许可与致谢

citeproc / citeproc-js

CiteDesk bundles an unmodified copy of `chrome/content/zotero/xpcom/citeproc.js` as shipped in the Zotero client source tree (Zotero `main` at commit 15f6a81181dd696349447cb542cec56ff1d621f4; the file was last changed in Zotero commit 08880f7a0e51021cc13b6aff248fdcbc96234c91). It is not the npm package `citeproc`. Its content is citeproc-js at upstream commit f88a47e6 plus five pull requests that Zotero merged into its own copy: Juris-M/citeproc-js #256, #276, #275, #281 and #286 (#256, #276 and #286 were not yet merged upstream when this copy was taken). The processor reports `CSL.PROCESSOR_VERSION` 1.4.61. The production copy is kept byte for byte identical to Zotero's file; at build time the single line `module.exports = CSL` is appended after it, the same rule upstream uses to produce its CommonJS bundle.

Copyright (c) 2009-2019 Frank Bennett. License: CPAL-1.0 OR AGPL-3.0. For this distribution CiteDesk elects the GNU Affero General Public License version 3 option. Zotero's changes to the file are distributed with Zotero under the GNU Affero General Public License version 3. The upstream short license notice is distributed at `licenses/citeproc-js-LICENSE.txt`; the complete AGPL-3.0 legal text is distributed at `licenses/AGPL-3.0.txt` (official source: https://www.gnu.org/licenses/agpl-3.0.txt). Corresponding CiteDesk source, including the exact production copy and build instructions: provided together with each distribution of this version (the source distribution). Source: https://github.com/zotero/zotero/blob/15f6a81181dd696349447cb542cec56ff1d621f4/chrome/content/zotero/xpcom/citeproc.js Upstream processor: https://github.com/Juris-M/citeproc-js

Citation Style Language styles and locales

CiteDesk embeds fixed production copies of Citation Style Language style and locale XML. Each XML file retains its own author, contributor, source, update and rights metadata. The bundled files declare Creative Commons Attribution-ShareAlike 3.0 licensing. Most styles and all locales come from the Citation Style Language community repositories:

  https://github.com/citation-style-language/styles
  https://github.com/citation-style-language/locales

Attribution (as the styles repository asks of software that uses its styles): the styles and locales are the work of the Citation Style Language (CSL) project, an open standard for citation formatting, with its home at https://citationstyles.org/. CiteDesk's About window names the CSL project and links to that address as well.

The multilingual 《法学引注手册》 style comes from the independent zotero-chinese community repository:

  https://github.com/zotero-chinese/styles

Exact production paths, historical archive paths, SHA-256 values, style versions and upstream snapshot dates are recorded in the audit-only `src/core/citeproc/fixed-csl.ts` manifest in the source distribution; runtime XML imports are kept separately in `fixed-csl-runtime.ts`. The complete CC BY-SA 3.0 legal code is distributed at `licenses/CC-BY-SA-3.0.txt`; author and contributor attribution remains embedded in each XML style's `<info>` metadata. License source: https://creativecommons.org/licenses/by-sa/3.0/

Zotero journal abbreviation data and month-name data

CiteDesk embeds an unmodified copy of `resource/schema/abbreviations.json` from the Zotero client source tree (MEDLINE journal title abbreviations plus a per-word abbreviation table, 1,339,826 bytes), used by the "Use MEDLINE journal abbreviations" document preference. The abbreviation lookup logic is a port of `Zotero.Cite.getAbbreviation` from the same source tree.

It also embeds an unmodified copy of `resource/schema/dateFormats.json` from the same source tree (localized month names for 44 locales, 16,110 bytes), used when reading what a user typed into a date field. The date reading logic is a port of `Zotero.Date.strToDate` and the surrounding helpers from the same source tree.

It also embeds an unmodified copy of `resource/schema/renamed-styles.json` from the same source tree (a table of renamed citation styles, 610 entries, 42,488 bytes), used to treat an old style id as the style it was renamed to. The lookup logic is a port of `Zotero.Styles.get` and the renamed-style handling in `Zotero.Styles.init` from the same source tree.

It also embeds an unmodified copy of `resource/schema/engines.json` from the same source tree (the default list of lookup engines, 567 bytes) and of `chrome/skin/default/zotero/logos/google-scholar.ico` (the icon of its one engine, 3,871 bytes), used to fill the lookup engine list the first time it is created and when it is restored to its defaults. The engine management logic is a port of `Zotero.LocateManager` from the same source tree.

Copyright (c) Corporation for Digital Scholarship and Zotero contributors. Zotero is licensed under the GNU Affero General Public License version 3; the complete AGPL-3.0 legal text is distributed at `licenses/AGPL-3.0.txt`. Source: https://github.com/zotero/zotero (files `resource/schema/abbreviations.json`, `resource/schema/dateFormats.json`, `resource/schema/renamed-styles.json`, `resource/schema/engines.json` and `chrome/skin/default/zotero/logos/google-scholar.ico`; the exact commit, SHA-256 and byte length of each are recorded in the audit-only `src/core/citeproc/fixed-csl.ts` manifest in the source distribution).

OpenURL resolver directory

CiteDesk embeds an unmodified copy of the OpenURL resolver directory published on the Zotero documentation site (DokuWiki raw export of https://www.zotero.org/support/locate/openurl_resolvers, 50,062 bytes, 511 library resolvers grouped by continent and country), used to fill the "Resolver:" drop-down in settings. The Zotero client fetches the same page at run time; CiteDesk ships a snapshot instead and never goes online for it. The parsing is a port of `Zotero.Utilities.Internal.OpenURL.getResolvers`.

Licensing: the page belongs to the Zotero documentation wiki. Zotero's licensing page (https://www.zotero.org/support/licensing) states that wiki content produced after April 26, 2015 is released under the Creative Commons Attribution-ShareAlike 4.0 International License (https://creativecommons.org/licenses/by-sa/4.0/), and that previous wiki content may be licensed under the Creative Commons Attribution-NonCommercial-ShareAlike 3.0 Unported License. The public site does not expose this page's revision history, so it cannot be determined here which entries predate that date; no entry-level attribution or per-entry license is claimed. The content is library names and their OpenURL base addresses. The snapshot is kept unchanged, credited to the Zotero documentation and its wiki contributors; anyone who reuses the list commercially should first check the revision history against Zotero's Wiki Contributor License Agreement, as Zotero's licensing page advises. Source: https://www.zotero.org/support/locate/openurl_resolvers?do=export_raw (the snapshot date, SHA-256 and byte length are recorded in the audit-only `src/core/citeproc/fixed-csl.ts` manifest in the source distribution).

Zotero import, export, search and web translators and translation utilities

CiteDesk embeds copies of the file import and file export translators from the Zotero translator repository (BibTeX, RIS, Refer/BibIX, MEDLINE/nbib, MARC and the other bibliographic file formats Zotero's Import and Export dialogs handle), of the search translators Zotero's Add Item by Identifier runs for ISBNs, DOIs, arXiv IDs, ADS Bibcodes and PubMed IDs (DOI Content Negotiation, EIDR, arXiv.org, ADS Bibcode, PubMed, Library of Congress ISBN, BnF ISBN, K10plus ISBN, LIBRIS ISBN, National Library of Poland ISBN, Camara Brasileira do Livro ISBN, and the Crossref REST and CSL JSON translators they call), and of the web translators in the same repository that save items from a web page (Embedded Metadata, DOI, COinS, unAPI and the site-specific translators); the complete list with paths is the `FIXED_ZOTERO_TRANSLATORS` manifest named below. They come together with the Zotero utility modules they need to run (`utilities.js`, `date.js`, `utilities_item.js` and `resource/dateFormats.json` from the Zotero utilities repository, and `tlds.js` and `proxy.js` from the Zotero translate repository, which pick the web translators for an address). They are evaluated at run time only inside a separate sandboxed page, in a controlled function scope with no file system and no host application objects. The page itself has no network access; only while a search or a web page translation is in progress does the application make HTTP requests on a translator's behalf (GET, POST and HEAD to http and https addresses, without the application's cookies). The only change CiteDesk makes is to the translators: when the application is built, the upstream regression test cases at the end of each translator file (everything from `/** BEGIN TEST CASES **/` through `/** END TEST CASES **/`) are removed, because they are never executed at run time. Every other byte is unchanged, the utility modules are embedded unmodified, and the complete unmodified translator files are included in the source distribution.

The Note Markdown translator (it exports notes only) carries a browser bundle of the `turndown` and `turndown-plugin-gfm` packages inside its file; the MIT licence notice of `turndown` stays in that file as upstream wrote it, and the file is embedded unmodified.

