spdx-vir 0.0.0 → 0.0.1

package/LICENSE-CC0

@@ -0,0 +1,121 @@
+CC0 1.0 Universal
+
+Creative Commons Legal Code
+
+    CREATIVE COMMONS CORPORATION IS NOT A LAW FIRM AND DOES NOT PROVIDE
+    LEGAL SERVICES. DISTRIBUTION OF THIS DOCUMENT DOES NOT CREATE AN
+    ATTORNEY-CLIENT RELATIONSHIP. CREATIVE COMMONS PROVIDES THIS
+    INFORMATION ON AN "AS-IS" BASIS. CREATIVE COMMONS MAKES NO WARRANTIES
+    REGARDING THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS
+    PROVIDED HEREUNDER, AND DISCLAIMS LIABILITY FOR DAMAGES RESULTING FROM
+    THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS PROVIDED
+    HEREUNDER.
+
+Statement of Purpose
+
+The laws of most jurisdictions throughout the world automatically confer
+exclusive Copyright and Related Rights (defined below) upon the creator
+and subsequent owner(s) (each and all, an "owner") of an original work of
+authorship and/or a database (each, a "Work").
+
+Certain owners wish to permanently relinquish those rights to a Work for
+the purpose of contributing to a commons of creative, cultural and
+scientific works ("Commons") that the public can reliably and without fear
+of later claims of infringement build upon, modify, incorporate in other
+works, reuse and redistribute as freely as possible in any form whatsoever
+and for any purposes, including without limitation commercial purposes.
+These owners may contribute to the Commons to promote the ideal of a free
+culture and the further production of creative, cultural and scientific
+works, or to gain reputation or greater distribution for their Work in
+part through the use and efforts of others.
+
+For these and/or other purposes and motivations, and without any
+expectation of additional consideration or compensation, the person
+associating CC0 with a Work (the "Affirmer"), to the extent that he or she
+is an owner of Copyright and Related Rights in the Work, voluntarily
+elects to apply CC0 to the Work and publicly distribute the Work under its
+terms, with knowledge of his or her Copyright and Related Rights in the
+Work and the meaning and intended legal effect of CC0 on those rights.
+
+1. Copyright and Related Rights. A Work made available under CC0 may be
+protected by copyright and related or neighboring rights ("Copyright and
+Related Rights"). Copyright and Related Rights include, but are not
+limited to, the following:
+
+  i. the right to reproduce, adapt, distribute, perform, display,
+     communicate, and translate a Work;
+ ii. moral rights retained by the original author(s) and/or performer(s);
+iii. publicity and privacy rights pertaining to a person's image or
+     likeness depicted in a Work;
+ iv. rights protecting against unfair competition in regards to a Work,
+     subject to the limitations in paragraph 4(a), below;
+  v. rights protecting the extraction, dissemination, use and reuse of data
+     in a Work;
+ vi. database rights (such as those arising under Directive 96/9/EC of the
+     European Parliament and of the Council of 11 March 1996 on the legal
+     protection of databases, and under any national implementation
+     thereof, including any amended or successor version of such
+     directive); and
+vii. other similar, equivalent or corresponding rights throughout the
+     world based on applicable law or treaty, and any national
+     implementations thereof.
+
+2. Waiver. To the greatest extent permitted by, but not in contravention
+of, applicable law, Affirmer hereby overtly, fully, permanently,
+irrevocably and unconditionally waives, abandons, and surrenders all of
+Affirmer's Copyright and Related Rights and associated claims and causes
+of action, whether now known or unknown (including existing as well as
+future claims and causes of action), in the Work (i) in all territories
+worldwide, (ii) for the maximum duration provided by applicable law or
+treaty (including future time extensions), (iii) in any current or future
+medium and for any number of copies, and (iv) for any purpose whatsoever,
+including without limitation commercial, advertising or promotional
+purposes (the "Waiver"). Affirmer makes the Waiver for the benefit of each
+member of the public at large and to the detriment of Affirmer's heirs and
+successors, fully intending that such Waiver shall not be subject to
+revocation, rescission, cancellation, termination, or any other legal or
+equitable action to disrupt the quiet enjoyment of the Work by the public
+as contemplated by Affirmer's express Statement of Purpose.
+
+3. Public License Fallback. Should any part of the Waiver for any reason
+be judged legally invalid or ineffective under applicable law, then the
+Waiver shall be preserved to the maximum extent permitted taking into
+account Affirmer's express Statement of Purpose. In addition, to the
+extent the Waiver is so judged Affirmer hereby grants to each affected
+person a royalty-free, non transferable, non sublicensable, non exclusive,
+irrevocable and unconditional license to exercise Affirmer's Copyright and
+Related Rights in the Work (i) in all territories worldwide, (ii) for the
+maximum duration provided by applicable law or treaty (including future
+time extensions), (iii) in any current or future medium and for any number
+of copies, and (iv) for any purpose whatsoever, including without
+limitation commercial, advertising or promotional purposes (the
+"License"). The License shall be deemed effective as of the date CC0 was
+applied by Affirmer to the Work. Should any part of the License for any
+reason be judged legally invalid or ineffective under applicable law, such
+partial invalidity or ineffectiveness shall not invalidate the remainder
+of the License, and in such case Affirmer hereby affirms that he or she
+will not (i) exercise any of his or her remaining Copyright and Related
+Rights in the Work or (ii) assert any associated claims and causes of
+action with respect to the Work, in either case contrary to Affirmer's
+express Statement of Purpose.
+
+4. Limitations and Disclaimers.
+
+ a. No trademark or patent rights held by Affirmer are waived, abandoned,
+    surrendered, licensed or otherwise affected by this document.
+ b. Affirmer offers the Work as-is and makes no representations or
+    warranties of any kind concerning the Work, express, implied,
+    statutory or otherwise, including without limitation warranties of
+    title, merchantability, fitness for a particular purpose, non
+    infringement, or the absence of latent or other defects, accuracy, or
+    the present or absence of errors, whether or not discoverable, all to
+    the greatest extent permissible under applicable law.
+ c. Affirmer disclaims responsibility for clearing rights of other persons
+    that may apply to the Work or any use thereof, including without
+    limitation any person's Copyright and Related Rights in the Work.
+    Further, Affirmer disclaims responsibility for obtaining any necessary
+    consents, permissions or other rights required for any use of the
+    Work.
+ d. Affirmer understands and acknowledges that Creative Commons is not a
+    party to this document and has no duty or obligation with respect to
+    this CC0 or use of the Work.

