License Guidance

License Guidance

Status: Reference Last Updated: 2026-10-09 Source: repository root LICENSE, THIRD_PARTY_NOTICES.md, dependency-licenses.csv, CITATION.cff, and mofacts/package.json

MoFaCTS Project License

MoFaCTS project-owned code is licensed under the GNU Affero General Public License v3.0 only (AGPL-3.0-only). The canonical project license text is the root repository file:

• LICENSE

Release metadata must stay aligned:

• README.md describes MoFaCTS as AGPL-3.0-only.
• CITATION.cff identifies license: AGPL-3.0-only.
• mofacts/package.json uses "license": "AGPL-3.0-only".
• the root package entry in mofacts/package-lock.json uses "license": "AGPL-3.0-only".

Third-Party Code

Third-party code keeps its own license. Do not describe copied, vendored, bundled, or dependency code as relicensed to AGPL.

Preserve notices for local third-party files, including:

• Matt Diamond Recorder.js-derived files in mofacts/client/lib/audioRecorder.ts and mofacts/public/lib/audioRecorderWorker.js.
• hark@1.2.3-derived code in mofacts/client/lib/hark.ts.
• same-origin assets under mofacts/public/vendor/, whose per-library README files record source, version, license, and update guidance.
• WebGazer 3.5.3 and its packaged MediaPipe assets, including their GPL-3.0-or-later license and upstream notices.
• the managed ostrio:ddp-client package override and its retained upstream provenance.

Keep dependency package license metadata in package-lock.json. If node_modules or other dependency bundles are distributed, include the dependency package license files and notices.

Dependency Inventory

Runtime npm dependency licenses are generated with license-checker and committed as:

• dependency-licenses.csv

The optional full development/build tooling inventory is:

• dependency-licenses-all.csv

Regenerate from mofacts/:

npm run license:audit
npm run license:audit:all

Source Access for Deployments

Deployed MoFaCTS instances must provide source access to network users as required by AGPL section 13.

The deployed app should include a visible "License / Source" link that points to the exact public repository tag or source archive corresponding to the deployed version. Docker images, source tarballs, and bundled frontend artifacts should include the AGPL license text, third-party notices, build scripts, and lockfiles so recipients can rebuild and trace bundled JavaScript back to Corresponding Source.

Content Attribution

Media and stimulus attribution metadata in TDF/content fields such as licenseName, licenseUrl, creatorName, sourceName, and sourceUrl remains content attribution. Do not fold those fields into MoFaCTS project licensing.