license-cop 1.8.1 → 2.0.0

package/LICENSE.md

@@ -1,4 +1,4 @@
-Copyright (c) 2023-2025, [Toby Smith](https://tobysmith.uk), contact@tobythe.dev
+Copyright (c) 2023-2026, [Toby Smith](https://tobysmith.uk), contact@tobythe.dev
 
 Permission to use, copy, modify, and/or distribute this software for any purpose with or without fee is hereby granted, provided that the above copyright notice and this permission notice appear in all copies.
 

package/README.md

@@ -36,9 +36,29 @@ npx license-cop
 
 The `license-cop` command will use an exit code of 0 if all your dependencies conform to the settings in your config file.
 
+## Command line options
+
+```bash
+license-cop [options] [command]
+```
+
+| Option                               | Description                                                                                                               |
+| ------------------------------------ | ------------------------------------------------------------------------------------------------------------------------- |
+| `--dev-dependencies <include\|only>` | `include` checks your dev-dependencies as well as your production dependencies, `only` checks just your dev-dependencies. |
+| `-d, --directory <dir>`              | The directory of the project. Defaults to the current working directory.                                                  |
+| `--verbose`                          | Enable verbose logging.                                                                                                   |
+| `-v, --version`                      | Print the installed version of license-cop.                                                                               |
+| `-h, --help`                         | Display the help text.                                                                                                    |
+
+| Command | Description                                                                                                                            |
+| ------- | -------------------------------------------------------------------------------------------------------------------------------------- |
+| `init`  | Create a new license-cop config file. It won't overwrite one: it fails if the project already has a config in any of the places below. |
+
+When `--dev-dependencies` is given it replaces the [`includeDevDependencies`](#includedevdependencies) and [`devDependenciesOnly`](#devdependenciesonly) config options; when it's absent those config options apply.
+
 ## Config File
 
-By default the `--init` flag will make a `.licenses.json` file, however you can use many different variations of file name and file type including:
+By default the `init` command will make a `.licenses.json` file, however you can use many different variations of file name and file type including:
 
 <!--- cspell:disable-next-line --->
 
@@ -101,12 +121,12 @@ If you extend a remote file, and that in-turn extends an npm package, then you'r
 #### `includeDevDependencies`
 
 `false` by default.  
-Set to `true` to make license-cop also check your dev-dependencies.
+Set to `true` to make license-cop also check your dev-dependencies. The `--dev-dependencies` command line option takes precedence over this.
 
 #### `devDependenciesOnly`
 
 `false` by default.  
-Set to `true` to make license-cop only check your dev-dependencies.
+Set to `true` to make license-cop only check your dev-dependencies. The `--dev-dependencies` command line option takes precedence over this.
 
 ## CI/CD Example (GitHub Actions)
 
@@ -129,10 +149,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v7
 
       - name: Setup Node.js
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v7
         with:
           cache: npm
 

