@verifyhash/semver-lite 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 <OWNER-NAME PLACEHOLDER>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,177 @@
+# semver-lite
+
+<!-- publish-prep -->
+> **TODO (owner): pick the final npm name/scope before publishing.**
+> The npm name is **not** finalized. `package.json` uses the placeholder
+> `PLACEHOLDER-semver-lite` — replace it with the real published name/scope
+> before any `npm publish`. Graduation to a package registry is a
+> **needs-human** decision, not something this project does on its own.
+
+A tiny, **zero-dependency, zero-network** Node.js library for **Semantic
+Versioning 2.0.0**: parse a version string, compare two versions by the exact
+SemVer precedence rules (including the fiddly pre-release ordering), and test
+whether a version satisfies a range using a **documented, practical subset** of
+npm-style range syntax.
+
+It is a single CommonJS file (`index.js`) with no dependencies, no install step,
+and no I/O. Drop it into any project.
+
+Spec reference: <https://semver.org/spec/v2.0.0.html>
+
+## Who it's for
+
+JavaScript/Node developers who need dependency- or version-logic — "is `1.4.2`
+inside `^1.2.0`?", "which of these tags is newest?", "does this pre-release sort
+before the release?" — **without** pulling in the full [`semver`](https://www.npmjs.com/package/semver)
+package and its transitive footprint. Good for build scripts, CLIs, plugin
+loaders, changelog tooling, and anywhere you want auditable, single-file version
+math.
+
+If you need the *complete* node-semver range grammar (coercion, `x` in the
+middle of comparators, full prerelease-range semantics, `loose` mode, etc.), use
+the real `semver` package. This library deliberately covers the common 95%.
+
+## Install / use
+
+No install — copy `index.js`, or `require` it directly:
+
+```js
+const semver = require('./index.js');
+
+semver.parse('1.2.3-rc.1+build.5');
+// { major: 1, minor: 2, patch: 3,
+//   prerelease: ['rc', 1], build: ['build', '5'],
+//   version: '1.2.3-rc.1' }
+
+semver.gt('1.0.0', '1.0.0-rc.1');            // true  (release > prerelease)
+semver.lt('1.0.0-alpha.1', '1.0.0-alpha.beta'); // true  (numeric < alphanumeric)
+semver.eq('1.0.0+build.1', '1.0.0+build.9'); // true  (build metadata ignored)
+
+semver.satisfies('1.2.5', '^1.2.0');         // true
+semver.satisfies('2.0.0', '^1.2.0');         // false
+semver.sort(['1.0.0', '1.0.0-rc.1', '1.0.0-alpha']);
+// ['1.0.0-alpha', '1.0.0-rc.1', '1.0.0']
+```
+
+## API
+
+### `parse(v) → object | null`
+
+Parses a SemVer 2.0.0 string. **Returns `null` on invalid input — it does not
+throw.** (Comparison functions below *do* throw on invalid input; see each.)
+
+Returns:
+
+```js
+{
+  major:      Number,
+  minor:      Number,
+  patch:      Number,
+  prerelease: Array<string|number>,  // numeric identifiers are Numbers
+  build:      Array<string>,          // always strings; ignored for precedence
+  version:    String                  // "major.minor.patch[-prerelease]" (no build)
+}
+```
+
+Rejected (returns `null`): missing components (`1`, `1.2`), a leading `v`
+(`v1.2.3`), leading zeros in any numeric field (`01.2.3`, `1.2.3-01`), empty
+identifiers (`1.2.3-`, `1.0.0-a..b`), and non-strings. Surrounding whitespace is
+trimmed.
+
+### `valid(v) → boolean`
+
+`true` iff `parse(v)` succeeds.
+
+### `compare(a, b) → -1 | 0 | 1`
+
+Compares by SemVer precedence. **Throws `TypeError` if either argument is not a
+valid version.** Precedence rules implemented (SemVer §11):
+
+1. Compare `major`, then `minor`, then `patch` numerically.
