@callstack/licenses 0.3.3 → 1.0.0

package/build/node/common.d.ts

@@ -1,12 +1,33 @@
-import type { AboutLibrariesLikePackageInfo, AggregatedLicensesMapping, ScanPackageOptionsFactory } from '../types';
+import type { AboutLibrariesLikePackageInfo, AggregatedLicensesMapping, ScanDependenciesOptions, ScanPackageOptionsFactory } from '../types';
+/**
+ * Finds the root directory of the package that a directory belongs to - the closest directory (itself or a parent)
+ * containing a `package.json` with a `name` field. Nested `package.json` files without a name
+ * (e.g. `lib/commonjs/package.json` containing only `{ "type": "commonjs" }`) are skipped.
+ *
+ * Works for packages installed in `node_modules` as well as for workspace / linked packages,
+ * which are referenced by their real path (outside `node_modules`)
+ *
+ * @param startDir Absolute path to the directory to start the search from, e.g. the directory of a module file
+ * @returns Path to the package root directory or `null` if the directory does not belong to any named package
+ */
+export declare function findPackageRoot(startDir: string): string | null;
+/**
+ * Collects license information for a given list of package directories, e.g. the packages found in the Metro dependency graph.
+ * Unlike {@link scanDependencies}, it does not scan dependencies of the packages - the list is expected to be complete.
+ *
+ * @param packageRoots Paths to the root directories of the packages (directories containing `package.json`)
+ * @returns Aggregated licenses object containing the given packages and their license information
+ */
+export declare function scanPackageRoots(packageRoots: string[]): AggregatedLicensesMapping;
 /**
  * Scans `package.json` and searches for all packages under `dependencies` field. Supports monorepo projects.
  *
  * @param appPackageJsonPath Path to the `package.json` file of the application
  * @param scanOptionsFactory Factory function to create scan options for dependencies; defaults to {@link PackageUtils.legacyDefaultScanPackageOptionsFactory}
+ * @param options Additional options, see {@link ScanDependenciesOptions}
  * @returns Aggregated licenses object containing all scanned dependencies and their license information
  */
-export declare function scanDependencies(appPackageJsonPath: string, scanOptionsFactory?: ScanPackageOptionsFactory): AggregatedLicensesMapping;
+export declare function scanDependencies(appPackageJsonPath: string, scanOptionsFactory?: ScanPackageOptionsFactory, options?: ScanDependenciesOptions): AggregatedLicensesMapping;
 /**
  * Generates LicensePlist-compatible metadata for NPM dependencies as a YAML string.
  *

