# Third-party files in /tools/ocr/vendor

All files are unchanged copies from the npm registry (tarball SHA-1 checked against the registry's `dist.shasum`, 2026-10-15).
They are served from bitgeek.dev only and are downloaded by a visitor's browser only after they agree to it on the page.

| File | Package | License | SHA-256 |
|---|---|---|---|
| `tesseract.min.js`, `worker.min.js` | tesseract.js 7.0.0 (`dist/`) | Apache-2.0 (`LICENSE-tesseract.js.md`, bundled notices in `*.LICENSE.txt`) | `000c27d9…0afbc7e`, `576b7df7…f182c6d` |
| `core/tesseract-core-relaxedsimd-lstm.wasm.js`, `core/tesseract-core-simd-lstm.wasm.js`, `core/tesseract-core-lstm.wasm.js` | tesseract.js-core 7.0.0 (Tesseract OCR + Leptonica compiled to WebAssembly) | Apache-2.0 (`LICENSE-tesseract.js-core.txt`) | `861a536c…6b39a59b3`, `c58b46a4…f5362447b38`, `eef5f8b2…c0afbc7e8680` |
| `lang/eng.traineddata.gz` | @tesseract.js-data/eng 1.0.0 (`4.0.0_best_int/`, from tessdata_best) | MIT (package), Apache-2.0 (tessdata) | `45b4cb34…b887bcdb28` |

Shared with the dev tools (`/tools/dev/vendor/`, see its THIRD-PARTY.md): PDF.js 3.11 (Apache-2.0) reads PDFs, and pdf-lib 1.17.1
(MIT) makes the searchable PDFs. It is loaded only when a visitor downloads a searchable PDF.

The worker picks one core file: relaxed SIMD, SIMD, or plain, by what the browser supports. Only the LSTM engine is used.
Upgrade: download the new tarballs, check `dist.shasum`, copy the same files, update this table, run `devtools-tests/test-ocr.js`.