Copyright (c) Corporation for Digital Scholarship and Zotero contributors, and the individual translator authors named in each file header. License: GNU Affero General Public License version 3 (AGPL-3.0); the complete legal text is distributed at `licenses/AGPL-3.0.txt`. A few of the oldest translators written by the Zotero project itself carry no licence block in their file header; they are distributed as part of the Zotero client under the AGPL-3.0 and are embedded here on the same terms (the manifest marks them `licenseHeader: false`); `tlds.js` likewise carries no licence statement and is distributed by the Zotero project under the AGPL-3.0. Some translators (the file translators Bookmarks, Simple Evernote Export and TEI, and a number of web translators) state in their file headers that they are licensed under the GNU General Public License version 3 or any later version (GPL-3.0-or-later) instead, and one web translator (Pleade) under the GNU General Public License version 2 or any later version (GPL-2.0-or-later), which CiteDesk uses under version 3; the complete GPL-3.0 legal text is distributed at `licenses/GPL-3.0.txt` (official source: https://www.gnu.org/licenses/gpl-3.0.txt). One web translator (Intellixir) is licensed under the Apache License, Version 2.0 (Apache-2.0); the complete legal text is distributed at `licenses/Apache-2.0.txt` (official source: https://www.apache.org/licenses/LICENSE-2.0.txt). The manifest records the licence of every translator file individually. Corresponding CiteDesk source, including the exact dependency lock and build instructions: provided together with each distribution of this version (the source distribution). Source: https://github.com/zotero/translators, https://github.com/zotero/utilities and https://github.com/zotero/translate (the exact commits, SHA-256 values and byte lengths are recorded in the audit-only `src/core/citeproc/fixed-csl.ts` manifest in the source distribution).

SingleFile

Zotero saves a web page snapshot by loading the page in a hidden browser and running SingleFile (https://github.com/gildas-lormeau/SingleFile) over it, which inlines images, style sheets and fonts into one HTML file. CiteDesk embeds two unmodified files of the SingleFile repository at commit 0bca0227851348ef9bbaec780e88deb32b1cc03d (2023-05-17, package version 1.0.33), the commit that Zotero main pins as its `resource/SingleFile` submodule:

  lib/single-file.js            (SingleFile core and frame tree processing, minified UMD build)
  lib/single-file-hooks-frames.js

They are the two files that Zotero's `actors/SingleFileChild.mjs` loads into the page's top-level frame. The other files of SingleFile's `lib/` belong to the browser extension and are not loaded by Zotero or by CiteDesk; `single-file-frames.js`, which Zotero also injects into sub-frames, is not needed because Zotero's configuration removes frames. Zotero's build applies one replacement to `single-file.js` (`js-build/babel-worker.js`, `globalThis.Set` and `globalThis.Map` to `Set` and `Map`, a workaround for Firefox sandboxes); CiteDesk runs the files in a Chromium isolated world and uses the upstream bytes. The files run in a hidden window in the main process with their own session (`electron/snapshot-singlefile.ts`).

Copyright (c) Gildas Lormeau and SingleFile contributors. License: AGPL-3.0 (package.json declares AGPL-3.0-or-later); the complete legal text is distributed at `licenses/AGPL-3.0.txt`. The SingleFile README ("Code derived from third party projects") lists eight projects whose code SingleFile derives from and states that this code is licensed under MIT; the license texts are distributed as follows (the projects are csstree, postcss-media-query-parser, postcss-selector-parser, UglifyCSS, parse-srcset, parse-css-font, Readability and whatwg-mimetype):

  csstree: licenses/singlefile-derived-code-LICENSE.txt
  postcss-media-query-parser: licenses/singlefile-derived-code-LICENSE.txt
  UglifyCSS: licenses/singlefile-derived-code-LICENSE.txt
  parse-srcset: licenses/singlefile-derived-code-LICENSE.txt
  parse-css-font: licenses/singlefile-derived-code-LICENSE.txt
  whatwg-mimetype: licenses/singlefile-derived-code-LICENSE.txt
  postcss-selector-parser: licenses/postcss-selector-parser-LICENSE.txt
  Readability: licenses/readability-keep-nodes-LICENSE.txt

Readability is under the Apache License 2.0 (its repository's LICENSE.md is the unmodified text), which differs from the README's general statement about MIT; its complete text is distributed at `licenses/Apache-2.0.txt`. The texts for csstree, UglifyCSS, parse-srcset, parse-css-font and whatwg-mimetype are the LICENSE files of the projects' repositories as of 2026-10-14, not necessarily the revision that SingleFile copied from. postcss-media-query-parser publishes no license file; its package.json and README declare MIT, which `licenses/singlefile-derived-code-LICENSE.txt` records as such. The exact commit, SHA-256 and byte length of each embedded file are recorded in the `FIXED_ZOTERO_SINGLEFILE` manifest in `src/core/citeproc/fixed-csl.ts`. Source: https://github.com/gildas-lormeau/SingleFile/tree/0bca0227851348ef9bbaec780e88deb32b1cc03d

Tabulator RDF library (as distributed with Zotero)

Translators that work on RDF (Zotero RDF, Bibliontology RDF, Unqualified Dublin Core RDF and the generic RDF importer) need a triple store, an RDF/XML parser and a serializer. CiteDesk embeds unmodified copies of the six files Zotero uses for this (`init.js`, `uri.js`, `term.js`, `identity.js`, `rdfparser.js`, `serialize.js` from `src/rdf/` of the Zotero translate repository). They originate from the W3C Tabulator project.

Copyright (c) World Wide Web Consortium (Massachusetts Institute of Technology, European Research Consortium for Informatics and Mathematics, Keio University) and the Tabulator authors named in the file headers; modifications copyright (c) Corporation for Digital Scholarship and Zotero contributors. License: `uri.js`, `term.js` and `rdfparser.js` state the W3C Software Notice and License (SPDX: W3C; http://www.w3.org/Consortium/Legal/2002/copyright-software-20021231, reproduced in full in the header of `rdfparser.js`, which is embedded verbatim). The remaining files carry no licence statement of their own and are distributed by the Zotero project under the AGPL-3.0 (`licenses/AGPL-3.0.txt`). Source: https://github.com/zotero/translate (exact commit, SHA-256 values and byte lengths are recorded in the `FIXED_ZOTERO_RDF` manifest in `src/core/citeproc/fixed-csl.ts`).

XRegExp

The Zotero utilities repository ships a bundled build of XRegExp 3.2.0, which CiteDesk embeds unmodified because `utilities.js` and `date.js` require it for Unicode property escapes.

XRegExp Copyright (c) 2007-present Steven Levithan

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

License: MIT. Source: https://github.com/slevithan/xregexp (bundled at https://github.com/zotero/utilities/blob/master/xregexp-all.js)

Unicode Han Database (Unihan)

The Chinese character to pinyin table compiled into the application's scripts (in the source distribution as `src/core/generated/pinyin-chars.ts`, used to romanize Chinese names) is derived from the `kMandarin` field of `Unihan_Readings.txt` in the Unicode Han Database, Unicode 18.0.0 (file dated 2026-07-31). For each character from U+4E00 to U+9FFF CiteDesk keeps the first reading with its tone marks removed and writes ü as v; nothing else from the database is included. The table is generated by `scripts/generate-pinyin.mjs` from the unmodified data file `vendor/unicode/Unihan_Readings.txt`; both are kept in this application's source repository.

Copyright © 1991-2026 Unicode, Inc. License: Unicode License V3 (SPDX: Unicode-3.0). The complete copyright and permission notice is distributed at `licenses/Unicode-3.0.txt` (official source: https://www.unicode.org/license.txt). Source: https://www.unicode.org/Public/18.0.0/ucd/Unihan.zip

Unicode Case Folding

Workspace path comparison uses the complete default C+F mappings from Unicode 18.0.0 CaseFolding-18.0.0.txt (dated 2026-02-03). It does not use locale-specific Turkic mappings. The unmodified source is vendor/unicode/CaseFolding-18.0.0.txt; scripts/generate-casefold.mjs produces src/core/sync/unicode-casefold-data.ts. Paths are NFC-normalized before folding; original file names are not rewritten. Copyright © 1991-2026 Unicode, Inc. License: Unicode License V3 (SPDX: Unicode-3.0), distributed at licenses/Unicode-3.0.txt. Source: https://www.unicode.org/Public/18.0.0/ucd/CaseFolding.txt

Zotero PDF reader and note editor

CiteDesk embeds the prebuilt `zotero` builds of the Zotero PDF/EPUB reader (https://github.com/zotero/reader) and the Zotero note editor (https://github.com/zotero/note-editor), byte for byte as published by the upstream projects. They are taken the same way the Zotero client takes them (`js-build/reader.js` downloads the build archive for the submodule commit instead of building from source): reader at commit e7a93982baaee820e1bf5604dbf7f86400c98272 and note editor at commit acec74d09b910cfb67e6fa05135faca06f525c11, the commits pinned by the Zotero `main` tree at 15f6a81181dd696349447cb542cec56ff1d621f4. Only the `zotero/` directory of each archive is embedded (240 files for the reader, 23 for the note editor); nothing in them is modified. They run inside a separate window with their own session, their own narrow preload bridge and no network access.

