@lp-labs/asset-license-tracker 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Libin Prasanth
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,69 @@
-# Temporary Holding Version
+# @lp-labs/asset-license-tracker
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Create deterministic, machine-readable license metadata reports for assets. All identifiers,
+license labels, restrictions, attribution, and notice text come from the caller; this package ships
+no license corpus, does not reproduce license texts, and does not give legal advice or determine
+license obligations.
+
+## Install and quick start
+
+```sh
+npm install @lp-labs/asset-license-tracker
+```
+
+```js
+import { createAssetLicenseReport, renderExportNotices } from '@lp-labs/asset-license-tracker';
+
+const report = createAssetLicenseReport([
+  {
+    id: 'hero-photo',
+    name: 'Campaign hero photo',
+    license: {
+      id: 'provider-record-42',
+      label: 'Provider-supplied license label',
+      attributionRequired: true,
+      attribution: 'Photo by Example Artist',
+      notice: 'Used under the supplied campaign agreement',
+    },
+    restrictions: ['Do not redistribute the source file'],
+  },
+]);
+console.log(report.restrictions);
+console.log(renderExportNotices(report));
+```
+
+## API and types
+
+- `createAssetLicenseReport(assets, limits?)` validates caller-supplied metadata and returns
+  `AssetLicenseReport` with entries, attributions, restrictions, and export notices.
+- `renderExportNotices(report)` joins only supplied attribution and notice strings, in input order.
+- `LicensedAsset` contains `id`, `name`, `license`, and a list of restriction strings.
+- `AssetLicenseMetadata` contains a caller-defined license `id` and `label`,
+  `attributionRequired`, and optional `attribution` and `notice` text.
+- `LicenseReportLimits` bounds asset count, text length, and restrictions per asset.
+- `LicenseMetadataError` reports invalid records and missing required attribution.
+- Types: `AssetLicenseReport`, `LicenseReportEntry`, and the input/limit types above.
+
+Default limits are 10,000 assets, 4,096 characters per text value, and 100 restrictions per asset.
+Limits must be positive safe integers. Identifiers must be unique within one report. A
+`attributionRequired` flag is merely reported from caller data; the package does not determine
+whether that assertion is correct, interpret restrictions, fetch terms, or verify permissions.
+Keep source metadata and any legal review in your own system of record.
+Report construction and notice rendering are linear in the asset, restriction, and supplied text
+size, bounded by the configured capacities.
+
+## Module formats and customization
+
+ESM, CommonJS, and TypeScript declarations are included. CommonJS:
+`const { createAssetLicenseReport } = require('@lp-labs/asset-license-tracker')`. Extend the
+caller-owned metadata model in your application and map it into `LicensedAsset`; this API rejects
+unknown fields rather than guessing their meaning. No full license text is bundled. There are no
+runtime or peer dependencies; TypeScript and Prettier are development-only.
+
+## Support
+
+If this library is useful to you, consider supporting its maintenance with a [donation via PayPal](https://www.paypal.me/LibinPrasanth).
+
+## Author
+
+Created by [Libin Prasanth](https://www.linkedin.com/in/libinprasanth/). Connect on LinkedIn for updates and discussion.

