From 2a328fe68f51f6e531f308498df7de5cd4a27247 Mon Sep 17 00:00:00 2001 From: Doxa Maps Date: Mon, 28 Sep 2026 01:23:01 +0000 Subject: [PATCH 1/5] Every vendored font ships its own licence Two of the five shipped without one. bebas-neue/LICENSE was 24 lines and poppins/LICENSE 29 -- our own notes files named LICENSE, pointing at openfontlicense.org instead of carrying the text. The OFL requires the licence to travel WITH the font, and these fonts go out in the repo we intend to give away. Both now carry their FAMILY'S OWN upstream OFL, fetched verbatim from google/fonts, which is what brings the real copyright line with it -- Dharma Type for Bebas Neue, the Poppins Project Authors for Poppins. No licence text was authored here. Source URL and sha256 are recorded. figtree keeps its OFL and loses only the six lines of ours that sat above it. Our prose moved to documentation/vendored-fonts.md, OUTSIDE the served tree, and that placement is the whole lesson. My first attempt put a NOTES.md beside each LICENSE, which check:public-hygiene rejected as "documentation in a served folder" -- three new hard findings, plus a fourth for an internal folder name I had relocated with the text. The old bebas-neue LICENSE had said exactly this in its own words, "prose does not belong in a public served folder"; I quoted that line and then did it anyway. The licence travels with the font; the explanation travels with the repo. Whole shipped tree, measured before and after rather than sampled: role nouns 6 -> 0, hygiene warnings 18 -> 14, findings 1 -> 1 (the pre-existing assets/ contract one, not mine). --- data/fonts/bebas-neue/LICENSE | 113 +++++++++++++++++++++++++------ data/fonts/figtree/LICENSE | 7 -- data/fonts/poppins/LICENSE | 114 +++++++++++++++++++++++++------- documentation/vendored-fonts.md | 94 ++++++++++++++++++++++++++ 4 files changed, 274 insertions(+), 54 deletions(-) create mode 100644 documentation/vendored-fonts.md diff --git a/data/fonts/bebas-neue/LICENSE b/data/fonts/bebas-neue/LICENSE index e7376bc49..da9571488 100644 --- a/data/fonts/bebas-neue/LICENSE +++ b/data/fonts/bebas-neue/LICENSE @@ -1,24 +1,93 @@ -Bebas Neue — SIL Open Font License, Version 1.1 -Designer: Ryoichi Tsunekawa (Dharma Type). Distributed via Google Fonts. -Full text: https://openfontlicense.org/ (OFL-1.1) +Copyright © 2010 by Dharma Type. -WHY THIS FILE IS IN THIS REPO -DX-life's /regions pages set --font-family-heading to 'Bebas Neue'. Their own site does not -ship the file either — @nuxt/fonts downloads it at build and self-hosts it, which is why their -computed font-family reads "Bebas Neue", "Bebas Neue Fallback: ...". We cannot @font-face from -their origin: their font file is served without CORS headers, so a cross-origin face silently -fails and every heading fell back to a condensed system stack. That substitution was the ONLY -remaining difference between our regions dashboard and theirs (7 computed properties, all of -them this one font and its knock-on sizes). -So the font is vendored here, from Google Fonts, under the OFL that permits redistribution — -self-hosted, never a CDN, the same rule public/assets/vendor/tabulator/ follows. -Subsets and unicode-ranges are Google's own (css2 API, v16), reproduced verbatim in the -@font-face declared by library/composables/useDocumentFont.js. +This Font Software is licensed under the SIL Open Font License, Version 1.1. +This license is copied below, and is also available with a FAQ at: +http://scripts.sil.org/OFL -NOTE ON THIS FILENAME — it is deliberately extensionless. -check:public-hygiene refuses *.md / *.markdown / *.txt anywhere in the served tree ("no docs in a -served folder", Driver rule 2026-09-16), and it is right to: prose does not belong in a public -mirror. But the OFL requires this licence to accompany the font files wherever they are -redistributed, and the font files DO ship — they are fetched by the @font-face at runtime. So the -licence travels with them under the conventional extensionless name, which satisfies the rule -without weakening it. Do not rename this to LICENSE.txt. + +----------------------------------------------------------- +SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007 +----------------------------------------------------------- + +PREAMBLE +The goals of the Open Font License (OFL) are to stimulate worldwide +development of collaborative font projects, to support the font creation +efforts of academic and linguistic communities, and to provide a free and +open framework in which fonts may be shared and improved in partnership +with others. + +The OFL allows the licensed fonts to be used, studied, modified and +redistributed freely as long as they are not sold by themselves. The +fonts, including any derivative