licence_audit/hex

Types

Error

pub type Error {
  InvalidJson(String)
  InvalidMetadata(String)
  NotFound
  RateLimited
  UnexpectedResponse(status: Int)
  NetworkFailure(reason: String)
}

Constructors

```
InvalidJson(String)
```
```
InvalidMetadata(String)
```
```
NotFound
```
```
RateLimited
```
```
UnexpectedResponse(status: Int)
```
```
NetworkFailure(reason: String)
```

PackageMetadata

</>

pub type PackageMetadata {
  PackageMetadata(
    licences: List(String),
    description: option.Option(String),
    links: List(#(String, String)),
    publisher: option.Option(String),
  )
}

Constructors

```
PackageMetadata(
  licences: List(String),
  description: option.Option(String),
  links: List(#(String, String)),
  publisher: option.Option(String),
)
```
Arguments

description

Short package summary from Hex meta.description, when present.

links

meta.links as #(label, url) pairs, sorted by label for deterministic output (e.g. #("GitHub", "https://...")).

publisher

Display name of who published the package, derived best-effort from Hex owners (preferred) or meta.maintainers (fallback). Multiple names are joined with ", " in stable, alphabetical order. None when Hex exposes neither for the package (a common case).

Values

decode_cache_entry

</>

pub fn decode_cache_entry(
  encoded: String,
) -> Result(PackageMetadata, Nil)

Parse a cache entry written by encode_cache_entry. Returns Error(Nil) on any malformed entry so the caller can treat it as a cache miss.

decode_package

</>

pub fn decode_package(
  input: String,
) -> Result(PackageMetadata, Error)

describe_error

</>

pub fn describe_error(error: Error) -> String

Short, human-readable description of a fetch error, for surfacing in progress warnings (e.g. when a fetch fails and the cache falls back to a stale entry).

encode_cache_entry

</>

pub fn encode_cache_entry(metadata: PackageMetadata) -> String

Serialise metadata for the on-disk cache as a compact JSON object. The cache format is independent of the Hex API shape so it can evolve without reparsing upstream responses; bump the cache filename when it changes.

fetch_package_metadata

</>

pub fn fetch_package_metadata(
  name: String,
  client: fn(request.Request(String)) -> Result(
    response.Response(String),
    Error,
  ),
) -> Result(PackageMetadata, Error)

fetch_package_metadata_from_hex

</>

pub fn fetch_package_metadata_from_hex(
  name: String,
) -> Result(PackageMetadata, Error)

from_http_error

</>

pub fn from_http_error(
  req: request.Request(String),
  error: httpc_adaptive.Error,
) -> Error

licences_only

</>

pub fn licences_only(licences: List(String)) -> PackageMetadata

Construct metadata that contains only licences, with no description, links, or publisher. Used where only licence policy matters (the check/update paths) and by tests that don’t exercise SBOM enrichment.

package_metadata_from_archive

</>

pub fn package_metadata_from_archive(
  input: BitArray,
) -> Result(PackageMetadata, Nil)

Decode the immutable metadata.config stored in a Hex package tarball. Accept byte strings, quoted /utf8 strings, decimal byte segments, and mixtures of these binary segments. Reject unsupported literals or malformed fields instead of omitting metadata. Input is limited to 1 MiB and 64 nested containers; atoms are never interned.

Constructors

Constructors

Arguments