# Third-party software and model inventory

This document accompanies the short-form browser release candidate for review. See build-manifest.json for the selected inputs and patched module hashes.

| Component | Candidate input | License declared upstream | Source and build reference |
|---|---|---|---|
| Spellophone and embedded eSpeak NG | Spellophone 0.2.1, eSpeak NG 1.52.0 plus upstream dictionary patch | GPL-3.0-or-later | [Spellophone fixed source and build workflow](https://github.com/Spelling-Creator/spellophone/tree/6d51a872d54a773e4969d7130fdaed665b2d6d18), [eSpeak NG 1.52.0 source](https://github.com/espeak-ng/espeak-ng/tree/1.52.0). The original Spellophone LICENSE is included with the package files. |
| Kokoro JS | 1.2.1 with changes to module imports and model revision | Apache-2.0 | [Kokoro JS package](https://cdn.jsdelivr.net/npm/kokoro-js@1.2.1/package.json). The candidate builder records the patch inputs. |
| Transformers.js | 3.5.1 with changes to ONNX import URLs | Apache-2.0 | [Transformers.js 3.5.1 source](https://github.com/huggingface/transformers.js/tree/3.5.1) |
| ONNX Runtime | Common 1.31.1, Web 1.22.0-dev.20250409-89f8206ba4 and the JSEP runtime served via Transformers.js 3.5.1 | MIT package declarations to reconcile against the shipped artifacts | [ONNX Runtime source](https://github.com/microsoft/onnxruntime) |
| Kokoro model and Heart voice | Model repository revision 1939ad2a8e416c0acfeecc08a694d14ef25f2231 | Repository declares Apache-2.0 | [Fixed model revision](https://huggingface.co/onnx-community/Kokoro-82M-v1.0-ONNX/tree/1939ad2a8e416c0acfeecc08a694d14ef25f2231) |
| JSZip | 3.10.1 | MIT OR GPL-3.0-or-later | [JSZip 3.10.1 source](https://github.com/Stuk/jszip/tree/v3.10.1) |
| lamejs | 1.2.1 | LGPL-3.0 | [lamejs 1.2.1 package metadata](https://cdn.jsdelivr.net/npm/lamejs@1.2.1/package.json), [upstream source](https://github.com/zhuker/lamejs) |

Before public distribution, verify the actual license texts and notices for every shipped artifact, the corresponding source and its delivery method for the GPL components, and applicable replacement and source arrangements for lamejs. Verify Spellophone's provenance signature or independently reproduce the build. Review bundled and CDN-delivered third-party assets in the final configuration.