+ - name: Lint

+ run: task lint

+

+ - name: Tests

+ run: task test

+// Copyright (c) 2026 Nikolay Govorov

+// SPDX-License-Identifier: AGPL-3.0-or-later

+

+//go:build !licensegen

+

+// This package is a small hack for embedding LICENSE into a project.

+// Go sensibly prohibits embedding files from parent folders,

+// so this file is only needed to bypass the restriction.

+package mirum

+

+import _ "embed"

+

+//go:embed LICENSE

+var License string

+

+//go:embed build/licenses.json

+var Licenses []byte

+ # Production build pipeline

+ web:install:

+ desc: Install frontend dependencies

+ run: once

+ sources:

+ - package.json

+ - package-lock.json

+ generates:

+ - node_modules/.package-lock.json

+ - npm ci

+ run: once

+ deps: [web:install]

+ run: once

+ licenses:

+ desc: Regenerate third-party license manifest (build/licenses.json)

+ run: once

+ deps: [proto, web:build]

+ - go.sum

+ - cmd/mirum-server/web/package-lock.json

+ - internal/licensegen/**/*.go

+ - LICENSES.go

+ - LICENSES/*.txt

+ generates:

+ - build/licenses.json

+ - go run -tags licensegen ./internal/licensegen -out {{.BUILD_DIR}}/licenses.json

+ deps: [proto, licenses, web:build]

+ - mkdir -p {{.DIST_DIR}}

+ - for: [

+ darwin-amd64, darwin-arm64,

+ windows-amd64, windows-arm64,

+ netbsd-amd64, netbsd-arm64,

+ openbsd-amd64, openbsd-arm64,

+ freebsd-amd64, freebsd-arm64, freebsd-riscv64,

+ linux-amd64, linux-arm64, linux-riscv64, linux-ppc64le, linux-loong64, linux-s390x,

+ ]

+ cmd: |

+ target="{{ .ITEM }}"

+ publish:release:

+ desc: Create or update a GitHub Release

+ requires:

+ vars: [CHANNEL, VERSION]

+ cmds:

+ - |

+ if [ "{{.CHANNEL}}" = "stable" ]; then

+ TAG="v{{.VERSION}}"

+ NAME="{{.VERSION}}"

+ else

+ TAG="nightly"

+ NAME="nightly"

+ git tag -f nightly

+ git push origin --force tag nightly

+ for asset in $(gh release view nightly --json assets --jq '.assets[].name' 2>/dev/null || true); do

+ gh release delete-asset nightly "$asset" --yes

+ done

+ fi

+

+ gh release create "$TAG" {{.DIST_DIR}}/*.deb {{.DIST_DIR}}/*.rpm {{.DIST_DIR}}/*.tar.gz {{.DIST_DIR}}/*.zip {{.DIST_DIR}}/SHA256SUMS \

+ --title "$NAME" \

+ $( [ "{{.CHANNEL}}" = "nightly" ] && echo "--prerelease" ) \

+ --notes "**Version**: {{.VERSION}}" \

+ || gh release upload "$TAG" {{.DIST_DIR}}/*.deb {{.DIST_DIR}}/*.rpm {{.DIST_DIR}}/*.tar.gz {{.DIST_DIR}}/*.zip {{.DIST_DIR}}/SHA256SUMS --clobber

+

+ # Local dev env

+ devenv:config:

+ desc: Write dev/mirum-server.yaml if missing

+ status:

+ - test -f dev/mirum-server.yaml

+ cmds:

+ - mkdir -p dev

+ - |

+ cat > dev/mirum-server.yaml <<EOF

+ web_addr: ":3000"

+ grpc_addr: ":2026"

+ admin_socket: "/tmp/mirum-admin.sock"

+ database_uri: "postgres://{{.DEV_DB}}:{{.DEV_DB}}@localhost:5432/{{.DEV_DB}}?sslmode=disable"

+ pepper: "dev-pepper"

+ webhook_secret: "dev-secret"

+ grpc_tls:

+ cert: "dev/server.crt"

+ key: "dev/server.key"

+ EOF

+

+ devenv:keys:

+ desc: Generate dev TLS cert and worker key pair

+ status:

+ - test -f dev/server.crt

+ - test -f dev/worker.key

+ - test -f dev/worker.pub

+ cmds:

+ - mkdir -p dev

+ - >-

+ test -f dev/server.crt ||

+ openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:prime256v1

+ -keyout dev/server.key -out dev/server.crt

+ -days 365 -nodes -subj "/CN=mirum-server"

+ -addext "subjectAltName=DNS:mirum-server,DNS:localhost"

+ - >-

+ test -f dev/worker.key ||

+ openssl genpkey -algorithm ed25519 -out dev/worker.key

+ - >-

+ test -f dev/worker.pub ||

+ openssl pkey -in dev/worker.key -pubout -out dev/worker.pub

+

+ devenv:db:local:

+ internal: true

+ desc: Create the dev postgres role and database on a local install (needs sudo)

+ status:

+ - '[ "{{.DOCKER}}" = "true" ] || PGPASSWORD={{.DEV_DB}} psql -h localhost -U {{.DEV_DB}} -d {{.DEV_DB}} -c "SELECT 1" >/dev/null 2>&1'

+ cmds:

+ - |

+ sudo -u postgres psql -tAc "SELECT 1 FROM pg_roles WHERE rolname='{{.DEV_DB}}'" | grep -q 1 ||

+ sudo -u postgres psql -c "CREATE ROLE \"{{.DEV_DB}}\" LOGIN PASSWORD '{{.DEV_DB}}'"

+ - |

+ sudo -u postgres psql -tAc "SELECT 1 FROM pg_database WHERE datname='{{.DEV_DB}}'" | grep -q 1 ||

+ sudo -u postgres psql -c "CREATE DATABASE \"{{.DEV_DB}}\" OWNER \"{{.DEV_DB}}\""

+

+ devenv:db:docker:

+ internal: true

+ desc: Start a Postgres Docker container for dev

+ status:

+ - '[ "{{.DOCKER}}" != "true" ] || docker exec {{.DEV_DB}} pg_isready -U {{.DEV_DB}} >/dev/null 2>&1 || nc -z localhost 5432 2>/dev/null'

+ cmds:

+ - docker run -d

+ --name {{.DEV_DB}}

+ -e POSTGRES_USER={{.DEV_DB}}

+ -e POSTGRES_PASSWORD={{.DEV_DB}}

+ -e POSTGRES_DB={{.DEV_DB}}

+ -p 5432:5432

+ postgres:18

+ - |

+ echo "Waiting for postgres..."

