# Third-Party Notices

Leylines (formerly PartyMix) incorporates open-source components. Their
copyrights and license texts are reproduced below.

This file reaches users three ways, so a plugin obtained by any route carries
its own attributions:

- **Compiled into every plugin binary** and readable in-app at
  Settings → About → **View licenses** (CMake target `LeylinesLegalNotices`).
  This is the copy that travels with a bare VST3/CLAP bundle.
- **Installed on disk** by the Windows installer as
  `%ProgramFiles%\Leylines\THIRD_PARTY_NOTICES.txt`.
- **Staged next to the downloads** by `scripts/release-windows.ps1`.

## JUCE 8.0.15 (JUCE 8 licence, Starter tier; see https://juce.com/legal/juce-8-licence/)
Copyright © Raw Material Software Limited

Leylines is built on JUCE 8 under the terms of the JUCE 8 End User Licence
Agreement, on the free Starter tier (closed-source commercial distribution is
permitted up to a trailing-twelve-month revenue limit of USD 20,000). This
product includes software developed by Raw Material Software Limited. Consumed
via CMake FetchContent, pinned to the JUCE tag `8.0.15` (commit
`91ad83ae34a81e0833b1a2b0866f54846370ae53`).

JUCE requires no attribution at any tier; this entry is voluntary.

**JUCE is not one component.** It vendors third-party code under those authors'
own licences, and the modules Leylines links compile that code into every
shipped binary. Those components are attributed individually below, under
"Components bundled inside JUCE" - several of them, unlike JUCE itself, DO
require their notice to be reproduced with a binary distribution.

## Components bundled inside JUCE (JUCE 8.0.15, pinned commit above)

These are not extra dependencies to add; they are already inside the JUCE
modules `CMakeLists.txt` links, and they are in the shipped binary. The list
was derived from the JUCE modules in use and then CHECKED against the built
`Leylines.exe` (WEBRTC=ON, Release, 0.99.10) by searching it for each library's
own strings - `libFLAC`/`FLAC__` (70 hits), `Xiph`, `libpng`/`png_`, zlib's
`incorrect header check` and version `1.3.1`, libjpeg's `Bogus Huffman`/`JFIF`,
and HarfBuzz's `hb_font`. Codecs JUCE ships but does NOT compile at our
settings are listed at the end so nobody re-derives them.

libFLAC matters most: FLAC-WIRE M3 made it a FEATURE dependency rather than
incidental plumbing (`Source/engine/FlacChunkPayload.h` says so in as many
words), and BSD-3 requires the copyright notice and disclaimer be reproduced in
materials distributed with a binary.

### libFLAC 1.4.3 — BSD 3-Clause (Xiph.Org)
Copyright (C) 2000-2009 Josh Coalson; Copyright (C) 2011-2023 Xiph.Org Foundation.
Vendored at `modules/juce_audio_formats/codecs/flac` and compiled because
`JUCE_USE_FLAC` defaults to 1 (this build does not override it).

Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met:

- Redistributions of source code must retain the above copyright notice, this
  list of conditions and the following disclaimer.
- Redistributions in binary form must reproduce the above copyright notice,
  this list of conditions and the following disclaimer in the documentation
  and/or other materials provided with the distribution.
- Neither the name of the Xiph.Org Foundation nor the names of its contributors
  may be used to endorse or promote products derived from this software without
  specific prior written permission.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS BE LIABLE FOR ANY
DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

### Ogg / Vorbis (libvorbis 1.3.7) — BSD 3-Clause (Xiph.Org)
Copyright (c) 2002-2020 Xiph.org Foundation.
Vendored at `modules/juce_audio_formats/codecs/oggvorbis` and compiled because
`JUCE_USE_OGGVORBIS` defaults to 1. Leylines does not use Ogg Vorbis itself
(the wire codec is libopus, attributed separately); it is linked because the
module is. The BSD 3-Clause terms and disclaimer above apply verbatim, with
"Xiph.org Foundation" as the named holder.

