flatrender/services/remotion/docs/AUDIO_LIBRARY.md

# FlatRender — Curated AUDIO Library Catalog

> Synthesized from the `flatrender-audio-sweep` source set (33 source-rows surveyed →
> adversarial license + Iran-access verification per source). Mirrors the firewall
> discipline of `services/remotion/docs/ASSET_LIBRARY.md`. **Read §7 (Reality Check)
> before treating any source as "done".** Today only **4 self-authored CC0 stubs** are
> vendored (`public/audio/`); everything below is an **acquisition plan**, not a shipped
> library.

**Product context:** Persian-first paid template SaaS. Audio is **vendored into the repo**
(`services/remotion/public/audio/`) AND **rendered into customer-downloadable MP4s**
(`FlexStory.tsx` already muxes `audio/music-ambient.mp3` + `sfx-whoosh/chime` via
`staticFile()`). This dual requirement — *vendor the raw file* AND *bake it into a paid
customer output* — is the load-bearing test every source below is graded against.

---

## 0. THE LOAD-BEARING QUESTION: "Can a paid SaaS render + vendor this?"

FlatRender does two things that most "free music/SFX" licenses quietly forbid:

1. **Vendors the raw file** — commits the `.mp3`/`.wav` into the repo and serves it at render time.
2. **Bakes it into a paid customer MP4** that the customer downloads.

Only **three license classes** clear BOTH halves cleanly:

| Class | Render-into-MP4 | Vendor raw file | Attribution | Notes |
|---|---|---|---|---|
| **CC0 / Public Domain** | ✅ | ✅ | none | The only friction-free tier. Vendor + render + resell, zero conditions. |
| **CC-BY** | ✅ | ✅ | **REQUIRED, travels with file** | Legal but the credit must be auto-injected into every render + a notices file. Operational burden. |
| **MIT** (rare for audio) | ✅ | ✅ | notice file | n/a here — no audio source is MIT. |

Everything else fails on at least one of these recurring traps:

- **"No standalone-file redistribution"** (Pixabay, Mixkit, 99Sounds, Sonniss, Zapsplat, Bensound, Tunetank, Storyblocks, Patrick de Arteaga, Envato) → you may render-into-MP4 but **may NOT vendor the raw file**. Fatal under FlatRender's vendor-the-file architecture.
- **"No competing/stock-basis product"** (Mixkit, Uppbeat, Envato, Storyblocks) → a paid template SaaS *is* the competing product. Hard NO.
- **NonCommercial (-NC)** (BBC RemArc, Jamendo-via-Openverse, FMA -NC slice) → paid SaaS is commercial. Hard NO.
- **ShareAlike (-SA) / NoDerivatives (-ND)** (FMA slices) → SA forces your paid MP4 to be released CC-BY-SA (fatal); ND treats sync-to-video as a prohibited derivative (fatal).
- **Aggregator disclaimer** (FMA, Openverse, Chosic, ccMixter "Free for Commercial") → the platform licenses nothing; the per-track upstream license governs and must be verified per file.
- **Iran payment wall** (Uppbeat, Bensound, Tunetank, Envato, Storyblocks, Patrick de Arteaga paid tier, incompetech/CreatorChords no-attribution upgrade) → the *only compliant tier* requires a foreign card/contract Iran cannot execute.

**Net:** the vendorable library must be built on the **CC0 tier first** (FreePD via archive.org, Freesound-CC0, Kenney, OpenGameArt-CC0), with **CC-BY as a credit-pipeline tier** (incompetech, ccMixter-CC0/BY, FMA-CC0/BY, Chosic-CC0). Persian/traditional is the hardest gap and has **no clean CC0 bulk source** — see §3.

---

## 1. MUSIC — per-source verdicts

### 1.1 FreePD.com (Kevin MacLeod CC0 catalog) — ⭐ PRIMARY MUSIC SOURCE
- **License:** CC0 1.0 — full public-domain dedication, verified against CC legal code. Zero conditions: vendor + render + resell, no attribution. **The cleanest tier for FlatRender's exact use case.**
- **Iran-access:** **freepd.com is DEAD (closed 2025).** Catalog survives as a complete CC0 mirror at **`archive.org/details/freepd`** (1,025+ MP3, torrent + M3U). archive.org is intermittently reachable from Iran (VPN/Psiphon) — **mirror NOW, don't depend on live access.**
- **Vibe:** uplifting/corporate, calm/ambient, cinematic, playful. **WEAK on Persian/traditional.**
- **Verdict:** **USE** (CC0 clean). Rated "caution" in source only because the official host is dead and acquisition runs through a third-party archive.org mirror — license is spotless. **Vendor the FreePD/CC0 version, never the Incompetech/CC-BY twin of the same track.**

