arcane-os 0.2.2 → 0.3.0

package/docs/reference/ai/browser-speech-package-authority.json

@@ -0,0 +1,835 @@
+{
+  "schema": "arcane.browser-speech-package-authority/1",
+  "purpose": "Pre-download supply-chain metadata authority for the caller-selected Arcane SDK browser speech runtime artifacts used by Whisper STT and Kokoro TTS.",
+  "status": "browser-speech-package-authority-registry-and-selected-bytes-verified",
+  "publicationStatus": "browser-speech-public-runtime-ready-warn-first-secure-opt-in",
+  "auditedOn": "2026-08-27",
+  "evidenceBoundary": {
+    "packageCodeDownloaded": true,
+    "packageCodeInstalled": false,
+    "packageCodeExecuted": false,
+    "registryTarballsVerified": true,
+    "candidateFileDigestsAuthenticatedByRegistryTarballs": true,
+    "description": "All 23 exact registry tarballs matched the recorded SHA-512 integrity and SHA-1 shasum before extraction. Archive paths and member types were admitted before extraction, every extracted root manifest matched its recorded name, version and declared license, and all four selected runtime files matched their recorded byte lengths and SHA-256 values. The two caller-owned candidate model inventories also have exact file byte lengths and SHA-256 values. Package code was not installed, imported or executed. These optional audit facts do not make the SDK a redistributor and do not gate warn-first operation."
+  },
+  "selectedBrowserDependencyClosure": {
+    "root": "kokoro-js@1.2.1",
+    "nodeCount": 23,
+    "nodes": [
+      {
+        "id": "kokoro-js@1.2.1",
+        "name": "kokoro-js",
+        "version": "1.2.1",
+        "publisher": "xenova",
+        "license": "Apache-2.0",
+        "registryTarballUrl": "https://registry.npmjs.org/kokoro-js/-/kokoro-js-1.2.1.tgz",
+        "integritySha512": "sha512-oq0HZJWis3t8lERkMJh84WLU86dpYD0EuBPtqYnLlQzyFP1OkyBRDcweAqCfhNOpltyN9j/azp1H6uuC47gShw==",
+        "shasumSha1": "a6a9b0ffc1ab354fa3f9cb71ee95b6e9f0a13527",
+        "purpose": "Kokoro TTS browser runtime, voice catalog and voice-loading surface."
+      },
+      {
+        "id": "@huggingface/transformers@3.5.1",
+        "name": "@huggingface/transformers",
+        "version": "3.5.1",
+        "publisher": "xenova",
+        "license": "Apache-2.0",
+        "registryTarballUrl": "https://registry.npmjs.org/@huggingface/transformers/-/transformers-3.5.1.tgz",
+        "integritySha512": "sha512-qWsPoJMBPYcrGuzRMVL//3dwcLXED9r+j+Hzw+hZpBfrMPdyq57ehNs7lew0D34Paj0DO0E0kZQjOZcIVN17hQ==",
+        "shasumSha1": "8022b616ed8f1ec88d8e56def06d5b0ef5c7a1ee",
+        "purpose": "Browser model, tokenizer and processor loading plus Whisper pipeline and ONNX Runtime Web integration used by both selected speech providers."
+      },
+      {
+        "id": "@huggingface/jinja@0.4.1",
+        "name": "@huggingface/jinja",
+        "version": "0.4.1",
+        "publisher": "coyotte508",
+        "license": "MIT",
+        "registryTarballUrl": "https://registry.npmjs.org/@huggingface/jinja/-/jinja-0.4.1.tgz",
+        "integritySha512": "sha512-3WXbMFaPkk03LRCM0z0sylmn8ddDm4ubjU7X+Hg4M2GOuMklwoGAFXp9V2keq7vltoB/c7McE5aHUVVddAewsw==",
+        "shasumSha1": "a71deab443c4badb6498d28e784ea1cd5eb369e2",
+        "purpose": "Jinja template rendering imported by Transformers tokenizer support."
+      },
+      {
+        "id": "onnxruntime-web@1.22.0-dev.20250409-89f8206ba4",
+        "name": "onnxruntime-web",
+        "version": "1.22.0-dev.20250409-89f8206ba4",
+        "publisher": "onnxruntime",
+        "license": "MIT",
+        "registryTarballUrl": "https://registry.npmjs.org/onnxruntime-web/-/onnxruntime-web-1.22.0-dev.20250409-89f8206ba4.tgz",
+        "integritySha512": "sha512-0uS76OPgH0hWCPrFKlL8kYVV7ckM7t/36HfbgoFw6Nd0CZVVbQC4PkrR8mBX8LtNUFZO25IQBqV2Hx2ho3FlbQ==",
+        "shasumSha1": "d1e3a04e03dfee392b41d420ef547b6a0351b06b",
+        "purpose": "Browser ONNX inference runtime and JSEP WebAssembly module host."
+      },
+      {
+        "id": "onnxruntime-common@1.22.0-dev.20250409-89f8206ba4",
+        "name": "onnxruntime-common",
+        "version": "1.22.0-dev.20250409-89f8206ba4",
+        "publisher": "onnxruntime",
+        "license": "MIT",
+        "registryTarballUrl": "https://registry.npmjs.org/onnxruntime-common/-/onnxruntime-common-1.22.0-dev.20250409-89f8206ba4.tgz",
+        "integritySha512": "sha512-vDJMkfCfb0b1A836rgHj+ORuZf4B4+cc2bASQtpeoJLueuFc5DuYwjIZUBrSvx/fO5IrLjLz+oTrB3pcGlhovQ==",
+        "shasumSha1": "3d4a39563b93db3d0428b5527cba58a3c8f826c2",
+        "purpose": "Shared ONNX environment, tensor and inference-session contract used by ONNX Runtime Web."
+      },
+      {
+        "id": "flatbuffers@25.2.10",
+        "name": "flatbuffers",
+        "version": "25.2.10",
+        "publisher": "dbaileychess",
+        "license": "Apache-2.0",
+        "registryTarballUrl": "https://registry.npmjs.org/flatbuffers/-/flatbuffers-25.2.10.tgz",
+        "integritySha512": "sha512-7JlN9ZvLDG1McO3kbX0k4v+SUAg48L1rIwEvN6ZQl/eCtgJz9UylTMzE9wrmYrcorgxm3CX/3T/w5VAub99UUw==",
+        "shasumSha1": "308b750545f62db670ca4c9d7dbc66161420a95e",
+        "purpose": "FlatBuffers serialization support required by ONNX Runtime Web."
+      },
+      {
+        "id": "guid-typescript@1.0.9",
+        "name": "guid-typescript",
+        "version": "1.0.9",
+        "publisher": "nicolas.developer",
+        "license": "ISC",
+        "registryTarballUrl": "https://registry.npmjs.org/guid-typescript/-/guid-typescript-1.0.9.tgz",
+        "integritySha512": "sha512-Y8T4vYhEfwJOTbouREvG+3XDsjr8E3kIr7uf+JZ0BYloFsttiHU0WfvANVsR7TxNUJa/WpCnw/Ino/p+DeBhBQ==",
+        "shasumSha1": "e35f77003535b0297ea08548f5ace6adb1480ddc",
+        "purpose": "GUID helper required by ONNX Runtime Web."
