@dejadex/web 0.1.1 → 0.1.2

package/CHANGELOG.md

@@ -3,6 +3,18 @@
 All notable changes to `@dejadex/web`. Versions follow semver; before 1.0 a
 minor version may break the client contract (`src/types.ts`), and says so here.
 
+## 0.1.2
+
+- **Licence:** interim proprietary terms (`LICENSE.md`; `license` is now
+  `SEE LICENSE IN LICENSE.md`, was `UNLICENSED`), to be replaced by the
+  lawyer-reviewed text.
+- **Third-party notices:** `THIRD_PARTY_NOTICES` lists every package installed
+  with the SDK, with its version, licence and licence text, the identification
+  model the SDK downloads, and ONNX Runtime's own third-party notices. Both
+  files are in the package. The SDK's tests fail when a runtime dependency is
+  missing from it or listed at another version than the installed one.
+- No code change.
+
 ## 0.1.1
 
 - **Fix:** the usage database (`dejadex-usage`) no longer blocks a host's

package/LICENSE.md

@@ -0,0 +1,19 @@
+# Licence
+
+Copyright (c) 2026 Shay Axelrod. All rights reserved.
+
+This licence applies to the DejaDex Web SDK (@dejadex/web), the "Software".
+
+1. Use of the Software is permitted only to parties with a written agreement
+   with DejaDex, and only with a valid DejaDex API key and leases issued under
+   that agreement.
+
+2. No other right to use, copy, modify, distribute or sublicense the Software
+   is granted.
+
+3. Third-party components are licensed under their own terms, listed in
+   THIRD_PARTY_NOTICES.
+
+4. The Software is provided "as is", without warranty of any kind. To the
+   extent the law allows, there is no liability for any claim, damage or other
+   loss arising from the Software or its use.

package/README.md

@@ -221,3 +221,12 @@ The preprocessing parity fixtures in `src/identify/__fixtures__/` come from
 `ml/scripts/phase0_sdk_fixtures.py`: synthetic crops, never card images. The
 embedding half of that test runs only where the gitignored model files are on
 disk. `DEJADEX_REQUIRE_MODELS=1` turns their absence into a failure.
+
+## Licence
+
+Proprietary: use requires a written agreement with DejaDex (`LICENSE.md`).
+Third-party components keep their own licences, listed with their texts in
+`THIRD_PARTY_NOTICES`. When a runtime dependency is added or upgraded, copy
+its `LICENSE` from `node_modules` into that file; the SDK's tests
+(`scripts/check-third-party-notices.mjs`) fail until its entry matches the
+installed version.