### 1.2 Freesound.org (CC0 filter) — ⭐ PRIMARY SFX + music-loop source
- **License:** per-sound; **CC0 subset only.** CC0 = "you could even sell the sound," no attribution, standalone redistribution OK. CC-BY usable with attribution. **Hard-exclude CC-BY-NC + Sampling+.**
- **Acquisition catch:** the **Freesound API is NON-COMMERCIAL** unless you sign a UPF agreement → acquire **manually** (individual downloads), governed only by the CC license, not the API TOS. Never scrape.
- **Iran-access:** UPF/Barcelona (EU, not OFAC). Cloudflare-fronted + login-to-download → acquire once via non-Iran box/VPN, then vendor (CC grant is perpetual).
- **Vibe:** best-in-class SFX (UI/whoosh/transition/ambience/foley); some thin Persian instrument samples (santoor/tar/daf).
- **Verdict:** **USE** (CC0-filtered, manual download). Mandatory: re-verify license per file at download, log CC0 proof in ledger, loudness-normalize (no upstream QC).

### 1.3 incompetech (Kevin MacLeod) — CC-BY, attribution pipeline
- **License:** CC-BY 4.0 (free tier). Commercial + redistribution OK, **but attribution travels with every file** — exact credit string must appear in each render's credits + a notices file. Paid Standard License removes attribution but needs a **foreign card (Iran-blocked)**.
- **Iran-access:** GOOD (static Cloudflare site, no login; archive.org mirror as fallback). The no-attribution *upgrade* is payment-blocked.
- **Vibe:** EXCELLENT breadth (~2,000 tracks: uplifting/corporate/ambient/cinematic/playful). No Persian.
- **Verdict:** **CAUTION / USE-with-pipeline.** **Cleaner path: pull the SAME MacLeod tracks from FreePD where they are CC0 (no attribution).** Reserve incompetech CC-BY only for tracks not on FreePD, gated behind an attribution-injection pipeline.

### 1.4 ccMixter (dig.ccMixter "Free for Commercial") — per-track CC, supplement
- **License:** per-track. **CC0 subset = vendor freely.** CC-BY = vendor + mandatory in-output attribution (title + artist + ccMixter URL + CC-BY link). **HARD-AVOID:** CC-BY-NC, ccPlus (paid), Sampling/Sampling-plus. Remix community → tracks may sample other-licensed material.
- **Iran-access:** OK via VPN; documented IP-based download rate-limiting → throttle, no bulk scrape.
- **Vibe:** electronic/ambient/cinematic, community quality varies. No reliable Persian.
- **Verdict:** **CAUTION.** Use CC0 subset for vendoring; CC-BY only with attribution pipeline. Supplement, not primary.

### 1.5 Free Music Archive (FMA) — aggregator, per-track minefield
- **License:** aggregator, licenses nothing. **Safe set = CC0 + CC-BY ONLY.** **Reject ALL -NC, -SA, -ND** (verified stricter: FMA treats sync-to-video as a derivative → ND prohibited; SA would force your paid MP4 under CC-BY-SA). Terms 6(e) bans scraping → manual per-track download.
- **Iran-access:** OK (Tribe of Noise BV, Netherlands — not US). VPN fallback.
- **Vibe:** all vibes; has a **"World" section with some Persian-adjacent material** (best of the aggregators for Persian discovery, but per-track license verification mandatory).
- **Verdict:** **CAUTION.** Discovery layer → filter to CC0/CC-BY → re-verify each track's license page → vendor.

### 1.6 Openverse — aggregator, CC0 discovery funnel only
- **License:** aggregates Jamendo/Freesound/Wikimedia; licenses nothing, disclaims verification. **CRITICAL TRAP: Jamendo free tracks are CC-BY-NC (non-commercial) → forbidden.** Only the CC0 slice (Freesound/Wikimedia) is usable, confirmed on the source page.
- **Iran-access:** portal reachable; download happens on source (Wikimedia best, Freesound login-gated, **exclude Jamendo entirely**).
- **Verdict:** **CAUTION** — CC0 discovery funnel into Freesound/Wikimedia. Never trust the Openverse tag.