package/build/node/common.js

@@ -3,6 +3,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.findPackageRoot = findPackageRoot;
+exports.scanPackageRoots = scanPackageRoots;
 exports.scanDependencies = scanDependencies;
 exports.generateLicensePlistNPMOutput = generateLicensePlistNPMOutput;
 exports.writeLicensePlistNPMOutput = writeLicensePlistNPMOutput;
@@ -11,8 +13,109 @@ exports.writeAboutLibrariesNPMOutput = writeAboutLibrariesNPMOutput;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 const glob_1 = require("glob");
+const licenses_1 = require("../licenses");
 const utils_1 = require("../utils");
+const mergeLicensesMappings_1 = require("./mergeLicensesMappings");
 const utils_2 = require("./utils");
+/**
+ * Finds the root directory of the package that a directory belongs to - the closest directory (itself or a parent)
+ * containing a `package.json` with a `name` field. Nested `package.json` files without a name
+ * (e.g. `lib/commonjs/package.json` containing only `{ "type": "commonjs" }`) are skipped.
+ *
+ * Works for packages installed in `node_modules` as well as for workspace / linked packages,
+ * which are referenced by their real path (outside `node_modules`)
+ *
+ * @param startDir Absolute path to the directory to start the search from, e.g. the directory of a module file
+ * @returns Path to the package root directory or `null` if the directory does not belong to any named package
+ */
+function findPackageRoot(startDir) {
+    let dir = startDir;
+    // `path.dirname` of the filesystem root returns the root itself, which ends the loop
+    while (node_path_1.default.dirname(dir) !== dir) {
+        if (hasNamedPackageJson(dir)) {
+            return dir;
+        }
+        dir = node_path_1.default.dirname(dir);
+    }
+    return hasNamedPackageJson(dir) ? dir : null;
+}
+/**
+ * Checks whether a directory contains a valid `package.json` with a `name` field
+ *
+ * @param dir Path to the directory to check
+ */
+function hasNamedPackageJson(dir) {
+    const packageJsonPath = node_path_1.default.join(dir, 'package.json');
+    if (!node_fs_1.default.existsSync(packageJsonPath)) {
+        return false;
+    }
+    try {
+        const packageJson = JSON.parse(node_fs_1.default.readFileSync(packageJsonPath, { encoding: 'utf-8' }));
+        return Boolean(packageJson.name);
+    }
+    catch {
+        // invalid package.json - treat it as not a package root
+        return false;
+    }
+}
+/**
+ * Collects license information for a given list of package directories, e.g. the packages found in the Metro dependency graph.
+ * Unlike {@link scanDependencies}, it does not scan dependencies of the packages - the list is expected to be complete.
+ *
+ * @param packageRoots Paths to the root directories of the packages (directories containing `package.json`)
+ * @returns Aggregated licenses object containing the given packages and their license information
+ */
+function scanPackageRoots(packageRoots) {
+    const result = {};
+    for (const packageRoot of packageRoots) {
+        const packageJsonPath = node_path_1.default.join(packageRoot, 'package.json');
+        if (!node_fs_1.default.existsSync(packageJsonPath)) {
+            console.warn(`[react-native-legal] skipping ${packageRoot} could not find package.json`);
+            continue;
+        }
+        try {
+            const packageJson = require(node_path_1.default.resolve(packageJsonPath));
+            if (!packageJson.name || packageJson.private === true) {
+                continue;
+            }
+            const licenseInfo = readPackageLicenseInfo(packageJsonPath);
+            result[`${licenseInfo.name}@${licenseInfo.version}`] = {
+                ...licenseInfo,
+                dependencyType: 'dependency',
+                requiredVersion: licenseInfo.version,
+                parentPackages: [],
+            };
+        }
+        catch (error) {
+            console.warn(`[react-native-legal] could not process package.json in ${packageRoot}`);
+        }
+    }
+    return result;
+}
+/**
+ * Reads license information of a single package, based only on its own files
+ * (package.json and LICENSE file), without any context of how the package was found
+ *
+ * @param packageJsonPath Path to the package.json file of the package
+ */
+function readPackageLicenseInfo(packageJsonPath) {
+    const packageJson = require(node_path_1.default.resolve(packageJsonPath));
+    const rawLicense = utils_2.PackageUtils.parseLicenseField(packageJson) ?? null;