### HarfBuzz 10.1.0 — "Old MIT" licence
Copyright © 2010-2023 Google, Inc.; Behdad Esfahbod; Red Hat, Inc.; Mozilla
Foundation; Ebrahim Byagowi; Facebook, Inc.; Codethink Limited; Nokia
Corporation; Keith Stribley; Martin Hosken and SIL International; Chris Wilson;
David Turner and Werner Lemberg; Igalia S.L.; Matthias Clasen; Khaled Hosny;
Adobe, Inc.; Alexei Podtelezhnikov. Full per-file notices are in
`modules/juce_graphics/fonts/harfbuzz/COPYING` at the pinned JUCE commit.

Permission is hereby granted, without written agreement and without license or
royalty fees, to use, copy, modify, and distribute this software and its
documentation for any purpose, provided that the above copyright notice and the
following two paragraphs appear in all copies of this software.

IN NO EVENT SHALL THE COPYRIGHT HOLDER BE LIABLE TO ANY PARTY FOR DIRECT,
INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE
OF THIS SOFTWARE AND ITS DOCUMENTATION, EVEN IF THE COPYRIGHT HOLDER HAS BEEN
ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

THE COPYRIGHT HOLDER SPECIFICALLY DISCLAIMS ANY WARRANTIES, INCLUDING, BUT NOT
LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
PARTICULAR PURPOSE. THE SOFTWARE PROVIDED HEREUNDER IS ON AN "AS IS" BASIS, AND
THE COPYRIGHT HOLDER HAS NO OBLIGATION TO PROVIDE MAINTENANCE, SUPPORT,
UPDATES, ENHANCEMENTS, OR MODIFICATIONS.

### SheenBidi — Apache License 2.0
Copyright © Muhammad Tayyab Akram. Vendored at
`modules/juce_graphics/unicode/sheenbidi` and compiled as its own translation
unit (`juce_graphics_Sheenbidi.c`) in every plugin target. Attributed on the
build graph rather than on a string match: unlike the libraries above it
carries no identifying string literal, so a binary search cannot confirm or
deny it, and over-attribution is the safe error. Apache-2.0 terms are
reproduced under the Mbed TLS entry below and apply here unchanged.

### libpng 1.6.37 — PNG Reference Library License version 2
Copyright (c) 1995-2019 The PNG Reference Library Authors; (c) 2018-2019 Cosmin
Truta; (c) 2000-2002, 2004, 2006-2018 Glenn Randers-Pehrson; (c) 1996-1997
Andreas Dilger; (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.
Vendored at `modules/juce_graphics/image_formats/pnglib`.

The software is supplied "as is", without warranty of any kind, express or
implied, including, without limitation, the warranties of merchantability,
fitness for a particular purpose, title, and non-infringement. In no event
shall the Copyright owners, or anyone distributing the software, be liable for
any damages or other liability, whether in contract, tort or otherwise, arising
from, out of, or in connection with the software, or the use or other dealings
in the software, even if advised of the possibility of such damage.

Permission is hereby granted to use, copy, modify, and distribute this
software, or portions hereof, for any purpose, without fee, subject to the
restrictions in `modules/juce_graphics/image_formats/pnglib/LICENSE` at the
pinned JUCE commit.

### libjpeg (IJG, compatibility version 9.0) — Independent JPEG Group licence
Vendored at `modules/juce_graphics/image_formats/jpglib`.

This software is based in part on the work of the Independent JPEG Group.

(That sentence is the acknowledgement the IJG licence requires to appear "in
all documentation" when the software is used; it is reproduced here for that
purpose, not as a description of Leylines.)

### zlib 1.3.1 — zlib licence
Copyright (C) 1995-2024 Jean-loup Gailly and Mark Adler.
Vendored at `modules/juce_core/zip/zlib`.

This software is provided 'as-is', without any express or implied warranty. In
no event will the authors be held liable for any damages arising from the use
of this software. Permission is granted to anyone to use this software for any
purpose, including commercial applications, and to alter it and redistribute it
freely, subject to the following restrictions:

1. The origin of this software must not be misrepresented; you must not claim
   that you wrote the original software.
2. Altered source versions must be plainly marked as such, and must not be
   misrepresented as being the original software.
3. This notice may not be removed or altered from any source distribution.