package/dist/cjs/index.d.ts

@@ -0,0 +1,49 @@
+export interface AssetLicenseMetadata {
+    readonly id: string;
+    readonly label: string;
+    readonly attributionRequired: boolean;
+    readonly attribution?: string;
+    readonly notice?: string;
+}
+export interface LicensedAsset {
+    readonly id: string;
+    readonly name: string;
+    readonly license: AssetLicenseMetadata;
+    readonly restrictions: readonly string[];
+}
+export interface LicenseReportLimits {
+    readonly maxAssets?: number;
+    readonly maxTextLength?: number;
+    readonly maxRestrictionsPerAsset?: number;
+}
+export interface LicenseReportEntry {
+    readonly assetId: string;
+    readonly assetName: string;
+    readonly licenseId: string;
+    readonly licenseLabel: string;
+    readonly attributionRequired: boolean;
+    readonly attribution?: string;
+    readonly restrictions: readonly string[];
+    readonly notice?: string;
+}
+export interface AssetLicenseReport {
+    readonly assetCount: number;
+    readonly entries: readonly LicenseReportEntry[];
+    readonly attributions: readonly {
+        readonly assetId: string;
+        readonly text: string;
+    }[];
+    readonly restrictions: readonly {
+        readonly assetId: string;
+        readonly text: string;
+    }[];
+    readonly notices: readonly {
+        readonly assetId: string;
+        readonly text: string;
+    }[];
+}
+export declare class LicenseMetadataError extends Error {
+    constructor(message: string);
+}
+export declare function createAssetLicenseReport(assets: readonly LicensedAsset[], inputLimits?: LicenseReportLimits): AssetLicenseReport;
+export declare function renderExportNotices(report: AssetLicenseReport): string;

package/dist/cjs/index.js

@@ -0,0 +1,206 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LicenseMetadataError = void 0;
+exports.createAssetLicenseReport = createAssetLicenseReport;
+exports.renderExportNotices = renderExportNotices;
+class LicenseMetadataError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'LicenseMetadataError';
+    }
+}
+exports.LicenseMetadataError = LicenseMetadataError;
+const defaults = {
+    maxAssets: 10_000,
+    maxTextLength: 4_096,
+    maxRestrictionsPerAsset: 100,
+};
+const assetKeys = new Set(['id', 'name', 'license', 'restrictions']);
+const licenseKeys = new Set(['id', 'label', 'attributionRequired', 'attribution', 'notice']);
+function assertRecord(value, label, allowed, required) {
+    if (value === null ||
+        typeof value !== 'object' ||
+        Array.isArray(value) ||
+        (Object.getPrototypeOf(value) !== Object.prototype && Object.getPrototypeOf(value) !== null)) {
+        throw new LicenseMetadataError(`${label} must be a plain record.`);
+    }
+    for (const key of Reflect.ownKeys(value)) {
+        const descriptor = Object.getOwnPropertyDescriptor(value, key);
+        if (typeof key !== 'string' ||
+            !allowed.has(key) ||
+            !descriptor.enumerable ||
+            !('value' in descriptor)) {
+            throw new LicenseMetadataError(`${label} has an unknown or non-data field.`);
+        }
+    }
+    if (required.some((key) => !Object.hasOwn(value, key))) {
+        throw new LicenseMetadataError(`${label} is missing a required field.`);
+    }
+}
+function limitsOf(input) {
+    if (input === null || typeof input !== 'object' || Array.isArray(input)) {
+        throw new RangeError('License report limits must be a plain record.');
+    }
+    for (const key of Reflect.ownKeys(input)) {
+        const descriptor = typeof key === 'string' ? Object.getOwnPropertyDescriptor(input, key) : undefined;
+        if (!descriptor ||
+            !['maxAssets', 'maxTextLength', 'maxRestrictionsPerAsset'].includes(key) ||
+            !descriptor.enumerable ||
+            !('value' in descriptor)) {
+            throw new RangeError('License report limits contain unknown fields.');
+        }
+    }
+    const limits = {
+        maxAssets: input.maxAssets ?? defaults.maxAssets,
+        maxTextLength: input.maxTextLength ?? defaults.maxTextLength,
