# Licence policy for a closed-source commercial product.
# See docs/LICENSES.md in continuum-common for the rationale and the
# non-cargo dependencies (external binaries, ML models) this file cannot see.
#
# Run: cargo deny check licenses

[licenses]
# Permissive only. Anything copyleft reaching a shipped binary would make
# the product undistributable without releasing our source.
allow = [
    "MIT",
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "Zlib",
    "Unicode-3.0",
    "Unlicense",
    "MPL-2.0",
    "CC0-1.0",
    "BlueOak-1.0.0",
]
confidence-threshold = 0.9

# Our own crates declare `LicenseRef-Proprietary`, which is deliberately not
# an SPDX identifier and must never appear in the allow list above - a
# third-party crate claiming it would be a real finding. They are recognised
# as first-party by `publish = false` in their manifests.
private = { ignore = true }

[bans]
deny = []

[advisories]
yanked = "deny"

# NOT VISIBLE TO THIS FILE: the ONNX model weights loaded at runtime carry
# their own licence, independent of the `ort` crate (MIT). Ultralytics YOLO
# and Obico's print-failure models are AGPL-3.0 and cannot ship in a
# commercial product. See docs/LICENSES.md.