+    const license = (0, licenses_1.parseLicenseExpression)(rawLicense);
+    const licenseIds = (0, licenses_1.collectLicenseIds)(license);
+    const licenseFiles = utils_2.PackageUtils.readLicenseFiles(node_path_1.default.dirname(packageJsonPath), licenseIds);
+    return {
+        name: packageJson.name,
+        author: utils_2.PackageUtils.parseAuthorField(packageJson),
+        description: packageJson.description,
+        rawLicense,
+        license,
+        licenseIds,
+        licenseFiles,
+        url: utils_2.PackageUtils.parseRepositoryFieldToUrl(packageJson),
+        version: packageJson.version,
+    };
+}
 /**
  * Scans a single package and its dependencies for license information
  *
@@ -24,7 +127,7 @@ const utils_2 = require("./utils");
  * @param isOptionalDependency Whether the package is an optional dependency, in which case a warning will not be logged if the corresponding package.json is not found; defaults to `false`
  * @param parentPackageRoot Optional path to the parent package root, has priority over default root to lock for dependencies in; used to discover different versions of the same package installed in nested node_modules, e.g. suppose `X@1`, `Y@1` where `Y@1` -> `X@2`; then, node_modules would have `X@1`, `Y@1` and `X@2` would be installed to `node_modules/Y/node_modules/X@2`
  */
-function scanPackage(packageName, requiredVersion, processedPackages, result, scanOptionsFactory = utils_2.PackageUtils.legacyDefaultScanPackageOptionsFactory, { parentPackageRoot, parentPackageName, dependencyType, parentPackageRequiredVersion, parentPackageResolvedVersion, }) {
+function scanPackage(packageName, requiredVersion, processedPackages, result, scanOptionsFactory = utils_2.PackageUtils.legacyDefaultScanPackageOptionsFactory, { parentPackageRoot, parentPackageName, dependencyType, parentPackageRequiredVersion, parentPackageResolvedVersion, projectRoot, }) {
     const requiredVersionPackageKey = `${packageName}@${requiredVersion}`;
     // Skip if already processed to avoid circular dependencies
     if (processedPackages.has(requiredVersionPackageKey)) {
@@ -36,7 +139,7 @@ function scanPackage(packageName, requiredVersion, processedPackages, result, sc
     }
     processedPackages.add(requiredVersionPackageKey);
     try {
-        const localPackageJsonPath = utils_2.PackageUtils.getPackageJsonPath(packageName, parentPackageRoot);
+        const localPackageJsonPath = utils_2.PackageUtils.getPackageJsonPath(packageName, parentPackageRoot, projectRoot);
         if (!localPackageJsonPath) {
             // do not warn if the package is an optional dependency, it's normal it may not be installed
             if (!dependencyType.toLowerCase().includes('optional')) {
@@ -46,13 +149,6 @@ function scanPackage(packageName, requiredVersion, processedPackages, result, sc
         }
         const localPackageJson = require(node_path_1.default.resolve(localPackageJsonPath));
         if (localPackageJson.private !== true) {
-            const licenseFiles = glob_1.glob.sync('LICEN{S,C}E{.md,}', {
-                cwd: node_path_1.default.dirname(localPackageJsonPath),
-                absolute: true,
-                nocase: true,
-                nodir: true,
-                ignore: '**/{__tests__,__fixtures__,__mocks__}/**',
-            });
             const resolvedVersionPackageKey = `${packageName}@${localPackageJson.version}`;
             let parentPackageInfo;
             if (parentPackageName && parentPackageRequiredVersion && parentPackageResolvedVersion) {
@@ -70,14 +166,8 @@ function scanPackage(packageName, requiredVersion, processedPackages, result, sc
             }
             else {
                 result[resolvedVersionPackageKey] = {
+                    ...readPackageLicenseInfo(localPackageJsonPath),
                     name: packageName,
-                    author: utils_2.PackageUtils.parseAuthorField(localPackageJson),
-                    content: licenseFiles?.[0] ? node_fs_1.default.readFileSync(licenseFiles[0], { encoding: 'utf-8' }) : undefined,
-                    file: licenseFiles?.[0] ? licenseFiles[0] : undefined,
-                    description: localPackageJson.description,
-                    type: utils_2.PackageUtils.parseLicenseField(localPackageJson),
-                    url: utils_2.PackageUtils.parseRepositoryFieldToUrl(localPackageJson),
-                    version: localPackageJson.version,
                     requiredVersion,
