Third-Party Licenses

Generated by node scripts/generate-license-report.mjs from pnpm licenses list, which inspects the packages actually installed in node_modules — so this reflects the resolved dependency graph, including transitive dependencies, not just the manifests.

Re-run it after any dependency change; do not edit by hand.

• Packages: 2249 (1598 reachable from production dependencies)

• Distinct licenses: 23

• Needing review: 0

• Reviewed and accepted: 9

• Platform variants: 147 in the lockfile, of which 52 target production but are not installed here (see Platform coverage)

Scope is production when the package is reachable from a dependencies or optionalDependencies edge, and dev when it only arrives through build or test tooling and therefore never ships.

Summary by license

Needing review

None outstanding — every non-permissive entry has been reviewed and accepted below.

Reviewed and accepted

Non-permissive or unidentified terms that have been looked at and signed off, so they no longer appear above. The license column is what the package itself declares — an acceptance records a decision, it does not restate the license.

License corrections

These packages ship no license field, so pnpm licenses reports them as Unknown. The license below was read from the license file inside the package and is used in place of Unknown throughout this report.

Notes on unidentified licenses

Unknown means the package manifest carries no license field, not that the package is unlicensed. Each was resolved by reading the license file shipped inside it.

• @anthropic-ai/claude-agent-sdk — Proprietary. LICENSE.md reads "© Anthropic PBC. All rights reserved. Use is subject to the Legal Agreements outlined here: https://code.claude.com/docs/en/legal-and-compliance". The manifest declares SEE LICENSE IN README.md. This is the only non-OSS dependency in the tree.
• @anthropic-ai/claude-agent-sdk-darwin-arm64 — Platform binary for the above; same Anthropic terms.
• @ensembleapp/client-sdk — First-party — this repo publishes it from packages/client-sdk. Not third-party, but the manifest has no license field; worth adding one.

Platform coverage

Native packages ship one build per platform. pnpm licenses only sees the builds installed on the machine that generated this file, so the tables above reflect that host — while production runs linux/glibc (node:22-slim). The variants below come from the lockfile instead, so they are listed whether or not they were installed here.

Licenses for variants that are not installed here are read from the npm registry, not inferred from a sibling. Unresolved means the lookup failed (offline, or the version was unpublished) and the license was left undetermined rather than guessed.

• Platform variants in the lockfile: 147
• Targeting production (linux/glibc): 52
• Of those, not installed here and therefore missing from the tables above: 52

All packages