license-clash-mediatorlisted

# License Clash Mediator ## 1. System Architecture & Prerequisites Shipping a dependency with an incompatible license — GPL into a proprietary binary, a "no commercial use" license into a SaaS — is a legal landmine that a dependency audit never catches *as a license issue*. The Mediator walks your lockfile, resolves each package's license expression, classifies permissiveness (there is a small hard-coded police table; extend it for your org), and emits a classified clash report. Node 18+ stdlib. License classifier (expression → class): - `PERMISSIVE`: MIT, Apache-2.0, BSD-*, ISC - `WEAK_COPYLEFT`: LGPL-*, MPL-* - `STRONG_COPYLEFT`: GPL-*, AGPL-* - `RESTRICTED`: CC-BY-NC*, BUSL-*, "SEE LICENSE IN ..." - `UNKNOWN`: missing/`UNLICENSED`/custom ## 2. Input/Output Data Contracts Input: `package-lock.json` with registry metadata (uses `license` field from each version from a local `node_modules/<pkg>/package.json` when available — no network required). Output `LICENSE_CLASH_REPORT.md` + `license-report.json`: ```json { "deps": 214, "unknown": 22, "flagged": [ { "name": "lib-mp4", "license": "SEE LICENSE IN COPYING", "class": "RESTRICTED", "consumedBy": ["video-worker", "ingest"] } ], "conflicts": [ { "a": "agg-lib", "la": "GPL-3.0", "b": "proprietary", "note": "strong copyleft in closed-source distribution" } ] } ``` Exit: `0` = no unknown/restricted/copyleft-in-proprietary flags, `1` = flags exist, `2` = input unreadable. ## 3. Production Reference Implementation ```js