### Bundled by JUCE but NOT compiled into this product
Recorded so the omission reads as a decision rather than a gap:
**libmp3lame / JUCE's MP3 decoder** (`JUCE_USE_MP3AUDIOFORMAT` and
`JUCE_USE_LAME_AUDIO_FORMAT` both default to 0 and this build does not override
them, so neither is compiled and the MP3 patent/licence disclaimer in
`juce_audio_formats.h` does not apply to us), and **Box2D, juce_video and
juce_javascript**, whose modules are not linked at all.

## Steinberg VST3 SDK 3.8.0 (MIT License)
Copyright (c) 2025, Steinberg Media Technologies GmbH

Bundled inside JUCE and compiled into the VST3 artifact. Reproduced from
`modules/juce_audio_processors_headless/format_types/VST3_SDK/LICENSE.txt` at
the pinned JUCE commit.

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.

VST is a registered trademark of Steinberg Media Technologies GmbH.

## libopus 1.5.2 — BSD 3-Clause License
Copyright (c) 2001-2023, Xiph.Org Foundation and contributors.

Redistribution and use in source and binary forms, with or without modification,
are permitted provided that the following conditions are met:

- Redistributions of source code must retain the above copyright notice, this
  list of conditions and the following disclaimer.
- Redistributions in binary form must reproduce the above copyright notice,
  this list of conditions and the following disclaimer in the documentation
  and/or other materials provided with the distribution.
- Neither the name of Internet Society, IETF or IETF Trust, nor the names of
  specific contributors, may be used to endorse or promote products derived
  from this software without specific prior written permission.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

### Opus patent grant (royalty-free)

The Opus codec is additionally covered by royalty-free patent licenses from its
contributors. Xiph.Org Foundation and Broadcom Corporation have each granted,
via their IPR statements for the Opus reference implementation (see
https://opus-codec.org/license/ and the IETF IPR disclosures for RFC 6716), a
perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable
(except as stated in those statements) patent license to make, have made, use,
offer to sell, sell, import, transfer, and otherwise run, modify and propagate
the contents of the Opus reference implementation, applying to those patent
claims licensable by each grantor that are necessarily infringed by the
reference implementation. The grants terminate for any party that institutes
patent litigation alleging that the Opus reference implementation or a
derivative constitutes direct or contributory patent infringement.

## libdatachannel 0.24.5 — Mozilla Public License 2.0
Copyright © Paul-Louis Ageneau and contributors.

This Source Code Form is subject to the terms of the Mozilla Public License,
v. 2.0. If a copy of the MPL was not distributed with this file, you can obtain
one at https://mozilla.org/MPL/2.0/.

Leylines uses libdatachannel as a statically-linked library, built from the
exact commit `443f6934d9007eb7076ab7825ba330f355fcbead` (tag `v0.24.5`) of
https://github.com/paullouisageneau/libdatachannel, which is the Source Code
Form of the Covered Software as distributed in this product and is available at
that URL. Leylines makes no modifications to it; should a future release do so,
those modifications will be published at the same URL or supplied on request to
support@cybermoonaudio.com. (Corrected 2026-09-01, QA-0901 TT-9: the previous
wording offered "modified versions ... on request", which is less than MPL 2.0
s3.2 asks - the licence requires the Source Code Form AS DISTRIBUTED to be
available and recipients told how to get it, and it named no commit for a
reader to fetch the exact version.)

## Mbed TLS 3.6.7 — Apache License 2.0
Copyright © The Mbed TLS Contributors.

Licensed under the Apache License, Version 2.0 (the "License"); you may not use
this file except in compliance with the License. You may obtain a copy of the
License at https://www.apache.org/licenses/LICENSE-2.0.

Unless required by applicable law or agreed to in writing, software distributed
under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
CONDITIONS OF ANY KIND, either express or implied. See the License for the
specific language governing permissions and limitations under the License.

NOTICE: This product includes software developed by The Mbed TLS Contributors.

## clap-juce-extensions — MIT License
Copyright 2019-2020, Paul Walker

Consumed via CMake FetchContent, pinned to commit
`51a9359315298de632cf44e9d7524940868441e6` (main @ 2026-06-01) of
https://github.com/free-audio/clap-juce-extensions; wraps the JUCE processor
to produce the CLAP plugin builds. License text (LICENSE.md at the pinned
commit):

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.

