Read an inventory of dependencies and bundled source, open the licence, NOTICE and attribution files it points at, and emit a human review queue: for each component, either the obligation categories its licence raises -- with the phrase from the licence text that identified it -- or the reason the licence could not be resolved at all.
This walkthrough uses the tool's public README and checked-in example files. Run the command from a repository checkout with Node.js 22+.
Run the checked-in example
npm run example # the clean tree, exits 0
node bin/license-obligation-scanner.mjs --inventory examples/broken/inventory.json # exits 2Read the result
examples/clean/ resolves four bundled components from their own licence texts with the notices they require. examples/broken/ exercises each way the tool refuses to conclude: a missing licence file, a dual expression, a bespoke licence, a bundled Apache component with no NOTICE, a copyleft component, a declaration its own text contradicts, and a component absent from the attribution file. The licence files in both trees are abbreviated copies carrying the marker phrases; a real distribution ships the complete texts.
Scope
Bounds are part of the contract. Exceeding one is a named finding and an incomplete report, never a silent truncation: --max-bytes (1048576), --max-components (500), --max-files (1500), --max-file-bytes (262144), --max-depth (12), --max-millis (5000). If the time budget is spent, every entry is returned to the queue unresolved -- a review that did not finish concludes nothing.