                     parentPackages: parentPackageInfo ? [parentPackageInfo] : [],
                     parentPackageRequiredVersion,
@@ -121,6 +211,7 @@ function scanPackage(packageName, requiredVersion, processedPackages, result, sc
                     parentPackageName: packageName,
                     parentPackageRequiredVersion: requiredVersion,
                     parentPackageResolvedVersion: localPackageJson.version,
+                    projectRoot,
                 });
             }
         }
@@ -134,13 +225,32 @@ function scanPackage(packageName, requiredVersion, processedPackages, result, sc
  *
  * @param appPackageJsonPath Path to the `package.json` file of the application
  * @param scanOptionsFactory Factory function to create scan options for dependencies; defaults to {@link PackageUtils.legacyDefaultScanPackageOptionsFactory}
+ * @param options Additional options, see {@link ScanDependenciesOptions}
  * @returns Aggregated licenses object containing all scanned dependencies and their license information
  */
-function scanDependencies(appPackageJsonPath, scanOptionsFactory = utils_2.PackageUtils.legacyDefaultScanPackageOptionsFactory) {
-    const appPackageJson = require(node_path_1.default.resolve(appPackageJsonPath));
-    const dependencies = appPackageJson.dependencies;
-    const devDependencies = appPackageJson.devDependencies;
-    const optionalDependencies = appPackageJson.optionalDependencies;
+function scanDependencies(appPackageJsonPath, scanOptionsFactory = utils_2.PackageUtils.legacyDefaultScanPackageOptionsFactory, options = {}) {
+    const { additionalProjectRoots = [] } = options;
+    if (!Array.isArray(additionalProjectRoots) ||
+        additionalProjectRoots.some((additionalProjectRoot) => typeof additionalProjectRoot !== 'string' || !additionalProjectRoot)) {
+        throw new TypeError('[react-native-legal] additionalProjectRoots must be an array of non-empty paths');
+    }
+    const appRoot = node_fs_1.default.realpathSync(node_path_1.default.dirname(node_path_1.default.resolve(appPackageJsonPath)));
+    const additionalPackageJsonPaths = additionalProjectRoots.map((additionalProjectRoot) => {
+        const packageJsonPath = node_path_1.default.join(node_path_1.default.resolve(appRoot, additionalProjectRoot), 'package.json');
+        if (!node_fs_1.default.existsSync(packageJsonPath)) {
+            throw new Error(`[react-native-legal] additional project root "${additionalProjectRoot}" is not a directory with a package.json (${packageJsonPath} not found)`);
+        }
+        return packageJsonPath;
+    });
+    return (0, mergeLicensesMappings_1.mergeLicensesMappings)(scanProjectDependencies(appPackageJsonPath, scanOptionsFactory), ...additionalPackageJsonPaths.map((packageJsonPath) => scanProjectDependencies(packageJsonPath, scanOptionsFactory)));
+}
+function scanProjectDependencies(projectPackageJsonPath, scanOptionsFactory) {
+    const projectPackageJson = require(node_path_1.default.resolve(projectPackageJsonPath));
+    // real path, so that `node_modules` directories of the project's parent directories are found even if the project is reached through a symlink
+    const projectRoot = node_fs_1.default.realpathSync(node_path_1.default.dirname(node_path_1.default.resolve(projectPackageJsonPath)));
+    const dependencies = projectPackageJson.dependencies;
+    const devDependencies = projectPackageJson.devDependencies;
+    const optionalDependencies = projectPackageJson.optionalDependencies;
     const result = {};
     const processedPackages = new Set();
     const rootScanOptions = scanOptionsFactory({ isRoot: true, isWorkspacePackage: false });
@@ -161,6 +271,7 @@ function scanDependencies(appPackageJsonPath, scanOptionsFactory = utils_2.Packa
         for (const [depName, depVersion] of packages) {
             scanPackage(depName, depVersion, processedPackages, result, scanOptionsFactory, {
                 dependencyType,
+                projectRoot,
             });
         }
     }
@@ -183,12 +294,16 @@ function generateLicensePlistNPMOutput(licenses, iosProjectPath) {
         if (license.name !== normalizedPackageNameWithVersion) {
             renames[normalizedPackageNameWithVersion] = license.name;
         }
-        const relativeLicenseFile = license.file ? node_path_1.default.relative(iosProjectPath, license.file) : undefined;
+        // LicensePlist holds one `file`/`body` per package: a single license file is referenced directly,
+        // otherwise every license text is concatenated into the body under a per-license heading
