License report for acme-video-platform

How each package's license is resolved

LicenseProof reads only files already present on disk from the scanned project and its installed dependencies. It never contacts a network, registry, or remote service. The two ecosystems use different resolution orders:

npm packages

The first step that yields a license wins (later steps are not consulted):

1. Declared metadata — the license field in the package's package.json, parsed as an SPDX id or expression (OR / AND / WITH preserved). Confidence: high. npm's UNLICENSED convention is not treated as an SPDX id and falls through.
2. License file — the text of an on-disk LICENSE/COPYING file, matched by fingerprint against known license texts. Confidence: medium for a close match, low for a modified or partial match.
3. README mention — a License: line near the top of the README. Confidence: low.
4. Unknown — no signal resolved; the package is reported as UNKNOWN and flagged for review. Unknown does not mean safe.

PyPI packages

The metadata signals are read together so a disagreement between them can be surfaced; the on-disk steps run only when no metadata signal resolved:

1. License-Expression — the PEP 639 License-Expression metadata field. Confidence: high.
2. License — the legacy License metadata field, used when no License-Expression is present. Confidence: high.
3. Trove classifiers — the License :: classifiers, mapped to a representative SPDX id. Confidence: medium (classifiers are coarser than an explicit id — e.g. "BSD License" cannot distinguish BSD-2 from BSD-3).
4. License file — on-disk license text, fingerprint-matched. Confidence: medium / low, as for npm.
5. README mention — a License: line. Confidence: low.
6. Unknown — reported as UNKNOWN, flagged for review.

When a PyPI package's declared license field and its Trove classifiers resolve to different licenses (and not merely to different variants of the same license family), the package is additionally flagged for review as an internal metadata inconsistency.

What the confidence levels mean

• high — the license came from an explicit, declared SPDX id or expression in package or project metadata.
• medium — the license was inferred from a close license-file text match or from a coarse Trove classifier.
• low — the license came from a modified/partial license-file match, a README mention, or could not be determined at all (Unknown).

Limitations

• The category assigned to each license is an informational classification, not a legal determination of your obligations.
• Only declared and detectable license signals are used. No manual legal review is performed, and no upstream registry is consulted (the tool runs fully offline).
• Dependency paths are enumerated up to a cap; a "+at least N other paths" note is a floor, not an exact total.
• A package's resolved license reflects the metadata and files present on disk at scan time; it is not verified against any external source of truth.
• Unknown does not mean safe — it means the license could not be identified confidently and needs a human to look.

Not legal advice

This report is an informational license categorization produced by automated analysis of declared package metadata and license files. It is not legal advice and is not a substitute for review by qualified counsel.