt](licenses/texts/libaom-patents.txt); SHA-256: 661fb8e504744e95587b556b94a58343448300606a41bea8c7a9b97125696e61
- [libavif-license.txt](licenses/texts/libavif-license.txt); SHA-256: 10952217a6d404de8bf8a997fbea9b88f682df1fe98cb9b9f467ade641525639
- [libde265-COPYING.txt](licenses/texts/libde265-COPYING.txt); SHA-256: 3eb1e9b853651f296a613ebaccee61ddff842eb814e6af3f4698a1ec8cebaacf
- [libheif-COPYING.txt](licenses/texts/libheif-COPYING.txt); SHA-256: 99ba6a65c3ceebaa639244a7a118aa93047db8e57747526bf119a4d1194be573
- [LLVM-libcxx-LICENSE.TXT](licenses/texts/LLVM-libcxx-LICENSE.TXT); SHA-256: 539dd7aed86e8a4f12cbdd0e6c50c189c7d74847e4fecc64ce2c6ee3a01da38b
- [musl-COPYRIGHT.txt](licenses/texts/musl-COPYRIGHT.txt); SHA-256: f9bc4423732350eb0b3f7ed7e91d530298476f8fec0c6c427a1c04ade22655af
- [wasm-feature-detect-apache-2.0.txt](licenses/texts/wasm-feature-detect-apache-2.0.txt); SHA-256: bcf29b4fd3ec2cb5f9d40a0866da446f6da62170d2ccedf4aeca9cf9406dd20c

No third-party code was modified by this script. The source snapshots, upstream links and notices document provenance; they do not certify that every binary can be reproduced byte-for-byte.