package/LICENSE-MIT

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 electrovir
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,54 @@
+# spdx-vir
+
+Parses and validates license strings strictly according to the SPDX grammar: https://spdx.github.io/spdx-spec/v2.3/SPDX-license-expressions.
+
+License ids have been extracted from https://spdx.org/licenses/licenses.json and exceptions from https://spdx.org/licenses/exceptions.json.
+
+Based on https://www.npmjs.com/package/spdx-expression-parse but more strict to the grammar and written in modern ESM syntax.
+
+Test it out here: https://codepen.io/electrovir/pen/yyVjVQR
+
+## Install
+
+```sh
+npm i spdx-vir
+```
+
+## Usage
+
+Validating expressions:
+
+<!-- example-link: src/readme-examples/validate.example.ts -->
+
+```TypeScript
+import {isValidSpdxExpression} from 'spdx-vir';
+
+// returns true
+isValidSpdxExpression('(MIT OR CC0-1.0)');
+
+// returns false
+isValidSpdxExpression('(MIT or CC0 1.0)');
+```
+
+Parsing expressions:
+
+<!-- example-link: src/readme-examples/parse.example.ts -->
+
+```TypeScript
+import {parseSpdxExpression, SpdxConjunction} from 'spdx-vir';
+
+parseSpdxExpression('(MIT OR CC0-1.0)');
+// outputs the following:
+const output = {
+    conjunction: SpdxConjunction.OR,
+    left: {
+        license: 'MIT',
+    },
+    right: {
+        license: 'CC0-1.0',
+    },
+};
+
+// throws a SpdxParseError
+parseSpdxExpression('(MIT or CC0 1.0)');
+```

