From 6d6ed628360a2f85fe9e70395223ca24ccd209d9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Iwo=20Strzebo=C5=84ski?= <iwo@octoturge.com>
Date: Sat, 3 Oct 2026 10:10:15 +0000
Subject: [PATCH] Declare proprietary licensing and enforce permissive-only
 dependencies

Continuum is intended to be sold, so every dependency has to permit
distribution in closed-source commercial software. Our own crate and npm
packages carried no licence field, which made `cargo deny` report the
Tauri crate as `unlicensed`.

The Nuxt/Tauri dependency graph audited clean (MIT/Apache/ISC/BSD, plus
BlueOak-1.0.0 - which is why this allow list carries BlueOak where
continuum-cad's did not). Two entries worth knowing, both recorded in
continuum-common's docs/LICENSES.md: `node-forge` is
`(BSD-3-Clause OR GPL-2.0)` and we elect BSD-3-Clause, and
`caniuse-lite` is CC-BY-4.0 build-time data that is not bundled into the
built SPA, so no attribution obligation today.
---
 apps/desktop/package.json         |  1 +
 apps/desktop/src-tauri/Cargo.toml |  4 ++++
 apps/web/package.json             |  1 +
 deny.toml                         | 36 +++++++++++++++++++++++++++++++
 package.json                      |  1 +
 packages/ui/package.json          |  1 +
 6 files changed, 44 insertions(+)
 create mode 100644 deny.toml

diff --git a/apps/desktop/package.json b/apps/desktop/package.json
index 4de357b..439e934 100644
--- a/apps/desktop/package.json
+++ b/apps/desktop/package.json
@@ -1,5 +1,6 @@
 {
   "name": "@continuum/desktop",
+  "license": "UNLICENSED",
   "private": true,
   "version": "0.1.0",
   "type": "module",
diff --git a/apps/desktop/src-tauri/Cargo.toml b/apps/desktop/src-tauri/Cargo.toml
index ba3a693..fcc77cc 100644
--- a/apps/desktop/src-tauri/Cargo.toml
+++ b/apps/desktop/src-tauri/Cargo.toml
@@ -4,6 +4,10 @@ version = "0.1.0"
 description = "Continuum operator console desktop shell"
 edition = "2021"
 rust-version = "1.77"
+# Proprietary: deliberately not an SPDX id, so cargo-deny treats it as
+# first-party. See docs/LICENSES.md in continuum-common.
+license = "LicenseRef-Proprietary"
+publish = false
 
 [build-dependencies]
 tauri-build = { version = "2.0", features = [] }
diff --git a/apps/web/package.json b/apps/web/package.json
index 45bf634..de2840f 100644
--- a/apps/web/package.json
+++ b/apps/web/package.json
@@ -1,5 +1,6 @@
 {
   "name": "@continuum/web",
+  "license": "UNLICENSED",
   "private": true,
   "version": "0.1.0",
   "type": "module",
diff --git a/deny.toml b/deny.toml
new file mode 100644
index 0000000..44db90c
--- /dev/null
+++ b/deny.toml
@@ -0,0 +1,36 @@
+# Licence policy for a closed-source commercial product.
+# See docs/LICENSES.md in continuum-common for the rationale and the
+# non-cargo dependencies (external binaries, ML models) this file cannot see.
+#
+# Run: cargo deny check licenses
+
+[licenses]
+# Permissive only. Anything copyleft reaching a shipped binary would make
+# the product undistributable without releasing our source.
+allow = [
+    "MIT",
+    "Apache-2.0",
+    "Apache-2.0 WITH LLVM-exception",
+    "BSD-2-Clause",
+    "BSD-3-Clause",
+    "ISC",
+    "Zlib",
+    "Unicode-3.0",
+    "Unlicense",
+    "MPL-2.0",
+    "CC0-1.0",
+    "BlueOak-1.0.0",
+]
+confidence-threshold = 0.9
+
+# Our own crates declare `LicenseRef-Proprietary`, which is deliberately not
+# an SPDX identifier and must never appear in the allow list above - a
+# third-party crate claiming it would be a real finding. They are recognised
+# as first-party by `publish = false` in their manifests.
+private = { ignore = true }
+
+[bans]
+deny = []
+
+[advisories]
+yanked = "deny"
diff --git a/package.json b/package.json
index 6f708bf..0ff72fb 100644
--- a/package.json
+++ b/package.json
@@ -1,5 +1,6 @@
 {
   "name": "continuum-app",
+  "license": "UNLICENSED",
   "private": true,
   "version": "0.1.0",
   "description": "Continuum print farm operator console - Nuxt SPA + Tauri 2 desktop shell",
diff --git a/packages/ui/package.json b/packages/ui/package.json
index 66d969f..ec8d110 100644
--- a/packages/ui/package.json
+++ b/packages/ui/package.json
@@ -1,5 +1,6 @@
 {
   "name": "@continuum/ui",
+  "license": "UNLICENSED",
   "private": true,
   "version": "0.1.0",
   "type": "module",