+2. A version **with** a pre-release has **lower** precedence than the same
+   version **without** one (`1.0.0-rc.1 < 1.0.0`).
+3. Pre-release identifiers are compared left-to-right:
+   - numeric identifiers are compared numerically (`beta.2 < beta.11`);
+   - a numeric identifier always has **lower** precedence than an alphanumeric
+     one (`alpha.1 < alpha.beta`);
+   - alphanumeric identifiers are compared by ASCII sort order;
+   - if all shared identifiers are equal, the version with **more** fields has
+     higher precedence (`alpha < alpha.1`).
+4. **Build metadata is ignored** entirely (`1.0.0+a` == `1.0.0+b`).
+
+### `gt`, `lt`, `gte`, `lte`, `eq`, `neq` `(a, b) → boolean`
+
+Thin wrappers over `compare`; same throwing behaviour.
+
+### `sort(list) → array`
+
+Returns a **new** array sorted ascending by precedence.
+
+### `satisfies(version, range) → boolean`
+
+Returns `true` iff `version` matches `range`. **Never throws for a bad
+`version`** (returns `false`); a *malformed range token* throws `TypeError`.
+
+## Supported range syntax
+
+| Form            | Example              | Expands to                    |
+| --------------- | -------------------- | ----------------------------- |
+| exact           | `1.2.3`              | `=1.2.3`                      |
+| equals          | `=1.2.3`             | `=1.2.3`                      |
+| comparators     | `>1.2.3` `>=1.2.3` `<2.0.0` `<=1.2.3` | as written   |
+| caret           | `^1.2.3`             | `>=1.2.3 <2.0.0`             |
+| caret (0.x)     | `^0.2.3`             | `>=0.2.3 <0.3.0`             |
+| caret (0.0.x)   | `^0.0.3`             | `>=0.0.3 <0.0.4`             |
+| tilde           | `~1.2.3`             | `>=1.2.3 <1.3.0`            |
+| tilde (partial) | `~1.2` / `~1`        | `>=1.2.0 <1.3.0` / `>=1.0.0 <2.0.0` |
+| x-range         | `1.2.x` `1.x` `1.2.*` `*` `1` | e.g. `1.2.x` → `>=1.2.0 <1.3.0` |
+| hyphen range    | `1.2.3 - 2.3.4`      | `>=1.2.3 <=2.3.4`           |
+| AND (space)     | `>=1.2.0 <2.0.0`     | intersection                  |
+| OR (`\|\|`)     | `^1.0.0 \|\| ^2.0.0` | union                         |
+
+Partial operands are handled the node-semver way: `>1` → `>=2.0.0`,
+`<=1.2` → `<1.3.0`, and a partial upper hyphen bound like `1.2.3 - 2.3` becomes
+`<2.4.0`.
+
+### Pre-release handling in ranges
+
+A version carrying a pre-release tag (e.g. `1.2.3-beta.2`) satisfies a range
+**only if** some comparator in the matched set names the *same*
+`major.minor.patch` tuple **and itself has a pre-release**. So
+`1.2.3-beta.2` satisfies `>=1.2.3-beta.1 <2.0.0` but **not** `^1.0.0`. This
+mirrors npm's default (non-`includePrerelease`) behaviour.
+
+## NOT supported (use the full `semver` package instead)
+
+- `includePrerelease` mode and advanced pre-release range edge cases beyond the
+  single documented rule above.
+- Version **coercion** / `loose` parsing (e.g. `v1`, `1.2.3.4`, `=v1.2`).
+- `x`/`*` in the *middle* of a version (`1.x.3`) — only trailing wildcards.
+- Comparators glued to carets/tildes in one token, or ranges relying on
+  operator precedence quirks.
+- Any I/O, registry lookups, or `dist-tags`.
+
+If your input might use those, reach for [`semver`](https://www.npmjs.com/package/semver).
