{
  "synthetic": true,
  "execution": "Teaching record only; no live integration tested",
  "slug": "dependency-licence-evidence-manifest",
  "group": "supplier-handover",
  "title": [
    "Package licence metadata needs its supporting file",
    "软件包写了许可，还要找到对应文件"
  ],
  "intro": [
    "When buying a custom website, an inventory that says “all open source” is not a usable dependency handover. Record exact packages and versions, the licence declaration and the supporting text. A metadata field can point to a licence file; it cannot establish every obligation for a particular redistribution.",
    "采购定制网站时，“全部开源”不是可用依赖交付。应记录包和版本、许可声明及对应文本。元数据可以指向许可文件，却不能证明特定再分发的全部义务。"
  ],
  "facts": [
    [
      "npm package.json documentation describes SPDX licence expressions and the SEE LICENSE IN filename form. UNLICENSED and missing declarations must not be silently interpreted as a permissive licence.",
      "npm文档说明SPDX许可表达式及SEE LICENSE IN文件名形式；UNLICENSED或缺失声明不能擅自解释为宽松许可。",
      "https://docs.npmjs.com/cli/v11/configuring-npm/package-json/#license"
    ]
  ],
  "example": [
    [
      [
        "Synthetic package alpha@1.2; declaration MIT",
        "Exact package includes LICENSE text",
        "Record declaration+file hash; obligations still require review"
      ],
      [
        "合成alpha@1.2声明MIT",
        "该版本含LICENSE文本",
        "记录声明及文件hash，义务仍须审核"
      ]
    ],
    [
      [
        "beta@2.0; SEE LICENSE IN TERMS.txt",
        "TERMS.txt missing from handover",
        "Evidence gap; do not mark cleared"
      ],
      [
        "beta@2.0；SEE LICENSE IN TERMS.txt",
        "交付缺TERMS.txt",
        "证据缺口，不能标已清权"
      ]
    ],
    [
      [
        "gamma@3.0; UNLICENSED",
        "Not a permissive grant",
        "Hold for owner/vendor permission evidence"
      ],
      [
        "gamma@3.0；UNLICENSED",
        "不是宽松许可授权",
        "待负责人或供应商授权依据"
      ]
    ],
    [
      [
        "delta@4.0; no licence field",
        "Licence elsewhere unknown",
        "Unknown, not zero obligations or automatic permission"
      ],
      [
        "delta@4.0未写许可字段",
        "其他位置许可未知",
        "未知，不等于零义务或自动获准"
      ]
    ]
  ],
  "steps": [
    [
      "Export an exact direct/transitive dependency inventory for the delivered source and build. Include package version, integrity, declaration and location of supporting text without registry credentials.",
      "导出交付源码及构建的直接、间接依赖清单，含版本、完整性、声明及文本位置，不含仓库凭证。"
    ],
    [
      "Reconcile the filled four-row manifest against actual files for that version. Keep missing text, conflicting declarations and unknown entries visible rather than auto-grading them permissive.",
      "按四行例核对该版本真实文件，缺文本、声明冲突及未知项须保留，不能自动评为可用。"
    ],
    [
      "Have the responsible licensing reviewer decide notices, source or distribution requirements for the actual delivery. Preserve that decision with the artefact version.",
      "由许可负责人判断实际交付的声明、源码或分发要求，并随产物版本保存决定。"
    ]
  ],
  "result": [
    "Only the first row has both a declaration and a supporting text in the teaching record. Even that row is evidence-ready rather than a legal clearance result. The useful output is an actionable gap list tied to exact versions, not a claim that all open-source packages share one licence.",
    "教学记录仅首行同时有声明及文本，即使如此也只是证据可审，并非法律清权结论。有效输出是绑定版本的缺口表，而不是声称所有开源包使用同一许可。"
  ],
  "accept": [
    "Require exact-version traceability and a recorded reviewer decision for unresolved entries before the relevant redistribution. Keep the factual inventory separate from legal conclusions.",
    "相关再分发前须精确追到版本，并有未决项审核决定；事实清单与法律结论分开。"
  ],
  "limit": [
    "Fictional packages only, no licence audit of the frozen site, no package downloads and no legal advice. Metadata completeness alone cannot certify compliance.",
    "仅虚构软件包，不审计冻结网站、不下载包、不提供法律建议；元数据完整不等于合规认证。"
  ],
  "oldLinks": []
}