doxa-life/doxa-maps
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge remote-tracking branch 'origin/main' into bundler-1/work

Browse source
This commit is contained in:
Doxa Maps 2026-09-28 01:38:54 +00:00
commit 6853b822bb
6 changed files with 215 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

21
data/vendor/tabulator/LICENSE vendored Normal file
View file

@ -0,0 +1,21 @@
The MIT License (MIT)
Copyright (c) 2015-2026 Oli Folkerd
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.

21
data/vendor/vue/LICENSE vendored Normal file
View file

@ -0,0 +1,21 @@
The MIT License (MIT)
Copyright (c) 2018-present, Yuxi (Evan) You and Vue contributors
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
THE SOFTWARE.

106
documentation/CLOUD-DEVELOPMENT-ENVIRONMENT.md Normal file
View file

@ -0,0 +1,106 @@
# Working when your agent lives on a server
Most people do not need this page. If you are editing on your own laptop, start with
[HOWTO-join-the-table.md](./HOWTO-join-the-table.md) — a fresh clone and `bun run dev` gives you
everything, with nothing to configure.
This page is for one situation: **your coding agent runs on a server, not on your laptop.** Then the edits
appear somewhere you are not sitting, and you want to see them.
There are two ways. **The first is better for almost everyone.** The second is here because it is
sometimes the right answer, and because you should know what it costs before you choose it.
---
## Option 1 — keep working locally, and follow the remote (recommended)
Your laptop keeps running `bun run dev` exactly as before. You add **one line** so it follows the branch
your agent pushes to, and your browser hot-reloads when the agent lands something.
In `.env` (or `.env.local`) at the repo root:
```
DX_SYNC_REMOTE=https://<host>/<owner>/<repo>.git
```
A remote name like `origin` works too. Both files are gitignored; if both set it, `.env.local` wins.
That really is the whole setup. You keep everything good about working locally — the Plugin Studio,
dictation, your own database — and you additionally see your agent's work arrive.
### Two conditions, and the second one catches people
**If the repo is private**, your laptop needs git credentials that work without a prompt: either a
credential helper you already use, or a token in the URL. It never asks interactively. A token in the URL
is never written to a log.
**Your checkout has to be in a state where a fast-forward is safe.** All three of these:
- you are on the branch it follows (`DX_SYNC_BRANCH`, default `main`)
- you have no unsaved edits
- you have no local commits of your own
> **This is the one that surprises people.** If you have your own work in progress, the sync **stops
> pulling** — it will not touch your files. It reports `main is N commits ahead` instead and waits.
>
> That is deliberate and it is protecting you. But it means: **push your own work, or you will drift.**
> If you leave local commits sitting for a day while your agent lands twenty changes, the pull you
> eventually do has a day of divergence in it. Push little and often and this never happens.
Two optional dials:
| | what it does | default |
|---|---|---|
| `DX_SYNC_BRANCH` | which branch to follow | `main` |
| `DX_SYNC_INTERVAL` | seconds between checks | `5` |
---
## Option 2 — run the shared cloud dev server
Instead of your laptop rendering the branch, a container on a server does, and everyone opens the same URL.
From the repo root:
```bash
docker build -t dx-maps-dev deployment/cloud
docker run -d -p 5173:5173 \
-e REPO_URL=https://<host>/<owner>/<repo>.git \
-e BRANCH=main \
-v dx-maps-data:/data \
dx-maps-dev
```
Add `-e GIT_TOKEN=<read token>` for a private repo. Then `http://<server>:5173/` is the Plugin Studio.
You can also paste the Dockerfile into a host like Coolify using its "Dockerfile" build pack and give it a
domain, so it is `https://<your-domain>/`. The full settings table is in `deployment/cloud/`'s own README.
> **If it is reachable from the internet, put a sign-in in front of it.** Add the `OIDC_*` settings from
> that README. Do not expose it publicly without them.
### What this costs you
This is the honest list. None of it is a dealbreaker; all of it is worth knowing first.
- **No dictation.** The speech engine can run there, but on a 2-CPU server it falls about 4 seconds behind
the speaker, so it is switched off. Dictation is a laptop feature.
- **Nobody edits on it.** Changes only arrive by pushing to the branch; it pulls every 15 seconds and
reloads. It is a shared *viewer* of the branch, not a workspace.
- **Everyone shares one running copy.** A push that breaks the build breaks it for everybody until someone
fixes it.
- **It needs a real server** — roughly 2.5 GB of RAM and 2 vCPUs.
- **Its database is the shared team one**, not a private one per person.
---
## Which to pick
**Option 1**, unless you have a specific reason not to. You keep dictation, you keep your own database, a
broken push only breaks your own screen, and the setup is one line in a file you already have.
Option 2 earns its place when the *point* is that everyone looks at the same thing — a review, a demo, a
room full of people who should not each be running a build. It is a viewing gallery, not a workshop.
You can use both: follow the remote on your laptop for daily work, and open the shared server when the
team wants to look at something together.