+      },
+      {
+        "id": "long@5.3.2",
+        "name": "long",
+        "version": "5.3.2",
+        "publisher": "dcode",
+        "license": "Apache-2.0",
+        "registryTarballUrl": "https://registry.npmjs.org/long/-/long-5.3.2.tgz",
+        "integritySha512": "sha512-mNAgZ1GmyNhD7AuqnTG3/VQ26o760+ZYBPKjPvugO8+nLbYfX6TVpJPseBvopbdY+qpZ/lKUnmEc1LeZYS3QAA==",
+        "shasumSha1": "1d84463095999262d7d7b7f8bfd4a8cc55167f83",
+        "purpose": "64-bit integer support shared by ONNX Runtime Web and protobufjs."
+      },
+      {
+        "id": "platform@1.3.6",
+        "name": "platform",
+        "version": "1.3.6",
+        "publisher": "d10",
+        "license": "MIT",
+        "registryTarballUrl": "https://registry.npmjs.org/platform/-/platform-1.3.6.tgz",
+        "integritySha512": "sha512-fnWVljUchTro6RiCFvCXBbNhJc2NijN7oIQxbwsyL0buWJPG85v81ehlHI9fXrJsMNgTofEoWIQeClKpgxFLrg==",
+        "shasumSha1": "48b4ce983164b209c2d45a107adb31f473a6e7a7",
+        "purpose": "Runtime platform detection required by ONNX Runtime Web."
+      },
+      {
+        "id": "protobufjs@7.5.0",
+        "name": "protobufjs",
+        "version": "7.5.0",
+        "publisher": "google-wombot",
+        "license": "BSD-3-Clause",
+        "registryTarballUrl": "https://registry.npmjs.org/protobufjs/-/protobufjs-7.5.0.tgz",
+        "integritySha512": "sha512-Z2E/kOY1QjoMlCytmexzYfDm/w5fKAiRwpSzGtdnXW1zC88Z2yXazHHrOtwCzn+7wSxyE8PYM4rvVcMphF9sOA==",
+        "shasumSha1": "a317ad80713e9db43c8e55afa8636a9aa76bb630",
+        "purpose": "Protocol Buffers serialization support required by ONNX Runtime Web."
+      },
+      {
+        "id": "@protobufjs/aspromise@1.1.2",
+        "name": "@protobufjs/aspromise",
+        "version": "1.1.2",
+        "publisher": "dcode",
+        "license": "BSD-3-Clause",
+        "registryTarballUrl": "https://registry.npmjs.org/@protobufjs/aspromise/-/aspromise-1.1.2.tgz",
+        "integritySha512": "sha512-j+gKExEuLmKwvz3OgROXtrJ2UG2x8Ch2YZUxahh+s1F2HZ+wAceUNLkvy6zKCPVRkU++ZWQrdxsUeQXmcg4uoQ==",
+        "shasumSha1": "9b8b0cc663d669a7d8f6f5d0893a14d348f30fbf",
+        "purpose": "Promise adaptation helper in the protobufjs support tree."
+      },
+      {
+        "id": "@protobufjs/base64@1.1.2",
+        "name": "@protobufjs/base64",
+        "version": "1.1.2",
+        "publisher": "dcode",
+        "license": "BSD-3-Clause",
+        "registryTarballUrl": "https://registry.npmjs.org/@protobufjs/base64/-/base64-1.1.2.tgz",
+        "integritySha512": "sha512-AZkcAA5vnN/v4PDqKyMR5lx7hZttPDgClv83E//FMNhR2TMcLUhfRUBHCmSl0oi9zMgDDqRUJkSxO3wm85+XLg==",
+        "shasumSha1": "4c85730e59b9a1f1f349047dbf24296034bb2735",
+        "purpose": "Base64 codec in the protobufjs support tree."
+      },
+      {
+        "id": "@protobufjs/codegen@2.0.4",
+        "name": "@protobufjs/codegen",
+        "version": "2.0.4",
+        "publisher": "dcode",
+        "license": "BSD-3-Clause",
+        "registryTarballUrl": "https://registry.npmjs.org/@protobufjs/codegen/-/codegen-2.0.4.tgz",
+        "integritySha512": "sha512-YyFaikqM5sH0ziFZCN3xDC7zeGaB/d0IUb9CATugHWbd1FRFwWwt4ld4OYMPWu5a3Xe01mGAULCdqhMlPl29Jg==",
+        "shasumSha1": "7ef37f0d010fb028ad1ad59722e506d9262815cb",
+        "purpose": "Runtime code-generation helper in the protobufjs support tree."
+      },
+      {
+        "id": "@protobufjs/eventemitter@1.1.0",
+        "name": "@protobufjs/eventemitter",
+        "version": "1.1.0",
+        "publisher": "dcode",
+        "license": "BSD-3-Clause",
+        "registryTarballUrl": "https://registry.npmjs.org/@protobufjs/eventemitter/-/eventemitter-1.1.0.tgz",
+        "integritySha512": "sha512-j9ednRT81vYJ9OfVuXG6ERSTdEL1xVsNgqpkxMsbIabzSo3goCjDIveeGv5d03om39ML71RdmrGNjG5SReBP/Q==",
+        "shasumSha1": "355cbc98bafad5978f9ed095f397621f1d066b70",
+        "purpose": "Event-emitter helper in the protobufjs support tree."
+      },
+      {
+        "id": "@protobufjs/fetch@1.1.0",
+        "name": "@protobufjs/fetch",
+        "version": "1.1.0",
+        "publisher": "dcode",
+        "license": "BSD-3-Clause",
+        "registryTarballUrl": "https://registry.npmjs.org/@protobufjs/fetch/-/fetch-1.1.0.tgz",
+        "integritySha512": "sha512-lljVXpqXebpsijW71PZaCYeIcE5on1w5DlQy5WH6GLbFryLUrBD4932W/E2BSpfRJWseIL4v/KPgBFxDOIdKpQ==",
+        "shasumSha1": "ba99fb598614af65700c1619ff06d454b0d84c45",
+        "purpose": "Resource-fetch helper in the protobufjs support tree."
+      },
+      {
+        "id": "@protobufjs/float@1.0.2",
+        "name": "@protobufjs/float",
+        "version": "1.0.2",
+        "publisher": "dcode",
+        "license": "BSD-3-Clause",
+        "registryTarballUrl": "https://registry.npmjs.org/@protobufjs/float/-/float-1.0.2.tgz",
+        "integritySha512": "sha512-Ddb+kVXlXst9d+R9PfTIxh1EdNkgoRe5tOX6t01f1lYWOvJnSPDBlG241QLzcyPdoNTsblLUdujGSE4RzrTZGQ==",
+        "shasumSha1": "5e9e1abdcb73fc0a7cb8b291df78c8cbd97b87d1",
+        "purpose": "Floating-point codec in the protobufjs support tree."
