refactor(spdx-licenses): return a dedicated type from getLicenseByIdentifier

PHP hands back a positional array, so every caller had to reach into a
PhpMixed list by index and fall back to a default when an element was
missing or the wrong variant -- fallbacks that could never fire, since
the list shape is fixed. LicenseMetadata names the four elements and
makes the accesses total.

This also drops the crate's last use of PhpMixed, and with it the
dependency on shirabe-php-shim.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

5 files changed, 40 insertions, 74 deletions

diff --git a/Cargo.lock b/Cargo.lock
index 18ec0a47..4b5c6817 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2198,7 +2198,6 @@ version = "0.0.1"
 dependencies = [
  "indexmap",
  "serde_json",
- "shirabe-php-shim",
 ]
 
 [[package]]
diff --git a/crates/shirabe-spdx-licenses/Cargo.toml b/crates/shirabe-spdx-licenses/Cargo.toml
index 014673e1..fc421f02 100644
--- a/crates/shirabe-spdx-licenses/Cargo.toml
+++ b/crates/shirabe-spdx-licenses/Cargo.toml
@@ -4,7 +4,6 @@ version.workspace = true
 edition.workspace = true
 
 [dependencies]
-shirabe-php-shim.workspace = true
 indexmap.workspace = true
 serde_json.workspace = true
 
diff --git a/crates/shirabe-spdx-licenses/src/spdx_licenses.rs b/crates/shirabe-spdx-licenses/src/spdx_licenses.rs
index 36d87a1e..82f2ae70 100644
--- a/crates/shirabe-spdx-licenses/src/spdx_licenses.rs
+++ b/crates/shirabe-spdx-licenses/src/spdx_licenses.rs
@@ -1,7 +1,6 @@
 //! ref: composer/vendor/composer/spdx-licenses/src/SpdxLicenses.php
 
 use indexmap::IndexMap;
-use shirabe_php_shim::PhpMixed;
 
 // PHP reads the resource files from `dirname(__DIR__) . '/res'` at runtime via
 // file_get_contents. Composer's res directory ships with the vendored package; embed it at compile
@@ -31,6 +30,14 @@ pub struct SpdxLicenses {
     exceptions_by_length_desc: Vec<String>,
 }
 
+#[derive(Debug)]
+pub struct LicenseMetadata {
+    pub name: String,
+    pub is_osi_approved: bool,
+    pub url: String,
+    pub is_deprecated_license_id: bool,
+}
+
 impl Default for SpdxLicenses {
     fn default() -> Self {
         Self::new()
@@ -53,24 +60,18 @@ impl SpdxLicenses {
     }
 
     /// Returns license metadata by license identifier.
-    ///
-    /// The returned list is in the form of:
-    ///   [ 0 => full name, 1 => osi certified, 2 => link to license text, 3 => deprecation status ]
-    pub fn get_license_by_identifier(&self, identifier: &str) -> Option<PhpMixed> {
+    pub fn get_license_by_identifier(&self, identifier: &str) -> Option<LicenseMetadata> {
         let key = identifier.to_lowercase();
 
         let (identifier, name, is_osi_approved, is_deprecated_license_id) =
             self.licenses.get(&key)?;
 
-        Some(PhpMixed::List(vec![
-            PhpMixed::String(name.clone()),
-            PhpMixed::Bool(*is_osi_approved),
-            PhpMixed::String(format!(
-                "https://spdx.org/licenses/{}.html#licenseText",
-                identifier
-            )),
-            PhpMixed::Bool(*is_deprecated_license_id),
-        ]))
+        Some(LicenseMetadata {
+            name: name.clone(),
+            is_osi_approved: *is_osi_approved,
+            url: format!("https://spdx.org/licenses/{}.html#licenseText", identifier),
+            is_deprecated_license_id: *is_deprecated_license_id,
+        })
     }
 
