# Third-party components

## North America deployment adaptation

This private deployment candidate adapts the MIT-licensed BVN Online v1.0.0
Windows runtime archive by JavonLoong. It adds a Linux server entry point,
same-origin hosted game resources, five-room / ten-member limits, automatic P2
joining, resource integrity validation, and deployment configuration. The root
MIT notice is preserved. The upstream Windows archive SHA-256 is
`b9bfdb61102493b5407ab35a44c8d3000a9aeea0b61a60a68e4266c867bf4544`.

The original author's supplementary source archive is included, expanded,
in `third-party/`. Its original SHA-256 is
`a1d5b035ad28ba9431221fcfab4cd6d0dd7380bf7eb6788aa75610fe1a7dbffe`.
It contains the Ruffle audio patch, rebuild instructions, adapter source, and
GPL/LGPL notices referenced below. No cloudflared binary is used by this server.

The game pack was supplied by the user. The network entry and browser-compatible
fighter resources were obtained from the author's matching public 3.8 server.
Their provenance and hashes are recorded in `game/browser-resources.json` and
`game/load-plan.json`; these records are not a grant of rights to the original
game or characters. Production serving does not fetch from the original server.

The project's own networking code, UI, tests and build glue use the root MIT
license. The following components retain their respective licenses.

## Harman SWF format adapter

`bvn38/vendor/harman-swf.js` is a JavaScript adaptation of JPEXS Free Flash
Decompiler's [HarmanSwfEncrypt.java](https://github.com/jindrapetrik/jpexs-decompiler/blob/master/libsrc/ffdec_lib/src/com/jpexs/decompiler/flash/harman/HarmanSwfEncrypt.java).
Copyright (C) 2010–2026 JPEXS. The upstream implementation credits
`swfdecrypt.py` by NathaanTFM. JavaScript adaptation: 2026 BVN Online contributors.

This module is licensed under **LGPL-3.0-or-later**, with no warranty. Copies of
the [LGPL](licenses/LGPL-3.0.txt) and [GPL](licenses/GPL-3.0.txt) accompany it.
The adaptation keeps the format decoding algorithm, implements bounds checks,
uses Uint8Array/DataView, and delegates AES-CBC to @noble/ciphers. It omits Java
I/O, encryption and the Java command-line entry point.

The complete adapted source is shipped as an unminified, replaceable ES module
at `/vendor/harman-swf.js`, with its callers in `/local-converter.js` and
`/local-prepare.js`. The corresponding source, build tooling and license texts
are in the `v1.0.0` release source of
[bvn-online](https://github.com/JavonLoong/bvn-online/tree/v1.0.0).
No bundling or obfuscation step is required. Users may modify or replace this
module and run the application with that version; this notice imposes no
restriction on debugging such modifications.

## Runtime dependencies

- [@noble/ciphers](https://github.com/paulmillr/noble-ciphers), 2.4.0: MIT.
- [@noble/hashes](https://github.com/paulmillr/noble-hashes), 2.4.0: MIT.
- [Ruffle](https://github.com/ruffle-rs/ruffle): MIT or Apache-2.0, as provided by its package.
- [ws](https://github.com/websockets/ws): MIT.
- [Node.js](https://github.com/nodejs/node/tree/v22.23.2), 22.23.2: MIT and the bundled third-party notices in `licenses/NODE-LICENSE.txt`.
- [cloudflared](https://github.com/cloudflare/cloudflared/tree/2026.9.0), 2026.9.0: Apache-2.0; see `licenses/CLOUDFLARED-LICENSE.txt` in the Windows ZIP. The binary is unmodified and its official SHA-256 is verified by the build and launcher.

The bundled Ruffle 0.6.0 WebAssembly has two audio buffer thresholds changed.
The complete byte patch, original/replacement SHA-256 values, validation and
rebuild instructions are in `bvn38/tools/patch-ruffle-audio.mjs` and
`docs/full-room-audio.md`. Ruffle's MIT and Apache-2.0 license files are retained
in `app/node_modules/@ruffle-rs/ruffle` in the Windows distribution.

Dependency license files are retained in `node_modules` during packaging.
Original game programs, characters, artwork and original AS3 fragments are
outside this project's MIT grant. They are not distributed in this repository.