### 1.7 Chosic — aggregator, CC0 "no-attribution" funnel
- **License:** not a rights holder; has restrictive in-house terms. The `?attribution=no` filter is a **discovery hint, NOT a CC0 guarantee** (mixes CC-BY where artists sell paid no-attribution licenses). Trace each track to its origin, confirm genuine CC0 there.
- **Iran-access:** GOOD (no login, direct MP3, no hard geoblock).
- **Vibe:** cinematic/ambient/uplifting/playful; thin Persian.
- **Verdict:** **CAUTION** — CC0 discovery funnel; per-track human sign-off; provenance = named upstream artist + verified CC0, never "Chosic".

### 1.8 CreatorChords (Alexander Nakarada / ex-Serpent Sound) — best CINEMATIC/EPIC
- **License:** dual. Free = CC-BY 4.0 (attribution travels + Content-ID auto-claim risk). Clean path = **paid attribution-free Single License ($20/track)** — but **USD checkout is Iran-blocked.**
- **Iran-access:** free CC-BY downloads work; the paid clean tier is **payment-blocked from Iran.**
- **Vibe:** **best cinematic/epic/fantasy** on the list; folk/medieval/calm. No Persian.
- **Verdict:** **CAUTION.** Bake into render only (the "can't redistribute music alone" clause bars bare-file vendoring). Practically blocked from Iran for the clean tier.

### 1.9 Pixabay Music — ⚠️ vendoring TRAP (best Persian vibe, wrong architecture)
- **License:** Pixabay Content License (NOT CC0). **Render-into-MP4 = permitted** (adds value). **Vendoring the raw .mp3 = PROHIBITED** ("distribution of Content as music files on a standalone basis"). ToS also bans scraping/bulk. Third-party-sample caveat bites Persian/sampled tracks hardest.
- **Iran-access:** Cloudflare-blocked from Iran (ECONNREFUSED confirmed); acquire once via non-Iran box/VPN — license is perpetual.
- **Vibe:** **best practical Persian/Middle-Eastern coverage of the free sources** (`pixabay.com/music/search/persian` → santoor/oud), plus broad corporate/ambient/cinematic/playful.
- **Verdict:** **CAUTION / AVOID for vendoring.** Usable **ONLY if architecture changes** to mux-into-MP4 with **no standalone raw-file exposed/served**. Under FlatRender's vendor-the-file requirement it effectively disqualifies — but it is the **least-bad Persian source** if you adopt the bake-only, never-serve-raw discipline (screen each Persian track for sampled-recording rights, prefer original compositions).

### 1.10 Mixkit (Envato) — ❌ AVOID
- **License:** proprietary. Bans raw-file redistribution, stock/inventory basis, AND competing products. A paid template SaaS is exactly the prohibited case. Music also barred from CDs/DVDs/games/TV.
- **Iran-access:** Envato enforces US sanctions, locks Iranian accounts. POOR.
- **Verdict:** **AVOID** — textbook "free but forbids redistribution/competition" trap.

### 1.11 Uppbeat — ❌ AVOID
- **License:** single-use, no redistribution/resell/"make available as part of a competing platform." SaaS routed to a negotiated Music Vine custom license.
- **Iran-access:** GBP/USD billing, Iranian cards declined. POOR.
- **Verdict:** **AVOID** — license is the opposite of what FlatRender needs + Iran-payment-blocked.

### 1.12 Bensound — ❌ AVOID
- **License:** all standard tiers forbid standalone distribution + stock-library inclusion. SaaS requires a mandatory **Enterprise license** (explicitly "SaaS/platform integrations").
- **Iran-access:** Enterprise = signed EUR/USD contract with a Belgian company → **hard blocker from Iran.**
- **Verdict:** **AVOID** — cleanest written SaaS guidance, but mandatory paid tier is unobtainable from Iran.

### 1.13 Tunetank — ❌ AVOID
- **License:** ToS 8.2 bars download/distribution/sublicense/derivatives except in-conjunction-with-Tunetank. Resale explicitly banned. No SaaS path.
- **Iran-access:** USD/PayPal only → blocked.
- **Verdict:** **AVOID.**

### 1.14 Patrick de Arteaga — reference-only
- **License:** raw-file redistribution **forbidden at ALL tiers** (incl. paid). Free tier requires attribution.
- **Iran-access:** free CC works via VPN; paid tiers payment-blocked (and still forbid vendoring).
- **Verdict:** **REFERENCE-ONLY** — game-leaning cinematic/fantasy/chiptune; fails the vendor-into-repo requirement.

