Are there any package management tools that handle contractual compliance and inventory eligibility rules?

Yes — but usually not as generic package managers like npm, pip, or apt. What you’re describing is more like software supply chain governance / entitlement management: tools that control whether an artifact can be used based on contract terms, licensing, support entitlements, export restrictions, approval policies, or inventory eligibility.

A few categories and examples:

1) Enterprise artifact/package repositories with policy controls

These can enforce who may download/use packages, what versions are allowed, and whether artifacts are approved.

• JFrog Artifactory + JFrog Xray / JFrog Platform
  • Repository management, license compliance scanning, policy enforcement.
  • Can block or allow artifacts based on security, license, and policy rules.
• Sonatype Nexus Repository + Sonatype Lifecycle
  • Repository + policy engine for component governance.
  • Strong on license and vulnerability compliance.
• Azure Artifacts / GitHub Packages / GitLab Package Registry
  • Good for access control and internal distribution, though contractual compliance is usually handled externally.

2) Dependency governance / license compliance tools

These focus more on whether a component is legally or contractually eligible for use.

• Black Duck
• FOSSA
• Mend (WhiteSource)
• Snyk License Compliance

These typically analyze dependencies for:

• open-source license compatibility
• notice obligations
• policy violations
• approval workflows

3) Software entitlement / license management platforms

These are closer to “inventory eligibility” and contractual compliance in the broader sense.

• Flexera
• Snow Software
• ServiceNow Software Asset Management (SAM)
• Ivanti Neurons for SAM

These manage:

• which users/devices/business units are entitled
• contract and license inventory
• renewal/compliance status
• deployment eligibility

4) Internal package portals with custom eligibility logic

Many organizations build an internal package portal or proxy that checks:

• contract status
• region/country restrictions
• product tier or customer entitlement
• maintenance/support subscription validity
• internal approval status

This is often implemented with:

• a repository manager
• an entitlement service
• metadata tags
• policy-as-code (e.g. OPA/Gatekeeper)
• CI/CD gate checks

If you mean “package manager” in the strict sense

A strict package manager generally doesn’t enforce contractual compliance by itself. It may support:

• signed packages
• trusted sources
• repository permissions
• pinning versions
• policy hooks

But actual “eligibility rules” are usually done by:

• repository policy engines
• software asset management tools
• custom entitlement systems

Quick rule of thumb

• License and dependency compliance: Sonatype, JFrog, Black Duck, FOSSA, Mend
• Inventory/entitlement eligibility: Flexera, Snow, ServiceNow SAM
• Package distribution with policy gates: Artifactory, Nexus

If you want, I can also give you:

1. a tool-by-tool comparison table, or
2. a reference architecture for building this capability internally.