works, can be bundled, embedded, +redistributed and/or sold with any software provided that any reserved +names are not used by derivative works. The fonts and derivatives, +however, cannot be released under any other type of license. The +requirement for fonts to remain under this license does not apply +to any document created using the fonts or their derivatives. + +DEFINITIONS +"Font Software" refers to the set of files released by the Copyright +Holder(s) under this license and clearly marked as such. This may +include source files, build scripts and documentation. + +"Reserved Font Name" refers to any names specified as such after the +copyright statement(s). + +"Original Version" refers to the collection of Font Software components as +distributed by the Copyright Holder(s). + +"Modified Version" refers to any derivative made by adding to, deleting, +or substituting -- in part or in whole -- any of the components of the +Original Version, by changing formats or by porting the Font Software to a +new environment. + +"Author" refers to any designer, engineer, programmer, technical +writer or other person who contributed to the Font Software. + +PERMISSION & CONDITIONS +Permission is hereby granted, free of charge, to any person obtaining +a copy of the Font Software, to use, study, copy, merge, embed, modify, +redistribute, and sell modified and unmodified copies of the Font +Software, subject to the following conditions: + +1) Neither the Font Software nor any of its individual components, +in Original or Modified Versions, may be sold by itself. + +2) Original or Modified Versions of the Font Software may be bundled, +redistributed and/or sold with any software, provided that each copy +contains the above copyright notice and this license. These can be +included either as stand-alone text files, human-readable headers or +in the appropriate machine-readable metadata fields within text or +binary files as long as those fields can be easily viewed by the user. + +3) No Modified Version of the Font Software may use the Reserved Font +Name(s) unless explicit written permission is granted by the corresponding +Copyright Holder. This restriction only applies to the primary font name as +presented to the users. + +4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font +Software shall not be used to promote, endorse or advertise any +Modified Version, except to acknowledge the contribution(s) of the +Copyright Holder(s) and the Author(s) or with their explicit written +permission. + +5) The Font Software, modified or unmodified, in part or in whole, +must be distributed entirely under this license, and must not be +distributed under any other license. The requirement for fonts to +remain under this license does not apply to any document created +using the Font Software. + +TERMINATION +This license becomes null and void if any of the above conditions are +not met. + +DISCLAIMER +THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, +EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF +MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT +OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE +COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, +INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL +DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING +FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM +OTHER DEALINGS IN THE FONT SOFTWARE. diff --git a/data/fonts/figtree/LICENSE b/data/fonts/figtree/LICENSE index de97ffce2..80b12bb3d 100644 --- a/data/fonts/figtree/LICENSE +++ b/data/fonts/figtree/LICENSE @@ -1,10 +1,3 @@ -Figtree — SIL Open Font License, Version 1.1 -Designer: Erik D. Kennedy. Distributed via Google Fonts. -Vendored as the free stand-in for Brandon Grotesque (commercial), by Driver decision -2026-09-24. Chosen by MEASUREMENT, not by name: at 500/19.5312px Figtree renders -'FULL PROFILE' at 126px against Brandon's 128px on live doxa.life — the closest of 19 -libre grotesques tested. See _probe-glyph-width.mjs. - Copyright 2022 The Figtree Project Authors (https://github.com/erikdkennedy/figtree) This Font Software is licensed under the SIL Open Font License, Version 1.1. diff --git a/data/fonts/poppins/LICENSE b/data/fonts/poppins/LICENSE index 9786c3ad8..76df3b565 100644 --- a/data/fonts/poppins/LICENSE +++ b/data/fonts/poppins/LICENSE @@ -1,29 +1,93 @@ -Poppins — SIL Open Font License, Version 1.1 -Designers: Indian Type Foundry, Jonny Pinhorn. Distributed via Google Fonts. -Full text: https://openfontlicense.org/ (OFL-1.1) +Copyright 2020 The Poppins Project Authors (https://github.com/itfoundry/Poppins) -WHY THIS FILE IS IN THIS REPO -Poppins is DX-life's --font-family-base: the body face of every line of text on the pages the -regions plugin clones. Their own site self-hosts it via @nuxt/fonts; we could not use theirs, so -it is vendored here from Google Fonts under the OFL, which permits redistribution. +This Font Software is licensed under the SIL Open Font License, Version 1.1. +This license is copied below, and is also available with a FAQ at: +http://scripts.sil.org/OFL -WHY IT WAS NEEDED — and why no CSS check caught it. -A computed-style diff of our region dashboard against live doxa.life reported 68 of 68 properties -IDENTICAL while our body text was rendering in a system fallback, because BOTH sides merely NAME -"Poppins" first in font-family and a first-family comparison therefore matched. The difference only -became visible against a glyph-width oracle: the same string at the same size measured 334.58px -here against 317px on their page — 5.5% wider, i.e. a different face. -document.fonts.check() is NOT a usable oracle for this: it returned true for families never -vendored (Oswald, Brandon Grotesque) and false for Bebas Neue on DX-life's own page. -See _qa-cycle/02-builder-cycle/_probe-glyph-width.mjs. -WHAT IS HERE, AND WHY ONLY THIS -Weights 400/500/600/700 only — the four the regions surface actually asks for (measured across -their _globals, _cards, _buttons and _filters SCSS: medium x10, regular x4, bold x2, plus the -600 in the prayer-coverage legend). Subsets latin + latin-ext only. 44 KB in total, with Google's -own unicode-ranges reproduced in the @font-face so the subset split behaves as it does on their -site. Extra weights and scripts are deliberately NOT vendored — bloat is a repo rule here. +----------------------------------------------------------- +SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007 +----------------------------------------------------------- -FILENAME: extensionless on purpose. check:public-hygiene refuses *.txt in a served folder and is -right to, while the OFL requires this licence to accompany redistributed font files. Do not -rename this to LICENSE.txt. +PREAMBLE +The goals of the Open Font License (OFL) are to stimulate worldwide +development of collaborative font projects, to support the font creation +efforts of academic and linguistic communities, and to provide a free and +open framework in which fonts may be shared and improved in partnership +with others. + +The OFL allows the licensed fonts to be used, studied, modified and +redistributed freely as long as they are not sold by themselves. The +fonts, including any derivative works, can be bundled, embedded, +redistributed and/or sold with any software provided that any reserved +names are not used by derivative works. The fonts and derivatives, +however, cannot be released under any other type of license. The +requirement for fonts to remain under this license does not apply +to any document created using the fonts or their derivatives. + +DEFINITIONS +"Font Software" refers to the set of files released by the Copyright +Holder(s) under this license and clearly marked as such. This may +include source files, build scripts and documentation. + +"Reserved Font Name" refers to any names specified as such after the +copyright statement(s). + +"Original Version" refers to the collection of Font Software components as +distributed by the Copyright Holder(s). + +"Modified Version" refers to any derivative made by adding to, deleting, +or substituting -- in part or in whole -- any of the components of the +Original Version, by changing formats or by porting the Font Software to a +new environment. + +"Author" refers to any designer, engineer, programmer, technical +writer or other person who contributed to the Font Software. + +PERMISSION & CONDITIONS +Permission is hereby granted, free of charge, to any person obtaining +a copy of the Font Software, to use, study, copy, merge, embed, modify, +redistribute, and sell modified and unmodified copies of the Font +Software, subject to the following conditions: + +1) Neither the Font Software nor any of its individual components, +in Original or Modified Versions, may be sold by itself. + +2) Original or Modified Versions of the Font Software may be bundled, +redistributed and/or sold with any software, provided that each copy +contains the above copyright notice and this license. These can be +included either as stand-alone text files, human-readable headers or +in the appropriate machine-readable metadata fields within text or +binary files as long as those fields can be easily viewed by the user. + +3) No Modified Version of the Font Software may use the Reserved Font +Name(s) unless explicit written permission is granted by the corresponding +Copyright Holder. This restriction only applies to the primary font name as +presented to the