package/dist/api.d.ts

@@ -0,0 +1,14 @@
+import { type SpdxExpression } from './parse-tokens.js';
+/**
+ * Parse the given source string as SPDX license syntax.
+ *
+ * @category Main
+ * @throws SpdxParseError when parsing fails.
+ */
+export declare function parseSpdxExpression(source: string): SpdxExpression;
+/**
+ * Checks if the given source string is valid SPDX license syntax.
+ *
+ * @category Main
+ */
+export declare function isValidSpdxExpression(source: string): boolean;

package/dist/api.js

@@ -0,0 +1,25 @@
+import { parseRawTokens } from './parse-tokens.js';
+import { scanRawExpression } from './scan-expression.js';
+/**
+ * Parse the given source string as SPDX license syntax.
+ *
+ * @category Main
+ * @throws SpdxParseError when parsing fails.
+ */
+export function parseSpdxExpression(source) {
+    return parseRawTokens(scanRawExpression(source));
+}
+/**
+ * Checks if the given source string is valid SPDX license syntax.
+ *
+ * @category Main
+ */
+export function isValidSpdxExpression(source) {
+    try {
+        parseSpdxExpression(source);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}

package/dist/index.d.ts

@@ -0,0 +1,6 @@
+export * from './api.js';
+export * from './parse-tokens.js';
+export * from './scan-expression.js';
+export * from './spdx-exceptions.js';
+export * from './spdx-license-ids.js';
+export * from './spdx-parse-error.js';

package/dist/index.js

@@ -0,0 +1,6 @@
+export * from './api.js';
+export * from './parse-tokens.js';
+export * from './scan-expression.js';
+export * from './spdx-exceptions.js';
+export * from './spdx-license-ids.js';
+export * from './spdx-parse-error.js';

package/dist/parse-tokens.d.ts

@@ -0,0 +1,72 @@
+import { type SpdxToken } from './scan-expression.js';
+/**
+ * The logical conjunction joining two halves of an SPDX expression.
+ *
+ * @category Internal
+ */
+export declare enum SpdxConjunction {
+    AND = "AND",
+    OR = "OR"
+}
+/**
+ * A single license node within a parsed SPDX expression.
+ *
+ * @category Internal
+ */
+export type SpdxLicenseInfo = {
+    license: string;
+    plus?: boolean;
+    exception?: string;
+};
+/**
+ * A binary node joining two SPDX expressions with a conjunction.
+ *
+ * @category Internal
+ */
+export type SpdxConjunctionInfo = {
+    left: SpdxExpression;
+    conjunction: SpdxConjunction;
+    right: SpdxExpression;
+};
+/**
+ * A parsed SPDX expression: either a single license or a conjunction of two expressions.
+ *
+ * @category Internal
+ */
+export type SpdxExpression = SpdxLicenseInfo | SpdxConjunctionInfo;
+/**
+ * Parses a flat list of {@link SpdxToken}s into an {@link SpdxExpression} tree.
+ *
+ * The ABNF grammar in the spec is totally ambiguous. This parser follows the operator precedence
+ * defined in the `Order of Precedence and Parentheses` section.
+ *
+ * Ported from
+ * https://github.com/jslicense/spdx-expression-parse.js/blob/bb753f168e3364649eee90fb5d04e418e2d64d7b/parse.js,
+ * which has the following license:
+ *
+ *     The MIT License
+ *
+ *     Copyright (c) 2015 Kyle E. Mitchell & other authors listed in AUTHORS
+ *
+ *     Permission is hereby granted, free of charge, to any person obtaining
+ *     a copy of this software and associated documentation files (the
+ *     "Software"), to deal in the Software without restriction, including
+ *     without limitation the rights to use, copy, modify, merge, publish,
+ *     distribute, sublicense, and/or sell copies of the Software, and to
+ *     permit persons to whom the Software is furnished to do so, subject to
+ *     the following conditions:
+ *
+ *     The above copyright notice and this permission notice shall be included
+ *     in all copies or substantial portions of the Software.
+ *
+ *     THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ *     EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ *     MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+ *     IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+ *     CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+ *     TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+ *     SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ * @category Internal
+ */
+export declare function parseRawTokens(tokens: ReadonlyArray<SpdxToken>): SpdxExpression;

