chore: license MeshBay — LGPL protocol layer, AGPL for the rest

The protocol layer is LGPL-3.0-or-later in every language it exists in, so
any client may use it whatever its own licence: meshbay-common, and the files
marked with an SPDX line — keyderive.js, crypto.js, playlist-crypto.js,
transport*.js; keyring.js, transcripts.js and argon2-wasm.js on the desktop;
Kdf.kt, Keyring.kt and Transcripts.kt on Android. Everything else is
AGPL-3.0-or-later, which the RPM specs and package.json already declared
without a licence file to back them.

Two AGPL section 7 permissions:
- group applications may be under any licence when they use the interface
  only through a named surface (static/licenses/APPLICATION-EXCEPTION.txt);
  the reference application is 0BSD so that copying it brings no AGPL code;
- the Android application may be conveyed linked with Google Play services.

Third-party code is accounted for: THIRD-PARTY-NOTICES.txt is generated from
what a build ships (packaging/third_party_notices.py) for the deb/rpm venv and
the frozen Windows node — PyAV's wheel grafts in libx264 and libx265, which its
BSD licence does not mention — and the vendored browser libraries get their
licence texts and htm-preact.js its provenance. Wheels carry SPDX metadata,
RPMs %license, debs a DEP-5 copyright file, every Windows target LICENSE.txt.

test_licensing.py holds the line: the LGPL layer imports nothing under the
AGPL, the reference application nothing outside the application interface,
and every SPDX line is one of the known ones.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 65 insertions, 0 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/static/licenses/APPLICATION-EXCEPTION.txt b/packages/meshbay-hub/src/meshbay_hub/static/licenses/APPLICATION-EXCEPTION.txt
new file mode 100644
index 0000000..5ab0921
--- /dev/null
+++ b/packages/meshbay-hub/src/meshbay_hub/static/licenses/APPLICATION-EXCEPTION.txt
@@ -0,0 +1,65 @@
+MeshBay interface — additional permission for group applications
+under GNU AGPL version 3, section 7
+==============================================================================
+
+The MeshBay interface is free software under the GNU Affero General Public
+License, version 3 or (at your option) any later version (AGPL-3.0.txt, beside
+this file), with the following additional permission. Its protocol layer, the
+files marked SPDX-License-Identifier: LGPL-3.0-or-later, is under the GNU
+Lesser GPL instead and needs no such permission.
+
+Definitions
+
+  "The Interface" is the MeshBay web interface: the files of
+  packages/meshbay-hub/src/meshbay_hub/static/ that are under the AGPL,
+  wherever they are conveyed — served by a hub, or carried by the desktop or
+  the Android application.
+
+  "The Application Interface" is:
+    1. the properties the Interface passes to a group application's component
+       and to its settings pane, and the fields of an entry in its application
+       registry (apps.js), as docs/MESHBAY_DESIGN.md sections 9.2 to 9.4
+       describe them;
+    2. the names exported by these modules of the Interface:
+         i18n.js
+         icon.js
+         file-utils.js
+         settings-ui.js
+         folder-tree.js
+    3. the CSS class names style.css defines, and the message keys of the
+       catalogues under locales/.
+
+  "An Application" is a module, or a set of modules, that the Interface loads
+  as a group application and that interacts with the Interface only through
+  the Application Interface. It may also use the protocol layer and the
+  third-party files under vendor/, each under its own licence. It contains no
+  part of the Interface itself, copied or modified.
+
+Permission
+
+  As a special exception, the copyright holders of the Interface give you
+  permission to combine an Application with the Interface, and to convey the
+  resulting combination, with the Application under terms of your choice,
+  provided that the Interface itself — including any modification of it, of
+  which registering the Application in apps.js or adding its messages to the
+  catalogues is one — remains under the GNU AGPL with this permission, and
+  that you meet the AGPL's terms for it, section 13 included. An Application
+  does not become a work based on the Interface by using the Application
+  Interface, and conveyed on its own carries no obligation from the
+  Interface's licence.
+
+  This permission covers the Interface only. The hub, the node and the
+  desktop and Android shells keep their licence unchanged: code running there
+  on an Application's behalf is a modification of them.
+
+  If you modify the Interface, you may extend this permission to your version
+  of it, but you are not obliged to do so. If you do not wish to, delete this
+  permission from your version (section 7).
+
+Why: the point of the application store is that people other than MeshBay's
+authors write applications, under the licence they choose — free or not. An
+application runs in the same page as the Interface and calls into it, which
+without this permission would make it a work based on the Interface, under the
+AGPL. The permission is limited to a named, documented surface so that what an
+application may rely on is a deliberate commitment, not whatever happens to be
+importable.