### 1.15 Internet Archive (durable host + Persian classical) — per-item, mostly TRAP
- **License:** per-item, uploader-set; platform disclaims all rights. **Safe slice = items explicitly CC0/PD** (e.g. `archive.org/details/freepd` rehost, pre-1929 PD orchestral). **The "Iranian/Persian classical" uploads are user-uploaded COMMERCIAL recordings with NO valid PD/CC0 basis** (e.g. 1974 Nonesuch "A Persian Heritage", Smithsonian Folkways Dastgah LP — both still actively sold) → downloadable but **illegal to vendor.**
- **Iran-access:** FAVORABLE for acquisition (not Cloudflare-gated like Pixabay); but "PD-in-Iran" gives zero legal cover (Iran not in Berne/Rome → collapses the moment a customer downloads the MP4 in a Berne country).
- **Verdict:** **USE as durable host for already-cleared CC0 (FreePD mirror) + pre-1929 PD.** **REFERENCE-ONLY** for Persian classical — **the biggest Persian-license trap in the whole set.** Never equate downloadable with vendorable.

### 1.16 Envato Elements / AudioJungle — ❌ AVOID (double-blocked)
- **License:** 3-way prohibition (single-use, on-demand/build-it-yourself ban, redistribution/extraction ban). Best commercial Persian/santoor coverage, all unusable.
- **Iran-access:** **hard geo/OFAC block + foreign-card-only.**
- **Verdict:** **AVOID** — listed to rule out.

### 1.17 Storyblocks / Taketones / StockTune — ❌ AVOID
- **License:** Storyblocks = explicit standalone-audio + competing-library ban (subscription-gated). Taketones = resale ban. StockTune = AI-generated, unverifiable provenance, 403 ToS. None grant vendor-raw-file.
- **Iran-access:** paid tiers foreign-card-blocked; free tiers' licenses already forbid the use case.
- **Verdict:** **AVOID for vendoring.** Reference-only for Persian vibe-sourcing → commission original audio instead.

---

## 2. SFX — per-source verdicts

### 2.1 Kenney.nl (Audio packs) — ⭐ PRIMARY UI/SFX SOURCE
- **License:** CC0 1.0, confirmed on asset pages. No restrictions, no attribution, vendor raw OK.
- **Iran-access:** **CLEAN via kenney.nl** (Dutch host, not US/OFAC; no login). **NOT the GitHub/itch mirrors** (US, Iran-suspendable).
- **Vibe:** UI/click/pop/chime/toggle/select, playful/digital. Weak on cinematic whoosh; zero Persian.
- **Verdict:** **USE** — the spine of FlatRender's UI SFX kit. Lowest-risk source on the entire list.

### 2.2 Freesound.org (CC0) — see §1.2 (top SFX well by volume)
- **Verdict:** **USE** (CC0-filtered, manual download).

### 2.3 OpenGameArt.org (CC0 packs) — bulk CC0 supplement
- **License:** per-submission; **CC0-filtered packs only** ("100 CC0 SFX" #1/#2, "80 CC0 RPG SFX", etc.). **Reject CC-BY-SA/GPL/CC-BY/OGA-BY.** OGA disclaims credit-file accuracy → verify each file + provenance.
- **Iran-access:** no barrier (community static host, no payment).
- **Vibe:** game/UI clicks, impacts, RPG/fantasy, metal/wood foley, loops. No cinematic-premium, no Persian.
- **Verdict:** **USE** (CC0-filtered, per-file verified) — bulk supplement to Kenney.

### 2.4 Sonniss GameAudioGDC — caution (server-side render input only)
- **License:** permits "embedded into licensee project" (bake into MP4 = OK). **Bars standalone-file redistribution + competing libraries + AI/ML training.** Defensible ONLY if raw .wav never leaves the server as a downloadable asset.
- **Iran-access:** UK-based, free torrent; multi-GB size is the only friction.
- **Vibe:** premium cinematic/foley/impact/whoosh/ambience. Zero Persian.
- **Verdict:** **CAUTION** — **private object storage (MinIO) render-input ONLY**, never committed to a public repo, never served as raw, never fed to AI training.

