licence_audit/manifest

Types

GraphNode

A node in the full dependency graph. Includes non-Hex packages so that dependency paths can render correctly through git/path deps even though those packages are not audited for licences.

pub type GraphNode {
  GraphNode(name: String, requirements: List(String))
}

Constructors

GraphNode(name: String, requirements: List(String))

LockedPackages

</>

pub type LockedPackages {
  LockedPackages(
    packages: List(Package),
    skipped_packages: List(SkippedPackage),
    direct_names: List(String),
    graph: List(GraphNode),
  )
}

Constructors

LockedPackages(
  packages: List(Package),
  skipped_packages: List(SkippedPackage),
  direct_names: List(String),
  graph: List(GraphNode),
)

Package

</>

pub type Package {
  Package(
    name: String,
    version: String,
    requirements: List(String),
  )
}

Constructors

Package(
  name: String,
  version: String,
  requirements: List(String),
)

Provenance

</>

pub type Provenance {
  HexProvenance(
    outer_checksum: String,
    inner_checksum: option.Option(String),
  )
  GitProvenance(
    repo: String,
    commit: String,
    path: option.Option(String),
  )
  PathProvenance(path: String)
  UnknownProvenance(source: String)
}

Constructors

```
HexProvenance(
  outer_checksum: String,
  inner_checksum: option.Option(String),
)
```
Hex lockfile entry. outer_checksum is the SHA-256 of the tarball as shipped by Hex. inner_checksum, when present, is the SHA-256 of the contents inside the tarball: Gleam’s current manifest.toml does not record it, but the field is accepted for forward compatibility with future lockfile formats so the SBOM can surface both checksums.

GitProvenance(
  repo: String,
  commit: String,
  path: option.Option(String),
)

```
PathProvenance(path: String)
```
```
UnknownProvenance(source: String)
```

SbomEntry

</>

pub type SbomEntry {
  SbomEntry(
    name: String,
    version: String,
    requirements: List(String),
    provenance: Provenance,
  )
}

Constructors

SbomEntry(
  name: String,
  version: String,
  requirements: List(String),
  provenance: Provenance,
)

SbomManifest

</>

pub type SbomManifest {
  SbomManifest(
    entries: List(SbomEntry),
    root_requirements: List(String),
  )
}

Constructors

SbomManifest(
  entries: List(SbomEntry),
  root_requirements: List(String),
)

Whether a package is part of the production dependency tree (Prod) or only reachable through development dependencies (Dev). Prod wins: a package reachable from any production direct dependency is Prod.

pub type Scope {
  Prod
  Dev
}

Constructors

```
Prod
```
```
Dev
```

SkippedPackage

</>

A package present in the lockfile but excluded from licence auditing because it isn’t sourced from Hex (e.g. git or path deps). Still surfaced in the dependency tree so the structure of the graph is visible.

pub type SkippedPackage {
  SkippedPackage(
    name: String,
    version: String,
    source: String,
    requirements: List(String),
  )
}

Constructors

SkippedPackage(
  name: String,
  version: String,
  source: String,
  requirements: List(String),
)

Values

dep_paths

</>

pub fn dep_paths(
  locked: LockedPackages,
) -> dict.Dict(String, List(String))

Compute the shortest dependency path from any direct dependency to every reachable package in the locked graph.

The path is inclusive of both endpoints: for a direct dependency A, the path is ["A"]; for a transitive C reached via A -> B -> C, the path is ["A", "B", "C"]. Multi-source BFS from all direct deps guarantees shortest length; ties are broken by the order packages appear in the manifest.

Packages with no incoming edges from a direct dep (orphans, which a well-formed lockfile should not contain) are omitted.

dep_scopes

</>

pub fn dep_scopes(
  locked: LockedPackages,
  prod_direct_names: List(String),
) -> dict.Dict(String, Scope)

Classify every package in the locked graph as Prod or Dev, seeded from the production direct dependency names.

git_source_identity

</>

pub fn git_source_identity(
  repo: String,
  commit: String,
  path: option.Option(String),
) -> String

git_subdirectory

</>

pub fn git_subdirectory(
  path: option.Option(String),
) -> Result(String, Nil)

Normalize only for lookup; Git provenance retains the manifest spelling.

load

</>

pub fn load(path: String) -> Result(LockedPackages, Error)

load_sbom

</>

pub fn load_sbom(path: String) -> Result(SbomManifest, Error)

load_vulns

</>

pub fn load_vulns(path: String) -> Result(SbomManifest, Error)

Load vulnerability identities without requiring archive checksums. Missing source fields affect only that entry, not valid provenance elsewhere.

parse

</>

pub fn parse(input: String) -> Result(LockedPackages, Error)

prod_direct_names

</>

pub fn prod_direct_names(
  gleam_toml: String,
) -> Result(List(String), Nil)

Parse the names of direct production dependencies from gleam.toml source: the keys of the [dependencies] table, or an empty list if it is absent. Return Error(Nil) for invalid TOML or a dependencies value that is not a table.

sbom_entries

</>

pub fn sbom_entries(input: String) -> Result(SbomManifest, Error)

sbom_scopes

</>

pub fn sbom_scopes(
  manifest: SbomManifest,
  prod_direct_names: List(String),
) -> dict.Dict(String, Scope)

Classify every entry in an SBOM manifest graph (used by sbom and vulns).

scope_label

</>

pub fn scope_label(scope: Scope) -> String

String label for a scope, used in SBOM properties and CLI output.