users. + +4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font +Software shall not be used to promote, endorse or advertise any +Modified Version, except to acknowledge the contribution(s) of the +Copyright Holder(s) and the Author(s) or with their explicit written +permission. + +5) The Font Software, modified or unmodified, in part or in whole, +must be distributed entirely under this license, and must not be +distributed under any other license. The requirement for fonts to +remain under this license does not apply to any document created +using the Font Software. + +TERMINATION +This license becomes null and void if any of the above conditions are +not met. + +DISCLAIMER +THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, +EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF +MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT +OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE +COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, +INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL +DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING +FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM +OTHER DEALINGS IN THE FONT SOFTWARE. diff --git a/documentation/vendored-fonts.md b/documentation/vendored-fonts.md new file mode 100644 index 000000000..ac89b0618 --- /dev/null +++ b/documentation/vendored-fonts.md @@ -0,0 +1,94 @@ +# Vendored fonts — licences and why each one is here + +The fonts ship in `data/fonts//`, which `bun run tree` stages into the served tree at +`dx-maps/assets/fonts/`. Each family's `LICENSE` is its OWN upstream OFL text, verbatim, carrying +that family's real copyright line. Nothing in this file is part of any licence. + +★ THESE NOTES LIVE HERE, NOT BESIDE THE FONTS, AND THAT IS THE POINT. check:public-hygiene fails on +`documentation in a served folder`: a NOTES.md next to each LICENSE is prose a reader of the drop-in +tree should not be served. The old bebas-neue LICENSE said so in its own text -- "prose does not +belong in a public served folder" -- and I put three NOTES.md files there anyway before the gate +caught it. The licence travels with the font; the explanation travels with the repo. + +## bebas-neue + +| | | +|---|---| +| Licence source | `https://raw.githubusercontent.com/google/fonts/main/ofl/bebasneue/OFL.txt` | +| sha256 | `72082f6cb4d04be2ecf7cc7d9e1e7d73787f0af8a5a278a47cade70c16b78341` | +| Fetched | 2026-09-28 | + +``` +Bebas Neue — SIL Open Font License, Version 1.1 +Designer: Ryoichi Tsunekawa (Dharma Type). Distributed via Google Fonts. +Full text: https://openfontlicense.org/ (OFL-1.1) +WHY THIS FILE IS IN THIS REPO +DX-life's /regions pages set --font-family-heading to 'Bebas Neue'. Their own site does not +ship the file either — @nuxt/fonts downloads it at build and self-hosts it, which is why their +computed font-family reads "Bebas Neue", "Bebas Neue Fallback: ...". We cannot @font-face from +their origin: their font file is served without CORS headers, so a cross-origin face silently +fails and every heading fell back to a condensed system stack. That substitution was the ONLY +remaining difference between our regions dashboard and theirs (7 computed properties, all of +them this one font and its knock-on sizes). +So the font is vendored here, from Google Fonts, under the OFL that permits redistribution — +self-hosted, never a CDN, the same rule public/assets/vendor/tabulator/ follows. +Subsets and unicode-ranges are Google's own (css2 API, v16), reproduced verbatim in the +@font-face declared by library/composables/useDocumentFont.js. +NOTE ON THIS FILENAME — it is deliberately extensionless. +check:public-hygiene refuses *.md / *.markdown / *.txt anywhere in the served tree ("no docs in a +served folder", product rule 2026-09-16), and it is right to: prose does not belong in a public +mirror. But the OFL requires this licence to accompany the font files wherever they are +redistributed, and the font files DO ship — they are fetched by the @font-face at runtime. So the +licence travels with them under the conventional extensionless name, which satisfies the rule +without weakening it. Do not rename this to LICENSE.txt. +``` + +## poppins + +| | | +|---|---| +| Licence source | `https://raw.githubusercontent.com/google/fonts/main/ofl/poppins/OFL.txt` | +| sha256 | `6be04893d770899a015649c7aa3b582f871b272f8747a92b78b17c3e5c8b2573` | +| Fetched | 2026-09-28 | + +``` +Poppins — SIL Open Font License, Version 1.1 +Designers: Indian Type Foundry, Jonny Pinhorn. Distributed via Google Fonts. +Full text: https://openfontlicense.org/ (OFL-1.1) +WHY THIS FILE IS IN THIS REPO +Poppins is DX-life's --font-family-base: the body face of every line of text on the pages the +regions plugin clones. Their own site self-hosts