@sythos/js_barcode_universal 1.0.0 → 1.2.5

package/LICENSE

@@ -31,17 +31,18 @@ READ THIS FIRST
 **Nothing in this appendix applies to, encumbers, or imposes any obligation on
 the software distributed under the MIT License above.**
 
-This package contains 100% original code, written from scratch. It has ZERO
-runtime dependencies. No source code, and no table of values, has been copied
-from any other software project, under any license. The distributed artifact is
-therefore covered by the MIT License above and by nothing else.
+The implementation and integration work in this package is original work by
+Sythos. It has ZERO runtime dependencies. No third-party barcode source code
+is copied into or shipped by the distributed artifact. Public or normative
+format values may be represented in original Sythos data structures with
+provenance and legal-review status recorded where required.
 
 This appendix exists only because barcode symbologies carry a history of
 specification copyrights, expired patents and live trademarks, and it is useful
 to have that history inventoried in one place. It is an ENGINEERING INVENTORY,
-NOT LEGAL ADVICE. Every row marked "TO VERIFY" is an item the author has not
-independently confirmed; do not rely on any of it for a legal decision. If your
-use case is commercially sensitive, consult a qualified attorney.
+NOT LEGAL ADVICE. Scoped review labels identify items that need current legal or
+registry confirmation. If your use case is commercially sensitive, consult a
+qualified attorney.
 
 
 1. THE DISTRIBUTED PACKAGE
@@ -53,7 +54,7 @@ use case is commercially sensitive, consult a qualified attorney.
     Effective license ............... MIT, in full, as stated above
 
 
-2. DEVELOPMENT-TIME TOOLS (NOT DISTRIBUTED, NOT LINKED, NEVER READ)
+2. DEVELOPMENT-TIME TOOLS (NOT DISTRIBUTED OR LINKED)
 -------------------------------------------------------------------
 
     Tool                              License      Role
@@ -64,16 +65,14 @@ use case is commercially sensitive, consult a qualified attorney.
 
 THE PROJECT RULE, STATED PRECISELY:
 
-    These tools may be INVOKED during testing.
-    Their SOURCE is never opened, and no line of their code, and no constant
-    from their tables, ever enters this project's output.
+    These tools and public technical materials may be consulted during
+    implementation or testing. No third-party barcode source code is copied
+    into this project's output.
 
-They are used strictly as black boxes: an input goes in, the OUTPUT that comes
-back is compared against ours. Outputs are facts about a published symbology,
-not creative expression, so comparing against them creates no derivative work
-and no license obligation. This is the standard clean-room technique, and it is
-the opposite of source copying — it is how originality is PROVEN rather than
-merely asserted.
+Their outputs may be compared against ours as testing evidence. Public or
+normative values are represented in original Sythos structures with provenance
+and legal review where required. None of this is a legal conclusion about
+derivative works or license obligations.
 
 typescript (tsc) is not a barcode library and carries no symbology logic at
 all. It is an optional generator: it reads the JSDoc annotations already

package/NOTICE.md

@@ -2,11 +2,11 @@
 
 ## Origin of this code
 
-Every line of JavaScript in this repository is **original work by Sythos**.
-
-No source code, and no table of constants, has been copied from any other
-software project — under any license, permissive or otherwise. That covers
-every other barcode implementation, without exception.
+The JavaScript implementation and integration work in this repository is
+original work by Sythos. No third-party barcode source code is copied into or
+shipped by this package. Public or normative format values may be represented
+in original Sythos data structures, with provenance and legal-review status
+recorded where required.
 
 The symbologies are implemented from **published descriptions of the formats**
 (which are systems and facts, not works of authorship) and from **constant
@@ -22,24 +22,23 @@ is derivable rather than arbitrary.
 | Third-party licenses applying to the distributed package | **none** |
 
 The `LICENSE` file carries the full MIT text plus an informational appendix
-inventorying the specification copyrights, patent history and trademarks that
-surround these symbologies. **None of them encumbers this code** — the appendix
-exists for reference, not because obligations flow from it.
+inventorying specification copyrights, patent history and trademarks that
+surround these symbologies. The appendix is an engineering record, not legal
+advice, and does not resolve obligations in every jurisdiction.
 
