# Third-party software notices

fun.study Retro Arcade contains no ROMs, BIOS files, game artwork, or proprietary console firmware.

The frontend project is distributed under GNU GPL version 3. The full text is in `LICENSE`.

## Inventory scope

The production inventory below covers every npm package copied into the deployed site and every separately identifiable browser component shipped inside the pinned EmulatorJS asset bundle. Localization files and ZIP/7Z helpers are part of that same pinned EmulatorJS distribution. Browser APIs such as WebAssembly, IndexedDB, OPFS, Web Audio, Canvas, WebGL and the Gamepad API are platform features, not third-party libraries.

The public `/open-source/` page presents this inventory in a readable format. `vendor/emulatorjs/manifest.json` records the exact production package versions, while `package-lock.json` records the complete build and test dependency graph. Local upstream READMEs, package metadata and available license texts are published under `vendor/licenses/`.

## EmulatorJS

- Package: `@emulatorjs/emulatorjs`
- Version: 4.2.3
- License: GNU GPL version 3
- Source: <https://github.com/EmulatorJS/EmulatorJS/tree/4.2.3>
- Local license copy: `vendor/licenses/emulatorjs.txt`

The npm release's readable `data/src/` files are distributed instead of a minified bundle. `scripts/vendor-emulatorjs.mjs` makes two auditable changes after copying upstream files:

1. the loader selects readable local sources without enabling upstream debug mode; and
2. the automatic remote version check is disabled for an offline/private pinned distribution.

No emulator functionality is intentionally changed by those two patches.

### Browser components included in the EmulatorJS asset bundle

These files are shipped to visitors as part of the pinned EmulatorJS `data/` directory:

| Component | Version / identification | Purpose | License | Source |
| --- | --- | --- | --- | --- |
| NippleJS | 0.10.2 | Virtual touch joystick used by the on-screen controls | MIT | <https://github.com/yoannmoi/nipplejs/tree/0.10.2> |
| Socket.IO browser client | 4.8.1 (identified by the distributed file header) | Optional EmulatorJS netplay client transport | MIT | <https://github.com/socketio/socket.io-client/tree/4.8.1> |
| libunrar-js / UnRAR | EmulatorJS 4.2.3 bundled build | RAR archive extraction worker | UnRAR freeware source license, including the restriction against recreating the proprietary RAR compression algorithm | <https://github.com/tnikolai2/libunrar-js> |
| EmulatorJS compression workers | EmulatorJS 4.2.3 bundled builds | ZIP and 7Z extraction | Distributed as part of the EmulatorJS package; consult the upstream package and source tree | <https://github.com/EmulatorJS/EmulatorJS/tree/4.2.3/data/compression> |
| libretro GLSL shader presets | EmulatorJS 4.2.3 selection | Optional display filters | Individual shader terms vary; source comments identify the upstream shader files | <https://github.com/libretro/glsl-shaders> |

Copies of the NippleJS MIT terms, Socket.IO MIT terms, and UnRAR terms are stored in `vendor/licenses/`. Emulator core archives contain their own upstream `license.txt` files.

## Compiled libretro cores

The exact binary package version is recorded in `vendor/emulatorjs/manifest.json`. Each `.data` core archive also contains its upstream `license.txt`, which EmulatorJS exposes in its core information menu. The package READMEs identify the corresponding source and build repositories.

