@companion-module/tools 3.0.2 → 3.1.0

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## [3.1.0](https://github.com/bitfocus/companion-module-tools/compare/v3.0.2...v3.1.0) (2026-08-28)
+
+
+### Features
+
+* add node26 tsconfig ([bb73011](https://github.com/bitfocus/companion-module-tools/commit/bb7301104fd641dc3dfda0bd7abef4dc36870fb5))
+* Replace license-file generation after esbuild migration ([#112](https://github.com/bitfocus/companion-module-tools/issues/112)) ([7819905](https://github.com/bitfocus/companion-module-tools/commit/7819905a47f3a357a4fe8e1b6ed117b617e3f2cc))
+* warn about restricted module licenses ([#113](https://github.com/bitfocus/companion-module-tools/issues/113)) ([b1cc996](https://github.com/bitfocus/companion-module-tools/commit/b1cc996bc1201f796e0e1afa26f29822bfff260f))
+
+
 ## [3.0.2](https://github.com/bitfocus/companion-module-tools/compare/v3.0.1...v3.0.2) (2026-06-19)
 
 

package/LICENSE

@@ -0,0 +1,21 @@
+The MIT License
+
+Copyright (c) 2026 Bitfocus AS
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

package/README.md

@@ -14,6 +14,28 @@ More information on this command is available [on the wiki](https://github.com/b
 
 Generate the new format manifest from an old `package.json`.
 
+## Licensing
+
+A module has two licenses, and they are not the same thing:
+
+- `license` in `package.json` is the license of the code you wrote. This must be `MIT`, so module source always stays
+  portable and can be reused anywhere.
+- `license` in `companion/manifest.json` is the license the packaged module is distributed under. A build bundles your
+  code together with its dependencies, so this has to be a license that whole blob can be shipped under.
+
+Your own code stays MIT even when a dependency is copyleft. If you bundle a GPL-3.0 dependency, your source stays MIT
+while the manifest declares `GPL-3.0-only`, because that is what the combined package must be distributed as. Anyone
+reusing your source on its own still gets it under MIT.
+
+The build and check commands validate every bundled and external dependency against the manifest license. Supported
+values are `MIT` (recommended, it can use the most of npm), `GPL-2.0-only` and `GPL-3.0-only`. Dual licensing is not
+supported, and a module which declares no license in its manifest falls back to the one in `package.json`.
+
+Some older packages ship a license file but declare no license in their `package.json`, so there is nothing to check
+against. Those are listed in `src/scripts/lib/known-package-licenses.ts` once their license has been confirmed from
+what they publish, so open a PR there if you hit one. A license a package declares itself always wins over that list.
+
+Pass `--ignore-license-rules` to report license problems as warnings instead of failing the command.
 
 ## Upgrading from v1.x to v2.0
 
@@ -21,8 +43,8 @@ v2.0 of this library includes some breaking changes to how eslint and prettier h
 
 This change was done for two reasons:
 
-1) Very few modules use eslint, making this extra weight for them for no gain.
-2) Recent versions of yarn do not expose these binaries in a way which is easily callable by modules, requiring tricks to be able to execute them.
+1. Very few modules use eslint, making this extra weight for them for no gain.
+2. Recent versions of yarn do not expose these binaries in a way which is easily callable by modules, requiring tricks to be able to execute them.
 
 To resolve this, you will need to do a `yarn add --dev eslint prettier` in your modules to install the dependencies, and update any scripts to remove the invocation hacks.
 
