# Third-party notices

## Mediabunny 1.62.1

The browser-side container parser and WebCodecs audio sample reader are from
Mediabunny, Copyright (c) Vanilagy, licensed under the Mozilla Public License
2.0 (MPL-2.0). The unmodified upstream license and package source are included
in `vendor/mediabunny/LICENSE`, `vendor/mediabunny/README.md`, and
`vendor/mediabunny/src/`.

- Source tag: https://github.com/Vanilagy/mediabunny/tree/v1.62.1
- Tag commit: `f630141a4ac2936d00af14bf8ff2c5bb62b66150`
- Published package: https://registry.npmjs.org/mediabunny/-/mediabunny-1.62.1.tgz
- npm SHA-512 integrity: `sha512-lYzeerDwo9QLhBCipqQDXOSV7InvaIFplllZQviPO5rPwH+IUr8M1uvumk1olIUgMRGkPiInRriv25WFErUgMw==`

The minified browser bundle is unmodified. The source directory corresponding
to the package is provided alongside it. No FFmpeg or FFmpeg WASM binary is
distributed by this version of the tool.

## Whisper Tiny timestamped ONNX model

The runtime uses `onnx/encoder_model_quantized.onnx` and
`onnx/decoder_model_merged_quantized.onnx` from the pinned snapshot of
`onnx-community/whisper-tiny_timestamped`, revision
`517244293732ee2d58139af5814231b7e6830a0d`. Their SHA-256 hashes match the
quantized ONNX files introduced in Xenova's model commit
`41bc5e7b3682b7cbace8be6a2da5b9e5abde050e` (2024-07-02), which merged PR #1
from commit `89b5e356e7d34cc8406be1efb04bc6115201e0ba` (also authored by
Xenova). The pinned README identifies `openai/whisper-tiny` as the base model
and says the repository provides its ONNX weights for Transformers.js. A
later metadata commit sets `base_model` to `openai/whisper-tiny`; the later
snapshot commit `517244...` updated fp16/q4f16 variants, while the q8 files
used here retain the earlier hashes.

The ONNX repository has no separate license field or bundled license file.
OpenAI's upstream Whisper Tiny model card declares Apache-2.0. Apache-2.0
permits distribution of object-form conversions and derivative works subject
to its conditions. This site therefore redistributes the ONNX files as
converted derivatives of the Apache-2.0 upstream model, supplies the license
text and attribution below, and does not claim the ONNX repository made a
separate license declaration.

- Pinned ONNX model: https://huggingface.co/onnx-community/whisper-tiny_timestamped/tree/517244293732ee2d58139af5814231b7e6830a0d
- Quantized model-file commit: https://huggingface.co/onnx-community/whisper-tiny_timestamped/commit/41bc5e7b3682b7cbace8be6a2da5b9e5abde050e (Xenova, 2024-07-02)
- Quantized model-file PR commit: https://huggingface.co/onnx-community/whisper-tiny_timestamped/commit/89b5e356e7d34cc8406be1efb04bc6115201e0ba
- Pinned snapshot commit: `517244293732ee2d58139af5814231b7e6830a0d` (Xenova, 2025-03-05; parent `69298da22f4994d6137aa98562f089c257d50a40`)
- Base-model metadata commit: `69298da22f4994d6137aa98562f089c257d50a40` (`base_model: openai/whisper-tiny`)
- Pinned model README: https://huggingface.co/onnx-community/whisper-tiny_timestamped/resolve/517244293732ee2d58139af5814231b7e6830a0d/README.md
- Upstream Whisper Tiny: https://huggingface.co/openai/whisper-tiny/tree/169d4a4341b33bc18d8881c4b69c2e104e1cc0af
- Upstream license: Apache-2.0 (full text in `LICENSES/Apache-2.0.txt`); upstream model card identifies the model as Apache-2.0
- Conversion note: the model README recommends export with Hugging Face Optimum; the model repository does not include the original conversion script or environment lockfile. The commit/PR provenance and content hashes above identify the exact redistributed artifacts, but do not claim the binary is reproducibly rebuilt here.
- Pinned encoder SHA-256: `d4397fbfed1975bb5dd1bedb748808367331c85293f54cbc927774728daec2b2`
- Pinned decoder SHA-256: `ced2053c1aa8ff7048927197416a5c169f50010e7b280e5d564b46a991fca011`

The deployed static copies are stored below `models/onnx-community/` at the
same pinned revision path. The browser downloads them from MBTI313's static
origin; no request is routed through a Vercel Function.

## Runtime libraries loaded by the worker

- `@huggingface/transformers` 4.3.2 is served from jsDelivr and is licensed
  under Apache-2.0. Its license text is in `LICENSES/Apache-2.0.txt`.
- `onnxruntime-web` 1.31.0-dev.20260914-8d85527a0 is loaded as a
  Transformers.js runtime dependency and is MIT-licensed. Its license text is
  in `LICENSES/MIT-ONNX-Runtime.txt`.
- `@huggingface/jinja` 0.5.10 is MIT-licensed; its license text is included
  in `LICENSES/MIT-HuggingFace-Jinja.txt`.
- `@huggingface/tokenizers` 0.2.0 is Apache-2.0. The Apache license text is
  included in `LICENSES/Apache-2.0.txt`.