| Package / core | Used for | License summary | Source |
| --- | --- | --- | --- |
| `@emulatorjs/core-fceumm` 4.2.3 | NES/Famicom/FDS | GNU GPL v2; consult bundled/upstream terms | <https://github.com/EmulatorJS/libretro-fceumm/tree/d9d7e141274d07186b6a871ca2919b6f13cfb2f9> |
| `@emulatorjs/core-gambatte` 4.2.3 | GB/GBC | GNU GPL v2; consult bundled/upstream terms | <https://github.com/EmulatorJS/gambatte-libretro/tree/811b1f7a56c16f8588caada36d7a3f9a56cb16d4> |
| `@emulatorjs/core-mgba` 4.2.3 | GBA | Mozilla Public License 2.0 plus component notices | <https://github.com/EmulatorJS/mgba/tree/57678d6180e7020798809703283e02d2bba18b63> |
| `@emulatorjs/core-snes9x` 4.2.3 | SNES/SFC | Custom non-commercial license | <https://github.com/EmulatorJS/snes9x/tree/6ca2343e5f3b0acbea49ca958251e3a0af58a81d> |
| `@emulatorjs/core-genesis_plus_gx` 4.2.3 | Genesis/MD, Master System, Game Gear | Custom non-commercial license plus component terms | <https://github.com/EmulatorJS/Genesis-Plus-GX/tree/def3a7c0e413ef35a7d9d4430e5c9c9a5698b4fe> |
| `@emulatorjs/core-pcsx_rearmed` 4.2.3 | Sony PlayStation | GNU GPL v2; consult bundled/upstream terms | <https://github.com/EmulatorJS/pcsx_rearmed/tree/f29871dde1742cafb0ab56ba33636a8600bbbd80> |
| `@emulatorjs/core-dosbox_pure` 4.2.3 | DOS PC | GNU GPL v2; consult bundled/upstream terms | <https://github.com/EmulatorJS/dosbox-pure/tree/bdabec1651380f3f736eecff8d859090ae822f9b> |

Core compilation tooling: <https://github.com/EmulatorJS/build/tree/b24e5b535034dc7c3428d76f236d4793881969b6>

The core source revisions above are the repository heads at each timestamp recorded by the distributed upstream build reports. The core packages do not embed a Git commit identifier, so this is a timestamp-based reconstruction rather than a cryptographically attested source-to-binary mapping. Shared build inputs at the first recorded build timestamp were EmulatorJS/RetroArch `c9eb36d4dbb801979f78de517f98b94fee5317e7` and the EmulatorJS core wrapper `0131c16ab5e7264e2dcb8bc8029b789d2095d89f`.

General libretro license reference: <https://docs.libretro.com/development/licenses/>

## Development, testing, and deployment tools

The following tools are used to build, test, preview, or deploy the project but are not JavaScript libraries delivered by the production pages:

| Tool | Version | Use | License / source |
| --- | --- | --- | --- |
| Node.js | 22 or newer | Build scripts, local server, tests | MIT and bundled component licenses; <https://github.com/nodejs/node> |
| Playwright Test | 1.62.1 | Chromium integration, responsive, PWA, offline, and real-core tests | Apache-2.0; <https://github.com/microsoft/playwright/tree/v1.62.1> |
| Wrangler | 4.127.1 used for this deployment | Cloudflare Worker deployment | MIT OR Apache-2.0; <https://github.com/cloudflare/workers-sdk> |
| Nginx | 1.29 Alpine image | Optional Docker static server | 2-clause BSD; <https://nginx.org/LICENSE> |
| Docker / Compose | Host-provided | Optional container build and orchestration | <https://github.com/docker> |

`package-lock.json` is the machine-readable inventory of the complete npm dependency graph and exact installed versions. Only the nine direct packages in `package.json` are imported by project scripts: EmulatorJS, the seven selected core packages, and Playwright Test. The many other npm entries are transitive build/test dependencies or optional core packages referenced by the upstream EmulatorJS package; they are not copied into the production site unless listed above.

The core source and build links above document provenance, but an operator distributing these compiled binaries remains responsible for maintaining equivalent access to the exact corresponding source required by each applicable license. An upstream link is not a substitute if that source later disappears or no longer matches the binaries.

### Commercial-use warning

Snes9x and Genesis Plus GX prohibit or restrict commercial use. This exact bundle must not be used in a paid product, monetized service, advertising-supported distribution, commercial appliance, or other commercial activity without a qualified license review and any required permission. GPL/MPL obligations also continue to apply. Replace those cores with appropriately licensed alternatives if the intended business model is incompatible.

This notice is a practical inventory, not legal advice. Review the complete license text embedded in each distributed core and the corresponding source before redistribution.