@companion-module/tools 3.0.2 → 3.1.0

package/dist/scripts/lib/known-package-licenses.js

@@ -0,0 +1,78 @@
+/**
+ * Packages which ship no license declaration in their package.json, but whose license has been confirmed by reading
+ * what they publish. Only add an entry after checking that version yourself, and record where the license was found.
+ *
+ * Keys are exact `name@version`, as a later release can change license. A declared license always wins over this list,
+ * so an entry can never hide what a package says about itself.
+ */
+export const KNOWN_PACKAGE_LICENSES = {
+    // LICENSE.md, "The MIT License", https://github.com/bwindels/exif-parser
+    'exif-parser@0.1.12': 'MIT',
+    // Readme.md "## License" section in the published tarball, and a LICENSE added to
+    // https://github.com/component/indexof after this version was published
+    'indexof@0.0.1': 'MIT',
+    // Readme.md "## License" section in the published tarball, and a LICENSE added to
+    // https://github.com/component/inherit after this version was published
+    'component-inherit@0.0.3': 'MIT',
+    // Readme.md "## License" section in the published tarball, and a LICENSE added to
+    // https://github.com/component/bind after this version was published
+    'component-bind@1.0.0': 'MIT',
+    // COPYING in the published tarball is the Boost Software License 1.0 with the notice retention paragraph removed,
+    // so it imposes strictly less than BSL-1.0 and recording it as that can only ever overstate its obligations.
+    // https://github.com/russellmcc/node-binpack
+    'binpack@0.1.0': 'BSL-1.0',
+    // LICENSE in the published tarball is BSD-3-Clause, including the clause forbidding use of the copyright holder's
+    // name to endorse derived products, https://github.com/fairoakslabs/bufferpack
+    'bufferpack@0.0.6': 'BSD-3-Clause',
+    // LICENSE, "(The MIT License)", in the published tarball, npm metadata claims MIT but package.json declares
+    // nothing, https://github.com/vercel/ms
+    'ms@0.7.1': 'MIT',
+    // cycle.js in the published tarball carries "Public Domain." in its header comment, and the author has since
+    // added "license": "Public-Domain" to https://github.com/dscape/cycle
+    'cycle@1.0.3': 'Public-Domain',
+    // component.json and bower.json both declare "MIT" in the published tarball, only package.json omits it,
+    // https://github.com/component/emitter (1.1.2 republished from https://github.com/sindresorhus/component-emitter)
+    'emitter-component@1.1.1': 'MIT',
+    'emitter-component@1.1.2': 'MIT',
+    // LICENSE, "The MIT License (MIT)", in the published tarball, https://github.com/changchang/seq-queue
+    'seq-queue@0.0.5': 'MIT',
+    // license, "MIT License", in the published tarball, https://github.com/fabiospampinato/atomically
+    'atomically@2.0.3': 'MIT',
+    // license, "MIT License", in the published tarball, https://github.com/fabiospampinato/stubborn-fs
+    'stubborn-fs@1.2.5': 'MIT',
+};
+export function knownPackageLicense(name, version) {
+    if (!name || !version)
+        return undefined;
+    return KNOWN_PACKAGE_LICENSES[`${name}@${version}`];
+}
+/**
+ * Packages which declare a license that is not a valid SPDX expression, mapped to what the license text they publish
+ * actually is. Unlike KNOWN_PACKAGE_LICENSES this overrides what a package says about itself, so it is only consulted
+ * when the declaration cannot be parsed, and can never turn a real license into a more convenient one.
+ *
+ * Only add an entry after reading the license text shipped in that exact version, and record what identified it.
+ * Keys are exact `name@version`, so a later release declaring something different is unaffected.
+ */
+export const CORRECTED_PACKAGE_LICENSES = {
+    // Declares "BSD". LICENSE is BSD-3-Clause: three conditions, the third forbidding use of the author's name to
+    // endorse derived products, which is exactly what separates it from BSD-2-Clause.
+    'url-template@2.0.8': 'BSD-3-Clause',
+    // Declares "MIT License", which is the name rather than the identifier. LICENSE is "The MIT License (MIT)".
