StockControls offline PDF dependencies
=====================================

These readable sources are bundled solely for the optional local PDF export.
The StockControls adapter restricts document input to escaped plain text, blocks
document HTTP and local-resource loading, embeds one local DejaVu Sans font,
checks its actual glyph coverage, and creates a private per-request font cache.
No Composer executable, shell command, remote renderer or font download runs on
the merchant site. GD and mbstring are required only for this export action.

The adapter applies canonical Unicode NFC composition, not transliteration or
character replacement. Supported glyphs cover Latin, Greek, Cyrillic, Hebrew
and Arabic; other scripts/symbols may require the existing browser-print route.
Arabic OpenType shaping and bidirectional layout are enabled. PDF readers can
extract shaped Arabic presentation forms or mixed-direction punctuation in a
different sequence; the visible document and original store values are distinct.

mPDF is GPL-2.0-only. Its own LICENSE.txt and CREDITS.txt, dependency license files
provided upstream, and DejaVu Bitstream/Arev font terms are retained in the
corresponding packages. The two mPDF PSR shim tags have no standalone LICENSE
file; their exact MIT declarations and author metadata are retained as described
below.
StockControls original code remains GPL-2.0-or-later; the combined Free download
is distributed under GPLv2. This notice does not replace upstream license terms.

Dependencies and exact upstream source revisions:
- mpdf/mpdf v8.3.1; GPL-2.0-only
  https://github.com/mpdf/mpdf.git @ 2a454ec334109911fdb323a284c19dbf3f049810
- mpdf/psr-http-message-shim v2.0.1; MIT
  https://github.com/mpdf/psr-http-message-shim.git @ f25a0153d645e234f9db42e5433b16d9b113920f
- mpdf/psr-log-aware-trait v2.0.0; MIT
  https://github.com/mpdf/psr-log-aware-trait.git @ 7a077416e8f39eb626dee4246e0af99dd9ace275
- myclabs/deep-copy 1.13.4; MIT
  https://github.com/myclabs/DeepCopy.git @ 07d290f0c47959fd5eed98c95ee5602db07e0b6a
- paragonie/random_compat v9.99.100; MIT
  https://github.com/paragonie/random_compat.git @ 996434e5492cb4c3edcb9168db6fbb1359ef965a
- psr/http-message 2.0; MIT
  https://github.com/php-fig/http-message.git @ 402d35bcb92c70c026d1a6a9883f06b2ead23d71
- psr/log 1.1.4; MIT
  https://github.com/php-fig/log.git @ d49695b909c3b7628b6289db5479a1c204601f11
- setasign/fpdi v2.6.8; MIT
  https://github.com/Setasign/FPDI.git @ 881945be29a4996ad3d008eb18ddc01fa3df890c
- symfony/polyfill-intl-normalizer v1.33.0; MIT
  https://github.com/symfony/polyfill-intl-normalizer.git @ 3833d7255cc303546435cb650316bff708a1c75c

Upstream metadata preserved for packages without standalone license files:
- mpdf/psr-http-message-shim v2.0.1 declares MIT in composer.json and lists
  Mark Dorison, Kristofer Widholm and Nigel Cunningham as authors. Its exact
  metadata is retained, without changes, as
  mpdf/psr-http-message-shim/UPSTREAM-COMPOSER.txt.
- mpdf/psr-log-aware-trait v2.0.0 declares MIT in composer.json and lists
  Mark Dorison and Kristofer Widholm as authors. Its exact metadata is retained,
  without changes, as mpdf/psr-log-aware-trait/UPSTREAM-COMPOSER.txt.
Neither pinned upstream distribution includes a standalone LICENSE file. Their
README credits and readable source notices are also retained. These are upstream
author attributions and license declarations; this packaging note does not add
copyright years, designate new rights holders, or replace upstream terms.
Primary metadata at the exact revisions:
https://github.com/mpdf/psr-http-message-shim/blob/f25a0153d645e234f9db42e5433b16d9b113920f/composer.json
https://github.com/mpdf/psr-log-aware-trait/blob/7a077416e8f39eb626dee4246e0af99dd9ace275/composer.json

Bundled font: mpdf/mpdf/ttfonts/DejaVuSans.ttf, from mPDF8.3.1.
Font SHA256: 08ca98e69d9d8fa1065584b4f9ab7d49b6205abea6572b90e171b254845bb990
Font license: mpdf/mpdf/ttfonts/DejaVuinfo.txt.

Modifications: PHP-Scoper0.18.19 adds StockControlsPDFVendor namespace; two mPDF
dynamic Tag namespace literals are prefixed; Symfony Normalizer references and
its optional stub are made private without declaring a global Normalizer class.
Four mPDF string-prefix calls explicitly target its private PHP7.4 helpers,
which are defined independently of newer PHP builtins. The unused global
Normalizer function bootstraps (including a PHP8-only file) are omitted.
Unused fonts, Composer runtime metadata/autoload, development configs/scripts and
package verification keys are omitted, except for the two exact readable metadata
copies documented above. Case-insensitive development-directory filtering removes
paragonie/random_compat/other/build_phar.php and psr/log/Psr/Log/Test/DummyTest.php,
LoggerInterfaceTest.php and TestLogger.php. Explicit exclusions also remove the
unused mpdf/mpdf/data/out.php HTTP helper and the development-only
paragonie/random_compat/psalm-autoload.php. The pinned recipe asserts this exact
six-file removal and preserves license/attribution files. None of these entry
points is used by StockControls' PDF adapter. No PDF engine or shaping algorithm
is rewritten.

The plugin includes its exact reproducible build inputs in
development/pdf-dependencies/ at the plugin root: rebuild.py, composer.json,
composer.lock, NOTICE.txt and README.txt. README.txt explains a manual developer
rebuild from an extracted installer and how to compare every output member.
These files match the maintained tools/pdf-dependencies/ copies. Composer2.10.3
and PHP-Scoper downloads are SHA256 pinned; upstream packages use the exact lock.
The recipe is developer-only, downloads tools/dependencies when explicitly run,
and writes only new --work and --output directories. WordPress and the PDF export
never load or execute the development folder. No downloaded PHAR or tool binary
is included in the plugin.

Primary documentation:
https://mpdf.github.io/about-mpdf/requirements-v7.html
https://mpdf.github.io/fonts-languages/opentype-layout-otl.html
https://mpdf.github.io/fonts-languages/fonts-in-mpdf-7-x.html
https://github.com/humbug/php-scoper/blob/0.18.19/docs/configuration.md
https://github.com/symfony/polyfill-intl-normalizer
https://dejavu-fonts.github.io/
