The identity of the dependency sets that decide what licenses/inventory.zon has
to cover. This file is a snapshot, not a source: src/licenses_drift_test.zig
recomputes each section from build.zig.zon and admin/package-lock.json and fails
when it disagrees with what is recorded here. Prose before the first section
header is ignored by the guard.

Updating a section without reviewing licenses/inventory.zon defeats the point of
the guard. When a section changes, work out what the change means for the
shipped bytes first, then record it.

The runtime closure is every lockfile package not marked `dev`. That is a
superset of what the bundler emits — the guard cannot run rollup — so packages
tree-shaken out of admin/dist appear here too; the inventory explains each of them
instead of carrying its licence.

The bundled-packages section is the one the Zig guard cannot compute: it is the
set of npm packages that actually contribute a module to admin/dist, read off the
sourcemap `sources` lists of a `vite build --sourcemap`. Only the frontend gate
can produce it, so gates.yml recomputes it there and fails on a difference. It
is what closes the hole the runtime-closure section leaves open — a package
already in the closure that application code starts importing changes no
lockfile and no version, but it does change this list.

The base image section is here for the same reason: the container image is a
released artifact, and the one third-party file it carries that the binary does
not — the Mozilla CA bundle — comes out of that base. A new tag or a rebuilt
digest both change the line, which forces somebody to re-read what the new base
ships before the inventory can claim it.

The generators section is the other direction: packages the lockfile marks `dev`
whose own output nevertheless ends up in admin/dist, and so in the binary. Its
membership is a judgement, not a query — it was settled by reading a
`vite build --sourcemap` of admin/, both the sourcemap `sources` lists and the
regions of each chunk no sourcemap segment maps back to a source file. The
versions here are read from the lockfile like any other section.

[build.zig.zon dependencies]
mbedtls url=https://github.com/Mbed-TLS/mbedtls/archive/refs/tags/mbedtls-3.6.7.tar.gz hash=N-V-__8AALrvlQKVtYlvv9dpBnbrJfdwR_F0wAgwsvZhAF1Y
sqlite url=https://sqlite.org/2026/sqlite-amalgamation-3530400.zip hash=N-V-__8AAGVtrgCcOcmjrOJnagmnRyMrcKaOo09KbU-vu8w8

[npm runtime closure]
@internationalized/date 3.12.3 Apache-2.0
@internationalized/number 3.6.7 Apache-2.0
@internationalized/string 3.2.10 Apache-2.0
@react-types/shared 3.36.1 Apache-2.0
@stylexjs/stylex 0.19.0 MIT
@swc/helpers 0.5.23 Apache-2.0
@tanstack/history 1.162.0 MIT
@tanstack/query-core 5.101.4 MIT
@tanstack/react-query 5.101.4 MIT
@tanstack/react-router 1.170.18 MIT
@tanstack/react-store 0.9.3 MIT
@tanstack/router-core 1.171.15 MIT
@tanstack/store 0.9.3 MIT
@types/d3-array 3.0.3 MIT
@types/d3-color 3.1.0 MIT
@types/d3-delaunay 6.0.1 MIT
@types/d3-format 3.0.1 MIT
@types/d3-geo 3.1.0 MIT
@types/d3-interpolate 3.0.1 MIT
@types/d3-path 3.1.1 MIT
@types/d3-scale 4.0.2 MIT
@types/d3-shape 3.1.7 MIT
@types/d3-time 3.0.0 MIT
@types/d3-time-format 2.1.0 MIT
@types/geojson 7946.0.16 MIT
@types/react 19.2.17 MIT
@types/react-dom 19.2.3 MIT
@visx/axis 4.0.0 MIT
@visx/bounds 4.0.0 MIT
@visx/curve 4.0.0 MIT
@visx/grid 4.0.0 MIT
@visx/group 4.0.0 MIT
@visx/point 4.0.0 MIT
@visx/scale 4.0.0 MIT
@visx/shape 4.0.0 MIT
@visx/text 4.0.0 MIT
@visx/tooltip 4.0.0 MIT
@visx/vendor 4.0.0 MIT and ISC
aria-hidden 1.2.6 MIT
balanced-match 0.4.2 MIT
classnames 2.5.1 MIT
client-only 0.0.1 MIT
clsx 2.1.1 MIT
cookie-es 3.1.1 MIT
css-mediaquery 0.1.2 BSD
csstype 3.2.3 MIT
d3-array 3.2.1 ISC
d3-color 3.1.0 ISC
d3-delaunay 6.0.2 ISC
d3-format 3.1.0 ISC
d3-geo 3.1.0 ISC
d3-interpolate 3.0.1 ISC
d3-path 3.1.0 ISC
d3-scale 4.0.2 ISC
d3-shape 3.2.0 ISC
d3-time 3.1.0 ISC
d3-time-format 4.1.0 ISC
delaunator 5.1.0 ISC
internmap 2.0.3 ISC
invariant 2.2.4 MIT
isbot 5.2.1 Unlicense
js-tokens 4.0.0 MIT
loose-envify 1.4.0 MIT
math-expression-evaluator 1.4.0 MIT
react 19.2.8 MIT
react-aria 3.51.0 Apache-2.0
react-aria-components 1.20.0 Apache-2.0
react-dom 19.2.8 MIT
react-stately 3.49.0 Apache-2.0
react-use-measure 2.1.7 MIT
reduce-css-calc 1.3.0 MIT
reduce-function-call 1.0.3 MIT
balanced-match 1.0.2 MIT
robust-predicates 3.0.3 Unlicense
scheduler 0.27.0 MIT
seroval 1.5.6 MIT
seroval-plugins 1.5.6 MIT
styleq 0.2.1 MIT
tslib 2.8.1 0BSD
use-sync-external-store 1.6.0 MIT

[npm build-time generators whose output ships]
rolldown 1.1.5 MIT
vite 8.1.5 MIT

[container base image]
alpine:3.22@sha256:14358309a308569c32bdc37e2e0e9694be33a9d99e68afb0f5ff33cc1f695dce

[npm packages bundled into admin/dist]
@internationalized/string
@stylexjs/stylex
@tanstack/history
@tanstack/query-core
@tanstack/react-query
@tanstack/react-router
@tanstack/react-store
@tanstack/router-core
@tanstack/store
@visx/axis
@visx/bounds
@visx/grid
@visx/group
@visx/point
@visx/scale
@visx/shape
@visx/text
@visx/tooltip
balanced-match
classnames
clsx
d3-array
d3-color
d3-format
d3-interpolate
d3-path
d3-scale
d3-shape
d3-time
internmap
math-expression-evaluator
react
react-aria
react-aria-components
react-dom
react-stately
reduce-css-calc
reduce-function-call
scheduler
use-sync-external-store