 ## Where other barcode libraries may and may not appear
 
-The line is drawn at **invoke vs. read**:
+The line is drawn at **invoke vs. incorporate**:
 
 | | |
 |---|---|
 | Running an independent implementation during **testing**, comparing its output to ours | **allowed** |
-| Reading its source, or lifting a constant table from it, into this project | **never** |
+| Copying its source code into this project | **not done** |
+| Consulting public technical material or an implementation during review | allowed with provenance |
 
-Such outputs are facts about a published symbology, not creative expression —
-comparing against them creates no derivative work. This is how the originality
-of the shipped code is *demonstrated*, not compromised: an implementation that
-independently agrees with several unrelated ones, byte for byte, is evidently
-correct and evidently not a copy of any of them.
+Such outputs are facts about a published symbology. Comparing against them is a
+testing activity; it does not place their code in the distributed package and
+is not a legal conclusion about derivative works.
 
 No third-party barcode code is a runtime dependency, and none of it ships in the
 published package. See `LICENSE` §2.
@@ -69,7 +68,7 @@ worked example exists in the format's public documentation, its intermediate
 values are checked — not copied code, just the arithmetic any correct
 implementation must reproduce.
 
-**4. The real world — the decisive test.** `examples/create.html` renders any
+**4. The real world — the decisive test.** `git/examples/create.html` renders any
 symbol to the screen; a phone camera or a supermarket scanner reads it or does
 not. This is the strongest oracle available and the one that actually matters,
 because it tests against the installed base of real scanners rather than
@@ -80,7 +79,8 @@ write.**
 **5. Differential testing against independent implementations.** Random
 payloads across every version and ECC level are encoded here and decoded by
 several unrelated third-party barcode implementations — and vice versa. These
-are invoked as black boxes and their source is never read (see above).
+are invoked as black boxes; their source and tables are not shipped by this
+project.
 Agreement across implementations that share no lineage is strong evidence of
 correctness; disagreement localises a bug immediately.
 
@@ -96,11 +96,13 @@ Records any constant table whose values were transcribed from a documented
 source rather than generated by `tools/`. Each entry names the source and the
 date of transcription.
 
-*(empty — all tables to date are generated by `tools/` or derived from
-first principles in the module that uses them)*
+| PDF417 pattern ordering | AIM USS-PDF417 public reference ([reference copy](https://www.expresscorp.com/uploads/specifications/44/USS-PDF-417.pdf)), Appendix H / Table H1, transcribed for `src/pdf417/tables.js`; accessed 2026-08-11. The reference copy is attributed here; its copyright and redistribution terms remain under legal review. |
+| PDF417 black-box verification | ZXing Java 3.5.3 and bwip-js 4.5.1 were invoked as external black boxes on 2026-08-11 for bidirectional Text/Numeric/UTF-8 vectors. Their source and tables are not shipped. |
+| PDF417 device evidence | User-provided 6/6 continuous-camera attestations on Pixel 10/Android 17/Chrome and iPhone 17/Safari, including printed Brother MFC-L2710DW symbols, low light/flash, blur and motion; recorded as user evidence, not independently captured by this repository. |
+| MicroPDF417 technical and provenance review | [ISO/IEC 24728:2006](https://www.iso.org/standard/38838.html), [Wikipedia overview](https://en.wikipedia.org/wiki/MicroPDF417), [US 6,047,892 record](https://patents.google.com/patent/US6047892A/en) and its [direct PDF](https://patentimages.storage.googleapis.com/0a/79/f5/e8d374043414f3/US6047892.pdf) were consulted on 2026-08-11. ZXing-C++, Zint and bwip-js were consulted for implementation/review or black-box validation. No third-party source code is copied or shipped; normative/public values are represented in original Sythos data structures, with provenance and legal review pending. |
 