package/dist/bin.js

@@ -0,0 +1,545 @@
+#!/usr/bin/env node
+import { parseArgs } from "node:util";
+import { z } from "zod";
+import { LicenseCopError, PackageJsonError, checkLicenses } from "@license-cop/core";
+import { join } from "node:path";
+import { readFile, stat, writeFile } from "node:fs/promises";
+import JSON5 from "json5";
+import deepMerge from "deepmerge";
+import { cosmiconfig } from "cosmiconfig";
+import { stat as stat$1 } from "fs/promises";
+import { join as join$1 } from "path";
+import { fileURLToPath } from "node:url";
+//#region src/io.ts
+const defaultIo = {
+	stdout: (line) => console.log(line),
+	stderr: (line) => console.error(line)
+};
+const createVerboseLogger = (io, enabled) => {
+	if (!enabled) return () => {};
+	const verbose = (message) => io.stdout(message);
+	verbose("Verbose logging enabled");
+	return verbose;
+};
+//#endregion
+//#region src/errors.ts
+var UsageError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "UsageError";
+	}
+};
+//#endregion
+//#region src/args/schema.ts
+const devDependenciesModeSchema = z.enum(["include", "only"], { error: (issue) => `--dev-dependencies must be 'include' or 'only', but got '${String(issue.input)}'` });
+/** What the command line asks for. Each `error` is what the user sees, so it reads as a sentence. */
+const cliInvocationSchema = z.discriminatedUnion("kind", [
+	z.object({
+		kind: z.literal("check"),
+		directory: z.string(),
+		verbose: z.boolean(),
+		devDependencies: devDependenciesModeSchema.optional()
+	}),
+	z.object({
+		kind: z.literal("init"),
+		directory: z.string(),
+		verbose: z.boolean(),
+		devDependencies: z.undefined({ error: "'init' does not accept --dev-dependencies" }).optional()
+	}),
+	z.object({ kind: z.literal("version") }),
+	z.object({ kind: z.literal("help") })
+]);
+//#endregion
+//#region src/args/parse.ts
+const removedFlagHints = {
+	"--init": "the --init flag has been removed, use 'license-cop init' instead",
+	"-D": "the -D flag has been removed, use '--dev-dependencies include' instead",
+	"--include-dev": "the --include-dev flag has been removed, use '--dev-dependencies include' instead",
+	"--dev-only": "the --dev-only flag has been removed, use '--dev-dependencies only' instead"
+};
+const cliOptions = {
+	directory: {
+		type: "string",
+		short: "d"
+	},
+	verbose: { type: "boolean" },
+	"dev-dependencies": { type: "string" },
+	version: {
+		type: "boolean",
+		short: "v"
+	},
+	help: {
+		type: "boolean",
+		short: "h"
+	}
+};
+const parseCliArgs = (args, defaultDirectory) => {
+	throwIfRemovedFlag(args);
+	const tokens = tokenize(args);
+	const candidate = toCandidate(tokens, defaultDirectory);
+	const result = cliInvocationSchema.safeParse(candidate);
+	if (!result.success) throw new UsageError(firstMessage(result.error));
+	return result.data;
+};
+const throwIfRemovedFlag = (args) => {
+	for (const arg of args) {
+		const hint = removedFlagHints[arg];
+		if (hint) throw new UsageError(hint);
+	}
+};
+const tokenize = (args) => {
+	try {
+		const { values, positionals } = parseArgs({
+			args,
+			allowPositionals: true,
+			strict: true,
+			options: cliOptions
+		});
+		return {
+			values,
+			positionals
+		};
+	} catch (error) {
+		throw new UsageError(error instanceof Error ? error.message : String(error));
+	}
+};
+/**
+* Decides which command was asked for, once, and lays the flags out for the schema to check. Help
+* and the version win over everything else on the command line.
+*/
+const toCandidate = ({ values, positionals }, defaultDirectory) => {
+	if (values.help) return { kind: "help" };
+	if (values.version) return { kind: "version" };
+	const isInit = positionals[0] === "init";
+	const unexpected = isInit ? positionals[1] : positionals[0];
+	if (unexpected !== void 0) throw new UsageError(`unexpected argument '${unexpected}'`);
+	return {
+		kind: isInit ? "init" : "check",
+		directory: values.directory ?? defaultDirectory,
+		verbose: values.verbose ?? false,
+		devDependencies: values["dev-dependencies"]
+	};
+};
