Third-Party Components and Licence Inventory第三方组件与许可证清单

1. Scope and interpretation1. 清单范围与解释

This inventory is generated from the current portable releases, classic/web/package-lock.json, installed licence texts and supplied notices. The lockfile includes development tools, optional platform packages and transitive dependencies; not every package is loaded by end users. The supplied main-editor list and PDF quick-edit resources are distinct evidence, not a complete binary SBOM by themselves.清单依据当前两款便携包、classic/web/package-lock.json、已安装包许可原文及随包声明生成。锁文件含开发工具、可选平台包和间接依赖，不表示每个包都在用户程序中加载。随包主剪辑打包清单和 PDF 简单编辑资源分别核对，不能把其中一个表当作全部二进制的完整 SBOM。

It records discovered components and licence evidence, not independent authorship of all code, transfer of upstream copyright, completion of every distribution obligation or patent/codec clearance. Original licences/notices prevail; summaries do not amend them.此清单记录已发现的组件和许可证据，不构成第三方代码全部由我们原创、版权已经转归公司、所有商业分发义务已通过或编码／专利许可已清零的声明。原许可和权利人声明优先；下列中文说明不是对许可证的改写。

2. OpenCut Classic and WASM2. OpenCut Classic 与 WASM

The adopted OpenCut Classic revision is cf5e79e919144200294fb9fed22a222592a0aeea, with Copyright 2025–2026 OpenCut and MIT terms. PrivacyCut uses and modifies its editor frontend; a modified file is not wholly new exclusive company authorship. opencut-wasm 0.2.10 declares MIT in its metadata; the current editor's WASM matches the supplied dependency binary.OpenCut Classic 采用提交 cf5e79e919144200294fb9fed22a222592a0aeea，原声明为 Copyright 2025–2026 OpenCut，MIT。PrivacyCut 的剪辑前端使用并修改其代码；不能把修改过的整份文件都算成公司独占原创。opencut-wasm 0.2.10 的包元数据声明 MIT，当前剪辑包中的 WASM 与依赖原二进制一致。

MIT permits use, modification, merging and sale, while requiring copyright/permission notices with copies or substantial portions. It does not itself require publication of all independently added code; other components retain their own terms. Use gives no automatic OpenCut trade mark rights or upstream endorsement.MIT 允许使用、修改、合并及销售，但要求在副本或重要部分中保留版权与许可声明。它本身不要求公开全部独立新增代码；其他组件仍适用各自许可。没有因采用 OpenCut 自动取得其商标或上游背书。

3. Mediabunny and SoundTouchJS3. Mediabunny 与 SoundTouchJS

Mediabunny 1.29.1 is MPL-2.0. Recipients of executable form must be told how to obtain corresponding covered source. Modified covered MPL files remain under MPL, and a commercial EULA must not reduce those source rights. dependency-sources/mediabunny exists in the current source archive; final commercial modifications/source delivery still require review.Mediabunny 1.29.1 为 MPL-2.0。分发其可执行形式时，需要告知接收者如何取得相应覆盖源码；修改的 MPL 覆盖文件仍受 MPL 约束，不可用商业 EULA 缩减这些源码权利。当前应用源码包中存在 dependency-sources/mediabunny，最终商用包仍须逐项核对修改和源码交付。

SoundTouchJS 0.3.0 has LGPL-2.1 npm metadata; supplied notices say LGPL-2.1-or-later. The actual grant depends on original source notices. Licence, library distribution and source archives are supplied, citing upstream revision 36b161bb7d69d801b6a81674ad0fc0c42082729f. Preserve permitted debugging of modifications, replacement/relinking and source rights. Minification, integrity checks and signing in the final distribution must not defeat those rights. This document does not claim passed final commercial relinking acceptance.SoundTouchJS 0.3.0 的 npm 字段为 LGPL-2.1；随包说明记为 LGPL-2.1-or-later，实际授权以相应源文件原声明为准。随包包含许可、库发行文件和源码包，使用的上游修订为 36b161bb7d69d801b6a81674ad0fc0c42082729f。对库修改的调试、替换／重新链接及相应源码权利应保留；最终打包压缩、完整性校验和签名机制不得使依法享有的这些权利落空。本文不声称已完成最终商业包重链接验收。

4. PDF, font and decoding subcomponents4. PDF 及字库／解码子组件

PDF.js (pdfjs-dist) 6.4.299 primarily uses Apache-2.0; pdf-lib 1.17.1 uses MIT. pako, tslib, @pdf-lib/standard-fonts, @pdf-lib/upng and related versions/terms are recorded in the inventory. Preserve applicable notices, copyright and modification statements.PDF.js（pdfjs-dist）6.4.299 主要采用 Apache-2.0，pdf-lib 1.17.1 采用 MIT；相关 pako、tslib、@pdf-lib/standard-fonts、@pdf-lib/upng 等以本清单的实际版本及原许可为准。应保留适用 NOTICE、版权和修改说明。

