Bundled third-party assets: where they come from, and how to verify them
========================================================================

Every third-party file bundled with this plugin is copied verbatim, byte for
byte, from the prebuilt distribution of a pinned upstream npm package. Nothing
is minified, transformed, concatenated or patched by this plugin. One of the
bundled files (chart.umd.min.js) is already minified in the form upstream
publishes it; the human-readable source of each file is named in its section
below.

Verify the bundled files (run from the plugin's root directory):

    shasum -a 256 -c public/licenses/VENDOR-CHECKSUMS.txt

or, with GNU coreutils:

    sha256sum -c public/licenses/VENDOR-CHECKSUMS.txt

Reproduce them from upstream (requires Node.js; package.json pins the versions):

    npm ci
    cp node_modules/@zxing/library/umd/index.js               public/js/vendor/zxing-library.js
    cp node_modules/chart.js/dist/chart.umd.min.js            public/js/vendor/chart.umd.min.js
    cp node_modules/qrcode-generator/dist/qrcode.js           public/js/vendor/qrcode-generator.js
    shasum -a 256 -c public/licenses/VENDOR-CHECKSUMS.txt

The plugin's source repository additionally ships bin/build-assets.sh and
bin/verify-assets.sh, which perform exactly the two steps above. They are shell
scripts and are therefore excluded from the distributed package.


@zxing/library 0.23.0 — Apache-2.0 License
-----------------------------------------
Upstream:  https://github.com/zxing-js/library
npm:       https://www.npmjs.com/package/@zxing/library

    public/js/vendor/zxing-library.js  <- node_modules/@zxing/library/umd/index.js

This is the barcode decoder used by the staff PWA. It is pure JavaScript: there
is no WebAssembly and no binary in this package. Decoding happens entirely in
the browser; the plugin makes no request to any external host for it.

This is upstream's UNMINIFIED UMD build, shipped as-is so that the code running
in the browser is human-readable. (Upstream also publishes a minified build,
umd/index.min.js; it is deliberately not used here. That file embeds literal
control characters in its Aztec and GS1 lookup tables, which makes file(1)
report it as application/octet-stream even though it is plain JavaScript.)
The TypeScript source is at https://github.com/zxing-js/library/tree/v0.23.0/src .

Formats enabled by the plugin: EAN-13 / EAN-8 / UPC-A (JAN), Code 128 (GS1-128),
GS1 DataBar (RSS-14), GS1 DataBar Expanded, DataMatrix and QR. GS1 DataBar
Limited and UPC-E are not decoded by this library, so those codes are typed in
by hand.

License text: public/licenses/ZXING-JS-LICENSE.txt


Chart.js 4.5.1 — MIT License
----------------------------
Upstream:  https://www.chartjs.org/
npm:       https://www.npmjs.com/package/chart.js

    public/js/vendor/chart.umd.min.js  <- node_modules/chart.js/dist/chart.umd.min.js

Used for the admin-side expense and price charts. Upstream publishes this file
already minified; the human-readable source is dist/chart.js in the same package
and in the repository above.


qrcode-generator 2.0.4 — MIT License
------------------------------------
Upstream:  https://github.com/kazuhikoarase/qrcode-generator
npm:       https://www.npmjs.com/package/qrcode-generator

    public/js/vendor/qrcode-generator.js  <- node_modules/qrcode-generator/dist/qrcode.js

Unminified upstream source. Renders the staff-app login QR code locally in the
browser; no external request is made.