Copyright (c) Corporation for Digital Scholarship and Zotero contributors. License: GNU Affero General Public License version 3 (AGPL-3.0); the complete legal text is distributed at `licenses/AGPL-3.0.txt`. Corresponding CiteDesk source, including the exact embedded copies and build instructions: provided together with each distribution of this version (the source distribution). Source: https://github.com/zotero/reader and https://github.com/zotero/note-editor (the exact commits, the SHA-256 of each upstream build archive and the SHA-256 and byte length of every embedded file are recorded in the audit-only `src/core/citeproc/fixed-csl.ts` manifest and the generated `src/core/generated/zotero-reader-files.ts` list in the source distribution).

The two upstream builds carry third-party code inside them, each under its own license, and the upstream projects distribute the resulting works under the AGPL-3.0 as stated above:

  The reader embeds Zotero's fork of pdf.js (https://github.com/zotero/pdf.js at commit
  3ec7e00205d95c512a8d74fefee5228611416d46, reporting PDF.js 5.7.0), Copyright (c) Mozilla
  Foundation and pdf.js contributors, licensed under the Apache License 2.0. pdf.js ships its
  own license texts inside the embedded tree, which this distribution keeps unchanged:
  `zotero/reader/pdf/LICENSE` (Apache-2.0), `zotero/reader/pdf/web/wasm/LICENSE_JBIG2`,
  `LICENSE_OPENJPEG`, `LICENSE_QCMS`, `LICENSE_PDFJS_JBIG2`, `LICENSE_PDFJS_OPENJPEG`,
  `LICENSE_PDFJS_QCMS`, `zotero/reader/pdf/web/standard_fonts/LICENSE_FOXIT`,
  `LICENSE_LIBERATION`, `zotero/reader/pdf/web/cmaps/LICENSE` and
  `zotero/reader/pdf/web/iccs/LICENSE`. The complete Apache-2.0 text is also distributed at
  `licenses/Apache-2.0.txt`.

  The reader also embeds the libraries listed in the next section, and the note editor the ones
  listed there for it; the MathJax web fonts under `zotero/reader/mathjax-fonts` are the
  unmodified woff files of mathjax-full 3.2.2 (checked byte for byte), and the KaTeX fonts under
  `zotero/note-editor/assets/fonts` come with KaTeX 0.16.22. The reader's build scripts carry no
  separate license file and are distributed under the AGPL-3.0 with the reader.
  The `structured-document-text` module (commit 7963c11faac4595be3bbe86b7574704a22c67bed) has
  no license declaration of its own: its repository has no license file, its package manifest
  has no license field and its README says nothing about licensing. It is taken to be under the
  AGPL-3.0 by inference from the Zotero licensing page (https://www.zotero.org/support/licensing),
  which states: "Unless otherwise indicated, the source code of the Zotero project is released
  under the GNU Affero General Public License (version 3)."

Libraries inside the Zotero reader and note editor builds

The two builds above are minified bundles, so the packages inside them cannot be read off the files. The list below is the production dependency closure that the upstream projects pin themselves: `package.json` and `package-lock.json` of zotero/reader at commit e7a93982baaee820e1bf5604dbf7f86400c98272 and of zotero/note-editor at commit acec74d09b910cfb67e6fa05135faca06f525c11, plus the dependencies of the epub.js fork (github.com/zotero/epub.js at commit e68c8b9c868be6ccb5b9684213117e95e52ef880, version 0.3.93, BSD-2-Clause) and of the prosemirror-math fork (github.com/zotero/prosemirror-math at commit 31bb011ed2537b63d3978cb227e60d9debb97e12). It leaves out the React family (react, react-dom, scheduler, prop-types, react-is, loose-envify, js-tokens, object-assign), which both builds load from outside and which is covered in the next section, and the packages that run only under Node or are type declarations only (esm, commander, argparse and the `@types` packages). `@babel/runtime` is a development dependency of the note editor, but its helper functions are compiled into the build. Each license text below was taken from the package's own published tarball (the SHA-512 of every tarball matches the `integrity` value in the upstream lock file), or, for the two Zotero forks, from the fork's repository at the pinned commit; the SHA-256 of every text is pinned in `scripts/verify-app.mjs`. Packages that share one license text share one file. The Apache-2.0 text is the original from https://www.apache.org/licenses/LICENSE-2.0.txt: for @fluent/bundle, @fluent/react, @fluent/sequence, cached-iterable and mj-context-menu the packages declare Apache-2.0 without shipping the text, so this is the text that applies to them. The license files in the tarballs of jszip (MIT or GPL-3.0-or-later; the MIT option is taken) and xmldom-sre (LGPL-2.0 or MIT; the MIT option is taken) offer a choice, and the files are kept whole.