 ## Verification log
 
-Records each `[TO VERIFY]` marker cleared from `LICENSE`, with its citation.
-
-*(empty)*
+Records the scoped review labels used by the inventory. Current labels include
+`[VERIFIED FACT]`, `[REGISTRY CHECK REQUIRED]`, `[PATENT FAMILY REVIEW REQUIRED]`,
+`[LICENSE TERMS REVIEW REQUIRED]` and `[LEGAL REVIEW]`.

package/README.md

@@ -6,7 +6,7 @@ Read and write barcodes in JavaScript.
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 [![Runtime dependencies: 0](https://img.shields.io/badge/runtime%20dependencies-0-brightgreen.svg)](package.json)
 
-100% original code, zero runtime dependencies, MIT. It runs unmodified in Node, in browsers
+Original Sythos implementation, zero runtime dependencies, MIT. It runs unmodified in Node, in browsers
 (including Safari on iOS) and in web workers. The core requires no canvas, no filesystem and no
 DOM — images go in and come out as plain `{ data, width, height }` RGBA objects, which is exactly
 what an `ImageData` is.
@@ -90,8 +90,11 @@ const svg = toSVG(encodeQR('https://example.com', { ecc: 'M' }), { scale: 8 });
 | `@sythos/js_barcode_universal/core` | `BitMatrix`, `GaloisField`, Reed–Solomon, the error classes |
 | `@sythos/js_barcode_universal/image` | `LuminanceSource`, the binarizers, grid sampling, `PerspectiveTransform` |
 | `@sythos/js_barcode_universal/oned` | The per-format 1D writers (`encodeEAN13`, `encodeCode128`, …) and `decodeOneD` |
-| `@sythos/js_barcode_universal/qr` | `encodeQR`, `decodeQR`, `detectQR`, `detectAndDecodeQR` |
+| `@sythos/js_barcode_universal/qr` | `encodeQR`, `decodeQR`, `detectQR`, `detectAndDecodeQR` |
 | `@sythos/js_barcode_universal/datamatrix` | `encodeDataMatrix`, `decodeDataMatrix`, `detectDataMatrix`, `detectAndDecodeDataMatrix` |
+| `@sythos/js_barcode_universal/aztec` | `encodeAztec`, `decodeAztec`, `detectAztec`, `detectAndDecodeAztec` |
+| `@sythos/js_barcode_universal/pdf417` | `encodePDF417`, `decodePDF417`, `detectPDF417`, `detectAndDecodePDF417` |
+| `@sythos/js_barcode_universal/micropdf417` | `encodeMicroPDF417`, `decodeMicroPDF417`, `detectMicroPDF417`, `detectAndDecodeMicroPDF417` |
 | `@sythos/js_barcode_universal/render` | Every renderer plus `isWebGL2Available` / `isWebGPUAvailable` |
 | `@sythos/js_barcode_universal/render/svg` | `toSVG`, `toSVGDataURI` |
 | `@sythos/js_barcode_universal/render/png` | `toPNG`, `toPNGDataURI` |
@@ -103,8 +106,8 @@ The `unpkg` and `jsdelivr` fields point at the IIFE bundle, so a CDN needs no in
 
 ```html
 <script src="https://unpkg.com/@sythos/js_barcode_universal"></script>
-<script src="https://unpkg.com/@sythos/js_barcode_universal@1.0.0"></script>
-<script src="https://cdn.jsdelivr.net/npm/@sythos/js_barcode_universal@1.0.0"></script>
+<script src="https://unpkg.com/@sythos/js_barcode_universal@1.2.5"></script>
+<script src="https://cdn.jsdelivr.net/npm/@sythos/js_barcode_universal@1.2.5"></script>
 ```
 
