THIRD-PARTY LICENSES AND NOTICES
札束よわし クリップメーカー / video_clip
Technical inventory updated: 2026-09-14

This notice is a technical inventory, not legal advice. It records components observed in the public PWA source and the production deployment at the audit time. It does not grant rights to user-provided assets.

BROWSER-DELIVERED COMPONENTS

1. @ffmpeg/ffmpeg 0.12.10
   Purpose: browser-side API and Worker.
   Copyright: FFmpeg.wasm contributors.
   License: MIT. Full text: MIT.txt
   Project: https://github.com/ffmpegwasm/ffmpeg.wasm
   Delivered as: web/vendor/ffmpeg/ (locally hosted).

2. @ffmpeg/core 0.12.6, single-thread ESM core
   Purpose: FFmpeg WebAssembly executable.
   Package wrapper metadata: MIT; this does not determine the licence of the FFmpeg/external-library executable contained in ffmpeg-core.wasm.
   Detected executable configuration: --enable-gpl, --enable-libx264, --enable-libx265, --enable-libvpx, --enable-libmp3lame, --enable-libtheora, --enable-libvorbis, --enable-libopus, --enable-zlib, --enable-libwebp, --enable-libfreetype, --enable-libfribidi, --enable-libass, --enable-libzimg.
   Consequence: treat the delivered core as GPL-configured pending legal review.
   Full GPL text: GPL-2.0.txt. Exact-source status: FFMPEG_CORE_SOURCE_NOTICE.txt
   Project: https://github.com/ffmpegwasm/ffmpeg.wasm
   Delivered as: web/vendor/ffmpeg-core/ffmpeg-core.js and ffmpeg-core.wasm.

3. @huggingface/transformers 3.7.2
   Purpose: browser ASR pipeline. Loaded at runtime from jsDelivr.
   Copyright: Hugging Face, Inc.
   License: Apache-2.0. Full text: Apache-2.0.txt
   Project: https://github.com/huggingface/transformers.js
   Runtime note: the source imports this ESM package from https://cdn.jsdelivr.net/npm/@huggingface/transformers@3.7.2 . Its browser dependency graph includes onnxruntime-web; the PWA does not pin or locally host the exact ONNX Runtime Web files. Record their resolved version and notices before claiming a complete browser-delivery inventory.

4. Xenova/whisper-tiny
   Purpose: ONNX ASR model downloaded into the end user's browser at runtime.
   License declared by repository: Apache-2.0. Full text: Apache-2.0.txt
   Project: https://huggingface.co/Xenova/whisper-tiny
   Revision: NOT PINNED. Source specifies the mutable model identifier only.
   The model weight files are not stored in this source archive or server tree.

5. OpenAI Whisper upstream
   Purpose: upstream architecture/model provenance only; not a Python package or local weight file in this PWA.
   Copyright: OpenAI, 2022.
   License: MIT. Full text: MIT.txt
   Project: https://github.com/openai/whisper

SERVER-INTERNAL COMPONENTS (NOT SENT AS PWA DOWNLOADS)

6. Caddy 2.10.2-alpine
   Purpose: current production HTTPS/static reverse proxy.
   License: Apache-2.0. Project: https://caddyserver.com/
   Deployment: server container only; not a user download.

7. Node.js 22-bookworm-slim base image and Ubuntu 24.04.5 LTS host
   Purpose: server runtime and host operating system.
   Deployment: server only; no image/OS distribution to PWA users was observed.
   An SBOM and image notices are required before distributing these images.

8. image-converter server package-lock production direct dependencies
   express 5.2.1 (MIT), multer 2.3.0 (MIT), sharp 0.35.4 (Apache-2.0), jszip 3.10.1 ((MIT OR GPL-3.0-or-later), operator may select MIT).
   These belong to the separate server-side image-converter service and were not observed in the video_clip browser bundle. Transitive dependency notices and Sharp/libvips native-binary provenance need an SBOM before any container is distributed.

USER-PROVIDED ASSET
   web/assets/avatar.png was supplied by the project owner. This audit did not establish authorship, copyright, trademark, or permission for redistribution.

NOT OBSERVED IN video_clip SOURCE OR PUBLIC STATIC TREE
   faster-whisper, CTranslate2, Python, TTS, VOICEVOX, Ollama, Qwen/other LLMs, native ffmpeg.exe/ffprobe.exe, DLLs, EXEs, embedded audio, or embedded fonts.