# spdx-expression-validate

> validate SPDX license expressions

Latest version **2.0.0** (published 2019-02-15) · (MIT AND CC-BY-3.0) license · 0 weekly downloads

## Install

```sh
npm install spdx-expression-validate
pnpm add spdx-expression-validate
yarn add spdx-expression-validate
bun add spdx-expression-validate
```

## Health

**Score 23/100 (F)** — status: abandoned.

Positive: has types package; no vulnerabilities; high quality score.

Warnings: low downloads; no esm support.

Negative: abandoned; low maintenance score.

## Facts

| | |
|---|---|
| Version | 2.0.0 |
| Published | 2019-02-15 |
| First published | 2015-08-02 |
| Weekly downloads | 0 |
| License | (MIT AND CC-BY-3.0) |
| TypeScript types | separate (@types/spdx-expression-validate) |
| Module format | CommonJS |
| Dependencies | 1 |
| Unpacked size | 3.5 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| GitHub stars | 0 |
| Author | Kyle E. Mitchell |
| Maintainers | kemitchell |
| Keywords | SPDX, law, legal, license, metadata, package, package.json, standards |

## Links

- npm: https://www.npmjs.com/package/spdx-expression-validate
- Repository: https://github.com/kemitchell/spdx-expression-validate.js
- Homepage: https://github.com/kemitchell/spdx.js
- Issues: https://github.com/kemitchell/spdx-expression-validate.js/issues
- npm.io page: https://npm.io/package/spdx-expression-validate

## Dependencies (1)

- [spdx-expression-parse](https://npm.io/package/spdx-expression-parse.md) ^3.0.0

## Alternatives

- [@mapbox/jsonlint-lines-primitives](https://npm.io/package/@mapbox/jsonlint-lines-primitives.md) — 5.3M weekly downloads
- [reftools](https://npm.io/package/reftools.md) — 3.5M weekly downloads
- [@hey-api/openapi-ts](https://npm.io/package/@hey-api/openapi-ts.md) — 3.5M weekly downloads
- [@mapbox/geojson-rewind](https://npm.io/package/@mapbox/geojson-rewind.md) — 2.4M weekly downloads
- [turbo-stream](https://npm.io/package/turbo-stream.md) — 1.7M weekly downloads

## Recent versions

- 2.0.0 (latest) — 2019-02-15
- 1.0.2 — 2016-10-05
- 1.0.1 — 2015-08-02
- 1.0.0 — 2015-08-02

## README

```javascript
var assert = require('assert')
var valid = require('spdx-expression-validate')
```

# Simple License Expressions
```javascript
assert(!valid('Invalid-Identifier'))
assert(valid('GPL-2.0'))
assert(valid('GPL-2.0+'))
assert(valid('LicenseRef-23'))
assert(valid('LicenseRef-MIT-Style-1'))
assert(valid('DocumentRef-spdx-tool-1.2:LicenseRef-MIT-Style-2'))
```

# Composite License Expressions

## Disjunctive `OR` Operator
```javascript
assert(valid('(LGPL-2.1 OR MIT)'))
assert(valid('(LGPL-2.1 OR MIT OR BSD-3-Clause)'))
```

## Conjunctive `AND` Operator
```javascript
assert(valid('(LGPL-2.1 AND MIT)'))
assert(valid('(LGPL-2.1 AND MIT AND BSD-2-Clause)'))
```

## Exception `WITH` Operator
```javascript
assert(valid('(GPL-2.0+ WITH Bison-exception-2.2)'))
```

# Strict Whitespace Rules
```javascript
assert(!valid('MIT '))
assert(!valid(' MIT'))
assert(!valid('MIT  AND  BSD-3-Clause'))
```

---

[The Software Package Data Exchange (SPDX) specification](http://spdx.org) is the work of the [Linux Foundation](http://www.linuxfoundation.org) and its contributors, and is licensed under the terms of [the Creative Commons Attribution License 3.0 Unported (SPDX: "CC-BY-3.0")](http://spdx.org/licenses/CC-BY-3.0). "SPDX" is a United States federally registered trademark of the Linux Foundation.

---
_Source: https://npm.io/package/spdx-expression-validate · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._