 Pin the version for anything you ship; the unpinned form resolves to `latest` and will move under
@@ -207,55 +210,119 @@ time.
 | Code 11 | `code11` | 1D | ✅ | — |
 | MSI Plessey | `msi` | 1D | ✅ | — |
 | Pharmacode | `pharmacode` | 1D | ✅ | — |
-| QR Code | `qr` | 2D | ✅ | ✅ |
-| Data Matrix ECC 200 | `datamatrix` | 2D | ✅ | ✅ |
+| QR Code | `qr` | 2D | ✅ | ✅ |
+| Data Matrix ECC 200 | `datamatrix` | 2D | ✅ | ✅ |
+| Aztec Code | `aztec` | 2D | ✅ | ✅ |
+| PDF417 | `pdf417` | 2D | ✅ | ✅ |
+| MicroPDF417 | `micropdf417` | 2D | ✅ | ✅ |
 
-Seventeen formats, all writable, fourteen readable. **Code 11, MSI Plessey and Pharmacode are
-write-only** — they encode correctly, but there is no reader for them, and `decode` will never
-return one.
+Twenty formats, all writable, seventeen readable. **Code 11, MSI Plessey and Pharmacode remain
+write-only in the generic image pipeline.** PDF417 exposes direct matrix decoding, automatic
+camera localization and an assisted quadrilateral sampler through its subpath. Its detector is
+validated on degraded synthetic photographs and real Pixel 10/Chrome and iPhone 17/Safari camera
+tests; external black-box vectors from ZXing 3.5.3 and bwip-js also pass in both directions.
+Text and Numeric vectors are covered bidirectionally; binary byte-for-byte interop remains
+explicitly unclaimed until a dedicated external byte corpus is added.
 
 [^1]: `gs1128`, `itf14` and `isbn` are sub-variants that share a decoder with their base format, so
 they decode under that base id: a GS1-128 comes back as `code128`, an ITF-14 as `itf`, and an ISBN
 as `ean13`. The payload is intact either way — a GS1-128 *is* a Code 128 with a leading FNC1, an
 ITF-14 *is* an ITF fixed at fourteen digits, and an ISBN barcode *is* an EAN-13 with a 978/979
 prefix. Match on `result.format === 'code128'` rather than `'gs1128'`, or a
-condition on the sub-variant id will silently never fire.
+condition on the sub-variant id will silently never fire.
+
+### Data Matrix ECC 200
+
+`datamatrix` writes and reads the 30 classic ECC 200 square and rectangular symbol sizes. The
+encoder supports ASCII compaction (including numeric pairs), Base256 binary payloads, automatic
+or forced square/rectangular shape, Reed–Solomon error correction and GS1 FNC1 in the first
+position. DMRE is not included.
+
+```js
+import { encodeDataMatrix, decodeDataMatrix } from '@sythos/js_barcode_universal/datamatrix';
+
+const symbol = encodeDataMatrix('0101234567890128', { gs1: true, shape: 'square' });
+const result = decodeDataMatrix(symbol);
+console.log(result.text, result.gs1); // 0101234567890128 true
+```
+
+Binary content is accepted as a `Uint8Array` with `encoding: 'base256'`. The current high-level
+decoder handles ASCII and Base256 codewords; C40, Text, X12 and EDIFACT input symbols are not yet
+decoded. The current detector accepts axis-aligned square or rectangular symbols; the normal
+`decode(image, { formats: ['datamatrix'] })` pipeline also retries quarter-turn rotations.
+Arbitrary-angle and perspective-skewed Data Matrix photographs are not yet guaranteed.
+
+### Aztec Code
+
+`aztec` writes Compact layers 1–4 and Full layers 1–32, selecting a fitting symbol automatically
+unless `layers` and `compact` are forced. It supports the five Aztec text tables and UTF-8 byte
+payloads through Binary Shift, with `eccPercent` (default 23) controlling the requested
+error-correction level.
+ECI is not yet a configurable public option.
+
+```js
+import { encodeAztec, decodeAztec } from '@sythos/js_barcode_universal/aztec';
+
+const symbol = encodeAztec('Greetings My Lord Sythos  👋', { eccPercent: 23 });
+const result = decodeAztec(symbol);
+console.log(result.text); // Greetings My Lord Sythos  👋
+```
+
+The image detector handles rotation, inverted polarity and quadrilateral sampling around the
+central bull’s-eye. Severe photographic perspective remains an interoperability and robustness
+gate rather than a guaranteed capability.
+
+### PDF417 (writer, matrix decoder and camera reader)
+
+`pdf417` supports PDF417 Text, Byte and Numeric compaction, ECI 3 (ISO-8859-1) and ECI 26
+(UTF-8), ECC levels 0–8, row-height inference and Reed–Solomon erasure correction. The direct
+matrix decoder is available from `@sythos/js_barcode_universal/pdf417`.
+
+The image helper handles clean module-aligned raster symbols, integer scale, right-angle
+rotations, automatic perspective estimation, mild blur/noise and an application-supplied
+quadrilateral. Results expose `bytes` and ordered `segments` for byte-preserving payloads. Real
+device validation covers Pixel 10/Chrome and iPhone 17/Safari with printed symbols and continuous
+camera capture. Extreme glare, severe occlusion, curved media and multi-symbol scenes remain
+outside the validated robustness envelope.
+
+```js
+import { encodePDF417, decodePDF417 } from '@sythos/js_barcode_universal/pdf417';
+
+const symbol = encodePDF417('AAMVA SAMPLE', { eccLevel: 3 });
+console.log(decodePDF417(symbol).text);
+```
 