+const firstMessage = (error) => error.issues[0]?.message ?? error.message;
+//#endregion
+//#region src/config/parsers/json5.ts
+const json5Parse = (content) => JSON5.parse(content);
+//#endregion
+//#region src/read-project-name.ts
+const projectPackageJsonSchema = z.object({ name: z.string() });
+/** The name in a project's package.json, for saying what's being scanned. */
+const readProjectName = async (pathToPackageJson, onVerbose) => {
+	const contents = await readFile(pathToPackageJson, "utf8").catch(() => {
+		onVerbose(`Cannot find the package.json: '${pathToPackageJson}'`);
+		throw new PackageJsonError(`Cannot find the file: '${pathToPackageJson}'`);
+	});
+	let parsed;
+	try {
+		parsed = json5Parse(contents);
+	} catch (error) {
+		const reason = error instanceof Error ? error.message : String(error);
+		throw new PackageJsonError(`Unable to parse package.json: ${pathToPackageJson}: ${reason}`);
+	}
+	const result = projectPackageJsonSchema.safeParse(parsed);
+	if (!result.success) throw new PackageJsonError(`Unable to parse package.json: ${pathToPackageJson}: ${result.error.message}`);
+	return result.data.name;
+};
+//#endregion
+//#region src/config/dev-dependencies.ts
+/**
+* The `--dev-dependencies` flag, when given, decides on its own and the config file's keys are
+* ignored; only when it's absent do the config keys apply. This means the two options are never
+* both true when they come from the flag.
+*/
+const resolveDevDependencyOptions = (flag, config) => {
+	switch (flag) {
+		case void 0: return {
+			includeDevDependencies: config.includeDevDependencies,
+			devDependenciesOnly: config.devDependenciesOnly
+		};
+		case "include": return {
+			includeDevDependencies: true,
+			devDependenciesOnly: false
+		};
+		case "only": return {
+			includeDevDependencies: false,
+			devDependenciesOnly: true
+		};
+		default: throw new Error(`Unknown dev dependencies mode: ${flag}`);
+	}
+};
+//#endregion
+//#region src/config/config-error.ts
+var ConfigError = class ConfigError extends LicenseCopError {
+	constructor(message) {
+		super(`Config error: ${message}`);
+	}
+	static fromUnknown(e) {
+		const message = resolveMessage(e);
+		return new ConfigError(message);
+	}
+};
+const resolveMessage = (e) => {
+	if (e instanceof Error) return e.message;
+	if (typeof e === "string") return e;
+	return "Unknown error";
+};
+//#endregion
+//#region src/config/config.ts
+const rawConfigParser = z.object({
+	extends: z.string().optional(),
+	licenses: z.array(z.string()).optional(),
+	packages: z.array(z.string()).optional(),
+	includeDevDependencies: z.boolean().optional(),
+	devDependenciesOnly: z.boolean().optional(),
+	directory: z.string().optional()
+});
+/**
+* Validates a config without applying any defaults. Configs must be merged in this form,
+* otherwise a default on the child would override a value that was explicitly set on its parent.
+*/
+const parseRawConfig = (config) => {
+	const parseResult = rawConfigParser.safeParse(config);
+	if (!parseResult.success) throw new ConfigError(parseResult.error.message);
+	return parseResult.data;
+};
+const applyConfigDefaults = (config) => ({
+	extends: config.extends,
+	licenses: config.licenses ?? [],
+	packages: config.packages ?? [],
+	includeDevDependencies: config.includeDevDependencies ?? false,
+	devDependenciesOnly: config.devDependenciesOnly ?? false
+});
+//#endregion
+//#region src/config/find-config.ts
+const moduleNames = [
+	"licenses",
+	"licences",
+	"licensesrc",
+	"licencesrc"
+];
+const generateSearchPlaces = (moduleName) => [
+	`.${moduleName}`,
+	`.${moduleName}.json`,
+	`.${moduleName}.jsonc`,
+	`.${moduleName}.json5`,
+	`.${moduleName}.yaml`,
+	`.${moduleName}.yml`,
+	`.${moduleName}.js`,
+	`.${moduleName}.cjs`,
+	`.config/${moduleName}`,
+	`.config/${moduleName}.json`,
+	`.config/${moduleName}.jsonc`,
+	`.config/${moduleName}.json5`,
+	`.config/${moduleName}.yaml`,
+	`.config/${moduleName}.yml`,
+	`.config/${moduleName}.js`,
+	`.config/${moduleName}.cjs`,
+	`${moduleName}.config.js`,
+	`${moduleName}.config.cjs`
+];