package/dist/parse-tokens.js

@@ -0,0 +1,174 @@
+import { SpdxTokenType } from './scan-expression.js';
+import { SpdxParseError } from './spdx-parse-error.js';
+/**
+ * The logical conjunction joining two halves of an SPDX expression.
+ *
+ * @category Internal
+ */
+export var SpdxConjunction;
+(function (SpdxConjunction) {
+    SpdxConjunction["AND"] = "AND";
+    SpdxConjunction["OR"] = "OR";
+})(SpdxConjunction || (SpdxConjunction = {}));
+/**
+ * Parses a flat list of {@link SpdxToken}s into an {@link SpdxExpression} tree.
+ *
+ * The ABNF grammar in the spec is totally ambiguous. This parser follows the operator precedence
+ * defined in the `Order of Precedence and Parentheses` section.
+ *
+ * Ported from
+ * https://github.com/jslicense/spdx-expression-parse.js/blob/bb753f168e3364649eee90fb5d04e418e2d64d7b/parse.js,
+ * which has the following license:
+ *
+ *     The MIT License
+ *
+ *     Copyright (c) 2015 Kyle E. Mitchell & other authors listed in AUTHORS
+ *
+ *     Permission is hereby granted, free of charge, to any person obtaining
+ *     a copy of this software and associated documentation files (the
+ *     "Software"), to deal in the Software without restriction, including
+ *     without limitation the rights to use, copy, modify, merge, publish,
+ *     distribute, sublicense, and/or sell copies of the Software, and to
+ *     permit persons to whom the Software is furnished to do so, subject to
+ *     the following conditions:
+ *
+ *     The above copyright notice and this permission notice shall be included
+ *     in all copies or substantial portions of the Software.
+ *
+ *     THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ *     EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ *     MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+ *     IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+ *     CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+ *     TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+ *     SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ * @category Internal
+ */
+export function parseRawTokens(tokens) {
+    let index = 0;
+    function hasMore() {
+        return index < tokens.length;
+    }
+    function token() {
+        return hasMore() ? tokens[index] : undefined;
+    }
+    function next() {
+        /**
+         * `next` is only ever called after a `token()` check has already confirmed that a token
+         * exists, so `hasMore()` is always true at this point. This guard is kept as an invariant
+         * safeguard but is unreachable in practice, hence the coverage exclusion.
+         */
+        /* c8 ignore next 3 */
+        if (!hasMore()) {
+            throw new SpdxParseError('Unexpected end of expression');
+        }
+        index++;
+    }
+    function parseOperator(operator) {
+        const currentToken = token();
+        if (currentToken &&
+            currentToken.type === SpdxTokenType.Operator &&
+            operator === currentToken.string) {
+            next();
+            return currentToken.string;
+        }
+        return undefined;
+    }
+    function parseWith() {
+        if (parseOperator('WITH')) {
+            const currentToken = token();
+            if (currentToken && currentToken.type === SpdxTokenType.Exception) {
+                next();
+                return currentToken.string;
+            }
+            throw new SpdxParseError('Expected exception after `WITH`');
+        }
+        return undefined;
+    }
+    function parseLicenseRef() {
+        /**
+         * Everything is concatenated into one string for backward-compatibility but it could be
+         * better to return a nice structure.
+         */
+        const begin = index;
+        let string = '';
+        const documentRefToken = token();
+        if (documentRefToken && documentRefToken.type === SpdxTokenType.DocumentRef) {
+            next();
+            string += 'DocumentRef-' + documentRefToken.string + ':';
+            if (!parseOperator(':')) {
+                throw new SpdxParseError('Expected `:` after `DocumentRef-...`');
+            }
+        }
+        const licenseRefToken = token();
+        if (licenseRefToken && licenseRefToken.type === SpdxTokenType.LicenseRef) {
+            next();
+            string += 'LicenseRef-' + licenseRefToken.string;
+            return {
+                license: string,
+            };
+        }
+        index = begin;
+        return undefined;
+    }
+    function parseLicense() {
+        const currentToken = token();
+        if (currentToken && currentToken.type === SpdxTokenType.License) {
+            next();
+            const node = {
+                license: currentToken.string,
+            };
+            if (parseOperator('+')) {
+                node.plus = true;
+            }
+            const exception = parseWith();
+            if (exception) {
+                node.exception = exception;
+            }
+            return node;
+        }
+        return undefined;
+    }
+    function parseParenthesizedExpression() {
+        const left = parseOperator('(');
+        if (!left) {
+            return undefined;
+        }
+        const expr = parseExpression();
+        if (!parseOperator(')')) {
+            throw new SpdxParseError('Expected `)`');
+        }
+        return expr;
+    }
+    function parseAtom() {
+        return parseParenthesizedExpression() || parseLicenseRef() || parseLicense();
+    }
+    function makeBinaryOpParser(operator, conjunction, nextParser) {
+        return function parseBinaryOp() {
+            const left = nextParser();
+            if (!left) {
+                return undefined;
+            }
+            else if (!parseOperator(operator)) {
+                return left;
+            }
+            const right = parseBinaryOp();
+            if (!right) {
+                throw new SpdxParseError('Expected expression');
+            }
+            return {
+                left,
+                conjunction,
+                right,
+            };
+        };
+    }
+    const parseAnd = makeBinaryOpParser('AND', SpdxConjunction.AND, parseAtom);
+    const parseExpression = makeBinaryOpParser('OR', SpdxConjunction.OR, parseAnd);
+    const node = parseExpression();
+    if (!node || hasMore()) {
+        throw new SpdxParseError('Syntax error');
+    }
+    return node;
+}

