@dejadex/web 0.1.0 → 0.1.2

package/CHANGELOG.md

@@ -3,6 +3,32 @@
 All notable changes to `@dejadex/web`. Versions follow semver; before 1.0 a
 minor version may break the client contract (`src/types.ts`), and says so here.
 
+## 0.1.2
+
+- **Licence:** interim proprietary terms (`LICENSE.md`; `license` is now
+  `SEE LICENSE IN LICENSE.md`, was `UNLICENSED`), to be replaced by the
+  lawyer-reviewed text.
+- **Third-party notices:** `THIRD_PARTY_NOTICES` lists every package installed
+  with the SDK, with its version, licence and licence text, the identification
+  model the SDK downloads, and ONNX Runtime's own third-party notices. Both
+  files are in the package. The SDK's tests fail when a runtime dependency is
+  missing from it or listed at another version than the installed one.
+- No code change.
+
+## 0.1.1
+
+- **Fix:** the usage database (`dejadex-usage`) no longer blocks a host's
+  `indexedDB.deleteDatabase`. The IndexedDB store closes its connection on
+  `versionchange`; before, a host deleting it on sign-out stayed blocked for
+  the life of the page, and the previous account's queued usage could be
+  drained under the next account's session.
+- `UsageStore.close()` (optional for stores a host writes; a no-op on the
+  memory store). After a close or a `versionchange`, every call rejects with
+  `ScannerError` `INVALID_OPTIONS` ("the usage store is closed"); nothing is
+  dropped in silence.
+- `destroy()` also closes the usage store the identifier opened itself. A store
+  passed as `options.usageStore` belongs to the host and is left open.
+
 ## 0.1.0 — first published release
 
 - `createIdentifier`: card crops in, catalogue ids out, on the device

package/LICENSE.md

@@ -0,0 +1,19 @@
+# Licence
+
+Copyright (c) 2026 Shay Axelrod. All rights reserved.
+
+This licence applies to the DejaDex Web SDK (@dejadex/web), the "Software".
+
+1. Use of the Software is permitted only to parties with a written agreement
+   with DejaDex, and only with a valid DejaDex API key and leases issued under
+   that agreement.
+
+2. No other right to use, copy, modify, distribute or sublicense the Software
+   is granted.
+
+3. Third-party components are licensed under their own terms, listed in
+   THIRD_PARTY_NOTICES.
+
+4. The Software is provided "as is", without warranty of any kind. To the
+   extent the law allows, there is no liability for any claim, damage or other
+   loss arising from the Software or its use.

package/README.md

@@ -21,7 +21,8 @@ npm install @dejadex/web
 What protects the platform is the lease and the signed asset URLs, not the
 SDK's code, which runs in browsers anyway. Releases are cut from a
 `web-v<version>` tag by `.github/workflows/publish-web-sdk.yml` (npm trusted
-publishing, no stored token); see `CHANGELOG.md`.
+publishing, no stored token), staged and then approved by a maintainer with
+2FA; see `CHANGELOG.md`.
 
 ## Usage
 
@@ -69,7 +70,14 @@ await identifier.drainUsage((batch) => myBackend.postUsage(batch))
 device engine and resolves its `DeviceEngineInfo` (backend, precision, threads,
 measured `perCropMs`). `status()` reports the lease, the device engine and why
 the server route is paused. `leaseRequest()` is the renewal body (see Usage).
-`newSession()`, `pendingUsage()` and `destroy()` are what their names say.
+`newSession()` and `pendingUsage()` are what their names say. `destroy()`
+releases the device engine and closes the usage store the identifier opened;
+a store passed as `usageStore` is the host's, and stays open.
+
+**Sign-out.** Drain usage, `destroy()` the identifier, then
+`indexedDB.deleteDatabase('dejadex-usage')`. An SDK store still open lets go
+of the database when the delete arrives (and rejects later calls), so the
+delete is never blocked and no queued usage carries into the next account.
 
 ### Where a call runs
 
@@ -213,3 +221,12 @@ The preprocessing parity fixtures in `src/identify/__fixtures__/` come from
 `ml/scripts/phase0_sdk_fixtures.py`: synthetic crops, never card images. The
 embedding half of that test runs only where the gitignored model files are on
 disk. `DEJADEX_REQUIRE_MODELS=1` turns their absence into a failure.
+
+## Licence
+
+Proprietary: use requires a written agreement with DejaDex (`LICENSE.md`).
+Third-party components keep their own licences, listed with their texts in
+`THIRD_PARTY_NOTICES`. When a runtime dependency is added or upgraded, copy
+its `LICENSE` from `node_modules` into that file; the SDK's tests
+(`scripts/check-third-party-notices.mjs`) fail until its entry matches the
+installed version.