# Upstream build instructions, not executed

These instructions describe the exact staged upstream commits. They are provided for review and later use; no command below was run as part of this source-staging task. The staged source files and upstream licence notices are unchanged from their Git blobs.

## tesseract.js-core 7.0.0

The upstream [README at the release commit](https://github.com/naptha/tesseract.js-core/blob/acffef2b66eb44a31df297e11d905f4b39001068/README.md) instructs users to install Docker and run:

```sh
cd source/tesseract.js-core-7.0.0
bash build-with-docker.sh
```

The pinned [build-with-docker.sh](https://github.com/naptha/tesseract.js-core/blob/acffef2b66eb44a31df297e11d905f4b39001068/build-with-docker.sh) sets `EM_VERSION=4.0.15` and runs the Docker image `emscripten/emsdk:4.0.15`. It mounts the working tree at `/src`, mounts `wasm/cache` into the Emscripten cache, and invokes `bash ./build.sh` in the container. The upstream script does not pin the Docker image by digest or specify a Docker client/engine version; none is inferred here.

`build.sh` prints `emcc -v`, invokes `build-scripts/install-deps.sh`, and builds zlib, libtiff, openlibm, giflib, libpng, libjpeg, libwebp, leptonica, and the Tesseract fork, in that order. It copies `third_party/tesseract/build/bin/*` to the core repository root. Every script and all of these dependency sources are included locally. Do not run `git submodule update` on this extracted archive: the exact submodules are already populated, and Git working-directory metadata is intentionally absent.

The staged `build-scripts/var.sh` has `BUILD_WASM=1`, `BUILD_WASM_RELAXED_SIMD=1`, `BUILD_SINGLE=0`, and `BUILD_CLEAN=1`. The build scripts generate the SIMD, relaxed-SIMD, and non-SIMD variants with and without the legacy engine. The README says outputs are written to the root and warns that dependency compilation can encounter parallel-build races, for which upstream suggests re-running.

The upstream `install-deps.sh` detects missing `autoconf`, `automake`, `libtool`, and `pkg-config` and installs them with apt on Linux or Homebrew otherwise. Their package versions and package-index snapshots are not pinned by that script. Docker/Emscripten, their system libraries, and those external build tools are not bundled here.

The source also includes `javascript/gen-glue.sh`, a separate optional helper for regenerating `javascript/src/glue.cpp` from `javascript/tesseract.idl`. That helper retains the older upstream `EMSCRIPTEN_VERSION=1.38.45` and Docker image `trzeci/emscripten:1.38.45`. This is a different upstream helper and is not invoked by `build.sh`; the current core compilation uses Emscripten 4.0.15. Both the IDL and generated glue are included without alteration.

## tesseract.js 7.0.0

The [upstream package.json](https://github.com/naptha/tesseract.js/blob/42eae669e4b3a66429d8516f078912cc747a89df/package.json) defines the build. The [upstream CI](https://github.com/naptha/tesseract.js/blob/42eae669e4b3a66429d8516f078912cc747a89df/.github/workflows/node.js.yml) installs dependencies with `npm ci`. A build using these upstream entry points is:

```sh
cd source/tesseract.js-7.0.0
npm ci
npm run build
```

`npm ci` requires network access to obtain the dependencies identified by the included lockfile and may execute their install lifecycle scripts. The project itself defines a `postinstall` command using `opencollective-postinstall`. No install was performed here.

The `build` command removes `dist`, uses Webpack through `scripts/webpack.config.prod.js` to produce `dist/tesseract.min.js` and `dist/worker.min.js`, then uses `scripts/rollup.esm.mjs` to produce `dist/tesseract.esm.min.js`. The source, shared build configuration, generated-source-map settings, and lockfile are included. The lockfile pins `tesseract.js-core` to version 7.0.0 and records the official npm tarball URL and integrity hash.

The exact source commit's CI matrix lists Node 16.x, 18.x, 20.x, 22.x, and 24.x. It does not pin exact Node/npm patch versions for building. The saved official npm metadata records the JavaScript package's publishing environment as Node `22.12.0` and npm `10.9.0`; these fields describe publishing metadata and are not evidence of a required build environment. The core package's npm metadata similarly records Node `14.21.3` and npm `6.14.18`, which does not override its explicit Emscripten compiler pin.

## Verification limits

All 4,804 staged Git blobs and their executable/symlink modes were verified against the exact source trees, including recursive submodules. This establishes the source bytes retrieved, not a successful compilation or byte-identical reproduction of the npm binaries. No source-file gap remains in the requested repositories or their recursive Git submodules. The npm dependencies, container image, compiler/toolchain source, and operating-system build packages are external build inputs and have not been separately vendored or tested in this task.