# Third-party software notices / 利用ライブラリ

ami includes the following unmodified third-party distributions. These notices
and the linked license files must accompany copies of the app, including
commercial distributions. The app's own code is separate from these licenses.
No upstream trademark endorsement is implied.

## PDF and OCR

| Component | Pinned distribution | License / retained notices |
|---|---|---|
| Mozilla PDF.js | 6.4.299 | [Apache-2.0](vendor/pdf.js/6.4.299/LICENSE); copyright notices remain in the module and worker |
| Tesseract.js worker | 5.1.1 | [Apache-2.0](vendor/tesseract.js/5.1.1/LICENSE.md), [original bundled notices](vendor/tesseract.js/5.1.1/dist/worker.min.js.LICENSE.txt) |
| Tesseract.js-core (LSTM, SIMD and non-SIMD) | 5.1.1 | [Apache-2.0](vendor/tesseract.js-core/5.1.1/LICENSE); native notices below also apply |
| English/Japanese/Korean LSTM language data | `@tesseract.js-data/{eng,jpn,kor}@1.0.0`, `4.0.0_best_int` | [Upstream tessdata Apache-2.0](vendor/tessdata/1.0.0/LICENSE). The npm wrapper metadata declares MIT; no wrapper program code is used. [eng metadata](vendor/tessdata/1.0.0/eng.package.json), [jpn metadata](vendor/tessdata/1.0.0/jpn.package.json), [kor metadata](vendor/tessdata/1.0.0/kor.package.json) are retained to make this distinction explicit. |

Apache-2.0 permits commercial use subject to its terms, including preservation of
license, copyright, patent and attribution notices, and notices of modifications
when applicable. The vendor distributions are not modified by ami. The application
adapter and local path configuration are outside those distributions. The explicit
patent terms and termination conditions in the full license apply.

## JavaScript bundled in the OCR worker

The upstream distribution's emitted notices are preserved. Additional full
license texts are retained below; version provenance is the
[upstream Tesseract.js 5.1.1 lockfile](vendor/licenses/tesseract.js-5.1.1-upstream-package-lock.json),
not an app installation manifest.

- [base64-js 1.5.1 — MIT](vendor/licenses/base64-js-1.5.1.txt)
- [bmp-js 0.1.0 — MIT](vendor/licenses/bmp-js-0.1.0.txt)
- [buffer 6.0.3 — MIT](vendor/licenses/buffer-6.0.3.txt)
- [ieee754 1.2.1 — BSD-3-Clause](vendor/licenses/ieee754-1.2.1.txt)
- [is-electron 2.2.2 — MIT](vendor/licenses/is-electron-2.2.2.txt)
- [is-url 1.2.4 — MIT](vendor/licenses/is-url-1.2.4.txt)
- [regenerator-runtime 0.13.11 — MIT](vendor/licenses/regenerator-runtime-0.13.11.txt)
- [wasm-feature-detect 1.2.11 — Apache-2.0](vendor/licenses/wasm-feature-detect-1.2.11.txt)
- [zlibjs 0.3.1 — MIT](vendor/licenses/zlibjs-0.3.1.txt)
- [idb-keyval 6.2.0 — ISC](vendor/licenses/idb-keyval-6.2.0.txt)

MIT/ISC require retention of their copyright and permission notices. BSD-3-Clause
also requires preservation of its disclaimer and prohibits use of contributor
names for endorsement without permission. Full terms are in the linked texts.

## Native components in the OCR WASM distribution

Upstream tesseract.js-core's build includes Tesseract, Leptonica and image/math
libraries. Preserve all the following notices when redistributing the WASM:

- [Tesseract — Apache-2.0](vendor/licenses/native-tesseract-native.txt)
- [Leptonica — BSD-style](vendor/licenses/native-leptonica.txt)
- [Independent JPEG Group libjpeg — IJG license and documentation](vendor/licenses/native-libjpeg-IJG.txt)
- [giflib — MIT-style](vendor/licenses/native-giflib.txt)
- [libpng — libpng license](vendor/licenses/native-libpng.txt)
- [libtiff — permissive copyright/license](vendor/licenses/native-libtiff.txt)
- [libwebp — BSD-3-Clause](vendor/licenses/native-libwebp.txt), [patent grant](vendor/licenses/native-libwebp-PATENTS.txt)
- [zlib — zlib license](vendor/licenses/native-zlib.txt)
- [OpenLibm — component copyright/license collection](vendor/licenses/native-openlibm.txt)
- [Emscripten — MIT / University of Illinois NCSA](vendor/licenses/native-emscripten.txt)

**This software is based in part on the work of the Independent JPEG Group.**

Copyrights, disclaimers, attribution and non-endorsement requirements in these
texts are retained. None of the above licenses requires ami to become a paid
service or to publish personal project data. Preserve the original notices and
identify any future changes to vendor code.

## Reproducibility and scope

[The vendor manifest](vendor/manifest.json) records actual source URLs, byte sizes
and SHA-256 for every retained file. Native-license reference revisions are
recorded there; they are not claims that the corresponding native revisions were
used to compile the prebuilt WASM. That package does not provide a complete
binary-to-native-source SBOM. Exact native revision correspondence and current
vulnerability status remain **未確認**. No claim of a complete legal or security
audit is made. License/notice preservation does not establish vulnerability safety.

Run `node scripts/verify-vendor.cjs` before distribution. Do not omit this file or
the `vendor/` licenses when deploying/copying the app. The settings screen links
here so users can view the notices without visiting an external site.