@@ -42,7 +64,7 @@ If using TypeScript, you should specify a `typescriptRoot`:
 import { generateEslintConfig } from '@companion-module/tools/eslint/config.mjs'
 
 export default generateEslintConfig({
-    enableTypescript: true,
+	enableTypescript: true,
 })
 ```
 

package/dist/scripts/build-connection.js

@@ -2,18 +2,31 @@
 // The zx shebang doesn't resolve dependencies correctly
 import 'zx/globals';
 import { buildPackage } from './lib/build-util.js';
+import { LicensePolicyError } from './lib/license-warning-util.js';
+import { ignoreLicenseRules } from './lib/cli-options.js';
 if (process.platform === 'win32') {
     usePowerShell(); // to enable powershell
 }
 if (argv.help) {
-    console.log('Usage: companion-module-build [--dev] [--prerelease]');
+    console.log('Usage: companion-module-build [--dev] [--prerelease] [--ignore-license-rules]');
     console.log('Builds the companion connection module');
     console.log('  --dev: Build in development mode. This will not minify the code, making it easier to debug.');
     console.log('  --prerelease: Build in prerelease mode. This gets added as metadata to the manifest');
     console.log('  --output <filename>: Output to a specific filename, without a file extension');
+    console.log('  --ignore-license-rules: Report license policy issues as warnings instead of failing');
     process.exit(0);
 }
 const { validateManifest } = await import('@companion-module/base/manifest').catch((e) => {
     throw new Error(`Failed to load @companion-module/base. Have you installed a compatible version?: ${e?.message ?? e}`);
 });
-await buildPackage('@companion-module/base', validateManifest, 'connection', '>=1.4.0 <3.0.0');
+try {
+    await buildPackage('@companion-module/base', validateManifest, 'connection', '>=1.4.0 <3.0.0', {
+        ignoreLicenseRules: ignoreLicenseRules(argv),
+    });
+}
+catch (e) {
+    if (e instanceof LicensePolicyError)
+        process.exitCode = 1;
+    else
+        throw e;
+}

package/dist/scripts/build-surface.js

@@ -2,16 +2,29 @@
 // The zx shebang doesn't resolve dependencies correctly
 import 'zx/globals';
 import { buildPackage } from './lib/build-util.js';
+import { LicensePolicyError } from './lib/license-warning-util.js';
+import { ignoreLicenseRules } from './lib/cli-options.js';
 if (process.platform === 'win32') {
     usePowerShell(); // to enable powershell
 }
 if (argv.help) {
-    console.log('Usage: companion-module-build [--dev] [--prerelease]');
-    console.log('Builds the companion connection module');
+    console.log('Usage: companion-surface-build [--dev] [--prerelease] [--ignore-license-rules]');
+    console.log('Builds the companion surface module');
     console.log('  --dev: Build in development mode. This will not minify the code, making it easier to debug.');
     console.log('  --prerelease: Build in prerelease mode. This gets added as metadata to the manifest');
     console.log('  --output <filename>: Output to a specific filename, without a file extension');
+    console.log('  --ignore-license-rules: Report license policy issues as warnings instead of failing');
     process.exit(0);
 }
 const { validateSurfaceManifest } = await import('@companion-surface/base');
-await buildPackage('@companion-surface/base', validateSurfaceManifest, 'surface', '>=1.0.0 <2.0.0');
+try {
+    await buildPackage('@companion-surface/base', validateSurfaceManifest, 'surface', '>=1.0.0 <2.0.0', {
+        ignoreLicenseRules: ignoreLicenseRules(argv),
+    });
+}
+catch (e) {
+    if (e instanceof LicensePolicyError)
+        process.exitCode = 1;
+    else
+        throw e;
+}

package/dist/scripts/check-connection.js

@@ -1,25 +1,37 @@
 #!/usr/bin/env node
 // The zx shebang doesn't resolve dependencies correctly
 import 'zx/globals';
-import path from 'path';
-import { findModuleDir, readUTF8File } from './lib/build-util.js';
+import { createRequire } from 'node:module';
