@callstack/licenses 0.3.2 → 1.0.0

package/README.md

@@ -33,6 +33,7 @@ import {
   Types,
   generateAboutLibrariesNPMOutput,
   generateLicensePlistNPMOutput,
+  renderLicenseExpression,
   scanDependencies,
 } from '@callstack/licenses';
 import * as md from 'ts-markdown-builder';
@@ -58,17 +59,16 @@ const licensePlistReport = generateLicensePlistNPMOutput(licenses, iosProjectPat
 const markdownString = md
   .joinBlocks(
     Object.entries(licenses)
-      .flatMap(([packageKey, { name: packageName, version, author, content, description, file, type, url }]) => [
+      .flatMap(([packageKey, { name: packageName, version, author, description, license, licenseFiles, url }]) => [
         md.heading(packageName, { level: 2 }),
         '\n',
         `Version: ${version}<br/>\n`,
         url ? `URL: ${url}<br/>\n` : '',
         author ? `Author: ${author}<br/>\n\n` : '',
-        content ?? '',
+        licenseFiles.map(({ licenseId, file, content }) => `${licenseId ?? file}:\n\n${content}`).join('\n\n'),
         '\n',
         description ? `Description: ${description}\n` : '',
-        file ? `\nFile: ${file}\n` : '',
-        type ? `Type: ${type}` : '',
+        `License: ${renderLicenseExpression(license)}`,
         '\n',
         md.horizontalRule,
       ])

package/build/constants/licenses.d.ts

@@ -1,5 +1,9 @@
 /**
  * https://spdx.org/licenses
+ *
+ * Canonical License Identifiers, as produced by parsing a License Expression: deprecated identifiers are upgraded
+ * (`GPL-2.0` becomes `GPL-2.0-only`) and `+` is absorbed (`GPL-2.0+` becomes `GPL-2.0-or-later`), so neither form is listed.
+ * The exception are deprecated identifiers with a built-in License Exception, which have no `-only` form.
  */
 export declare const STRONG_COPYLEFT_LICENSES: Set<string>;
 export declare const WEAK_COPYLEFT_LICENSES: Set<string>;

package/build/constants/licenses.js

@@ -1,22 +1,29 @@
 "use strict";
 /**
  * https://spdx.org/licenses
+ *
+ * Canonical License Identifiers, as produced by parsing a License Expression: deprecated identifiers are upgraded
+ * (`GPL-2.0` becomes `GPL-2.0-only`) and `+` is absorbed (`GPL-2.0+` becomes `GPL-2.0-or-later`), so neither form is listed.
+ * The exception are deprecated identifiers with a built-in License Exception, which have no `-only` form.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.WEAK_COPYLEFT_LICENSES_LOWERCASE = exports.STRONG_COPYLEFT_LICENSES_LOWERCASE = exports.WEAK_COPYLEFT_LICENSES = exports.STRONG_COPYLEFT_LICENSES = void 0;
 exports.STRONG_COPYLEFT_LICENSES = new Set([
-    'GPL',
-    'GPL-1.0',
-    'GPL-1.0+',
-    'GPL-2.0',
-    'GPL-2.0+',
+    'GPL-1.0-only',
+    'GPL-1.0-or-later',
     'GPL-2.0-only',
     'GPL-2.0-or-later',
-    'GPL-3.0',
-    'GPL-3.0+',
+    'GPL-2.0-with-autoconf-exception',
+    'GPL-2.0-with-bison-exception',
+    'GPL-2.0-with-classpath-exception',
+    'GPL-2.0-with-font-exception',
+    'GPL-2.0-with-GCC-exception',
+    'GPL-3.0-with-autoconf-exception',
+    'GPL-3.0-with-GCC-exception',
     'GPL-3.0-only',
     'GPL-3.0-or-later',
-    'AGPL-3.0',
+    'AGPL-1.0-only',
+    'AGPL-1.0-or-later',
     'AGPL-3.0-only',
     'AGPL-3.0-or-later',
     'EUPL-1.0',
@@ -33,17 +40,10 @@ exports.WEAK_COPYLEFT_LICENSES = new Set([
     'CDDL-1.1',
     'EPL-1.0',
     'EPL-2.0',
-    'LGPL',
-    'LGPL-2.0',
-    'LGPL-2.0+',
     'LGPL-2.0-only',
     'LGPL-2.0-or-later',
-    'LGPL-2.1',
-    'LGPL-2.1+',
     'LGPL-2.1-only',
     'LGPL-2.1-or-later',
-    'LGPL-3.0',
-    'LGPL-3.0+',
     'LGPL-3.0-only',
     'LGPL-3.0-or-later',
     'MPL-1.1',