+    'xml-escape@1.1.0': 'MIT',
+    // Declares "Apache 2.0" through the deprecated licenses array. LICENSE is the Apache License 2.0, followed by an
+    // MIT notice covering the QR library vendored into vendor/QRCode, whose text the inventory collects as well.
+    'qrcode-terminal@0.12.0': 'Apache-2.0',
+    // Declares "Apache2", which is neither the identifier nor the name. LICENSE is the verbatim Apache License 2.0
+    // including its appendix, with no NOTICE file to propagate, https://git.coolaj86.com/coolaj86/ssl-root-cas.js
+    'ssl-root-cas@1.3.1': 'Apache-2.0',
+    // Declares the pair through the deprecated licenses array as "AFLv2.1" and "BSD", each linking a line of the Dojo
+    // LICENSE the package is covered by. That file names its BSD half "BSD 3-Clause \"New\" License", including the
+    // clause forbidding use of the Dojo Foundation's name to endorse derived products, https://github.com/kriszyp/json-schema
+    'json-schema@0.2.3': '(AFL-2.1 OR BSD-3-Clause)',
+};
+export function correctedPackageLicense(name, version) {
+    if (!name || !version)
+        return undefined;
+    return CORRECTED_PACKAGE_LICENSES[`${name}@${version}`];
+}

package/dist/scripts/lib/license-util.d.ts

@@ -0,0 +1,55 @@
+import * as esbuild from 'esbuild';
+export type ShippedPackageKind = 'project' | 'bundled' | 'external';
+export interface ShippedPackage {
+    kind: ShippedPackageKind;
+    name: string;
+    version?: string;
+    declaredLicense?: string;
+    /** Only for the project, the package.json license of its own source, which declaredLicense distributes it under */
+    sourceLicense?: string;
+    /** Where recipients can obtain the source of this package, as required by MPL-2.0 and the GPL family */
+    repositoryUrl?: string;
+    packageRoot: string;
+    contributingPaths: Set<string>;
+}
+export interface MetafilePackageCollection {
+    packages: ShippedPackage[];
+    diagnostics: string[];
+}
+export interface LegalText {
+    role: 'license' | 'notice' | 'source-comment';
+    filename: string;
+    content: string;
+    sha256: string;
+}
+export interface ShippedPackageLegalRecord extends ShippedPackage {
+    legalTexts: LegalText[];
+}
+export interface PackageLegalMaterial {
+    package: ShippedPackageLegalRecord;
+    diagnostics: string[];
+}
+export interface LegalInventory {
+    packages: ShippedPackageLegalRecord[];
+    diagnostics: string[];
+}
+type PackageJson = {
+    name?: string;
+    version?: string;
+    license?: unknown;
+    licenses?: unknown;
+    repository?: unknown;
+    homepage?: unknown;
+};
+export declare function normalizeRepositoryUrl(packageJson: PackageJson): string | undefined;
+export declare function normalizeInventoryPath(inputPath: string, ownerRoot: string): string;
+export declare function collectInstalledPackages(nodeModulesDir: string): Promise<ShippedPackage[]>;
+export declare function normalizeLegalText(content: string): string;
+export declare function collectPackageLegalMaterial(packageInfo: ShippedPackage): Promise<PackageLegalMaterial>;
+export declare function renderLicenseFile(inventory: LegalInventory): string;
+export declare function renderNoticeFile(inventory: LegalInventory): string | undefined;
+export declare function writeLegalArtifacts(outputDir: string, inventory: LegalInventory): Promise<void>;
+export declare function createLegalInventory(packages: ShippedPackage[]): Promise<LegalInventory>;
+export declare function analyzeShippedLegalInventory(moduleDir: string): Promise<LegalInventory>;
+export declare function collectMetafilePackages(moduleDir: string, metafile: esbuild.Metafile): Promise<MetafilePackageCollection>;
+export {};

package/dist/scripts/lib/license-util.js

@@ -0,0 +1,427 @@
+import { lstat, readdir, realpath, readFile, rm, stat, writeFile } from 'node:fs/promises';
+import { createHash } from 'node:crypto';
+import path from 'node:path';
+import * as esbuild from 'esbuild';
+import { createEsbuildOptions, loadModuleBuildDefinition } from './bundle-util.js';