+        const singleLicenseFile = license.licenseFiles.length === 1 ? license.licenseFiles[0].file : undefined;
         return {
             name: normalizedPackageNameWithVersion,
             version: license.version,
             ...(license.url && { source: license.url }),
-            ...(license.file ? { file: relativeLicenseFile } : { body: license.content ?? license.type ?? 'UNKNOWN' }),
+            ...(singleLicenseFile
+                ? { file: node_path_1.default.relative(iosProjectPath, singleLicenseFile) }
+                : { body: utils_2.PackageUtils.buildLicensePlistBody(license) }),
         };
     });
     const excludedEntries = Object.values(licenses).reduce((acc, license) => {
@@ -270,42 +385,28 @@ function writeLicensePlistNPMOutput(licenses, iosProjectPath, plistLikeOutput) {
  * @see {@link writeAboutLibrariesNPMOutput}
  */
 function generateAboutLibrariesNPMOutput(licenses) {
-    return Object.entries(licenses)
-        .map(([packageKey, license]) => {
-        return {
+    return Object.entries(licenses).map(([packageKey, license]) => {
+        const uniqueId = utils_2.PackageUtils.normalizePackageName(packageKey);
+        const licenseJsonPayloads = utils_2.PackageUtils.prepareAboutLibrariesLicenses(license).map(({ name, content }) => ({
+            content,
+            hash: utils_2.PackageUtils.prepareAboutLibrariesLicenseField(name, content),
+            name,
+            url: '',
+        }));
+        const libraryJsonPayload = {
             artifactVersion: license.version,
-            content: license.content ?? '',
             description: license.description ?? '',
             developers: [{ name: license.author ?? '', organisationUrl: '' }],
-            licenses: [utils_2.PackageUtils.prepareAboutLibrariesLicenseField(license)],
+            licenses: licenseJsonPayloads.map(({ hash }) => hash),
             name: license.name,
             tag: '',
-            type: license.type,
-            uniqueId: utils_2.PackageUtils.normalizePackageName(packageKey),
+            uniqueId,
             website: license.url,
         };
-    })
-        .map((jsonPayload) => {
-        const libraryJsonPayload = {
-            artifactVersion: jsonPayload.artifactVersion,
-            description: jsonPayload.description,
-            developers: jsonPayload.developers,
-            licenses: jsonPayload.licenses,
-            name: jsonPayload.name,
-            tag: jsonPayload.tag,
-            uniqueId: jsonPayload.uniqueId,
-            website: jsonPayload.website,
-        };
-        const licenseJsonPayload = {
-            content: jsonPayload.content,
-            hash: jsonPayload.licenses[0],
-            name: jsonPayload.type ?? '',
-            url: '',
-        };
         return {
-            normalizedPackageNameWithVersion: jsonPayload.uniqueId,
+            normalizedPackageNameWithVersion: uniqueId,
             libraryJsonPayload,
-            licenseJsonPayload,
+            licenseJsonPayloads,
         };
     });
 }
@@ -345,12 +446,14 @@ function writeAboutLibrariesNPMOutput(licenses, androidProjectPath, aboutLibrari
     if (!aboutLibrariesLikeOutput) {
         aboutLibrariesLikeOutput = generateAboutLibrariesNPMOutput(licenses);
     }
-    aboutLibrariesLikeOutput.forEach(({ normalizedPackageNameWithVersion, libraryJsonPayload, licenseJsonPayload }) => {
+    aboutLibrariesLikeOutput.forEach(({ normalizedPackageNameWithVersion, libraryJsonPayload, licenseJsonPayloads }) => {
         const libraryJsonFilePath = node_path_1.default.join(aboutLibrariesConfigLibrariesDirPath, `${normalizedPackageNameWithVersion}.json`);
-        const licenseJsonFilePath = node_path_1.default.join(aboutLibrariesConfigLicensesDirPath, `${licenseJsonPayload.hash}.json`);
         node_fs_1.default.writeFileSync(libraryJsonFilePath, JSON.stringify(libraryJsonPayload));
-        if (!node_fs_1.default.existsSync(licenseJsonFilePath)) {
-            node_fs_1.default.writeFileSync(licenseJsonFilePath, JSON.stringify(licenseJsonPayload));
+        for (const licenseJsonPayload of licenseJsonPayloads) {
+            const licenseJsonFilePath = node_path_1.default.join(aboutLibrariesConfigLicensesDirPath, `${licenseJsonPayload.hash}.json`);
+            if (!node_fs_1.default.existsSync(licenseJsonFilePath)) {
+                node_fs_1.default.writeFileSync(licenseJsonFilePath, JSON.stringify(licenseJsonPayload));
+            }
         }
     });
 }

