# Third-party code and assets in this plugin

Marfilo bundles its runtime libraries. User-selected embeds and font fallback
can contact external providers, as documented in readme.txt.
This file records where each bundled piece comes from and under
what permission, which is what this file is for. All of these licenses allow
commercial use.

## Lottie — lottie-web 5.13.0

MIT license, copyright Airbnb, Inc.
Readable and minified light builds: assets/vendor/lottie-light.js and
assets/vendor/lottie-light.min.js. Full license: assets/vendor/lottie-LICENSE.txt.
Source: https://github.com/airbnb/lottie-web/tree/v5.13.0
Reproduced from the pinned npm dependency by editor/build-vendor.mjs.

---

## Tailwind CSS — the class names in panel-base.css

MIT license, copyright Tailwind Labs, Inc.
`assets/css/panel-base.css` is the builder's own stylesheet and the version of
record: it is plain CSS, edited by hand, and nothing regenerates it. It started
life as the Tailwind v4.3.3 output of the application this editor was written
in, which is why many of its class names read as generated ones (`mt-4`,
`flex`, `text-sm`) and why the notice Tailwind puts at the top of its output is
kept at the top of the file — that notice is the licence condition.

No part of Tailwind ships as code: there is no Tailwind dependency, no build
step that runs it and no configuration file for it.
Source: https://github.com/tailwindlabs/tailwindcss

```
MIT License

Copyright (c) Tailwind Labs, Inc.

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
```

---

## Icons — Lucide

**2,050 icons**, in `editor/src/core/modules/_shared/icons-lucide.ts`
(generated by `editor/build-icons.mjs` from the `lucide-static` package).

Commercial use is permitted, with no obligation to credit on the page. The
only condition is to keep this notice, which is exactly what this file does.

```
ISC License

Copyright (c) for portions of Lucide are held by Cole Bemis 2013-2022 as part of
Feather (MIT). All other copyright (c) for Lucide are held by Lucide Contributors
2022.

Permission to use, copy, modify, and/or distribute this software for any purpose
with or without fee is hereby granted, provided that the above copyright notice
and this permission notice appear in all copies.

THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND
FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF
THIS SOFTWARE.
```

Some of these icons derive from the **Feather** project, MIT licensed:

```
The MIT License (MIT)

Copyright (c) 2013-present Cole Bemis

Permission is hereby granted, free of charge, to any person obtaining a copy of
this software and associated documentation files (the "Software"), to deal in
the Software without restriction, including without limitation the rights to
use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
the Software, and to permit persons to whom the Software is furnished to do so,
subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
```

The other ~130 icons — the ones that name things of the builder itself:
`megaMenu`, `priceList`, `rotate360` — were drawn in this project and belong
to it.

---

## Fonts — Google Fonts catalogue

What the plugin includes is the **list** of families (name, category and
available weights), generated by `editor/build-fonts.mjs` from Google Fonts'
public metadata.

No font file is fetched at all unless an administrator turns Google Fonts on in
Marfilo Settings: `Store::fonts_css()` returns empty while the
`marfilo_google_fonts` option is off, so the feature is opt-in and stays off
until somebody consents to it.

With it on, publishing makes the site's server fetch the stylesheet once and
`Store::fonts_localize()` downloads each `woff2` into the site's own uploads
folder (`uploads/marfilo-fonts/`), rewriting the sheet to point at home. That is
the normal path, and on it **visitors contact no third party**.

It is not a guarantee, and readme.txt says the same thing to users: a download
that fails leaves *that* file's `fonts.gstatic.com` URL untouched — deliberately,
so a page is never left without its letters — and a document published before the
option was enabled keeps its original Google links until it is republished. In
both cases the visitor's browser requests the file from Google, which is why
`Render` still preconnects to gstatic when something is left pointing there.

The editor (wp-admin) also contacts Google Fonts to preview families while
editing, again only once the option is on. A design that sticks to system fonts
contacts nothing anywhere.

Each family carries its own license — almost all SIL Open Font License 1.1 or
Apache 2.0, all of them commercial-use; the exact one is listed on the family's
page at fonts.google.com, and both licenses permit exactly this kind of
redistribution with the site.

---

## Fonts — bundled interface faces

The editor's own interface uses two typefaces that ship **inside the plugin**
(`assets/fonts/`, subset to latin and latin-ext), so opening wp-admin makes
no external requests:

* **IBM Plex Mono** — Copyright © 2017 IBM Corp. with Reserved Font Name
  "Plex". Upstream source: https://github.com/IBM/plex
* **Instrument Sans** — Copyright 2022 The Instrument Sans Project Authors
  (https://github.com/Instrument/instrument-sans).

Both are licensed under the SIL Open Font License, Version 1.1, which permits
bundling and commercial use. Clause 2 requires the original copyright notice and
the license to travel with each copy, so `assets/fonts/OFL.txt` sits beside the
`woff2` files and carries both notices and the full license text. The same text
is reproduced here.