+const searchPlaces = ["package.json"];
+for (const moduleName of moduleNames) searchPlaces.push(...generateSearchPlaces(moduleName));
+const json5Loader = (_filepath, content) => Promise.resolve(json5Parse(content));
+/**
+* Looks for a config in the directory, loading it the way a normal run would. Resolves to `null`
+* when there isn't one, and throws a `ConfigError` when there is one that can't be loaded. Empty
+* files are skipped, so they don't count as a config.
+*/
+const searchConfig = async (rootDir) => {
+	const explorer = cosmiconfig("licensecop", {
+		stopDir: rootDir,
+		searchPlaces,
+		loaders: {
+			".json": json5Loader,
+			".jsonc": json5Loader,
+			".json5": json5Loader
+		}
+	});
+	try {
+		return await explorer.search(rootDir);
+	} catch (e) {
+		throw ConfigError.fromUnknown(e);
+	}
+};
+const findConfig = async (rootDir) => {
+	const result = await searchConfig(rootDir);
+	if (!result?.config) throw ConfigError.fromUnknown("No config file found");
+	return result.config;
+};
+//#endregion
+//#region src/config/parent-resolutions/github.ts
+const githubResolution = async (repoId, onVerbose) => {
+	onVerbose(`Resolving config from GitHub repo: ${repoId}`);
+	const parts = repoId.split("/");
+	const [owner, repoName] = parts;
+	if (parts.length !== 2 || owner === void 0 || repoName === void 0 || owner.length === 0 || repoName.length === 0) throw new ConfigError(`Invalid GitHub repo ID: ${repoId}`);
+	try {
+		const url = `https://api.github.com/repos/${owner}/${repoName}/contents/.licenses.json`;
+		const response = await fetch(url, { headers: {
+			accept: "application/vnd.github.raw+json",
+			"user-agent": "license-cop"
+		} });
+		if (!response.ok) throw new Error(`Request failed with status code ${response.status}`);
+		const fileContent = await response.text();
+		return json5Parse(fileContent);
+	} catch (e) {
+		throw new ConfigError(`Could not resolve config from GitHub repo: ${repoId}, error: ${e instanceof Error ? e.message : String(e)}`);
+	}
+};
+//#endregion
+//#region src/config/parent-resolutions/http.ts
+const httpResolution = async (url, onVerbose) => {
+	onVerbose(`Resolving http config: ${url}`);
+	const response = await fetch(url);
+	if (!response.ok) throw new Error(`Request failed with status code ${response.status}`);
+	const body = await response.text();
+	return json5Parse(body);
+};
+//#endregion
+//#region src/config/parent-resolutions/npm.ts
+const npmResolution = async (packageName, rootDir, onVerbose) => {
+	onVerbose(`Resolving npm package: ${packageName}`);
+	const packagePath = getPackagePath(rootDir, packageName);
+	return await findConfig(packagePath);
+};
+const nodeModuleExists = async (packageName, rootDir) => {
+	const packagePath = getPackagePath(rootDir, packageName);
+	try {
+		return (await stat$1(packagePath)).isDirectory();
+	} catch {
+		return false;
+	}
+};
+const getPackagePath = (rootDir, packageName) => join$1(rootDir, "node_modules", packageName);
+//#endregion
+//#region src/config/load-parent-config.ts
+const loadParentConfig = async (parentConfigPath, rootDir, onVerbose) => {
+	if (parentConfigPath.startsWith("npm:")) {
+		const packageName = parentConfigPath.substring(4);
+		return await npmResolution(packageName, rootDir, onVerbose);
+	}
+	if (parentConfigPath.startsWith("github:")) {
+		const repo = parentConfigPath.substring(7);
+		return await githubResolution(repo, onVerbose);
+	}
+	if (parentConfigPath.startsWith("http")) return await httpResolution(parentConfigPath, onVerbose);
+	if (await nodeModuleExists(parentConfigPath, rootDir)) return await npmResolution(parentConfigPath, rootDir, onVerbose);
+	throw new ConfigError(`Invalid parent config location: ${parentConfigPath}`);
+};
+//#endregion
+//#region src/config/load-config.ts
+const loadConfig = async (rootDir, onVerbose) => {
+	const foundConfig = await findConfig(rootDir);
+	let config = parseRawConfig(foundConfig);
+	const visitedParents = /* @__PURE__ */ new Set();
+	while (config.extends) {
+		const parentLocation = config.extends;