+import { findModuleDir } from './lib/build-util.js';
+import { checkPackage } from './lib/check-util.js';
+import { LicensePolicyError } from './lib/license-warning-util.js';
+import { ignoreLicenseRules } from './lib/cli-options.js';
 if (process.platform === 'win32') {
     usePowerShell(); // to enable powershell
 }
+if (argv.help) {
+    console.log('Usage: companion-module-check [--ignore-license-rules]');
+    console.log('Checks the companion connection module');
+    console.log('  --ignore-license-rules: Report license policy issues as warnings instead of failing');
+    process.exit(0);
+}
 const { validateManifest } = await import('@companion-module/base/manifest').catch((e) => {
     throw new Error(`Failed to load @companion-module/base. Have you installed a compatible version?: ${e?.message ?? e}`);
 });
-// const toolsDir = path.join(__dirname, '..')
-const toolsDir = await findModuleDir(import.meta.resolve('@companion-module/tools'));
-const frameworkDir = await findModuleDir(import.meta.resolve('@companion-module/base'));
+const require = createRequire(import.meta.url);
+const toolsDir = await findModuleDir(require.resolve('@companion-module/tools'));
+const frameworkDir = await findModuleDir(require.resolve('@companion-module/base'));
 console.log(`Checking for: ${process.cwd()}`);
 console.log(`Tools path: ${toolsDir}`);
 console.log(`Framework path: ${frameworkDir}`);
-const manifestJson = JSON.parse(await readUTF8File(path.resolve('./companion/manifest.json')));
 try {
-    validateManifest(manifestJson, false);
+    await checkPackage({ validateManifest, ignoreLicenseRules: ignoreLicenseRules(argv) });
 }
 catch (e) {
-    console.error('Manifest validation failed', e);
-    process.exit(1);
+    if (e instanceof LicensePolicyError)
+        process.exitCode = 1;
+    else {
+        console.error('Manifest validation failed', e);
+        process.exit(1);
+    }
 }

package/dist/scripts/check-surface.js

@@ -1,23 +1,38 @@
 #!/usr/bin/env node
 // The zx shebang doesn't resolve dependencies correctly
 import 'zx/globals';
-import path from 'path';
-import { validateSurfaceManifest } from '@companion-surface/base';
-import { findModuleDir, readUTF8File } from './lib/build-util.js';
+import { createRequire } from 'node:module';
+import { findModuleDir } from './lib/build-util.js';
+import { checkPackage } from './lib/check-util.js';
+import { LicensePolicyError } from './lib/license-warning-util.js';
+import { ignoreLicenseRules } from './lib/cli-options.js';
 if (process.platform === 'win32') {
     usePowerShell(); // to enable powershell
 }
-// const toolsDir = path.join(__dirname, '..')
-const toolsDir = await findModuleDir(import.meta.resolve('@companion-module/tools'));
-const frameworkDir = await findModuleDir(import.meta.resolve('@companion-surface/base'));
+if (argv.help) {
+    console.log('Usage: companion-surface-check [--ignore-license-rules]');
+    console.log('Checks the companion surface module');
+    console.log('  --ignore-license-rules: Report license policy issues as warnings instead of failing');
+    process.exit(0);
+}
+const { validateSurfaceManifest } = await import('@companion-surface/base');
+const require = createRequire(import.meta.url);
+const toolsDir = await findModuleDir(require.resolve('@companion-module/tools'));
+const frameworkDir = await findModuleDir(require.resolve('@companion-surface/base'));
 console.log(`Checking for: ${process.cwd()}`);
 console.log(`Tools path: ${toolsDir}`);
 console.log(`Framework path: ${frameworkDir}`);
-const manifestJson = JSON.parse(await readUTF8File(path.resolve('./companion/manifest.json')));
 try {
-    validateSurfaceManifest(manifestJson, false);
+    await checkPackage({
+        validateManifest: validateSurfaceManifest,
+        ignoreLicenseRules: ignoreLicenseRules(argv),
+    });
 }
 catch (e) {
-    console.error('Manifest validation failed', e);
-    process.exit(1);
+    if (e instanceof LicensePolicyError)
