Third-party notices - 432 Player web app ========================================= This file lists third-party code that ships inside the web build and whose licence asks for a notice. It was started for the video converter (/convert/video/, September 2026) and is NOT yet a complete inventory of the app's dependencies; add to it rather than replacing it. It is published with the site at https://432hz.live/licenses/THIRD_PARTY_NOTICES.txt (linked from the video converter page), next to the full licence texts it refers to, all in the same folder: /licenses/MPL-2.0.txt Mozilla Public License 2.0 /licenses/LGPL-2.1.txt GNU Lesser General Public License 2.1 /licenses/LGPL-2.0.txt GNU Library General Public License 2 /licenses/MIT-wasm-media-encoders.txt MIT (wasm-media-encoders) /licenses/MIT-signalsmith-stretch.txt MIT (Signalsmith Stretch) /licenses/source/aacWasmBuild.ts.txt the source of our one modification to an MPL-2.0 file (section 2) 1. mediabunny 1.60.0 -------------------- Licence: Mozilla Public License 2.0 (MPL-2.0), https://mozilla.org/MPL/2.0/ (full text: /licenses/MPL-2.0.txt) Copyright: (c) 2026-present, Vanilagy and contributors Source: https://github.com/Vanilagy/mediabunny (npm: mediabunny@1.60.0) Shipped: bundled, UNMODIFIED, into /workers/videoConvert.worker.js (the video converter's worker; loaded only on that page). Used for: reading MP4/MOV/WebM/Matroska, copying the video packets, decoding and re-encoding the audio, writing the output file. MPL-2.0 is a file-level copyleft: the Source Code Form of these files is the package above, and any modification to them would have to be published under the same licence. None is made. 2. @mediabunny/aac-encoder 1.60.0 --------------------------------- Licence: MPL-2.0 (the JavaScript), https://mozilla.org/MPL/2.0/ Copyright: (c) 2026-present, Vanilagy and contributors Source: https://github.com/Vanilagy/mediabunny/tree/main/packages/aac-encoder (npm: @mediabunny/aac-encoder@1.60.0) Shipped: its JavaScript is bundled into /workers/videoConvert.worker.js; its WebAssembly binary is served as a SEPARATE FILE, /workers/aac-encoder.wasm. MODIFICATION (MPL-2.0 section 3.2): the package ships the WebAssembly inlined in a JavaScript string. At build time exactly one expression of dist/bundles/mediabunny-aac-encoder.mjs is changed - the function returning the inlined bytes is replaced by one that fetches the same bytes from /workers/aac-encoder.wasm - and the removed bytes are written out, unchanged, as that file. The transformation is src/services/video/aacWasmBuild.ts; its source is published with the site at /licenses/source/aacWasmBuild.ts.txt (MPL-2.0 Source Code Form of the modification; a test keeps that copy equal to the file the build runs). It refuses to build if the package's shape changes, and src/__tests__/aacWasmBuild.test.ts checks that the served bytes equal what the package itself decodes. 3. FFmpeg (libavcodec, libavutil) - the AAC encoder inside aac-encoder.wasm --------------------------------------------------------------------------- Licence: GNU Lesser General Public License, version 2.1 or later (LGPL-2.1-or-later), https://www.gnu.org/licenses/old-licenses/lgpl-2.1.html (full text: /licenses/LGPL-2.1.txt) Copyright: (c) the FFmpeg developers, https://ffmpeg.org/ Version: libavcodec 62.23.103 (the "Lavc62.23.103" identifier read from the shipped binary; an FFmpeg git snapshot, not a numbered release). OPEN ITEM: the exact FFmpeg commit is not published by the package and could not be pinned from here; it has to be asked of the package's maintainer, or the encoder rebuilt from a pinned commit, before the source offer below can be met byte for byte. Build: per the @mediabunny/aac-encoder README: FFmpeg configured with --disable-everything --enable-avcodec --enable-encoder=aac --disable-programs --disable-asm (and the other flags listed there), linked with src/bridge.c by Emscripten into one module. The configuration contains no --enable-gpl and no --enable-nonfree, so the result is LGPL, not GPL. The binary does not embed its configure line (checked: no such string in it), so this rests on the package's published build instructions. Why a separate file: LGPL-2.1 section 6 requires that users can replace the LGPL library with a modified version and still run the application. The encoder is loaded at run time from /workers/aac-encoder.wasm, by URL, as a self-contained module with the exported functions listed in src/bridge.c. A replacement must be built the same way (Emscripten, the flags above, the same bridge.c exports): the Emscripten loader glue bundled into /workers/videoConvert.worker.js is generated together with its WASM, so a binary from a different Emscripten version or with a different export list will not load against it. Source offer: the complete corresponding source is FFmpeg at the version above (https://git.ffmpeg.org/ffmpeg.git) plus bridge.c and the build instructions in the @mediabunny/aac-encoder package. For three years from the last deployment of this build, the 432 Player team will provide a copy of that source on request, for no more than the cost of providing it, via the support address published on https://432hz.live. Separate question for the owner, not answered here: patent licensing for distributing an AAC encoder (critique, item 10). 4. Engines the video converter runs (already shipped by the player) ------------------------------------------------------------------- - SoundTouch Audio Worklet v0.2.1 (soundtouchjs) - LGPL-2.1-or-later (/licenses/LGPL-2.1.txt) - served as /worklets/real-soundtouch-worklet.js, vendored and unmodified. The video worker fetches this same file at run time; it is not bundled. - Signalsmith Stretch 1.3.2 - MIT (/licenses/MIT-signalsmith-stretch.txt) - served as /engines/SignalsmithStretch.mjs, vendored and unmodified, imported at run time, never bundled. 5. wasm-media-encoders 0.7.0 and LAME 3.100 - the video converter's MP3 export ------------------------------------------------------------------------------ wasm-media-encoders: MIT, Copyright (c) 2020-2024 arseneyr, https://github.com/arseneyr/wasm-media-encoders (npm: wasm-media-encoders@0.7.0) LAME: GNU Lesser General Public License, version 2 or later (LGPL), https://lame.sourceforge.io/ - version 3.100 (the "3.100" string read from the shipped binary). Full texts: /licenses/LGPL-2.0.txt (the Library GPL v2 LAME names) and /licenses/LGPL-2.1.txt. wasm-media-encoders' MIT text: /licenses/MIT-wasm-media-encoders.txt. Shipped: the library's small JavaScript loader is bundled into /workers/videoConvert.worker.js; the LAME WebAssembly binary (the package's wasm/mp3.wasm, UNMODIFIED) is served as a SEPARATE FILE, /assets/mp3-.wasm, fetched only when a user exports an MP3 from a video (src/services/video/audioOnly.ts). /convert's MP3 worker already ships the same binary, inlined (mp3Encode.worker.ts). Why a separate file: as for FFmpeg above, the LGPL library is loaded at run time by URL as a self-contained module and can be replaced by a rebuild from LAME source with the package's build scripts. Source offer: LAME 3.100 source (https://sourceforge.net/projects/lame/files/lame/3.100/) plus the wasm-media-encoders build files at the version above; the same three-year offer as in section 3 applies. Development-only (NOT shipped) ------------------------------ @ffmpeg/ffmpeg and @ffmpeg/core (ffmpeg.wasm) are devDependencies used by e2e/make-video-fixtures.mjs and e2e/convert-video-offline.e2e.mjs to make test media and decode AAC. They are never part of a build.