### 2.5 99Sounds — caution (render input only)
- **License:** commercial use OK; **bars redistributing files "on their own / as a separate attachment."** Render-into-MP4 = OK; commit-raw-into-repo = violation.
- **Iran-access:** Gumroad $0 checkout, VPN. Achievable.
- **Vibe:** **strongest free source for premium cinematic TRANSITION/whoosh/riser/boom.** No UI-micro, no Persian.
- **Verdict:** **CAUTION** — render-time input only; enforce render-yes / commit-no boundary.

### 2.6 Pixabay (SFX) — ⚠️ vendoring trap (same as §1.9)
- **Verdict:** **AVOID for vendoring** ("no standalone redistribution"); render-input only if you never persist/serve the raw file.

### 2.7 Mixkit (SFX) — ❌ AVOID (same clauses as §1.10)
- **Verdict:** **AVOID** + Envato Iran-sanctions exposure.

### 2.8 Zapsplat — ❌ AVOID (most explicit prohibition)
- **License:** Standard tier names "sound effects app" + "apps" as **forbidden redistribution targets**; bans sharing/transfer/sub-license to any third party on free AND Gold. Free tier requires visible "ZapSplat" credit.
- **Iran-access:** UK, not OFAC-blocked, but the license is the dealbreaker.
- **Verdict:** **AVOID** — direct collision with FlatRender's model.

### 2.9 BBC Sound Effects (RemArc) — ❌ AVOID (non-commercial)
- **License:** RemArc = **non-commercial/personal/education only.** Commercial = paid Pro Sound Effects (US, Iran-closed).
- **Verdict:** **AVOID** — known "free BBC sounds" trap.

---

## 3. PERSIAN / TRADITIONAL — the honest gap

There is **no clean CC0 bulk source** for authentic Persian/Middle-Eastern music. The realistic options, worst-to-best for a vendor-the-file SaaS:

- **Internet Archive Persian classical** (Payvar santur, Dastgah LPs) — perfect vibe, **almost always wrong license** (commercial recordings, no PD/CC0 basis, still sold by Warner/Smithsonian). **REFERENCE-ONLY. The biggest Persian-license trap.**
- **Envato / Storyblocks / Taketones** ("Ambient Persian Santoor" etc.) — best commercial coverage, but license forbids the SaaS pattern AND Iran-payment-blocked. **AVOID.**
- **Pixabay Persian subset** — least-bad real option, but **only under bake-into-MP4, never-serve-raw** discipline + per-track sampled-rights screening. Not a clean vendor-the-file source.
- **Freesound-CC0 Persian instrument samples** (santoor/tar/daf) — thin but **genuinely CC0 and vendorable.** Best clean building block; needs manual curation.
- **✅ The only truly firewall-clean path: COMMISSION original santoor/tar/setar recordings (or self-author/synthesize) and self-dedicate CC0.** This mirrors how the illustration library self-authors Persian/seasonal motifs (`Nowruz3D.tsx`). For a Persian-first paid product this is the recommended long-term answer.

---

## 4. License firewall — `assets.json` ledger rules (mirrors the illustration firewall)

The CI guard (`services/remotion/scripts/check-assets.mjs`) **already scans `public/audio/`**
against `public/illustrations/assets.json`. **Every vendored audio file gets one ledger row.
No row → build fails (exit 1).** Reference-only sources are **never vendored** (no file → no row).

Ledger key convention (verified): audio rows carry the `audio/` prefix
(e.g. `"audio/freepd-epic-01.mp3"`).

```jsonc
{
  "audio/freepd-cinematic-01.mp3": {
    "source": "FreePD (Kevin MacLeod) via archive.org/details/freepd",
    "license": "CC0-1.0", "license_class": "CC0",
    "commercial_ok": true, "attribution_required": false, "ai_training_allowed": true,
    "vibe": "cinematic", "url": "https://archive.org/details/freepd",
    "provenance": "CC0; FreePD twin (NOT Incompetech/CC-BY)", "vendored": "2026-06-23"
  },
  "audio/freesound-whoosh-01.wav": {
    "source": "Freesound.org (CC0 filter, manual download)",
    "license": "CC0-1.0", "license_class": "CC0",
    "commercial_ok": true, "attribution_required": false, "ai_training_allowed": true,
    "vibe": "sfx/transition", "url": "https://freesound.org/s/<id>/",
    "provenance": "license re-verified at download; NOT via commercial API", "vendored": "2026-06-23"
  },
  "audio/kenney-ui-click-01.wav": {
    "source": "Kenney.nl Interface Sounds",
    "license": "CC0-1.0", "license_class": "CC0",
    "commercial_ok": true, "attribution_required": false, "ai_training_allowed": true,
    "vibe": "sfx/ui", "url": "https://kenney.nl/assets/interface-sounds", "vendored": "2026-06-23"
  },
  "audio/incompetech-corporate-01.mp3": {
    "source": "incompetech (Kevin MacLeod)",
    "license": "CC-BY-4.0", "license_class": "CC-BY",
    "commercial_ok": true, "attribution_required": true, "ai_training_allowed": true,
    "attribution": "Title — Kevin MacLeod (incompetech.com) — Licensed under Creative Commons: By Attribution 4.0",
    "vibe": "uplifting/corporate", "notice_file": "audio/CREDITS.md", "vendored": "2026-06-23"
  }
}
```

