# Exact-build component/source and notice inventory

New binarySHA2568204ccf1c93dc66915a3d1acc9760d4b87320e0493aeded8a69168b213a68a7f; sourcegitc28db5dd4fc9660e67117dfdb9f18a43623f5f3d. This replaces the npm binary whose buildcommit was unknown.

input-lock.json identifies all exact fetchedsource archives and publisher-verified official tool binaries. recipe-patches.json identifies source modifications; build-offline.sh fixes stages/resources/linkmemory. Debian image digest and apt exactclosure receipts retained, no floating CPAN packages. Source compilation ran offline. Originalsource archives are included in the review archive; compiler/tool binaries and cached .debs retained locally but omitted from adoptionpayload, with exact URLs/digests to reproduce.

Perl5.42.0 supplies libperl and explicit static extensions enumerated in the retainedlinklog/perl-extension-object-inventory. Their complete original distribution, comments and license files are supplied, including Artistic, GPLCopying and bundled CPAN extension sources. Do not reduce this to a single Apache license.

ExifTool13.42 original distribution and license supplied. Source-built script removes only the recorded INT/CONT handler registration lines; all other script source/comments preserved. No perltidy minification/dependency. Bounded adapter replaces the npm wrapper's embeddedminifiedscript with this exact script. Wrapper functions otherwise retained; zeroperl Worker detector predicate patch retained. Originalnpm wrapper bytes/provenance preserved for comparison.

zeroperl build/runtime stubs MIT; originalsource archive and patches supplied. zlib1.3.1 and bzip2.1.0.8 linked externally plus relevant Perl compression extension source from the Perl archive; originallicenses retained. WASI SDK27 official binary includes linkedlibc/emulated libraries/compiler builtins: sourceSDKcommitfbdec30656d4099da5c7fd7e8275e4af777ca97e points to wasi-libc3f7eb4c7d6ede4dde3c4bffa6ed14e8d656fe93f and llvm-project87f0227cb60147a26a1eeb4fb06e3b505e9c7261. Exact Apache/LLVM-exception/MIT/musl/BSD notices supplied; SDK/license receipts identify official sources. Binaryen124 is a buildtool, not browser-deployed runtime.

@uswriting/exiftool1.0.9 wrapper declaresApache2.0 and includesLICENSE. @6over3/zeroperl-ts1.0.10 wrapper declaresApache2.0 but omitsLICENSE/NOTICE; standardASF full declared terms, exact npm/upstream commit attribution and prominent modified-file notices are included. Missing separate LICENSE/NOTICE alone does not establish absent permission; no upstream copyright or NOTICE text is invented. zip.js2.23.0 BSD3 originalpackage/LICENSE retained. Playwright1.63.0 Apache2.0 is testonly; Prettier3.6.2 MIT was formattingonly and is not an adoption/runtime dependency. Unused evaluated piexifjs/@colorhythm packages are excluded.

This is a traceable inventory and source/notice payload for independent review, not a conclusion that every redistributioncondition is already fulfilled. Ship the exact component-specific source/license/attribution/modification materials listed in SOURCE-NOTICES-SHIPPING.md and establish their public availability before publicbeta. The archive remains private and no license was imposed on the user's broader app.