+
+## Running the tests
+
+One command, no framework, only Node's built-in `assert`:
+
+```sh
+node test/index.test.js
+# or
+npm test
+```
+
+The suite covers: `parse` (valid, prerelease/build, leading-zero rejection,
+non-string input), the full **SemVer spec precedence chain**
+(`1.0.0-alpha < 1.0.0-alpha.1 < 1.0.0-alpha.beta < 1.0.0-beta < 1.0.0-beta.2 <
+1.0.0-beta.11 < 1.0.0-rc.1 < 1.0.0`), **build-metadata-ignored** equality,
+invalid-input handling, and `satisfies` with **both true and false** cases for
+every supported range form (exact, `^`, `~`, x-range, comparators, hyphen, and
+`||`).
+
+## License
+
+MIT — see `LICENSE`. (Owner: replace the copyright placeholder before
+publishing.)

package/index.js

@@ -0,0 +1,486 @@
+'use strict';
+
+/**
+ * semver-lite — a zero-dependency SemVer 2.0.0 parser, comparator, and a
+ * practical subset of npm-style range matching.
+ *
+ * No network, no I/O, no dependencies. Pure functions over strings.
+ * Spec reference: https://semver.org/spec/v2.0.0.html
+ */
+
+// ---------------------------------------------------------------------------
+// parse
+// ---------------------------------------------------------------------------
+
+// SemVer 2.0.0 core grammar.
+//   <major>.<minor>.<patch>[-<prerelease>][+<build>]
+// - numeric identifiers: 0 or a non-zero digit followed by digits (no leading zero)
+// - prerelease identifiers: alphanumerics + hyphen; numeric ones must not have
+//   leading zeros; identifiers must not be empty
+// - build identifiers: alphanumerics + hyphen; leading zeros allowed; must not
+//   be empty
+const NUM = '0|[1-9]\\d*';
+const PRE_ID = '(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*)';
+const BUILD_ID = '[0-9a-zA-Z-]+';
+const SEMVER_RE = new RegExp(
+  '^' +
+    `(${NUM})\\.(${NUM})\\.(${NUM})` +
+    `(?:-(${PRE_ID}(?:\\.${PRE_ID})*))?` +
+    `(?:\\+(${BUILD_ID}(?:\\.${BUILD_ID})*))?` +
+    '$'
+);
+
+/**
+ * Parse a SemVer 2.0.0 string.
+ *
+ * Returns `null` on invalid input (it does NOT throw). Callers who want a
+ * throwing variant can do `parse(v) || (() => { throw ... })()`.
+ *
+ * @param {string} v
+ * @returns {{major:number,minor:number,patch:number,prerelease:Array<string|number>,build:string[],version:string}|null}
+ */
+function parse(v) {
+  if (typeof v !== 'string') return null;
+  const str = v.trim();
+  const m = SEMVER_RE.exec(str);
+  if (!m) return null;
+
+  const [, major, minor, patch, pre, build] = m;
+  const prerelease =
+    pre === undefined
+      ? []
+      : pre.split('.').map((id) => (/^\d+$/.test(id) ? Number(id) : id));
+  const buildMeta = build === undefined ? [] : build.split('.');
+
+  return {
+    major: Number(major),
+    minor: Number(minor),
+    patch: Number(patch),
+    prerelease,
+    build: buildMeta,
+    version: `${major}.${minor}.${patch}${pre ? '-' + pre : ''}`,
+  };
+}
+
+/** Internal: parse or throw a TypeError. */
+function mustParse(v) {
+  const p = parse(v);
+  if (!p) throw new TypeError(`Invalid SemVer version: ${JSON.stringify(v)}`);
+  return p;
+}
+
+/** Whether a string is a valid SemVer 2.0.0 version. */
+function valid(v) {
+  return parse(v) !== null;
+}
+
+// ---------------------------------------------------------------------------
+// compare / precedence
+// ---------------------------------------------------------------------------
+
+/** Compare two numbers, returning -1 / 0 / 1. */
+function cmpNum(a, b) {
+  return a < b ? -1 : a > b ? 1 : 0;
+}
+
+/**
+ * Compare prerelease identifier lists per SemVer §11.4.