  @abejellinek/readability-keep-nodes 1.0.0 (Apache-2.0; reader): licenses/readability-keep-nodes-LICENSE.txt
  @babel/runtime 7.24.8 (MIT; note editor): licenses/babel-runtime-LICENSE.txt
  @benrbray/prosemirror-math 1.0.0 (MIT; note editor): licenses/prosemirror-math-LICENSE.txt
  @fluent/bundle 0.19.1 (Apache-2.0; reader and note editor): licenses/Apache-2.0.txt
  @fluent/react 0.15.2 (Apache-2.0; reader and note editor): licenses/Apache-2.0.txt
  @fluent/sequence 0.8.0 (Apache-2.0; reader and note editor): licenses/Apache-2.0.txt
  cached-iterable 0.3.0 (Apache-2.0; reader and note editor): licenses/Apache-2.0.txt
  classnames 2.3.2 (MIT; reader): licenses/classnames-LICENSE.txt
  classnames 2.5.1 (MIT; note editor): licenses/classnames-LICENSE.txt
  core-js 3.37.1 (MIT; note editor): licenses/core-js-LICENSE.txt
  core-util-is 1.0.3 (MIT; reader): licenses/core-util-is-LICENSE.txt
  cssesc 3.0.0 (MIT; reader): licenses/cssesc-LICENSE.txt
  d 1.0.1 (ISC; reader): licenses/d-LICENSE.txt
  darkreader 4.9.83 (MIT; reader): licenses/darkreader-LICENSE.txt
  eld 2.0.2 (Apache-2.0; reader): licenses/eld-LICENSE.txt
  entities 4.5.0 (BSD-2-Clause; note editor): licenses/entities-LICENSE.txt
  epubjs 0.3.93 (BSD-2-Clause; reader): licenses/epubjs-LICENSE.txt
  es5-ext 0.10.62 (ISC; reader): licenses/es5-ext-LICENSE.txt
  es6-iterator 2.0.3 (MIT; reader): licenses/es6-iterator-LICENSE.txt
  es6-symbol 3.1.3 (ISC; reader): licenses/d-LICENSE.txt
  event-emitter 0.3.5 (MIT; reader): licenses/event-emitter-LICENSE.txt
  ext 1.7.0 (ISC; reader): licenses/es5-ext-LICENSE.txt
  immediate 3.0.6 (MIT; reader): licenses/immediate-LICENSE.txt
  inherits 2.0.4 (ISC; reader): licenses/inherits-LICENSE.txt
  jszip 3.10.1 ((MIT OR GPL-3.0-or-later); reader): licenses/jszip-LICENSE.txt
  katex 0.16.22 (MIT; note editor): licenses/katex-LICENSE.txt
  lie 3.3.0 (MIT; reader): licenses/lie-LICENSE.txt
  linkify-it 5.0.0 (MIT; note editor): licenses/linkify-it-LICENSE.txt
  luaparse 0.3.1 (MIT; reader): licenses/luaparse-LICENSE.txt
  markdown-it 14.1.0 (MIT; note editor): licenses/markdown-it-LICENSE.txt
  mathjax-full 3.2.2 (Apache-2.0; reader): licenses/Apache-2.0.txt
  mdurl 2.0.0 (MIT; note editor): licenses/mdurl-LICENSE.txt
  mhchemparser 4.2.1 (Apache-2.0; reader): licenses/mhchemparser-LICENSE.txt
  mj-context-menu 0.6.1 (Apache-2.0; reader): licenses/Apache-2.0.txt
  next-tick 1.1.0 (ISC; reader): licenses/next-tick-LICENSE.txt
  orderedmap 2.1.1 (MIT; note editor): licenses/orderedmap-LICENSE.txt
  pako 1.0.11 ((MIT AND Zlib); reader): licenses/pako-LICENSE.txt
  postcss-selector-parser 6.0.13 (MIT; reader): licenses/postcss-selector-parser-LICENSE.txt
  process-nextick-args 2.0.1 (MIT; reader): licenses/process-nextick-args-LICENSE.txt
  prosemirror-commands 1.7.1 (MIT; note editor): licenses/prosemirror-LICENSE.txt
  prosemirror-dropcursor 1.8.2 (MIT; note editor): licenses/prosemirror-LICENSE.txt
  prosemirror-gapcursor 1.3.2 (MIT; note editor): licenses/prosemirror-LICENSE.txt
  prosemirror-history 1.4.1 (MIT; note editor): licenses/prosemirror-LICENSE.txt
  prosemirror-inputrules 1.5.0 (MIT; note editor): licenses/prosemirror-LICENSE.txt
  prosemirror-keymap 1.2.3 (MIT; note editor): licenses/prosemirror-LICENSE.txt
  prosemirror-markdown 1.13.2 (MIT; note editor): licenses/prosemirror-LICENSE.txt
  prosemirror-model 1.25.2 (MIT; note editor): licenses/prosemirror-LICENSE.txt
  prosemirror-schema-basic 1.2.4 (MIT; note editor): licenses/prosemirror-LICENSE.txt
  prosemirror-schema-list 1.5.1 (MIT; note editor): licenses/prosemirror-LICENSE.txt
  prosemirror-state 1.4.3 (MIT; note editor): licenses/prosemirror-LICENSE.txt
  prosemirror-tables 1.7.1 (MIT; note editor): licenses/prosemirror-tables-LICENSE.txt
  prosemirror-transform 1.10.4 (MIT; note editor): licenses/prosemirror-LICENSE.txt
  prosemirror-utils 1.2.2 (Apache-2.0; note editor): licenses/prosemirror-utils-LICENSE.txt
  prosemirror-view 1.40.1 (MIT; note editor): licenses/prosemirror-LICENSE.txt
  punycode.js 2.3.1 (MIT; note editor): licenses/cssesc-LICENSE.txt
  queue 6.0.2 (MIT; reader): licenses/queue-LICENSE.txt
  readable-stream 2.3.7 (MIT; reader): licenses/readable-stream-LICENSE.txt
  rope-sequence 1.3.4 (MIT; note editor): licenses/rope-sequence-LICENSE.txt
  safe-buffer 5.1.2 (MIT; reader): licenses/safe-buffer-LICENSE.txt
  sentencex-ts 0.1.13-ts (MIT; reader): licenses/sentencex-ts-LICENSE.txt
  setimmediate 1.0.5 (MIT; reader): licenses/setimmediate-LICENSE.txt
  sorted-btree 1.8.1 (MIT; reader): licenses/sorted-btree-LICENSE.txt
  speech-rule-engine 4.0.7 (Apache-2.0; reader): licenses/speech-rule-engine-LICENSE.txt
  string_decoder 1.1.1 (MIT; reader): licenses/string_decoder-LICENSE.txt
  type 1.2.0 (ISC; reader): licenses/type-1.2.0-LICENSE.txt
  type 2.7.2 (ISC; reader): licenses/type-LICENSE.txt
  uc.micro 2.1.0 (MIT; note editor): licenses/cssesc-LICENSE.txt
  util-deprecate 1.0.2 (MIT; reader): licenses/util-deprecate-LICENSE.txt
  wicked-good-xpath 1.3.0 (MIT; reader): licenses/wicked-good-xpath-LICENSE.txt
  xmldom-sre 0.1.31 ((LGPL-2.0 or MIT); reader): licenses/xmldom-sre-LICENSE.txt

Two packages in the reader's list publish no license text. isarray 1.0.0 (Copyright (c) 2013 Julian Gruber, MIT, stated in the package README) and path-webpack 0.0.3 (MIT, stated in the package manifest; the package names no copyright holder and adapts the Node.js `path` module) are embedded under the MIT License, whose text is reproduced in full under XRegExp above.

React (used by the Zotero reader and note editor)

The `zotero` builds of the reader and the note editor leave React out of their bundles and load it from three fixed addresses, so CiteDesk embeds the UMD builds of the versions pinned by the Zotero dependency lock. They are the unmodified files from the npm packages (the SHA-512 of each downloaded package matches the `integrity` value in Zotero's `package-lock.json`), and they are served only to the reader window.

  react 18.3.1 (`umd/react.production.min.js`), react-dom 18.3.1
  (`umd/react-dom.production.min.js`, which also contains scheduler 0.23.2)
  Copyright (c) Facebook, Inc. and its affiliates. (later releases: Copyright (c) Meta
  Platforms, Inc. and affiliates.)
  License: MIT; full text at `licenses/react-LICENSE.txt`.
  Source: https://github.com/facebook/react

  prop-types 15.8.1 (`prop-types.js`)
  Copyright (c) 2013-present, Facebook, Inc.
  License: MIT; full text at `licenses/prop-types-LICENSE.txt`.
  Source: https://github.com/facebook/prop-types

Zotero interface text for the reader and note editor

The reader and the note editor take their interface text as Fluent source passed in by the host, so CiteDesk embeds Zotero's `zotero.ftl`, `reader.ftl` and `note-editor.ftl` for the three interface languages the application has (zh-CN, en-US, ko-KR), unmodified, from the Zotero source tree at commit db41b99fddcc52d38897c59c161b6adaca036afb.

Copyright (c) Corporation for Digital Scholarship, Zotero contributors and the Zotero translation contributors. License: GNU Affero General Public License version 3 (AGPL-3.0); the complete legal text is distributed at `licenses/AGPL-3.0.txt`. The Fluent files carry no license header of their own; they are distributed as part of the Zotero client under the AGPL-3.0 and are embedded here on the same terms (the manifest marks them `licenseHeader: false`). Source: https://github.com/zotero/zotero/tree/db41b99fddcc52d38897c59c161b6adaca036afb/chrome/locale

CiteDesk adds its own supplement files after Zotero's (`citedesk-l10n/<language>/reader-overrides.ftl` and `note-editor-overrides.ftl`): translations for sentences that the upstream ko-KR text still leaves in English, and the `-app-name` and `-subscription-name` brand terms that Zotero keeps in `brand.ftl`. These files are CiteDesk's own work, distributed under the AGPL-3.0 like the rest of the application.

npm packages bundled into the application scripts

The renderer script in `dist/` is built from the following npm packages (the CodeMirror editor, its parsers and helpers, MathJax, the Lucide icon set, and the on-demand language packs and Mermaid listed at the end of this section), each at the exact version pinned by the dependency lock. They are bundled and minified unmodified. Each package's own license file is distributed byte for byte at the path given below.

CodeMirror
  @codemirror/autocomplete 6.20.3, @codemirror/commands 6.11.1, @codemirror/lang-css 6.3.1,
  @codemirror/lang-html 6.4.12, @codemirror/lang-javascript 6.2.5,
  @codemirror/lang-markdown 6.5.2, @codemirror/language 6.13.1, @codemirror/search 6.7.2,
  @codemirror/state 6.7.6, @codemirror/streamparser 6.0.0, @codemirror/view 6.43.14
  Copyright (C) 2018-2021 by Marijn Haverbeke <marijn@haverbeke.berlin> and others
  License: MIT; full text at `licenses/codemirror-LICENSE.txt`.
  Source: https://code.haverbeke.berlin/codemirror (mirrored at https://github.com/codemirror)

Lezer
  @lezer/common 1.5.3, @lezer/css 1.3.9, @lezer/highlight 1.2.5, @lezer/html 1.3.13,
  @lezer/javascript 1.5.6, @lezer/lr 1.4.11
  Copyright (C) 2018 by Marijn Haverbeke <marijn@haverbeke.berlin> and others
  License: MIT; full text at `licenses/lezer-LICENSE.txt`.
  Source: https://code.haverbeke.berlin/lezer (mirrored at https://github.com/lezer-parser)

  @lezer/markdown 1.8.0
  Copyright (C) 2020 by Marijn Haverbeke <marijn@haverbeke.berlin> and others
  License: MIT; full text at `licenses/lezer-markdown-LICENSE.txt`.
  Source: https://code.haverbeke.berlin/lezer/markdown