+      },
+      {
+        "id": "@protobufjs/inquire@1.1.0",
+        "name": "@protobufjs/inquire",
+        "version": "1.1.0",
+        "publisher": "dcode",
+        "license": "BSD-3-Clause",
+        "registryTarballUrl": "https://registry.npmjs.org/@protobufjs/inquire/-/inquire-1.1.0.tgz",
+        "integritySha512": "sha512-kdSefcPdruJiFMVSbn801t4vFK7KB/5gd2fYvrxhuJYg8ILrmn9SKSX2tZdV6V+ksulWqS7aXjBcRXl3wHoD9Q==",
+        "shasumSha1": "ff200e3e7cf2429e2dcafc1140828e8cc638f089",
+        "purpose": "Optional module-inquiry helper in the protobufjs support tree."
+      },
+      {
+        "id": "@protobufjs/path@1.1.2",
+        "name": "@protobufjs/path",
+        "version": "1.1.2",
+        "publisher": "dcode",
+        "license": "BSD-3-Clause",
+        "registryTarballUrl": "https://registry.npmjs.org/@protobufjs/path/-/path-1.1.2.tgz",
+        "integritySha512": "sha512-6JOcJ5Tm08dOHAbdR3GrvP+yUUfkjG5ePsHYczMFLq3ZmMkAD98cDgcT2iA1lJ9NVwFd4tH/iSSoe44YWkltEA==",
+        "shasumSha1": "6cc2b20c5c9ad6ad0dccfd21ca7673d8d7fbf68d",
+        "purpose": "Path helper in the protobufjs support tree."
+      },
+      {
+        "id": "@protobufjs/pool@1.1.0",
+        "name": "@protobufjs/pool",
+        "version": "1.1.0",
+        "publisher": "dcode",
+        "license": "BSD-3-Clause",
+        "registryTarballUrl": "https://registry.npmjs.org/@protobufjs/pool/-/pool-1.1.0.tgz",
+        "integritySha512": "sha512-0kELaGSIDBKvcgS4zkjz1PeddatrjYcmMWOlAuAPwAeccUrPHdUqo/J6LiymHHEiJT5NrF1UVwxY14f+fy4WQw==",
+        "shasumSha1": "09fd15f2d6d3abfa9b65bc366506d6ad7846ff54",
+        "purpose": "Allocation-pool helper in the protobufjs support tree."
+      },
+      {
+        "id": "@protobufjs/utf8@1.1.0",
+        "name": "@protobufjs/utf8",
+        "version": "1.1.0",
+        "publisher": "dcode",
+        "license": "BSD-3-Clause",
+        "registryTarballUrl": "https://registry.npmjs.org/@protobufjs/utf8/-/utf8-1.1.0.tgz",
+        "integritySha512": "sha512-Vvn3zZrhQZkkBE8LSuW3em98c0FwgO4nxzv6OdSxPKJIEKY2bGbHn+mhGIPerzI4twdxaP8/0+06HBpwf345Lw==",
+        "shasumSha1": "a777360b5b39a1a2e5106f8e858f2fd2d060c570",
+        "purpose": "UTF-8 codec in the protobufjs support tree."
+      },
+      {
+        "id": "@types/node@22.10.6",
+        "name": "@types/node",
+        "version": "22.10.6",
+        "publisher": "types",
+        "license": "MIT",
+        "registryTarballUrl": "https://registry.npmjs.org/@types/node/-/node-22.10.6.tgz",
+        "integritySha512": "sha512-qNiuwC4ZDAUNcY47xgaSuS92cjf8JbSUoaKS77bmLG1rU7MlATVSiw/IlrjtIyyskXBZ8KkNfjK/P5na7rgXbQ==",
+        "shasumSha1": "5c6795e71635876039f853cbccd59f523d9e4239",
+        "purpose": "Node type declarations required by protobufjs package metadata; not browser-executable."
+      },
+      {
+        "id": "undici-types@6.20.0",
+        "name": "undici-types",
+        "version": "6.20.0",
+        "publisher": "matteo.collina",
+        "license": "MIT",
+        "registryTarballUrl": "https://registry.npmjs.org/undici-types/-/undici-types-6.20.0.tgz",
+        "integritySha512": "sha512-Ny6QZ2Nju20vw1SRHe3d9jVu6gJ+4e3+MMpqu7pqE5HT6WsTSlce++GQmK5UXS8mzV8DSYHrQH+Xrf2jVcuKNg==",
+        "shasumSha1": "8171bf22c1f588d1554d55bf204bc624af388433",
+        "purpose": "Undici and Fetch type declarations required by @types/node; not browser-executable."
+      },
+      {
+        "id": "phonemizer@1.2.1",
+        "name": "phonemizer",
+        "version": "1.2.1",
+        "publisher": "xenova",
+        "license": "Apache-2.0",
+        "registryTarballUrl": "https://registry.npmjs.org/phonemizer/-/phonemizer-1.2.1.tgz",
+        "integritySha512": "sha512-v0KJ4mi2T4Q7eJQ0W15Xd4G9k4kICSXE8bpDeJ8jisL4RyJhNWsweKTOi88QXFc4r4LZlz5jVL5lCHhkpdT71A==",
+        "shasumSha1": "175aed7034b49b9169fc6adf13c16134374d238d",
+        "purpose": "Bundled eSpeak-NG-based text-to-phoneme conversion used by Kokoro."
