What does this plugin do?

It hooks into your Rollup build (or Vite build), identifies which third-party packages were actually bundled, reads their package metadata and license files, and writes everything into a single JSON report at the end of the build.

Where is the report written?

Exactly where you tell it to. The output path is the first, required argument of the plugin — for example ./dist/licenses.json writes the report next to your bundle. You cannot accidentally override it with options; there is exactly one place.

Does it work with Vite?

Yes. The plugin is implemented with native Rollup hooks (renderChunk and generateBundle) and Vite uses Rollup under the hood, so it works in both Rollup and Vite projects with the same configuration.

Which dependencies end up in the report?

Only modules that are part of the rendered bundle output — if a package is installed but never imported, it will not appear. Records are deduplicated by name unless you enable multipleVersions. Private packages and the project itself are excluded by default, and records without an available license text are omitted from the JSON.

Can I fail the build on disallowed licenses?

Yes. Pass thirdParty.allow with { test: "(MIT OR Apache-2.0)", failOnViolation: true } and any dependency whose license does not satisfy the expression stops the build with an error. failOnUnlicensed does the same for dependencies without a declared license. Without those flags, violations are reported as warnings.

Does this replace legal review?

No. It is a technical tool for collecting and exposing license information at build time. Interpreting license obligations and ensuring compliance remains the responsibility of your project and its team.

§ Rollup plugin · v2.0.1

Know exactly which licenses ship with your bundle.

A Rollup plugin that turns your production bundle's dependency licenses into a clean, machine-readable JSON report — so open-source compliance doesn't become a manual task.

Get startedView on GitHub

npm install -D @darcas/rollup-plugin-license-json

Rollup & Vite Zero runtime dependencies Node.js ≥ 14 TypeScript types included

licenses.jsonReport generated

·[·  {·    "name": "axios",·    "version": "0.21.4",·    "license": "MIT",MIT·    "licenseText": "Permission is hereby granted…"·  },·  {·    "name": "lodash",·    "version": "4.17.21",·    "license": "MIT"MIT·    …·  }·]

§ 01 The problem

Your bundle has dependencies. Your license report shouldn't be manual.

A modern JavaScript application pulls in a large dependency graph — direct packages, transitive packages, scoped packages you didn't even know were there.

Once everything is bundled, figuring out which third-party code and which licenses actually ended up in the distributed artifact means walking node_modules by hand: tedious, error-prone, and out of date the moment you ship again.

This plugin lives inside your build pipeline. It looks at what Rollup actually emits, not at what you think you installed, and turns it into a structured report — no separate compliance workflow to maintain.

reactaxioslodashschedulerpicomatchzod

licenses.json

§ 02 Features

Everything a build-time license report needs. Nothing else.

The plugin does one job and does it natively: watch the bundle, collect license facts, emit JSON.

JSON license report

At the end of every build, the plugin writes a JSON file describing each third-party dependency that made it into your bundle.

generateBundle → file

Real dependency discovery

Only modules actually included in the output are traced back to their package.json — no guessing from your manifest.

renderChunk · renderedLength > 0

Full license metadata

Name, version, author, description, homepage, SPDX license and the full sanitized license text for every record.

LicensePluginJsonRecord

SPDX allow-list

Restrict dependencies to an SPDX expression like "(MIT OR Apache-2.0)", or plug in your own validator function.

spdx-expression-validate + spdx-satisfies

Rollup-native, Vite-compatible

Implemented with native Rollup hooks, so it runs anywhere Rollup runs — including Vite. Zero runtime dependencies.

renderChunk + generateBundle

Fine-grained control

Include private packages or the project itself, keep every installed version, or enable debug logging of scanned modules.

includePrivate · includeSelf · multipleVersions

§ 03 How it works

From build output to license report, automatically.

§ 01
Build
Your project runs its normal Rollup or Vite build. There is no separate step to remember.
§ 02
Inspect
For every module that made it into the rendered output, the plugin walks up the directory tree to its package.json and reads the license facts.
§ 03
Generate
At bundle time, records are filtered (private, self), optionally validated against your SPDX allow-list, and written as JSON.
§ 04
Ship
The report lands next to your artifact — archive it in CI, inspect it in review, or feed it to internal tooling.