+        process.exitCode = 1;
+    else {
+        console.error('Manifest validation failed', e);
+        process.exit(1);
+    }
 }

package/dist/scripts/lib/build-util.d.ts

@@ -1,6 +1,12 @@
 import 'zx/globals';
+import type { ModuleType } from './license-warning-util.js';
+import type { LegalInventory } from './license-util.js';
 export declare function readUTF8File(filePath: string): Promise<string>;
 export declare function findModuleDir(cwd: string): Promise<string>;
-type ModuleType = 'connection' | 'surface';
-export declare function buildPackage<M>(frameworkPackageName: string, validateManifest: (manifest: M, looseChecks: boolean) => void, moduleType: ModuleType, versionRange: string): Promise<void>;
-export {};
+export declare function enforceLegalInventory(inventory: LegalInventory, options?: {
+    ignoreLicenseRules?: boolean;
+    stderr?: Pick<NodeJS.WriteStream, 'write' | 'isTTY'>;
+}): void;
+export declare function buildPackage<M>(frameworkPackageName: string, validateManifest: (manifest: M, looseChecks: boolean) => void, moduleType: ModuleType, versionRange: string, options?: {
+    ignoreLicenseRules?: boolean;
+}): Promise<void>;

package/dist/scripts/lib/build-util.js

@@ -6,6 +6,10 @@ import * as tar from 'tar';
 import { createRequire } from 'module';
 import * as semver from 'semver';
 import * as esbuild from 'esbuild';
+import { collectInstalledPackages, collectMetafilePackages, createLegalInventory, writeLegalArtifacts, } from './license-util.js';
+import { createEsbuildOptions, loadModuleBuildDefinition } from './bundle-util.js';
+import { resolveExternalDependencies } from './external-install-util.js';
+import { enforceLicensePolicy } from './license-warning-util.js';
 function toSanitizedDirname(name) {
     return name.replace(/[^a-zA-Z0-9-\.]/g, '-').replace(/[-+]/g, '-');
 }
@@ -23,7 +27,10 @@ export async function findModuleDir(cwd) {
     }
     return path.dirname(pkgJsonPath);
 }
-export async function buildPackage(frameworkPackageName, validateManifest, moduleType, versionRange) {
+export function enforceLegalInventory(inventory, options = {}) {
+    enforceLicensePolicy(inventory, options);
+}
+export async function buildPackage(frameworkPackageName, validateManifest, moduleType, versionRange, options = {}) {
     // const toolsDir = path.join(__dirname, '..')
     const moduleDir = process.cwd();
     const moduleRequire = createRequire(path.join(moduleDir, 'package.json'));
@@ -57,55 +64,27 @@ export async function buildPackage(frameworkPackageName, validateManifest, modul
     // create new
     await fs.mkdir(packageBaseDir, { recursive: true });
     const isDev = !!(argv.dev || argv.debug);
-    // Load optional build config from the module directory
-    let buildConfig = {};
-    const buildConfigPath = path.resolve('build-config.cjs');
-    if (fs.existsSync(buildConfigPath)) {
-        buildConfig = require(buildConfigPath);
+    const buildDefinition = await loadModuleBuildDefinition(moduleDir);
+    const buildConfig = buildDefinition.buildConfig;
+    if (fs.existsSync(path.join(moduleDir, 'build-config.cjs')))
         console.log('Found additional build configuration');
-    }
-    // Flatten externals to a string array for esbuild
-    const externalsRaw = Array.isArray(buildConfig.externals)
-        ? buildConfig.externals
-        : buildConfig.externals
-            ? [buildConfig.externals]
-            : [];
-    // Build entry points map
-    const entryPoints = {
-        main: './' + srcPackageJson.main,
-        ...buildConfig.additionalEntrypoints,
-    };
+    const externalsRaw = buildDefinition.externals;
     // build the code
-    const esbuildOptions = {
-        entryPoints,
+    const esbuildOptions = createEsbuildOptions(buildDefinition, {
         outdir: path.resolve(moduleDir, packageBaseDir),
-        bundle: true,
-        platform: 'node',
-        format: 'esm',
         minify: isDev ? false : !buildConfig.disableMinifier,
