octoturgeandClaude Opus 5
4a54ed62f7
Continuum is intended to be sold, so every dependency has to permit distribution in closed-source commercial software. Nothing recorded that before: our own crates and npm packages carried no licence field at all, which made `cargo deny` report them as `unlicensed` errors and left the actual policy nowhere. Crates now declare `LicenseRef-Proprietary` with `publish = false`. That string is deliberately not a real SPDX identifier, so it must never appear in a `deny.toml` allow list - a third-party crate claiming it would be a genuine finding. npm packages use `"license": "UNLICENSED"`, the equivalent convention there. `deny.toml` holds the permissive-only allow list. The policy itself, the audit, and the three categories cargo-deny cannot see (external binaries, ML model weights, self-hosted servers) are documented in continuum-common's docs/LICENSES.md. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
18 lines
382 B
JSON
18 lines
382 B
JSON
{
|
|
"name": "continuum-schemas",
|
|
"license": "UNLICENSED",
|
|
"version": "0.1.0",
|
|
"private": true,
|
|
"workspaces": [
|
|
"packages/*"
|
|
],
|
|
"scripts": {
|
|
"build:rust": "cargo build -p continuum-rust-types --manifest-path packages/rust-types/Cargo.toml",
|
|
"build": "npm run build:rust",
|
|
"typecheck": "tsc -b"
|
|
},
|
|
"devDependencies": {
|
|
"typescript": "^5.5.0"
|
|
}
|
|
}
|