package/build/licenses/OrPolicy.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Enumerates all valid OR Policy values
+ *
+ * @see {@link OrPolicy}
+ */
+export declare const validOrPolicies: readonly ["most-restrictive", "least-restrictive"];
+/**
+ * Rule for which operand of a Dual License (`A OR B`) determines its License Category:
+ * - 'most-restrictive' (the most restrictive operand)
+ * - 'least-restrictive' (the least restrictive operand; matches SPDX's "choice" meaning of OR)
+ *
+ * Never applies to AND, which always takes the most restrictive operand.
+ */
+export type OrPolicy = (typeof validOrPolicies)[number];
+/**
+ * OR Policy used when none is given: a Dual License takes its most restrictive operand,
+ * as a conservative default for compliance checks.
+ *
+ * @see {@link OrPolicy}
+ */
+export declare const DEFAULT_OR_POLICY: OrPolicy;

package/build/licenses/OrPolicy.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_OR_POLICY = exports.validOrPolicies = void 0;
+/**
+ * Enumerates all valid OR Policy values
+ *
+ * @see {@link OrPolicy}
+ */
+exports.validOrPolicies = ['most-restrictive', 'least-restrictive'];
+/**
+ * OR Policy used when none is given: a Dual License takes its most restrictive operand,
+ * as a conservative default for compliance checks.
+ *
+ * @see {@link OrPolicy}
+ */
+exports.DEFAULT_OR_POLICY = 'most-restrictive';

package/build/licenses/index.d.ts

@@ -1,3 +1,6 @@
 export * from './LicenseCategory';
 export * from './descriptions';
 export * from './licenseAnalysis';
+export * from './OrPolicy';
+export * from './licenseExpression';
+export * from './licenseClassification';

package/build/licenses/index.js

@@ -17,3 +17,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./LicenseCategory"), exports);
 __exportStar(require("./descriptions"), exports);
 __exportStar(require("./licenseAnalysis"), exports);
+__exportStar(require("./OrPolicy"), exports);
+__exportStar(require("./licenseExpression"), exports);
+__exportStar(require("./licenseClassification"), exports);

package/build/licenses/licenseAnalysis.d.ts

@@ -1,15 +1,14 @@
 import type { AggregatedLicensesMapping } from '../types';
 import type { LicenseAnalysisResult } from '../types/LicenseAnalysisResult';
-import { LicenseCategory } from './LicenseCategory';
-/**
- * Categorizes a license based on its copyleft characteristics.
- * @param licenseType the license type
- * @returns the license category
- */
-export declare function categorizeLicense(licenseType?: string): LicenseCategory;
+import type { OrPolicy } from './OrPolicy';
 /**
  * Analyzes license data and returns comprehensive statistics.
+ *
+ * Each package is classified by its License Expression and grouped by the rendered expression,
+ * so a Dual License such as `MIT OR Apache-2.0` is counted under one key.
+ *
  * @param report the licenses report data
+ * @param orPolicy the OR Policy used to classify Dual Licenses; defaults to {@link DEFAULT_OR_POLICY}
  * @returns the license analysis result
  */
-export declare function analyzeLicenses(report: AggregatedLicensesMapping): LicenseAnalysisResult;
+export declare function analyzeLicenses(report: AggregatedLicensesMapping, orPolicy?: OrPolicy): LicenseAnalysisResult;