**The Reserved Font Name, and why the monospaced family is called something
else.** The files in `assets/fonts/` are web subsets (latin and latin-ext).
Under clause 3 a subset is a Modified Version, and a Modified Version may not
present a Reserved Font Name as its primary font name. IBM's notice reserves
"Plex". So `assets/css/editor-fonts.css` declares the monospaced face as
`font-family: 'Marfilo Mono'`, not `'IBM Plex Mono'`: the files are IBM's and
the credit above is theirs, but the name they are served under is not the
reserved one. Instrument Sans reserves no name, so it keeps its own.

```
SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007

PREAMBLE
The goals of the Open Font License (OFL) are to stimulate worldwide
development of collaborative font projects, to support the font creation
efforts of academic and linguistic communities, and to provide a free and
open framework in which fonts may be shared and improved in partnership
with others.

The OFL allows the licensed fonts to be used, studied, modified and
redistributed freely as long as they are not sold by themselves. The
fonts, including any derivative works, can be bundled, embedded,
redistributed and/or sold with any software provided that any reserved
names are not used by derivative works. The fonts and derivatives,
however, cannot be released under any other type of license. The
requirement for fonts to remain under this license does not apply
to any document created using the fonts or their derivatives.

DEFINITIONS
"Font Software" refers to the set of files released by the Copyright
Holder(s) under this license and clearly marked as such. This may
include source files, build scripts and documentation.

"Reserved Font Name" refers to any names specified as such after the
copyright statement(s).

"Original Version" refers to the collection of Font Software components as
distributed by the Copyright Holder(s).

"Modified Version" refers to any derivative made by adding to, deleting,
or substituting -- in part or in whole -- any of the components of the
Original Version, by changing formats or by porting the Font Software to a
new environment.

"Author" refers to any designer, engineer, programmer, technical
writer or other person who contributed to the Font Software.

PERMISSION & CONDITIONS
Permission is hereby granted, free of charge, to any person obtaining
a copy of the Font Software, to use, study, copy, merge, embed, modify,
redistribute, and sell modified and unmodified copies of the Font
Software, subject to the following conditions:

1) Neither the Font Software nor any of its individual components,
in Original or Modified Versions, may be sold by itself.

2) Original or Modified Versions of the Font Software may be bundled,
redistributed and/or sold with any software, provided that each copy
contains the above copyright notice and this license. These can be
included either as stand-alone text files, human-readable headers or
in the appropriate machine-readable metadata fields within text or
binary files as long as those fields can be easily viewed by the user.

3) No Modified Version of the Font Software may use the Reserved Font
Name(s) unless explicit written permission is granted by the corresponding
Copyright Holder. This restriction only applies to the primary font name as
presented to the users.

4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
Software shall not be used to promote, endorse or advertise any
Modified Version, except to acknowledge the contribution(s) of the
Copyright Holder(s) and the Author(s) or with their explicit written
permission.

5) The Font Software, modified or unmodified, in part or in whole,
must be distributed entirely under this license, and must not be
distributed under any other license. The requirement for fonts to
remain under this license does not apply to any document created
using the Font Software.

TERMINATION
This license becomes null and void if any of the above conditions are
not met.

DISCLAIMER
THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
OTHER DEALINGS IN THE FONT SOFTWARE.
```

---

## npm dependencies bundled into `assets/dist/editor.js`

The editor bundle is built by `editor/build.mjs` from the sources in
`editor/src`, and it inlines every runtime dependency declared in
`editor/package.json` (`dependencies`, plus what they pull in). That is the
complete list below — it matches the non-dev entries of
`editor/package-lock.json`, which ships with the plugin so the bundle can be
reproduced with `npm ci && npm run build`. Each is MIT licensed; the MIT text is
the one reproduced above, under the Feather notice.

The bundle only loads in wp-admin. Published pages carry none of it: they are
served as plain HTML and CSS.

| Package | Version | License | Copyright | Source |
|---|---|---|---|---|
| `react` | 19.2.8 | MIT | Copyright (c) Meta Platforms, Inc. and affiliates | https://github.com/facebook/react |
| `react-dom` | 19.2.8 | MIT | Copyright (c) Meta Platforms, Inc. and affiliates | https://github.com/facebook/react |
| `scheduler` | 0.27.0 | MIT | Copyright (c) Meta Platforms, Inc. and affiliates | https://github.com/facebook/react/tree/main/packages/scheduler |
| `zod` | 3.25.76 | MIT | Copyright (c) 2025 Colin McDonnell | https://github.com/colinhacks/zod |
| `fflate` | 0.8.2 | MIT | Copyright (c) 2023 Arjun Barrett | https://github.com/101arrowz/fflate |

Notes on two of them:

* **`zod`** is not only bundled: it is also handed to third-party module
  authors as `window.Marfilo.z`, so a plugin that registers a Marfilo module
  writes its schema against this copy. The MIT license permits that, and the
  attribution above is the notice it asks for in return.
* **`fflate`** compresses and reads the site exporter's `.zip`.

`lottie-web` is a dependency too, but it does not go through this bundle: it is
copied out as a standalone file by `editor/build-vendor.mjs` and declared at the
top of this document, with its own license file in `assets/vendor/`.

`lucide-static` is a **development** dependency: `editor/build-icons.mjs` reads
it to generate the icon set, and the package itself is not shipped. Its terms
are the Lucide notice above.