+import { resolveExternalDependencies, withInstalledExternalTree } from './external-install-util.js';
+import { knownPackageLicense } from './known-package-licenses.js';
+const SHORTHAND_REPOSITORY_HOSTS = {
+    github: 'https://github.com/',
+    gitlab: 'https://gitlab.com/',
+    bitbucket: 'https://bitbucket.org/',
+};
+export function normalizeRepositoryUrl(packageJson) {
+    const repository = packageJson.repository;
+    const declared = typeof repository === 'string'
+        ? repository
+        : repository && typeof repository === 'object' && typeof repository.url === 'string'
+            ? repository.url
+            : undefined;
+    let url = declared?.trim() ?? '';
+    if (url) {
+        // npm shorthands, either "user/repo" or "<host>:user/repo"
+        if (/^[\w.-]+\/[\w.-]+$/.test(url))
+            url = `${SHORTHAND_REPOSITORY_HOSTS.github}${url}`;
+        const shorthand = /^([a-z]+):([\w.-]+\/[\w.-]+)$/.exec(url);
+        if (shorthand && SHORTHAND_REPOSITORY_HOSTS[shorthand[1]]) {
+            url = `${SHORTHAND_REPOSITORY_HOSTS[shorthand[1]]}${shorthand[2]}`;
+        }
+        url = url.replace(/^git\+/, '').replace(/^(?:git|ssh):\/\/(?:git@)?/, 'https://');
+        const scpLike = /^git@([^:]+):(.+)$/.exec(url);
+        if (scpLike)
+            url = `https://${scpLike[1]}/${scpLike[2]}`;
+        url = url.replace(/\.git$/, '');
+    }
+    if (!/^https?:\/\//.test(url))
+        url = typeof packageJson.homepage === 'string' ? packageJson.homepage.trim() : '';
+    return /^https?:\/\//.test(url) ? url : undefined;
+}
+export function normalizeInventoryPath(inputPath, ownerRoot) {
+    const relativePath = path.relative(ownerRoot, inputPath);
+    if (relativePath === '' || relativePath === '.')
+        return '.';
+    if (relativePath === '..' || relativePath.startsWith(`..${path.sep}`) || path.isAbsolute(relativePath)) {
+        return '<outside package root>';
+    }
+    return relativePath.split(path.sep).join('/');
+}
+async function readPackageJson(packageRoot) {
+    return JSON.parse(await readFile(path.join(packageRoot, 'package.json'), 'utf8'));
+}
+function asLicenseString(license) {
+    if (typeof license === 'string')
+        return license;
+    // npm deprecated { type, url } and arrays of it long ago, but older packages are still published with them
+    if (Array.isArray(license)) {
+        const choices = license.map(asLicenseString).filter((choice) => choice !== undefined);
+        if (!choices.length)
+            return undefined;
+        return choices.length === 1 ? choices[0] : `(${choices.join(' OR ')})`; // An array offers a choice of licenses
+    }
+    if (license && typeof license === 'object')
+        return asLicenseString(license.type);
+    return undefined;
+}
+/** Reads a package's license, preferring the current field over the deprecated plural one */
+function declaredLicenseOf(packageJson) {
+    return (asLicenseString(packageJson.license) ??
+        asLicenseString(packageJson.licenses) ??
+        // Only for packages declaring nothing at all, so this can never override what a package says about itself
+        knownPackageLicense(packageJson.name, packageJson.version));
+}
+async function readManifestLicense(moduleDir) {
+    try {
+        const manifest = JSON.parse(await readFile(path.join(moduleDir, 'companion', 'manifest.json'), 'utf8'));
+        return manifest.license;
+    }
+    catch {
+        return undefined; // Modules without a readable manifest fall back to the package.json license
+    }
+}
+async function findPackageRoot(inputPath, moduleDir) {
+    const nodeModulesDir = path.join(moduleDir, 'node_modules');
+    if (!inputPath.startsWith(`${nodeModulesDir}${path.sep}`))
+        return undefined;
+    // A package owns everything below the directory node_modules resolves it to. Its own subdirectories can hold a
+    // package.json marking their module type, sometimes with a name and version, so only this boundary identifies it.