         sourcemap: isDev ? 'inline' : false,
-        target: 'node22',
-        external: externalsRaw,
-        // When bundling to ESM, `require`, `__dirname`, and `__filename` are not defined.
-        // Many CJS transitive dependencies call require() for Node built-ins (e.g. `require('events')`).
-        // Inject a small header that recreates them with ESM-native APIs so they work at runtime.
-        banner: {
-            js: [
-                `import { createRequire as __esbuild_createRequire } from 'module';`,
-                `import { fileURLToPath as __esbuild_fileURLToPath } from 'url';`,
-                `import { dirname as __esbuild_dirname } from 'path';`,
-                `const require = __esbuild_createRequire(import.meta.url);`,
-                `const __filename = __esbuild_fileURLToPath(import.meta.url);`,
-                `const __dirname = __esbuild_dirname(__filename);`,
-            ].join('\n'),
-        },
-    };
-    await esbuild.build(esbuildOptions);
+    });
+    const buildResult = await esbuild.build(esbuildOptions);
+    if (!buildResult.metafile)
+        throw new Error('esbuild did not produce a metafile');
+    const metafilePackages = await collectMetafilePackages(moduleDir, buildResult.metafile);
     // copy in the metadata
     await fs.copy('companion', path.join(packageBaseDir, 'companion'));
     // Copy the manifest, overriding some properties
     manifestJson.runtime.entrypoint = '../main.js';
     manifestJson.version = srcPackageJson.version;
+    // Note: not syncing the license, as source and distrubution could be different licenses.
     manifestJson.runtime.api = 'nodejs-ipc';
     manifestJson.runtime.apiVersion = frameworkPackageJson.version;
     // Bake in the prerelease flag if using module-base which is new enough
@@ -132,15 +111,7 @@ export async function buildPackage(frameworkPackageName, validateManifest, modul
     };
     // Ensure that any externals are added as dependencies
     if (externalsRaw.length) {
-        // Add any external dependencies with versions matching what is currently installed.
-        // Externals are plain package-name strings when using esbuild.
-        for (const external of externalsRaw) {
-            const extPath = await findUp('package.json', { cwd: moduleRequire.resolve(external) });
-            if (extPath) {
-                const extJson = JSON.parse(await readUTF8File(extPath));
-                packageJson.dependencies[extJson.name] = extJson.version;
-            }
-        }
+        Object.assign(packageJson.dependencies, await resolveExternalDependencies(moduleDir, externalsRaw));
         // Ensure node-gyp is excluded from the installed deps in the output package
         packageJson.resolutions = {
             'node-gyp': 'npm:empty-npm-package@1.0.0',
@@ -205,6 +176,16 @@ export async function buildPackage(frameworkPackageName, validateManifest, modul
             }
         }
     }
+    const shippedPackages = [...metafilePackages.packages];
+    if (Object.keys(packageJson.dependencies).length) {
+        shippedPackages.push(...(await collectInstalledPackages(path.join(packageBaseDir, 'node_modules'))));
+    }
+    const legalInventory = await createLegalInventory(shippedPackages);
+    for (const diagnostic of [...metafilePackages.diagnostics, ...legalInventory.diagnostics]) {
+        console.warn(`License inventory: ${diagnostic}`);
+    }
+    await writeLegalArtifacts(packageBaseDir, legalInventory);
+    enforceLegalInventory(legalInventory, options);
     // Create tgz of the build
     let tgzFile = toSanitizedDirname(`${manifestJson.id}-${manifestJson.version}`);
     if (typeof argv['output'] === 'string') {

package/dist/scripts/lib/bundle-util.d.ts

@@ -0,0 +1,11 @@
+import * as esbuild from 'esbuild';
+import type { ModuleBuildConfig } from '../../build-config.js';
+export interface ModuleBuildDefinition {
+    moduleDir: string;
+    packageJson: Record<string, unknown>;
