CCS PDF Editor — Third-Party Software Notices
=============================================

The CCS PDF Editor application code and CCS-authored documentation are
governed by the Internal Use Software License in the LICENSE file.

This application also embeds third-party software under `lib/` and
`assets/`. Those components are not “CCS proprietary” under LICENSE;
they remain subject to their own licenses. Retain license texts that
ship with each package when you update them.

This NOTICE is for attribution and compliance awareness. It is not
legal advice. Confirm current license texts in each package’s own
files after any upgrade.

----------------------------------------------------------------------------
1. PDF.js (Mozilla)
----------------------------------------------------------------------------

Paths:                  lib/pdf.local.js
                        lib/pdf.worker.local.js
                        lib/cmaps/ (character maps)
Purpose:                PDF rendering and text-layer extraction in-browser
Typical license:        Apache License, Version 2.0
Upstream:               https://github.com/mozilla/pdf.js
                        http://www.apache.org/licenses/LICENSE-2.0

CMap / Adobe mapping data under lib/cmaps/ includes Adobe-origin notices;
see lib/cmaps/LICENSE.

----------------------------------------------------------------------------
2. pdf-lib
----------------------------------------------------------------------------

Path:                   lib/pdf-lib.min.js
Purpose:                Create / merge / embed content into PDF files
Typical license:        MIT License
Upstream:               https://github.com/Hopding/pdf-lib

Also ships source maps: lib/pdf-lib.min.js.map

Standard font binaries used with pdf-lib workflows may appear under
lib/standard_fonts/ (Foxit + Liberation — see their LICENSE files).

----------------------------------------------------------------------------
2b. QPDF (WASM) — password protection
----------------------------------------------------------------------------

Paths:                  lib/qpdf.js
                        lib/qpdf.wasm
Purpose:                Optional password protection on Save PDF (content-preserving;
                        keeps AcroForm fillable fields)
Typical license:        Apache-2.0 / Artistic-2.0 for QPDF; package ISC wrapper
Upstream:               https://github.com/qpdf/qpdf
                        https://github.com/neslinesli93/qpdf-wasm
                        npm: @neslinesli93/qpdf-wasm

Loaded in the browser via Emscripten; encryption runs fully client-side.
Passwords are not stored by the application.

----------------------------------------------------------------------------
3. html2canvas
----------------------------------------------------------------------------

Path:                   lib/html2canvas.min.js
Purpose:                Rasterize DOM overlay layers for final PDF export
Version (shipped):      1.4.1 (per file header)
Typical license:        MIT License
Upstream:               https://github.com/niklasvh/html2canvas
                        https://html2canvas.hertzen.com

----------------------------------------------------------------------------
4. Tesseract.js (and related worker / core / trained data)
----------------------------------------------------------------------------

Paths:                  lib/tesseract.min.js
                        lib/tes.worker.min.js
                        lib/tesseract-core-simd-lstm.wasm.js
                        lib/tumin.js (if present)
                        lib/eng.traineddata / eng.traineddata.gz
Purpose:                Local OCR (English) entirely in the browser
Typical license:        Apache License, Version 2.0 (Tesseract.js)
Upstream:               https://github.com/naptha/tesseract.js

OCR language data and WASM core may carry additional upstream notices.
CCS configures the app to load these assets from the local `./lib/`
path (not a public CDN) for offline / internal deployment.

----------------------------------------------------------------------------
5. Fonts (web UI)
----------------------------------------------------------------------------

Path:                   assets/*.woff2, fonts.css
Purpose:                UI and editor typography (self-hosted; no Google Fonts CDN)

Many UI font files are SIL Open Font License (OFL) or Apache-2.0 family
fonts redistributed for offline use. Confirm per-font upstream if
re-bundling a new set.

Liberation fonts under lib/standard_fonts/:
  LICENSE_LIBERATION — SIL Open Font License 1.1

Foxit standard fonts under lib/standard_fonts/:
  LICENSE_FOXIT — see file for terms applicable to pdf-lib standard fonts

----------------------------------------------------------------------------
6. Runtime / host environment (not vendored application logic)
----------------------------------------------------------------------------

The following are typically provided by the deployment host or end-user
device; their licenses are those of the upstream distributor:

  - Web server (e.g. Apache, nginx, IIS) serving static files
  - Modern browser (Chromium, Firefox, Edge, Safari), offline browser pack,
    or optional Windows WebView2 shell (CcsPdfEditor.exe)
  - OS packages on the static file host

No database server is required for the application itself.

----------------------------------------------------------------------------
7. Optional desktop shell (Windows WebView2 / future shells)
----------------------------------------------------------------------------

If CCS ships the Windows WebView2 package (CcsPdfEditor.exe) or a future
Tauri-style wrapper around this web UI, third-party notices for that shell
runtime (e.g. Microsoft Edge WebView2, .NET) apply in addition to this
NOTICE and should be inventoried with that release. The browser OWA path
does not require a desktop shell.

----------------------------------------------------------------------------
8. What this app does *not* embed
----------------------------------------------------------------------------

- No analytics / telemetry SDKs (Google Analytics, etc.) are part of the
  CCS application source under js/
- No cloud PDF conversion APIs
- No remote OCR services when configured as shipped (local Tesseract assets)

If a future release adds remote services, update this NOTICE, SYSTEM-PROFILE,
and GOVERNANCE data-flow sections before production use.
