Skip to main content

Licenses & Attribution

Compliance requirement: every third-party piece of software shipped in the distributable must be attributable. nque surfaces this in an in-app Licenses page, opened from Help → Licenses in the sidebar.

What the Licenses page shows​

src/components/license-sheet.tsx renders four sections, backed by generated data:

  1. Application license — LICENSE.txt, nque's own proprietary license.
  2. npm dependencies — the transitive dependencies closure resolved from node_modules.
  3. Cargo dependencies — every package resolved in Cargo.lock.
  4. Vendored dependencies — manually vendored code documented in VENDORS.md.

The generator​

scripts/generate-licenses.mjs produces src/generated/licenses.ts. It runs automatically before dev, build, and test via the generate:licenses script, so the page always reflects the current dependency tree.

pnpm generate:licenses   # regenerate manually
caution

src/generated/licenses.ts is gitignored build output. Do not edit it by hand.

Cargo license text​

License text for cargo crates can only be recovered for crates present in the local cargo registry cache. Crates that are not cached are listed with a license of Unknown.

Vendored dependencies​

Any third-party code that is manually copied, adapted, or embedded into the repository must be recorded in VENDORS.md, including its license. This covers copied snippets, bundled assets, inline library code, and licensed fonts or graphics.

To add one:

  1. Add a row to the table in VENDORS.md with Package, Version, License (SPDX id or a link to the license text), and Notes.
  2. Keep the table sorted alphabetically by package name.

Dependencies pulled in automatically by pnpm or Cargo are not added to VENDORS.md; they are discovered by the generator.

When adding or upgrading dependencies​

Run pnpm generate:licenses and verify the Licenses page reflects the change.