it via @nuxt/fonts; we could not use theirs, so +it is vendored here from Google Fonts under the OFL, which permits redistribution. +WHY IT WAS NEEDED — and why no CSS check caught it. +A computed-style diff of our region dashboard against live doxa.life reported 68 of 68 properties +IDENTICAL while our body text was rendering in a system fallback, because BOTH sides merely NAME +"Poppins" first in font-family and a first-family comparison therefore matched. The difference only +became visible against a glyph-width oracle: the same string at the same size measured 334.58px +here against 317px on their page — 5.5% wider, i.e. a different face. +document.fonts.check() is NOT a usable oracle for this: it returned true for families never +vendored (Oswald, Brandon Grotesque) and false for Bebas Neue on DX-life's own page. +See the builder-cycle probes: _probe-glyph-width.mjs. +WHAT IS HERE, AND WHY ONLY THIS +Weights 400/500/600/700 only — the four the regions surface actually asks for (measured across +their _globals, _cards, _buttons and _filters SCSS: medium x10, regular x4, bold x2, plus the +600 in the prayer-coverage legend). Subsets latin + latin-ext only. 44 KB in total, with Google's +own unicode-ranges reproduced in the @font-face so the subset split behaves as it does on their +site. Extra weights and scripts are deliberately NOT vendored — bloat is a repo rule here. +FILENAME: extensionless on purpose. check:public-hygiene refuses *.txt in a served folder and is +right to, while the OFL requires this licence to accompany redistributed font files. Do not +rename this to LICENSE.txt. +``` + +## figtree + +Its LICENSE is the family's own OFL text, left intact (our prose was stripped from the top). + +``` +Figtree — SIL Open Font License, Version 1.1 +Designer: Erik D. Kennedy. Distributed via Google Fonts. +Vendored as the free stand-in for Brandon Grotesque (commercial), by product decision +2026-09-24. Chosen by MEASUREMENT, not by name: at 500/19.5312px Figtree renders +'FULL PROFILE' at 126px against Brandon's 128px on live doxa.life — the closest of 19 +libre grotesques tested. See _probe-glyph-width.mjs. +``` + From e8ddfc34a607b615d1a501765bc4d99e911bcdef Mon Sep 17 00:00:00 2001 From: Doxa Maps Date: Mon, 28 Sep 2026 01:30:46 +0000 Subject: [PATCH 2/5] Vue and Tabulator ship their MIT notices, and a third-party register MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Both are MIT, which asks for the permission notice to be included with the software. Tabulator's minified .js carried only "(c) Oliver Folkerd 2025" and its .css carried nothing; Vue's banner names @license MIT but omits the permission text. Each now has its upstream LICENSE vendored verbatim beside it -- fetched, not authored, with the URL and sha256 recorded. ★ AND THE ALLOWLIST IS WHY IT WOULD NOT HAVE WORKED. generate-tree stages vendor/ by an explicit PATH LIST, so the licences sat in data/vendor and never reached the tree: staged count 0. Vendoring a notice the staging step drops is not compliance, it is paperwork. Both LICENSE paths are now listed. documentation/THIRD-PARTY.md is the register the sweep produced: every non-original thing dx-maps ships, its source, its licence, whether the licence or attribution actually travels, and the gap. Compiled by inspecting the SHIPPED tree rather than the source lists, because the question is what a recipient receives. Four rows are left OPEN and marked as such. Two are unverified and need a look (world-adm0's provenance, the pplr upstream). Two need a decision, not a fetch: people-groups and the 304 derived tables carry data whose redistribution terms are not established, 36 MB of it. Attaching a licence I have not confirmed would be worse than the gap, so those go to the Driver. geoBoundaries is closable by work rather than judgment -- CC BY needs attribution, and the .meta.json sidecar pattern already exists here for one file of eight. --- data/vendor/tabulator/LICENSE | 21 +++++++++++++++++ data/vendor/vue/LICENSE | 21 +++++++++++++++++ documentation/THIRD-PARTY.md | 44 +++++++++++++++++++++++++++++++++++ internal/generate-tree.mjs | 7 ++++++ 4 files changed, 93 insertions(+) create mode 100644 data/vendor/tabulator/LICENSE create mode 100644 data/vendor/vue/LICENSE create mode 100644 documentation/THIRD-PARTY.md diff --git a/data/vendor/tabulator/LICENSE b/data/vendor/tabulator/LICENSE new file mode 100644 index 000000000..3388c4491 --- /dev/null +++ b/data/vendor/tabulator/LICENSE @@ -0,0 +1,21 @@ +The MIT License (MIT) + +Copyright (c) 2015-2026 Oli Folkerd + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. \ No newline at end of file diff --git a/data/vendor/vue/LICENSE b/data/vendor/vue/LICENSE new file mode 100644 index 000000000..8fd17290c --- /dev/null +++ b/data/vendor/vue/LICENSE @@ -0,0 +1,21 @@ +The MIT License (MIT) + +Copyright (c) 2018-present, Yuxi (Evan) You and Vue contributors + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in +all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN +THE SOFTWARE. diff --git a/documentation/THIRD-PARTY.md b/documentation/THIRD-PARTY.md new file mode 100644 index 000000000..bcfe354fb --- /dev/null +++ b/documentation/THIRD-PARTY.md @@ -0,0 +1,44 @@ +# Third-party content in the shipped tree + +Every non-original thing `dx-maps/` ships, what licenses it, and whether the licence or +attribution actually travels with it. Compiled 2026-09-28 by inspecting the SHIPPED tree, not the +source lists -- the question is what a recipient receives. + +Notes live HERE and not beside the assets: `check:public-hygiene` fails on "documentation in a +served folder". The licence travels with the asset; the explanation travels with the repo. + +| Item | Source | Licence | Does it travel? | Gap | +|---|---|---|---|---| +| Fonts: bebas-neue, figtree, noto-serif-devanagari, oswald, poppins | Google Fonts / foundry repos | OFL-1.1 | **Yes** — each `LICENSE` is the family's own upstream OFL, verbatim, with its real copyright line | none (closed 2026-09-28) | +| `vendor/vue/vue.global.prod.js` | vuejs/core | MIT | **Partly** — the minified banner carries `(c) 2018-present Yuxi (Evan) You` and `@license MIT`, but NOT the permission notice MIT asks to include | closed: upstream `LICENSE` now vendored beside it | +| `vendor/tabulator/tabulator.min.js` + `.min.css` | olifolkerd/tabulator v6.3.1 | MIT | **No** — the `.js` had only `(c) Oliver Folkerd 2025`; the `.css` had nothing | closed: upstream `LICENSE` now vendored beside it | +| `boundaries/gb-*.geojson` (4 files) | geoBoundaries gbOpen (www.geoboundaries.org) | CC BY — the India ADM1 file records **CC BY 2.5 IN**, sourced from DataMeet/Election Commission of India | **Partly** — provenance sits in ONE sidecar, `gb-IND-ADM1-full.meta.json` (source, boundaryID, licence, fetch URL, processing). The other boundary files have none, and no human-readable attribution ships | **OPEN** — CC BY requires attribution to accompany the work | +| `boundaries/world-adm0*.geojson` | not verified — probably Natural Earth | Natural Earth is public domain | n/a if Natural Earth | **OPEN** — provenance unconfirmed for this file | +| `people-groups/*` (3 files, 8 MB) | peoplegroups.org | **not established** | no terms ship | **OPEN, judgment** — redistribution terms unknown | +| `pplr/*` (6 files, 16 MB) | not resolved from `plugin-designs/pplr-data-maps/scripts/build-data.mjs` | **not established** | nothing ships | **OPEN, judgment** — owner should name the upstream | +| `tables/*` (304 files, 36 MB) | derived by `library/scripts/research/fetch-*.mjs` from several upstream APIs | **varies, not established per table** | nothing ships; there is no source or licence doc in `tables/` | **OPEN, judgment** — the largest gap by volume | +| `images/worldmap.svg` | recorded in `images/PROVENANCE` | see that file | the PROVENANCE file ships and explains why no licence file sits beside it | none claimed; reasoning recorded rather than assumed | +| `previews/*` (378 files) | our own poster previews | ours | n/a | none | +| Natural Earth 1:10m populated places (`library/scripts/posters/data/ne-places.json`) | naturalearthdata.com | **public domain**, no attribution required | n/a | none. Their 1:10m ROADS were deliberately not shipped because of an ODbL attribution obligation | + +## Provenance records + +| Vendored file | Upstream URL | sha256 | +|---|---|---| +| `data/vendor/tabulator/LICENSE` | `https://raw.githubusercontent.com/olifolkerd/tabulator/master/LICENSE` | `191a2ee554684e1064c897b432f0e1bc6dfa714ca045d3f6ea2cf692cbd398b7` | +| `data/vendor/vue/LICENSE` | `https://raw.githubusercontent.com/vuejs/core/main/LICENSE` | `49190d1f742dd61e47fe816df4963e5186a2a62100d9122f9883a60ea32973ac` | +| `data/fonts/bebas-neue/LICENSE` | `https://raw.githubusercontent.com/google/fonts/main/ofl/bebasneue/OFL.txt` | see `documentation/vendored-fonts.md` | +| `data/fonts/poppins/LICENSE` | `https://raw.githubusercontent.com/google/fonts/main/ofl/poppins/OFL.txt` | see `documentation/vendored-fonts.md` | + +## What is NOT closed, and why it is not mine to close + +Four rows above are marked OPEN. Two are simply unverified and someone should look +(`world-adm0` provenance, the `pplr` upstream). Two need a decision rather than a fetch: +**people-groups** and the 304 **tables** carry data whose redistribution terms are not established, +and 36 MB of derived tables is the largest exposure by volume. Attaching a licence I have not +confirmed would be worse than the present gap, so those go to the Driver. + +The geoBoundaries row is closable by work rather than judgment: CC BY needs attribution to +accompany the data, and the pattern already exists in this repo -- the `.meta.json` sidecar. Extending +it to the other boundary files plus one shipped attribution line would close it. + diff --git a/internal/generate-tree.mjs b/internal/generate-tree.mjs index 1bf0b5f2b..bcb4408e7 100644 --- a/internal/generate-tree.mjs +++ b/internal/generate-tree.mjs @@ -1637,6 +1637,12 @@ function main() { // vendor — DataTable/TabulatorTable inject Tabulator from assetsBase at runtime. 