octoturgeandClaude Opus 5
ec69ebb0c0
Continuum is intended to be sold, so every dependency has to permit distribution in closed-source commercial software. Nothing recorded that before: our own crates and npm packages carried no licence field at all, which made `cargo deny` report them as `unlicensed` errors and left the actual policy nowhere. docs/LICENSES.md is the policy and lives here because it is the repo both other tiers already depend on. It covers the allow/deny list, the 2026-09-17 audit of all six repos (no copyleft reaches any binary), and the three categories `cargo deny` structurally cannot see: external binaries we spawn or ship, ML model weights, and self-hosted server software whose licence is not its client library's. Two findings in there are worth more than the tooling: Redis 7.4+ is RSALv2/SSPL and 8.0+ adds AGPLv3, and Ultralytics YOLO and Obico's print-failure model are both AGPL-3.0 - the obvious choice in each case is the one we cannot ship. Crates declare `LicenseRef-Proprietary` with `publish = false`; that string is deliberately not valid SPDX so it must never enter an allow list. npm packages use `"license": "UNLICENSED"`. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
17 lines
499 B
TOML
17 lines
499 B
TOML
[package]
|
|
name = "continuum-schema-instance"
|
|
version = "0.1.0"
|
|
edition = "2021"
|
|
description = "Builds a JSON instance from a JSON Schema - fills const/enum/default, only builds required properties, everything else is left out"
|
|
# Proprietary: deliberately not an SPDX id, so cargo-deny treats it as
|
|
# first-party. See docs/LICENSES.md in continuum-common.
|
|
license = "LicenseRef-Proprietary"
|
|
publish = false
|
|
|
|
[dependencies]
|
|
serde_json = "1"
|
|
thiserror = "1.0"
|
|
|
|
[dev-dependencies]
|
|
jsonschema = "0.53.0"
|