# Third-party license bundle

These files accompany runtime assets shipped by DoAllHere. Verbatim upstream
texts are pinned below and must remain in production artifacts that redistribute
the corresponding assets.

- `heic-to-LGPL-3.0.txt`: `heic-to` 1.5.2 package license.
- `GPL-3.0.txt`: the GNU GPL version incorporated by reference in LGPL-3.0.
- `heic-to-README-v1.5.2.md`: the pinned wrapper README, including its decoder
  version table and build notes.
- `heic-to-source-build-v1.5.2.md`: the exact source tags and rebuild outline
  for the embedded libheif/libde265 decoder, including the LGPL relinking path.
- `onnxruntime-MIT.txt`: ONNX Runtime MIT license from commit
  `b7804b056c30aa35c1748f8e4e239d0e2ff25d6d`.
- `onnxruntime-ThirdPartyNotices.txt`: ONNX Runtime third-party notices from
  that same pinned commit (the `onnxruntime-web` version is recorded in
  `package-lock.json`).
- `SIL-OFL-1.1-DM-Sans.txt`, `SIL-OFL-1.1-Plus-Jakarta-Sans.txt`, and
  `SIL-OFL-1.1-JetBrains-Mono.txt`: OFL 1.1 texts and font-specific attribution
  for the three `next/font` families used by the application.

The corresponding upstream URLs and release obligations are listed in
`/THIRD_PARTY_NOTICES.md`. Keep the exact files at these public paths when
building or deploying the site.

`npm run qa:release-artifact` verifies the pinned SHA-256 digest of every
verbatim license/notice file in this directory. The locally authored HEIC
source/build record is checked for its exact release tags and relinking terms.

For a public distribution, these bundled files are necessary but not treated
as sufficient evidence by the release process. `npm run qa:public-launch`
also requires stable HTTPS locations for the exact corresponding source and a
practical relinking or replacement procedure, plus an explicit distributor
acknowledgement. The distributor must have qualified counsel review the actual
distribution method and LGPL obligations.