+        maxRestrictionsPerAsset: input.maxRestrictionsPerAsset ?? defaults.maxRestrictionsPerAsset,
+    };
+    for (const [name, value] of Object.entries(limits)) {
+        if (!Number.isSafeInteger(value) || value < 1) {
+            throw new RangeError(`${name} must be a positive safe integer.`);
+        }
+    }
+    return limits;
+}
+function text(value, name, maximum) {
+    if (typeof value !== 'string' || value.trim().length === 0 || value.length > maximum) {
+        throw new LicenseMetadataError(`${name} must be a non-empty string up to ${maximum} characters.`);
+    }
+    return value;
+}
+function optionalText(value, name, maximum) {
+    return value === undefined ? undefined : text(value, name, maximum);
+}
+function validateAsset(value, limits) {
+    assertRecord(value, 'Asset', assetKeys, ['id', 'name', 'license', 'restrictions']);
+    const id = text(value.id, 'asset.id', limits.maxTextLength);
+    const assetName = text(value.name, 'asset.name', limits.maxTextLength);
+    assertRecord(value.license, 'License metadata', licenseKeys, [
+        'id',
+        'label',
+        'attributionRequired',
+    ]);
+    const licenseId = text(value.license.id, 'license.id', limits.maxTextLength);
+    const licenseLabel = text(value.license.label, 'license.label', limits.maxTextLength);
+    if (typeof value.license.attributionRequired !== 'boolean') {
+        throw new LicenseMetadataError('license.attributionRequired must be a boolean.');
+    }
+    const attribution = optionalText(value.license.attribution, 'license.attribution', limits.maxTextLength);
+    const notice = optionalText(value.license.notice, 'license.notice', limits.maxTextLength);
+    if (value.license.attributionRequired && attribution === undefined) {
+        throw new LicenseMetadataError('Required attribution text was not supplied.');
+    }
+    if (!Array.isArray(value.restrictions) ||
+        value.restrictions.length > limits.maxRestrictionsPerAsset) {
+        throw new RangeError('Asset restrictions must be a bounded string array.');
+    }
+    const restrictions = [];
+    for (let index = 0; index < value.restrictions.length; index += 1) {
+        const descriptor = Object.getOwnPropertyDescriptor(value.restrictions, String(index));
+        if (!descriptor || !descriptor.enumerable || !('value' in descriptor)) {
+            throw new LicenseMetadataError('Restrictions must be dense enumerable data values.');
+        }
+        restrictions.push(text(descriptor.value, `restrictions[${index}]`, limits.maxTextLength));
+    }
+    for (const key of Reflect.ownKeys(value.restrictions)) {
+        if (key !== 'length' && (typeof key !== 'string' || !/^(0|[1-9]\d*)$/.test(key))) {
+            throw new LicenseMetadataError('Restrictions cannot have extra properties.');
+        }
+    }
+    if (new Set(restrictions).size !== restrictions.length) {
+        throw new LicenseMetadataError('Duplicate restriction entries are not allowed.');
+    }
+    return {
+        assetId: id,
+        assetName,
+        licenseId,
+        licenseLabel,
+        attributionRequired: value.license.attributionRequired,
+        ...(attribution === undefined ? {} : { attribution }),
+        restrictions,
+        ...(notice === undefined ? {} : { notice }),
+    };
+}
+function createAssetLicenseReport(assets, inputLimits = {}) {
+    if (!Array.isArray(assets))
+        throw new LicenseMetadataError('Assets must be an array.');
+    const limits = limitsOf(inputLimits);
+    if (assets.length > limits.maxAssets)
+        throw new RangeError('Asset count exceeds capacity.');
+    const entries = [];
+    for (let index = 0; index < assets.length; index += 1) {
+        const descriptor = Object.getOwnPropertyDescriptor(assets, String(index));
+        if (!descriptor || !descriptor.enumerable || !('value' in descriptor)) {
+            throw new LicenseMetadataError('Assets must be a dense array of enumerable data values.');
+        }
+        entries.push(validateAsset(descriptor.value, limits));
+    }