-### Data Matrix ECC 200
+### MicroPDF417
 
-`datamatrix` writes and reads the 30 classic ECC 200 square and rectangular symbol sizes. The
-encoder supports ASCII compaction (including numeric pairs), Base256 binary payloads, automatic
-or forced square/rectangular shape, Reed–Solomon error correction and GS1 FNC1 in the first
-position. DMRE is not included.
+`micropdf417` writes and reads the 34 fixed MicroPDF417 variants. It supports Text, Byte and
+Numeric compaction, plus Byte-compaction ECI 3 (ISO-8859-1) and 26 (UTF-8). `columns`,
+`rowHeight` and `aspectRatio` let callers constrain automatic variant selection.
 
 ```js
-import { encodeDataMatrix, decodeDataMatrix } from '@sythos/js_barcode_universal/datamatrix';
+import { encodeMicroPDF417, decodeMicroPDF417 } from '@sythos/js_barcode_universal/micropdf417';
 
-const symbol = encodeDataMatrix('0101234567890128', { gs1: true, shape: 'square' });
-const result = decodeDataMatrix(symbol);
-console.log(result.text, result.gs1); // 0101234567890128 true
+const symbol = encodeMicroPDF417('MICRO PDF417', { compaction: 'text' });
+console.log(decodeMicroPDF417(symbol).text);
 ```
 
-Binary content is accepted as a `Uint8Array` with `encoding: 'base256'`. The current high-level
-decoder handles ASCII and Base256 codewords; C40, Text, X12 and EDIFACT input symbols are not yet
-decoded. The current detector accepts axis-aligned square or rectangular symbols; the normal
-`decode(image, { formats: ['datamatrix'] })` pipeline also retries quarter-turn rotations.
-Arbitrary-angle and perspective-skewed Data Matrix photographs are not yet guaranteed.
+The detector accepts clean, integer-scaled raster symbols and quarter-turn rotations. Arbitrary
+perspective, severe photographic degradation and multi-symbol scenes are not yet claimed as
+robust capabilities.
 