+      }
+    ],
+    "dependencyEdges": [
+      { "from": "kokoro-js@1.2.1", "to": "@huggingface/transformers@3.5.1" },
+      { "from": "kokoro-js@1.2.1", "to": "phonemizer@1.2.1" },
+      { "from": "@huggingface/transformers@3.5.1", "to": "@huggingface/jinja@0.4.1" },
+      { "from": "@huggingface/transformers@3.5.1", "to": "onnxruntime-web@1.22.0-dev.20250409-89f8206ba4" },
+      { "from": "onnxruntime-web@1.22.0-dev.20250409-89f8206ba4", "to": "flatbuffers@25.2.10" },
+      { "from": "onnxruntime-web@1.22.0-dev.20250409-89f8206ba4", "to": "guid-typescript@1.0.9" },
+      { "from": "onnxruntime-web@1.22.0-dev.20250409-89f8206ba4", "to": "long@5.3.2" },
+      { "from": "onnxruntime-web@1.22.0-dev.20250409-89f8206ba4", "to": "onnxruntime-common@1.22.0-dev.20250409-89f8206ba4" },
+      { "from": "onnxruntime-web@1.22.0-dev.20250409-89f8206ba4", "to": "platform@1.3.6" },
+      { "from": "onnxruntime-web@1.22.0-dev.20250409-89f8206ba4", "to": "protobufjs@7.5.0" },
+      { "from": "protobufjs@7.5.0", "to": "@protobufjs/aspromise@1.1.2" },
+      { "from": "protobufjs@7.5.0", "to": "@protobufjs/base64@1.1.2" },
+      { "from": "protobufjs@7.5.0", "to": "@protobufjs/codegen@2.0.4" },
+      { "from": "protobufjs@7.5.0", "to": "@protobufjs/eventemitter@1.1.0" },
+      { "from": "protobufjs@7.5.0", "to": "@protobufjs/fetch@1.1.0" },
+      { "from": "protobufjs@7.5.0", "to": "@protobufjs/float@1.0.2" },
+      { "from": "protobufjs@7.5.0", "to": "@protobufjs/inquire@1.1.0" },
+      { "from": "protobufjs@7.5.0", "to": "@protobufjs/path@1.1.2" },
+      { "from": "protobufjs@7.5.0", "to": "@protobufjs/pool@1.1.0" },
+      { "from": "protobufjs@7.5.0", "to": "@protobufjs/utf8@1.1.0" },
+      { "from": "protobufjs@7.5.0", "to": "@types/node@22.10.6" },
+      { "from": "protobufjs@7.5.0", "to": "long@5.3.2" },
+      { "from": "@protobufjs/fetch@1.1.0", "to": "@protobufjs/aspromise@1.1.2" },
+      { "from": "@protobufjs/fetch@1.1.0", "to": "@protobufjs/inquire@1.1.0" },
+      { "from": "@types/node@22.10.6", "to": "undici-types@6.20.0" }
+    ],
+    "selectedClosureOptionalDependencyEdges": [],
+    "selectedClosurePeerDependencyEdges": []
+  },
+  "coreSourceRevisions": [
+    {
+      "package": "kokoro-js@1.2.1",
+      "repository": "https://github.com/hexgrad/kokoro",
+      "commit": "664c76a704021239ba59c84dcbaa4d3dece01fe9",
+      "immutableSourceUrl": "https://github.com/hexgrad/kokoro/tree/664c76a704021239ba59c84dcbaa4d3dece01fe9/kokoro.js"
+    },
+    {
+      "package": "@huggingface/transformers@3.5.1",
+      "repository": "https://github.com/huggingface/transformers.js",
+      "commit": "746c8c25bf27c5e0684a20f76889b4bb8d23e295",
+      "immutableSourceUrl": "https://github.com/huggingface/transformers.js/tree/746c8c25bf27c5e0684a20f76889b4bb8d23e295"
+    },
+    {
+      "package": "phonemizer@1.2.1",
+      "repository": "https://github.com/xenova/phonemizer.js",
+      "commit": "6835144b7ee9043129222549c1ed2f6a27216278",
+      "immutableSourceUrl": "https://github.com/xenova/phonemizer.js/tree/6835144b7ee9043129222549c1ed2f6a27216278"
+    },
+    {
+      "package": "onnxruntime-web@1.22.0-dev.20250409-89f8206ba4",
+      "repository": "https://github.com/microsoft/onnxruntime",
+      "commit": "89f8206ba4f1c22c39e0297fb55272e8ce8cd7d0",
+      "immutableSourceUrl": "https://github.com/microsoft/onnxruntime/tree/89f8206ba4f1c22c39e0297fb55272e8ce8cd7d0/js/web"
+    }
+  ],
+  "candidateArtifacts": [
+    {
+      "id": "kokoro-js-browser-entry",
+      "package": "kokoro-js@1.2.1",
+      "path": "dist/kokoro.web.js",
+      "role": "kokoro-tts-browser-entrypoint",
+      "bytes": 2135146,
+      "sha256": "6067712fe4c43cdb36c762f860a5ab8d96ea1d9c8882466438eb9f3d0d20be8f",
+      "mediaType": "application/javascript",
+      "sourceUrl": "https://cdn.jsdelivr.net/npm/kokoro-js@1.2.1/dist/kokoro.web.js",
+      "sourceRevision": "664c76a704021239ba59c84dcbaa4d3dece01fe9",
+      "declaredPackageLicense": "Apache-2.0",
+      "fileLicenseVerificationStatus": "published-bundle-package-license-recorded-third-party-notice-closure-incomplete",
+      "digestEvidence": "registry-integrity-verified-tarball-byte-match",
+      "sourceAdmission": "exact-version-source-url-no-redirect-media-type-verified"
+    },
+    {
+      "id": "transformers-whisper-browser-entry",
+      "package": "@huggingface/transformers@3.5.1",
+      "path": "dist/transformers.js",
+      "role": "transformers-whisper-browser-entrypoint-with-bundled-onnx-runtime-javascript",
+      "bytes": 2141070,
+      "sha256": "730d42f06974f547e1f6a5f5b7313fc731ff21a3d3ac4c8e47d1f69b0a375547",
+      "mediaType": "application/javascript",
+      "sourceUrl": "https://cdn.jsdelivr.net/npm/@huggingface/transformers@3.5.1/dist/transformers.js",
+      "sourceRevision": "746c8c25bf27c5e0684a20f76889b4bb8d23e295",
+      "declaredPackageLicense": "Apache-2.0",
+      "fileLicenseVerificationStatus": "published-bundle-package-license-and-inline-onnx-mit-headers-recorded-third-party-notice-closure-incomplete",
+      "digestEvidence": "registry-integrity-verified-tarball-byte-match",
+      "sourceAdmission": "exact-version-source-url-no-redirect-media-type-verified"
+    },
+    {
+      "id": "onnx-runtime-jsep-module",
+      "package": "@huggingface/transformers@3.5.1",
+      "upstreamPackage": "onnxruntime-web@1.22.0-dev.20250409-89f8206ba4",
+      "path": "dist/ort-wasm-simd-threaded.jsep.mjs",
+      "role": "onnx-runtime-jsep-esm-and-pthread-worker-module",
+      "bytes": 44484,
+      "sha256": "08fb86ec433c78bfb032c5d84a68b8e8e5a8d81268fa39e24314179a5767a5b9",
+      "mediaType": "application/javascript",
+      "sourceUrl": "https://cdn.jsdelivr.net/npm/@huggingface/transformers@3.5.1/dist/ort-wasm-simd-threaded.jsep.mjs",
+      "packagingRevision": "746c8c25bf27c5e0684a20f76889b4bb8d23e295",
+      "upstreamSourceRevision": "89f8206ba4f1c22c39e0297fb55272e8ce8cd7d0",
+      "declaredPackageLicense": "MIT",
+      "fileLicenseVerificationStatus": "onnx-mit-package-license-and-immutable-source-notices-recorded-published-tarball-notices-absent",
+      "digestEvidence": "transformers-and-onnx-registry-integrity-verified-tarball-byte-match",
+      "sourceAdmission": "exact-version-source-url-no-redirect-media-type-verified"
+    },
+    {
+      "id": "onnx-runtime-jsep-wasm",
+      "package": "@huggingface/transformers@3.5.1",
+      "upstreamPackage": "onnxruntime-web@1.22.0-dev.20250409-89f8206ba4",
+      "path": "dist/ort-wasm-simd-threaded.jsep.wasm",
+      "role": "onnx-runtime-jsep-webassembly-binary",
+      "bytes": 21596019,
+      "sha256": "c46655e8a94afc45338d4cb2b840475f88e5012d524509916e505079c00bfa39",
+      "mediaType": "application/wasm",
+      "sourceUrl": "https://cdn.jsdelivr.net/npm/@huggingface/transformers@3.5.1/dist/ort-wasm-simd-threaded.jsep.wasm",
+      "packagingRevision": "746c8c25bf27c5e0684a20f76889b4bb8d23e295",
+      "upstreamSourceRevision": "89f8206ba4f1c22c39e0297fb55272e8ce8cd7d0",
+      "declaredPackageLicense": "MIT",
+      "fileLicenseVerificationStatus": "onnx-mit-package-license-and-immutable-source-notices-recorded-published-tarball-notices-absent",
+      "digestEvidence": "transformers-and-onnx-registry-integrity-verified-tarball-byte-match",
+      "sourceAdmission": "exact-version-source-url-no-redirect-media-type-verified"
+    }
+  ],
+  "candidateModelAuthorities": {
+    "status": "browser-speech-caller-model-provider-download-authorities-available-warn-first",
+    "runtimeBytesPacked": false,
+    "modelWeightsPacked": false,
+    "voiceBytesPacked": false,
+    "secureGraphSourceAdmissionContract": {
+      "sdkSourceCommits": [
+        "f84c27f66b0642d7f04cf5886cae32f38ab2d12f",
+        "4c9a2f9afcb641122ac4fe0a3e811b977ff5ab4d",
+        "d5e08e33dc9c20e95688444572176070db006052"
+      ],
+      "defaultRedirectPolicy": "artifact-graph-source-redirects-rejected",
+      "declaredRedirectPolicy": "artifact-graph-only-declared-final-https-origins-admitted",
+      "descriptorFields": {
+        "redirectFinalOrigins": "Optional nonempty exact HTTPS-origin inventory. Supplying it changes graph identity and permits Fetch redirect following only when the exposed final response origin is declared.",
+        "sourceMediaType": "Optional exact transport Content-Type when the authenticated source response media type differs from the execution mediaType. Supplying it changes graph identity."