+    for (const key of Reflect.ownKeys(assets)) {
+        if (key !== 'length' && (typeof key !== 'string' || !/^(0|[1-9]\d*)$/.test(key))) {
+            throw new LicenseMetadataError('Asset arrays cannot have extra properties.');
+        }
+    }
+    const ids = new Set();
+    for (const entry of entries) {
+        if (ids.has(entry.assetId))
+            throw new LicenseMetadataError(`Duplicate asset id: ${entry.assetId}`);
+        ids.add(entry.assetId);
+    }
+    return {
+        assetCount: entries.length,
+        entries,
+        attributions: entries.flatMap((entry) => entry.attribution === undefined ? [] : [{ assetId: entry.assetId, text: entry.attribution }]),
+        restrictions: entries.flatMap((entry) => entry.restrictions.map((restriction) => ({
+            assetId: entry.assetId,
+            text: restriction,
+        }))),
+        notices: entries.flatMap((entry) => entry.notice === undefined ? [] : [{ assetId: entry.assetId, text: entry.notice }]),
+    };
+}
+function renderExportNotices(report) {
+    assertRecord(report, 'License report', new Set(['assetCount', 'entries', 'attributions', 'restrictions', 'notices']), ['assetCount', 'entries', 'attributions', 'restrictions', 'notices']);
+    if (!Array.isArray(report.entries) ||
+        !Array.isArray(report.attributions) ||
+        !Array.isArray(report.restrictions) ||
+        !Array.isArray(report.notices) ||
+        !Number.isSafeInteger(report.assetCount) ||
+        report.entries.length !== report.assetCount) {
+        throw new LicenseMetadataError('A valid report is required.');
+    }
+    const lines = [];
+    for (let index = 0; index < report.entries.length; index += 1) {
+        const descriptor = Object.getOwnPropertyDescriptor(report.entries, String(index));
+        if (!descriptor || !descriptor.enumerable || !('value' in descriptor)) {
+            throw new LicenseMetadataError('Report entries must be dense enumerable data values.');
+        }
+        const entry = descriptor.value;
+        assertRecord(entry, 'License report entry', new Set([
+            'assetId',
+            'assetName',
+            'licenseId',
+            'licenseLabel',
+            'attributionRequired',
+            'attribution',
+            'restrictions',
+            'notice',
+        ]), ['assetId', 'assetName', 'licenseId', 'licenseLabel', 'attributionRequired', 'restrictions']);
+        if (typeof entry.attributionRequired !== 'boolean' ||
+            typeof entry.assetId !== 'string' ||
+            typeof entry.assetName !== 'string' ||
+            typeof entry.licenseId !== 'string' ||
+            typeof entry.licenseLabel !== 'string' ||
+            !Array.isArray(entry.restrictions)) {
+            throw new LicenseMetadataError('License report entry is malformed.');
+        }
+        const attribution = entry.attribution;
+        const notice = entry.notice;
+        if (entry.attributionRequired && attribution === undefined) {
+            throw new LicenseMetadataError('Required attribution text is missing from this report.');
+        }
+        if (attribution !== undefined)
+            lines.push(text(attribution, 'attribution', Number.MAX_SAFE_INTEGER));
+        if (notice !== undefined)
+            lines.push(text(notice, 'notice', Number.MAX_SAFE_INTEGER));
+    }
+    return lines.join('\n');
+}

package/dist/cjs/package.json

@@ -0,0 +1 @@
+{"type":"commonjs"}

package/dist/esm/index.d.ts

@@ -0,0 +1,49 @@
+export interface AssetLicenseMetadata {
+    readonly id: string;
+    readonly label: string;
+    readonly attributionRequired: boolean;
+    readonly attribution?: string;
+    readonly notice?: string;
+}
+export interface LicensedAsset {
+    readonly id: string;
+    readonly name: string;
+    readonly license: AssetLicenseMetadata;
+    readonly restrictions: readonly string[];
+}
+export interface LicenseReportLimits {
+    readonly maxAssets?: number;
+    readonly maxTextLength?: number;
+    readonly maxRestrictionsPerAsset?: number;
+}
+export interface LicenseReportEntry {