'vendor/tabulator/tabulator.min.js', 'vendor/tabulator/tabulator.min.css', + // ★ AND THEIR LICENCES, because this list is what decides whether a notice TRAVELS. Both are MIT, + // which requires the permission notice to be included with the software. Tabulator's minified .js + // carried only a copyright line and its .css carried nothing; Vue's banner names MIT but omits the + // permission text. Shipping the code without the notice is the gap, and an allowlist that omits + // the LICENSE guarantees it stays open however carefully the file is vendored. + 'vendor/tabulator/LICENSE', // vendor/vue — the GALLERY SHELL's own Vue (generate-gallery.mjs loadVue()), not a bundle's. // // ★ ADDED 2026-09-22, and it had never been staged. generate-gallery.mjs:542 requests @@ -1652,6 +1658,7 @@ function main() { // claim was false. A tree dropped on a foreign host or opened over file:// is exactly the // case the self-hosted rung exists for. 'vendor/vue/vue.global.prod.js', + 'vendor/vue/LICENSE', ]) { const from = join(pubAssets, rel) if (!existsSync(from)) { console.warn(`[generate-tree] WARN missing tree asset: assets/${rel}`); continue } From 86471947fc08a3887e728fd42cdfd1882a9ae162 Mon Sep 17 00:00:00 2001 From: Doxa Maps Date: Mon, 28 Sep 2026 00:57:09 +0000 Subject: [PATCH 3/5] README quick start: a shallow clone, and Go for Rudder's voice engine (everything else works without it) --- README.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index b228653e7..011b58452 100644 --- a/README.md +++ b/README.md @@ -646,10 +646,11 @@ a higher-capability plugin from them — that's how the Research Gallery was bui You need **git**, **[Bun](https://bun.sh)** and **Node ≥ 18**, plus a free **[Mapbox](https://account.mapbox.com) public token** (it starts with `pk.`) so the maps have a -background. +background. For Rudder's voice engine, also **[Go](https://go.dev/dl/) 1.22+**, then run +`bash backend/rudder-engine/setup-runtime.sh` once; without Go, everything except voice works. ```bash -git clone https://git.nuxtbase.app/doxa-open/doxa-maps.git +git clone --depth 1 https://git.nuxtbase.app/doxa-open/doxa-maps.git # latest code only: seconds, not hundreds of MB of history cd doxa-maps bun install --frozen-lockfile cp .env.example .env # then paste your pk. token after VITE_MAPBOX_TOKEN= From 8c529c0313db28ffec24e2722a8428aa835036e6 Mon Sep 17 00:00:00 2001 From: Doxa Maps Date: Mon, 28 Sep 2026 01:13:57 +0000 Subject: [PATCH 4/5] Zero-config local setup: .env.example spells out every local default; README love line A fresh clone needs no .env. .env.example lists each local setting with its default, and an empty value means the default: DX_SYNC_REMOTE empty = hot reload of local edits only; DX_PB_URL empty = a local PocketBase. Rudder's settings are marked as shell-environment only, since the dev server reads them there. --- .env.example | 51 ++++++++++++++++++++++++++++++++++++++------------- README.md | 4 +++- 2 files changed, 41 insertions(+), 14 deletions(-) diff --git a/.env.example b/.env.example index a31e2208b..300456003 100644 --- a/.env.example +++ b/.env.example @@ -1,16 +1,41 @@ -# Mapbox token used in dev. Production hosts pass the token via profile-config.tk -# on the host page; never bake into the IIFE bundle. -VITE_MAPBOX_TOKEN=pk.your_dev_token_here +# .env.example — every local setting, each shown with its DEFAULT. +# A fresh clone needs NONE of this: `bun run dev` works with no .env at all. To change something, copy +# this file to .env (or .env.local, which wins; both are gitignored) and edit only the lines you need. +# An empty value means "use the default". + +# ── Maps ───────────────────────────────────────────────────────────────────────────────────────── +# A Mapbox public token (starts with pk.) for the map backgrounds. Empty = no Mapbox background; set +# "provider": "maplibre" on a plugin (or ?provider=maplibre on a page) to draw with MapLibre, no key. +# Production hosts pass the token through profile-config.tk; never bake it into a bundle. +VITE_MAPBOX_TOKEN= +# The data API the maps read when a plugin's profile does not name one (profile apiBaseUrl and a host +# page's