+ * Precondition: called only when both major.minor.patch are equal.
+ */
+function comparePrerelease(a, b) {
+  // A version WITHOUT prerelease has HIGHER precedence than one WITH.
+  if (a.length === 0 && b.length === 0) return 0;
+  if (a.length === 0) return 1; // a is release, b is prerelease -> a > b
+  if (b.length === 0) return -1;
+
+  const len = Math.min(a.length, b.length);
+  for (let i = 0; i < len; i++) {
+    const ai = a[i];
+    const bi = b[i];
+    const aNum = typeof ai === 'number';
+    const bNum = typeof bi === 'number';
+    if (aNum && bNum) {
+      const c = cmpNum(ai, bi);
+      if (c !== 0) return c;
+    } else if (aNum && !bNum) {
+      // numeric identifiers always have LOWER precedence than alphanumeric
+      return -1;
+    } else if (!aNum && bNum) {
+      return 1;
+    } else {
+      // both alphanumeric: ASCII lexical order
+      if (ai < bi) return -1;
+      if (ai > bi) return 1;
+    }
+  }
+  // All shared identifiers equal: the larger set has higher precedence.
+  return cmpNum(a.length, b.length);
+}
+
+/**
+ * Compare two versions by SemVer precedence. Build metadata is IGNORED.
+ * @returns {number} -1 if a<b, 0 if equal precedence, 1 if a>b
+ */
+function compare(a, b) {
+  const pa = mustParse(a);
+  const pb = mustParse(b);
+  return (
+    cmpNum(pa.major, pb.major) ||
+    cmpNum(pa.minor, pb.minor) ||
+    cmpNum(pa.patch, pb.patch) ||
+    comparePrerelease(pa.prerelease, pb.prerelease)
+  );
+}
+
+function gt(a, b) {
+  return compare(a, b) > 0;
+}
+function lt(a, b) {
+  return compare(a, b) < 0;
+}
+function gte(a, b) {
+  return compare(a, b) >= 0;
+}
+function lte(a, b) {
+  return compare(a, b) <= 0;
+}
+function eq(a, b) {
+  return compare(a, b) === 0;
+}
+function neq(a, b) {
+  return compare(a, b) !== 0;
+}
+
+/** Sort a list of versions ascending by precedence (returns a new array). */
+function sort(list) {
+  return [...list].sort(compare);
+}
+
+// ---------------------------------------------------------------------------
+// satisfies (range matching)
+// ---------------------------------------------------------------------------
+//
+// Supported (documented) subset — see README:
+//   - exact:        1.2.3            (also 1.2.3-alpha)
+//   - =:            =1.2.3
+//   - comparators:  >1.2.3  >=1.2.3  <2.0.0  <=1.2.3
+//   - caret:        ^1.2.3  ^0.2.3  ^0.0.3   (and ^1.2.x style partials)
+//   - tilde:        ~1.2.3  ~1.2    ~1
+//   - x-ranges:     1.2.x   1.x   1.2.*   *   1
+//   - hyphen:       1.2.3 - 2.3.4
+//   - OR unions:    A || B
+//   - whitespace-joined AND: ">=1.2.0 <2.0.0"
+//
+// A prerelease version (e.g. 1.2.3-beta) only satisfies a comparator set when
+// at least one comparator in that set names the SAME major.minor.patch tuple
+// with a prerelease — matching npm's behaviour, and documented as such.
+
+const XR = '[xX*]';
+// A single partial version like "1", "1.2", "1.2.3", "1.2.x", "*", with
+// optional prerelease/build on a full triple.
