# Third-party notices and distribution status

Original @drakonkat/advanced-player wrapper, React UI and integration tooling:
Copyright (c) 2026 drakonkat, MIT. This does **not** relicense dependencies,
upstream source excerpts in the patch or node/patch-libmedia.mjs, or decoder binaries.

The package metadata uses `(MIT AND LGPL-3.0-or-later)` to describe the different
licensed parts of this archive, not to relicense the original wrapper:
- LICENSE (MIT): original JavaScript API, React UI, styles and build tooling.
- LGPL-3.0-or-later: libmedia excerpts and modifications in
  patches/libmedia-subtitle-worker.patch and the matching replacement snippets
  in node/patch-libmedia.mjs. The surrounding original patch-tool code is MIT.
- licenses/: unmodified upstream license texts, not application code.

## libmedia

@libmedia/avplayer 1.3.1, author Gaoxing Zhao, declares LGPL-3.0-or-later.
Project/source: https://github.com/zhaohappy/libmedia
Pinned WASM/source reference: 152f629d3021fd8013efa464fcb7b55f9fbe7753.
The installed package's license text is copied to prepared assets. Supporting
GPL/LGPL texts are in licenses/. Existing bundle copyright headers are retained.

The local subtitle-worker-1 patch modifies only a pinned JS chunk. The equivalent
upstream-source diff and original/patched fingerprints are supplied in patches/
and node/patch-libmedia.mjs. Upstream excerpts and their local modifications
remain LGPL-3.0-or-later. Local modifications by drakonkat, 2026-09-25.

The npm tarball does NOT embed libmedia bundles or WASM binaries. The build-time
asset tool copies the separately installed npm engine and fetches hash-locked
WASM artifacts. Hosting the resulting assets is a separate distribution step,
with the associated licensing obligations; a private repository is not an exemption.

## WASM / FFmpeg: unresolved release gate

The pinned upstream decoder build script uses --enable-gpl and --enable-version3:
https://github.com/zhaohappy/libmedia/blob/152f629d3021fd8013efa464fcb7b55f9fbe7753/build/build-ffmpeg-decoder.sh
https://ffmpeg.org/legal.html

Do NOT describe those prebuilt WASM artifacts as MIT or LGPL-only. Exact
corresponding sources, dependency versions and build toolchains for the prebuilt
artifacts have not yet been verified. The license texts, source links, checksums
and patch included here do NOT constitute a complete corresponding-source offer
or a completed compliance audit. No blanket commercial-distribution clearance
is asserted. Additional components and codec-patent questions require review.

The source-only npm package uses the experimental `next` channel. After the
owner's first publication, subsequent releases use an authorized protected-main
GitLab CI publisher. Its artifact check is separate from the generated asset
audit, which remains OPEN. See RELEASE-AUDIT.md and RELEASE.md. Neither automated
npm publication nor the separately authorized public experimental Pages demo
closes the license audit.

## Optional integrations

React and Rsbuild are optional peers, not included copies of their source in
this tarball. Their own packages retain their notices and licenses. Consult
the consumer's dependency tree, not only this notice, for a full application audit.