package/build/licenses/licenseAnalysis.js

@@ -1,36 +1,22 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.categorizeLicense = categorizeLicense;
 exports.analyzeLicenses = analyzeLicenses;
-const licenses_1 = require("../constants/licenses");
 const LicenseCategory_1 = require("./LicenseCategory");
+const OrPolicy_1 = require("./OrPolicy");
 const descriptions_1 = require("./descriptions");
-/**
- * Categorizes a license based on its copyleft characteristics.
- * @param licenseType the license type
- * @returns the license category
- */
-function categorizeLicense(licenseType) {
-    if (!licenseType || licenseType === 'unknown') {
-        return LicenseCategory_1.LicenseCategory.UNKNOWN;
-    }
-    // check for strong copyleft licenses
-    if (licenses_1.STRONG_COPYLEFT_LICENSES_LOWERCASE.has(licenseType.toLowerCase())) {
-        return LicenseCategory_1.LicenseCategory.STRONG_COPYLEFT;
-    }
-    // check for weak copyleft licenses
-    if (licenses_1.WEAK_COPYLEFT_LICENSES_LOWERCASE.has(licenseType.toLowerCase())) {
-        return LicenseCategory_1.LicenseCategory.WEAK_COPYLEFT;
-    }
-    // everything else is considered permissive
-    return LicenseCategory_1.LicenseCategory.PERMISSIVE;
-}
+const licenseClassification_1 = require("./licenseClassification");
+const licenseExpression_1 = require("./licenseExpression");
 /**
  * Analyzes license data and returns comprehensive statistics.
+ *
+ * Each package is classified by its License Expression and grouped by the rendered expression,
+ * so a Dual License such as `MIT OR Apache-2.0` is counted under one key.
+ *
  * @param report the licenses report data
+ * @param orPolicy the OR Policy used to classify Dual Licenses; defaults to {@link DEFAULT_OR_POLICY}
  * @returns the license analysis result
  */
-function analyzeLicenses(report) {
+function analyzeLicenses(report, orPolicy = OrPolicy_1.DEFAULT_OR_POLICY) {
     const byCategory = {
         [LicenseCategory_1.LicenseCategory.STRONG_COPYLEFT]: 0,
         [LicenseCategory_1.LicenseCategory.WEAK_COPYLEFT]: 0,
@@ -38,17 +24,16 @@ function analyzeLicenses(report) {
         [LicenseCategory_1.LicenseCategory.UNKNOWN]: 0,
     };
     const byLicense = {};
+    const categoryByLicense = {};
     const categorizedLicenses = {};
     Object.entries(report).forEach(([packageKey, license]) => {
-        const licenseType = license.type;
-        const category = categorizeLicense(licenseType);
+        const category = (0, licenseClassification_1.classifyLicenseExpression)(license.license, orPolicy);
+        const renderedLicense = (0, licenseExpression_1.renderLicenseExpression)(license.license);
         // stats by category
         byCategory[category]++;
         // stats by specific license
-        {
-            const key = licenseType ?? 'unknown';
-            byLicense[key] = (byLicense[key] ?? 0) + 1;
-        }
+        byLicense[renderedLicense] = (byLicense[renderedLicense] ?? 0) + 1;
+        categoryByLicense[renderedLicense] = category;
         // memoization for lookup
         categorizedLicenses[packageKey] = category;
     });
@@ -58,6 +43,7 @@ function analyzeLicenses(report) {
         total,
         byCategory,
         byLicense,
+        categoryByLicense,
         description,
         categoriesPresence,
         categorizedLicenses,

