Skip to content

Commit 8f29d65

Browse files
cameroncookecameroncooke
committed
Add third-party package license docs
1 parent 95da278 commit 8f29d65

File tree

4 files changed

+240
-0
lines changed

4 files changed

+240
-0
lines changed

‎README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -369,3 +369,4 @@ The CLI uses a per-workspace daemon for stateful operations (log capture, debugg
369369

370370
This project is licensed under the MIT License - see the [LICENSE](LICENSE) file for details.
371371
Third-party licensing notices (including AXe and Meta's IDB MIT attributions) are in [THIRD_PARTY_LICENSES](THIRD_PARTY_LICENSES).
372+
Generated production npm package attributions are in [THIRD_PARTY_PACKAGE_LICENSES](THIRD_PARTY_PACKAGE_LICENSES.md) (refresh with `npm run license:report`).

‎THIRD_PARTY_PACKAGE_LICENSES.md‎

Lines changed: 198 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,198 @@
1+
# Third-Party Package Licenses
2+
3+
Generated at: 2026-03-04T09:40:24.809Z
4+
5+
This file is generated from production npm dependencies.
6+
7+
| Package | License | Repository |
8+
| --- | --- | --- |
9+
| @apm-js-collab/code-transformer@0.8.2 | Apache-2.0 | https://github.com/apm-js-collab/orchestrion-js |
10+
| @apm-js-collab/tracing-hooks@0.3.1 | Apache-2.0 | https://github.com/apm-js-collab/tracing-hooks |
11+
| @clack/core@1.0.1 | MIT | https://github.com/bombshell-dev/clack |
12+
| @clack/prompts@1.0.1 | MIT | https://github.com/bombshell-dev/clack |
13+
| @hono/node-server@1.19.9 | MIT | https://github.com/honojs/node-server |
14+
| @modelcontextprotocol/sdk@1.26.0 | MIT | https://github.com/modelcontextprotocol/typescript-sdk |
15+
| @opentelemetry/api-logs@0.207.0 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-js |
16+
| @opentelemetry/api-logs@0.211.0 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-js |
17+
| @opentelemetry/api@1.9.0 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-js |
18+
| @opentelemetry/context-async-hooks@2.5.0 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-js |
19+
| @opentelemetry/core@2.5.0 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-js |
20+
| @opentelemetry/instrumentation-amqplib@0.58.0 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-js-contrib |
21+
| @opentelemetry/instrumentation-connect@0.54.0 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-js-contrib |
22+
| @opentelemetry/instrumentation-dataloader@0.28.0 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-js-contrib |
23+
| @opentelemetry/instrumentation-express@0.59.0 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-js-contrib |
24+
| @opentelemetry/instrumentation-fs@0.30.0 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-js-contrib |
25+
| @opentelemetry/instrumentation-generic-pool@0.54.0 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-js-contrib |
26+
| @opentelemetry/instrumentation-graphql@0.58.0 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-js-contrib |
27+
| @opentelemetry/instrumentation-hapi@0.57.0 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-js-contrib |
28+
| @opentelemetry/instrumentation-http@0.211.0 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-js |
29+
| @opentelemetry/instrumentation-ioredis@0.59.0 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-js-contrib |
30+
| @opentelemetry/instrumentation-kafkajs@0.20.0 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-js-contrib |
31+
| @opentelemetry/instrumentation-knex@0.55.0 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-js-contrib |
32+
| @opentelemetry/instrumentation-koa@0.59.0 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-js-contrib |
33+
| @opentelemetry/instrumentation-lru-memoizer@0.55.0 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-js-contrib |
34+
| @opentelemetry/instrumentation-mongodb@0.64.0 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-js-contrib |
35+
| @opentelemetry/instrumentation-mongoose@0.57.0 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-js-contrib |
36+
| @opentelemetry/instrumentation-mysql@0.57.0 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-js-contrib |
37+