PDF.js fonts, CMaps and WASM decoders have separate terms. In particular, the current LICENSE_LIBERATION states GPL v2 with font exceptions, not a blanket MIT/OFL licence. Covered scope, font source and replacement requirements need commercial-release review. Retain Foxit, Adobe CMaps, JBIG2, OpenJPEG, qcms and PDF.js wrapper notices. These application font resources are not a stock editing-media library.PDF.js 自带字体、CMaps 和 WASM 解码器有分别的许可。特别是当前 LICENSE_LIBERATION 写明 GPL v2 加字体例外，并非可一概标成 MIT 或 OFL；其覆盖范围、字体源文件和替换要求须在商业发布前复核。Foxit、Adobe CMaps、JBIG2、OpenJPEG、qcms 及 PDF.js 包装代码的随附文本一并保留。此类程序字库不等于内置用户剪辑素材。

5. Windows and WebView2 runtimes5. Windows 与 WebView2 运行时

Microsoft WebView2 SDK/Loader and Fixed Version Runtime have supplied Microsoft terms and third-party components including Chromium under their respective terms. The fixed runtime is 156.0.4314.42 x64. The entire runtime is not MIT and its inclusion does not make Microsoft's work company-original code.Microsoft WebView2 SDK／Loader 与 Fixed Version Runtime 采用随附微软条款，并包含 Chromium 等各自的第三方组件。当前固定运行时为 156.0.4314.42 x64。不得把整个运行时统一标为 MIT，也不因它被捆绑就把微软的版权归入公司原创。

No separate FFmpeg command-line executable is called, but WebView2's binary directory does contain ffmpeg.dll. Retain runtime credits, Microsoft terms and subcomponent notices, and review relevant codec/territorial requirements. System Windows/.NET APIs are platform dependencies, not an assertion of an open-source licence over this project's code.当前没有独立调用的 FFmpeg 命令行程序，但 WebView2 的二进制目录确实含 ffmpeg.dll。应保留运行时自带 credits、微软许可和子组件声明，并复核适用编解码及地区分发要求。系统自带 Windows／.NET API 是平台依赖，不作为本项目源码的开源授权声明。

6. General UI libraries and build tools6. 通用界面与开发工具

React/React DOM, Zustand, Radix/Floating UI, icons and styling tools use their respective MIT, BSD, ISC, Apache and other terms. A majority of MIT packages does not excuse omitted minority licences. Exact locked versions and development/supplied-bundle evidence are recorded separately.React／React DOM、Zustand、Radix／Floating UI、图标和样式工具等依各自 MIT、BSD、ISC、Apache 等许可使用；不能仅因多数为 MIT 而省略少数其他许可。完整锁定版本记录在依赖表中，开发期与随包清单证据单独标识。

A build tool's presence does not mean it is redistributed with the app. Conversely, bundled transitive dependencies, fonts and binary subcomponents must not be omitted merely because they are not direct dependencies. Final executable packages require per-product reconciliation.开发工具的存在不自动意味着工具本身必须随应用分发；相反，打包进入程序的间接依赖、字体和二进制子组件也不能因不是直接依赖而漏掉。最终每产品的可执行包仍需核对实际内容。

10. Current MSIX PDF / Office additions10. 当前 MSIX PDF／Office 补充

The current MSIX code also includes @neslinesli93/qpdf-wasm 0.3.0 (ISC wrapper), QPDF 12.2.0 (Apache-2.0 and upstream NOTICE), and recipe-referenced zlib/libjpeg-turbo notices. The supplied prebuilt WASM is not claimed to be solely ISC or independently reproduced byte for byte.当前 MSIX 代码另含 @neslinesli93/qpdf-wasm 0.3.0（ISC 包装层）、QPDF 12.2.0（Apache-2.0 及原 NOTICE），以及构建配方涉及的 zlib／libjpeg-turbo 许可记录。不宣称预编译 WASM 整体仅属 ISC，也不声称逐字节独立重建验证。

@pdf-lib/fontkit 1.1.1 declares MIT, with pako notices also retained. The applicable standalone upstream copyright/licence text for fontkit still needs release review; package metadata/README alone is not licence clearance.@pdf-lib/fontkit 1.1.1 声明 MIT，同时保留 pako 通知。fontkit 适用的上游独立版权／许可原文仍需发行核验；包元数据或 README 本身不能代替许可完备审查。

The modified local PrivacyCut CJK TrueType font derives from Noto Sans SC under SIL OFL 1.1; naming, upstream copyright and transformation are recorded. It is a program dependency, not a bundled sample-media library. Existing PDF.js/pdf-lib/runtime/OpenCut and other obligations continue.本地修改字体 PrivacyCut CJK TrueType 来源于 SIL OFL 1.1 的 Noto Sans SC，保留上游版权、改名与转换记录。它是程序依赖，不是内置示例素材库。既有 PDF.js／pdf-lib／运行时／OpenCut 等义务继续适用。

The linked MSIX notice originals and the 2 November addendum supplement the historical inventory. The complete final per-package binary SBOM and licence obligations remain release gates; this list is not independent legal approval.链接的 MSIX 许可原文及 11 月 2 日附录补充历史清单。最终逐包二进制 SBOM 与许可义务仍为发行门槛，本清单不代表独立法律批准。