+    buildConfig: ModuleBuildConfig;
+    entryPoints: Record<string, string>;
+    externals: string[];
+}
+export declare function loadModuleBuildDefinition(moduleDir: string): Promise<ModuleBuildDefinition>;
+export declare function createEsbuildOptions(definition: ModuleBuildDefinition, overrides: Pick<esbuild.BuildOptions, 'outdir' | 'write' | 'minify' | 'sourcemap'>): esbuild.BuildOptions;

package/dist/scripts/lib/bundle-util.js

@@ -0,0 +1,49 @@
+import { existsSync } from 'node:fs';
+import { readFile } from 'node:fs/promises';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+export async function loadModuleBuildDefinition(moduleDir) {
+    const moduleRequire = createRequire(path.join(moduleDir, 'package.json'));
+    const packageJson = JSON.parse(await readFile(path.join(moduleDir, 'package.json'), 'utf8'));
+    if (typeof packageJson.main !== 'string')
+        throw new Error('Missing main in package.json');
+    let buildConfig = {};
+    const buildConfigPath = path.join(moduleDir, 'build-config.cjs');
+    if (existsSync(buildConfigPath))
+        buildConfig = moduleRequire(buildConfigPath);
+    const externals = Array.isArray(buildConfig.externals)
+        ? buildConfig.externals
+        : buildConfig.externals
+            ? [buildConfig.externals]
+            : [];
+    return {
+        moduleDir,
+        packageJson,
+        buildConfig,
+        entryPoints: { main: `./${packageJson.main}`, ...buildConfig.additionalEntrypoints },
+        externals,
+    };
+}
+export function createEsbuildOptions(definition, overrides) {
+    return {
+        absWorkingDir: definition.moduleDir,
+        entryPoints: definition.entryPoints,
+        bundle: true,
+        platform: 'node',
+        format: 'esm',
+        target: 'node22',
+        external: definition.externals,
+        metafile: true,
+        ...overrides,
+        banner: {
+            js: [
+                `import { createRequire as __esbuild_createRequire } from 'module';`,
+                `import { fileURLToPath as __esbuild_fileURLToPath } from 'url';`,
+                `import { dirname as __esbuild_dirname } from 'path';`,
+                `const require = __esbuild_createRequire(import.meta.url);`,
+                `const __filename = __esbuild_fileURLToPath(import.meta.url);`,
+                `const __dirname = __esbuild_dirname(__filename);`,
+            ].join('\n'),
+        },
+    };
+}

package/dist/scripts/lib/check-util.d.ts

@@ -0,0 +1,6 @@
+export declare function checkPackage<M>(options: {
+    validateManifest: (manifest: M, looseChecks: boolean) => void;
+    cwd?: string;
+    ignoreLicenseRules?: boolean;
+    stderr?: Pick<NodeJS.WriteStream, 'write' | 'isTTY'>;
+}): Promise<void>;

package/dist/scripts/lib/check-util.js

@@ -0,0 +1,14 @@
+import { readFile } from 'node:fs/promises';
+import path from 'node:path';
+import { enforceLicensePolicy } from './license-warning-util.js';
+import { analyzeShippedLegalInventory } from './license-util.js';
+export async function checkPackage(options) {
+    const cwd = options.cwd ?? process.cwd();
+    const manifest = JSON.parse(await readFile(path.join(cwd, 'companion', 'manifest.json'), 'utf8'));
+    options.validateManifest(manifest, false);
+    const inventory = await analyzeShippedLegalInventory(cwd);
+    enforceLicensePolicy(inventory, {
+        ignoreLicenseRules: options.ignoreLicenseRules,
+        stderr: options.stderr,
+    });
+}

package/dist/scripts/lib/cli-options.d.ts

@@ -0,0 +1 @@
+export declare function ignoreLicenseRules(argv: Record<string, unknown>): boolean;

package/dist/scripts/lib/cli-options.js

@@ -0,0 +1,4 @@
+export function ignoreLicenseRules(argv) {
+    const value = argv['ignore-license-rules'];
+    return value === true || value === 'true';
+}

package/dist/scripts/lib/external-install-util.d.ts

@@ -0,0 +1,2 @@
+export declare function resolveExternalDependencies(moduleDir: string, externals: string[]): Promise<Record<string, string>>;