package/build/node/index.d.ts

@@ -1,3 +1,4 @@
 export * from './common';
+export * from './mergeLicensesMappings';
 export * from './utils';
 export * from '../';

package/build/node/index.js

@@ -15,5 +15,6 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./common"), exports);
+__exportStar(require("./mergeLicensesMappings"), exports);
 __exportStar(require("./utils"), exports);
 __exportStar(require("../"), exports);

package/build/node/mergeLicensesMappings.d.ts

@@ -0,0 +1,8 @@
+import type { AggregatedLicensesMapping } from '../types';
+/**
+ * Combines licenses mappings, e.g. from scans of several project roots, into one.
+ *
+ * @param mappings Licenses mappings to combine; a package version present in several of them keeps the entry from the first one, with the parent packages of all of them
+ * @returns A new licenses mapping that shares no objects with the mappings passed in
+ */
+export declare function mergeLicensesMappings(...mappings: AggregatedLicensesMapping[]): AggregatedLicensesMapping;

package/build/node/mergeLicensesMappings.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mergeLicensesMappings = mergeLicensesMappings;
+const utils_1 = require("./utils");
+/**
+ * Combines licenses mappings, e.g. from scans of several project roots, into one.
+ *
+ * @param mappings Licenses mappings to combine; a package version present in several of them keeps the entry from the first one, with the parent packages of all of them
+ * @returns A new licenses mapping that shares no objects with the mappings passed in
+ */
+function mergeLicensesMappings(...mappings) {
+    const result = {};
+    for (const mapping of mappings) {
+        for (const [packageKey, license] of Object.entries(mapping)) {
+            const existingLicense = result[packageKey];
+            if (!existingLicense) {
+                result[packageKey] = structuredClone({ ...license, parentPackages: license.parentPackages ?? [] });
+                continue;
+            }
+            for (const parentPackage of license.parentPackages ?? []) {
+                if (!utils_1.MiscUtils.arrayIncludesObject(existingLicense.parentPackages, parentPackage)) {
+                    existingLicense.parentPackages.push(structuredClone(parentPackage));
+                }
+            }
+        }
+    }
+    return result;
+}

package/build/node/utils/aboutLibrariesLicenses.d.ts

@@ -0,0 +1,11 @@
+import type { License } from '../../types';
+/**
+ * One AboutLibraries license per License Identifier (or the Raw License when it is Unknown). Its name keeps
+ * a retained `+` and the License Exception; its content is the linked license file, else every unlinked text
+ * when the package has one license or exactly one unlinked text.
+ */
+export declare function prepareAboutLibrariesLicenses(license: License): {
+    name: string;
+    content: string;
+}[];
+export declare function prepareAboutLibrariesLicenseField(name: string, content?: string): string;