Helpers used by CodeMirror
  @marijn/find-cluster-break 1.0.4
  Copyright (C) 2024 by Marijn Haverbeke <marijn@haverbeke.berlin>
  License: MIT; full text at `licenses/find-cluster-break-LICENSE.txt`.
  Source: https://code.haverbeke.berlin/marijn/find-cluster-break

  crelt 1.0.7
  Copyright (C) 2020 by Marijn Haverbeke <marijn@haverbeke.berlin>
  License: MIT; full text at `licenses/crelt-LICENSE.txt`.
  Source: https://code.haverbeke.berlin/marijn/crelt

  style-mod 4.1.4
  Copyright (C) 2018 by Marijn Haverbeke <marijn@haverbeke.berlin> and others
  License: MIT; full text at `licenses/style-mod-LICENSE.txt`.
  Source: https://code.haverbeke.berlin/marijn/style-mod

  w3c-keyname 2.2.8
  Copyright (C) 2016 by Marijn Haverbeke <marijn@haverbeke.berlin> and others
  License: MIT; full text at `licenses/w3c-keyname-LICENSE.txt`.
  Source: https://github.com/marijnh/w3c-keyname

MathJax
  @mathjax/src 4.1.3
  Copyright (c) 2017-2026 The MathJax Consortium
  @mathjax/mathjax-tex-font 4.1.3, @mathjax/mathjax-mhchem-font-extension 4.1.3
  Copyright (c) 2022, MathJax, Inc.
  License: Apache-2.0; full text at `licenses/Apache-2.0.txt`. The two font packages are published to
  npm without a license file; their package.json gives Apache-2.0. The formula renderer is loaded on
  demand the first time a formula is drawn; the fonts' woff2 files are distributed unmodified in
  `dist/assets/mathjax/`.
  Source: https://github.com/mathjax/MathJax-src and https://github.com/mathjax/MathJax-fonts

  mhchemparser 4.2.1
  Copyright (c) 2015-2023 Martin Hensel
  License: Apache-2.0; full text at `licenses/mhchemparser-LICENSE.txt`.
  Source: https://github.com/mhchem/mhchemParser

Lucide
  lucide 1.59.0
  Copyright (c) 2026 Lucide Icons and Contributors
  License: ISC. The icons that Lucide derives from the Feather project are additionally
  Copyright (c) 2013-present Cole Bemis and licensed under the MIT License. Both notices and
  the list of derived icons are in the full text at `licenses/lucide-LICENSE.txt`.
  Source: https://github.com/lucide-icons/lucide

diff (three-way merge of external file changes)
  diff 9.0.0
  Copyright (c) 2009-2015, Kevin Decker <kpdecker@gmail.com>
  License: BSD-3-Clause; full text at `licenses/diff-LICENSE.txt`.
  Source: https://github.com/kpdecker/jsdiff

yaml
  yaml 2.9.1
  Copyright Eemeli Aro <eemeli@gmail.com>
  License: ISC; full text at `licenses/yaml-LICENSE.txt`.
  Source: https://github.com/eemeli/yaml

jspath (translator sandbox page)
  jspath 0.4.0
  Copyright (c) 2012 Dmitry Filatov
  License: MIT; full text at `licenses/jspath-LICENSE.txt`.
  Source: https://github.com/dfilatov/jspath
  Used by custom "Find Full Text" resolvers in JSON mode (the findPDFs.resolvers setting), as Zotero does.
  It compiles paths with Function(), so it only runs in the translator sandbox page.

Manuscript export
  fflate 0.8.3
  Copyright (c) 2026 Arjun Barrett
  License: MIT; full text at `licenses/fflate-LICENSE.txt`.
  Source: https://github.com/101arrowz/fflate
  Used to write the ZIP package of exported Word manuscripts.

  parse5 8.0.1
  Copyright (c) 2013-2019 Ivan Nikulin (ifaaan@gmail.com, https://github.com/inikulin)
  License: MIT; full text at `licenses/parse5-LICENSE.txt`.
  Source: https://github.com/inikulin/parse5
  Used to parse citeproc HTML for rich-text manuscript serialization.

  entities 8.1.0
  Copyright (c) Felix Böhm
  License: BSD-2-Clause; full text at `licenses/entities-LICENSE.txt`.
  Source: https://github.com/fb55/entities
  Used by parse5 to read HTML character references. Its license file is byte for byte
  identical to the entities 4.5.0 license distributed with the Zotero note editor above.

EPUB full-text extraction

  @xmldom/xmldom 0.9.12
  Copyright 2019 - present Christopher J. Brody and other contributors
  Copyright 2012 - 2017 @jindw <jindw@xidea.org> and other contributors
  License: MIT; full text at `licenses/xmldom-LICENSE.txt`.
  Source: https://github.com/xmldom/xmldom
  Parses the chapters and the package file of an EPUB as XML, as Zotero does with DOMParser, to
  index the text of the book. It reads files the user has added to the library and fetches nothing.

Account sign-in (OpenID Connect client)

The main process signs in to the account service with the OpenID Connect authorization code flow and PKCE (RFC 8252), through the system browser. These npm packages are bundled unmodified into the main-process script `dist-electron/main.cjs`; they run only there, never in a window.

  openid-client 6.8.8
  Copyright (c) 2016 Filip Skokan
  License: MIT; full text at `licenses/openid-client-LICENSE.txt`.
  Source: https://github.com/panva/openid-client

  oauth4webapi 3.8.8
  Copyright (c) 2022 Filip Skokan
  License: MIT; full text at `licenses/oauth4webapi-LICENSE.txt`.
  Source: https://github.com/panva/oauth4webapi

  jose 6.2.12
  Copyright (c) 2018 Filip Skokan
  License: MIT; full text at `licenses/jose-LICENSE.txt`.
  Source: https://github.com/panva/jose

PDF manuscript pagination

The script `dist-electron/pdf-paginate.js` is built from the following npm packages, each at the exact version pinned by the dependency lock, bundled and minified unmodified. It runs only in the hidden print page of a PDF manuscript export whose notes are placed at the foot of the page, where it splits the manuscript into pages so that each note is printed at the bottom of its own page.

  pagedjs 0.4.3
  Copyright (c) 2018 Adam Hyde
  License: MIT; full text at `licenses/pagedjs-LICENSE.txt`.
  Source: https://gitlab.coko.foundation/pagedjs/pagedjs (https://github.com/pagedjs/pagedjs)

  css-tree 1.1.3
  Copyright (C) 2016-2019 by Roman Dvornov
  License: MIT; full text at `licenses/css-tree-LICENSE.txt`.
  Source: https://github.com/csstree/csstree

  mdn-data 2.0.14
  License: CC0-1.0; full text at `licenses/mdn-data-LICENSE.txt`.
  Source: https://github.com/mdn/data

  source-map 0.6.1
  Copyright (c) 2009-2011, Mozilla Foundation and contributors
  License: BSD-3-Clause; full text at `licenses/source-map-LICENSE.txt`.
  Source: https://github.com/mozilla/source-map

  clear-cut 2.0.2
  Copyright (c) 2014 GitHub Inc.
  License: MIT; full text at `licenses/clear-cut-LICENSE.txt`.
  Source: https://github.com/github/clear-cut

  event-emitter 0.3.5
  Copyright (C) 2012-2015 Mariusz Nowak (www.medikoo.com)
  License: MIT; full text at `licenses/event-emitter-LICENSE.txt`.
  Source: https://github.com/medikoo/event-emitter

  d 1.0.2, es6-symbol 3.1.4
  Copyright (c) 2013-2024, Mariusz Nowak, @medikoo, medikoo.com
  License: ISC; full text at `licenses/d-1.0.2-LICENSE.txt`.
  Source: https://github.com/medikoo/d, https://github.com/medikoo/es6-symbol

  es5-ext 0.10.64
  Copyright (c) 2011-2024, Mariusz Nowak, @medikoo, medikoo.com
  License: ISC; full text at `licenses/es5-ext-0.10.64-LICENSE.txt`.
  Source: https://github.com/medikoo/es5-ext

  ext 1.7.0
  Copyright (c) 2011-2022, Mariusz Nowak, @medikoo, medikoo.com
  License: ISC; full text at `licenses/es5-ext-LICENSE.txt` (the same text as the ext license).
  Source: https://github.com/medikoo/es5-ext/tree/main/ext (https://github.com/medikoo/ext)

  type 2.7.3
  Copyright (c) 2019-2024, Mariusz Nowak, @medikoo, medikoo.com
  License: ISC; full text at `licenses/type-2.7.3-LICENSE.txt`.
  Source: https://github.com/medikoo/type

Code highlighting and Mermaid diagrams

The language packs behind fenced-code colouring (`@codemirror/language-data`, loaded on demand) and the Mermaid diagram renderer with its dependencies (loaded on demand the first time a diagram is drawn) are bundled unmodified, each at the exact version pinned by the dependency lock. Packages that appear in more than one version are listed once per version.