package/build/licenses/licenseClassification.d.ts

@@ -0,0 +1,52 @@
+import type { LicenseExpression } from '../types';
+import { LicenseCategory } from './LicenseCategory';
+import type { OrPolicy } from './OrPolicy';
+/**
+ * Classifies a License Expression into a License Category.
+ *
+ * Categories are ordered permissive < weak copyleft < strong copyleft < unknown:
+ * - a license takes the category of its License Identifier;
+ * - an Unknown License is unknown;
+ * - AND always takes its most restrictive operand;
+ * - OR takes the operand chosen by the OR Policy.
+ *
+ * @param expression the License Expression to classify
+ * @param orPolicy the OR Policy applied to every OR in the expression; defaults to {@link DEFAULT_OR_POLICY}
+ * @returns the License Category of the whole expression
+ * @example
+ * classifyLicenseExpression(parseLicenseExpression('MIT OR GPL-3.0-only'), 'least-restrictive');
+ * // LicenseCategory.PERMISSIVE
+ */
+export declare function classifyLicenseExpression(expression: LicenseExpression, orPolicy?: OrPolicy): LicenseCategory;
+/** The copyleft that cannot be avoided for a License Expression, see {@link classifyUnavoidableCopyleft} */
+export interface UnavoidableCopyleft {
+    /** The known copyleft that must be complied with, never unknown; permissive when no known operand requires copyleft */
+    category: LicenseCategory;
+    /** `true` when an Unknown operand could require more than `category`, so `category` is only a lower bound */
+    unidentified: boolean;
+}
+/**
+ * Decides which copyleft cannot be avoided for a License Expression under an OR Policy.
+ *
+ * Unknown operands are ignored, so a custom license next to a copyleft one cannot hide the copyleft:
+ * - AND requires the most restrictive known operand;
+ * - OR with an Unknown operand requires what the other operand requires;
+ * - OR with two known operands follows the OR Policy;
+ * - an expression with no known operand requires no copyleft.
+ *
+ * Ignoring an Unknown operand can also understate the result (`MIT AND LicenseRef-Custom`, or an expression
+ * that is wholly Unknown), so the result says when that happened: `unidentified` is `true` when an Unknown operand
+ * could require more than the category under the OR Policy and the category is not already strong copyleft,
+ * the most restrictive known category. `MIT OR LicenseRef-Custom` is only unidentified under the most restrictive OR Policy.
+ *
+ * @param expression the License Expression to check
+ * @param orPolicy the OR Policy applied to every OR in the expression; defaults to {@link DEFAULT_OR_POLICY}
+ * @returns the known copyleft category, and whether an Unknown operand leaves it unidentified
+ * @example
+ * classifyUnavoidableCopyleft(parseLicenseExpression('GPL-3.0-only AND LicenseRef-Custom'));
+ * // { category: LicenseCategory.STRONG_COPYLEFT, unidentified: false }
+ * @example
+ * classifyUnavoidableCopyleft(parseLicenseExpression('MIT AND LicenseRef-Custom'));
+ * // { category: LicenseCategory.PERMISSIVE, unidentified: true }
+ */
+export declare function classifyUnavoidableCopyleft(expression: LicenseExpression, orPolicy?: OrPolicy): UnavoidableCopyleft;