**Hard rules (audio):**
1. **Only CC0/PD vendored as raw `public/audio/` files** (FreePD, Freesound-CC0, Kenney, OpenGameArt-CC0). These get `attribution_required:false`.
2. **CC-BY vendored ONLY with an attribution pipeline** — `attribution_required:true` + an exact `attribution` string + a `notice_file` (`audio/CREDITS.md`) that the render bakes into the output. No pipeline → don't vendor (prefer the FreePD/CC0 twin).
3. **"Render-input-only" sources (Sonniss, 99Sounds, Pixabay-mux-only) are NEVER committed to the public repo** — store in **private MinIO**, mux into MP4 server-side, never serve/persist a standalone raw file. They get **no `public/audio/` row** (the ledger is for vendored files only).
4. **`ai_training_allowed:false`** on anything that touches FlatRender's future AI-video pipeline unless the license explicitly permits ML training (Sonniss explicitly forbids it).
5. **Never-vendored reference-only** (Mixkit, Uppbeat, Bensound, Tunetank, Zapsplat, BBC RemArc, Envato, Storyblocks, Patrick de Arteaga, IA-Persian-classical): no file, no row, design-time reference only.
6. **Persian tracks** carry an extra `provenance` note: `"vetted original-composition"` or `"CC0 instrument sample"` — never vendor sampled-commercial-recording-based tracks.

---

## 5. Vendoring manifest — concrete starter set

All under `services/remotion/public/audio/`. For Cloudflare/archive.org/Gumroad-gated
sources, acquire via a **non-Iran box / VPN once**, then commit — render-time is CDN-free.

```bash
# 0. Folder already exists (4 self-authored CC0 stubs vendored). Keep them.
#    public/audio/{music-ambient,sfx-whoosh,sfx-pop,sfx-chime}.mp3  ✅ already ledgered

# 1. MUSIC — FreePD CC0 (⭐ primary). freepd.com is DEAD → pull the archive.org mirror.
#    [NON-IRAN FETCH] VPN/Psiphon; mirror the whole collection, it is PD forever.
#    archive.org/details/freepd  → pick ~8–10 beds across vibes:
#      uplifting/corporate ×3, calm/ambient ×3, cinematic ×2, playful ×2
#    → public/audio/freepd-<vibe>-NN.mp3   (license_class:"CC0", attribution:false)

# 2. SFX — Kenney.nl CC0 (⭐ primary, CLEAN from Iran via kenney.nl, NOT GitHub mirror)
#    Interface Sounds + UI Audio packs → pick click/pop/chime/toggle/select/whoosh
#    → public/audio/kenney-ui-<name>.wav   (CC0, no firewall concern)

# 3. SFX — Freesound CC0 (manual download, NOT the commercial API)
#    [NON-IRAN FETCH] login required → VPN once. Filter license:"Creative Commons 0"
#    re-verify per file → cinematic whoosh/riser + ambience beds Kenney lacks
#    → public/audio/freesound-<name>.wav   (CC0; log source URL + CC0 proof)

# 4. SFX — OpenGameArt CC0 packs (bulk supplement, per-file verified)
#    "100 CC0 SFX" #1/#2 → extra UI/impact loops; reject any CC-BY-SA/GPL/CC-BY
#    → public/audio/oga-<name>.ogg

# 5. (OPTIONAL) MUSIC — incompetech CC-BY ONLY for vibes FreePD lacks, WITH pipeline
#    Build audio/CREDITS.md + render-time credit injection FIRST. Otherwise skip.

# 6. PERSIAN — no clean bulk source. Short term: curate Freesound-CC0 santoor/tar/daf
#    samples (vendorable). Long term: COMMISSION original Persian recordings → self-CC0.
#    Do NOT vendor Internet Archive Persian classical (commercial, illegal to vendor).

# 7. Verify firewall:
npm run check:assets   # fails if any public/audio/*.mp3|wav|ogg lacks a ledger row
```

**Then add one `assets.json` row per vendored file** (§4 templates). The CI guard already
covers `public/audio/`, so an un-ledgered drop fails the build automatically.