  @braintree/sanitize-url 7.1.2  (https://github.com/braintree/sanitize-url)
  License: MIT; full text at `licenses/braintree-sanitize-url-LICENSE.txt`.

  @chevrotain/cst-dts-gen 13.2.0  (https://github.com/Chevrotain/chevrotain)
  @chevrotain/gast 13.2.0  (https://github.com/Chevrotain/chevrotain)
  @chevrotain/regexp-to-ast 13.2.0  (https://github.com/Chevrotain/chevrotain)
  @chevrotain/utils 13.2.0  (https://github.com/Chevrotain/chevrotain)
  chevrotain 13.2.0  (https://github.com/Chevrotain/chevrotain)
  dompurify 3.4.16  (https://github.com/cure53/DOMPurify)
  License: Apache-2.0 for chevrotain and its sub-packages. dompurify is offered under (MPL-2.0 OR Apache-2.0)
  and CiteDesk elects Apache-2.0; its own license file is the Apache-2.0 text. Full text at `licenses/Apache-2.0.txt`.

  @codemirror/lang-angular 0.1.4  (https://github.com/codemirror/lang-angular)
  @codemirror/lang-cpp 6.0.3  (https://github.com/codemirror/lang-cpp)
  @codemirror/lang-java 6.0.2  (https://github.com/codemirror/lang-java)
  @codemirror/lang-json 6.0.2  (https://github.com/codemirror/lang-json)
  @codemirror/lang-less 6.0.2  (https://github.com/codemirror/lang-less)
  @codemirror/lang-php 6.0.2  (https://github.com/codemirror/lang-php)
  @codemirror/lang-python 6.2.1  (https://github.com/codemirror/lang-python)
  @codemirror/lang-rust 6.0.2  (https://github.com/codemirror/lang-rust)
  @codemirror/lang-sass 6.0.2  (https://github.com/codemirror/lang-sass)
  @codemirror/lang-sql 6.10.0  (https://github.com/codemirror/lang-sql)
  @codemirror/lang-vue 0.1.3  (https://github.com/codemirror/lang-vue)
  @codemirror/lang-wast 6.0.2  (https://github.com/codemirror/lang-wast)
  @codemirror/lang-xml 6.1.0  (https://github.com/codemirror/lang-xml)
  @codemirror/language-data 6.5.2  (https://github.com/codemirror/language-data)
  @codemirror/legacy-modes 6.5.5  (https://code.haverbeke.berlin/codemirror/legacy-modes)
  License: MIT; full text at `licenses/codemirror-LICENSE.txt`.

  @codemirror/lang-go 6.0.1  (https://github.com/codemirror/lang-go)
  @codemirror/lang-yaml 6.1.3  (https://github.com/codemirror/lang-yaml)
  License: MIT; full text at `licenses/codemirror-lang-go-LICENSE.txt`.

  @codemirror/lang-jinja 6.0.1  (https://code.haverbeke.berlin/codemirror/lang-jinja)
  License: MIT; full text at `licenses/codemirror-lang-jinja-LICENSE.txt`.

  @codemirror/lang-liquid 6.3.3  (https://code.haverbeke.berlin/codemirror/lang-liquid)
  License: MIT; full text at `licenses/codemirror-lang-liquid-LICENSE.txt`.

  @iconify/utils 3.1.7  (https://github.com/iconify/iconify)
  License: MIT; full text at `licenses/iconify-utils-LICENSE.txt`.

  @lezer/cpp 1.1.6  (https://code.haverbeke.berlin/lezer/cpp)
  @lezer/go 1.0.1  (https://github.com/lezer-parser/go)
  @lezer/java 1.1.5  (https://code.haverbeke.berlin/lezer/java)
  @lezer/python 1.1.19  (https://code.haverbeke.berlin/lezer/python)
  License: MIT; full text at `licenses/lezer-markdown-LICENSE.txt`.

  @lezer/json 1.0.3  (https://github.com/lezer-parser/json)
  License: MIT; full text at `licenses/lezer-json-LICENSE.txt`.

  @lezer/php 1.0.6  (https://code.haverbeke.berlin/lezer/php)
  @lezer/rust 1.0.3  (https://code.haverbeke.berlin/lezer/rust)
  @lezer/sass 1.1.0  (https://github.com/lezer-parser/sass)
  @lezer/xml 1.0.6  (https://github.com/lezer-parser/xml)
  License: MIT; full text at `licenses/lezer-LICENSE.txt`.

  @lezer/yaml 1.0.4  (https://github.com/lezer-parser/yaml)
  License: MIT; full text at `licenses/lezer-yaml-LICENSE.txt`.

  @mermaid-js/parser 2.0.1  (https://github.com/mermaid-js/mermaid)
  License: MIT; full text at `licenses/mermaid-js-parser-LICENSE.txt`.

  @upsetjs/venn.js 2.0.0  (https://github.com/upsetjs/venn.js)
  License: MIT; full text at `licenses/upsetjs-venn.js-LICENSE.txt`.

  cose-base 1.0.3  (https://github.com/iVis-at-Bilkent/cose-base)
  cose-base 2.2.0  (https://github.com/iVis-at-Bilkent/cose-base)
  License: MIT; full text at `licenses/cose-base-1.0.3-LICENSE.txt`.

  cytoscape 3.34.3  (https://github.com/cytoscape/cytoscape.js)
  License: MIT; full text at `licenses/cytoscape-LICENSE.txt`.

  cytoscape-cose-bilkent 4.1.0  (https://github.com/cytoscape/cytoscape.js-cose-bilkent)
  License: MIT; full text at `licenses/cytoscape-cose-bilkent-LICENSE.txt`.

  cytoscape-fcose 2.2.0  (https://github.com/iVis-at-Bilkent/cytoscape.js-fcose)
  License: MIT; full text at `licenses/cytoscape-fcose-LICENSE.txt`.

  d3 7.9.0  (https://github.com/d3/d3)
  d3-array 3.2.4  (https://github.com/d3/d3-array)
  License: ISC; full text at `licenses/d3-LICENSE.txt`.

  d3-array 2.12.1  (https://github.com/d3/d3-array)
  License: BSD-3-Clause; full text at `licenses/d3-array-2.12.1-LICENSE.txt`.

  d3-axis 3.0.0  (https://github.com/d3/d3-axis)
  d3-brush 3.0.0  (https://github.com/d3/d3-brush)
  d3-chord 3.0.1  (https://github.com/d3/d3-chord)
  d3-dispatch 3.0.1  (https://github.com/d3/d3-dispatch)
  d3-drag 3.0.0  (https://github.com/d3/d3-drag)
  d3-force 3.0.0  (https://github.com/d3/d3-force)
  d3-hierarchy 3.1.2  (https://github.com/d3/d3-hierarchy)
  d3-interpolate 3.0.1  (https://github.com/d3/d3-interpolate)
  d3-polygon 3.0.1  (https://github.com/d3/d3-polygon)
  d3-quadtree 3.0.1  (https://github.com/d3/d3-quadtree)
  d3-random 3.0.1  (https://github.com/d3/d3-random)
  d3-scale 4.0.2  (https://github.com/d3/d3-scale)
  d3-selection 3.0.0  (https://github.com/d3/d3-selection)
  d3-time-format 4.1.0  (https://github.com/d3/d3-time-format)
  d3-timer 3.0.1  (https://github.com/d3/d3-timer)
  d3-transition 3.0.1  (https://github.com/d3/d3-transition)
  d3-zoom 3.0.0  (https://github.com/d3/d3-zoom)
  License: ISC; full text at `licenses/d3-axis-LICENSE.txt`.

  d3-color 3.1.0  (https://github.com/d3/d3-color)
  d3-shape 3.2.0  (https://github.com/d3/d3-shape)
  d3-time 3.1.0  (https://github.com/d3/d3-time)
  License: ISC; full text at `licenses/d3-color-LICENSE.txt`.

  d3-contour 4.0.2  (https://github.com/d3/d3-contour)
  License: ISC; full text at `licenses/d3-contour-LICENSE.txt`.

  d3-delaunay 6.0.4  (https://github.com/d3/d3-delaunay)
  License: ISC; full text at `licenses/d3-delaunay-LICENSE.txt`.

  d3-dsv 3.0.1  (https://github.com/d3/d3-dsv)
  License: ISC; full text at `licenses/d3-dsv-LICENSE.txt`.

