# Browser audio libraries

GetTextToSpeech serves the libraries below from this site's own `/vendor/` directory. These files handle audio on the visitor's device; no runtime CDN is used. The application and its MP3 worker load the libraries as separate ES modules.

## SoundTouchJS 2.1.1

Used packages: `@soundtouchjs/audio-worklet`, `@soundtouchjs/core`, `@soundtouchjs/worklet-base`, and `@soundtouchjs/interpolation-strategy-lanczos`, all version `2.1.1`.

- Authors and copyright holders include Olli Parviainen, Ryan Berdeen, Jakub Fiala, Steve "Cutter" Blades, and contributors. Original notices remain in the source archive and processor.
- License: [Mozilla Public License 2.0](/vendor/licenses/MPL-2.0.txt). The [package's original notice](/vendor/licenses/SoundTouchJS-UPSTREAM-NOTICE.txt) is also provided.
- Upstream: <https://github.com/cutterbl/SoundTouchJS>.
- Exact source revision: `d9e39a7ddcf74c7a145bbba45856f30068c82b79` (tag `v2.1.1`).
- [Download the source archive](/vendor/sources/soundtouchjs-2.1.1.tar.gz).
- Distributed browser files: `/vendor/soundtouch.js` and `/vendor/soundtouch-processor.js`, with source maps.
- Changes: no changes to library sources. The main module is bundled for browser imports with esbuild. The published processor is copied unchanged.

To rebuild the application wrapper, run `npm ci` and `npm run build` from the application source checkout. The upstream source archive includes the original package sources and build configuration. A compatible replacement ES module can be placed at `/vendor/soundtouch.js`; it must export `processOffline`. A compatible worklet processor must also be placed at `/vendor/soundtouch-processor.js`.

## LAME / @breezystack/lamejs 1.2.7

This is a JavaScript port of the LAME MP3 encoder, originally maintained by Alex Zhukov, distributed through the `@breezystack/lamejs` fork. LAME project: <https://lame.sourceforge.io/>. Original JavaScript project: <https://github.com/zhuker/lamejs>. Fork: <https://github.com/gideonstele/lamejs> (formerly `shijinyu/lamejs`).

- License declared by the npm package: `LGPL-3.0`. Copies of the [GNU Lesser General Public License version 3](/vendor/licenses/LGPL-3.0-only.txt), [GNU General Public License version 3](/vendor/licenses/GPL-3.0-only.txt), and [package's original notice](/vendor/licenses/lamejs-UPSTREAM-NOTICE.txt) are provided.
- Exact source revision: `1fb0ef5fa177413107e2e107d054a9b994e3f79c`, reported as `gitHead` for the published npm package version `1.2.7`.
- [Download the corresponding source archive](/vendor/sources/lamejs-1.2.7.tar.gz), including the encoder sources and upstream build configuration.
- Distributed browser file: `/vendor/lamejs.js`, copied byte-for-byte from the package's `dist/lamejs.js`.
- Changes: none to the encoder. Application code for PCM conversion and worker messaging is kept separate.

### Replacing or rebuilding the encoder

The encoder remains a separate module loaded by the application at runtime. In a local or self-hosted application copy, replace `public/vendor/lamejs.js` with a compatible modified build. It must export `Mp3Encoder` with `encodeBuffer()` and `flush()`. The application does not verify an encoder hash at runtime or prevent this replacement. Modification and reverse engineering for debugging such library modifications are permitted as required by the LGPL; no application restriction is intended to limit those rights.

To build the encoder from source, unpack its archive, install the build dependencies described in its `package.json`, then run its `npm run build` script. Copy the resulting `dist/lamejs.js` to the application path above **after** running the application's vendor build, because that build restores the locked upstream package by default. The original source and notices are available without requiring access to the application's private repository.

## Build integrity and source access

`scripts/vendor-audio.mjs` checks the installed library versions. It also verifies SHA-256 hashes of the source archives and full license texts before distributing them. `/vendor/manifest.json` records the source URLs, package versions, and generated artifact hashes. These are build checks, not restrictions on replacing the libraries in a modified application copy.

Source archives are served alongside the application for offline inspection and rebuilding. Fresh builds fetch the pinned source artifacts and license texts; subsequent builds reuse verified local copies. Full license text copies are obtained from the SPDX project's official `license-list-data` repository.