package/build/node/utils/aboutLibrariesLicenses.js

@@ -0,0 +1,58 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.prepareAboutLibrariesLicenses = prepareAboutLibrariesLicenses;
+exports.prepareAboutLibrariesLicenseField = prepareAboutLibrariesLicenseField;
+const licenses_1 = require("../../licenses");
+const miscUtils_1 = require("./miscUtils");
+function collectLicenseLeaves(expression) {
+    switch (expression.kind) {
+        case 'license':
+            return [expression];
+        case 'and':
+        case 'or':
+            return [...collectLicenseLeaves(expression.left), ...collectLicenseLeaves(expression.right)];
+        case 'unknown':
+            return [];
+    }
+}
+function getAboutLibrariesEntries(license) {
+    const leavesById = new Map(collectLicenseLeaves(license.license).map((leaf) => [leaf.id, leaf]));
+    if (leavesById.size > 0) {
+        return [...leavesById.values()].map((leaf) => ({ id: leaf.id, name: (0, licenses_1.renderLicenseExpression)(leaf) }));
+    }
+    // Unknown License: the Raw License is the best name we have
+    if (license.rawLicense) {
+        return [{ name: license.rawLicense }];
+    }
+    // nothing declared, but the package ships a license text, so keep it
+    if (license.licenseFiles.length > 0) {
+        return [{ name: (0, licenses_1.renderLicenseExpression)(license.license) }];
+    }
+    return [];
+}
+/**
+ * One AboutLibraries license per License Identifier (or the Raw License when it is Unknown). Its name keeps
+ * a retained `+` and the License Exception; its content is the linked license file, else every unlinked text
+ * when the package has one license or exactly one unlinked text.
+ */
+function prepareAboutLibrariesLicenses(license) {
+    const entries = getAboutLibrariesEntries(license);
+    const unlinkedTexts = license.licenseFiles.filter((file) => !file.licenseId).map((file) => file.content);
+    // unlinked texts go to every license when there is only one text (it may cover all of them),
+    // or when there is only one license (it owns every text)
+    const sharedContent = entries.length === 1 || unlinkedTexts.length === 1 ? unlinkedTexts.join('\n\n') : '';
+    return entries.map(({ id, name }) => ({
+        name,
+        content: (id ? license.licenseFiles.find((file) => file.licenseId === id)?.content : undefined) ?? sharedContent,
+    }));
+}
+function prepareAboutLibrariesLicenseField(name, content) {
+    // The returned value is used as a filename under `android/config/licenses/`.
+    // Legacy/compound SPDX expressions like `MIT/X11` or `(MIT OR Apache-2.0)` would
+    // otherwise produce paths containing `/`, `(` or spaces, which causes the writer
+    // to either fail with ENOENT (when a `/` is interpreted as a subdirectory) or
+    // to produce names that are invalid on some filesystems.
+    const sanitizedName = name.replace(/[^A-Za-z0-9._-]/g, '_');
+    // hash the unsanitized name when there is no text, so that names differing only in sanitized characters stay distinct
+    return `${sanitizedName}_${(0, miscUtils_1.sha512)(content || name)}`;
+}

package/build/node/utils/licenseFiles.d.ts

@@ -0,0 +1,8 @@
+import type { LicenseFile } from '../../types';
+/**
+ * Reads every license file (`LICEN{S,C}E*`, `COPYING*`, case-insensitive) from the package root.
+ *
+ * A file is linked to a License Identifier by its name suffix (e.g. `LICENSE-APACHE` → `Apache-2.0`),
+ * but only when exactly one of `licenseIds` matches; otherwise it is listed without an identifier.
+ */
+export declare function readLicenseFiles(packageDir: string, licenseIds: string[]): LicenseFile[];