+    const segments = inputPath.split(path.sep);
+    const rootIndex = segments.lastIndexOf('node_modules') + 1;
+    const packageRoot = segments
+        .slice(0, segments[rootIndex]?.startsWith('@') ? rootIndex + 2 : rootIndex + 1)
+        .join(path.sep);
+    try {
+        await readPackageJson(packageRoot);
+        return packageRoot;
+    }
+    catch {
+        return undefined; // Without a package.json this is not a package, so the file counts as project code
+    }
+}
+function getContributingInputs(metafile) {
+    const inputs = new Set();
+    for (const [outputPath, output] of Object.entries(metafile.outputs)) {
+        if (!outputPath.endsWith('.js'))
+            continue;
+        for (const [inputPath, input] of Object.entries(output.inputs)) {
+            if (input.bytesInOutput > 0)
+                inputs.add(inputPath);
+        }
+    }
+    return [...inputs];
+}
+function packageFromJson(kind, packageRoot, packageJson) {
+    return {
+        kind,
+        name: packageJson.name ?? path.basename(packageRoot),
+        version: packageJson.version,
+        declaredLicense: declaredLicenseOf(packageJson),
+        repositoryUrl: normalizeRepositoryUrl(packageJson),
+        packageRoot,
+        contributingPaths: new Set(),
+    };
+}
+export async function collectInstalledPackages(nodeModulesDir) {
+    const packages = [];
+    async function scan(currentNodeModulesDir) {
+        let entries;
+        try {
+            entries = await readdir(currentNodeModulesDir, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
+            if (entry.name === '.bin' || entry.isSymbolicLink())
+                continue;
+            if (entry.name.startsWith('@')) {
+                if (!entry.isDirectory())
+                    continue;
+                await scanScopedPackages(path.join(currentNodeModulesDir, entry.name));
+                continue;
+            }
+            if (!entry.isDirectory())
+                continue;
+            await scanPackage(path.join(currentNodeModulesDir, entry.name));
+        }
+    }
+    async function scanScopedPackages(scopeDir) {
+        const entries = await readdir(scopeDir, { withFileTypes: true });
+        for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
+            if (entry.isDirectory() && !entry.isSymbolicLink())
+                await scanPackage(path.join(scopeDir, entry.name));
+        }
+    }
+    async function scanPackage(packageRoot) {
+        try {
+            packages.push(packageFromJson('external', packageRoot, await readPackageJson(packageRoot)));
+        }
+        catch {
+            return;
+        }
+        await scan(path.join(packageRoot, 'node_modules'));
+    }
+    await scan(nodeModulesDir);
+    return packages;
+}
+const MAX_LEGAL_FILE_SIZE = 1024 * 1024;
+export function normalizeLegalText(content) {
+    return content.replace(/\r\n/g, '\n').trim();
+}
+function sha256(content) {
+    return createHash('sha256').update(content).digest('hex');
+}
+function isPathInside(childPath, parentPath) {
+    const relativePath = path.relative(parentPath, childPath);
+    return (relativePath === '' ||
+        (!relativePath.startsWith(`..${path.sep}`) && relativePath !== '..' && !path.isAbsolute(relativePath)));
+}
+function legalRole(filename) {
+    if (/^(license|licence|copying)/i.test(filename))
+        return 'license';
+    if (/^notice/i.test(filename))
+        return 'notice';
+    return undefined;
+}
+async function readLegalText(filePath, packageRoot, role) {
+    const linkStat = await lstat(filePath);
+    if (linkStat.isSymbolicLink())
+        return undefined;
+    const fileStat = await stat(filePath);
+    if (!fileStat.isFile() || fileStat.size > MAX_LEGAL_FILE_SIZE)
+        return undefined;
+    const rawContent = await readFile(filePath, 'utf8');
+    if (rawContent.includes('\0'))
+        return undefined;
+    const content = normalizeLegalText(rawContent);
+    if (!content)
+        return undefined;
+    return { role, filename: normalizeInventoryPath(filePath, packageRoot), content, sha256: sha256(content) };
+}
+function sourceLoader(filename) {
+    switch (path.extname(filename).toLowerCase()) {
+        case '.js':
+        case '.mjs':
+        case '.cjs':