  d3-ease 3.0.1  (https://github.com/d3/d3-ease)
  License: BSD-3-Clause; full text at `licenses/d3-ease-LICENSE.txt`.

  d3-fetch 3.0.1  (https://github.com/d3/d3-fetch)
  License: ISC; full text at `licenses/d3-fetch-LICENSE.txt`.

  d3-format 3.1.2  (https://github.com/d3/d3-format)
  License: ISC; full text at `licenses/d3-format-LICENSE.txt`.

  d3-geo 3.1.1  (https://github.com/d3/d3-geo)
  License: ISC; full text at `licenses/d3-geo-LICENSE.txt`.

  d3-path 1.0.9  (https://github.com/d3/d3-path)
  License: BSD-3-Clause; full text at `licenses/d3-path-1.0.9-LICENSE.txt`.

  d3-path 3.1.0  (https://github.com/d3/d3-path)
  License: ISC; full text at `licenses/d3-path-3.1.0-LICENSE.txt`.

  d3-sankey 0.12.3  (https://github.com/d3/d3-sankey)
  License: BSD-3-Clause; full text at `licenses/d3-sankey-LICENSE.txt`.

  d3-scale-chromatic 3.1.0  (https://github.com/d3/d3-scale-chromatic)
  License: ISC; full text at `licenses/d3-scale-chromatic-LICENSE.txt`.

  d3-shape 1.3.7  (https://github.com/d3/d3-shape)
  License: BSD-3-Clause; full text at `licenses/d3-shape-1.3.7-LICENSE.txt`.

  dagre-d3-es 7.0.14  (https://github.com/tbo47/dagre-es)
  License: MIT; full text at `licenses/dagre-d3-es-LICENSE.txt`.

  dayjs 1.11.23  (https://github.com/iamkun/dayjs)
  License: MIT; full text at `licenses/dayjs-LICENSE.txt`.

  delaunator 5.1.0  (https://github.com/mapbox/delaunator)
  License: ISC; full text at `licenses/delaunator-LICENSE.txt`.

  es-toolkit 1.52.0  (https://github.com/toss/es-toolkit)
  License: MIT; full text at `licenses/es-toolkit-LICENSE.txt`.

  internmap 1.0.1  (https://github.com/mbostock/internmap)
  internmap 2.0.3  (https://github.com/mbostock/internmap)
  License: ISC; full text at `licenses/internmap-1.0.1-LICENSE.txt`.

  katex 0.18.10  (https://github.com/KaTeX/KaTeX; Mermaid uses it for formulas in diagram labels)
  License: MIT; full text at `licenses/katex-LICENSE.txt`.

  khroma 2.1.0  (https://github.com/fabiospampinato/khroma)
  License: ""; full text at `licenses/khroma-LICENSE.txt`.

  layout-base 1.0.2  (https://github.com/iVis-at-Bilkent/layout-base)
  layout-base 2.0.1  (https://github.com/iVis-at-Bilkent/layout-base)
  License: MIT; full text at `licenses/layout-base-1.0.2-LICENSE.txt`.

  lodash-es 4.18.1  (lodash/lodash)
  License: MIT; full text at `licenses/lodash-es-LICENSE.txt`.

  marked 16.4.2  (https://github.com/markedjs/marked)
  License: MIT; full text at `licenses/marked-LICENSE.txt`.

  mermaid 12.2.0  (https://github.com/mermaid-js/mermaid)
  License: MIT; full text at `licenses/mermaid-LICENSE.txt`.

  robust-predicates 3.0.3  (https://github.com/mourner/robust-predicates)
  License: Unlicense; full text at `licenses/robust-predicates-LICENSE.txt`.

  roughjs 4.6.6  (https://github.com/pshihn/rough)
  License: MIT; full text at `licenses/roughjs-LICENSE.txt`.

  stylis 4.4.0  (https://github.com/thysultan/stylis.js)
  License: MIT; full text at `licenses/stylis-LICENSE.txt`.

  ts-dedent 2.3.0  (https://github.com/tamino-martinius/node-ts-dedent)
  License: MIT; full text at `licenses/ts-dedent-LICENSE.txt`.

  uuid 14.0.3  (https://github.com/uuidjs/uuid)
  License: MIT; full text at `licenses/uuid-LICENSE.txt`.

  elkjs 0.12.0  (https://github.com/kieler/elkjs)
  License: EPL-2.0 OR GPL-3.0-or-later (the project declares the GNU General Public License v3.0 or
  later as the Secondary License in its LICENSE and file headers; CiteDesk uses it under the
  GPL-3.0-or-later option, together with its AGPL-3.0 code); bundled unmodified; the source is
  kieler/elkjs tag 0.12.0 together with eclipse-elk/elk tag v0.12.0, kept in vendor/elkjs/0.12.0;
  full text at `licenses/elkjs-LICENSE.txt`.

CiteDesk's own license does not replace the licenses of these third-party components.

The distributed application (its scripts in `dist/` and `dist-electron/`, the embedded Zotero reader and note editor, and the resources that ship beside them) combines CiteDesk's own code with the AGPL-3.0 components listed above (the Zotero reader, the Zotero note editor, the Zotero translators and utilities, the Zotero interface text, SingleFile, and citeproc-js, which CiteDesk uses under its AGPL-3.0 option) and with the GPL-3.0-or-later and GPL-2.0-or-later translators (the latter under GPL-3.0) and the Apache-2.0 translator, which the AGPL-3.0 permits to be combined with it. The combined application is therefore conveyed as a whole under the terms of the GNU Affero General Public License version 3, and CiteDesk's own source code is released under that same license. Each third-party component keeps its own license.

Zotero document-worker

CiteDesk embeds the unchanged CI build of zotero/document-worker at commit 8fb70af4000873561c82b2f4eb88be190efb9979, pinned by Zotero main at 15f6a81181dd696349447cb542cec56ff1d621f4. The upstream build is published at https://zotero-download.s3.amazonaws.com/ci/document-worker/8fb70af4000873561c82b2f4eb88be190efb9979.zip. The complete build is retained except for cmaps/ and standard_fonts/, which Zotero also serves from the reader tree. The 11 retained files are not modified. The worker runs in a separate hidden renderer with a narrow preload bridge and no external network access.

Copyright (c) 2020 Corporation for Digital Scholarship, Vienna, Virginia, USA. The document-worker project declares AGPL-3.0 in its package manifest and COPYING. Its complete original COPYING, including the project-specific copyright statement, is distributed at licenses/document-worker-AGPL-3.0.txt. The five block-seg model/data files come from this same fixed source tree; no separate model license declaration was found.

The fixed pdf.js submodule is f4d05caed86bd38f6ccd2171dbbd5cb832d72912. The `structured-document-text` module (commit 7963c11faac4595be3bbe86b7574704a22c67bed) has no license declaration of its own: its repository has no license file, its package manifest has no license field and its README says nothing about licensing. It is taken to be under the AGPL-3.0 by inference from the Zotero licensing page (https://www.zotero.org/support/licensing), which states: "Unless otherwise indicated, the source code of the Zotero project is released under the GNU Affero General Public License (version 3)."

The JavaScript bundle includes the 11 npm packages listed below: dom-serializer, domelementtype, domhandler, domutils, entities, fastest-levenshtein, fflate, htmlparser2, pako, onnxruntime-web and onnxruntime-common. Versions and complete original texts follow. The ONNX runtime was taken from onnxruntime-web 1.27.0; its wasm bytes match that package. The npm package does not include a separate LICENSE file. The MIT text and the complete upstream ThirdPartyNotices are from the v1.27.0 source commit 8f0278c77bf44b0cc83c098c6c722b92a36ac4b5. Those notices are the upstream product-wide collection, not a claim that every named native dependency is linked into this wasm.