+const PARTIAL_RE = new RegExp(
+  '^[v=\\s]*' +
+    `(${NUM}|${XR})` +
+    `(?:\\.(${NUM}|${XR}))?` +
+    `(?:\\.(${NUM}|${XR}))?` +
+    `(?:-(${PRE_ID}(?:\\.${PRE_ID})*))?` +
+    `(?:\\+(${BUILD_ID}(?:\\.${BUILD_ID})*))?` +
+    '$'
+);
+
+function isX(part) {
+  return part === undefined || part === '*' || part === 'x' || part === 'X';
+}
+
+/** Parse a partial version into {major,minor,patch,pre} with nulls for x/missing. */
+function parsePartial(str) {
+  const m = PARTIAL_RE.exec(str.trim());
+  if (!m) return null;
+  const [, M, mi, p, pre] = m;
+  return {
+    major: isX(M) ? null : Number(M),
+    minor: isX(mi) ? null : Number(mi),
+    patch: isX(p) ? null : Number(p),
+    pre: pre === undefined ? null : pre,
+  };
+}
+
+/** Build a comparator object {op, version(parsed)}. */
+function comparator(op, versionStr) {
+  return { op, v: mustParse(versionStr) };
+}
+
+/**
+ * Expand a caret partial into a comparator set.
+ * ^1.2.3 -> >=1.2.3 <2.0.0
+ * ^0.2.3 -> >=0.2.3 <0.3.0
+ * ^0.0.3 -> >=0.0.3 <0.0.4
+ * ^1.2   -> >=1.2.0 <2.0.0
+ * ^0     -> >=0.0.0 <1.0.0
+ */
+function expandCaret(part, preStr) {
+  if (part.major === null) return [comparator('>=', '0.0.0')]; // ^* -> any
+  const min = `${part.major}.${part.minor || 0}.${part.patch || 0}${
+    preStr ? '-' + preStr : ''
+  }`;
+  let upper;
+  if (part.major > 0 || part.minor === null) {
+    upper = `${part.major + 1}.0.0`;
+  } else if (part.minor > 0 || part.patch === null) {
+    upper = `0.${part.minor + 1}.0`;
+  } else {
+    upper = `0.0.${part.patch + 1}`;
+  }
+  return [comparator('>=', min), comparator('<', upper)];
+}
+
+/**
+ * Expand a tilde partial into a comparator set.
+ * ~1.2.3 -> >=1.2.3 <1.3.0
+ * ~1.2   -> >=1.2.0 <1.3.0
+ * ~1     -> >=1.0.0 <2.0.0
+ */
+function expandTilde(part, preStr) {
+  if (part.major === null) return [comparator('>=', '0.0.0')];
+  const min = `${part.major}.${part.minor || 0}.${part.patch || 0}${
+    preStr ? '-' + preStr : ''
+  }`;
+  let upper;
+  if (part.minor === null) {
+    upper = `${part.major + 1}.0.0`;
+  } else {
+    upper = `${part.major}.${part.minor + 1}.0`;
+  }
+  return [comparator('>=', min), comparator('<', upper)];
+}
+
+/**
+ * Expand an x-range / bare partial into a comparator set.
+ * *      -> >=0.0.0
+ * 1      -> >=1.0.0 <2.0.0
+ * 1.2    -> >=1.2.0 <1.3.0
+ * 1.2.3  -> =1.2.3 (exact; handled as >= & <= same)
+ */
+function expandXRange(part) {
+  if (part.major === null) return [comparator('>=', '0.0.0')];
+  if (part.minor === null) {
+    return [
+      comparator('>=', `${part.major}.0.0`),
+      comparator('<', `${part.major + 1}.0.0`),
+    ];
+  }
+  if (part.patch === null) {
+    return [
+      comparator('>=', `${part.major}.${part.minor}.0`),
+      comparator('<', `${part.major}.${part.minor + 1}.0`),
+    ];
+  }
+  // Fully specified: exact match (respecting any prerelease).
+  const exact = `${part.major}.${part.minor}.${part.patch}${
+    part.pre ? '-' + part.pre : ''
+  }`;
+  return [comparator('=', exact)];
+}
+
+/**
+ * Expand a comparator token like ">=1.2", ">1", "<2.0.0" where the operand may
+ * be partial. npm semantics: for inequality ops, x/missing parts default in a
+ * way that keeps the bound meaningful.