+            return 'js';
+        case '.ts':
+            return 'ts';
+        case '.tsx':
+            return 'tsx';
+        default:
+            return undefined;
+    }
+}
+export async function collectPackageLegalMaterial(packageInfo) {
+    const diagnostics = [];
+    const candidateFiles = new Map();
+    for (const entry of await readdir(packageInfo.packageRoot, { withFileTypes: true })) {
+        if (!entry.isFile())
+            continue;
+        const role = legalRole(entry.name);
+        if (role)
+            candidateFiles.set(entry.name, role);
+    }
+    const seeLicenseMatch = /^SEE LICENSE IN (.+)$/i.exec(packageInfo.declaredLicense ?? '');
+    if (seeLicenseMatch) {
+        const explicitPath = path.resolve(packageInfo.packageRoot, seeLicenseMatch[1]);
+        if (!isPathInside(explicitPath, packageInfo.packageRoot)) {
+            diagnostics.push(`Ignoring license file outside package root: ${seeLicenseMatch[1]}`);
+        }
+        else {
+            candidateFiles.set(normalizeInventoryPath(explicitPath, packageInfo.packageRoot), 'license');
+        }
+    }
+    const legalTexts = [];
+    for (const [filename, role] of [...candidateFiles.entries()].sort(([a], [b]) => a.localeCompare(b))) {
+        try {
+            const legalText = await readLegalText(path.join(packageInfo.packageRoot, filename), packageInfo.packageRoot, role);
+            if (legalText)
+                legalTexts.push(legalText);
+            else
+                diagnostics.push(`Ignoring unreadable, binary, or oversized legal file: ${filename}`);
+        }
+        catch {
+            diagnostics.push(`Ignoring unreadable legal file: ${filename}`);
+        }
+    }
+    if (!legalTexts.some((text) => text.role === 'license')) {
+        for (const sourcePath of [...packageInfo.contributingPaths].sort()) {
+            const loader = sourceLoader(sourcePath);
+            if (!loader) {
+                diagnostics.push(`Ignoring unsupported source file for legal comments: ${sourcePath}`);
+                continue;
+            }
+            try {
+                const source = await readFile(path.join(packageInfo.packageRoot, sourcePath), 'utf8');
+                const result = await esbuild.transform(source, { loader, legalComments: 'external' });
+                if (result.legalComments) {
+                    const content = normalizeLegalText(result.legalComments);
+                    if (content) {
+                        legalTexts.push({
+                            role: 'source-comment',
+                            filename: sourcePath,
+                            content,
+                            sha256: sha256(content),
+                        });
+                    }
+                }
+            }
+            catch {
+                diagnostics.push(`Ignoring unreadable source file for legal comments: ${sourcePath}`);
+            }
+        }
+    }
+    const uniqueTexts = new Map();
+    for (const legalText of legalTexts) {
+        const key = legalText.role === 'source-comment'
+            ? `${legalText.role}:${legalText.sha256}`
+            : `${legalText.role}:${legalText.filename}:${legalText.sha256}`;
+        uniqueTexts.set(key, legalText);
+    }
+    return { package: { ...packageInfo, legalTexts: [...uniqueTexts.values()] }, diagnostics };
+}
+function comparePackages(a, b) {
+    if (a.kind === 'project' && b.kind !== 'project')
+        return -1;
+    if (a.kind !== 'project' && b.kind === 'project')
+        return 1;
+    return a.name.localeCompare(b.name) || (a.version ?? '').localeCompare(b.version ?? '');
+}
+function packageName(packageInfo) {
+    return packageInfo.version ? `${packageInfo.name}@${packageInfo.version}` : packageInfo.name;
+}
+function renderLegalFile(inventory, roles) {
+    const groupedTexts = new Map();
+    for (const packageInfo of inventory.packages) {
+        for (const text of packageInfo.legalTexts) {
+            if (!roles.includes(text.role))
+                continue;
+            const group = groupedTexts.get(text.sha256) ?? { text, packages: new Map() };
+            const packageKey = `${packageInfo.kind === 'project' ? 'project' : 'dependency'}:${packageName(packageInfo)}:${packageInfo.declaredLicense ?? ''}`;
