feat(build): generate THIRD-PARTY inventory via license-maven-plugin

NOTICE.txt

@@ -1,17 +1,14 @@
 Percussion CMS
 Copyright 1999-2026 Percussion Software, Inc.
-
-This product includes software developed by the Apache Software Foundation (http://www.apache.org/).
-Copyright (c) 2004 The Apache Software Foundation. All rights reserved.
-
-GNU Runtime Libraries are included in this product and are covered under the GNU LGPL (http://www.gnu.org/licenses/lgpl.html).
-
-This product includes the jTDS driver, which is released under the terms of the GNU LGPL.
-
-XStream Copyright (c) 2003-2005, Joe Walnes. All rights reserved.
-ASM Copyright (c) 2000-2005 INRIA, France Telecom All rights reserved.
-Lato font Copyright (c) 2012, Lukasz Dziedzic
-with Reserved Font Name Lato.
-This Font Software is licensed under the SIL Open Font License, Version 1.1.
-This license is copied below, and is also available with a FAQ at:
-http://scripts.sil.org/OFL
+Additional contributions and ongoing maintenance by Intersoft Data Labs Pvt. Ltd.
+(https://www.intsof.com), 2023-present.
+
+This product is licensed under the Apache License, Version 2.0
+(https://www.apache.org/licenses/LICENSE-2.0). A copy of the license is provided
+in the LICENSE.txt file in the product distribution.
+
+This product includes third-party open source software. A complete, versioned
+inventory of third-party dependencies and their licenses is generated from the
+Maven reactor dependency set at build time and is shipped as THIRD-PARTY.txt
+in the product distribution. Do not hand-maintain version pins or component
+lists here — the build-generated inventory is authoritative.

docs/ai-generated/code-reviews/1689-license-maven-plugin-erlang.md

@@ -0,0 +1,57 @@
+# Erlang review: #1689 license-maven-plugin THIRD-PARTY inventory
+
+|       Field        |              Value               |
+|--------------------|----------------------------------|
+| **Date**           | 2026-08-02                       |
+| **Branch**         | `feat/1689-license-maven-plugin` |
+| **Scope**          | Uncommitted work for issue #1689 |
+| **Recommendation** | approve                          |
+| **Gate**           | May commit/push: **yes**         |
+| **Blocking bugs**  | 0                                |
+
+## Summary
+
+Adopts `org.codehaus.mojo:license-maven-plugin` on the reactor root to generate a versioned
+`THIRD-PARTY.txt` inventory from the dependency set. Hand-curated component lists and version pins
+are removed from `NOTICE.txt` and `thirdPartyCopyright`; both become stable pointers only. The
+installer module copies `LICENSE.txt`, `NOTICE.txt`, and the generated inventory into the assembly
+root. Behavioral tests cover the blurb policy and packaging when the inventory is present.
+
+## Scope
+
+- `pom.xml` — plugin version property + root-only aggregate execution
+- `NOTICE.txt` — stable product notice + pointer
+- `system/.../PSStringResources.properties` — thin `thirdPartyCopyright` / copyright year
+- `system/.../PSThirdPartyCopyrightTest.java` — new
+- `modules/perc-distribution-tree/pom.xml` — copy license artifacts into assembly
+- `modules/perc-distribution-tree/.../ThirdPartyInventoryPackagingTest.java` — new
+- `src/license/*` — missing-license map + README
+- Out of scope discarded: `modules/perc-i18n/scripts/cache/i18n_translate.json` (unrelated drift)
+
+**Memory patterns hit:** non-portable path joins (checked clean — uses `Path`/`Files`); missing
+behavioral tests (present for blurb + packaging); incomplete change-class (packaging companion
+included).
+
+**Cross-platform path review:** clean. Tests resolve repo root via `Path` walk/`resolve`; no
+hardcoded `/` or `\` filesystem joins; no Unix-only absolute roots; no line-ending fragile multi-line
+file equality assertions.
+
+## Issues
+
+### suggestion — packaging soft-skips when inventory missing
+
+- **File:** `modules/perc-distribution-tree/src/test/java/com/percussion/distribution/install/ThirdPartyInventoryPackagingTest.java`
+- **Note:** `assumeTrue` means standalone Surefire without a prior root aggregate pass does not fail.
+  Acceptable for this monorepo (AC targets full reactor). Documented in pom comment + `src/license/README.md`.
+  Full-reactor / process-resources path was verified locally (LICENSE + NOTICE + THIRD-PARTY in assembly).
+
+### nit — copyright year pin in test
+
+- **File:** `system/.../PSThirdPartyCopyrightTest.java` (`1999-2026`)
+- **Note:** Will need a yearly bump; matches product prose. Acceptable.
+
+## Gate
+
+No bugs. No missing behavioral tests for the changed policy. Path I/O portable.
+
+**May commit/push: yes**

modules/intsof-common-utilities/README.md

@@ -11,6 +11,45 @@ Product-agnostic Java utilities for Intersoft Data Labs projects
 | License      | Apache License 2.0                              |
 | Copyright    | Intersoft Data Labs                             |
 
+## Third-party license inventory (`license.ThirdPartyLicenseInventory`)
+
+Product-agnostic merge of a Maven-oriented inventory text file with **production**
+npm packages from `package-lock.json` (lockfileVersion 2/3 `packages` map). No
+Jackson or other runtime dependencies — includes a small JSON subset parser.
+
+```java
+import com.intsof.common.utilities.license.ThirdPartyLicenseInventory;
+import java.nio.file.Path;
+
+// Library API
+var npm =
+    ThirdPartyLicenseInventory.readProductionPackagesFromLockFile(
+        Path.of("frontend/package-lock.json"), Path.of("."));
+String section = ThirdPartyLicenseInventory.formatNpmSection(npm);
+String merged =
+    ThirdPartyLicenseInventory.mergeMavenAndNpm(mavenText, section, "My product inventory");
+
+// Or write files (Maven half + lock list → merged THIRD-PARTY.txt)
+ThirdPartyLicenseInventory.generateMergedInventory(
+    projectRoot,
+    outDir,
+    ThirdPartyLicenseInventory.DEFAULT_MAVEN_FILE_NAME,
+    ThirdPartyLicenseInventory.DEFAULT_NPM_FILE_NAME,
+    ThirdPartyLicenseInventory.DEFAULT_MERGED_FILE_NAME,
+    lockListFile,
+    "My product inventory",
+    true);
+```
+
+CLI (`main`) for Maven `exec-maven-plugin:java`:
+
+```text
+java -cp utilities-0.0.1.jar com.intsof.common.utilities.license.ThirdPartyLicenseInventory \
+  --root <project-root> --require-maven [--title "..."] [--lock-list path] [--out-dir path]
+```
+
+Tests: `ThirdPartyLicenseInventoryTest`.
+
 ## User configuration (`UserConfiguration`)
 
 Provides a portable per-user config root: