feat: prepare CASAN paid PoC release package

2026-07-18 00:07:04 +07:00
parent c818eaf8b0
commit 881ee01691
55 changed files with 5992 additions and 44 deletions
@@ -0,0 +1,48 @@
+#!/usr/bin/env node
+// Generate a reproducible third-party inventory from the committed npm lockfile.
+// This is an inventory, not legal advice; every release must regenerate and review it.
+import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+
+const [output = 'docs/commercial/THIRD_PARTY_SOFTWARE.json'] = process.argv.slice(2);
+const lock = JSON.parse(readFileSync('package-lock.json', 'utf8'));
+const exceptionsPath = 'docs/commercial/LICENSE_EXCEPTIONS.json';
+const exceptions = existsSync(exceptionsPath) ? JSON.parse(readFileSync(exceptionsPath, 'utf8')).exceptions ?? {} : {};
+const workspaceLicenses = new Map(Object.entries(lock.packages ?? {})
+  .filter(([path, value]) => path && !path.startsWith('node_modules/') && value && typeof value === 'object' && typeof value.name === 'string')
+  .map(([, value]) => [value.name, typeof value.license === 'string' ? value.license : 'UNKNOWN']));
+const rows = Object.entries(lock.packages ?? {})
+  .filter(([path, value]) => path.startsWith('node_modules/') && value && typeof value === 'object')
+  .map(([path, value]) => {
+    const name = path.slice('node_modules/'.length);
+    const key = `${name}@${String(value.version ?? 'unknown')}`;
+    const declared = typeof value.license === 'string' ? value.license : (workspaceLicenses.get(name) ?? 'UNKNOWN');
+    const exception = exceptions[key];
+    return {
+      name,
+      version: String(value.version ?? 'unknown'),
+      declared_license: declared,
+      license: typeof exception?.reviewed_license === 'string' ? exception.reviewed_license : declared,
+      review_evidence: typeof exception?.evidence === 'string' ? exception.evidence : null,
+      resolved: typeof value.resolved === 'string' ? value.resolved : null,
+      integrity: typeof value.integrity === 'string' ? value.integrity : null,
+    };
+  })
+  .sort((a, b) => a.name.localeCompare(b.name));
+
+const licenses = {};
+for (const row of rows) licenses[row.license] = (licenses[row.license] ?? 0) + 1;
+const inventory = {
+  schema_version: '1.0',
+  generated_from: 'package-lock.json',
+  generated_at: new Date().toISOString(),
+  scope: 'npm dependencies recorded in the root lockfile; Python, container base images, model and dataset licenses require separate release review.',
+  exceptions_source: existsSync(exceptionsPath) ? exceptionsPath : null,
+  package_count: rows.length,
+  licenses,
+  packages: rows,
+};
+const destination = resolve(output);
+mkdirSync(dirname(destination), { recursive: true });
+writeFileSync(destination, `${JSON.stringify(inventory, null, 2)}\n`);
+console.log(`LICENSE_INVENTORY_CREATED path=${output} packages=${rows.length} licenses=${Object.keys(licenses).length}`);