SPDX表达式解析与许可证冲突治理（AND-OR-WITH）最佳实践

实现示例type Node = { type: 'ID' | 'AND' | 'OR' | 'WITH'; left?: Node; right?: Node; id?: string; exception?: string } function tokenize(expr: string): string[] { return expr.replace(/\(|\)/g, m => ` ${m} `).trim().split(/\s+/) } function parse(tokens: string[]): Node { const stack: Node[] = [] const ops: string[] = [] function reduce(op: string) { const r = stack.pop() as Node const l = stack.pop() as Node stack.push({ type: op as any, left: l, right: r }) } for (const t of tokens) { if (t === '(') ops.push(t) else if (t === ')') { while (ops.length && ops[ops.length - 1] !== '(') reduce(ops.pop() as string); ops.pop() } else if (t === 'AND' || t === 'OR') { while (ops.length && ops[ops.length - 1] !== '(') reduce(ops.pop() as string); ops.push(t) } else if (t === 'WITH') { const prev = stack.pop() as Node; const next = tokens.shift() as string; stack.push({ type: 'WITH', left: prev, right: { type: 'ID', id: next }, exception: next }) } else stack.push({ type: 'ID', id: t }) } while (ops.length) reduce(ops.pop() as string) return stack[0] } function containsDenied(ast: Node, deny: Set<string>): boolean { if (ast.type === 'ID') return deny.has(ast.id || '') if (ast.type === 'WITH') return deny.has(ast.left?.id || '') if (ast.type === 'AND') return containsDenied(ast.left as Node, deny) || containsDenied(ast.right as Node, deny) if (ast.type === 'OR') return containsDenied(ast.left as Node, deny) && containsDenied(ast.right as Node, deny) return false } function evaluate(expr: string, deny: Set<string>): { ok: boolean; errors: string[] } { const tokens = tokenize(expr) const ast = parse(tokens) const bad = containsDenied(ast, deny) return { ok: !bad, errors: bad ? ['license-denied'] : [] } } 审计与发布治理审计表达式与冲突结果；命中禁止许可证阻断并输出建议。例外审批需设到期与影响范围；产线默认拒绝未审批项。