| @opentelemetry/instrumentation-mysql2@0.57.0 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-js-contrib |
38+
| @opentelemetry/instrumentation-pg@0.63.0 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-js-contrib |
39+
| @opentelemetry/instrumentation-redis@0.59.0 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-js-contrib |
40+
| @opentelemetry/instrumentation-tedious@0.30.0 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-js-contrib |
41+
| @opentelemetry/instrumentation-undici@0.21.0 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-js-contrib |
42+
| @opentelemetry/instrumentation@0.207.0 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-js |
43+
| @opentelemetry/instrumentation@0.211.0 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-js |
44+
| @opentelemetry/redis-common@0.38.2 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-js-contrib |
45+
| @opentelemetry/resources@2.5.0 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-js |
46+
| @opentelemetry/sdk-trace-base@2.5.0 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-js |
47+
| @opentelemetry/semantic-conventions@1.39.0 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-js |
48+
| @opentelemetry/sql-common@0.41.2 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-js-contrib |
49+
| @prisma/instrumentation@7.2.0 | Apache-2.0 | https://github.com/prisma/prisma |
50+
| @sentry/cli-darwin@3.1.0 | FSL-1.1-MIT | https://github.com/getsentry/sentry-cli |
51+
| @sentry/cli@3.1.0 | FSL-1.1-MIT | https://github.com/getsentry/sentry-cli |
52+
| @sentry/core@10.38.0 | MIT | https://github.com/getsentry/sentry-javascript |
53+
| @sentry/node-core@10.38.0 | MIT | https://github.com/getsentry/sentry-javascript |
54+
| @sentry/node@10.38.0 | MIT | https://github.com/getsentry/sentry-javascript |
55+
| @sentry/opentelemetry@10.38.0 | MIT | https://github.com/getsentry/sentry-javascript |
56+
| @types/connect@3.4.38 | MIT | https://github.com/DefinitelyTyped/DefinitelyTyped |
57+
| @types/mysql@2.15.27 | MIT | https://github.com/DefinitelyTyped/DefinitelyTyped |
58+
| @types/node@22.17.1 | MIT | https://github.com/DefinitelyTyped/DefinitelyTyped |
59+
| @types/pg-pool@2.0.7 | MIT | https://github.com/DefinitelyTyped/DefinitelyTyped |
60+
| @types/pg@8.15.6 | MIT | https://github.com/DefinitelyTyped/DefinitelyTyped |
61+
| @types/tedious@4.0.14 | MIT | https://github.com/DefinitelyTyped/DefinitelyTyped |
62+
| accepts@2.0.0 | MIT | https://github.com/jshttp/accepts |
63+
| acorn-import-attributes@1.9.5 | MIT | https://github.com/xtuc/acorn-import-attributes |
64+
| acorn@8.15.0 | MIT | https://github.com/acornjs/acorn |
65+
| ajv-formats@3.0.1 | MIT | https://github.com/ajv-validator/ajv-formats |
66+
| ajv@8.18.0 | MIT | https://github.com/ajv-validator/ajv |
67+
| ansi-regex@5.0.1 | MIT | https://github.com/chalk/ansi-regex |
68+
| ansi-styles@4.3.0 | MIT | https://github.com/chalk/ansi-styles |
69+
| balanced-match@4.0.4 | MIT | https://github.com/juliangruber/balanced-match |
70+
| big-integer@1.6.52 | Unlicense | https://github.com/peterolson/BigInteger.js |
71+
| body-parser@2.2.1 | MIT | https://github.com/expressjs/body-parser |
72+
| bplist-parser@0.3.2 | MIT | https://github.com/nearinfinity/node-bplist-parser |
73+
| brace-expansion@5.0.3 | MIT | https://github.com/juliangruber/brace-expansion |
74+
| bytes@3.1.2 | MIT | https://github.com/visionmedia/bytes.js |
75+
| call-bind-apply-helpers@1.0.2 | MIT | https://github.com/ljharb/call-bind-apply-helpers |
76+
| call-bound@1.0.4 | MIT | https://github.com/ljharb/call-bound |
77+
| chokidar@5.0.0 | MIT | https://github.com/paulmillr/chokidar |
78+
| cjs-module-lexer@2.2.0 | MIT | https://github.com/nodejs/cjs-module-lexer |
79+
| cliui@8.0.1 | ISC | https://github.com/yargs/cliui |
80+
| color-convert@2.0.1 | MIT | https://github.com/Qix-/color-convert |
81+
| color-name@1.1.4 | MIT | https://github.com/colorjs/color-name |
82+
| content-disposition@1.0.0 | MIT | https://github.com/jshttp/content-disposition |
83+
| content-type@1.0.5 | MIT | https://github.com/jshttp/content-type |
84+
| cookie-signature@1.2.2 | MIT | https://github.com/visionmedia/node-cookie-signature |
85+
| cookie@0.7.2 | MIT | https://github.com/jshttp/cookie |