§ 04 Usage

One plugin. A few lines of configuration.

Pass the output path as the first argument — it is required and always wins. The optional second argument tunes what ends up in the report.

cwd — Project root used for "self" detection and package discovery. Defaults to process.cwd().
debug — Log every scanned module while the build runs.
thirdParty.allow — SPDX expression, validator function, or { test, failOnUnlicensed, failOnViolation }.
thirdParty.includePrivate — Include packages marked private in the report.
thirdParty.includeSelf — Include the project being built itself.
thirdParty.multipleVersions — Keep each installed version of a package instead of deduplicating by name.

rollup.config.mjs

1// rollup.config.mjs2import LicensePluginJson from '@darcas/rollup-plugin-license-json';34export default {5  // ...6  plugins: [7    // ...8    LicensePluginJson('./dist/licenses.json', {9      thirdParty: {10        allow: '(MIT OR Apache-2.0)',11      },12    }),13  ],14};

The snippet above shows real options from the README — swap them for what your policy requires.

§ 05 The output

From dependency graph to structured data.

One record per dependency, straight from each package's metadata and license file.

dist/licenses.json

1[2  {3    "name": "axios",4    "version": "0.21.4",5    "author": {6      "name": "Matt Zabriskie",7      "email": null,8      "url": null9    },10    "description": "Promise based HTTP client for the browser and node.js",11    "homepage": "https://axios-http.com/",12    "license": "MIT",13    "licenseText": "Permission is hereby granted, free of charge, to any person..."14  },15  {16    "name": "lodash",17    "version": "4.17.21",18    "author": { "...": "..." },19    "description": "A modern JavaScript utility library delivering modularity...",20    "homepage": "https://lodash.com/",21    "license": "MIT",22    "licenseText": "Permission is hereby granted, free of charge, to any person..."23  }24]

Archivable. The report is a plain JSON file — commit it, attach it to a release, or store it with the artifact.
Inspectable. Names, versions, authors and full license text are human-readable without extra tooling.
Processable. Typed as LicensePluginJsonRecord in TypeScript, trivially consumable by scripts.
CI/CD-ready. Because it is produced during the build, it is always in sync with what you actually ship.

LicensePluginJsonRecord = {

name, version: string

author: { name, email, url } | null

description, license, licenseText: string

homepage: string | null

}

Records whose license text is empty or unavailable are omitted. HTML tags in license files are stripped; line breaks become <br> to preserve readability.

§ 06 Compliance

Make license visibility part of your build.

Instead of discovering third-party licenses after release, generate the information alongside the artifact — on every single build.

commit
install dependencies
rollup / vite build
license report
artifact · CI archive

With thirdParty.allow, dependencies that violate your policy can warn — or stop the build entirely with failOnViolation / failOnUnlicensed.

Technical tooling helps you surface license information early. Your project's legal obligations should still be reviewed according to the licenses and policies that apply to it.

§ 07 FAQ

Questions, answered precisely.

§ 08 Ecosystem

Built for the tools you already use.

Rollupnative hooksViteworks out of the boxNode.js≥ 14.0.0TypeScripttypes included

Make license visibility part of every build.

Install it once. Keep your dependency licensing information close to the artifact.

Get startedView source on GitHub

Know exactly which licenses ship with your bundle.

Your bundle has dependencies. Your license report shouldn't be manual.

Everything a build-time license report needs. Nothing else.

JSON license report

Real dependency discovery

Full license metadata

SPDX allow-list

Rollup-native, Vite-compatible

Fine-grained control

From build output to license report, automatically.

Build

Inspect

Generate

Ship

One plugin. A few lines of configuration.

From dependency graph to structured data.

Make license visibility part of your build.

Questions, answered precisely.

01What does this plugin do?

02Where is the report written?

03Does it work with Vite?

04Which dependencies end up in the report?

05Can I fail the build on disallowed licenses?

06Does this replace legal review?

Built for the tools you already use.

Make license visibility part of every build.