package/build/licenses/licenseClassification.js

@@ -0,0 +1,136 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.classifyLicenseExpression = classifyLicenseExpression;
+exports.classifyUnavoidableCopyleft = classifyUnavoidableCopyleft;
+const constants_1 = require("../constants");
+const LicenseCategory_1 = require("./LicenseCategory");
+const OrPolicy_1 = require("./OrPolicy");
+const CATEGORY_RANK = {
+    [LicenseCategory_1.LicenseCategory.PERMISSIVE]: 0,
+    [LicenseCategory_1.LicenseCategory.WEAK_COPYLEFT]: 1,
+    [LicenseCategory_1.LicenseCategory.STRONG_COPYLEFT]: 2,
+    [LicenseCategory_1.LicenseCategory.UNKNOWN]: 3,
+};
+const OR_COMPARISON_STRATEGY = {
+    'most-restrictive': takeMoreRestrictive,
+    'least-restrictive': takeLessRestrictive,
+};
+/**
+ * Categorizes a canonical License Identifier from a parsed License Expression.
+ * Not for raw strings: an identifier outside the copyleft tables is assumed permissive,
+ * which is only safe because the parser rejects unrecognised identifiers.
+ */
+function categorizeLicenseId(licenseId) {
+    if (constants_1.STRONG_COPYLEFT_LICENSES_LOWERCASE.has(licenseId.toLowerCase())) {
+        return LicenseCategory_1.LicenseCategory.STRONG_COPYLEFT;
+    }
+    if (constants_1.WEAK_COPYLEFT_LICENSES_LOWERCASE.has(licenseId.toLowerCase())) {
+        return LicenseCategory_1.LicenseCategory.WEAK_COPYLEFT;
+    }
+    return LicenseCategory_1.LicenseCategory.PERMISSIVE;
+}
+/**
+ * Classifies a License Expression into a License Category.
+ *
+ * Categories are ordered permissive < weak copyleft < strong copyleft < unknown:
+ * - a license takes the category of its License Identifier;
+ * - an Unknown License is unknown;
+ * - AND always takes its most restrictive operand;
+ * - OR takes the operand chosen by the OR Policy.
+ *
+ * @param expression the License Expression to classify
+ * @param orPolicy the OR Policy applied to every OR in the expression; defaults to {@link DEFAULT_OR_POLICY}
+ * @returns the License Category of the whole expression
+ * @example
+ * classifyLicenseExpression(parseLicenseExpression('MIT OR GPL-3.0-only'), 'least-restrictive');
+ * // LicenseCategory.PERMISSIVE
+ */
+function classifyLicenseExpression(expression, orPolicy = OrPolicy_1.DEFAULT_OR_POLICY) {
+    switch (expression.kind) {
+        case 'license':
+            return isLicenseRef(expression.id) ? LicenseCategory_1.LicenseCategory.UNKNOWN : categorizeLicenseId(expression.id);
+        case 'unknown':
+            return LicenseCategory_1.LicenseCategory.UNKNOWN;
+        case 'and':
+            return takeMoreRestrictive(classifyLicenseExpression(expression.left, orPolicy), classifyLicenseExpression(expression.right, orPolicy));
+        case 'or':
+            return OR_COMPARISON_STRATEGY[orPolicy](classifyLicenseExpression(expression.left, orPolicy), classifyLicenseExpression(expression.right, orPolicy));
+    }
+}
+/**
+ * Decides which copyleft cannot be avoided for a License Expression under an OR Policy.
+ *
+ * Unknown operands are ignored, so a custom license next to a copyleft one cannot hide the copyleft:
+ * - AND requires the most restrictive known operand;
+ * - OR with an Unknown operand requires what the other operand requires;
+ * - OR with two known operands follows the OR Policy;
+ * - an expression with no known operand requires no copyleft.
+ *
+ * Ignoring an Unknown operand can also understate the result (`MIT AND LicenseRef-Custom`, or an expression
+ * that is wholly Unknown), so the result says when that happened: `unidentified` is `true` when an Unknown operand
+ * could require more than the category under the OR Policy and the category is not already strong copyleft,
+ * the most restrictive known category. `MIT OR LicenseRef-Custom` is only unidentified under the most restrictive OR Policy.
+ *
+ * @param expression the License Expression to check
+ * @param orPolicy the OR Policy applied to every OR in the expression; defaults to {@link DEFAULT_OR_POLICY}
+ * @returns the known copyleft category, and whether an Unknown operand leaves it unidentified
+ * @example
+ * classifyUnavoidableCopyleft(parseLicenseExpression('GPL-3.0-only AND LicenseRef-Custom'));
+ * // { category: LicenseCategory.STRONG_COPYLEFT, unidentified: false }
+ * @example
+ * classifyUnavoidableCopyleft(parseLicenseExpression('MIT AND LicenseRef-Custom'));
+ * // { category: LicenseCategory.PERMISSIVE, unidentified: true }
+ */
+function classifyUnavoidableCopyleft(expression, orPolicy = OrPolicy_1.DEFAULT_OR_POLICY) {
+    const category = findKnownCopyleft(expression, orPolicy) ?? LicenseCategory_1.LicenseCategory.PERMISSIVE;
+    return {
+        category,
+        unidentified: category !== LicenseCategory_1.LicenseCategory.STRONG_COPYLEFT && hasUnknownOperand(expression, orPolicy),
+    };
+}
+/**
+ * Whether an Unknown operand could require more than {@link findKnownCopyleft} found under the OR Policy.
+ *
+ * An OR with a known operand only has this risk under the most restrictive OR Policy: under the least restrictive
+ * one the known operand can always be chosen instead of the Unknown one.
+ */
+function hasUnknownOperand(expression, orPolicy) {
+    switch (expression.kind) {
+        case 'unknown':
+            return true;
+        case 'license':
+            return classifyLicenseExpression(expression, orPolicy) === LicenseCategory_1.LicenseCategory.UNKNOWN;
+        case 'and':
+            return hasUnknownOperand(expression.left, orPolicy) || hasUnknownOperand(expression.right, orPolicy);
+        case 'or':
+            return orPolicy === 'least-restrictive'
+                ? hasUnknownOperand(expression.left, orPolicy) && hasUnknownOperand(expression.right, orPolicy)
+                : hasUnknownOperand(expression.left, orPolicy) || hasUnknownOperand(expression.right, orPolicy);
+    }
+}
+/** Like {@link classifyUnavoidableCopyleft}, but `null` when no operand has a known category */
+function findKnownCopyleft(expression, orPolicy) {
+    if (expression.kind === 'unknown') {
+        return null;
+    }
+    if (expression.kind === 'license') {
+        const category = classifyLicenseExpression(expression, orPolicy);
+        return category === LicenseCategory_1.LicenseCategory.UNKNOWN ? null : category;
+    }
+    const left = findKnownCopyleft(expression.left, orPolicy);
+    const right = findKnownCopyleft(expression.right, orPolicy);
+    if (left === null || right === null) {
+        return left ?? right;
+    }
+    return expression.kind === 'and' ? takeMoreRestrictive(left, right) : OR_COMPARISON_STRATEGY[orPolicy](left, right);
+}
+/** A custom license reference, optionally qualified by a document: `LicenseRef-X` or `DocumentRef-Y:LicenseRef-X` */
+function isLicenseRef(id) {
+    return /^(DocumentRef-[^:]+:)?LicenseRef-/.test(id);
+}
+function takeMoreRestrictive(a, b) {
+    return CATEGORY_RANK[a] >= CATEGORY_RANK[b] ? a : b;
+}
+function takeLessRestrictive(a, b) {
+    return CATEGORY_RANK[a] <= CATEGORY_RANK[b] ? a : b;
+}

