# Vendored MP3 encoder provenance

- **File:** `lame.all.js` (the upstream unminified browser bundle, encoder only)
- **SHA-256:** `026bd88846040f357a937cd85821a48492a362eff0812cda734f23fca55fea3b`
  — asserted by `tests/structure-d3.js` so an unexpected substitution of
  the vendored encoder fails the build.
- **Package:** `lamejs` 1.2.1 (npm) — a pure-JavaScript port of the LAME
  MP3 encoder (lame.sourceforge.net), by Alex Zhukov and the LAME authors
  whose copyright notices appear throughout the file.
- **Upstream (pinned):** the 1.2.1 publish was cut from commit
  `260ecf8a2cf15b97e65442986c5c9149b0be7764` of
  https://github.com/zhuker/lamejs —
  https://github.com/zhuker/lamejs/tree/260ecf8a2cf15b97e65442986c5c9149b0be7764
  — and is immutably archived at
  https://registry.npmjs.org/lamejs/-/lamejs-1.2.1.tgz ·
  https://www.npmjs.com/package/lamejs/v/1.2.1
- **Corresponding source:** this file IS the source. `lame.all.js` is the
  upstream's unminified concatenation of its `src/js/` modules, shipped
  here byte-identical with every header comment and copyright notice
  intact — the minified `lame.min.js` variant was deliberately not chosen,
  so the LGPL's source-availability obligation is met by the served
  artifact itself, alongside the pinned upstream links above.
- **License:** LGPL. The upstream `LICENSE` file (served in this
  directory, verbatim) states the LGPL and the acknowledgment condition;
  the source headers embedded in `lame.all.js` declare LGPL v2/v2.1 "or
  (at your option) any later version", while the npm metadata declares
  LGPL-3.0. To cover that ambiguity the full texts of **LGPL-2.1**,
  **LGPL-3.0**, and **GPL-3.0** (which LGPL-3.0 incorporates by
  reference) are all served in this directory. Attribution — "MP3
  encoding by lamejs (LGPL), a JavaScript port of LAME —
  lame.sourceforge.net" — appears on the methodology page, the terms
  page, and each MP3 converter page.
- **Encoder only:** the bundle contains no MP3 *decoder*. Upstream's
  `src/main/java/mpg/` tree (a GPL-licensed decoder) is not part of
  `lame.all.js` — the bundle's `MPGLib` is an empty stub — and nothing
  from that tree may ever be copied here (see
  `docs/2026-08-08-third-party-code-legal.md`). Decoding on this site is
  browser-native `decodeAudioData`, deliberately.
- **Why it exists:** browsers decode M4A/WAV/video audio natively but
  cannot encode MP3; no permissive-licensed MP3 encoder exists (verified
  absence, same legal note). MP3's last US patent expired 2017-04-16, so
  the format carries zero patent obligation.
- **Loading:** lazy only (idle prefetch + on-demand injection by
  `audio.js`). Never referenced by a `<script>` tag in any page's HTML —
  enforced by `tests/structure-d3.js`. Deliberately NOT in the service
  worker's precache SHELL (it is ~518 KB); the runtime cache captures it
  on first fetch, which the idle prefetch makes the first page view in
  practice, so the offline story matches the HEIC decoder's.
- **To update:** bump the `lamejs` devDependency, re-copy `lame.all.js`
  and `LICENSE` here unmodified, update the version AND the SHA-256 above
  (`sha256sum lame.all.js`) plus the pinned commit/tarball links, **bump
  `CACHE_VERSION` in `../../sw.js`** so returning users' service workers
  purge the old encoder (cache-first would otherwise serve the stale copy
  forever), and re-run the conversion smoke checks in a real browser
  before pushing.