licence_audit/gleam_toml

Reusable parser for a dependency’s gleam.toml.

Git and path dependencies have no Hex registry metadata, but their checked out source tree has a gleam.toml with description, licences, and links. This module extracts those into a hex.PackageMetadata value so the SBOM and notices flows can treat local and Hex-sourced metadata uniformly. The repository link is always the caller-supplied repo_url (the manifest-recorded source), not gleam.toml’s declared repository, which may point at an upstream project for a fork.

Values

declared_licences

</>

pub fn declared_licences(doc: tomlet.Document) -> List(String)

Read the licences array from a parsed gleam.toml, dropping non-string entries. Returns [] when the key is absent or not an array.

links

</>

pub fn links(doc: tomlet.Document) -> List(#(String, String))

Parse a gleam.toml links = [{ title, href }] array into #(title, href) pairs, skipping malformed entries.

package_metadata

</>

pub fn package_metadata(
  contents: String,
  repo_url: String,
) -> Result(hex.PackageMetadata, Nil)

Build package metadata from a dependency’s gleam.toml contents, mirroring the fields Hex enrichment provides (minus publisher, which gleam.toml lacks).

strip_git_suffix

</>

pub fn strip_git_suffix(url: String) -> String

Drop a trailing .git suffix from a URL, if present.