Declare proprietary licensing and enforce permissive-only dependencies

Continuum is intended to be sold, so every dependency has to permit
distribution in closed-source commercial software. Nothing recorded that
before: our own crates and npm packages carried no licence field at all,
which made `cargo deny` report them as `unlicensed` errors and left the
actual policy nowhere.

Crates now declare `LicenseRef-Proprietary` with `publish = false`.
That string is deliberately not a real SPDX identifier, so it must never
appear in a `deny.toml` allow list - a third-party crate claiming it
would be a genuine finding. npm packages use `"license": "UNLICENSED"`,
the equivalent convention there.

`deny.toml` holds the permissive-only allow list. The policy itself, the
audit, and the three categories cargo-deny cannot see (external
binaries, ML model weights, self-hosted servers) are documented in
continuum-common's docs/LICENSES.md.

This commit is contained in:

octoturge

2026-10-03 10:09:59 +00:00

parent 88919d500d

commit ef6c422458

4 changed files with 42 additions and 0 deletions

									
										packages/ts-types/package.json
									
		+1
		
												View File
												
				@@ -1,5 +1,6 @@

				{

				  "name": "@continuum/ts-types",

				  "license": "UNLICENSED",

				  "version": "0.1.0",

				  "private": true,

				  "type": "module",