JAZ-X Media Provenance Inspector third-party dependency notices
==========================================

1. @contentauth/c2pa-web
Project source: https://github.com/contentauth/c2pa-js
Package version: 0.15.1
License: MIT

JAZ-X Media Provenance Inspector self-hosts the official npm distribution required for browser-side
C2PA parsing and verification. The package entry/runtime files, matching
c2pa_bg.wasm, and c2pa_worker.js are stored under vendor/c2pa/.

One browser-resolution-only change is made to the upstream runtime chunk: its
bare import of "highgain" is rewritten to the local relative path
"./highgain.js". The local index file also points at the renamed local runtime
chunk. Upstream source is available at the project source URL above. Exact
package versions and npm integrity values are recorded in vendor/c2pa/VERSIONS.txt.

2. @contentauth/c2pa-wasm / c2pa-types / c2pa-utilities
These are dependencies represented in the packaged @contentauth/c2pa-web
runtime. Their license files from the installed packages are included under
vendor/c2pa/licenses/.
License: MIT

3. highgain
Package version: 0.1.0
License: ISC
Package distribution: https://www.npmjs.com/package/highgain/v/0.1.0
The local readable ESM distribution, package metadata, and license notice are included under vendor/c2pa/.


CONTENTPROOF NETWORK BOUNDARY
-----------------------------
JAZ-X Media Provenance Inspector 0.3.4 performs cryptographic media verification with the locally
packaged C2PA JavaScript/WASM runtime. The browser verifier fetches media only
from the same WordPress origin. Cross-origin media/CDN URLs are blocked in this
this release. Remote manifests, OCSP lookups, and external trust-list
requests are disabled. No third-party executable JavaScript or WASM is loaded
for verification.
