# Vendored code

Served from this site; nothing is loaded from a CDN at runtime.

## lamejs 1.2.1 (MP3 encoder)

- Package: [`lamejs`](https://www.npmjs.com/package/lamejs) **1.2.1** (published 2021-12-02), from
  `https://registry.npmjs.org/lamejs/-/lamejs-1.2.1.tgz`
  (npm integrity `sha512-s7bxvjvYthw6oPLCm5pFxvA84wUROODB8jEO2+CE1adhKgrIvVOlmMgY8zyugxGrvRaDHNJanOiS21/emty6dQ==`,
  tarball sha256 `d8d099ef788808c15bc9b4a407dd23ae935feb1152e6bb0efdcd24e3e91c2a2d`).
- Source: https://github.com/zhuker/lamejs (a JavaScript port of jump3r, itself a port of
  [LAME](https://lame.sourceforge.io/), "LAME Ain't an MP3 Encoder").
- License: **LGPL-3.0** (package.json `"license": "LGPL-3.0"`). LAME itself is LGPL.
- Files (copied **unmodified** from the tarball):
  - `lamejs/lame.min.js` (the package's prebuilt browser build; sha256 `15d285e2587b3bdbfd18a68de6ce07cc074f7480a82c3815da2dc1c348ec6df4`).
    It is loaded on its own, at runtime, by `mp3-worker.js` (`importScripts`), so it stays a separate, replaceable
    library as the LGPL asks. You can swap in your own build of lamejs at the same path.
  - `lamejs/LICENSE` (the package's license note, unmodified: "Link to LAME as separate jar … Fully acknowledge that you
    are using LAME, and give a link to our web site").
  - `lamejs/COPYING.LESSER` and `lamejs/COPYING`: the full GNU LGPL v3 and GNU GPL v3 texts (from gnu.org; the
    package doesn't ship them). The LGPL v3 is written as additional permissions on top of the GPL v3, so both are
    included.
- Why lamejs: every widely used JavaScript MP3 encoder is derived from LAME and so is LGPL (`@breezystack/lamejs`
  1.2.7 is also LGPL-3.0, not MIT). lamejs 1.2.1 is the original, most used one, and its prebuilt `lame.min.js`
  works in a classic Web Worker in Chrome, Firefox and Safari.
- Acknowledgement and links are in the page footer.

### Checks

- Network: `lame.min.js` contains no `fetch`, `XMLHttpRequest`, `WebSocket`, `importScripts`, `sendBeacon`, `eval`
  or `new Image`. The only URL in it is the string `http://www.mp3dev.org/` returned by `getLameUrl()` (a version
  string, never requested).
- Email addresses: none in `lame.min.js` or `LICENSE`. (The package's unminified `lame.all.js`, not vendored, has
  some author addresses in source comments; it was left out.)
- Tested in Node by running `mp3-worker.js` with this file: 44.1/48/32 kHz, mono and stereo, 96–320 kbps; the
  output was read back with ffprobe, afinfo and ffmpeg (sample rate, channels, bitrate, duration, pitch, level).

## Not vendored

Everything else (WAV writer, WebM and M4A muxers, resampler, time-stretch, edits) is this site's own code:
`dsp.js`, `mux.js`, `dsp-worker.js`, `mp3-worker.js`, `index.html`.