**Iran-mirror flags:** FreePD/archive.org = VPN/Psiphon (intermittent). Freesound =
Cloudflare + login → non-Iran box once. Kenney = clean from Iran (use kenney.nl, not GitHub).
Pixabay = Cloudflare-blocked → non-Iran box, and **mux-only never vendor.** Envato/Mixkit/
Uppbeat/Bensound/Tunetank/Storyblocks = OFAC payment-blocked, don't pursue.

---

## 6. Best vendorable source per vibe

| Vibe | Best CLEAN vendorable source | License | Note |
|---|---|---|---|
| **Uplifting / corporate** | FreePD (archive.org mirror) | CC0 | incompetech CC-BY backup (w/ pipeline) |
| **Calm / ambient** | FreePD + Freesound-CC0 ambience | CC0 | self-authored `music-ambient.mp3` already vendored |
| **Cinematic** | FreePD (cinematic/epic categories) | CC0 | CreatorChords better quality but Iran-payment-blocked |
| **Playful** | FreePD playful + OpenGameArt-CC0 | CC0 | Kenney for playful UI blips |
| **UI / transition SFX** | **Kenney.nl** ⭐ | CC0 | clean from Iran; Freesound-CC0 for whoosh/riser |
| **Persian / traditional** | **Freesound-CC0 instrument samples** (thin) → **commission + self-CC0** | CC0 | Pixabay Persian = bake-only, never-vendor; IA classical = trap |

---

## 7. ⚠️ Reality Check — honest status

- **Truly USE-tier + vendorable TODAY (CC0, clean):** **4 sources** —
  **FreePD** (via archive.org), **Freesound-CC0**, **Kenney.nl**, **OpenGameArt-CC0**.
  Plus the **4 self-authored CC0 stubs already in `public/audio/`** (these are the only
  audio files actually vendored right now).
- **CAUTION (usable with friction/pipeline/architecture-constraint):** **6** — incompetech
  (CC-BY pipeline), ccMixter (CC0/BY subset), FMA (CC0/BY, manual), Chosic & Openverse
  (CC0 funnels), Internet Archive (CC0/PD-host only). Plus **Sonniss / 99Sounds / Pixabay**
  as **render-input-only** (NOT vendorable — private MinIO, mux-only).
- **AVOID / reference-only:** **the rest** — Mixkit, Uppbeat, Bensound, Tunetank, Zapsplat,
  BBC RemArc, Envato, Storyblocks, Taketones, StockTune, Patrick de Arteaga, and the
  Internet Archive Persian-classical uploads (license trap).
- **Needs a NON-IRAN / VPN fetch:** FreePD (archive.org intermittent), Freesound (Cloudflare +
  login), Pixabay (Cloudflare ECONNREFUSED from Iran). **Kenney is the one clean-from-Iran
  source.** Acquisition-once-then-vendor makes the CC0/CC-BY grant perpetual and Iran-access
  irrelevant at render time.
- **Persian honest verdict:** **NO clean CC0 bulk source exists.** Best clean path =
  Freesound-CC0 instrument samples (thin) + **commission original recordings and self-dedicate
  CC0** (matches the project's self-authored Persian-illustration discipline). Everything with
  rich Persian vibe (Pixabay, Envato, Internet Archive) is either bake-only-never-vendor,
  Iran-payment-blocked, or an outright license trap.
- **Bottom line:** Build the vendorable audio library on **FreePD + Freesound-CC0 + Kenney +
  OpenGameArt-CC0**; add **incompetech CC-BY only behind an attribution pipeline**; keep
  **Sonniss/99Sounds/Pixabay as private render-inputs**; **self-commission Persian audio**;
  and treat **everything else as design-time reference only.** Today's true deliverable is not
  "a music library downloaded" — it's the §5 starter set (≈20 CC0 files) vendored + ledgered,
  growing on the proven firewall pipeline.