+export declare function withInstalledExternalTree<T>(dependencies: Record<string, string>, inspect: (nodeModulesDir: string) => Promise<T>): Promise<T>;

package/dist/scripts/lib/external-install-util.js

@@ -0,0 +1,51 @@
+import { execFile } from 'node:child_process';
+import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
+import { createRequire } from 'node:module';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { promisify } from 'node:util';
+const execFileAsync = promisify(execFile);
+async function findPackageRoot(filePath) {
+    let currentDir = path.dirname(filePath);
+    while (true) {
+        try {
+            await readFile(path.join(currentDir, 'package.json'));
+            return currentDir;
+        }
+        catch {
+            const parentDir = path.dirname(currentDir);
+            if (parentDir === currentDir)
+                throw new Error(`No package.json found for ${filePath}`);
+            currentDir = parentDir;
+        }
+    }
+}
+export async function resolveExternalDependencies(moduleDir, externals) {
+    const moduleRequire = createRequire(path.join(moduleDir, 'package.json'));
+    const dependencies = {};
+    for (const external of externals) {
+        const packageRoot = await findPackageRoot(moduleRequire.resolve(external));
+        const packageJson = JSON.parse(await readFile(path.join(packageRoot, 'package.json'), 'utf8'));
+        if (typeof packageJson.name !== 'string' || typeof packageJson.version !== 'string') {
+            throw new Error(`External ${external} has invalid package metadata`);
+        }
+        dependencies[packageJson.name] = packageJson.version;
+    }
+    return dependencies;
+}
+export async function withInstalledExternalTree(dependencies, inspect) {
+    const stagingDir = await mkdtemp(path.join(tmpdir(), 'companion-license-check-'));
+    try {
+        await writeFile(path.join(stagingDir, 'package.json'), JSON.stringify({
+            private: true,
+            dependencies,
+            resolutions: { 'node-gyp': 'npm:empty-npm-package@1.0.0' },
+        }));
+        await writeFile(path.join(stagingDir, 'yarn.lock'), '');
+        await execFileAsync('yarn', ['--cwd', stagingDir, 'install', '--no-immutable']);
+        return await inspect(path.join(stagingDir, 'node_modules'));
+    }
+    finally {
+        await rm(stagingDir, { recursive: true, force: true });
+    }
+}

package/dist/scripts/lib/known-package-licenses.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Packages which ship no license declaration in their package.json, but whose license has been confirmed by reading
+ * what they publish. Only add an entry after checking that version yourself, and record where the license was found.
+ *
+ * Keys are exact `name@version`, as a later release can change license. A declared license always wins over this list,
+ * so an entry can never hide what a package says about itself.
+ */
+export declare const KNOWN_PACKAGE_LICENSES: Record<string, string>;
+export declare function knownPackageLicense(name: string | undefined, version: string | undefined): string | undefined;
+/**
+ * Packages which declare a license that is not a valid SPDX expression, mapped to what the license text they publish
+ * actually is. Unlike KNOWN_PACKAGE_LICENSES this overrides what a package says about itself, so it is only consulted
+ * when the declaration cannot be parsed, and can never turn a real license into a more convenient one.
+ *
+ * Only add an entry after reading the license text shipped in that exact version, and record what identified it.
+ * Keys are exact `name@version`, so a later release declaring something different is unaffected.
+ */
+export declare const CORRECTED_PACKAGE_LICENSES: Record<string, string>;
+export declare function correctedPackageLicense(name: string | undefined, version: string | undefined): string | undefined;