# DoAllHere third-party notices

This file is the public copy of the project's third-party release notice.
The package-lock file records exact resolved versions. No third-party source
was copied into this repository; libraries are used through their public APIs.

## Release license bundle

Keep the exact public files below with every artifact that redistributes the
matching runtime assets:

- [`/licenses/heic-to-LGPL-3.0.txt`](/licenses/heic-to-LGPL-3.0.txt)
- [`/licenses/GPL-3.0.txt`](/licenses/GPL-3.0.txt)
- [`/licenses/heic-to-README-v1.5.2.md`](/licenses/heic-to-README-v1.5.2.md)
- [`/licenses/heic-to-source-build-v1.5.2.md`](/licenses/heic-to-source-build-v1.5.2.md)
- [`/licenses/onnxruntime-MIT.txt`](/licenses/onnxruntime-MIT.txt)
- [`/licenses/onnxruntime-ThirdPartyNotices.txt`](/licenses/onnxruntime-ThirdPartyNotices.txt)
- [`/licenses/SIL-OFL-1.1-DM-Sans.txt`](/licenses/SIL-OFL-1.1-DM-Sans.txt)
- [`/licenses/SIL-OFL-1.1-Plus-Jakarta-Sans.txt`](/licenses/SIL-OFL-1.1-Plus-Jakarta-Sans.txt)
- [`/licenses/SIL-OFL-1.1-JetBrains-Mono.txt`](/licenses/SIL-OFL-1.1-JetBrains-Mono.txt)

The ONNX files are pinned to commit
`b7804b056c30aa35c1748f8e4e239d0e2ff25d6d`. The HEIC source/build record pins
the wrapper to `v1.5.2`, libheif to `v1.22.2`, and libde265 to `v1.0.16`.
These notices document obligations, not legal advice. LGPL-covered HEIC
distributions still need corresponding source and a practical relinking path.

## Runtime libraries

- `@huggingface/transformers` 4.2.0, Apache-2.0:
  https://github.com/huggingface/transformers.js/blob/main/LICENSE
- `onnxruntime-web` 1.26.0-dev.20260416-b7804b056c, MIT:
  https://github.com/microsoft/onnxruntime/tree/b7804b056c30aa35c1748f8e4e239d0e2ff25d6d
  Its browser WASM distribution includes upstream notices for bundled
  components including Eigen, Intel MKL, ONNX, protobuf, pybind11, and zlib.
- `heic-to` 1.5.2, LGPL-3.0:
  https://github.com/hoppergee/heic-to/tree/v1.5.2
  Embedded libheif source: https://github.com/strukturag/libheif/tree/v1.22.2
  It embeds the LGPL libheif/libde265 decoder. Production distributors must
  provide the LGPL text, corresponding source/build information, and a
  relinkable path as required by the LGPL.
- `pdfjs-dist` 6.3.289, Apache-2.0:
  https://github.com/mozilla/pdf.js/blob/master/LICENSE
  Optional CMaps, WASM codecs, and standard fonts have separate package
  notices and must remain included if those assets are redistributed.
- `xlsx` 0.20.3, Apache-2.0, vendored from the official SheetJS distribution at
  `vendor/xlsx-0.20.3.tgz`. The release artifact check records SHA-256
  `8dc73fc3b00203e72d176e85b50938627c7b086e607c682e8d3c22c02bb99fe8`.
- `pdf-lib` 1.17.1, MIT: https://github.com/Hopding/pdf-lib/blob/master/LICENSE
- `fflate` 0.8.3, MIT: https://github.com/101arrowz/fflate/blob/master/LICENSE
- `jszip` 3.10.1, used under its MIT option:
  https://github.com/Stuk/jszip/blob/main/LICENSE.markdown
- `mammoth` 1.12.2, BSD-2-Clause:
  https://github.com/mwilliamson/mammoth.js/blob/master/LICENSE
- `exifr` 7.1.3, MIT: https://github.com/MikeKovarik/exifr/blob/master/LICENSE

## Model and fonts

- Background removal uses `Xenova/modnet` at revision
  `fa2fa546052fba4c08921230a26cc69a333fca12`, Apache-2.0:
  https://huggingface.co/Xenova/modnet
  The model is fetched by the browser and user files remain local. The BRIA
  RMBG model is not used because its terms restrict commercial use without a
  separate agreement.
- DM Sans, Plus Jakarta Sans, and JetBrains Mono are distributed by
  `next/font` under the SIL Open Font License 1.1. Their exact public OFL
  files are listed in the release bundle above.

## Compliance note

Before commercial deployment, package the exact license texts and upstream
notices with the build artifact, verify the `heic-to` LGPL relinking/source
obligations, and review platform-specific native `sharp`/libvips notices if
standalone image binaries are included. This notice is not legal advice.