# Licence

nidl is dual-licensed under either of

- Apache License, Version 2.0 ([LICENSE-APACHE](./LICENSE-APACHE))
- MIT License ([LICENSE-MIT](./LICENSE-MIT))

at your option. This is the Rust ecosystem's customary dual licence, and it is what the
great majority of this project's own dependencies already use.

Unless you explicitly state otherwise, any contribution intentionally submitted for
inclusion in this work by you, as defined in the Apache-2.0 licence, shall be dual
licensed as above, without any additional terms or conditions.

## Third-party notice

This notice is scoped to what each build contains, as
`.hermes/artifacts/plugin-cli-foundation/F-DEPENDENCY-SECURITY-AUDIT.md` s.2 records it. Its
obligations are recorded here rather than left to be discovered.

**The headless binary** (`nidl-core`, built without default features: what a handed build
contains) has one dependency under a copyleft licence:

**`option-ext`** (MPL-2.0), used unmodified, reached through `dirs` → `dirs-sys`. MPL-2.0 is
file-level copyleft: the obligation attaches to modifications of MPL-licensed *files*, not
to the work that links them. nidl modifies none, so what is owed is the notice above and
availability of that component's source, which is published at its own repository. It
places no constraint on nidl's own terms.

Everything else in the headless binary's dependency graph is permissive. No crate in it is under
GPL, LGPL or AGPL.

**The desktop app** (built with default features, and not distributed today) also contains the
four MPL-2.0 crates of its webview's CSS stack, each used unmodified, with the same obligation as
`option-ext`: **`cssparser`**, **`cssparser-macros`**, **`dtoa-short`** and **`selectors`**. No
crate in it is under GPL, LGPL or AGPL either.

**The website** (`@nidl/web`, private, and not distributed) depends on
**`@img/sharp-libvips-darwin-arm64`** (LGPL-3.0-or-later), a prebuilt image library reached through
`next` → `sharp`. Publishing the website would make its LGPL obligation live.

`tests/licence_notice_test.rs` reads both Rust dependency graphs, and fails when a copyleft crate in
either is not named here or a crate under GPL, LGPL or AGPL appears.