Original license texts and declarations, preserved byte for byte:

  document-worker and its block-seg model resources: licenses/document-worker-AGPL-3.0.txt
  dom-serializer 2.0.0: licenses/dom-serializer-LICENSE.txt
  domelementtype 2.3.0: licenses/entities-LICENSE.txt
  domhandler 5.0.3: licenses/entities-LICENSE.txt
  domutils 3.2.2: licenses/entities-LICENSE.txt
  entities 4.5.0: licenses/entities-LICENSE.txt
  fastest-levenshtein 1.0.16: licenses/fastest-levenshtein-LICENSE.txt
  fflate 0.8.2: licenses/fflate-0.8.2-LICENSE.txt
  htmlparser2 9.1.0: licenses/htmlparser2-LICENSE.txt
  pako 2.1.0: licenses/pako-LICENSE.txt
  onnxruntime-web 1.27.0: licenses/document-worker-onnxruntime-LICENSE.txt
  onnxruntime-common 1.27.0: licenses/document-worker-onnxruntime-LICENSE.txt
  ONNX Runtime ThirdPartyNotices 1.27.0: licenses/document-worker-onnxruntime-ThirdPartyNotices.txt
  pdf.js: licenses/speech-rule-engine-LICENSE.txt
  LICENSE_JBIG2: licenses/document-worker-pdfjs-LICENSE_JBIG2-LICENSE.txt
  LICENSE_PDFJS_JBIG2: licenses/document-worker-pdfjs-LICENSE_PDFJS_JBIG2-LICENSE.txt
  LICENSE_OPENJPEG: licenses/document-worker-pdfjs-LICENSE_OPENJPEG-LICENSE.txt
  LICENSE_PDFJS_OPENJPEG: licenses/document-worker-pdfjs-LICENSE_PDFJS_OPENJPEG-LICENSE.txt
  LICENSE_QCMS: licenses/document-worker-pdfjs-LICENSE_QCMS-LICENSE.txt
  LICENSE_PDFJS_QCMS: licenses/document-worker-pdfjs-LICENSE_PDFJS_QCMS-LICENSE.txt
  LICENSE_BROTLI: licenses/document-worker-pdfjs-LICENSE_BROTLI-LICENSE.txt
  pdfassembler: licenses/document-worker-pdfassembler-license-header.txt
  jsPDF ttffont: licenses/document-worker-jspdf-ttffont-license-header.txt
  css.escape 1.5.1: licenses/cssesc-LICENSE.txt
  colorjs: licenses/document-worker-colorjs-LICENSE.txt
  readability: licenses/readability-keep-nodes-LICENSE.txt
  doq: licenses/document-worker-doq-LICENSE.txt
  pako 2.1.0 embedded zlib: licenses/document-worker-pako-zlib-LICENSE.txt

Readability's Apache declaration above is accompanied by the complete Apache License 2.0 at licenses/Apache-2.0.txt. Pako's original MIT license and its complete embedded zlib license header are both included. The qcms JavaScript glue is bundled, but qcms_bg.wasm is not part of this document-worker build; retaining its upstream statements does not claim that the native qcms binary is shipped.

The consumer sources credit doq, color.js and Readability but do not identify their exact copied revisions. Their unmodified license texts were retrieved from fixed donor snapshots preceding the respective imports; these are license-source snapshots, not claims that the consumed code equals those snapshots. The snapshots and per-file hashes are recorded in scripts/document-worker-licenses.mjs. The document-worker source, build instructions, fixed resource identities and source URLs are included in the CiteDesk source distribution of this version.

Pandoc 3.12.1 (single-equation OMML conversion)

CiteDesk bundles the unmodified official Pandoc WASM module and the public JavaScript wrapper from source commit e51c9c6054c8f4ec5c3209d5abe10939dfe2963e. The same WASM bytes serve both macOS architectures. No installed Word, global Pandoc or user Pandoc configuration is used. Only one MathJax MathML expression is passed to the converter, never a manuscript. Conversions run one at a time in a Node worker that compiles the WASM once, with a virtual WASI file system holding only the current expression; the host terminates the worker on failure, cancellation, timeout, idleness or after a fixed number of conversions. The wrapper's fixed CDN import (which names version 0.3.0) is resolved at build time to the npm dependency below, currently 0.4.2, whose interface the wrapper uses unchanged; its fixed fetch request is answered with the bundled WASM bytes inside that isolated worker. No conversion code or resulting OMML characters are modified.

Pandoc: Copyright (C) 2006-2024 John MacFarlane and contributors. License: GPL-2.0-or-later, with additional notices reproduced byte for byte in licenses/pandoc-COPYRIGHT.txt and the complete legal text in licenses/pandoc-GPL-2.0.txt. The upstream COPYRIGHT includes the Lua notice and other component notices. The WASM interface and patches are MIT licensed; complete upstream text: licenses/pandoc-wasm-MIT.txt. texmath 0.13.3.1 (pinned by Pandoc's stack.yaml): GPL-2.0-or-later; complete upstream license text: licenses/texmath-GPL-2.0.txt. @bjorn3/browser_wasi_shim 0.4.2 (MIT OR Apache-2.0): CiteDesk elects the MIT option; complete package license text: licenses/browser-wasi-shim-MIT.txt.

Official module archive: https://github.com/jgm/pandoc/releases/download/3.12.1/pandoc-3.12.1.wasm.zip Pandoc source: https://github.com/jgm/pandoc/tree/e51c9c6054c8f4ec5c3209d5abe10939dfe2963e texmath source: https://github.com/jgm/texmath/tree/a7600d953690166e9917dc6f34a5d1e7c5844c4a WASI shim source: https://github.com/bjorn3/browser_wasi_shim Exact top-level source snapshots and original notices are retained in vendor/pandoc/3.12.1, together with the source of the 91 statically linked Haskell packages whose exact versions were read from the module's own symbol table (pandoc-wasm-haskell-sources.tar; the list, its gaps and the way it was derived are in vendor/README.md). Pandoc publishes no build plan for the official module, so these sources are not a claim that the complete statically linked Haskell/C dependency closure and its notices have been audited: packages whose symbols the binary does not keep, the GHC base libraries, the GHC WebAssembly runtime and wasi-libc are not included.

csl-validator-wasm 1.0.0 (CSL style schema validator)

Used by the style editor (as in Zotero's own style editor) to check a style against the official CSL RelaxNG schema and to warn when installing a style that does not validate. The result is shown to the user only; it never reaches the formatting path. The bundled files (csl-validator.mjs, rnv.mjs, rnv.wasm) are byte-identical to the npm package csl-validator-wasm 1.0.0 (integrity sha512-UcWQBj6cH1aUe7HGLxn2Y+DCNppyu/oznD08iIBhvGB4r1y/ziQkyfuC7eXJaumvzpP/tvIRW7WqSu6RFss/GQ==, the same file Zotero pins), built from https://github.com/AbeJellinek/csl-validator-wasm at commit 4a671b4478b2022be2f77065bf7245b3d93bdf48. The package ships two statements that do not agree: its LICENSE.txt is the GNU AGPL version 3 (the same text as licenses/AGPL-3.0.txt), while its package.json license field says LGPL-3.0-or-later. CiteDesk uses the package under the terms of the LICENSE.txt that is distributed with it, the GNU AGPL version 3, which is also the stricter of the two; it does not rely on any LGPL-only permission, and provides the corresponding source (snapshot, build scripts and notices, see below) with its own. The mismatch has not been put to the package's authors. It runs in a Node worker thread, one validation per thread, and is terminated afterwards. Components statically linked into rnv.wasm, with their notices in licenses/csl-validator-wasm-libs-LICENSE.txt: rnv 1.7.11 (BSD-3-Clause, David Tolpin) and libexpat 2.7.1 (MIT). Source snapshot, original package files and notices are retained in vendor/csl-validator-wasm/1.0.0 (the repository's schema submodule, citation-style-language/schema, pinned there at commit e3ce254a72c4470a5ed3b9d23b428017d25674e9 and licensed MIT, is kept separately beside the snapshot; the CSL schema is embedded in the bundled files, and its MIT notice is in licenses/csl-validator-wasm-libs-LICENSE.txt).

Smithy Signature V4 (S3 sync transport)
Source: https://github.com/aws/aws-sdk-js-v3 and https://github.com/smithy-lang/smithy-typescript
Only packages actually included in the main-process bundle are listed. The AWS SDK team standalone Signature V4 signer uses explicit S3 credentials and a dedicated Electron network handler. No default credential provider, child process, automatic retry, or optional checksum middleware is included.
  @smithy/core 3.36.0 (Apache-2.0): licenses/sync-smithy-core-LICENSE.txt
  @smithy/types 4.19.0 (Apache-2.0): licenses/sync-smithy-core-LICENSE.txt
  @smithy/signature-v4 5.7.4 (Apache-2.0): licenses/sync-smithy-signature-v4-LICENSE.txt

Bech32m recovery-code checksum

The fixed-purpose recovery codec translates the polymod, HRP expansion and checksum algorithm from Pieter Wuille's reference implementation: https://github.com/sipa/bech32/blob/7a7d7ab158db7078a333384e0e918c90dbc42917/ref/python/segwit_addr.py (lines 31-71). CiteDesk uses only Bech32m with a fixed cdrec prefix and 20-byte input; Bitcoin address rules and the Bech32 checksum are not included.

Copyright (c) 2017, 2020 Pieter Wuille. License: MIT. The original license header is reproduced in licenses/bech32-reference-MIT.txt. The BIP173/BIP350 specification documents use BSD-2-Clause; that document license is distinct from the MIT license of this reference code.