# Third-party distribution inventory

Verified: 2026-08-02. Production candidate processing remains in-browser and
does not upload the input image.

| Distributed component | Version / source | Bytes | SHA-256 | License | NOTICE |
|---|---|---:|---|---|---|
| `vendor/mediapipe/1.0.1/vision_bundle.mjs` | `@mediapipe/tasks-vision@1.0.1` (telemetry removed locally) | 154,823 | `fda0f18a67c69e8f4c64fa410f9b142193b265fd351910bf486e3e2716854ceb` | Apache-2.0 | package and upstream repository contain no NOTICE file |
| `vendor/mediapipe/1.0.1/wasm/vision_wasm_module_internal.js` | `@mediapipe/tasks-vision@1.0.1` | 323,415 | `da8934057f147b622e82cfb4c0dbd85461c598e268588b5a8ba9ca963a8ff82d` | Apache-2.0 | same |
| `vendor/mediapipe/1.0.1/wasm/vision_wasm_module_internal.wasm` | `@mediapipe/tasks-vision@1.0.1` | 11,756,972 | `2dabd8e23c60984628beb7bb338764c81a08e6837145273f59578684b5d53c1b` | Apache-2.0 | same |
| `models/semantic-v1/selfie_multiclass_256x256.tflite` | [official model](https://storage.googleapis.com/mediapipe-models/image_segmenter/selfie_multiclass_256x256/float32/latest/selfie_multiclass_256x256.tflite) | 16,371,837 | `c6748b1253a99067ef71f7e26ca71096cd449baefa8f101900ea23016507e0e0` | Apache-2.0 | model card has no additional NOTICE |
| `models/semantic-v1/face_landmarker.task` | [official model](https://storage.googleapis.com/mediapipe-models/face_landmarker/face_landmarker/float16/latest/face_landmarker.task) | 3,758,596 | `64184e229b263107bc2b804c6625db1341ff2bb731874b0bcc2fe6544e0bc9ff` | Apache-2.0 | model cards have no additional NOTICE |

The complete Apache License 2.0 text is distributed at
`third_party/mediapipe/LICENSE`. Upstream source and license:

- https://github.com/google-ai-edge/mediapipe
- https://github.com/google-ai-edge/mediapipe/blob/master/LICENSE
- https://www.npmjs.com/package/@mediapipe/tasks-vision/v/1.0.1

Model documentation:

- https://developers.google.com/edge/mediapipe/solutions/vision/image_segmenter
- https://storage.googleapis.com/mediapipe-assets/Model%20Card%20Multiclass%20Segmentation.pdf
- https://developers.google.com/edge/mediapipe/solutions/vision/face_landmarker
- https://storage.googleapis.com/mediapipe-assets/MediaPipe%20BlazeFace%20Model%20Card%20%28Short%20Range%29.pdf
- https://storage.googleapis.com/mediapipe-assets/Model%20Card%20MediaPipe%20Face%20Mesh%20V2.pdf

Each distributed asset is below Cloudflare Pages' 25 MiB per-file limit. Only
the module-worker WASM pair is shipped; unused classic/no-SIMD copies were
removed. The lab uses `pngjs` (MIT) and `puppeteer-core` (Apache-2.0) for tests,
but neither is required by the production browser payload.

The upstream `vision_bundle.mjs` artifact had SHA-256
`d885630c297c0b20b1fe86096cb06291c4c8080876f27852e724f24ac603713f`.
Its internal 60-second ODML telemetry queue and sender were replaced with a
no-op before distribution. This keeps model inference local by construction,
without relying on CSP to block an attempted request.