27
documentation/HOWTO-join-the-table.md
View file

@ -25,8 +25,12 @@ bun install
bun run dev
```
You get the Plugin Studio, hot reload on your own edits, and a local database with your own test data. Break
it, reset it, fill it with nonsense — it is yours.
That is the whole setup. **Nothing to configure**, no server to reach, no Docker. You get the Plugin
Studio, dictation, hot reload on your own edits, and a local database with your own test data. Break it,
reset it, fill it with nonsense — it is yours.
If your coding agent runs on a server rather than on your laptop, there is a second way to work —
see [CLOUD-DEVELOPMENT-ENVIRONMENT.md](./CLOUD-DEVELOPMENT-ENVIRONMENT.md). Most people do not need it.
### 2. `main` — the truth
@ -117,8 +121,8 @@ There are three databases. You work against one of the first two — never the t
| Where | What is in it | Who touches it |
|---|---|---|
| Your laptop | your own sandbox data | you, freely |
| The team's shared one | the team's shared test data | the team — this is usually the default |
| Your laptop | your own sandbox data | you, freely — **this is the default** |
| The team's shared one | the team's shared test data | the team — opt-in, see below |
| Production | what the public sees | nobody directly |
**You never publish a database.** Not yours, not anyone's. What travels is the *shape* — the tables and
@ -134,19 +138,20 @@ live config did not match the repo, you already know why.
### Which one your laptop talks to
Most teams point every laptop at the **shared** one, so you are all working against the same test data.
Put this in `.env.local`:
**By default, your own.** You do not configure anything. The first time you run `bun run dev` it starts a
database on your laptop, keeps its data in `.pb/`, and gives you an admin screen at `/api/pb/_/`. A fresh
clone plus `bun run dev` is the whole setup — no remote server, no Docker, nothing to sign into.
If your team wants everyone working against the *same* test data instead, that is opt-in. Add one line to
`.env.local`:
```
DX_PB_URL=https://<your team's dev server>/pb
```
You sign in with the same team account you use for everything else — there is no separate password. Ask
whoever set up your team for the address if you do not have it.
**Leave it unset and you get a private one instead.** The first time you run `bun run dev` it downloads and
starts a database on your laptop, with its data in `.pb/`, and you can open its admin screen at
`/api/pb/_/`. That is the fallback, and it is a fine way to work while you are finding your feet.
whoever set up your team for the address. Leave the line out and you stay on your own local one, which is
the right place to be while you are finding your feet.
The only other thing here is `DX_PB_PORT`, which you set only if the log says port 8090 is already in use.

44
documentation/THIRD-PARTY.md Normal file
View file

@ -0,0 +1,44 @@
# Third-party content in the shipped tree
Every non-original thing `dx-maps/` ships, what licenses it, and whether the licence or
attribution actually travels with it. Compiled 2026-09-28 by inspecting the SHIPPED tree, not the
source lists -- the question is what a recipient receives.
Notes live HERE and not beside the assets: `check:public-hygiene` fails on "documentation in a
served folder". The licence travels with the asset; the explanation travels with the repo.
| Item | Source | Licence | Does it travel? | Gap |
|---|---|---|---|---|
| Fonts: bebas-neue, figtree, noto-serif-devanagari, oswald, poppins | Google Fonts / foundry repos | OFL-1.1 | **Yes** — each `LICENSE` is the family's own upstream OFL, verbatim, with its real copyright line | none (closed 2026-09-28) |
| `vendor/vue/vue.global.prod.js` | vuejs/core | MIT | **Partly** — the minified banner carries `(c) 2018-present Yuxi (Evan) You` and `@license MIT`, but NOT the permission notice MIT asks to include | closed: upstream `LICENSE` now vendored beside it |
| `vendor/tabulator/tabulator.min.js` + `.min.css` | olifolkerd/tabulator v6.3.1 | MIT | **No** — the `.js` had only `(c) Oliver Folkerd 2025`; the `.css` had nothing | closed: upstream `LICENSE` now vendored beside it |