 ### Not implemented
 
-**PDF417, Aztec, GS1 DataBar and MaxiCode are not implemented** — neither writing
-nor reading. Data Matrix ECC 200 is implemented for its classic square and rectangular symbols;
-DMRE remains outside the current scope. Some scaffolding for the remaining formats exists in the core (the Galois field code already handles
-the prime field PDF417 needs), but none of those remaining symbologies is usable today. See [`PLAN.md`](PLAN.md)
-for where they sit.
+**GS1 DataBar and MaxiCode are not implemented** — neither writing nor reading. Data Matrix ECC
+200 is implemented for its classic square and rectangular symbols;
+DMRE remains outside the current scope. See [`PLAN.md`](PLAN.md) for the remaining symbologies.
 
 ---
 
 ## Live examples
 
 Two self-contained pages, each loading the IIFE bundle with a plain `<script>` tag. **Both open
-directly from disk** — double-click the file, no server and no build.
+directly from disk** — double-click the file, no server and no build. This `examples/` directory is
+the single canonical source; the development workspace references these files instead of keeping
+a second copy.
 
 ### [`examples/create.html`](examples/create.html)
 
@@ -289,15 +356,21 @@ hatch.
 encode(text, options?) → BitMatrix
 ```
 
-`options`: `format` (default `'qr'`), `ecc` (`'L'|'M'|'Q'|'H'`), `version` (QR 1–40, auto if
-omitted), `checkDigit`, `fullAscii` (Code 39 extended), `gs1` (emit a leading FNC1). Data Matrix
-ECC 200 accepts `shape: 'any' | 'square' | 'rectangular'` and `encoding: 'ascii' | 'base256'`.
+`options`: `format` (default `'qr'`), `ecc` (`'L'|'M'|'Q'|'H'`), `version` (QR 1–40, auto if
+omitted), `checkDigit`, `fullAscii` (Code 39 extended), `gs1` (emit a leading FNC1). Data Matrix
+ECC 200 accepts `shape: 'any' | 'square' | 'rectangular'` and `encoding: 'ascii' | 'base256'`.
+Aztec accepts `layers`, `compact` and `eccPercent`; it transports UTF-8 byte payloads through
+Binary Shift, and it does not expose configurable ECI yet.
+MicroPDF417 accepts `compaction: 'auto' | 'text' | 'byte' | 'numeric'`, ECI 3 or 26 for Byte
+compaction, and optional `columns`, `rowHeight` and `aspectRatio` constraints.
 
 ```js
 encode('5901234123457', { format: 'ean13' })
 encode('ABC-123', { format: 'code39', fullAscii: true, checkDigit: true })
-encode('https://example.com', { format: 'qr', ecc: 'H', version: 7 })
-encode('0101234567890128', { format: 'datamatrix', gs1: true })
+encode('https://example.com', { format: 'qr', ecc: 'H', version: 7 })
+encode('0101234567890128', { format: 'datamatrix', gs1: true })
+encode('Greetings My Lord Sythos  👋', { format: 'aztec', eccPercent: 23 })
+encode('MICRO PDF417', { format: 'micropdf417', compaction: 'text' })
 ```
 