86+
| cors@2.8.5 | MIT | https://github.com/expressjs/cors |
87+
| cross-spawn@7.0.6 | MIT | https://github.com/moxystudio/node-cross-spawn |
88+
| debug@4.4.3 | MIT | https://github.com/debug-js/debug |
89+
| depd@2.0.0 | MIT | https://github.com/dougwilson/nodejs-depd |
90+
| dunder-proto@1.0.1 | MIT | https://github.com/es-shims/dunder-proto |
91+
| ee-first@1.1.1 | MIT | https://github.com/jonathanong/ee-first |
92+
| emoji-regex@8.0.0 | MIT | https://github.com/mathiasbynens/emoji-regex |
93+
| encodeurl@2.0.0 | MIT | https://github.com/pillarjs/encodeurl |
94+
| es-define-property@1.0.1 | MIT | https://github.com/ljharb/es-define-property |
95+
| es-errors@1.3.0 | MIT | https://github.com/ljharb/es-errors |
96+
| es-object-atoms@1.1.1 | MIT | https://github.com/ljharb/es-object-atoms |
97+
| escalade@3.2.0 | MIT | https://github.com/lukeed/escalade |
98+
| escape-html@1.0.3 | MIT | https://github.com/component/escape-html |
99+
| etag@1.8.1 | MIT | https://github.com/jshttp/etag |
100+
| eventsource-parser@3.0.3 | MIT | https://github.com/rexxars/eventsource-parser |
101+
| eventsource@3.0.7 | MIT | git://git@github.com/EventSource/eventsource |
102+
| express-rate-limit@8.2.1 | MIT | https://github.com/express-rate-limit/express-rate-limit |
103+
| express@5.2.1 | MIT | https://github.com/expressjs/express |
104+
| fast-deep-equal@3.1.3 | MIT | https://github.com/epoberezkin/fast-deep-equal |
105+
| fast-uri@3.1.0 | BSD-3-Clause | https://github.com/fastify/fast-uri |
106+
| finalhandler@2.1.0 | MIT | https://github.com/pillarjs/finalhandler |
107+
| forwarded-parse@2.1.2 | MIT | https://github.com/lpinca/forwarded-parse |
108+
| forwarded@0.2.0 | MIT | https://github.com/jshttp/forwarded |
109+
| fresh@2.0.0 | MIT | https://github.com/jshttp/fresh |
110+
| function-bind@1.1.2 | MIT | https://github.com/Raynos/function-bind |
111+
| get-caller-file@2.0.5 | ISC | https://github.com/stefanpenner/get-caller-file |
112+
| get-intrinsic@1.3.0 | MIT | https://github.com/ljharb/get-intrinsic |
113+
| get-proto@1.0.1 | MIT | https://github.com/ljharb/get-proto |
114+
| gopd@1.2.0 | MIT | https://github.com/ljharb/gopd |
115+
| has-symbols@1.1.0 | MIT | https://github.com/inspect-js/has-symbols |
116+
| hasown@2.0.2 | MIT | https://github.com/inspect-js/hasOwn |
117+
| hono@4.12.3 | MIT | https://github.com/honojs/hono |
118+
| http-errors@2.0.1 | MIT | https://github.com/jshttp/http-errors |
119+
| iconv-lite@0.7.0 | MIT | https://github.com/pillarjs/iconv-lite |
120+
| import-in-the-middle@2.0.6 | Apache-2.0 | https://github.com/nodejs/import-in-the-middle |
121+
| inherits@2.0.4 | ISC | https://github.com/isaacs/inherits |
122+
| ip-address@10.0.1 | MIT | https://github.com/beaugunderson/ip-address |
123+
| ipaddr.js@1.9.1 | MIT | https://github.com/whitequark/ipaddr.js |
124+
| is-fullwidth-code-point@3.0.0 | MIT | https://github.com/sindresorhus/is-fullwidth-code-point |
125+
| is-promise@4.0.0 | MIT | https://github.com/then/is-promise |
126+
| isexe@2.0.0 | ISC | https://github.com/isaacs/isexe |
127+
| jose@6.1.3 | MIT | https://github.com/panva/jose |
128+
| json-schema-traverse@1.0.0 | MIT | https://github.com/epoberezkin/json-schema-traverse |
129+
| json-schema-typed@8.0.2 | BSD-2-Clause | https://github.com/RemyRylan/json-schema-typed |
130+
| math-intrinsics@1.1.0 | MIT | https://github.com/es-shims/math-intrinsics |
131+
| media-typer@1.1.0 | MIT | https://github.com/jshttp/media-typer |
132+
| merge-descriptors@2.0.0 | MIT | https://github.com/sindresorhus/merge-descriptors |
133+
| mime-db@1.54.0 | MIT | https://github.com/jshttp/mime-db |
134+
| mime-types@3.0.1 | MIT | https://github.com/jshttp/mime-types |
135+
| minimatch@9.0.7 | ISC | https://github.com/isaacs/minimatch |
136+
| module-details-from-path@1.0.4 | MIT | https://github.com/watson/module-details-from-path |
137+
| ms@2.1.3 | MIT | https://github.com/vercel/ms |
138+
| negotiator@1.0.0 | MIT | https://github.com/jshttp/negotiator |
139+
| object-assign@4.1.1 | MIT | https://github.com/sindresorhus/object-assign |
140+
| object-inspect@1.13.4 | MIT | https://github.com/inspect-js/object-inspect |
141+
| on-finished@2.4.1 | MIT | https://github.com/jshttp/on-finished |
