# Third-Party Notices

Libraries and assets used by this project, either vendored directly into
the repository or loaded from a CDN at runtime. Versions and license
identification below are drawn from the files themselves (vendored) or
from the CDN reference in code (CDN-loaded) — marked accordingly. Where
a CDN-loaded library's exact license text isn't locally verifiable, its
license identifier is the one that library publishes for the referenced
version, not independently re-verified here.

## Vendored (checked into `erp/assets/`, not via a dependency manager)

| Library | Version | Location | License | Purpose |
|---|---|---|---|---|
| PHPMailer | 6.12.0 (from `PHPMailer::VERSION` constant) | `erp/assets/PHPMailer/` | LGPL-2.1 (per file header; no separate `LICENSE` file bundled) | Outbound email sending |
| TCPDF | 6.11.3 (from file header comment) | `erp/assets/tcpdf/` | LGPL v3 (`erp/assets/tcpdf/LICENSE.TXT`, bundled) | PDF generation (report cards, letterheads, salary slips, ID cards, admit cards) |
| Poppins (Bold) | N/A (static font file) | `erp/assets/fonts/Poppins-Bold.ttf` | SIL Open Font License 1.1 (`erp/assets/fonts/OFL.txt`, bundled) | Dynamic text rendering on generated birthday posters (`erp/modules/birthday_service.php`) |
| IBM Plex Sans / Serif / Mono | latin + latin-ext subsets, WOFF2, from Google Fonts | `erp/assets/fonts/*.woff2` declared by `erp/assets/fonts/portal-fonts.css` | SIL Open Font License 1.1 (`erp/assets/fonts/OFL-webfonts.txt`, bundled) | Self-hosted interface and document typography across every portal, so printed certificates and report cards do not depend on a reachable CDN |

`erp/config.php`'s own project code is not third-party and isn't listed
here — this file only covers dependencies with a separate origin/license.

## CDN-loaded (referenced by URL in PHP-rendered pages, not stored in this repo)

| Library | Version(s) seen in code | Typical license | Purpose |
|---|---|---|---|
| Font Awesome | Free 6.5.0 / 6.5.1 (most references), one legacy 6.0.0-beta3 reference (`sweet_alert()`'s inline `<link>` in `erp/modules/base.php`) | Font Awesome Free (icons: CC BY 4.0; fonts: SIL OFL 1.1; code: MIT) | Icons across the admin panel and mobile app portals |
| Google Fonts | Space Grotesk, Manrope, JetBrains Mono (mobile app portals — see `docs/frontend.md`); Outfit, DM Serif Display (desktop admin panel) | SIL Open Font License 1.1 (per Google Fonts' own licensing for each family) | Typography |
| SweetAlert2 | 11.0.19 (`sweet_alert()` in `erp/modules/base.php`, via jsdelivr) | MIT | Alert/confirmation dialogs app-wide |
| DataTables | 1.11.5 combined build (`cdn.datatables.net`, includes jQuery) | MIT | Admin list views (per `docs/architecture.md`/`docs/frontend.md`) |
| html2canvas | version not pinned in the referenced URL (`app/student/exam.php`) | MIT | Client-side screenshot/capture on that page |

A version inconsistency exists in Font Awesome usage (6.0.0-beta3 in one
inline helper vs. 6.5.x everywhere else) — noted here as a known minor
drift, not something this documentation pass corrected (would be an
unrelated code change outside this pass's scope).

## Dev tooling (Composer, `require-dev` only — never shipped to production)

`composer.json` exists solely for these two tools; the application
itself has zero runtime Composer dependencies (the vendored libraries
above are unaffected, still tracked directly). Neither of these is
deployed — see `docs/deployment.md`, which only ever moves `erp/`'s
contents.

| Library | Version constraint | Purpose | Update responsibility |
|---|---|---|---|
| PHPStan | `^1.11` (`composer.json`) | Static analysis — see `docs/static-analysis.md` | Bump the constraint deliberately when a new major is needed; not on a schedule |

Exact resolved versions aren't determinable from this repository alone
— no `composer.lock` has been committed yet (network/Composer access
wasn't available in the session that added these). `composer install`
generates one; committing it afterward is what pins these to exact,
reproducible versions rather than a floating range. Until then, treat
the constraints above as intent, not a guarantee of what will actually
resolve.

## Not included here

- The application's own PHP code (`erp/modules/`, `erp/schools/`) —
  first-party, covered by this repository's own terms, not third-party.
- `erp/assets/app/*.css`/`*.js` (the shared mobile-portal design
  system) — first-party, written for this project.
- Anything in `erp/url_shortner/` — first-party standalone tool.

## Updating this file

When vendoring a new library or adding a new CDN reference: add a row
here in the same commit, with the version and license actually found in
the vendored files (or the CDN reference), not assumed. If a library is
removed, remove its row in the same commit that removes the reference.