+      },
+      "immutableAuthority": "The revision-pinned sourceUrl remains authority. A followed final URL, redirect cache URL, Xet path, signed query, or ETag never replaces it and is not persisted as authority.",
+      "byteAuthority": "Every cold response must still match the declared positive byte length and SHA-256, is persisted to DBOPFS, reopened and rehashed, and is admitted only after the manifest is written last.",
+      "browserObservationBoundary": "Browser Fetch exposes the final response URL, not every intermediate redirect hop. The SDK validates the exposed final HTTPS origin; CORS or redirect policy rejection before a Response exists propagates as artifact-graph-source-fetch-rejected. This record makes no per-hop-origin proof claim.",
+      "credentials": "omit",
+      "cache": "no-store",
+      "referrerPolicy": "no-referrer"
+    },
+    "graphs": [
+      {
+        "id": "xenova-whisper-small-q8-2d67713f236afa48a18992566e7647f6ca848e13",
+        "role": "stt",
+        "modelId": "Xenova/whisper-small",
+        "dtype": "q8",
+        "revision": "2d67713f236afa48a18992566e7647f6ca848e13",
+        "inputSampleRate": 16000,
+        "licenseDeclaration": "Apache-2.0",
+        "licenseEvidence": {
+          "url": "https://huggingface.co/api/models/Xenova/whisper-small/revision/2d67713f236afa48a18992566e7647f6ca848e13?blobs=true",
+          "status": "exact-revision-api-license-declaration-only-immutable-license-file-digest-not-captured"
+        },
+        "baseSourceUrl": "https://huggingface.co/Xenova/whisper-small/resolve/2d67713f236afa48a18992566e7647f6ca848e13/",
+        "fileCount": 7,
+        "modelBytes": 251875316,
+        "modelAndSelectedRuntimeBytes": 275656889,
+        "files": [
+          {
+            "kind": "model-configuration-json",
+            "path": "config.json",
+            "sourceUrl": "https://huggingface.co/Xenova/whisper-small/resolve/2d67713f236afa48a18992566e7647f6ca848e13/config.json",
+            "mediaType": "application/json",
+            "sourceMediaType": "text/plain",
+            "license": "Apache-2.0",
+            "bytes": 2232,
+            "sha256": "5a6429d21d7a3379dd0861b74510f9f7076f32b563bffc9fcb072482d55ab3be",
+            "redirectFinalOrigins": ["https://huggingface.co"],
+            "observedRedirect": "307-to-same-origin-resolve-cache",
+            "observedEtag": "a239fdd538b77d3c496d13d085848eca67fe993a"
+          },
+          {
+            "kind": "model-generation-configuration-json",
+            "path": "generation_config.json",
+            "sourceUrl": "https://huggingface.co/Xenova/whisper-small/resolve/2d67713f236afa48a18992566e7647f6ca848e13/generation_config.json",
+            "mediaType": "application/json",
+            "sourceMediaType": "text/plain",
+            "license": "Apache-2.0",
+            "bytes": 3837,
+            "sha256": "0b7407a4e53a677f826e03c75d409e6f830663932bf43dda3b08c5efa2223279",
+            "redirectFinalOrigins": ["https://huggingface.co"],
+            "observedRedirect": "307-to-same-origin-resolve-cache",
+            "observedEtag": "66f96818620f7b67c276aed4a35bedc4f6986dc3"
+          },
+          {
+            "kind": "model-preprocessor-json",
+            "path": "preprocessor_config.json",
+            "sourceUrl": "https://huggingface.co/Xenova/whisper-small/resolve/2d67713f236afa48a18992566e7647f6ca848e13/preprocessor_config.json",
+            "mediaType": "application/json",
+            "sourceMediaType": "text/plain",
+            "license": "Apache-2.0",
+            "bytes": 339,
+            "sha256": "a6a76d28c93edb273669eb9e0b0636a2bddbb1272c3261e47b7ca6dfdbac1b8d",
+            "redirectFinalOrigins": ["https://huggingface.co"],
+            "observedRedirect": "307-to-same-origin-resolve-cache",
+            "observedEtag": "91876762a536a746d268353c5cba57286e76b058"
+          },
+          {
+            "kind": "model-tokenizer-json",
+            "path": "tokenizer.json",
+            "sourceUrl": "https://huggingface.co/Xenova/whisper-small/resolve/2d67713f236afa48a18992566e7647f6ca848e13/tokenizer.json",
+            "mediaType": "application/json",
+            "sourceMediaType": "text/plain",
+            "license": "Apache-2.0",
+            "bytes": 2480466,
+            "sha256": "27fc476bfe7f17299480be2273fc0608e4d5a99aba2ab5dec5374b4482d1a566",
+            "redirectFinalOrigins": ["https://huggingface.co"],
+            "observedRedirect": "307-to-same-origin-resolve-cache",
+            "observedEtag": "1e95340ff836fad1b5932e800fb7b8c5e6d78a74"
+          },
+          {
+            "kind": "model-tokenizer-json",
+            "path": "tokenizer_config.json",
+            "sourceUrl": "https://huggingface.co/Xenova/whisper-small/resolve/2d67713f236afa48a18992566e7647f6ca848e13/tokenizer_config.json",
+            "mediaType": "application/json",
+            "sourceMediaType": "text/plain",
+            "license": "Apache-2.0",
+            "bytes": 282683,
+            "sha256": "2a4c4281cf9f51ac6ccc406fdc711a087afe6530f671fa7b80953edc498275ce",
+            "redirectFinalOrigins": ["https://huggingface.co"],
+            "observedRedirect": "307-to-same-origin-resolve-cache",
+            "observedEtag": "d13b786c04765fb1a06492b53587752cd67665ea"
+          },
+          {
+            "kind": "model-onnx-binary",
+            "path": "onnx/encoder_model_quantized.onnx",
+            "sourceUrl": "https://huggingface.co/Xenova/whisper-small/resolve/2d67713f236afa48a18992566e7647f6ca848e13/onnx/encoder_model_quantized.onnx",
+            "mediaType": "application/octet-stream",
+            "license": "Apache-2.0",
+            "bytes": 92324809,
+            "sha256": "969f5ac12974340386bf7a02ea6626003e5e2dee396ffc6ab0eec282bf55ba06",
+            "redirectFinalOrigins": ["https://us.aws.cdn.hf.co"],