package/build/licenses/licenseExpression.d.ts

@@ -0,0 +1,37 @@
+import type { LicenseExpression } from '../types';
+/**
+ * Parses a Raw License into a License Expression, following the SPDX License Expression syntax.
+ *
+ * Never throws: a missing or unparseable value becomes an Unknown License that keeps the original value.
+ *
+ * @param rawLicense the license declaration as written in package.json, or `null` if absent
+ * @returns the parsed License Expression
+ * @example
+ * parseLicenseExpression('MIT OR Apache-2.0');
+ * // { kind: 'or', left: { kind: 'license', id: 'MIT', declaredId: 'MIT' }, right: { kind: 'license', id: 'Apache-2.0', declaredId: 'Apache-2.0' } }
+ */
+export declare function parseLicenseExpression(rawLicense: string | null): LicenseExpression;
+/**
+ * Collects the License Identifiers mentioned in a License Expression, regardless of how they are combined.
+ *
+ * @param expression the License Expression to flatten
+ * @returns the License Identifiers in order of first appearance, without duplicates; empty for an Unknown License
+ * @example
+ * collectLicenseIds(parseLicenseExpression('(MIT OR ISC) AND (MIT OR Apache-2.0)'));
+ * // ['MIT', 'ISC', 'Apache-2.0']
+ */
+export declare function collectLicenseIds(expression: LicenseExpression): string[];
+/**
+ * Renders a License Expression to a string, following the SPDX License Expression syntax.
+ *
+ * Adds only the parentheses required by SPDX precedence and by the right-nesting of operator chains,
+ * so that parsing the result gives back the same tree. An Unknown License renders as its original value
+ * (or `unknown` when absent) and is not expected to parse back to the same tree.
+ *
+ * @param expression the License Expression to render
+ * @returns the rendered License Expression
+ * @example
+ * renderLicenseExpression(parseLicenseExpression('(MIT OR Apache-2.0) AND ISC'));
+ * // '(MIT OR Apache-2.0) AND ISC'
+ */
+export declare function renderLicenseExpression(expression: LicenseExpression): string;