+ until docker exec {{.DEV_DB}} pg_isready -U {{.DEV_DB}} >/dev/null 2>&1; do

+ sleep 1

+ done

+

+ devenv:db:

+ desc: "Create the dev postgres role and database (set DOCKER=true for Docker)"

+ deps: [devenv:db:local, devenv:db:docker]

+

+ devenv:

+ desc: Provision a full local dev environment (keys, config, database)

+ deps: [devenv:keys, devenv:config, devenv:db]

+

+ web:dev:

+ desc: Run Vite dev server (use with `go run -tags dev ./cmd/mirum-server`)

+ dir: cmd/mirum-server/web

+ deps: [web:install, proto]

+ prefix: vite

+ env:

+ NO_COLOR: "1"

+ CI: "true"

+ cmds:

+ - npm run dev

+

+ dev:server:

+ desc: Build mirum-server with -tags dev and run it against the dev environment

+ deps: [proto, licenses, devenv]

+ prefix: mirum-server

+ cmds:

+ - mkdir -p {{.BUILD_DIR}}

+ - go build -tags dev -o {{.BUILD_DIR}}/mirum-server ./cmd/mirum-server

+ - "{{.BUILD_DIR}}/mirum-server daemon --config dev/mirum-server.yaml"

+

+ run:

+ desc: Build and run mirum-server against the dev environment

+ deps: [build, devenv]

+ vars:

+ GOOS: { sh: go env GOOS }

+ GOARCH: { sh: go env GOARCH }

+ cmds:

+ - "{{.BUILD_DIR}}/mirum-server-{{.GOOS}}-{{.GOARCH}} daemon --config dev/mirum-server.yaml"

+

+ dev:

+ desc: Run Vite dev server and mirum-server together (HMR-enabled)

+ deps: [web:dev, dev:server]

+

+ # Test and lint checks

+ signof:

+ desc: Verifies that the author is known and has signed the CLA

+ cmds:

+ - |

+ ALLOWLIST="Nikolay Govorov|github-actions\\[bot\\]"

+

+ bad=0

+ for sha in $(git log --no-merges --format=%H); do

+ author=$(git log -1 --format='%an' "$sha")

+ if echo "$author" | grep -qP "^($ALLOWLIST)$"; then

+ continue

+ fi

+

+ email=$(git log -1 --format='%ae' "$sha")

+ expected="${author} <${email}>"

+ if ! git log -1 --format='%(trailers:key=Signed-off-by,valueonly)' "$sha" | grep -qF "$expected"; then

+ echo "Commit ${sha:0:8} by ${expected} is missing a valid Signed-off-by"

+ bad=1

+ fi

+ done

+

+ if [ "$bad" -eq 1 ]; then

+ echo "All commits must be signed off (git commit -s). See CLA.md"

+ exit 1

+ fi

+

+ # Check that all authors and committers are in .mailmap

+ missing=0

+ for email in $(git log --no-merges --format='%ae%n%ce' | sort -u); do

+ if ! grep -v '^#' .mailmap | grep -qF "<${email}>"; then

+ echo "Email <${email}> is not in .mailmap"

+ missing=1

+ fi

+ done

+

+ if [ "$missing" -eq 1 ]; then

+ echo "All contributors must be listed in .mailmap. See README.md"

+ exit 1

+ fi

+

+ web:lint:

+ desc: Lint and check the frontend

+ dir: cmd/mirum-server/web

+ deps: [web:build]

+ cmds:

+ - npm run lint

+ - npm run size

+

+ go:lint:

+ desc: Lint and check the go

+ deps: [proto, web:build, licenses]

+ cmds:

+ - gofmt -l . | grep . && exit 1 || true

+ - go vet ./...

+ - go tool govulncheck ./...

+ - go tool golangci-lint run ./...

+

+ lint:

+ desc: Run static checks

+ deps: [go:lint, web:lint]

+ cmds:

+ - task: signof

+ - task: go:lint

+ - task: web:lint

+ - reuse lint

+

+ test:

+ desc: Run all tests

+ deps: [build]

+ env:

+ CGO_ENABLED: "1" # required for -race

+ cmds:

+ - go test -race -count=1 ./...

+

+// Copyright (c) 2026 Nikolay Govorov

+// SPDX-License-Identifier: AGPL-3.0-or-later

+

+package main

+

+import (

+ "encoding/json"

+ "net/http"

+ "strings"

+

+ mirum "dimidiumlabs/mirum"

+)

+

+// primarySPDX is the SPDX identifier of mirum itself.

+const primarySPDX = "AGPL-3.0-or-later"

+

+// licensesPageData mirrors internal/licensegen's Manifest with a primary

+// license header prepended. The frontend consumes it verbatim.

+type licensesPageData struct {

+ Primary struct {

+ Name string `json:"name"`

+ SPDX string `json:"spdx"`

+ Text string `json:"text"`

+ } `json:"primary"`

+ Manifest json.RawMessage `json:"manifest"`

+}

+

+var licensesData = mustLoadLicenses()

+

+func mustLoadLicenses() *licensesPageData {

+ if !json.Valid(mirum.Licenses) {

+ panic("embedded licenses.json is not valid JSON")

+ }

+ d := &licensesPageData{Manifest: mirum.Licenses}

+ d.Primary.Name = "mirum"

+ d.Primary.SPDX = primarySPDX

+ d.Primary.Text = strings.TrimSpace(mirum.License) + "\n"

+ return d

+}

+

+// licenses serves /about/licenses. Public: no auth, no CSRF.