+            "observedRedirect": "302-to-expiring-signed-xet",
+            "observedFinalPath": "/xet-bridge-us/6452c2113a794b2d9b15b8ae/ca019c006b3a393c1cf31063a4a186fc9060d1e24e93a71a03cddfb3363faccb",
+            "signedFinalQueryRecorded": false
+          },
+          {
+            "kind": "model-onnx-binary",
+            "path": "onnx/decoder_model_merged_quantized.onnx",
+            "sourceUrl": "https://huggingface.co/Xenova/whisper-small/resolve/2d67713f236afa48a18992566e7647f6ca848e13/onnx/decoder_model_merged_quantized.onnx",
+            "mediaType": "application/octet-stream",
+            "license": "Apache-2.0",
+            "bytes": 156780950,
+            "sha256": "fcfc6100dc7339e7507e10f8b274350be7c4f8d8b575f0293f94cc0e156d6d24",
+            "redirectFinalOrigins": ["https://us.aws.cdn.hf.co"],
+            "observedRedirect": "302-to-expiring-signed-xet",
+            "observedFinalPath": "/xet-bridge-us/6452c2113a794b2d9b15b8ae/414ba17dccaae99fa86802d93b740843da55ca419ca751126fe6165caf68fbd8",
+            "signedFinalQueryRecorded": false
+          }
+        ]
+      },
+      {
+        "id": "onnx-community-kokoro-82m-v1-q8-af-heart-1939ad2a8e416c0acfeecc08a694d14ef25f2231",
+        "role": "tts",
+        "modelId": "onnx-community/Kokoro-82M-v1.0-ONNX",
+        "dtype": "q8",
+        "revision": "1939ad2a8e416c0acfeecc08a694d14ef25f2231",
+        "outputSampleRate": 24000,
+        "defaultVoice": "af_heart",
+        "licenseDeclaration": "Apache-2.0",
+        "licenseEvidence": {
+          "url": "https://huggingface.co/api/models/onnx-community/Kokoro-82M-v1.0-ONNX/revision/1939ad2a8e416c0acfeecc08a694d14ef25f2231?blobs=true",
+          "status": "exact-revision-api-license-declaration-only-immutable-license-file-digest-not-captured"
+        },
+        "baseSourceUrl": "https://huggingface.co/onnx-community/Kokoro-82M-v1.0-ONNX/resolve/1939ad2a8e416c0acfeecc08a694d14ef25f2231/",
+        "fileCount": 5,
+        "modelAndVoiceBytes": 92887010,
+        "modelVoiceAndSelectedRuntimeBytes": 116662659,
+        "files": [
+          {
+            "kind": "model-configuration-json",
+            "path": "config.json",
+            "sourceUrl": "https://huggingface.co/onnx-community/Kokoro-82M-v1.0-ONNX/resolve/1939ad2a8e416c0acfeecc08a694d14ef25f2231/config.json",
+            "mediaType": "application/json",
+            "sourceMediaType": "text/plain",
+            "license": "Apache-2.0",
+            "bytes": 44,
+            "sha256": "df34b4f930b23447cd4dc410fabfb42eb3f24e803e6c3f97d618fb359380a36f",
+            "redirectFinalOrigins": ["https://huggingface.co"],
+            "observedRedirect": "307-to-same-origin-resolve-cache",
+            "observedEtag": "790faf216e7e3f490e71e8bc80df79ed8941101c"
+          },
+          {
+            "kind": "model-tokenizer-json",
+            "path": "tokenizer.json",
+            "sourceUrl": "https://huggingface.co/onnx-community/Kokoro-82M-v1.0-ONNX/resolve/1939ad2a8e416c0acfeecc08a694d14ef25f2231/tokenizer.json",
+            "mediaType": "application/json",
+            "sourceMediaType": "text/plain",
+            "license": "Apache-2.0",
+            "bytes": 3497,
+            "sha256": "77a02c8e164413299b4b4c403b14f8e0e1c1b727db4d46a09d6327b861060a34",
+            "redirectFinalOrigins": ["https://huggingface.co"],
+            "observedRedirect": "307-to-same-origin-resolve-cache",
+            "observedEtag": "4280f55fc1c32211bc9bb4d55545759a00054ecd"
+          },
+          {
+            "kind": "model-tokenizer-json",
+            "path": "tokenizer_config.json",
+            "sourceUrl": "https://huggingface.co/onnx-community/Kokoro-82M-v1.0-ONNX/resolve/1939ad2a8e416c0acfeecc08a694d14ef25f2231/tokenizer_config.json",
+            "mediaType": "application/json",
+            "sourceMediaType": "text/plain",
+            "license": "Apache-2.0",
+            "bytes": 113,
+            "sha256": "be1cb066d6ef6b074b3f15e6a6dd21ac88ff3cdaedf325f0aaed686c70f75d20",
+            "redirectFinalOrigins": ["https://huggingface.co"],
+            "observedRedirect": "307-to-same-origin-resolve-cache",
+            "observedEtag": "5c81e9a3a06db9139900d6ee5b60e8bb701ccb0b"
+          },
+          {
+            "kind": "model-onnx-binary",
+            "path": "onnx/model_quantized.onnx",
+            "sourceUrl": "https://huggingface.co/onnx-community/Kokoro-82M-v1.0-ONNX/resolve/1939ad2a8e416c0acfeecc08a694d14ef25f2231/onnx/model_quantized.onnx",
+            "mediaType": "application/octet-stream",
+            "license": "Apache-2.0",
+            "bytes": 92361116,
+            "sha256": "fbae9257e1e05ffc727e951ef9b9c98418e6d79f1c9b6b13bd59f5c9028a1478",
+            "redirectFinalOrigins": ["https://us.aws.cdn.hf.co"],
+            "observedRedirect": "302-to-expiring-signed-xet",
+            "observedFinalPath": "/xet-bridge-us/67a5e958d363dcc0e458b910/72db5d760d8920a2fbd09b5a5b109b29c71c5e525956e6166025d1146c851e15",
+            "signedFinalQueryRecorded": false
+          },
+          {
+            "kind": "voice-style-binary",
+            "path": "voices/af_heart.bin",
+            "sourceUrl": "https://huggingface.co/onnx-community/Kokoro-82M-v1.0-ONNX/resolve/1939ad2a8e416c0acfeecc08a694d14ef25f2231/voices/af_heart.bin",
+            "mediaType": "application/octet-stream",
+            "license": "Apache-2.0",
+            "bytes": 522240,
+            "sha256": "d583ccff3cdca2f7fae535cb998ac07e9fcb90f09737b9a41fa2734ec44a8f0b",
+            "redirectFinalOrigins": ["https://us.aws.cdn.hf.co"],
+            "observedRedirect": "302-to-expiring-signed-xet",
+            "observedFinalPath": "/xet-bridge-us/67a5e958d363dcc0e458b910/478bbd0d587a03135a4899153eac4a80a046d65a32d924b25ea059319b055df8",
+            "signedFinalQueryRecorded": false,