     pub fn validate(&self, license: &str) -> bool {
diff --git a/crates/shirabe/src/command/show_command.rs b/crates/shirabe/src/command/show_command.rs
index a6bb906d..77d81858 100644
--- a/crates/shirabe/src/command/show_command.rs
+++ b/crates/shirabe/src/command/show_command.rs
@@ -2020,24 +2020,13 @@ impl ShowCommand {
             let out = match license {
                 None => license_id.clone(),
                 Some(license) => {
-                    // SpdxLicenses::getLicenseByIdentifier returns [0 => fullname, 1 => osiApproved, 2 => url].
-                    let list = license.as_list();
-                    let fullname = list
-                        .and_then(|l| l.first())
-                        .and_then(|v| v.as_string())
-                        .unwrap_or("")
-                        .to_string();
-                    let is_osi =
-                        list.and_then(|l| l.get(1)).and_then(|v| v.as_bool()) == Some(true);
-                    let url = list
-                        .and_then(|l| l.get(2))
-                        .and_then(|v| v.as_string())
-                        .unwrap_or("")
-                        .to_string();
-                    if is_osi {
-                        format!("{} ({}) (OSI approved) {}", fullname, license_id, url)
+                    if license.is_osi_approved {
+                        format!(
+                            "{} ({}) (OSI approved) {}",
+                            license.name, license_id, license.url
+                        )
                     } else {
-                        format!("{} ({}) {}", fullname, license_id, url)
+                        format!("{} ({}) {}", license.name, license_id, license.url)
                     }
                 }
             };
@@ -2268,23 +2257,11 @@ impl ShowCommand {
                     match license {
                         None => PhpMixed::String(license_id),
                         Some(l) => {
-                            // PHP shape: ['name' => $license[0], 'osi' => $licenseId, 'url' => $license[2]].
-                            // Note 'osi' is the license id string, not the OSI-approved flag.
-                            let list = l.as_list();
-                            let name = list
-                                .and_then(|x| x.first())
-                                .and_then(|v| v.as_string())
-                                .unwrap_or("")
-                                .to_string();
-                            let url = list
-                                .and_then(|x| x.get(2))
-                                .and_then(|v| v.as_string())
-                                .unwrap_or("")
-                                .to_string();
+                            // The 'osi' key holds the license id string, not the OSI-approved flag.
                             let mut m: IndexMap<String, PhpMixed> = IndexMap::new();
-                            m.insert("name".to_string(), PhpMixed::String(name));
+                            m.insert("name".to_string(), PhpMixed::String(l.name));
                             m.insert("osi".to_string(), PhpMixed::String(license_id));
-                            m.insert("url".to_string(), PhpMixed::String(url));
+                            m.insert("url".to_string(), PhpMixed::String(l.url));
                             PhpMixed::Array(m.into_iter().collect())
                         }
                     }
diff --git a/crates/shirabe/src/util/config_validator.rs b/crates/shirabe/src/util/config_validator.rs
index 35f14192..9b6b292d 100644
--- a/crates/shirabe/src/util/config_validator.rs
+++ b/crates/shirabe/src/util/config_validator.rs
@@ -116,33 +116,23 @@ impl ConfigValidator {
             let license_validator = SpdxLicenses::new();
             for license in &licenses {
                 let spdx_license = license_validator.get_license_by_identifier(license);
-                if let Some(spdx_license) = spdx_license {
-                    // PHP: $spdxLicense[3] — fourth element is the deprecated flag.
-                    let is_deprecated = match &spdx_license {
-                        PhpMixed::List(l) => l.get(3).and_then(|v| v.as_bool()).unwrap_or(false),
-                        _ => false,
-                    };
-                    if is_deprecated {
-                        if Preg::is_match(php_regex!(r"{^[AL]?GPL-[123](\.[01])?\+$}i"), license) {
-                            warnings.push(format!(
-                                "License \"{}\" is a deprecated SPDX license identifier, use \"{}-or-later\" instead",
-                                license,
-                                license.replace('+', "")
-                            ));
-                        } else if Preg::is_match(
-                            php_regex!(r"{^[AL]?GPL-[123](\.[01])?$}i"),
+                if spdx_license.is_some_and(|l| l.is_deprecated_license_id) {
+                    if Preg::is_match(php_regex!(r"{^[AL]?GPL-[123](\.[01])?\+$}i"), license) {
+                        warnings.push(format!(
+                            "License \"{}\" is a deprecated SPDX license identifier, use \"{}-or-later\" instead",
                             license,
-                        ) {
-                            warnings.push(format!(
-                                "License \"{}\" is a deprecated SPDX license identifier, use \"{}-only\" or \"{}-or-later\" instead",
-                                license, license, license
-                            ));
-                        } else {
-                            warnings.push(format!(
-                                "License \"{}\" is a deprecated SPDX license identifier, see https://spdx.org/licenses/",
-                                license
-                            ));
-                        }
+                            license.replace('+', "")
+                        ));
+                    } else if Preg::is_match(php_regex!(r"{^[AL]?GPL-[123](\.[01])?$}i"), license) {
+                        warnings.push(format!(
+                            "License \"{}\" is a deprecated SPDX license identifier, use \"{}-only\" or \"{}-or-later\" instead",
+                            license, license, license
+                        ));
+                    } else {
+                        warnings.push(format!(
+                            "License \"{}\" is a deprecated SPDX license identifier, see https://spdx.org/licenses/",
+                            license
+                        ));
                     }
                 }
             }