+    readonly assetId: string;
+    readonly assetName: string;
+    readonly licenseId: string;
+    readonly licenseLabel: string;
+    readonly attributionRequired: boolean;
+    readonly attribution?: string;
+    readonly restrictions: readonly string[];
+    readonly notice?: string;
+}
+export interface AssetLicenseReport {
+    readonly assetCount: number;
+    readonly entries: readonly LicenseReportEntry[];
+    readonly attributions: readonly {
+        readonly assetId: string;
+        readonly text: string;
+    }[];
+    readonly restrictions: readonly {
+        readonly assetId: string;
+        readonly text: string;
+    }[];
+    readonly notices: readonly {
+        readonly assetId: string;
+        readonly text: string;
+    }[];
+}
+export declare class LicenseMetadataError extends Error {
+    constructor(message: string);
+}
+export declare function createAssetLicenseReport(assets: readonly LicensedAsset[], inputLimits?: LicenseReportLimits): AssetLicenseReport;
+export declare function renderExportNotices(report: AssetLicenseReport): string;

package/dist/esm/index.js

@@ -0,0 +1,200 @@
+export class LicenseMetadataError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'LicenseMetadataError';
+    }
+}
+const defaults = {
+    maxAssets: 10_000,
+    maxTextLength: 4_096,
+    maxRestrictionsPerAsset: 100,
+};
+const assetKeys = new Set(['id', 'name', 'license', 'restrictions']);
+const licenseKeys = new Set(['id', 'label', 'attributionRequired', 'attribution', 'notice']);
+function assertRecord(value, label, allowed, required) {
+    if (value === null ||
+        typeof value !== 'object' ||
+        Array.isArray(value) ||
+        (Object.getPrototypeOf(value) !== Object.prototype && Object.getPrototypeOf(value) !== null)) {
+        throw new LicenseMetadataError(`${label} must be a plain record.`);
+    }
+    for (const key of Reflect.ownKeys(value)) {
+        const descriptor = Object.getOwnPropertyDescriptor(value, key);
+        if (typeof key !== 'string' ||
+            !allowed.has(key) ||
+            !descriptor.enumerable ||
+            !('value' in descriptor)) {
+            throw new LicenseMetadataError(`${label} has an unknown or non-data field.`);
+        }
+    }
+    if (required.some((key) => !Object.hasOwn(value, key))) {
+        throw new LicenseMetadataError(`${label} is missing a required field.`);
+    }
+}
+function limitsOf(input) {
+    if (input === null || typeof input !== 'object' || Array.isArray(input)) {
+        throw new RangeError('License report limits must be a plain record.');
+    }
+    for (const key of Reflect.ownKeys(input)) {
+        const descriptor = typeof key === 'string' ? Object.getOwnPropertyDescriptor(input, key) : undefined;
+        if (!descriptor ||
+            !['maxAssets', 'maxTextLength', 'maxRestrictionsPerAsset'].includes(key) ||
+            !descriptor.enumerable ||
+            !('value' in descriptor)) {
+            throw new RangeError('License report limits contain unknown fields.');
+        }
+    }
+    const limits = {
+        maxAssets: input.maxAssets ?? defaults.maxAssets,
+        maxTextLength: input.maxTextLength ?? defaults.maxTextLength,
+        maxRestrictionsPerAsset: input.maxRestrictionsPerAsset ?? defaults.maxRestrictionsPerAsset,
+    };
+    for (const [name, value] of Object.entries(limits)) {
+        if (!Number.isSafeInteger(value) || value < 1) {
+            throw new RangeError(`${name} must be a positive safe integer.`);
+        }
+    }
+    return limits;
+}
+function text(value, name, maximum) {
+    if (typeof value !== 'string' || value.trim().length === 0 || value.length > maximum) {
+        throw new LicenseMetadataError(`${name} must be a non-empty string up to ${maximum} characters.`);
+    }
+    return value;
+}
+function optionalText(value, name, maximum) {
+    return value === undefined ? undefined : text(value, name, maximum);
+}
+function validateAsset(value, limits) {
+    assertRecord(value, 'Asset', assetKeys, ['id', 'name', 'license', 'restrictions']);
