octoturge
d5375254d7
Continuum is intended to be sold, so every dependency has to permit distribution in closed-source commercial software. Nothing recorded that before: our own crates and npm packages carried no licence field at all, which made `cargo deny` report them as `unlicensed` errors and left the actual policy nowhere. docs/LICENSES.md is the policy and lives here because it is the repo both other tiers already depend on. It covers the allow/deny list, the 2026-09-17 audit of all six repos (no copyleft reaches any binary), and the three categories `cargo deny` structurally cannot see: external binaries we spawn or ship, ML model weights, and self-hosted server software whose licence is not its client library's. Two findings in there are worth more than the tooling: Redis 7.4+ is RSALv2/SSPL and 8.0+ adds AGPLv3, and Ultralytics YOLO and Obico's print-failure model are both AGPL-3.0 - the obvious choice in each case is the one we cannot ship. Crates declare `LicenseRef-Proprietary` with `publish = false`; that string is deliberately not valid SPDX so it must never enter an allow list. npm packages use `"license": "UNLICENSED"`.
33 lines
615 B
JSON
33 lines
615 B
JSON
{
|
|
"name": "@continuum/ts-core",
|
|
"license": "UNLICENSED",
|
|
"version": "0.1.0",
|
|
"private": true,
|
|
"type": "module",
|
|
"module": "src/index.ts",
|
|
"types": "src/index.ts",
|
|
"exports": {
|
|
".": "./src/index.ts"
|
|
},
|
|
"scripts": {
|
|
"build": "tsc -p tsconfig.json",
|
|
"typecheck": "tsc -p tsconfig.json --noEmit"
|
|
},
|
|
"dependencies": {
|
|
"jose": "^5.9.6"
|
|
},
|
|
"peerDependencies": {
|
|
"elysia": ">=1.1.0"
|
|
},
|
|
"peerDependenciesMeta": {
|
|
"elysia": {
|
|
"optional": true
|
|
}
|
|
},
|
|
"devDependencies": {
|
|
"bun-types": "^1.1.14",
|
|
"typescript": "^5.6.3",
|
|
"elysia": "^1.1.26"
|
|
}
|
|
}
|