# Third-party software and model notices

Verified 2026-10-02 against installed package metadata and the upstream model card. The lockfile is the exact dependency inventory. Engine binaries are unmodified; splitting and recombining bytes is deployment packaging only.

| Component | Version / revision | License | Source |
| --- | --- | --- | --- |
| @ffmpeg/ffmpeg | 0.12.15 | MIT | https://github.com/ffmpegwasm/ffmpeg.wasm |
| @noble/ciphers | 2.0.1 | MIT | https://github.com/paulmillr/noble-ciphers |
| @ffmpeg/core | 0.12.10, single-thread ESM | GPL-2.0-or-later | https://github.com/ffmpegwasm/ffmpeg.wasm/tree/71aa99d37c02a7b4c435275ca9ef50e612f6efa1 |
| @huggingface/transformers | 4.3.0 | Apache-2.0 | https://github.com/huggingface/transformers.js |
| onnxruntime-web | 1.31.0-dev.20260914-8d85527a0 | MIT | https://github.com/microsoft/onnxruntime |
| Xenova/whisper-tiny | 5332fcc35e32a33b86612b9a57a89be7906102b1 | Apache-2.0 (model card) | https://huggingface.co/Xenova/whisper-tiny/tree/5332fcc35e32a33b86612b9a57a89be7906102b1 |
| React, TanStack Start, Vite | Locked in pnpm-lock.yaml | MIT | Respective package source repositories |
| Inter variable font | 5.3.0 package | SIL Open Font License 1.1 | https://github.com/rsms/inter |

## FFmpeg corresponding source and build recipe

The official package-history API identifies commit `71aa99d37c02a7b4c435275ca9ef50e612f6efa1` as the release of core 0.12.10. This is distinct from the version of the JavaScript wrapper.

- Source snapshot: https://github.com/ffmpegwasm/ffmpeg.wasm/archive/71aa99d37c02a7b4c435275ca9ef50e612f6efa1.tar.gz
- Docker build recipe, including exact upstream dependencies and source checkout references: https://github.com/ffmpegwasm/ffmpeg.wasm/blob/71aa99d37c02a7b4c435275ca9ef50e612f6efa1/Dockerfile
- Build scripts: https://github.com/ffmpegwasm/ffmpeg.wasm/tree/71aa99d37c02a7b4c435275ca9ef50e612f6efa1/build
- FFmpeg upstream source (n5.1.4): https://github.com/FFmpeg/FFmpeg/tree/n5.1.4
- FFmpeg GPL license: https://github.com/FFmpeg/FFmpeg/blob/n5.1.4/COPYING.GPLv2

The core includes third-party codecs and libraries. Their notices and source references are part of the upstream build/source distribution; do not describe the core as MIT merely because the wrapper is MIT. When upgrading the core, retain the matching corresponding-source references and license texts. Public notices are available at `/third-party-notices.txt` and the linked upstream source locations.

## Sample ownership

The three-note WAV is generated by `toneSample()` from mathematical sine waves. The spoken sample uses original text (“The meeting starts at nine. Please bring your notes.”) synthesized locally with Windows System.Speech. No private recording or competitor media is used. Both sample actions pass the original through the real processing path; no transcript or converted result is substituted.

## Resource packaging

`prepare-assets.mjs` copies the FFmpeg ESM module and ORT loader, slices the unmodified WASM into content-hashed parts no larger than 16 MiB, and records their lengths. `finalize-build.mjs` removes ORT's redundant bundler fallback WASM because the worker explicitly supplies `wasmBinary`, then rejects any static asset larger than 25 MiB. Recheck real browser inference and output on engine upgrades.

## Bundled license texts

- /licenses/ffmpeg-gpl-2.0.txt
- /licenses/ffmpeg-wrapper-mit.txt
- /licenses/noble-ciphers-mit.txt
- /licenses/onnxruntime-mit.txt
- /licenses/transformers-apache-2.0.txt