+    const id = text(value.id, 'asset.id', limits.maxTextLength);
+    const assetName = text(value.name, 'asset.name', limits.maxTextLength);
+    assertRecord(value.license, 'License metadata', licenseKeys, [
+        'id',
+        'label',
+        'attributionRequired',
+    ]);
+    const licenseId = text(value.license.id, 'license.id', limits.maxTextLength);
+    const licenseLabel = text(value.license.label, 'license.label', limits.maxTextLength);
+    if (typeof value.license.attributionRequired !== 'boolean') {
+        throw new LicenseMetadataError('license.attributionRequired must be a boolean.');
+    }
+    const attribution = optionalText(value.license.attribution, 'license.attribution', limits.maxTextLength);
+    const notice = optionalText(value.license.notice, 'license.notice', limits.maxTextLength);
+    if (value.license.attributionRequired && attribution === undefined) {
+        throw new LicenseMetadataError('Required attribution text was not supplied.');
+    }
+    if (!Array.isArray(value.restrictions) ||
+        value.restrictions.length > limits.maxRestrictionsPerAsset) {
+        throw new RangeError('Asset restrictions must be a bounded string array.');
+    }
+    const restrictions = [];
+    for (let index = 0; index < value.restrictions.length; index += 1) {
+        const descriptor = Object.getOwnPropertyDescriptor(value.restrictions, String(index));
+        if (!descriptor || !descriptor.enumerable || !('value' in descriptor)) {
+            throw new LicenseMetadataError('Restrictions must be dense enumerable data values.');
+        }
+        restrictions.push(text(descriptor.value, `restrictions[${index}]`, limits.maxTextLength));
+    }
+    for (const key of Reflect.ownKeys(value.restrictions)) {
+        if (key !== 'length' && (typeof key !== 'string' || !/^(0|[1-9]\d*)$/.test(key))) {
+            throw new LicenseMetadataError('Restrictions cannot have extra properties.');
+        }
+    }
+    if (new Set(restrictions).size !== restrictions.length) {
+        throw new LicenseMetadataError('Duplicate restriction entries are not allowed.');
+    }
+    return {
+        assetId: id,
+        assetName,
+        licenseId,
+        licenseLabel,
+        attributionRequired: value.license.attributionRequired,
+        ...(attribution === undefined ? {} : { attribution }),
+        restrictions,
+        ...(notice === undefined ? {} : { notice }),
+    };
+}
+export function createAssetLicenseReport(assets, inputLimits = {}) {
+    if (!Array.isArray(assets))
+        throw new LicenseMetadataError('Assets must be an array.');
+    const limits = limitsOf(inputLimits);
+    if (assets.length > limits.maxAssets)
+        throw new RangeError('Asset count exceeds capacity.');
+    const entries = [];
+    for (let index = 0; index < assets.length; index += 1) {
+        const descriptor = Object.getOwnPropertyDescriptor(assets, String(index));
+        if (!descriptor || !descriptor.enumerable || !('value' in descriptor)) {
+            throw new LicenseMetadataError('Assets must be a dense array of enumerable data values.');
+        }
+        entries.push(validateAsset(descriptor.value, limits));
+    }
+    for (const key of Reflect.ownKeys(assets)) {
+        if (key !== 'length' && (typeof key !== 'string' || !/^(0|[1-9]\d*)$/.test(key))) {
+            throw new LicenseMetadataError('Asset arrays cannot have extra properties.');
+        }
+    }
+    const ids = new Set();
+    for (const entry of entries) {
+        if (ids.has(entry.assetId))
+            throw new LicenseMetadataError(`Duplicate asset id: ${entry.assetId}`);
+        ids.add(entry.assetId);
+    }
+    return {
+        assetCount: entries.length,
+        entries,
+        attributions: entries.flatMap((entry) => entry.attribution === undefined ? [] : [{ assetId: entry.assetId, text: entry.attribution }]),
+        restrictions: entries.flatMap((entry) => entry.restrictions.map((restriction) => ({
+            assetId: entry.assetId,
+            text: restriction,
+        }))),
