| title | Dependency Ownership |
|---|---|
| description | The fail-closed dependency, platform, oracle, and acquisition policy for zig-js. |
zig-js has a machine-readable dependency boundary:
docs/.data/dependency-inventory-v1.json,
plus the issue #497 repository-tool migration inventory at
docs/.data/tool-migration-inventory-v1.json.
zig build dependency-audit validates both inventories and rejects an unknown
local package, system link, build subprocess, script runtime, registry package,
submodule, corpus checkout, release download, or production dynamic-loading
edge. The gate itself is implemented in Zig and performs no network access.
Every external edge has exactly one class:
| Class | Permitted use |
|---|---|
zig_toolchain |
The Zig compiler and standard library used to produce the engine. |
standard_platform_interface |
Target C/C++ ABI and named SDK interfaces such as Foundation; never an imported JavaScript implementation. |
owner_maintained_local |
An owner-maintained sibling checkout resolved by local path. The production allowlist is exactly ../zig-regex and ../zig-gc; owned tools such as BunPress are scoped separately. |
owner_maintained_pinned_tooling |
An owner-maintained build/bootstrap tool fixed to immutable source and executable versions; never part of engine semantics. |
checksum_pinned_oracle |
A named test, differential, or benchmark input pinned by git object ID or release checksum. |
generated_data_acquisition_input |
A one-shot source for checked-in generated tables; it is not contacted by ordinary build or test steps. |
prohibited_unclassified |
An edge that cannot remain. A checked migration issue is mandatory, so this state cannot become a silent exemption. |
Each inventory record also states its scope, locator, pin, license, and whether it can affect runtime semantics. Ambiguous or missing fields fail the audit.
build.zig.zon contains only the two owned local dependencies. It has no URL or
package-registry resolution, and the normal library graph contains no fetch
command. CI checks out those siblings at the exact revisions recorded in the
inventory, using the same adjacent paths as a local build.
Documentation deliberately uses the owner-maintained BunPress source checkout
at ../../Tools/bunpress. BunPress, STX, and ts-syntax-highlighter are each
resolved from their owner-maintained sibling checkout, and all three exact
revisions are recorded in the inventory. CI uses the same Libraries/ plus
Tools/ layout, builds those owned sources, and verifies the workspace links
before rendering. Missing behavior is fixed in the owning repository and then
consumed here; zig-js does not carry substitutes.
Home's repository-tool runtime is bootstrapped without a dependency cycle.
zig build home-tool-bootstrap installs the unbridged public C archive that
Home links for its zig-js engine; once that pinned Home runtime exists, the
normal macOS zig build uses it to append the Objective-C bridge objects and
produce the complete installed archive. The bootstrap target is not a reduced
public product and does not replace the normal install—it is the exact producer
boundary needed before the owned packaging tool exists.
The macOS Objective-C bridge may use the Xcode SDK and Foundation as the
platform interface it implements. System JavaScriptCore is isolated to the
explicit differential and benchmark executables; it never links into
libzig-js.a or supplies engine semantics. Upstream corpora and Wasm converters
are likewise oracle-only inputs to named targets, with git or SHA-256 pins.
The #497 migration is complete. Every repository tool is TypeScript executed by owner-maintained Home, with zig-js as its default JavaScript engine and JSC as the explicit compatibility selection. CI actions use immutable commit identifiers. Standards-data generators accept operator-supplied local snapshots; the sole network-capable acquisition tool pins both the upstream revision and every archive SHA-256.
The tool migration inventory classifies 59 executable tools: no .py or
.mjs, 59 .ts, and no .sh. The documentation link gate has already moved to
the tested in-tree docs-link-check Zig executable and is no longer part of
that migration set. Each remaining record identifies its role, inputs, outputs,
subprocesses, caller/reference files, effective exit and diagnostic contract,
ordering and schema requirements, network policy, and disposition. Durable
tools execute through the owner-maintained Home runtime. The audit reads the Git
index and rejects a missing or stale tool record, extension/runtime mismatch,
unknown contract profile, new caller/reference file, or reintroduction of a
Python, MJS, or shell tool. Tracked symlinks are not
followed because their real tracked targets are audited directly.
The former system-libffi edge was removed by the owned Zig/assembly dispatcher tracked in #463; it is no longer an inventory entry or link dependency.
Update the implementation and inventory in the same commit, including the semantic-effect ruling and an exact pin where the class requires one. Then run:
zig build dependency-auditAdding an edge without a complete classification is intentionally impossible to land through the required CI gate.
The single-byte TextDecoder tables are generated from
encoding-singlebyte-oracle-v1.json.
That versioned artifact freezes the 26 accepted tables and 183 accepted labels
that were originally sampled from Node/ICU at source commit 5125308aa. The
generator no longer executes a host Node binary or downloads moving WHATWG
inputs. Changing decoder behavior now requires reviewing a new oracle version
and its generated Zig diff together.