142+
| once@1.4.0 | ISC | https://github.com/isaacs/once |
143+
| parseurl@1.3.3 | MIT | https://github.com/pillarjs/parseurl |
144+
| path-key@3.1.1 | MIT | https://github.com/sindresorhus/path-key |
145+
| path-to-regexp@8.2.0 | MIT | https://github.com/pillarjs/path-to-regexp |
146+
| pg-int8@1.0.1 | ISC | https://github.com/charmander/pg-int8 |
147+
| pg-protocol@1.11.0 | MIT | https://github.com/brianc/node-postgres |
148+
| pg-types@2.2.0 | MIT | https://github.com/brianc/node-pg-types |
149+
| picocolors@1.1.1 | ISC | https://github.com/alexeyraspopov/picocolors |
150+
| pkce-challenge@5.0.0 | MIT | https://github.com/crouchcd/pkce-challenge |
151+
| postgres-array@2.0.0 | MIT | https://github.com/bendrucker/postgres-array |
152+
| postgres-bytea@1.0.1 | MIT | https://github.com/bendrucker/postgres-bytea |
153+
| postgres-date@1.0.7 | MIT | https://github.com/bendrucker/postgres-date |
154+
| postgres-interval@1.2.0 | MIT | https://github.com/bendrucker/postgres-interval |
155+
| progress@2.0.3 | MIT | https://github.com/visionmedia/node-progress |
156+
| proxy-addr@2.0.7 | MIT | https://github.com/jshttp/proxy-addr |
157+
| proxy-from-env@1.1.0 | MIT | https://github.com/Rob--W/proxy-from-env |
158+
| qs@6.14.2 | BSD-3-Clause | https://github.com/ljharb/qs |
159+
| range-parser@1.2.1 | MIT | https://github.com/jshttp/range-parser |
160+
| raw-body@3.0.2 | MIT | https://github.com/stream-utils/raw-body |
161+
| readdirp@5.0.0 | MIT | https://github.com/paulmillr/readdirp |
162+
| require-directory@2.1.1 | MIT | https://github.com/troygoode/node-require-directory |
163+
| require-from-string@2.0.2 | MIT | https://github.com/floatdrop/require-from-string |
164+
| require-in-the-middle@8.0.1 | MIT | https://github.com/nodejs/require-in-the-middle |
165+
| router@2.2.0 | MIT | https://github.com/pillarjs/router |
166+
| safe-buffer@5.2.1 | MIT | https://github.com/feross/safe-buffer |
167+
| safer-buffer@2.1.2 | MIT | https://github.com/ChALkeR/safer-buffer |
168+
| send@1.2.0 | MIT | https://github.com/pillarjs/send |
169+
| serve-static@2.2.0 | MIT | https://github.com/expressjs/serve-static |
170+
| setprototypeof@1.2.0 | ISC | https://github.com/wesleytodd/setprototypeof |
171+
| shebang-command@2.0.0 | MIT | https://github.com/kevva/shebang-command |
172+
| shebang-regex@3.0.0 | MIT | https://github.com/sindresorhus/shebang-regex |
173+
| side-channel-list@1.0.0 | MIT | https://github.com/ljharb/side-channel-list |
174+
| side-channel-map@1.0.1 | MIT | https://github.com/ljharb/side-channel-map |
175+
| side-channel-weakmap@1.0.2 | MIT | https://github.com/ljharb/side-channel-weakmap |
176+
| side-channel@1.1.0 | MIT | https://github.com/ljharb/side-channel |
177+
| sisteransi@1.0.5 | MIT | https://github.com/terkelg/sisteransi |
178+
| statuses@2.0.2 | MIT | https://github.com/jshttp/statuses |
179+
| string-width@4.2.3 | MIT | https://github.com/sindresorhus/string-width |
180+
| strip-ansi@6.0.1 | MIT | https://github.com/chalk/strip-ansi |
181+
| toidentifier@1.0.1 | MIT | https://github.com/component/toidentifier |
182+
| type-is@2.0.1 | MIT | https://github.com/jshttp/type-is |
183+
| undici-types@6.21.0 | MIT | https://github.com/nodejs/undici |
184+
| undici@6.23.0 | MIT | https://github.com/nodejs/undici |
185+
| unpipe@1.0.0 | MIT | https://github.com/stream-utils/unpipe |
186+
| uuid@11.1.0 | MIT | https://github.com/uuidjs/uuid |
187+
| vary@1.1.2 | MIT | https://github.com/jshttp/vary |
188+
| which@2.0.2 | ISC | https://github.com/isaacs/node-which |
189+
| wrap-ansi@7.0.0 | MIT | https://github.com/chalk/wrap-ansi |
190+
| wrappy@1.0.2 | ISC | https://github.com/npm/wrappy |
191+
| xcodebuildmcp@2.1.0 | MIT | https://github.com/getsentry/XcodeBuildMCP |
192+
| xtend@4.0.2 | MIT | https://github.com/Raynos/xtend |
193+
| y18n@5.0.8 | ISC | https://github.com/yargs/y18n |
194+
| yaml@2.8.2 | ISC | https://github.com/eemeli/yaml |
195+
| yargs-parser@21.1.1 | ISC | https://github.com/yargs/yargs-parser |
196+
| yargs@17.7.2 | MIT | https://github.com/yargs/yargs |
197+
| zod-to-json-schema@3.25.1 | ISC | https://github.com/StefanTerdell/zod-to-json-schema |
198+
| zod@4.3.2 | MIT | https://github.com/colinhacks/zod |

