Opace Content Credentials runtime source and build notice
=====================================================

This directory contains only the browser runtime needed for local C2PA file
inspection, plus its licence and source notice. It is generated by running:

  npm ci --ignore-scripts
  npm run build

Pinned packages:
- @contentauth/c2pa-web 0.14.3 (MIT)
- @contentauth/c2pa-wasm 0.11.3 (MIT)
- @contentauth/c2pa-types 0.7.3 (MIT licence file)
- @contentauth/c2pa-utilities 0.2.1 (MIT)
- highgain 0.1.0 (ISC)
- ts-deepmerge 8.0.0 (ISC)

Source:
- https://github.com/contentauth/c2pa-js
- https://www.npmjs.com/package/highgain/v/0.1.0
- https://github.com/voodoocreation/ts-deepmerge

Included runtime artefacts:
- dist/index.js, renamed internal chunk and dist/c2pa_worker.js from c2pa-web
- dist/resources/c2pa_bg.wasm from c2pa-wasm via c2pa-web
- dist/index.js from highgain, renamed highgain.js

The upstream minified runtime is not re-minified. Two deterministic path-only
changes let native browser modules load from this plugin without a bundler:
- the hashed C2PA chunk import is renamed to ./c2pa-runtime.js;
- its bare highgain import becomes ./highgain.js.

No source map, declaration, test, builder tool, CDN loader or inline-WASM build
is shipped. Remote manifest fetching, OCSP fetching and trust-list verification
are disabled by the Opace wrapper in assets/js/c2pa-provenance.mjs.

Generated SHA-256 hashes:
32bb2346e66d27b5d99c6601fa9bc87519a3b354ece9d86822c82be1cce38983  index.js
25977b1a90aed3ae654b6473f436d727fa0c6f11a80c011b43b7c1b42525dd1a  c2pa-runtime.js
49032ee72ef64b7cb200f3934ebdc12fc702d00fb304618b679f1f34b3c46202  c2pa_worker.js
2e27f91fe1e50999ac1407472d411d1247c53c32788595c37c7abfdd19988b6d  c2pa_bg.wasm
318220c98cc72436b2a9108f54f64b904476a3e738d2866da9e946567373a078  highgain.js