+func (h *webHandler) licenses(w http.ResponseWriter, _ *http.Request) {

+ h.assets.renderPage(w, "licenses", http.StatusOK, licensesData)

+}

+ - local: ["../web/node_modules/.bin/protoc-gen-es"]

+ r.Get("/about/licenses", h.licenses)

+shell.html

+// Copyright (c) 2026 Nikolay Govorov

+// SPDX-License-Identifier: AGPL-3.0-or-later

+

+import {

+ Accordion,

+ AccordionContent,

+ AccordionItem,

+ AccordionTrigger,

+} from "@/components/ui/accordion";

+

+interface Dep {

+ name: string;

+ version?: string;

+ spdx: string;

+ url?: string;

+ count?: number; // >0 means a collapsed scope entry covering N sub-packages

+}

+

+function depLabel(d: Dep): string {

+ if (d.count && d.count > 0) {

+ return `${d.name} (via ${d.count} npm packages)`;

+ }

+ return d.version ? `${d.name}@${d.version}` : d.name;

+}

+

+interface Variant {

+ text: string;

+ deps: Dep[];

+}

+

+interface Group {

+ spdx: string;

+ total: number;

+ variants: Variant[];

+}

+

+interface Ecosystem {

+ total: number;

+ groups: Group[];

+}

+

+export interface LicensesPageProps {

+ primary: { name: string; spdx: string; text: string };

+ manifest: {

+ generated_at: string;

+ go: Ecosystem;

+ npm: Ecosystem;

+ };

+}

+

+function slug(s: string): string {

+ return s.replace(/[^A-Za-z0-9.-]/g, "_");

+}

+

+/** License renders one variant as an accordion item: the trigger shows the

+ * comma-separated list of packages sharing this exact LICENSE text; the

+ * text itself is hidden inside the collapsed content. */

+function License({

+ value,

+ spdx,

+ variant,

+}: {

+ value: string;

+ spdx: string;

+ variant: Variant;

+}) {

+ return (

+ <AccordionItem value={value}>

+ <AccordionTrigger>

+ <span className="text-start">

+ {variant.deps.map((d, i) => {

+ const outerExpr = d.spdx.replace(/^\((.*)\)$/, "$1");

+ return (

+ <span key={`${d.name}@${d.version ?? ""}`}>

+ {i > 0 && ", "}

+ {depLabel(d)}

+ {outerExpr !== spdx && ` (${outerExpr})`}

+ </span>

+ );

+ })}

+ </span>

+ </AccordionTrigger>

+ <AccordionContent>

+ <pre className="max-h-[280px] overflow-y-scroll border-s-4 border-neutral-800 bg-amber-50 px-4 py-3 text-sm whitespace-pre-wrap dark:border-neutral-500 dark:bg-neutral-800">

+ {variant.text}

+ </pre>

+ </AccordionContent>

+ </AccordionItem>

+ );

+}

+

+function EcosystemSection({

+ title,

+ data,

+ prefix,

+}: {

+ title: string;

+ data: Ecosystem;

+ prefix: string;

+}) {

+ return (

+ <>

+ <h2 className="mt-6 mb-2 text-2xl font-bold leading-[1.2] text-balance">

+ {title} ({data.total})

+ </h2>

+ <p className="my-4 text-pretty">

+ {data.total} runtime {title.toLowerCase()} packages across{" "}

+ {data.groups.length} licenses:

+ </p>

+ <ul className="my-4 list-disc ps-6">

+ {data.groups.map((g) => (

+ <li key={g.spdx} className="my-1">

+ <a

+ href={`#${prefix}-${slug(g.spdx)}`}

+ className="text-sky-700 hover:underline dark:text-sky-400"

+ >

+ {g.spdx} ({g.total})

+ </a>

+ </li>

+ ))}

+ </ul>

+

+ {data.groups.map((g) => (

+ <div key={g.spdx}>

+ <h3

+ id={`${prefix}-${slug(g.spdx)}`}

+ className="mt-6 mb-2 text-[1.15rem] font-bold leading-[1.2] text-balance"

+ >

+ <a

+ href={`#${prefix}-${slug(g.spdx)}`}

+ className="text-inherit hover:underline"

+ >

+ {g.spdx}

+ </a>

+ </h3>

+ <Accordion type="multiple">

+ {g.variants.map((v, i) => (

+ <License

+ key={`${prefix}-${slug(g.spdx)}-${i}`}

+ value={`${prefix}-${slug(g.spdx)}-${i}`}

+ spdx={g.spdx}

+ variant={v}

+ />

+ ))}

+ </Accordion>

+ </div>

+ ))}

+ </>

+ );

+}

+

+export function Page({ primary, manifest }: LicensesPageProps) {

+ return (

+ <article className="mx-auto max-w-[80ch] px-8 py-6 font-mono leading-[1.4]">

+ <h1 className="text-4xl font-bold leading-[1.1] text-balance">

+ Licenses

+ </h1>

+

+ <h2 className="mt-6 mb-2 text-2xl font-bold leading-[1.2] text-balance">

+ Mirum

+ </h2>

+

+ <p className="my-4 text-pretty">

+ Mirum is licensed under{" "}

+ <code className="bg-neutral-200/40 px-[0.4em] py-[0.2em] dark:bg-neutral-700/40">

+ {primary.spdx}

+ </code>

+ . The full license text is included below.