+        notices: entries.flatMap((entry) => entry.notice === undefined ? [] : [{ assetId: entry.assetId, text: entry.notice }]),
+    };
+}
+export function renderExportNotices(report) {
+    assertRecord(report, 'License report', new Set(['assetCount', 'entries', 'attributions', 'restrictions', 'notices']), ['assetCount', 'entries', 'attributions', 'restrictions', 'notices']);
+    if (!Array.isArray(report.entries) ||
+        !Array.isArray(report.attributions) ||
+        !Array.isArray(report.restrictions) ||
+        !Array.isArray(report.notices) ||
+        !Number.isSafeInteger(report.assetCount) ||
+        report.entries.length !== report.assetCount) {
+        throw new LicenseMetadataError('A valid report is required.');
+    }
+    const lines = [];
+    for (let index = 0; index < report.entries.length; index += 1) {
+        const descriptor = Object.getOwnPropertyDescriptor(report.entries, String(index));
+        if (!descriptor || !descriptor.enumerable || !('value' in descriptor)) {
+            throw new LicenseMetadataError('Report entries must be dense enumerable data values.');
+        }
+        const entry = descriptor.value;
+        assertRecord(entry, 'License report entry', new Set([
+            'assetId',
+            'assetName',
+            'licenseId',
+            'licenseLabel',
+            'attributionRequired',
+            'attribution',
+            'restrictions',
+            'notice',
+        ]), ['assetId', 'assetName', 'licenseId', 'licenseLabel', 'attributionRequired', 'restrictions']);
+        if (typeof entry.attributionRequired !== 'boolean' ||
+            typeof entry.assetId !== 'string' ||
+            typeof entry.assetName !== 'string' ||
+            typeof entry.licenseId !== 'string' ||
+            typeof entry.licenseLabel !== 'string' ||
+            !Array.isArray(entry.restrictions)) {
+            throw new LicenseMetadataError('License report entry is malformed.');
+        }
+        const attribution = entry.attribution;
+        const notice = entry.notice;
+        if (entry.attributionRequired && attribution === undefined) {
+            throw new LicenseMetadataError('Required attribution text is missing from this report.');
+        }
+        if (attribution !== undefined)
+            lines.push(text(attribution, 'attribution', Number.MAX_SAFE_INTEGER));
+        if (notice !== undefined)
+            lines.push(text(notice, 'notice', Number.MAX_SAFE_INTEGER));
+    }
+    return lines.join('\n');
+}

package/package.json

@@ -1,6 +1,63 @@
 {
   "name": "@lp-labs/asset-license-tracker",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "Caller-supplied asset license metadata and deterministic export notices.",
+  "license": "MIT",
+  "type": "module",
+  "main": "./dist/cjs/index.js",
+  "module": "./dist/esm/index.js",
+  "types": "./dist/esm/index.d.ts",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/esm/index.d.ts",
+        "default": "./dist/esm/index.js"
+      },
+      "require": {
+        "types": "./dist/cjs/index.d.ts",
+        "default": "./dist/cjs/index.js"
+      }
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "sideEffects": false,
+  "engines": {
+    "node": "\u003e=18"
+  },
+  "scripts": {
+    "build": "node scripts/build.mjs",
+    "typecheck": "npm run build \u0026\u0026 node scripts/check-types.mjs",
+    "test": "npm run build \u0026\u0026 node --test tests/*.test.mjs",
+    "format": "prettier --write src scripts tests *.json README.md",
+    "format:check": "prettier --check src scripts tests *.json README.md",
+    "prepack": "npm run build"
+  },
+  "devDependencies": {
+    "typescript": "^5.9.3",
+    "prettier": "^3.6.2"
+  },
+  "prettier": {
+    "singleQuote": true,
+    "semi": true,
+    "trailingComma": "all",
+    "printWidth": 100,
+    "endOfLine": "lf"
+  },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "author": {
+    "name": "Libin Prasanth",
+    "url": "https://www.linkedin.com/in/libinprasanth/"
+  },
+  "funding": {
+    "type": "paypal",
+    "url": "https://www.paypal.me/LibinPrasanth"
+  }
+}