package/build/licenses/licenseExpression.js

@@ -0,0 +1,166 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseLicenseExpression = parseLicenseExpression;
+exports.collectLicenseIds = collectLicenseIds;
+exports.renderLicenseExpression = renderLicenseExpression;
+const index_json_1 = __importDefault(require("spdx-exceptions/index.json"));
+const spdx_expression_parse_1 = __importDefault(require("spdx-expression-parse"));
+const deprecated_json_1 = __importDefault(require("spdx-license-ids/deprecated.json"));
+const index_json_2 = __importDefault(require("spdx-license-ids/index.json"));
+const SPDX_LICENSE_IDS = new Set(index_json_2.default);
+const DEPRECATED_SPDX_LICENSE_IDS = new Set(deprecated_json_1.default);
+const CANONICAL_ID_BY_LOWERCASE = new Map([...index_json_2.default, ...deprecated_json_1.default, ...index_json_1.default].map((id) => [id.toLowerCase(), id]));
+const SPDX_OPERATORS = new Set(['and', 'or', 'with']);
+/**
+ * Unambiguous spellings that are not valid SPDX License Expressions, keyed by the lowercase, trimmed value.
+ * Ambiguous values (`BSD`, `GPL`, `LGPL`) are deliberately absent: guessing a variant or version changes the legal meaning.
+ */
+const LICENSE_ALIASES = new Map([
+    ['apache 2.0', 'Apache-2.0'],
+    ['apache-2', 'Apache-2.0'],
+    ['apache license 2.0', 'Apache-2.0'],
+    ['mit/x11', 'MIT'],
+    ['mit license', 'MIT'],
+]);
+/**
+ * Parses a Raw License into a License Expression, following the SPDX License Expression syntax.
+ *
+ * Never throws: a missing or unparseable value becomes an Unknown License that keeps the original value.
+ *
+ * @param rawLicense the license declaration as written in package.json, or `null` if absent
+ * @returns the parsed License Expression
+ * @example
+ * parseLicenseExpression('MIT OR Apache-2.0');
+ * // { kind: 'or', left: { kind: 'license', id: 'MIT', declaredId: 'MIT' }, right: { kind: 'license', id: 'Apache-2.0', declaredId: 'Apache-2.0' } }
+ */
+function parseLicenseExpression(rawLicense) {
+    if (rawLicense === null) {
+        return { kind: 'unknown', raw: rawLicense };
+    }
+    const parsed = tryParse(rawLicense) ??
+        tryParse(LICENSE_ALIASES.get(rawLicense.trim().toLowerCase())) ??
+        tryParse(fixIdentifierCase(rawLicense));
+    return parsed ?? { kind: 'unknown', raw: rawLicense };
+}
+function tryParse(rawLicense) {
+    if (rawLicense === undefined) {
+        return undefined;
+    }
+    try {
+        return mapSpdxParsedValueToLicenseExpression((0, spdx_expression_parse_1.default)(rawLicense));
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Rewrites every identifier and operator to its canonical spelling (SPDX Annex B.2: identifiers are case-insensitive).
+ * Tokens that match no known identifier are left as written, so the re-parse rejects them.
+ */
+function fixIdentifierCase(rawLicense) {
+    return rawLicense.replace(/[^\s()]+/g, (token) => {
+        if (SPDX_OPERATORS.has(token.toLowerCase())) {
+            return token.toUpperCase();
+        }
+        const plus = token.endsWith('+') ? '+' : '';
+        const id = plus ? token.slice(0, -1) : token;
+        const canonicalId = CANONICAL_ID_BY_LOWERCASE.get(id.toLowerCase()) ??
+            (/^licenseref-/i.test(id) ? `LicenseRef-${id.slice('LicenseRef-'.length)}` : id);
+        return `${canonicalId}${plus}`;
+    });
+}
+function mapSpdxParsedValueToLicenseExpression(spdxParsedValue) {
+    if ('conjunction' in spdxParsedValue) {
+        return {
+            kind: spdxParsedValue.conjunction,
+            left: mapSpdxParsedValueToLicenseExpression(spdxParsedValue.left),
