= Third-party notices
:toc:
:toclevels: 1

Frontend libraries vendored under `public/vendor/` instead of loaded
from a CDN, so the app keeps working with no internet access. All are
BSD-3-Clause licensed.

[cols="1,1,2"]
|===
| Library | Version | Source

| MapLibre GL JS
| 6.6.0
| https://github.com/maplibre/maplibre-gl-js

| pmtiles (pmtiles.js)
| 4.5.0
| https://github.com/protomaps/PMTiles

| maplibre-contour (Overlays panel's "Contour lines", `public/js/contour.js`)
| 0.1.0
| https://github.com/onthegomap/maplibre-contour
|===

Also vendored under `public/vendor/`, but not BSD-3-Clause like the
above — MIT-licensed per its own `package.json` (the monorepo's
top-level `LICENSE.md` separately places the whole repo in the public
domain as a work of the US government; either way, no attribution is
required):

[cols="1,1,2"]
|===
| Library | Version | Source

| NPS Home Button (`home-button`)
| 0.0.1-d
| https://github.com/nationalparkservice/npmap5-plugins/tree/main/home-button

| NPS Overview Map (`maplibre-gl-overview`)
| 5.0.1
| https://github.com/nationalparkservice/npmap5-plugins/tree/maplibre-gl-overview
|===

The overview map is vendored from an unmerged branch, not `main` (see
`docs/nps-resources.adoc`), and converted from its UMD dist build to a
plain ES module — no functional change except the module wrapper. It
was also patched for a MapLibre API break: it reads `map.transform`
(public in the MapLibre ~2.4 this plugin targets) to relax the
overview's polar pan limit, but MapLibre 6's `Map` no longer exposes
`.transform` at all — guarded to skip that (cosmetic) adjustment
instead of throwing when it's absent.

Also vendored under `public/vendor/` — MIT-licensed (© 2013 Panayiotis
Lipiridis), attribution required (this notice satisfies that):

[cols="1,1,2"]
|===
| Library | Version | Source

| flag-icons (just the square `1x1/` crop, only the 39 European
countries `lib/maptool/data/europe_countries.geojson` lists — see
`public/js/offline_data.js`)
| 7.5.0
| https://github.com/lipis/flag-icons
|===

Offline map text labels need font glyphs too (see
`docs/architecture.adoc`), vendored under `public/vendor/fonts/` —
SIL Open Font License, not BSD-3-Clause like the above:

[cols="1,2"]
|===
| Asset | Source

| Noto Sans Regular/Italic/Medium glyph PBFs (ranges `0-255`,
`256-511` only)
| https://github.com/protomaps/basemaps-assets[protomaps/basemaps-assets]
(`fonts/`, `OFL.txt` included alongside)

| National Park (Bold weight only, `.woff2`), topbar wordmark
(`.topbar__brand`, `public/css/style.css`) — see
`docs/nps-resources.adoc`
| https://nationalparktypeface.com[nationalparktypeface.com] (Ben
Hoepner, Andrea Herstowski, Jeremy Shellhorn / DO Studio) — "published
for free use under the SIL Open Font License" per the site; no
`OFL.txt` ships in its own download zips, unlike Noto Sans above
|===

The map style — https://tiles.openfreemap.org/styles/liberty[OpenFreeMap
"liberty"], built from https://www.openstreetmap.org[OpenStreetMap]
data — is used two ways (see `docs/architecture.adoc`): fetched live
at runtime for the "Online" layer, and as a one-time vendored snapshot
(`public/vendor/liberty-style/liberty.json`) that the "Offline" layer
repoints at local data instead. Its icon sprite is vendored the same
way, under `public/vendor/liberty-sprite/` (`ofm.json`/`ofm.png` +
`@2x` variants, from `tiles.openfreemap.org/sprites/`). Neither has
been re-checked against a specific upstream version pin the way the
table above does — re-fetch both from `tiles.openfreemap.org` if
Liberty's own style/sprite ever visibly drifts from what's vendored.

`data/offline.pmtiles` (`lib/maptool/pmtiles_builder.rb`'s in-app
regeneration, or the manual recipe in `docs/development.adoc`) is
built at build time, not vendored, from
https://download.geofabrik.de[Geofabrik]'s per-country OpenStreetMap
extracts (ODbL).

`terrain.pmtiles` (same regeneration mechanism) is extracted at build
time, not vendored, from https://mapterhorn.com[Mapterhorn] — a
Protomaps-affiliated project publishing pre-built Terrarium-encoded
terrain as PMTiles. Per-region source licenses vary (CC-BY-4.0 and
similar); see
https://download.mapterhorn.com/attribution.json[their own attribution
list] for the full provenance.

Not a frontend asset like the above, but also baked into this app's own
Docker image (not a separate container the way kiwix-serve/gpsd are —
see `docs/deployment.adoc`/`docs/development.adoc`): three CLI tools
`lib/maptool/pmtiles_builder.rb` shells out to for offline.pmtiles/
terrain.pmtiles regeneration.

[cols="1,1,1,2"]
|===
| Tool | Version | License | Source

| go-pmtiles (`pmtiles` CLI)
| 1.31.2
| BSD-3-Clause
| https://github.com/protomaps/go-pmtiles

| Planetiler (`planetiler.jar`)
| 0.10.2
| Apache-2.0
| https://github.com/onthegomap/planetiler

| osmium-tool (`osmium`, installed via the `osmium-tool` Debian package)
| (Debian trixie's packaged version)
| GPL-3.0
| https://github.com/osmcode/osmium-tool
|===

To update a vendored library: download its package (e.g.
`npm pack <name>@<version>`), replace the corresponding files under
`public/vendor/<name>/`, and update the version in this file. To
update go-pmtiles or Planetiler, bump `PMTILES_VERSION`/
`PLANETILER_VERSION` in the `Dockerfile` and the version here —
osmium-tool tracks whatever version Debian trixie currently packages,
nothing to pin on this side.