+		if (visitedParents.has(parentLocation)) throw new ConfigError(`Circular config extension: ${parentLocation}`);
+		visitedParents.add(parentLocation);
+		onVerbose(`Extending config with ${parentLocation}`);
+		const loadedParentConfig = await loadParentConfig(parentLocation, rootDir, onVerbose);
+		const parsedParentConfig = parseRawConfig(loadedParentConfig);
+		config = deepMerge(parsedParentConfig, config);
+		config.extends = parsedParentConfig.extends;
+	}
+	return applyConfigDefaults(config);
+};
+//#endregion
+//#region src/config/resolve-check-options.ts
+/**
+* Everything needed to check a project before scanning it: reads the project's name and its config
+* file (with anything it extends) and combines them with what the command line asked for into the
+* options for `checkLicenses`. Nothing is scanned, so it's quick, and it fails on a bad config
+* before a slow scan.
+*/
+const resolveCheckOptions = async (directory, input) => {
+	const { devDependencies, onVerbose } = input;
+	const packageJsonPath = join(directory, "package.json");
+	const productName = await readProjectName(packageJsonPath, onVerbose);
+	const config = await loadConfig(directory, onVerbose);
+	return {
+		productName,
+		options: {
+			allowedLicenses: config.licenses,
+			allowedPackages: config.packages,
+			workingDirectory: directory,
+			...resolveDevDependencyOptions(devDependencies, config),
+			onVerbose
+		}
+	};
+};
+//#endregion
+//#region src/report-failure.ts
+const reportFailure = (result, io) => {
+	const { noLicenses, forbiddenLicenses } = result;
+	io.stderr("Found the following issues...\n");
+	if (noLicenses.size > 0) logNoLicenseIssues(noLicenses, io);
+	if (forbiddenLicenses.size > 0) logForbiddenLicenseIssues(forbiddenLicenses, io);
+};
+const logNoLicenseIssues = (noLicenseResults, io) => {
+	io.stderr("Packages with no license:");
+	for (const result of noLicenseResults.values()) {
+		const { name, version } = result;
+		io.stderr(`${name}@${version}`);
+	}
+	io.stderr("");
+};
+const logForbiddenLicenseIssues = (forbiddenLicensesResults, io) => {
+	io.stderr("Packages with forbidden licenses:");
+	for (const result of forbiddenLicensesResults.values()) {
+		const { name, version, licenseIdentifiers, spdxExpression } = result;
+		const licenseDetails = licenseIdentifiers === spdxExpression ? licenseIdentifiers : `${licenseIdentifiers} from ${spdxExpression}`;
+		io.stderr(`${name}@${version} - ${licenseDetails}`);
+	}
+};
+//#endregion
+//#region src/report-success.ts
+const reportSuccess = (result, io) => {
+	const { allowedPackages, allowedLicenses } = result;
+	io.stdout("\nDone! No issues found");
+	if (allowedPackages.size !== 0) io.stdout(`Found ${allowedPackages.size} allowed packages`);
+	if (allowedLicenses.size !== 0) io.stdout(`Found ${allowedLicenses.size} packages with allowed licenses`);
+};
+//#endregion
+//#region src/commands/check.ts
+const runCheck = async (options, io) => {
+	const { directory, verbose: verboseEnabled, devDependencies } = options;
+	const verbose = createVerboseLogger(io, verboseEnabled);
+	verbose(`Using directory: ${directory}`);
+	const resolved = await resolveCheckOptions(directory, {
+		devDependencies,
+		onVerbose: verbose
+	});
+	io.stdout(`Scanning dependencies of: ${resolved.productName}`);
+	const result = await checkLicenses(resolved.options);
+	const exitCode = result.noLicenses.size > 0 || result.forbiddenLicenses.size > 0 ? 1 : 0;
+	if (exitCode === 0) reportSuccess(result, io);
+	else reportFailure(result, io);
+	verbose(`Exiting with code ${exitCode}`);
+	return exitCode;
+};
+//#endregion
+//#region src/commands/init.ts
+const defaultConfig = `{
+  "$schema": "https://license-cop.js.org/schema.json",
+  "licenses": ["MIT", "ISC", "Apache-2.0"],
+  "packages": []
+}
+`;
+const runInit = async (options, io) => {
+	const { directory, verbose: verboseEnabled } = options;
+	const verbose = createVerboseLogger(io, verboseEnabled);
+	if (!await stat(directory).then((stats) => stats.isDirectory(), () => false)) {