+            "runtimeRequestUrls": [
+              "https://huggingface.co/onnx-community/Kokoro-82M-v1.0-ONNX/resolve/main/voices/af_heart.bin"
+            ],
+            "runtimeAliasAuthority": "authenticated-local-route-only-never-source-or-network-authority"
+          }
+        ]
+      }
+    ]
+  },
+  "authenticatedVerification": {
+    "status": "browser-speech-registry-tarballs-and-selected-runtime-bytes-verified",
+    "registryTarballCount": 23,
+    "dependencyEdgeCount": 25,
+    "archiveAdmission": "all-registry-tarball-paths-and-member-types-verified-before-extraction",
+    "manifestAdmission": "all-extracted-package-name-version-license-fields-verified",
+    "selectedArtifactCount": 4,
+    "selectedArtifactAdmission": "all-selected-byte-lengths-and-sha256-values-verified",
+    "onnxPackagingRelationship": "transformers-jsep-mjs-and-wasm-byte-identical-to-recorded-onnxruntime-web-package",
+    "networkSourceAdmission": "all-selected-exact-version-source-urls-returned-without-redirect-and-with-admitted-media-types",
+    "temporaryExport": "read-only-nonrepository-audit-export-identity-checked-and-removed"
+  },
+  "immutableOnnxNoticeEvidence": {
+    "sourceRevision": "89f8206ba4f1c22c39e0297fb55272e8ce8cd7d0",
+    "license": {
+      "url": "https://raw.githubusercontent.com/microsoft/onnxruntime/89f8206ba4f1c22c39e0297fb55272e8ce8cd7d0/LICENSE",
+      "bytes": 1073,
+      "sha256": "2f07c72751aed99790b8a4869cf2311df85a860b22ded05fa22803587a48922c",
+      "mediaType": "text/plain"
+    },
+    "thirdPartyNotices": {
+      "url": "https://raw.githubusercontent.com/microsoft/onnxruntime/89f8206ba4f1c22c39e0297fb55272e8ce8cd7d0/ThirdPartyNotices.txt",
+      "bytes": 326866,
+      "sha256": "e9e90971a8e75a9a8ac0c6412e29c1202d079998389915aa485f46c816c3b4cc",
+      "mediaType": "text/plain"
+    },
+    "evidenceBoundary": "These files are immutable source-revision evidence. The published onnxruntime-web tarball omits LICENSE and ThirdPartyNotices, so this record does not claim that the package itself carries complete notice closure or that the notice file proves the exact compiled feature set."
+  },
+  "compositeLicenseNoticeEvidence": {
+    "status": "external-upstream-distribution-not-an-sdk-runtime-gate",
+    "publicOperationalSttGraphStatus": "browser-speech-stt-public-graph-ready-from-upstream-downloads",
+    "publicOperationalTtsGraphStatus": "browser-speech-tts-public-graph-ready-from-upstream-downloads",
+    "runtimeRedistributionAuthorized": false,
+    "contentAddressedLicenseReceiptPublished": false,
+    "verifiedCoreLegalEvidence": [
+      {
+        "component": "kokoro-js@1.2.1",
+        "declaredLicense": "Apache-2.0",
+        "sourceKind": "registry-integrity-verified-tarball-member",
+        "sourcePath": "package/LICENSE",
+        "bytes": 11357,
+        "sha256": "c71d239df91726fc519c6eb72d318ec65820627232b2f796219e87dcf35d0ab4",
+        "evidenceStatus": "package-license-bytes-verified-embedded-component-obligations-not-closed"
+      },
+      {
+        "component": "@huggingface/transformers@3.5.1",
+        "declaredLicense": "Apache-2.0",
+        "sourceKind": "registry-integrity-verified-tarball-member",
+        "sourcePath": "package/LICENSE",
+        "bytes": 11358,
+        "sha256": "cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30",
+        "evidenceStatus": "package-license-bytes-verified-bundled-onnx-component-obligations-not-closed"
+      },
+      {
+        "component": "phonemizer@1.2.1",
+        "declaredLicense": "Apache-2.0",
+        "sourceKind": "registry-integrity-verified-tarball-member",
+        "sourcePath": "package/LICENSE",
+        "bytes": 11357,
+        "sha256": "c71d239df91726fc519c6eb72d318ec65820627232b2f796219e87dcf35d0ab4",
+        "evidenceStatus": "package-license-bytes-verified-embedded-espeak-obligations-not-identified"
+      },
+      {
+        "component": "onnxruntime-web@1.22.0-dev.20250409-89f8206ba4",
+        "declaredLicense": "MIT",
+        "sourceKind": "immutable-upstream-source-revision",
+        "sourceRevision": "89f8206ba4f1c22c39e0297fb55272e8ce8cd7d0",
+        "licenseBytes": 1073,
+        "licenseSha256": "2f07c72751aed99790b8a4869cf2311df85a860b22ded05fa22803587a48922c",
+        "thirdPartyNoticesBytes": 326866,
+        "thirdPartyNoticesSha256": "e9e90971a8e75a9a8ac0c6412e29c1202d079998389915aa485f46c816c3b4cc",
+        "evidenceStatus": "immutable-source-license-and-notices-verified-published-tarball-carriage-and-exact-compiled-feature-closure-unproven"
+      }
+    ],
+    "phonemizerEmbeddedEspeakFinding": {
+      "hostPackage": "phonemizer@1.2.1",
+      "hostSourceRevision": "6835144b7ee9043129222549c1ed2f6a27216278",
+      "generatedWorkerPath": "src/espeakng.worker.js",
+      "generatedWorkerBytes": 1449799,
+      "generatedWorkerSha256": "6bab8f2f2cf25d65b596b87471cb17567a496012ee6ce649cfa88b284c1fb9f8",
+      "embeddedDataPath": "data/espeakng.worker.data",
+      "embeddedDataBytes": 890802,
+      "embeddedDataSha256": "6262621f3f8267fb61ef41fe7af75b8fe7e2315d6c9092afd29d7629bb21a60b",
+      "exactEspeakUpstreamRevision": null,
+      "exactBuildToolchainReceipt": null,
+      "exactGeneratedOutputToCorrespondingSourceBinding": null,
+      "licenseNoticeClosureStatus": "phonemizer-embedded-espeak-license-and-notice-evidence-missing",
+      "correspondingSourceStatus": "phonemizer-embedded-espeak-corresponding-source-unidentified",
+      "finding": "The exact generated Worker and data are not byte-identical to the audited candidate eSpeak package output. The phonemizer package and source revision identify no exact eSpeak upstream revision, build recipe, corresponding-source mapping, or complete embedded notice set. Adding an unbound license text would not close this boundary."