| `boundaries/gb-*.geojson` (4 files) | geoBoundaries gbOpen (www.geoboundaries.org) | CC BY — the India ADM1 file records **CC BY 2.5 IN**, sourced from DataMeet/Election Commission of India | **Partly** — provenance sits in ONE sidecar, `gb-IND-ADM1-full.meta.json` (source, boundaryID, licence, fetch URL, processing). The other boundary files have none, and no human-readable attribution ships | **OPEN** — CC BY requires attribution to accompany the work |
| `boundaries/world-adm0*.geojson` | not verified — probably Natural Earth | Natural Earth is public domain | n/a if Natural Earth | **OPEN** — provenance unconfirmed for this file |
| `people-groups/*` (3 files, 8 MB) | peoplegroups.org | **not established** | no terms ship | **OPEN, judgment** — redistribution terms unknown |
| `pplr/*` (6 files, 16 MB) | not resolved from `plugin-designs/pplr-data-maps/scripts/build-data.mjs` | **not established** | nothing ships | **OPEN, judgment** — owner should name the upstream |
| `tables/*` (304 files, 36 MB) | derived by `library/scripts/research/fetch-*.mjs` from several upstream APIs | **varies, not established per table** | nothing ships; there is no source or licence doc in `tables/` | **OPEN, judgment** — the largest gap by volume |
| `images/worldmap.svg` | recorded in `images/PROVENANCE` | see that file | the PROVENANCE file ships and explains why no licence file sits beside it | none claimed; reasoning recorded rather than assumed |
| `previews/*` (378 files) | our own poster previews | ours | n/a | none |
| Natural Earth 1:10m populated places (`library/scripts/posters/data/ne-places.json`) | naturalearthdata.com | **public domain**, no attribution required | n/a | none. Their 1:10m ROADS were deliberately not shipped because of an ODbL attribution obligation |
## Provenance records
| Vendored file | Upstream URL | sha256 |
|---|---|---|
| `data/vendor/tabulator/LICENSE` | `https://raw.githubusercontent.com/olifolkerd/tabulator/master/LICENSE` | `191a2ee554684e1064c897b432f0e1bc6dfa714ca045d3f6ea2cf692cbd398b7` |
| `data/vendor/vue/LICENSE` | `https://raw.githubusercontent.com/vuejs/core/main/LICENSE` | `49190d1f742dd61e47fe816df4963e5186a2a62100d9122f9883a60ea32973ac` |
| `data/fonts/bebas-neue/LICENSE` | `https://raw.githubusercontent.com/google/fonts/main/ofl/bebasneue/OFL.txt` | see `documentation/vendored-fonts.md` |
| `data/fonts/poppins/LICENSE` | `https://raw.githubusercontent.com/google/fonts/main/ofl/poppins/OFL.txt` | see `documentation/vendored-fonts.md` |
## What is NOT closed, and why it is not mine to close
Four rows above are marked OPEN. Two are simply unverified and someone should look
(`world-adm0` provenance, the `pplr` upstream). Two need a decision rather than a fetch:
**people-groups** and the 304 **tables** carry data whose redistribution terms are not established,
and 36 MB of derived tables is the largest exposure by volume. Attaching a licence I have not
confirmed would be worse than the present gap, so those go to the Driver.
The geoBoundaries row is closable by work rather than judgment: CC BY needs attribution to
accompany the data, and the pattern already exists in this repo -- the `.meta.json` sidecar. Extending
it to the other boundary files plus one shipped attribution line would close it.

7
internal/generate-tree.mjs
View file

@ -1637,6 +1637,12 @@ function main() {
// vendor — DataTable/TabulatorTable inject Tabulator from assetsBase at runtime.
'vendor/tabulator/tabulator.min.js',
'vendor/tabulator/tabulator.min.css',
// ★ AND THEIR LICENCES, because this list is what decides whether a notice TRAVELS. Both are MIT,
// which requires the permission notice to be included with the software. Tabulator's minified .js
// carried only a copyright line and its .css carried nothing; Vue's banner names MIT but omits the
// permission text. Shipping the code without the notice is the gap, and an allowlist that omits
// the LICENSE guarantees it stays open however carefully the file is vendored.
'vendor/tabulator/LICENSE',
// vendor/vue — the GALLERY SHELL's own Vue (generate-gallery.mjs loadVue()), not a bundle's.
//
// ★ ADDED 2026-09-22, and it had never been staged. generate-gallery.mjs:542 requests
@ -1652,6 +1658,7 @@ function main() {
// claim was false. A tree dropped on a foreign host or opened over file:// is exactly the
// case the self-hosted rung exists for.
'vendor/vue/vue.global.prod.js',
'vendor/vue/LICENSE',
]) {
const from = join(pubAssets, rel)
if (!existsSync(from)) { console.warn(`[generate-tree] WARN missing tree asset: assets/${rel}`); continue }