+ </p>

+

+ <pre className="my-4 max-h-[280px] overflow-y-scroll border-s-4 border-neutral-800 bg-amber-50 px-4 py-3 text-sm whitespace-pre-wrap dark:border-neutral-500 dark:bg-neutral-800">

+ {primary.text}

+ </pre>

+

+ <EcosystemSection title="Go" data={manifest.go} prefix="go" />

+ <EcosystemSection title="NPM" data={manifest.npm} prefix="npm" />

+ </article>

+ );

+}

+// Copyright (c) 2023 shadcn

+// SPDX-License-Identifier: MIT

+

+import * as React from "react";

+import { Accordion as AccordionPrimitive } from "radix-ui";

+

+import { cn } from "@/lib/utils";

+import { ChevronDownIcon, ChevronUpIcon } from "lucide-react";

+

+function Accordion({

+ className,

+ ...props

+}: React.ComponentProps<typeof AccordionPrimitive.Root>) {

+ return (

+ <AccordionPrimitive.Root

+ data-slot="accordion"

+ className={cn("flex w-full flex-col", className)}

+ {...props}

+ />

+ );

+}

+

+function AccordionItem({

+ className,

+ ...props

+}: React.ComponentProps<typeof AccordionPrimitive.Item>) {

+ return (

+ <AccordionPrimitive.Item

+ data-slot="accordion-item"

+ className={cn("not-last:border-b", className)}

+ {...props}

+ />

+ );

+}

+

+function AccordionTrigger({

+ className,

+ children,

+ ...props

+}: React.ComponentProps<typeof AccordionPrimitive.Trigger>) {

+ return (

+ <AccordionPrimitive.Header className="flex">

+ <AccordionPrimitive.Trigger

+ data-slot="accordion-trigger"

+ className={cn(

+ "group/accordion-trigger relative flex flex-1 items-start justify-between rounded-md border border-transparent py-4 text-start text-sm font-medium transition-all outline-none hover:underline focus-visible:border-ring focus-visible:ring-3 focus-visible:ring-ring/50 focus-visible:after:border-ring disabled:pointer-events-none disabled:opacity-50 **:data-[slot=accordion-trigger-icon]:ms-auto **:data-[slot=accordion-trigger-icon]:size-4 **:data-[slot=accordion-trigger-icon]:text-muted-foreground",

+ className,

+ )}

+ {...props}

+ >

+ {children}

+ <ChevronDownIcon

+ data-slot="accordion-trigger-icon"

+ className="pointer-events-none shrink-0 group-aria-expanded/accordion-trigger:hidden"

+ />

+ <ChevronUpIcon

+ data-slot="accordion-trigger-icon"

+ className="pointer-events-none hidden shrink-0 group-aria-expanded/accordion-trigger:inline"

+ />

+ </AccordionPrimitive.Trigger>

+ </AccordionPrimitive.Header>

+ );

+}

+

+function AccordionContent({

+ className,

+ children,

+ ...props

+}: React.ComponentProps<typeof AccordionPrimitive.Content>) {

+ return (

+ <AccordionPrimitive.Content

+ data-slot="accordion-content"

+ className="overflow-hidden text-sm data-open:animate-accordion-down data-closed:animate-accordion-up"

+ {...props}

+ >

+ <div

+ className={cn(

+ "h-(--radix-accordion-content-height) pt-0 pb-4 [&_a]:underline [&_a]:underline-offset-3 [&_a]:hover:text-foreground [&_p:not(:last-child)]:mb-4",

+ className,

+ )}

+ >

+ {children}

+ </div>

+ </AccordionPrimitive.Content>

+ );

+}

+

+export { Accordion, AccordionItem, AccordionTrigger, AccordionContent };

+// Copyright (c) 2026 Nikolay Govorov

+// SPDX-License-Identifier: AGPL-3.0-or-later

+

+import "@/index.css";

+import { mountPage } from "@/lib/mount";

+import { Page } from "@/components/pages/licenses";

+

+mountPage(Page);

+@import "./shadcn.css";

+ "@bufbuild/protoc-gen-es": "^2.11.0",

+ "shadcn": "^4.1.2",

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "node_modules/@bufbuild/protoc-gen-es": {

+ "version": "2.11.0",

+ "resolved": "https://registry.npmjs.org/@bufbuild/protoc-gen-es/-/protoc-gen-es-2.11.0.tgz",

+ "integrity": "sha512-VzQuwEQDXipbZ1soWUuAWm1Z0C3B/IDWGeysnbX6ogJ6As91C2mdvAND/ekQ4YIWgen4d5nqLfIBOWLqCCjYUA==",

+ "dev": true,

+ "license": "Apache-2.0",

+ "dependencies": {

+ "@bufbuild/protobuf": "2.11.0",

+ "@bufbuild/protoplugin": "2.11.0"

+ },

+ "bin": {

+ "protoc-gen-es": "bin/protoc-gen-es"

+ },

+ "engines": {

+ "node": ">=20"

+ },

+ "peerDependencies": {

+ "@bufbuild/protobuf": "2.11.0"

+ },

+ "peerDependenciesMeta": {

+ "@bufbuild/protobuf": {

+ "optional": true

+ }

+ }

+ },

+ "node_modules/@bufbuild/protoplugin": {

+ "version": "2.11.0",

+ "resolved": "https://registry.npmjs.org/@bufbuild/protoplugin/-/protoplugin-2.11.0.tgz",

+ "integrity": "sha512-lyZVNFUHArIOt4W0+dwYBe5GBwbKzbOy8ObaloEqsw9Mmiwv2O48TwddDoHN4itylC+BaEGqFdI1W8WQt2vWJQ==",

+ "dev": true,

+ "license": "Apache-2.0",

+ "dependencies": {

+ "@bufbuild/protobuf": "2.11.0",

+ "@typescript/vfs": "^1.6.2",

+ "typescript": "5.4.5"

+ }

+ },

+ "node_modules/@bufbuild/protoplugin/node_modules/typescript": {

+ "version": "5.4.5",

+ "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.4.5.tgz",

+ "integrity": "sha512-vcI4UpRgg81oIRUFwR0WSIHKt11nJ7SAVlYNIu+QpqeyXP+gpQJy/Z4+F0aGxSE4MqwjyXvW/TzgkLAx2AGHwQ==",

+ "dev": true,

+ "license": "Apache-2.0",

+ "bin": {

+ "tsc": "bin/tsc",

+ "tsserver": "bin/tsserver"