+    },
+    "dependencyLegalInventory": {
+      "dependencyNodeCount": 23,
+      "tarballsWithLegalMembers": 20,
+      "tarballsWithoutRootLegalMembers": [
+        "guid-typescript@1.0.9",
+        "onnxruntime-common@1.22.0-dev.20250409-89f8206ba4",
+        "onnxruntime-web@1.22.0-dev.20250409-89f8206ba4"
+      ],
+      "artifactToComponentInclusionMapStatus": "browser-speech-selected-bundle-artifact-to-component-inclusion-map-incomplete"
+    },
+    "requiredClosure": [],
+    "evidenceBoundary": "This is historical upstream-package evidence, not an SDK redistribution receipt or execution gate. The SDK does not republish these runtime, model, voice, license, or corresponding-source payloads."
+  },
+  "operationalRuntimeFindings": {
+    "status": "browser-speech-upstream-package-and-provider-downloads-default-secure-graph-optional",
+    "kokoroVoiceRequest": {
+      "requestPattern": "https://huggingface.co/onnx-community/Kokoro-82M-v1.0-ONNX/resolve/main/voices/${voice}.bin",
+      "cacheStorageName": "kokoro-voices",
+      "packageOverride": "kokoro-js-1.2.1-exposes-no-voice-url-bytes-resolver-or-provider-override",
+      "admissionRequirement": "warn-first-uses-the-upstream-provider-request-and-browser-cache-secure-graph-mode-may-map-it-to-a-caller-declared-local-file"
+    },
+    "onnxWasmFallback": {
+      "requestPattern": "https://cdn.jsdelivr.net/npm/@huggingface/transformers@${version}/dist/",
+      "admissionRequirement": "warn-first-uses-the-caller-selected-version-pinned-upstream-wasmPaths-secure-graph-mode-requires-materialized-runtime-files"
+    },
+    "workerBoundary": "The dedicated SDK Worker uses declared graph routes only for explicit secure:true artifact aliases. Default warn-first mode uses the direct upstream runtime/model authority and ordinary browser capabilities.",
+    "failClosedBoundary": "Strict rejection of undeclared capabilities is opt-in through secure:true. Default operation warns and proceeds so optional hardening cannot disable the selected provider."
+  },
+  "exclusions": {
+    "selectedBrowserClosureContainsOptionalDependencyEdges": false,
+    "selectedBrowserClosureContainsPeerDependencyEdges": false,
+    "excludedPackageTrees": [
+      {
+        "root": "onnxruntime-node@1.21.0",
+        "reason": "Transformers Node and native inference dependency; not part of the selected browser artifact graph."
+      },
+      {
+        "root": "sharp@0.34.1",
+        "reason": "Transformers Node and native image-processing dependency; not part of the selected browser artifact graph."
+      }
+    ],
+    "excludedArtifactsAndAuthorities": [
+      {
+        "subject": "dist/transformers.web.js",
+        "reason": "This package export retains bare onnxruntime-common and onnxruntime-web imports; the selected unminified bundled entry is dist/transformers.js."
+      },
+      {
+        "subject": "dist/transformers.min.js",
+        "reason": "Operational bundled sibling not selected by this authority; the selected unminified entry preserves inspectable license headers."
+      },
+      {
+        "subject": "ort-wasm-simd-threaded.mjs and ort-wasm-simd-threaded.wasm",
+        "reason": "Non-JSEP ONNX pair; the selected Transformers and Kokoro browser graph uses the JSEP pair."
+      },
+      {
+        "subject": "model weights and Kokoro voice binaries",
+        "reason": "Caller-owned model, revision, dtype and voice authority; this package metadata record does not select or bundle them."
+      },
+      {
+        "subject": "mutable CDN loaders and network fallbacks",
+        "reason": "Secure graph mode excludes mutable loaders and undeclared fallbacks; default warn-first mode uses caller-selected version-pinned upstream package and provider URLs."
+      }
+    ]
+  },
+  "registryProvenance": {
+    "checkedPackages": [
+      "kokoro-js@1.2.1",
+      "@huggingface/transformers@3.5.1",
+      "phonemizer@1.2.1",
+      "onnxruntime-web@1.22.0-dev.20250409-89f8206ba4"
+    ],
+    "distAttestations": null,
+    "sigstoreProvenanceClaim": false,
+    "description": "The checked core npm metadata exposes no dist attestations. This authority makes no Sigstore or npm provenance claim. Registry integrity and signatures are not substitutes for selected-file verification."
+  },
+  "plannedVerification": {
+    "status": "no-sdk-redistribution-or-legal-corpus-release-gate",
+    "sequence": []
+  },
+  "runtimeImplementation": {
+    "status": "browser-speech-warn-first-upstream-and-secure-graph-contracts-passed",
+    "sourceCommits": [
+      "fba95ed0fa2e9ab11727e19b257a8d7e1e95a495",
+      "f466458a09a2f6210c46aeaafcdc56a9da5c3a82",
+      "f84c27f66b0642d7f04cf5886cae32f38ab2d12f",
+      "4c9a2f9afcb641122ac4fe0a3e811b977ff5ab4d",
+      "d5e08e33dc9c20e95688444572176070db006052"
+    ],
+    "documentationCommit": "c1967fe3dc46986844666f5bb881485a462989b6",
+    "focusedVerification": {
+      "command": "node ./bin/arcane-test.mjs test/browser-speech-providers.test.mjs",
+      "result": "27-passed-0-failed",
+      "verifiedBoundaries": [
+        "deterministic-closed-artifact-graph",
+        "declared-final-https-origin-redirect-admission",
+        "independent-source-media-type-identity-binding",
+        "fetch-response-shape-and-redirect-error-propagation",
+        "cold-warm-and-zero-network-offline-dbopfs-admission",
+        "manifest-last-persistence",
+        "declared-edge-and-dynamic-code-isolation",
+        "caller-owned-model-sample-rate-and-voice-authority",
+        "private-worker-message-channel",
+        "exact-role-operation-error-envelope-admission",
+        "abort-and-unload-supersession",
+        "provider-worker-cleanup",
+        "warn-first-upstream-package-model-voice-and-wasm-downloads",
+        "secure-graph-opt-in-without-default-runtime-restriction"
+      ]
+    },
+    "componentManifest": {
+      "path": "browser-runtime/ai/ARCANE_AI_BROWSER_SPEECH_COMPONENTS.json",
+      "closureStatus": "browser-speech-runtime-resolved-from-upstream-packages-and-provider-downloads",
+      "publicationStatus": "browser-speech-public-runtime-ready-warn-first-secure-opt-in"
+    },
+    "deferredReleaseBoundary": "The combined numeric 0.3.0 package, runtime/browser receipts, npm integrity/provenance, tag, and GitHub release remain assigned to the shared release owner after Browser Speech, singleton events, and Mail source increments are reconciled."
+  },
+  "omittedUntilVerified": [
+    "Final composite SPDX license expressions for the bundled JavaScript entrypoints.",
+    "A claim that published package tarballs carry complete ONNX Runtime ThirdPartyNotices; they do not.",
+    "A content-addressed SDK redistribution corpus; the SDK does not redistribute these upstream payloads.",
+    "The exact phonemizer embedded-eSpeak corresponding source, upstream revision, build toolchain and complete notice set.",
+    "Immutable LICENSE and NOTICE file digests for both selected model revisions; their exact-revision API values remain declarations only.",
+    "Sigstore provenance for the checked core packages because npm dist attestations were absent."
+  ]
+}