+ */
+function expandComparatorToken(op, part) {
+  // For >, >=, <, <= with partials, fill missing with 0 for the lower-ish
+  // interpretation used by node-semver.
+  const major = part.major === null ? 0 : part.major;
+  const minor = part.minor === null ? 0 : part.minor;
+  const patch = part.patch === null ? 0 : part.patch;
+  const preStr = part.pre ? '-' + part.pre : '';
+
+  // If everything is x (e.g. ">=*"), treat as >=0.0.0 or an always-open bound.
+  if (part.major === null) {
+    if (op === '<' || op === '<=') return [comparator('<', '0.0.0')]; // <* matches nothing
+    return [comparator('>=', '0.0.0')];
+  }
+
+  // Handle partials for < and > with npm's rounding.
+  if (op === '>' && part.minor === null) {
+    // >1  -> >=2.0.0
+    return [comparator('>=', `${major + 1}.0.0`)];
+  }
+  if (op === '>' && part.patch === null) {
+    // >1.2 -> >=1.3.0
+    return [comparator('>=', `${major}.${minor + 1}.0`)];
+  }
+  if (op === '<=' && part.minor === null) {
+    // <=1 -> <2.0.0
+    return [comparator('<', `${major + 1}.0.0`)];
+  }
+  if (op === '<=' && part.patch === null) {
+    // <=1.2 -> <1.3.0
+    return [comparator('<', `${major}.${minor + 1}.0`)];
+  }
+  return [comparator(op, `${major}.${minor}.${patch}${preStr}`)];
+}
+
+/** Parse one whitespace-separated space of a range into a comparator set. */
+function parseComparatorSet(setStr) {
+  const trimmed = setStr.trim();
+  if (trimmed === '') return [comparator('>=', '0.0.0')]; // empty == "*"
+
+  // Hyphen range: "1.2.3 - 2.3.4"
+  const hyphen = /^\s*(.+?)\s+-\s+(.+?)\s*$/.exec(trimmed);
+  if (hyphen) {
+    return expandHyphen(hyphen[1], hyphen[2]);
+  }
+
+  // Split on whitespace into individual tokens (AND).
+  const tokens = trimmed.split(/\s+/);
+  const comps = [];
+  for (const tok of tokens) {
+    comps.push(...parseToken(tok));
+  }
+  return comps;
+}
+
+function expandHyphen(loStr, hiStr) {
+  const lo = parsePartial(loStr);
+  const hi = parsePartial(hiStr);
+  if (!lo || !hi) throw new TypeError(`Invalid hyphen range: ${loStr} - ${hiStr}`);
+  const comps = [];
+
+  // Lower bound: partials fill with 0.
+  const loMajor = lo.major === null ? 0 : lo.major;
+  const loMinor = lo.minor === null ? 0 : lo.minor;
+  const loPatch = lo.patch === null ? 0 : lo.patch;
+  comps.push(
+    comparator(
+      '>=',
+      `${loMajor}.${loMinor}.${loPatch}${lo.pre ? '-' + lo.pre : ''}`
+    )
+  );
+
+  // Upper bound: partials become an exclusive next bound.
