[andrew]

Running every ScanCode licensedb key through the package turned up several places where it disagreed with the SPDX grammar or with the license data.

• Identifiers may now start or end with - or ., which the SPDX idstring grammar allows, for example LicenseRef-scancode-gradle-enterprise-sla-2022-11-.
• Parse, NormalizeExpression and the Lax variants accept LicenseRef-* exceptions after WITH, as ParseSyntax already does. ParseStrict and Valid still reject them, since SPDX 2.3 requires exceptions from the exception list.
• ExtractLicenses uses this package's parser instead of go-spdx, so it accepts ScanCode exceptions. Results match go-spdx for every input in real_licenses.json that go-spdx accepts, and are now sorted as the doc comment describes.
• HasCopyleft, IsFullyPermissive and ExpressionCategories check licenses and ignore exceptions. Before, any WITH made them return false, so HasCopyleft("GPL-2.0-only WITH Classpath-exception-2.0") was false.
• WITH is allowed after LicenseRef-* and DocumentRef-*:LicenseRef-*, and LicenseRef gains an Exception field.
• The embedded data now includes every licensedb category instead of only OSS ones, so IsCommercial and GetLicenseInfo work for commercial, proprietary and non-commercial licenses. This adds CategoryNonCommercial, maps LicenseRef- alternate keys, and gives SPDX keys precedence so BSL-1.0 resolves to Boost instead of ScanCode's Business Source License.
• A new test parses every key in the embedded data, so the weekly update PR fails if licensedb adds a key that does not parse.

Closes #38
Closes #39
Closes #40

[Copilot]

🟡 Changes recommended

Missing license information can be misclassified as permissive, while rewriting can produce invalid expressions and repeated WITH clauses can silently overwrite exceptions.

3 open issues

• Reject special values in compound license expressions · New
• Reject multiple WITH clauses on license references · New
• Omit WITH when rewriting an exception to empty · New

What changed in this PR

This PR addresses SPDX parsing and ScanCode category gaps from #38–#40, expanding reference support while keeping strict exception validation.

Changes:

• Accepts edge punctuation in identifiers and supports exceptions on license references.
• Uses the local parser for sorted license extraction and excludes exceptions from category lookups.
• Removes category filtering from data updates, prioritizes SPDX keys, and adds regression coverage.

File	Description
spdx.go	Adds local extraction and category-specific identifier traversal.
rewrite.go	Rewrites license references and their exceptions separately.
rewrite_stream_test.go	Updates the rewrite oracle for reference exceptions.
README.md	Documents the non-commercial category.
parse.go	Adds parsing modes, reference exceptions, and edge-punctuation support.
parse_syntax_test.go	Tests expanded identifier syntax and strict validation.
parse_lax.go	Accepts reference exceptions during normalization.
licensedb_test.go	Adds database-wide parsing and extraction compatibility tests.
category.go	Adds prioritized license indexing and exception-free category lookups.
category_test.go	Covers category gaps, key precedence, and WITH expressions.
.github/​workflows/​update-licenses.yml	Retains all categories in future database updates.

_{Review effort: Balanced}