Fix PNPM Workspace Dependencies Scan and Add New License Discovery System

.dependency-radar/dependency-radar/import-graph.json

@@ -1,6 +1,7 @@
 {
   "files": {
     "src/aggregator.ts": [
+      "src/license.ts",
       "src/types.ts",
       "src/utils.ts"
     ],
@@ -14,10 +15,14 @@
       "src/types.ts",
       "src/utils.ts"
     ],
+    "src/generated/spdx.ts": [],
     "src/index.ts": [
       "src/aggregator.ts",
       "src/report.ts"
     ],
+    "src/license.ts": [
+      "src/generated/spdx.ts"
+    ],
     "src/report-assets.ts": [],
     "src/report.ts": [
       "src/report-assets.ts",
@@ -45,7 +50,9 @@
   "packages": {
     "src/aggregator.ts": [],
     "src/cli.ts": [],
+    "src/generated/spdx.ts": [],
     "src/index.ts": [],
+    "src/license.ts": [],
     "src/report-assets.ts": [],
     "src/report.ts": [],
     "src/runners/importGraphRunner.ts": [],
@@ -58,7 +65,9 @@
   "packageCounts": {
     "src/aggregator.ts": {},
     "src/cli.ts": {},
+    "src/generated/spdx.ts": {},
     "src/index.ts": {},
+    "src/license.ts": {},
     "src/report-assets.ts": {},
     "src/report.ts": {},
     "src/runners/importGraphRunner.ts": {},

README.md

@@ -17,6 +17,18 @@ Dependency Radar is a local-first CLI tool that inspects a Node.js project’s i
 - Not a bundler or build tool
 - Not a dependency updater
 
+
+## License Scanning
+
+Dependency Radar validates SPDX licenses declared in `package.json` and can infer licenses from `LICENSE` files when declarations are missing or invalid. It works offline and uses a bundled SPDX identifier list (generated at build time) with no runtime network access. Each dependency gets a structured license record with:
+
+- Declared SPDX validation (including deprecated IDs and `WITH` exceptions)
+- Inferred SPDX license (with confidence: `high`, `medium`, `low`) based on deterministic text matching
+- A status (`declared-only`, `inferred-only`, `match`, `mismatch`, `invalid-spdx`, `unknown`) to make review decisions easier
+
+This logic applies to all dependencies (direct and transitive). Inferred licenses are never treated as authoritative over valid declared SPDX expressions.
+
+
 ## Setup
 
 ```bash
@@ -158,8 +170,31 @@ export interface DependencyRecord {
     };
   };
   compliance: {
-    license: string; // License string read from the installed package.json
-    licenseRisk: 'green' | 'amber' | 'red'; // Risk classification derived from license string
+    license: {
+      declared?: {
+        spdxId: string; // SPDX ID or expression from package.json
+        expression: boolean; // True when SPDX expression (AND/OR/WITH)
+        deprecated: boolean; // True if SPDX ID is deprecated
+        valid: boolean; // True if SPDX ID/expression is valid
+      };
+      inferred?: {
+        spdxId: string; // SPDX ID inferred from LICENSE text
+        confidence: 'high' | 'medium' | 'low'; // Heuristic confidence
+      };
+      exception?: {
+        id: string; // SPDX exception id
+        deprecated: boolean; // True if exception is deprecated
+        valid: boolean; // True if exception id is valid
+      };
+      status:
+        | 'declared-only'
+        | 'inferred-only'
+        | 'match'
+        | 'mismatch'
+        | 'invalid-spdx'
+        | 'unknown';
+    };
+    licenseRisk: 'green' | 'amber' | 'red'; // Risk classification derived from declared/inferred SPDX ids
   };
   security: {
     summary: {