+            group.packages.set(packageKey, packageInfo);
+            groupedTexts.set(text.sha256, group);
+        }
+    }
+    if (!groupedTexts.size)
+        return undefined;
+    const sections = [...groupedTexts.values()].sort((a, b) => comparePackages([...a.packages.values()].sort(comparePackages)[0], [...b.packages.values()].sort(comparePackages)[0]));
+    const separator = '-'.repeat(80);
+    const renderedSections = sections.map((section) => {
+        const packages = [...section.packages.values()].sort(comparePackages);
+        const packageList = packages
+            .map((packageInfo) => {
+            const label = `${packageName(packageInfo)} — ${packageInfo.declaredLicense ?? 'UNKNOWN'}`;
+            // Tells recipients where to obtain the source, which MPL-2.0 and the GPL family require
+            return packageInfo.repositoryUrl ? `${label} (${packageInfo.repositoryUrl})` : label;
+        })
+            .join(', ');
+        return `Packages: ${packageList}\n${separator}\n${normalizeLegalText(section.text.content)}`;
+    });
+    return `${renderedSections.join('\n\n')}\n`;
+}
+export function renderLicenseFile(inventory) {
+    return renderLegalFile(inventory, ['license', 'source-comment']) ?? '';
+}
+export function renderNoticeFile(inventory) {
+    return renderLegalFile(inventory, ['notice']);
+}
+export async function writeLegalArtifacts(outputDir, inventory) {
+    await writeFile(path.join(outputDir, 'LICENSE'), renderLicenseFile(inventory));
+    const notice = renderNoticeFile(inventory);
+    const noticePath = path.join(outputDir, 'NOTICE');
+    if (notice)
+        await writeFile(noticePath, notice);
+    else
+        await rm(noticePath, { force: true });
+}
+const kindPriority = {
+    project: 0,
+    bundled: 1,
+    external: 2,
+};
+export async function createLegalInventory(packages) {
+    const mergedPackages = new Map();
+    for (const packageInfo of packages) {
+        const existing = mergedPackages.get(packageInfo.packageRoot);
+        if (!existing) {
+            mergedPackages.set(packageInfo.packageRoot, {
+                ...packageInfo,
+                contributingPaths: new Set(packageInfo.contributingPaths),
+            });
+            continue;
+        }
+        for (const sourcePath of packageInfo.contributingPaths)
+            existing.contributingPaths.add(sourcePath);
+        if (kindPriority[packageInfo.kind] < kindPriority[existing.kind])
+            existing.kind = packageInfo.kind;
+    }
+    const diagnostics = [];
+    const legalRecords = [];
+    for (const packageInfo of mergedPackages.values()) {
+        const material = await collectPackageLegalMaterial(packageInfo);
+        legalRecords.push(material.package);
+        diagnostics.push(...material.diagnostics);
+    }
+    return { packages: legalRecords, diagnostics };
+}
+export async function analyzeShippedLegalInventory(moduleDir) {
+    const definition = await loadModuleBuildDefinition(moduleDir);
+    const result = await esbuild.build(createEsbuildOptions(definition, {
+        outdir: path.join(moduleDir, '.license-analysis'),
+        write: false,
+        minify: false,
+        sourcemap: false,
+    }));
+    if (!result.metafile)
+        throw new Error('esbuild did not produce a metafile');
+    const metafilePackages = await collectMetafilePackages(moduleDir, result.metafile);
+    const packages = [...metafilePackages.packages];
+    if (definition.externals.length) {
+        const dependencies = await resolveExternalDependencies(moduleDir, definition.externals);
+        packages.push(...(await withInstalledExternalTree(dependencies, collectInstalledPackages)));
+    }
+    const inventory = await createLegalInventory(packages);
+    return { ...inventory, diagnostics: [...metafilePackages.diagnostics, ...inventory.diagnostics] };
+}
+export async function collectMetafilePackages(moduleDir, metafile) {
+    const resolvedModuleDir = await realpath(moduleDir);
+    const projectPackageJson = await readPackageJson(resolvedModuleDir);
+    const packages = new Map();
+    const diagnostics = [];
+    // The manifest license is what the packaged module is distributed as, which is what its dependencies must fit.