 ```js
@@ -379,12 +452,12 @@ margin ends up uniform on all four sides.
 RGBA bytes → luminance → binarize → detect → sample → error-correct → decode
 ```
 
-Luminance conversion flattens the image to greyscale. Binarization turns that into a `BitMatrix`,
-either globally or with a hybrid local threshold that survives uneven lighting. Detection locates
-a symbol and its corners in that bit plane. Detectors that recover four perspective-aware corners
-(currently QR) sample the symbol back through a perspective transform. Data Matrix currently uses
-an axis-aligned bounding box plus quarter-turn retries. Error correction repairs what the camera
-lost. Only then is the payload decoded.
+Luminance conversion flattens the image to greyscale. Binarization turns that into a `BitMatrix`,
+either globally or with a hybrid local threshold that survives uneven lighting. Detection locates
+a symbol and its corners in that bit plane. Detectors that recover four perspective-aware corners
+(currently QR) sample the symbol back through a perspective transform. Data Matrix currently uses
+an axis-aligned bounding box plus quarter-turn retries. Error correction repairs what the camera
+lost. Only then is the payload decoded.
 
 **Reed–Solomon is generic over the finite field.** The `GaloisField` class is constructed with a
 field order and a primitive polynomial rather than hard-coding GF(256), which is what lets one
@@ -428,35 +501,39 @@ and reports which backend actually drew.
 
 MIT © 2026 Sythos. Every source file carries the header.
 
-**The code is 100% original.** No source code and no constant table from any other barcode
-implementation is present, under any licence, permissive or otherwise. The symbologies are
-implemented from published descriptions of the formats — which are systems and facts, not works of
-authorship — and from constant tables generated by this project's own scripts wherever a table is
-derivable rather than arbitrary. There is consequently no upstream licence to carry and no
-co-author to credit.
-
-**Trademark is not licence.** QR Code® is a registered trademark of DENSO WAVE; Aztec Code,
-MaxiCode and GS1 DataBar are likewise marks of their owners. A trademark does not restrict
-implementing a symbology, but it does constrain branding — which is why this package is named
-descriptively rather than after any mark.
-
+**The implementation is original Sythos work.** No third-party barcode source code is copied into
+or shipped by this package. The symbologies are implemented from published descriptions of the
+formats and from original Sythos data structures; MicroPDF417 normative/public values carry
+provenance and pending legal review in `NOTICE.md`. The distributed package has no runtime
+third-party licence or co-author attribution.
+
+**Trademark is not licence.** QR Code® is a registered trademark of DENSO WAVE; Aztec Code,
+MaxiCode and GS1 DataBar are likewise marks of their owners. A trademark does not restrict
+implementing a symbology, but it does constrain branding — which is why this package is named
+descriptively rather than after any mark.
+
 Data Matrix ECC 200 is governed by ISO/IEC 16022:2024; GS1 DataMatrix additionally uses the GS1
 General Specifications and a leading FNC1. Its engineering provenance, patent and trademark
 research notes are recorded in [`licenses/data-matrix.license`](licenses/data-matrix.license),
-with unresolved claims kept explicitly marked `[TO VERIFY]`.
+with unresolved claims kept explicitly marked using scoped review labels.
+
+PDF417 and MicroPDF417 provenance and legal review notes are recorded in
+[`licenses/pdf417.license`](licenses/pdf417.license),
+[`licenses/micropdf417.license`](licenses/micropdf417.license) and the attribution log in
+[`NOTICE.md`](NOTICE.md).
 
 [`LICENSE`](LICENSE) carries the full MIT text plus an informational appendix inventorying the
 specification copyrights, patent history and trademarks that surround these symbologies. None of
-them encumbers this code; the appendix is an engineering inventory, not legal advice.
+them is resolved by this file; the appendix is an engineering inventory, not legal advice.
 [`NOTICE.md`](NOTICE.md) records the origin of the code and how its correctness is verified.
 
 ---
 
-## Contributing and roadmap
-
-[`PLAN.md`](PLAN.md) is the live status document: what is shipped, what is next, and the ground
-rules — chief among them that no code or constant table from any other barcode implementation
-enters this project, which is what keeps the licence clean.
+## Contributing and roadmap
+
+[`PLAN.md`](PLAN.md) is the live status document: what is shipped, what is next, and the ground
+rules — chief among them that no third-party source code is copied into or shipped by this
+project, while public or normative values remain provenance-tracked and subject to legal review.
 
 Issues and pull requests are welcome at
 [Sythos/JS_Barcode_Universal](https://github.com/Sythos/JS_Barcode_Universal). A patch that adds a