# Media engine notices and source

Tonalux uses the single-thread `@ffmpeg/core` **0.12.10** and `@ffmpeg/ffmpeg` **0.12.15**, pinned in package-lock.json. The core includes FFmpeg **5.1.4** and its enabled codec libraries. FFmpeg contributors retain their copyrights. The wrapper is copyright (c) 2019 Jerome Wu and contributors, MIT licensed. The core package declares GPL-2.0-or-later and includes GPL codecs. These are separate from the site's own code.

- [MIT licence](LICENSE.ffmpegwasm-MIT.txt)
- [GNU GPL version 2](LICENSE.FFmpeg-GPL-2.0.txt), with the core package's “or later” option
- [Official release for these exact package versions](https://github.com/ffmpegwasm/ffmpeg.wasm/releases/tag/v12.15)
- [ffmpeg.wasm source archive, build scripts and bindings](https://github.com/ffmpegwasm/ffmpeg.wasm/archive/refs/tags/v12.15.tar.gz)
- [FFmpeg 5.1.4 source archive](https://github.com/FFmpeg/FFmpeg/archive/refs/tags/n5.1.4.tar.gz)
- [Exact upstream Dockerfile and dependency source repositories/versions](UPSTREAM-Dockerfile.txt)
- [Tonalux's complete JavaScript adaptation source](/scripts/vendor-media.js)

The upstream build recipe names the source repositories and revisions for x264, x265, libvpx, LAME, Ogg, Theora, Opus, Vorbis, zlib, libwebp, FreeType, FriBidi, HarfBuzz, libass and zimg, and uses Emscripten 3.1.40. Their individual notices and licences are in those source trees. Keep this notice, licence texts, dependency source references and adaptation source available alongside the distributed engine.

No WASM binary or codec is modified. `npm run vendor:media` copies the pinned npm assets and applies two auditable JavaScript glue changes: preserve the ffprobe return value (upstream issue 817), and reserve a 5 MiB native command stack using Emscripten's exported allocation and stack primitives (the published core predates upstream PR 824's stack increase). The latter prevents the reproducible Opus stack overflow. A stack guard detects exhaustion and each command job's worker is terminated afterwards. Both patches fail closed if the expected upstream entry points change. `manifest.json` records the generated runtime files' SHA-256 hashes.

This software comes without warranty; see the applicable licences.