+		io.stderr(`Cannot set up a config file: ${directory} isn't a directory that exists`);
+		return 1;
+	}
+	const existingConfig = await searchConfig(directory);
+	if (existingConfig) throw new ConfigError(`this project already has a config file: ${existingConfig.filepath}`);
+	io.stdout("Setting up a new license-cop config file...");
+	const configPath = join(directory, ".licenses.json");
+	verbose(`Writing config file to: ${configPath}`);
+	await writeFile(configPath, defaultConfig);
+	io.stdout("Done!");
+	io.stdout("Run `npx license-cop` to check your dependencies");
+	return 0;
+};
+//#endregion
+//#region src/help.ts
+const helpText = () => `Usage: license-cop [options] [command]
+
+Yet another license checker tool for your dependencies; focused on simplicity
+
+Options:
+  --dev-dependencies <mode> Which dev dependencies to check: 'include' checks them as well as
+                            production dependencies, 'only' checks only them. Defaults to production
+                            dependencies only.
+  --verbose                 Enable verbose logging
+  -d, --directory <dir>     The directory of the project. Defaults to the current working directory.
+  -v, --version             Print the installed version of license-cop
+  -h, --help                Display this help
+
+Commands:
+  init                      Create a new license-cop configuration file`;
+const versionText = async () => {
+	const packageJsonLocation = fileURLToPath(new URL("../package.json", import.meta.url));
+	const contents = await readFile(packageJsonLocation, "utf8");
+	const { version } = ownPackageJsonSchema.parse(JSON.parse(contents));
+	return `v${version}`;
+};
+const ownPackageJsonSchema = z.object({ version: z.string() });
+//#endregion
+//#region src/report-error.ts
+/**
+* Turns anything a command threw into a message and an exit code, so that `run` never throws. What
+* the user did wrong reads as a sentence; only what nobody expected shows a stack, and only when
+* asked to, since a stack trace is no help to someone who just mistyped a directory.
+*/
+const reportError = (error, io, verbose) => {
+	if (error instanceof UsageError) {
+		io.stderr(`error: ${error.message}`);
+		io.stderr("Run 'license-cop --help' for usage");
+		return 1;
+	}
+	if (error instanceof LicenseCopError) {
+		io.stderr(error.message);
+		return 1;
+	}
+	io.stderr(`error: ${describeUnexpectedError(error)}`);
+	if (!verbose) {
+		io.stderr("Run again with --verbose to see the full stack trace");
+		return 1;
+	}
+	if (error instanceof Error && error.stack) io.stderr(error.stack);
+	return 1;
+};
+const fileSystemProblems = {
+	ENOENT: "no such file or directory",
+	EACCES: "permission denied",
+	EPERM: "operation not permitted",
+	EISDIR: "is a directory",
+	EROFS: "read-only file system"
+};
+const describeUnexpectedError = (error) => {
+	if (!(error instanceof Error)) return String(error);
+	const { code, path } = error;
+	const problem = typeof code === "string" ? fileSystemProblems[code] : void 0;
+	if (problem && typeof path === "string") return `${problem}: ${path}`;
+	return error.message;
+};
+//#endregion
+//#region src/main.ts
+const run = async (args, io = defaultIo, cwd = process.cwd()) => {
+	let verbose = false;
+	try {
+		const invocation = parseCliArgs(args, cwd);
+		verbose = "verbose" in invocation && invocation.verbose;
+		return await execute(invocation, io);
+	} catch (error) {
+		return reportError(error, io, verbose);
+	}
+};
+const execute = async (invocation, io) => {
+	switch (invocation.kind) {
+		case "check": return await runCheck(invocation, io);
+		case "init": return await runInit(invocation, io);
+		case "version": {
+			const text = await versionText();
+			io.stdout(text);
+			return 0;
+		}
+		case "help":
+			io.stdout(helpText());
+			return 0;
+		default: throw new Error(`Unknown invocation: ${JSON.stringify(invocation)}`);
+	}
+};
+//#endregion
+//#region src/bin.ts
+run(process.argv.slice(2), defaultIo).then((exitCode) => {
+	process.exitCode = exitCode;
+});
+//#endregion
+export {};
+
+//# sourceMappingURL=bin.js.map