‎package.json‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,8 @@
3737
"docs:update": "npx tsx scripts/update-tools-docs.ts",
3838
"docs:update:dry-run": "npx tsx scripts/update-tools-docs.ts --dry-run --verbose",
3939
"docs:check": "node scripts/check-docs-cli-commands.js",
40+
"license:report": "node scripts/generate-third-party-package-licenses.mjs",
41+
"license:check": "npx -y license-checker --production --onlyAllow 'MIT;ISC;BSD-2-Clause;BSD-3-Clause;Apache-2.0;Unlicense;FSL-1.1-MIT'",
4042
"test": "vitest run",
4143
"test:smoke": "npm run build && vitest run --config vitest.smoke.config.ts",
4244
"test:watch": "vitest",

‎scripts/generate-third-party-package-licenses.mjs‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
#!/usr/bin/env node
2+
3+
import { execSync } from "node:child_process";
4+
import { writeFileSync } from "node:fs";
5+
import path from "node:path";
6+
7+
const outputPath = path.resolve(process.cwd(), "THIRD_PARTY_PACKAGE_LICENSES.md");
8+
9+
const raw = execSync("npx -y license-checker --production --json", {
10+
encoding: "utf8",
11+
});
12+
const licenses = JSON.parse(raw);
13+
14+
const rows = Object.entries(licenses)
15+
.map(([name, meta]) => {
16+
const license = Array.isArray(meta.licenses)
17+
? meta.licenses.join(", ")
18+
: String(meta.licenses ?? "UNKNOWN");
19+
const repository = String(meta.repository ?? "");
20+
return { name, license, repository };
21+
})
22+
.sort((a, b) => a.name.localeCompare(b.name));
23+
24+
const now = new Date().toISOString();
25+
const lines = [
26+
"# Third-Party Package Licenses",
27+
"",
28+
`Generated at: ${now}`,
29+
"",
30+
"This file is generated from production npm dependencies.",
31+
"",
32+
"| Package | License | Repository |",
33+
"| --- | --- | --- |",
34+
...rows.map((row) => `| ${row.name} | ${row.license} | ${row.repository} |`),
35+
"",
36+
];
37+
38+
writeFileSync(outputPath, lines.join("\n"), "utf8");
39+
console.log(`Wrote ${rows.length} entries to ${outputPath}`);

0 commit comments

Comments
 (0)