# Third-party notices

Embodied Assistant's first-party code is licensed under GPL-2.0-or-later.
Third-party components retain their own copyrights and licenses. A release
includes their complete license texts in `licenses/`. Matching editable sources
and build instructions are included in `source/` in the WordPress.org Free
distribution, with external dependency source locations in `source/DEPENDENCIES.md`.
Other distributions provide a separate corresponding-source artifact.

| Component | License | Use |
| --- | --- | --- |
| [TalkingHead](https://github.com/met4citizen/TalkingHead) | MIT | Avatar renderer, playback worklet and language processors |
| [Three.js](https://github.com/mrdoob/three.js) | MIT | TalkingHead rendering dependency, including imported loaders |
| [Lit](https://github.com/lit/lit), lit-element, lit-html, @lit/reactive-element, @lit-labs/ssr-dom-shim | BSD-3-Clause | Web component runtime and supporting modules |
| [XState](https://github.com/statelyai/xstate) | MIT | Conversation state machine |
| [Toastify](https://github.com/apvarun/toastify-js) | MIT | Notifications |
| @types/trusted-types | MIT | Type declarations included with the dependency source collection |
| [HeadAudio](https://github.com/met4citizen/HeadAudio) | MIT | Audio-driven lip-sync client, worklet and pretrained model |

`licenses/npm-inventory.json` records the exact installed versions, licenses and
license filenames for the locked production dependency tree. This conservative
inventory includes supporting packages even when bundling removes unused code.
Development tools are not shipped as executable plugin code.

## Downloadable avatar catalog

Realistic catalog avatars are derived from [Microsoft Rocketbox](https://github.com/microsoft/Microsoft-Rocketbox), as identified by the publisher. They retain the MIT license below. Models are downloaded separately from the Sentifyd catalog; this notice does not change their license.

MIT License

Copyright (c) 2020 Microsoft

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.

Cartoon catalog avatars were created through Sentifyd's Ready Player Me partner integration for commercial use. On 2026-10-06, the publisher confirmed that they were a registered Ready Player Me developer and retain commercial rights for the GLB avatars they created through the platform. The avatars retain their applicable Ready Player Me terms, separate from the plugin's GPL license and Rocketbox's MIT license.

XState is managed through the web component's npm dependencies and lockfile;
there is no separate maintained copy in the repository. Release packaging adds
the matching upstream TypeScript archive under `upstream/` inside the generated
source archive. Lit's npm source maps retain its original TypeScript as
`sourcesContent`. The SSR DOM shim uses Lit's shared BSD license text, taken from
the installed `lit` package; its individual source copyright notices are retained.

## HeadAudio

Copyright (c) 2025 Mika Suominen. HeadAudio is a separate project from TalkingHead.
The manually updated `headaudio.min.mjs`, `headworklet.min.mjs`, `model-en-mixed.bin`
and their MIT `LICENSE` live together in
`packages/web-component/src/lipsync/headAudio/`. Its `SOURCE.json` identifies the
matching upstream release source. No editable HeadAudio source is maintained in
the repository. WordPress.org Free documents its pinned public source location
in `source/DEPENDENCIES.md` and restores it only when rebuilding. Separate full
source archives also preserve the matching upstream distribution.

The first-party converter `tools/build-headaudio-model.mjs` derives readable
Gaussian prototype data in `src/lipsync/models/model-en-mixed.json`. The build
verifies a byte-exact round trip against the pinned model. The first-party
adapter sends typed numeric records to the unchanged worklet using its existing
message protocol. Installable packages contain the readable JSON; the original
binary is restored from the pinned vendor archive when rebuilding included Free
source, and is preserved in the separate full corresponding-source archive.

The frontend build copies the license beside the generated audio assets as
`assets/HeadAudio-LICENSE.txt`; the installable plugin also includes
`licenses/HeadAudio-MIT.txt`.

## Other assets and platform dependencies

The ten English voice-preview MP3 recordings (96 kbps mono) are first-party supplied,
AI-generated assets distributed with the plugin under GPL-2.0-or-later to the
extent copyright applies. The plugin serves these recordings locally. When
adding a supported voice, include the matching `<voice>.mp3` in
`plugin/embodied-assistant/assets/audio/realtime-voices/`.

No third-party example avatars, animations, fonts or demo audio are included
from the TalkingHead or HeadAudio repositories. Optional animation clips are downloaded from the publisher's Azure catalog
only after the administrator enables Play avatar animation in Capabilities. These separately hosted assets are not included
in the plugin's GPL grant; their hosting and distribution rights must be verified
separately before release.

WordPress supplies `@wordpress/abilities` at runtime; it is not bundled here.