package/build/node/utils/licenseFiles.js

@@ -0,0 +1,45 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readLicenseFiles = readLicenseFiles;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+const glob_1 = require("glob");
+// `LICEN{S,C}E*` also matches code and data files such as `license.js` or `licenses.json`
+const NON_LICENSE_EXTENSIONS = new Set(['.js', '.cjs', '.mjs', '.ts', '.cts', '.mts', '.tsx', '.jsx', '.json', '.map']);
+/**
+ * Reads every license file (`LICEN{S,C}E*`, `COPYING*`, case-insensitive) from the package root.
+ *
+ * A file is linked to a License Identifier by its name suffix (e.g. `LICENSE-APACHE` → `Apache-2.0`),
+ * but only when exactly one of `licenseIds` matches; otherwise it is listed without an identifier.
+ */
+function readLicenseFiles(packageDir, licenseIds) {
+    return glob_1.glob
+        .sync('{LICEN{S,C}E*,COPYING*}', { cwd: packageDir, absolute: true, nocase: true, nodir: true })
+        .sort()
+        .filter((file) => !NON_LICENSE_EXTENSIONS.has(node_path_1.default.extname(file).toLowerCase()))
+        .map((file) => {
+        const licenseId = linkLicenseId(node_path_1.default.basename(file), licenseIds);
+        return {
+            file,
+            content: node_fs_1.default.readFileSync(file, { encoding: 'utf-8' }),
+            ...(licenseId && { licenseId }),
+        };
+    });
+}
+function linkLicenseId(fileName, licenseIds) {
+    const suffix = fileName
+        .replace(/\.(txt|md)$/i, '')
+        .replace(/^(licen[sc]e|copying)[-_. ]*/i, '')
+        .toLowerCase();
+    if (!suffix) {
+        return undefined;
+    }
+    const matching = licenseIds.filter((id) => {
+        const lowerId = id.toLowerCase();
+        return lowerId === suffix || lowerId.startsWith(`${suffix}-`);
+    });
+    return matching.length === 1 ? matching[0] : undefined;
+}

package/build/node/utils/licensePlistBody.d.ts

@@ -0,0 +1,6 @@
+import type { License } from '../../types';
+/**
+ * LicensePlist body: every license text under a per-license heading (plain text, as LicensePlist shows
+ * bodies verbatim); the rendered License Expression when there is no text.
+ */
+export declare function buildLicensePlistBody(license: License): string;

package/build/node/utils/licensePlistBody.js

@@ -0,0 +1,20 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildLicensePlistBody = buildLicensePlistBody;
+const path_1 = __importDefault(require("path"));
+const licenses_1 = require("../../licenses");
+/**
+ * LicensePlist body: every license text under a per-license heading (plain text, as LicensePlist shows
+ * bodies verbatim); the rendered License Expression when there is no text.
+ */
+function buildLicensePlistBody(license) {
+    if (license.licenseFiles.length === 0) {
+        return (0, licenses_1.renderLicenseExpression)(license.license);
+    }
+    return license.licenseFiles
+        .map(({ file, content, licenseId }) => `=== ${licenseId ?? path_1.default.basename(file)} ===\n\n${content.trim()}`)
+        .join('\n\n');
+}

package/build/node/utils/packageUtils.d.ts

@@ -1,18 +1,27 @@
-import type { License, ScanPackageOptionsFactory } from '../../types';
-export declare function getPackageJsonPath(dependency: string, root?: string): string | null;
-export declare function resolvePackageJsonFromEntry(dependency: string): string | null;
+import type { ScanPackageOptionsFactory } from '../../types';
+export { prepareAboutLibrariesLicenseField, prepareAboutLibrariesLicenses } from './aboutLibrariesLicenses';
+export { buildLicensePlistBody } from './licensePlistBody';
+export { readLicenseFiles } from './licenseFiles';
+export declare function getPackageJsonPath(dependency: string, root?: string, projectRoot?: string): string | null;
+export declare function resolvePackageJsonFromEntry(dependency: string, paths?: string[]): string | null;
 export declare function findPackageRoot(entryPath: string): string | undefined;
 export declare function normalizePackageName(packageName: string): string;
-export declare function prepareAboutLibrariesLicenseField(license: License): string;
 export declare function parseAuthorField(json: {
     author: string | {
         name: string;
     };
 }): string | undefined;
+/**
+ * Reads the Raw License from package.json: the `license` string, the legacy `license: { type }` object,
+ * or the legacy `licenses: [{ type }, …]` array, whose types are joined with ` OR `.
+ */
 export declare function parseLicenseField(json: {
-    license: string | {
+    license?: string | {
         type: string;
     };
+    licenses?: Array<{
+        type?: string;
+    }>;
 }): string | undefined;
 export declare function parseRepositoryFieldToUrl(json: {
     repository: string | {