window.MAP_APP_API_URL come first). This is the value the maps are built against. VITE_API_BASE_URL=https://pray.doxa.life -# Follow a shared branch while `bun run dev` runs (internal/dev-sync-plugin.mjs): fetch every N seconds and -# fast-forward when this checkout is on that branch with no local edits; otherwise only report it at -# /api/dev-sync. DX_SYNC_REMOTE is a remote name (origin) or a repo URL; leave it unset to turn this off. -# DX_SYNC_REMOTE=origin -# DX_SYNC_BRANCH=main -# DX_SYNC_INTERVAL=5 +# ── Hot reload from a shared branch (internal/dev-sync-plugin.mjs) ─────────────────────────────── +# Empty = OFF: the dev server hot-reloads YOUR local edits only (the default). +# Set to a remote name (origin) or a repo URL (https://…/repo.git) and `bun run dev` fetches every few +# seconds and fast-forwards when this checkout is on that branch with no local edits or commits; otherwise +# it only reports "main is N commits ahead" (in the log and at /api/dev-sync). It never merges over your work. +DX_SYNC_REMOTE= +# The branch to follow. Empty = main. +DX_SYNC_BRANCH= +# Seconds between checks. Empty = 5 (minimum 2). +DX_SYNC_INTERVAL= -# PocketBase for plugins (internal/backend-dev-plugin.mjs): `bun run dev` downloads the pinned binary once -# and serves it at /api/pb, data in .pb/dev. DX_PB_URL uses a shared PocketBase instead of a local one. -# DX_PB_PORT=8090 -# DX_PB_URL= +# ── PocketBase, the backend for plugins (internal/backend-dev-plugin.mjs) ──────────────────────── +# Empty = a LOCAL PocketBase: `bun run dev` downloads the pinned binary once (checksum-verified) and +# serves it at /api/pb, admin UI /api/pb/_/, data in .pb/dev (gitignored). Nothing leaves this computer. +# Set to a PocketBase root (e.g. https:///pb) to use a shared team one instead. +DX_PB_URL= +# The local PocketBase's port. Empty = 8090 (change it only if the log says the port is in use). +DX_PB_PORT= + +# ── Rudder, voice to text (backend/rudder-engine) ──────────────────────────────────────────────── +# These are read from the SHELL ENVIRONMENT, not from this file (e.g. `RUDDER_PORT=6193 bun run dev`). +# Rudder runs when its engine is built: install Go 1.22+ and run `bash backend/rudder-engine/setup-runtime.sh`. +# RUDDER_ENGINE 0 = never start the engine here (default: start it if it is built) +# RUDDER_PORT the engine's port (default 5193) +# RUDDER_NEMO_PORT the speech server's port (default 5194) +# RUDDER_HOME where the runtime and model live (default ~/.local/share/rudder) +# RUDDER_LANG the default language (default en-US) diff --git a/README.md b/README.md index 011b58452..7b58cf4fe 100644 --- a/README.md +++ b/README.md @@ -4,6 +4,8 @@ Made by Vibe Coders for Vibe Coders to prepare the way of the Lord and make His **Isaiah 40:3 “...Prepare the way for the LORD in the wilderness; make a straight highway for our God in the desert."** +Built with love, with the prayer that these maps bless the nations. + # dx-maps — one build, maps that embed everywhere **Write a map once in `plugin-designs//`, run one build, and drop it on any site** — @@ -653,7 +655,7 @@ background. For Rudder's voice engine, also **[Go](https://go.dev/dl/) 1.22+**, git clone --depth 1 https://git.nuxtbase.app/doxa-open/doxa-maps.git # latest code only: seconds, not hundreds of MB of history cd doxa-maps bun install --frozen-lockfile -cp .env.example .env # then paste your pk. token after VITE_MAPBOX_TOKEN= +cp .env.example .env # optional: paste your pk. token after VITE_MAPBOX_TOKEN= bun run dev # → http://localhost:5173/ is the Plugin Studio ``` From 7138385774a3c2c9f3b936e85a70d24902bd33cf Mon Sep 17 00:00:00 2001 From: Doxa Maps Date: Mon, 28 Sep 2026 01:26:47 +0000 Subject: [PATCH 5/5] README: link the cloud development guide next to the join-the-table guide --- README.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 7b58cf4fe..c0104f5c8 100644 --- a/README.md +++ b/README.md @@ -708,8 +708,9 @@ The studio is a plugin like any other: `plugin-designs/plugin-studio/plugin-stud their browser within seconds, with no rebuild. Add OIDC settings and it puts a "Sign in with *your provider*" page in front of everything, open only to the groups you allow. Recipe and settings: [deployment/cloud/](./deployment/cloud/README.md). -Working from your own laptop alongside the team (following the shared branch, the team's PocketBase): -[documentation/HOWTO-join-the-table.md](./documentation/HOWTO-join-the-table.md). +Working from your own laptop alongside the team (zero config, everything local by default): +[documentation/HOWTO-join-the-table.md](./documentation/HOWTO-join-the-table.md). When your agent runs on a +server instead: [documentation/CLOUD-DEVELOPMENT-ENVIRONMENT.md](./documentation/CLOUD-DEVELOPMENT-ENVIRONMENT.md). ---