## Inter font — SIL Open Font License 1.1
Copyright © 2016-2024 The Inter Project Authors (https://github.com/rsms/inter).
Full license at `Resources/fonts/Inter-LICENSE.txt`. Embedded (Regular +
SemiBold static instances, v4.1) as the plugin body face.

This Font Software is licensed under the SIL Open Font License, Version 1.1.
This license is copied at https://scripts.sil.org/OFL.

## DM Mono font — SIL Open Font License 1.1
Copyright 2020 The DM Mono Project Authors
(https://github.com/googlefonts/dm-mono). Full license at
`Resources/fonts/DMMono-LICENSE.txt`. Embedded (Regular + Medium) as the
plugin identity/monospace face.

This Font Software is licensed under the SIL Open Font License, Version 1.1.
This license is copied at https://scripts.sil.org/OFL.

## usrsctp, libjuice — bundled transitively by libdatachannel
- **usrsctp** — BSD-style license (https://github.com/sctplab/usrsctp)
- **libjuice** — Mozilla Public License 2.0 (https://github.com/paullouisageneau/libjuice)

These dependencies are pulled in as transitive components of libdatachannel and
share the relevant license obligations above. For libjuice, as for
libdatachannel, the Source Code Form as distributed is the commit
libdatachannel's own pin (above) resolves to, available at the URL given.

**libsrtp is NOT shipped** and was removed from this list on 2026-09-01
(QA-0901 TT-9). `CMakeLists.txt` configures libdatachannel with `NO_MEDIA ON`,
so libSRTP is never built; confirmed against the release build tree, which
contains `datachannel.lib`, `juice.lib`, `usrsctp.lib` and the Mbed TLS
libraries but no `srtp2.lib`. Attributing a component that is not in the binary
is harmless in itself, but it is the kind of drift that makes a reader distrust
the rest of this file.

## Monocypher 4.0.3 - CC0 1.0 Universal (dual-licensed BSD-2-Clause OR CC0-1.0)
Copyright (c) 2017-2023, Loup Vaillant, Michael Savage, Fabio Scotoni
(BSD arm; not exercised)

Ed25519 signature verification for the offline licence and activation-token
checks. Unlike every other dependency here, Monocypher is **vendored**, not
consumed via CMake FetchContent: upstream ships a Makefile and a meson build
rather than CMake, so FetchContent would have meant writing our own
`add_library` over it anyway. Four files are copied verbatim into
`Source/engine/thirdparty/monocypher/`:

    monocypher.c              sha256 f1f838cdd483bdebe0df0ff5c5ed60535e496f769c6a2f933ac4c0b114207123
    monocypher.h              sha256 fcaf6ed771358bb4f40fba016f6518ae86ec02b1b877d2cc35ad92d3a26fd7b3
    monocypher-ed25519.c      sha256 ce0d2f8e32ca8f66398ba5b3456cc74327c3eff14e7b950ce7d57be9025cc453
    monocypher-ed25519.h      sha256 3a3035181f991a158d0e1c7567258f0bae8ba0f1f23c5512b4a1db1b3c9730ce

Source: https://github.com/LoupVaillant/Monocypher, release tag `4.0.3`
(2026-06-15). Release tarball sha256
`a7cbae546fbdc489bca632c3747e1ceb8ca3d4bd39e2706a0916f28ccd280e50`. The upstream
`LICENCE.md`, carrying both licence texts in full, is copied alongside the
sources.

**Arm exercised: CC0-1.0.** Every vendored `.c` and `.h` carries the SPDX line
`SPDX-License-Identifier: BSD-2-Clause OR CC0-1.0` in its own header, so the
grant is readable in the bytes that ship rather than only on a web page. Under
the CC0 arm there is **no attribution obligation**; this entry exists because
this file is a provenance record, not a legal minimum, and a reader must not
have to guess which arm was taken.

Only the verification half reaches a shipped binary. `crypto_ed25519_sign` and
`crypto_ed25519_key_pair` live in the same translation unit and are referenced
only by the test target, so `/OPT:REF` drops them from the plugin.