+ },

+ "engines": {

+ "node": ">=14.17"

+ }

+ },

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "node_modules/@typescript/vfs": {

+ "version": "1.6.4",

+ "resolved": "https://registry.npmjs.org/@typescript/vfs/-/vfs-1.6.4.tgz",

+ "integrity": "sha512-PJFXFS4ZJKiJ9Qiuix6Dz/OwEIqHD7Dme1UwZhTK11vR+5dqW2ACbdndWQexBzCx+CPuMe5WBYQWCsFyGlQLlQ==",

+ "dev": true,

+ "license": "MIT",

+ "dependencies": {

+ "debug": "^4.4.3"

+ },

+ "peerDependencies": {

+ "typescript": "*"

+ }

+ },

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "dev": true,

+ "limit": "60 KB"

+ "limit": "60 KB"

+ "@bufbuild/protoc-gen-es": "^2.11.0",

+ "shadcn": "^4.1.2",

+/* Copyright (c) 2023 shadcn

+ * SPDX-License-Identifier: MIT

+ *

+ * Inlined from `shadcn/tailwind.css` (npm package `shadcn`, MIT). Kept in

+ * tree so the shadcn CLI can stay in devDependencies — importing the npm

+ * package at build time would re-introduce its runtime dep chain (which,

+ * transitively, pulls a Python-2.0 licensed package that conflicts with

+ * the mirum commercial license). */

+

+@theme inline {

+ @keyframes accordion-down {

+ from {

+ height: 0;

+ }

+ to {

+ height: var(

+ --radix-accordion-content-height,

+ var(--accordion-panel-height, auto)

+ );

+ }

+ }

+

+ @keyframes accordion-up {

+ from {

+ height: var(

+ --radix-accordion-content-height,

+ var(--accordion-panel-height, auto)

+ );

+ }

+ to {

+ height: 0;

+ }

+ }

+}

+

+/* Custom variants */

+@custom-variant data-open {

+ &:where([data-state="open"]),

+ &:where([data-open]:not([data-open="false"])) {

+ @slot;

+ }

+}

+

+@custom-variant data-closed {

+ &:where([data-state="closed"]),

+ &:where([data-closed]:not([data-closed="false"])) {

+ @slot;

+ }

+}

+

+@custom-variant data-checked {

+ &:where([data-state="checked"]),

+ &:where([data-checked]:not([data-checked="false"])) {

+ @slot;

+ }

+}

+

+@custom-variant data-unchecked {

+ &:where([data-state="unchecked"]),

+ &:where([data-unchecked]:not([data-unchecked="false"])) {

+ @slot;

+ }

+}

+

+@custom-variant data-selected {

+ &:where([data-selected="true"]) {

+ @slot;

+ }

+}

+

+@custom-variant data-disabled {

+ &:where([data-disabled="true"]),

+ &:where([data-disabled]:not([data-disabled="false"])) {

+ @slot;

+ }

+}

+

+@custom-variant data-active {

+ &:where([data-state="active"]),

+ &:where([data-active]:not([data-active="false"])) {

+ @slot;

+ }

+}

+

+@custom-variant data-horizontal {

+ &:where([data-orientation="horizontal"]) {

+ @slot;

+ }

+}

+

+@custom-variant data-vertical {

+ &:where([data-orientation="vertical"]) {

+ @slot;

+ }

+}

+

+@utility no-scrollbar {

+ -ms-overflow-style: none;

+ scrollbar-width: none;

+

+ &::-webkit-scrollbar {

+ display: none;

+ }

+}

+

+ <link rel="modulepreload" href="{{.Href}}" {{if .Integrity}} integrity="{{.Integrity}}" {{end}} />

+

+ <link rel="stylesheet" href="{{.Href}}" {{if .Integrity}} integrity="{{.Integrity}}" {{end}} />

+

+ <script type="application/json" id="__DATA__">

+ {{.DataJSON}}

+ </script>

+

+ font: 14px system-ui, sans-serif;

+ >Mirum requires JavaScript to run. Please enable it in your browser.</p>

+

+ {{- end}}

+

+ {{- range .Scripts}}

+ {{if .Integrity}} integrity="{{.Integrity}}" {{end}}

+ github.com/github/go-spdx/v2 v2.4.0

+ github.com/google/licensecheck v0.3.1

+github.com/github/go-spdx/v2 v2.4.0 h1:+4IwVwJJbm3rzvrQ6P1nI9BDMcy3la4RchRy5uehV/M=

+github.com/github/go-spdx/v2 v2.4.0/go.mod h1:/5rwgS0txhGtRdUZwc02bTglzg6HK3FfuEbECKlK2Sg=

+github.com/google/licensecheck v0.3.1 h1:QoxgoDkaeC4nFrtGN1jV7IPmDCHFNIVh54e5hSt6sPs=

+github.com/google/licensecheck v0.3.1/go.mod h1:ORkR35t/JjW+emNKtfJDII0zlciG9JgbT7SmsohlHmY=

+// Copyright (c) 2026 Nikolay Govorov

+// SPDX-License-Identifier: AGPL-3.0-or-later

+

+// Command licensegen writes build/licenses.json — the third-party dependency

+// manifest embedded into mirum binaries. Output is pre-grouped: each

+// ecosystem contains SPDX groups; each group contains text variants (packages

+// sharing identical LICENSE text collapse into one variant); each variant

+// lists its deps. The frontend renders without further transformation.

+package main

+

+import (

+ "cmp"

+ "encoding/json"

+ "flag"

+ "fmt"

+ "log"

+ "os"

+ "path/filepath"

+ "slices"

+ "strconv"

+ "strings"

+ "time"

+

+ "github.com/github/go-spdx/v2/spdxexp"

+)

+

+// allowedSPDX are SPDX ids approved for runtime deps. mirum sells a

+// commercial license, so GPL-family ids are excluded even though the

+// upstream distribution is AGPL-3.0-or-later.