+            right: mapSpdxParsedValueToLicenseExpression(spdxParsedValue.right),
+        };
+    }
+    const { license: declaredId, plus, exception } = spdxParsedValue;
+    return {
+        kind: 'license',
+        id: normalizeLicenseId(declaredId, plus === true),
+        declaredId,
+        ...(plus && { plus: true }),
+        ...(exception && { exception }),
+    };
+}
+/**
+ * Upgrades a declared License Identifier to its canonical form:
+ * - with `+`, to the `-or-later` identifier when one exists;
+ * - a deprecated identifier, to its `-only` identifier when one exists.
+ */
+function normalizeLicenseId(declaredId, plus) {
+    if (plus && SPDX_LICENSE_IDS.has(`${declaredId}-or-later`)) {
+        return `${declaredId}-or-later`;
+    }
+    if (!plus && DEPRECATED_SPDX_LICENSE_IDS.has(declaredId) && SPDX_LICENSE_IDS.has(`${declaredId}-only`)) {
+        return `${declaredId}-only`;
+    }
+    return declaredId;
+}
+/**
+ * Collects the License Identifiers mentioned in a License Expression, regardless of how they are combined.
+ *
+ * @param expression the License Expression to flatten
+ * @returns the License Identifiers in order of first appearance, without duplicates; empty for an Unknown License
+ * @example
+ * collectLicenseIds(parseLicenseExpression('(MIT OR ISC) AND (MIT OR Apache-2.0)'));
+ * // ['MIT', 'ISC', 'Apache-2.0']
+ */
+function collectLicenseIds(expression) {
+    switch (expression.kind) {
+        case 'license':
+            return [expression.id];
+        case 'and':
+        case 'or':
+            return [...new Set([...collectLicenseIds(expression.left), ...collectLicenseIds(expression.right)])];
+        case 'unknown':
+            return [];
+    }
+}
+/**
+ * Renders a License Expression to a string, following the SPDX License Expression syntax.
+ *
+ * Adds only the parentheses required by SPDX precedence and by the right-nesting of operator chains,
+ * so that parsing the result gives back the same tree. An Unknown License renders as its original value
+ * (or `unknown` when absent) and is not expected to parse back to the same tree.
+ *
+ * @param expression the License Expression to render
+ * @returns the rendered License Expression
+ * @example
+ * renderLicenseExpression(parseLicenseExpression('(MIT OR Apache-2.0) AND ISC'));
+ * // '(MIT OR Apache-2.0) AND ISC'
+ */
+function renderLicenseExpression(expression) {
+    switch (expression.kind) {
+        case 'unknown':
+            return expression.raw ?? 'unknown';
+        case 'or':
+        case 'and': {
+            const left = renderOperand(expression.left, expression.kind, 'left');
+            const right = renderOperand(expression.right, expression.kind, 'right');
+            return `${left} ${expression.kind.toUpperCase()} ${right}`;
+        }
+        case 'license':
+            return renderLicenseLeaf(expression);
+    }
+}
+function renderLicenseLeaf(leaf) {
+    // `+` is already absorbed into an `-or-later` identifier
+    const plus = leaf.plus && !leaf.id.endsWith('-or-later') ? '+' : '';
+    const exception = leaf.exception ? ` WITH ${leaf.exception}` : '';
+    return `${leaf.id}${plus}${exception}`;
+}
+function renderOperand(operand, parentKind, operandPosition) {
+    const rendered = renderLicenseExpression(operand);
+    return shouldAddParenthesis(operand, parentKind, operandPosition) ? `(${rendered})` : rendered;
+}
+function shouldAddParenthesis(childExpression, parentKind, childPosition) {
+    return ((parentKind === 'and' && childExpression.kind === 'or') ||
+        (childPosition === 'left' && parentKind === childExpression.kind));
+}