# Third-party notices The application includes these separately licensed dependencies. Retain their notices when distributing a build. ## mGBA / WebAssembly runtime - Core: mGBA revision `c034660f007c543233f1cadeb0ca13c71afd8f41`. - Source: https://github.com/mgba-emu/mgba - License: Mozilla Public License 2.0 (MPL-2.0); included in `vendor/mgba/LICENSE-MPL-2.0.txt`. - Shim derived from: https://github.com/wasm-gaming/mGBA-wasm The core is rebuilt from pinned upstream source. `native/mgba-shim.c` contains the modified browser shim, including restricted live RAM reads, a checked task-inbox writer, and zeroed manual checkpoint buffers. `scripts/build-runtime.mjs` reproduces the build. The previous npm TypeScript frontend is no longer used. See `vendor/mgba/NOTICE.md` for exact provenance, checksums and source availability. The small original GBA avatar program is separate from this emulator runtime. Generated emulator glue is not application source. ## Trystero - Packages: @trystero-p2p/nostr 0.25.4 and @trystero-p2p/core 0.25.4 - License: MIT, as declared by the packages. - Source: https://github.com/dmotz/trystero ## Game-engine attribution The adapter targets RHH (Rom Hacking Hideout) pokeemerald-expansion, based on pret pokeemerald. The real pinned expansion source is compiled for the waiting-room ROM; its exact revision is recorded in lobby/build-info.json. - https://github.com/rh-hideout/pokeemerald-expansion - https://github.com/pret/pokeemerald The source repository excludes generated game binaries/assets. The local waiting-room build DOES use upstream game code, map graphics, sprites and other assets, and the running website serves that generated ROM to visitors. It is a restricted-entry expansion build, not an original homebrew map. Public distribution permissions have not been assessed; review them before hosting these assets. The isolated homebrew test fixture is original project code. Pokemon and related marks belong to their respective owners; this project is not affiliated with or endorsed by them. Other npm dependency notices remain in their packages. See package-lock.json for the exact dependency graph. ## Hackdex patch workflow and xdelta The Heart and Soul release metadata and patch source are credited to Hackdex and the hack author: https://www.hackdex.app/hack/pokemon-heart-and-soul . No affiliation or upstream-deployed integration is implied. The local app cannot read Hackdex-origin browser storage. The exact xdelta worker, JavaScript and WebAssembly were copied from the public Hackdex source at the revision recorded in `vendor/xdelta/provenance.json`. Original notices and full license texts are retained in that directory and copied to the served assets. `NOTICE.txt` documents xdelta3, its Emscripten port, Apache-2.0 licensing and bundled liblzma's 0BSD notice. Generated vendor files are not reformatted. No copied Hackdex logo, hosted user ROM, private credentials or signed URL is included. The masked engine-signature reference library was derived from the public expansion and Heart and Soul engine sources. Its build provenance is in `scripts/scanner/README.md`; it contains instruction patterns, not a bundled game ROM or extracted game art. Upstream source/game rights remain with their owners. The actual patch and complete generated games remain ignored by Git; review distribution permissions before publishing a hosted copy. ## Frontend and catalogue The frontend uses Astro (https://astro.build), React (https://react.dev), Zustand (https://zustand.docs.pmnd.rs), and Tailwind, under MIT licenses. Astro integrates the React Compiler through Oxc. Vite remains development tooling. Development checks use the JohnDeved ox-standard preset, Oxlint/Oxfmt, Prettier with its Astro plugin, and Fallow (https://github.com/fallow-rs/fallow). Exact versions and transitive license metadata are recorded in package-lock.json and the installed packages. Game titles, descriptions, creator credits and screenshots are automatically read from public Hackdex pages. The modal credits and links each original release. Downloaded catalogue media are cached under ignored public/catalog, not committed artwork or evidence of permission to redistribute a complete game. No official Hackdex partnership or upstream API guarantee is implied. The host intentionally shares the patched game with its connected room peer; the base and saves remain local. Review the current README instead of older no-ROM-transfer descriptions.