+var allowedSPDX = []string{

+ "0BSD", "Apache-2.0", "BSD-2-Clause", "BSD-3-Clause",

+ "CC0-1.0", "ISC", "MIT", "OFL-1.1",

+ "Unicode-3.0", "Unlicense", "Zlib",

+}

+

+// collapsedScopes are npm scopes whose sub-packages come from a single

+// upstream monorepo and should render as one "@scope" row. All sub-packages

+// of a collapsed scope must declare the same SPDX — mismatch aborts.

+var collapsedScopes = []string{"@radix-ui"}

+

+type Dep struct {

+ Name string `json:"name"`

+ Version string `json:"version,omitempty"`

+ SPDX string `json:"spdx"`

+ URL string `json:"url,omitempty"`

+ Count int `json:"count,omitempty"` // >0 means a collapsed scope entry covering N sub-packages

+

+ atoms []string // internal: atomic SPDX ids for cross-listing

+ text string // internal: verbatim LICENSE text

+}

+

+type Variant struct {

+ Text string `json:"text"`

+ Deps []Dep `json:"deps"`

+}

+

+type Group struct {

+ SPDX string `json:"spdx"`

+ Total int `json:"total"`

+ Variants []Variant `json:"variants"`

+}

+

+type Ecosystem struct {

+ Total int `json:"total"`

+ Groups []Group `json:"groups"`

+}

+

+type Manifest struct {

+ GeneratedAt string `json:"generated_at"`

+ Go Ecosystem `json:"go"`

+ NPM Ecosystem `json:"npm"`

+}

+

+func main() {

+ log.SetFlags(0)

+ log.SetPrefix("licensegen: ")

+

+ out := flag.String("out", "", "output path for licenses.json")

+ repo := flag.String("repo", "", "repo root (defaults to walking up from cwd)")

+ flag.Parse()

+

+ if *out == "" {

+ log.Fatal("missing required -out flag")

+ }

+ root, err := resolveRepoRoot(*repo)

+ if err != nil {

+ log.Fatal(err)

+ }

+

+ goDeps, err := scanGo(root)

+ if err != nil {

+ log.Fatalf("scan go: %v", err)

+ }

+ npmDeps, err := scanNPM(root)

+ if err != nil {

+ log.Fatalf("scan npm: %v", err)

+ }

+

+ m := Manifest{

+ GeneratedAt: sourceDateEpoch().UTC().Format(time.RFC3339),

+ Go: group(goDeps),

+ NPM: group(npmDeps),

+ }

+

+ body, err := json.MarshalIndent(m, "", " ")

+ if err != nil {

+ log.Fatal(err)

+ }

+ if err := os.WriteFile(*out, append(body, '\n'), 0o644); err != nil {

+ log.Fatalf("write %s: %v", *out, err)

+ }

+ log.Printf("wrote %s (go=%d npm=%d)", *out, m.Go.Total, m.NPM.Total)

+}

+

+// group assembles deps into SPDX atoms × text variants. A dep with a compound

+// expression ("A AND B") is cross-listed under every atom.

+// Unexported Dep fields (atoms, text) are dropped by encoding/json.

+func group(deps []Dep) Ecosystem {

+ // atom → text → *Variant

+ byAtom := map[string]map[string]*Variant{}

+ for _, d := range deps {

+ for _, atom := range d.atoms {

+ byText := byAtom[atom]

+ if byText == nil {

+ byText = map[string]*Variant{}

+ byAtom[atom] = byText

+ }

+ v := byText[d.text]

+ if v == nil {

+ v = &Variant{Text: d.text}

+ byText[d.text] = v

+ }

+ v.Deps = append(v.Deps, d)

+ }

+ }

+

+ groups := make([]Group, 0, len(byAtom))

+ for atom, byText := range byAtom {

+ variants := make([]Variant, 0, len(byText))

+ total := 0

+ for _, v := range byText {

+ slices.SortFunc(v.Deps, func(a, b Dep) int { return strings.Compare(a.Name, b.Name) })

+ variants = append(variants, *v)

+ total += len(v.Deps)

+ }

+ slices.SortFunc(variants, func(a, b Variant) int {

+ return cmp.Or(

+ cmp.Compare(len(b.Deps), len(a.Deps)), // desc

+ cmp.Compare(a.Deps[0].Name, b.Deps[0].Name),

+ )

+ })

+ groups = append(groups, Group{SPDX: atom, Total: total, Variants: variants})

+ }

+ slices.SortFunc(groups, func(a, b Group) int {

+ return cmp.Or(cmp.Compare(b.Total, a.Total), cmp.Compare(a.SPDX, b.SPDX))

+ })

+ return Ecosystem{Total: len(deps), Groups: groups}

+}

+

+// validateSPDX checks expr against allowedSPDX and returns its atomic ids.

+func validateSPDX(expr string) ([]string, error) {

+ ok, err := spdxexp.Satisfies(expr, allowedSPDX)

+ if err != nil {

+ return nil, err

+ }

+ if !ok {

+ return nil, fmt.Errorf("SPDX %q not allowed", expr)

+ }

+ return spdxexp.ExtractLicenses(expr)

+}

+

+// readLicenseFile returns the contents and path of the first LICENSE-like

+// file in dir. "LICENSE", "LICENCE", "COPYING" prefixes with any extension.

+func readLicenseFile(dir string) (string, string, error) {

+ entries, err := os.ReadDir(dir)

+ if err != nil {

+ return "", "", err

+ }

+ for _, e := range entries {

+ n := strings.ToLower(e.Name())

+ if strings.HasPrefix(n, "license") || strings.HasPrefix(n, "licence") || strings.HasPrefix(n, "copying") {

+ p := filepath.Join(dir, e.Name())

+ if b, err := os.ReadFile(p); err == nil {

+ return normalize(string(b)), p, nil

+ }

+ }

+ }

+ return "", "", os.ErrNotExist

+}

+

+// normalize strips BOM + trims whitespace + LF line endings, so near-identical

+// texts (differing only by trailing blank lines or CRLF) dedupe.

