Declare and ship an open-source license

[itsjling]

Problem

The npm package does not declare a license. The npm registry omits license, deps.dev reports no licenses, npm.io shows Licence —, and GitHub's community profile reports no license.

This is the clearest actionable fault in the current package-health data. It leaves users unsure whether they may use, copy, or change the package.

Decision needed

The maintainer must choose the license. Do not infer one from dependencies or other projects. Record the chosen SPDX identifier.

Scope

• Add the full license text in a root LICENSE file.
• Add the matching SPDX identifier to package.json.
• Extend the package-manifest checks so a release cannot omit or mismatch the license.
• Confirm the packed tarball contains the license.
• Note the license in release notes if the choice changes users' rights.

Acceptance checks

• npm pack --dry-run includes LICENSE.
• The packed package.json has the chosen SPDX identifier.
• corepack pnpm run package:verify passes.
• corepack pnpm run lint and corepack pnpm test pass.
• After release, the npm registry and deps.dev show the chosen license.

Evidence

• npm package metadata for 0.12.1 has no license field.
• deps.dev returns licenses: [] for 0.12.1.
• GitHub's community profile is 28% and reports license: null.
• npm.io shows Licence —.

[itsjling]

This was generated by AI during triage.

Agent Brief

Category: enhancement
Summary: Declare and ship diffsplain under the MIT license.

Maintainer decision: Use SPDX identifier MIT. The maintainer approved this choice during triage.

Current behavior:
The package has no license field or root license text. The package checker permits a license file but does not require one. Triage checked the package metadata, package-manifest checks, and GitHub license detection; the requested behavior is not already present. No prior rejection was found.

Desired behavior:
Ship the full MIT license with the package and declare MIT in its metadata. Release checks must reject a missing license file, missing license declaration, or a declaration that does not match the chosen license. Preserve the proper copyright notice. Record the license addition in release notes.

Key interfaces:

• npm package metadata: the license field must equal MIT.
• Packed package contents: include the full license text.
• validatePackageManifest and package verification: enforce license inclusion and matching metadata.

Acceptance criteria:

• The repository contains the full MIT license text and GitHub detects it.
• npm pack --dry-run includes the license; the packed package declares MIT.
• Tests reject missing license text, a missing license field, and a mismatched license identifier.
• corepack pnpm run package:verify, corepack pnpm run lint, and corepack pnpm test pass.
• Run corepack pnpm run docs:check if docs change.
• Release notes record the license addition. After the next authorized release, verify that npm and deps.dev report MIT; report any indexing delay separately.

Out of scope:

• Choosing another license or adding license restrictions.
• Publishing a release solely to complete this implementation task.