+  if (hi.major === null) {
+    // "x - *" -> no upper bound
+  } else if (hi.minor === null) {
+    comps.push(comparator('<', `${hi.major + 1}.0.0`));
+  } else if (hi.patch === null) {
+    comps.push(comparator('<', `${hi.major}.${hi.minor + 1}.0`));
+  } else {
+    comps.push(
+      comparator('<=', `${hi.major}.${hi.minor}.${hi.patch}${hi.pre ? '-' + hi.pre : ''}`)
+    );
+  }
+  return comps;
+}
+
+/** Parse a single AND token (^, ~, comparator, x-range, exact). */
+function parseToken(tok) {
+  let s = tok.trim();
+  if (s === '') return [comparator('>=', '0.0.0')];
+
+  // Caret
+  if (s[0] === '^') {
+    const part = parsePartial(s.slice(1));
+    if (!part) throw new TypeError(`Invalid caret range: ${tok}`);
+    return expandCaret(part, part.pre);
+  }
+  // Tilde
+  if (s[0] === '~') {
+    // Support "~>" as an alias of "~" (rubygems-ism sometimes seen)
+    const body = s[1] === '>' ? s.slice(2) : s.slice(1);
+    const part = parsePartial(body);
+    if (!part) throw new TypeError(`Invalid tilde range: ${tok}`);
+    return expandTilde(part, part.pre);
+  }
+  // Comparators
+  const m = /^(>=|<=|>|<|=)(.*)$/.exec(s);
+  if (m) {
+    const op = m[1];
+    const part = parsePartial(m[2]);
+    if (!part) throw new TypeError(`Invalid comparator: ${tok}`);
+    if (op === '=') {
+      // "=1.2" behaves as an x-range expansion of the partial.
+      return expandXRange(part);
+    }
+    return expandComparatorToken(op, part);
+  }
+  // Bare partial / x-range / exact
+  const part = parsePartial(s);
+  if (!part) throw new TypeError(`Invalid range token: ${tok}`);
+  return expandXRange(part);
+}
+
+/** Test a single comparator against a parsed version. */
+function testComparator(comp, version) {
+  const c = compare(version.version, comp.v.version);
+  switch (comp.op) {
+    case '>':
+      return c > 0;
+    case '>=':
+      return c >= 0;
+    case '<':
+      return c < 0;
+    case '<=':
+      return c <= 0;
+    case '=':
+      return c === 0;
+    default:
+      return false;
+  }
+}
+
+/**
+ * Does `version` satisfy `range`?
+ *
+ * @param {string} version
+ * @param {string} range
+ * @returns {boolean}
+ */
+function satisfies(version, range) {
+  const v = parse(version);
+  if (!v) return false;
+  if (typeof range !== 'string') return false;
+
+  const unions = range.split('||');
+  for (const union of unions) {
+    const comps = parseComparatorSet(union);
+
+    // Prerelease gating (npm semantics): a version with a prerelease tag only
+    // matches if some comparator in this set is for the SAME [major,minor,patch]
+    // AND itself carries a prerelease.
+    if (v.prerelease.length > 0) {
+      const allowed = comps.some(
+        (comp) =>
+          comp.v.prerelease.length > 0 &&
+          comp.v.major === v.major &&
+          comp.v.minor === v.minor &&
+          comp.v.patch === v.patch
+      );
+      if (!allowed) continue;
+    }
+
+    let ok = true;
+    for (const comp of comps) {
+      if (!testComparator(comp, v)) {
+        ok = false;
+        break;
+      }
+    }
+    if (ok) return true;
+  }
+  return false;
+}
+
+module.exports = {
+  parse,
+  valid,
+  compare,
+  gt,
+  lt,
+  gte,
+  lte,
+  eq,
+  neq,
+  sort,
+  satisfies,
+};

package/package.json

@@ -0,0 +1,38 @@
+{
+  "name": "@verifyhash/semver-lite",
+  "version": "0.1.0",
+  "description": "Zero-dependency SemVer 2.0.0 parse, precedence compare, and a documented practical subset of npm-style range matching for Node.js.",
+  "keywords": [
+    "semver",
+    "semver2",
+    "version",
+    "parse",
+    "compare",
+    "precedence",
+    "satisfies",
+    "range",
+    "caret",
+    "tilde"
+  ],
+  "main": "index.js",
+  "scripts": {
+    "test": "node test/index.test.js"
+  },
+  "license": "MIT",
+  "files": [
+    "index.js",
+    "README.md"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/verifyhash/libs.git",
+    "directory": "semver-lite"
+  },
+  "homepage": "https://github.com/verifyhash/libs/tree/main/semver-lite#readme",
+  "bugs": {
+    "url": "https://github.com/verifyhash/libs/issues"
+  }
+}