# Vendor provenance

PDFium WASM release: **8046d**

Source release: https://github.com/paulocoutinhox/pdfium-lib/releases/tag/8046d
Archive: https://github.com/paulocoutinhox/pdfium-lib/releases/download/8046d/wasm.zip
Files extracted without modification from `release/node/`.

PDFium license: BSD-style, https://pdfium.googlesource.com/pdfium/+/refs/heads/main/LICENSE
Build packaging: https://github.com/paulocoutinhox/pdfium-lib

SHA-256:

```json
{
  "pdfium.js": "dcf13c22de5692ac8348f045e88ed5fd484e9841c694bfbe3e56d7faff8aae1a",
  "pdfium.wasm": "beeaf5bbff216d555fecec7cd486072838c4632a2272d31b52ef1fd05008fe7c"
}
```

The synthetic sample.pdf is generated by tests/create_fixture.py; no user documents are included. Original Deste licensing and notice files are retained. Third-party notices for the shipped bundle are listed in `THIRD-PARTY.md`; the bundle itself is distributed under the closed-test notice in `LICENSE`, not under an open-source license.

## Rust dependency patches

`vendor/pdfium-render`: crates.io 0.9.4, MIT OR Apache-2.0.
`vendor/winit`: crates.io 0.30.13, Apache-2.0.
Original license files retained in each dependency directory. Narrow web fixes documented in `vendor/PATCHES.md`. These are third-party dependency snapshots, not copies of RustPrinter or RustPdfCompressor.

## Compression WASM

`web/compressor` is compiled from the adjacent RustPdfCompressor sources, using Emscripten SDK 4.0.15, official https://github.com/emscripten-core/emsdk. See `compressor/Cargo.lock` for pinned Rust/OpenJPEG dependencies; no application engine sources are copied into this extension. `COMPRESSION.md` documents the build and limits. OpenJPEG is BSD-2-Clause, jbig2enc-rust is MIT OR Apache-2.0; source license notices remain in their original dependency/source directories.