+func normalize(s string) string {

+ s = strings.TrimPrefix(s, "\ufeff")

+ s = strings.ReplaceAll(s, "\r\n", "\n")

+ return strings.TrimSpace(s) + "\n"

+}

+

+func sourceDateEpoch() time.Time {

+ if v, _ := strconv.ParseInt(os.Getenv("SOURCE_DATE_EPOCH"), 10, 64); v > 0 {

+ return time.Unix(v, 0)

+ }

+ return time.Now()

+}

+

+func resolveRepoRoot(explicit string) (string, error) {

+ if explicit != "" {

+ return filepath.Abs(explicit)

+ }

+ dir, err := os.Getwd()

+ if err != nil {

+ return "", err

+ }

+ for {

+ if _, err := os.Stat(filepath.Join(dir, "go.mod")); err == nil {

+ return dir, nil

+ }

+ p := filepath.Dir(dir)

+ if p == dir {

+ return "", os.ErrNotExist

+ }

+ dir = p

+ }

+}

+// Copyright (c) 2026 Nikolay Govorov

+// SPDX-License-Identifier: AGPL-3.0-or-later

+

+package main

+

+import (

+ "encoding/json"

+ "errors"

+ "fmt"

+ "io"

+ "os"

+ "os/exec"

+

+ "github.com/google/licensecheck"

+)

+

+// goEntrypoints are the main packages whose linker inputs form the runtime

+// graph. Every production binary we ship lives under cmd/.

+var goEntrypoints = []string{

+ "./cmd/mirum-server",

+ "./cmd/mirum-worker",

+ "./cmd/mirum",

+}

+

+// scanGo reads the prod dependency graph via `go list -deps -json` and

+// classifies each module's LICENSE file with google/licensecheck at a 75%

+// coverage threshold. Below that we refuse to guess.

+func scanGo(root string) ([]Dep, error) {

+ args := append([]string{"list", "-tags=licensegen", "-deps", "-json"}, goEntrypoints...)

+ cmd := exec.Command("go", args...)

+ cmd.Dir = root

+ cmd.Stderr = os.Stderr

+ stdout, err := cmd.StdoutPipe()

+ if err != nil {

+ return nil, err

+ }

+ if err := cmd.Start(); err != nil {

+ return nil, err

+ }

+

+ type mod struct {

+ Path, Version, Dir string

+ Main bool

+ Replace *mod

+ }

+ type pkg struct {

+ Standard bool

+ Module *mod

+ }

+

+ mods := map[string]*mod{}

+ dec := json.NewDecoder(stdout)

+ for {

+ var p pkg

+ if err := dec.Decode(&p); err != nil {

+ if errors.Is(err, io.EOF) {

+ break

+ }

+ return nil, err

+ }

+ if p.Standard || p.Module == nil || p.Module.Main {

+ continue

+ }

+ m := p.Module

+ if m.Replace != nil {

+ m = m.Replace

+ }

+ if m.Dir == "" {

+ return nil, fmt.Errorf("%s: empty Dir (run `go mod download`)", m.Path)

+ }

+ mods[m.Path+"@"+m.Version] = m

+ }

+ if err := cmd.Wait(); err != nil {

+ return nil, err

+ }

+

+ deps := make([]Dep, 0, len(mods))

+ for _, m := range mods {

+ text, path, err := readLicenseFile(m.Dir)

+ if err != nil {

+ return nil, fmt.Errorf("%s@%s: no LICENSE file", m.Path, m.Version)

+ }

+ cov := licensecheck.Scan([]byte(text))

+ if cov.Percent < 75 || len(cov.Match) == 0 {

+ return nil, fmt.Errorf("%s@%s: cannot classify %s (%.0f%%)", m.Path, m.Version, path, cov.Percent)

+ }

+ spdx := cov.Match[0].ID

+ atoms, err := validateSPDX(spdx)

+ if err != nil {

+ return nil, fmt.Errorf("%s@%s: %w", m.Path, m.Version, err)

+ }

+ deps = append(deps, Dep{

+ Name: m.Path,

+ Version: m.Version,

+ SPDX: spdx,

+ URL: "https://pkg.go.dev/" + m.Path + "@" + m.Version,

+ atoms: atoms,

+ text: text,

+ })

+ }

+ return deps, nil

+}

+// Copyright (c) 2026 Nikolay Govorov

+// SPDX-License-Identifier: AGPL-3.0-or-later

+

+package main

+

+import (

+ "encoding/json"

+ "fmt"

+ "os"

+ "path/filepath"

+ "slices"

+ "strings"

+)

+

+const webDir = "cmd/mirum-server/web"

+

+// scanNPM reads package-lock.json (v3+), filters to runtime packages, reads

+// each package's LICENSE verbatim (or synthesizes a copyright notice when

+// none ships — canonical SPDX text is never substituted), and collapses the

+// scopes listed in collapsedScopes into single "@scope" rows.

+func scanNPM(root string) ([]Dep, error) {

+ var lock struct {

+ LockfileVersion int `json:"lockfileVersion"`

+ Packages map[string]struct {

+ Version string `json:"version"`

+ License any `json:"license"`

+ Dev, DevOptional, Link, Peer bool

+ } `json:"packages"`

+ }

+ raw, err := os.ReadFile(filepath.Join(root, webDir, "package-lock.json"))

+ if err != nil {

+ return nil, err

+ }

+ if err := json.Unmarshal(raw, &lock); err != nil {

+ return nil, err

+ }

+ if lock.LockfileVersion < 3 {

+ return nil, fmt.Errorf("lockfileVersion %d unsupported, regenerate with npm v7+", lock.LockfileVersion)

+ }

+

+ // npm hoists identical name@version under multiple paths; skip duplicates

+ // before the expensive LICENSE read.

