# Third-party notices

This project has **no licence of its own yet** — choosing one is the owner's decision. This file lists
the third-party software and data that the repository **redistributes** (committed files) or **loads at
run time**, with their licences.

## Redistributed in this repository

### D3 7.9.0 — `app/vendor/d3.min.js`

ISC licence, Copyright 2010-2023 Mike Bostock. Full text: [`app/vendor/d3.LICENSE.txt`](app/vendor/d3.LICENSE.txt).

### Rust crates compiled into `engines/rust/pkg/fbengine_bg.wasm`

The committed WebAssembly binary (and its wasm-bindgen JavaScript glue `pkg/fbengine.js`) contains code
from these crates. Each is used under the MIT option of its licence (MIT text below); where a crate is
dual-licensed, the Apache-2.0 option ([text](https://www.apache.org/licenses/LICENSE-2.0)) applies equally.

| Crate | Version | Licence | Copyright / authors | Source |
|---|---|---|---|---|
| serde | 1.0.229 | MIT OR Apache-2.0 | Erick Tryzelaar, David Tolnay | https://github.com/serde-rs/serde |
| serde_core | 1.0.229 | MIT OR Apache-2.0 | Erick Tryzelaar, David Tolnay | https://github.com/serde-rs/serde |
| serde_json | 1.0.154 | MIT OR Apache-2.0 | The serde_json authors | https://github.com/serde-rs/json |
| quick-xml | 0.41.0 | MIT | Copyright (c) 2016 Johann Tuffe | https://github.com/tafia/quick-xml |
| memchr | 2.8.3 | Unlicense OR MIT | Copyright (c) 2015 Andrew Gallant | https://github.com/BurntSushi/memchr |
| itoa | 1.0.18 | MIT OR Apache-2.0 | David Tolnay | https://github.com/dtolnay/itoa |
| zmij | 1.0.23 | MIT | David Tolnay | https://github.com/dtolnay/zmij |
| rustc-hash | 2.1.3 | Apache-2.0 OR MIT | The Rust Project Developers | https://github.com/rust-lang/rustc-hash |
| wasm-bindgen | 0.2.129 | MIT OR Apache-2.0 | Copyright (c) 2014 Alex Crichton; the wasm-bindgen Developers | https://github.com/wasm-bindgen/wasm-bindgen |
| wasm-bindgen-shared | 0.2.129 | MIT OR Apache-2.0 | Copyright (c) 2014 Alex Crichton; the wasm-bindgen Developers | https://github.com/wasm-bindgen/wasm-bindgen |
| cfg-if | 1.0.5 | MIT OR Apache-2.0 | Copyright (c) 2014 Alex Crichton | https://github.com/rust-lang/cfg-if |
| once_cell | 1.21.4 | MIT OR Apache-2.0 | Aleksey Kladov | https://github.com/matklad/once_cell |
| unicode-ident | 1.0.27 | (MIT OR Apache-2.0) AND Unicode-3.0 | David Tolnay; Unicode data © Unicode, Inc. ([Unicode-3.0](https://www.unicode.org/license.txt)) | https://github.com/dtolnay/unicode-ident |
| Rust standard library (core, alloc, std and its wasm allocator) | rustc 1.85.0 | MIT OR Apache-2.0 | The Rust Project Developers | https://github.com/rust-lang/rust |

Compile-time-only crates (procedural macros, build dependencies and their helpers: serde_derive, syn,
quote, proc-macro2, wasm-bindgen-macro, wasm-bindgen-macro-support, bumpalo, rustversion) generate
code but are not themselves linked into the binary; they are also MIT OR Apache-2.0. The list was taken from
`cargo tree --target wasm32-unknown-unknown -e normal` in `engines/rust`; re-check it when `Cargo.lock` changes.

<details>
<summary>MIT licence text (applies to every crate above with the copyright notice listed for it)</summary>

```
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and
associated documentation files (the "Software"), to deal in the Software without restriction,
including without limitation the rights to use, copy, modify, merge, publish, distribute,
sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or
substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT
NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT
OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
```

</details>

### Football event data

- **StatsBomb open data** — `data/sample/df2.csv` (provided by the project owner, flattened from
  StatsBomb events) and `tests/fixtures/statsbomb_events_3930159.json` (downloaded from
  https://github.com/statsbomb/open-data) are StatsBomb event data for Hungary v Switzerland,
  UEFA Euro 2024. Data provided by StatsBomb (Hudl StatsBomb). Use is subject to the StatsBomb Public
  Data User Agreement in that repository (`LICENSE.pdf`), which asks you to credit StatsBomb as the
  data source in anything you publish with it. `app/tests/fixtures/df2.engine.json.gz`,
  `tests/fixtures/edge/` and the screenshot `docs/images/dashboard.png` contain data derived from
  these files.
- **Opta** — `tests/fixtures/opta_f24_sample.xml` is **synthetic**: generated from the StatsBomb sample
  by `tools/make_opta_sample.py` in the documented Opta F24 layout. It contains no Opta data. Opta is a
  trademark of Stats Perform; this project is not affiliated with Stats Perform or StatsBomb.

## Loaded at run time (not redistributed)

- **Pyodide 314.0.7** (MPL-2.0, https://github.com/pyodide/pyodide) is downloaded by the Python engine's
  worker from `https://cdn.jsdelivr.net/pyodide/v314.0.7/full/`. It bundles CPython (PSF licence) and the
  packages the engine loads — pandas 3.0.2 (BSD-3-Clause), NumPy (BSD-3-Clause) and their dependencies,
  each under its own licence as distributed by Pyodide. This is the app's only external request.
- Dev-only tools installed by `npm install` / `pip` / `cargo` (the `pyodide` npm package for the smoke
  test, pytest, pandas for the native tests, wasm-pack) are not part of the shipped app.