# Third-party notices

This application redistributes local OCR assets. All OCR execution stays in the browser; these files are served from the same origin.

## Tesseract.js 6.0.1

- Package: `tesseract.js@6.0.1`
- Upstream: https://github.com/naptha/tesseract.js
- npm tarball: https://registry.npmjs.org/tesseract.js/-/tesseract.js-6.0.1.tgz
- License: Apache License 2.0
- Bundled files: `tesseract.min.js`, `worker.min.js`
- Exact match: both bundled files match the npm 6.0.1 distribution by SHA-256

The official extracted license sidecars are retained beside the minified files:

- `assets/vendor/tesseract/tesseract.min.js.LICENSE.txt`
- `assets/vendor/tesseract/worker.min.js.LICENSE.txt`

Those sidecars contain the upstream notices for bundled dependencies including regenerator-runtime, buffer, ieee754, and zlib.js.

## tesseract.js-core 6.0.0

- Package: `tesseract.js-core@6.0.0`
- Upstream: https://github.com/naptha/tesseract.js-core
- Engine upstream: https://github.com/tesseract-ocr/tesseract
- npm tarball: https://registry.npmjs.org/tesseract.js-core/-/tesseract.js-core-6.0.0.tgz
- License: Apache License 2.0
- Bundled files: the eight `tesseract-core*.wasm` and `tesseract-core*.wasm.js` builds
- Exact match: all eight bundled files match the npm 6.0.0 distribution by SHA-256

## English traineddata

- Package: `@tesseract.js-data/eng@1.0.0`
- Package path: `4.0.0/eng.traineddata.gz`
- Package repository: https://github.com/naptha/tessdata
- Engine data upstream: https://github.com/tesseract-ocr/tessdata
- npm tarball: https://registry.npmjs.org/@tesseract.js-data/eng/-/eng-1.0.0.tgz
- Exact match: the bundled `eng.traineddata.gz` matches the npm 1.0.0 package by SHA-256

The npm package metadata declares MIT. The source repository and upstream Tesseract language data repository carry Apache License 2.0. Both declarations are recorded here; the full Apache License 2.0 and the MIT text used for the package metadata are included under `LICENSES/`.

## Included license texts

- `LICENSES/Apache-2.0.txt`
- `LICENSES/MIT-tesseract-data-eng.txt`

## Provenance verification

Version identification was not inferred from file names. Each npm tarball was fetched from the registry, its SHA-512 integrity matched the registry metadata, and every redistributed runtime asset matched the extracted package file by SHA-256.