+ seen := map[string]bool{}

+ var deps []Dep

+ for path, pkg := range lock.Packages {

+ if path == "" || pkg.Link || pkg.Dev || pkg.DevOptional {

+ continue

+ }

+ name := npmName(path)

+ key := name + "@" + pkg.Version

+ if seen[key] {

+ continue

+ }

+ seen[key] = true

+

+ expr, err := npmSPDX(pkg.License)

+ if err != nil {

+ return nil, fmt.Errorf("%s: %w", key, err)

+ }

+

+ atoms, err := validateSPDX(expr)

+ if err != nil {

+ return nil, fmt.Errorf("%s declares %q: %w", key, expr, err)

+ }

+

+ pkgDir := filepath.Join(root, webDir, path)

+ deps = append(deps, Dep{

+ Name: name,

+ Version: pkg.Version,

+ SPDX: expr,

+ URL: "https://www.npmjs.com/package/" + name + "/v/" + pkg.Version,

+ atoms: atoms,

+ text: npmText(pkgDir, name),

+ })

+ }

+

+ scopeOf := func(name string) string {

+ if !strings.HasPrefix(name, "@") {

+ return ""

+ }

+ scope, _, ok := strings.Cut(name, "/")

+ if !ok {

+ return ""

+ }

+ return scope

+ }

+

+ buckets := map[string][]Dep{}

+ var out []Dep

+ for _, d := range deps {

+ if s := scopeOf(d.Name); slices.Contains(collapsedScopes, s) {

+ buckets[s] = append(buckets[s], d)

+ continue

+ }

+ out = append(out, d)

+ }

+

+ for scope, items := range buckets {

+ spdx := items[0].SPDX

+ version := items[0].Version

+ for _, d := range items[1:] {

+ if d.SPDX != spdx {

+ return nil, fmt.Errorf("scope %s: mixed SPDX %q vs %q (%s)", scope, spdx, d.SPDX, d.Name)

+ }

+ if d.Version != version {

+ version = ""

+ }

+ }

+

+ // Prefer umbrella LICENSE, then any sub-package's own.

+ text, _, err := readLicenseFile(filepath.Join(root, webDir, "node_modules", strings.TrimPrefix(scope, "@")))

+ if err != nil {

+ text = items[0].text

+ for _, d := range items {

+ if !strings.HasPrefix(d.text, "Copyright (c) contributors to ") {

+ text = d.text

+ break

+ }

+ }

+ }

+

+ out = append(out, Dep{

+ Name: strings.TrimPrefix(scope, "@"),

+ Version: version,

+ SPDX: spdx,

+ URL: "https://www.npmjs.com/~" + strings.TrimPrefix(scope, "@"),

+ Count: len(items),

+ atoms: items[0].atoms,

+ text: text,

+ })

+ }

+ return out, nil

+}

+

+// npmName extracts the package name from an npm lockfile key like

+// "node_modules/foo" or "node_modules/foo/node_modules/@scope/bar".

+func npmName(path string) string {

+ i := strings.LastIndex(path, "node_modules/")

+ if i < 0 {

+ return ""

+ }

+ n := path[i+len("node_modules/"):]

+ if strings.HasPrefix(n, "@") {

+ return n // scoped "@scope/name" is one name

+ }

+ head, _, _ := strings.Cut(n, "/")

+ return head

+}

+

+// npmSPDX normalises package.json's `license` field. Modern packages use a

+// string; we accept legacy array-of-objects too. Outer parens are stripped

+// so "(MIT OR Apache-2.0)" displays as "MIT OR Apache-2.0".

+func npmSPDX(v any) (string, error) {

+ var s string

+ switch x := v.(type) {

+ case string:

+ s = strings.TrimSpace(x)

+ case []any:

+ var ids []string

+ for _, it := range x {

+ if m, ok := it.(map[string]any); ok {

+ if t, ok := m["type"].(string); ok && t != "" {

+ ids = append(ids, t)

+ }

+ }

+ }

+ s = strings.Join(ids, " OR ")

+ }

+ if s == "" {

+ return "", fmt.Errorf("no license field")

+ }

+ for strings.HasPrefix(s, "(") && strings.HasSuffix(s, ")") {

+ s = strings.TrimSpace(s[1 : len(s)-1])

+ }

+ return s, nil

+}

+

+// npmText returns the LICENSE text shipped with a package, or a copyright

+// notice derived from package.json when no LICENSE file exists. Canonical

+// SPDX text is never substituted — doing so would claim the author wrote

+// something they didn't ship.

+func npmText(pkgDir, name string) string {

+ if text, _, err := readLicenseFile(pkgDir); err == nil {

+ return text

+ }

+ if c := copyrightFromPackageJSON(pkgDir); c != "" {

+ return c + "\n"

+ }

+ return "Copyright (c) contributors to " + name + "\n"

+}

+

+// copyrightFromPackageJSON builds a "Copyright (c) ..." line from the

+// package's author/contributors fields. Returns empty if neither is present.

+func copyrightFromPackageJSON(pkgDir string) string {

+ data, err := os.ReadFile(filepath.Join(pkgDir, "package.json"))

+ if err != nil {

+ return ""

+ }

+ var pj struct {

+ Author any `json:"author"`

+ Contributors []any `json:"contributors"`

+ }

+ if err := json.Unmarshal(data, &pj); err != nil {

+ return ""

+ }

+ var names []string

+ for _, v := range append([]any{pj.Author}, pj.Contributors...) {

+ if s := personName(v); s != "" {

+ names = append(names, s)

+ }

+ }

+ if len(names) == 0 {

+ return ""

+ }

+ return "Copyright (c) " + strings.Join(names, ", ")

+}

+

+// personName renders an npm author/contributor entry (string or {name,email})

+// as "Name <email>" or just "Name".

+func personName(v any) string {

+ switch x := v.(type) {

+ case string:

+ return strings.TrimSpace(x)

+ case map[string]any:

+ name, _ := x["name"].(string)

+ email, _ := x["email"].(string)

+ name = strings.TrimSpace(name)

+ email = strings.TrimSpace(email)

+ if name == "" {

+ return ""

+ }

+ if email == "" {

+ return name

+ }

+ return name + " <" + email + ">"

+ }

+ return ""

+}