package/dist/scan-expression.d.ts

@@ -0,0 +1,54 @@
+/**
+ * The kind of token produced by {@link scanRawExpression} when reading an SPDX expression.
+ *
+ * @category Internal
+ */
+export declare enum SpdxTokenType {
+    Operator = "OPERATOR",
+    DocumentRef = "DOCUMENTREF",
+    LicenseRef = "LICENSEREF",
+    License = "LICENSE",
+    Exception = "EXCEPTION"
+}
+/**
+ * A single lexical token scanned from an SPDX expression.
+ *
+ * @category Internal
+ */
+export type SpdxToken = {
+    type: SpdxTokenType;
+    string: string;
+};
+/**
+ * Scans an SPDX expression string into a flat list of {@link SpdxToken}s.
+ *
+ * Ported from
+ * https://github.com/jslicense/spdx-expression-parse.js/blob/bb753f168e3364649eee90fb5d04e418e2d64d7b/scan.js,
+ * which has the following license:
+ *
+ *     The MIT License
+ *
+ *     Copyright (c) 2015 Kyle E. Mitchell & other authors listed in AUTHORS
+ *
+ *     Permission is hereby granted, free of charge, to any person obtaining
+ *     a copy of this software and associated documentation files (the
+ *     "Software"), to deal in the Software without restriction, including
+ *     without limitation the rights to use, copy, modify, merge, publish,
+ *     distribute, sublicense, and/or sell copies of the Software, and to
+ *     permit persons to whom the Software is furnished to do so, subject to
+ *     the following conditions:
+ *
+ *     The above copyright notice and this permission notice shall be included
+ *     in all copies or substantial portions of the Software.
+ *
+ *     THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ *     EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ *     MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+ *     IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+ *     CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+ *     TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+ *     SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ * @category Internal
+ */
+export declare function scanRawExpression(source: string): SpdxToken[];