+    // package.json only licenses the module's own source, so it is a fallback for modules not declaring the other.
+    const projectLicense = (await readManifestLicense(resolvedModuleDir)) ?? declaredLicenseOf(projectPackageJson);
+    for (const input of getContributingInputs(metafile)) {
+        if (input.startsWith('<')) {
+            diagnostics.push(`Ignoring virtual esbuild input: ${input}`);
+            continue;
+        }
+        const inputPath = path.resolve(resolvedModuleDir, input);
+        if (!isPathInside(inputPath, resolvedModuleDir)) {
+            diagnostics.push(`Ignoring esbuild input outside module directory: ${input}`);
+            continue;
+        }
+        // Resolve ownership using logical node_modules path. Realpath would turn linked
+        // dependencies into paths outside moduleDir and incorrectly classify them as project code.
+        const packageRoot = (await findPackageRoot(inputPath, resolvedModuleDir)) ?? resolvedModuleDir;
+        const packageJson = packageRoot === resolvedModuleDir ? projectPackageJson : await readPackageJson(packageRoot);
+        const kind = packageRoot === resolvedModuleDir ? 'project' : 'bundled';
+        const key = `${kind}:${packageRoot}`;
+        let packageInfo = packages.get(key);
+        if (!packageInfo) {
+            packageInfo = {
+                kind,
+                name: packageJson.name ?? path.basename(packageRoot),
+                version: packageJson.version,
+                declaredLicense: kind === 'project' ? asLicenseString(projectLicense) : declaredLicenseOf(packageJson),
+                sourceLicense: kind === 'project' ? declaredLicenseOf(projectPackageJson) : undefined,
+                repositoryUrl: normalizeRepositoryUrl(packageJson),
+                packageRoot,
+                contributingPaths: new Set(),
+            };
+            packages.set(key, packageInfo);
+        }
+        packageInfo.contributingPaths.add(normalizeInventoryPath(inputPath, packageRoot));
+    }
+    return { packages: [...packages.values()], diagnostics };
+}

package/dist/scripts/lib/license-warning-util.d.ts

@@ -0,0 +1,27 @@
+import type { LegalInventory, ShippedPackageLegalRecord } from './license-util.js';
+export type ModuleType = 'connection' | 'surface';
+export interface LicensePolicyIssue {
+    packageName: string;
+    packageVersion?: string;
+    packageKind: ShippedPackageLegalRecord['kind'];
+    message: string;
+}
+type LicensePolicyOutput = Pick<NodeJS.WriteStream, 'write'>;
+export declare class LicensePolicyError extends Error {
+    readonly issues: LicensePolicyIssue[];
+    constructor(issues: LicensePolicyIssue[]);
+}
+/** Licenses a module may be declared as, each allowing a different set of dependency licenses */
+export type ProjectLicense = 'MIT' | 'GPL-2.0-only' | 'GPL-3.0-only';
+export declare const SUPPORTED_PROJECT_LICENSES: ProjectLicense[];
+/** Resolve the license the packaged module is distributed under, which selects the policy applied to its dependencies */
+export declare function resolveProjectLicense(inventory: LegalInventory): {
+    declaration: string;
+    license: ProjectLicense | undefined;
+};
+export declare function createLicensePolicyIssues(inventory: LegalInventory): LicensePolicyIssue[];
+export declare function enforceLicensePolicy(inventory: LegalInventory, options?: {
+    ignoreLicenseRules?: boolean;
+    stderr?: LicensePolicyOutput;
+}): void;
+export {};