mokhtar
ad26aca198
the hand-written scale, tick, stacking and arc math is replaced by visx 4.0.0 primitives; rendering, colours and themes stay the app's own. all four charts share one hover treatment: the client chart gains the tooltip and dimming the query timeline had, the donuts gain both, an open tooltip follows a data refresh instead of going stale, and it retires when the window rolls. the timeline's third series is named allowed instead of other, and the client chart's other aggregate disappears from a window where it counted nothing. licenses gain the isc text for the bundled d3 modules.
171 lines
5.2 KiB
Plaintext
171 lines
5.2 KiB
Plaintext
The identity of the dependency sets that decide what licenses/inventory.zon has
|
|
to cover. This file is a snapshot, not a source: src/licenses_drift_test.zig
|
|
recomputes each section from build.zig.zon and admin/package-lock.json and fails
|
|
when it disagrees with what is recorded here. Prose before the first section
|
|
header is ignored by the guard.
|
|
|
|
Updating a section without reviewing licenses/inventory.zon defeats the point of
|
|
the guard. When a section changes, work out what the change means for the
|
|
shipped bytes first, then record it.
|
|
|
|
The runtime closure is every lockfile package not marked `dev`. That is a
|
|
superset of what the bundler emits — the guard cannot run rollup — so packages
|
|
tree-shaken out of admin/dist appear here too; the inventory explains each of them
|
|
instead of carrying its licence.
|
|
|
|
The bundled-packages section is the one the Zig guard cannot compute: it is the
|
|
set of npm packages that actually contribute a module to admin/dist, read off the
|
|
sourcemap `sources` lists of a `vite build --sourcemap`. Only the frontend gate
|
|
can produce it, so gates.yml recomputes it there and fails on a difference. It
|
|
is what closes the hole the runtime-closure section leaves open — a package
|
|
already in the closure that application code starts importing changes no
|
|
lockfile and no version, but it does change this list.
|
|
|
|
The base image section is here for the same reason: the container image is a
|
|
released artifact, and the one third-party file it carries that the binary does
|
|
not — the Mozilla CA bundle — comes out of that base. A new tag or a rebuilt
|
|
digest both change the line, which forces somebody to re-read what the new base
|
|
ships before the inventory can claim it.
|
|
|
|
The generators section is the other direction: packages the lockfile marks `dev`
|
|
whose own output nevertheless ends up in admin/dist, and so in the binary. Its
|
|
membership is a judgement, not a query — it was settled by reading a
|
|
`vite build --sourcemap` of admin/, both the sourcemap `sources` lists and the
|
|
regions of each chunk no sourcemap segment maps back to a source file. The
|
|
versions here are read from the lockfile like any other section.
|
|
|
|
[build.zig.zon dependencies]
|
|
mbedtls url=https://github.com/Mbed-TLS/mbedtls/archive/refs/tags/mbedtls-3.6.7.tar.gz hash=N-V-__8AALrvlQKVtYlvv9dpBnbrJfdwR_F0wAgwsvZhAF1Y
|
|
sqlite url=https://sqlite.org/2026/sqlite-amalgamation-3530400.zip hash=N-V-__8AAGVtrgCcOcmjrOJnagmnRyMrcKaOo09KbU-vu8w8
|
|
|
|
[npm runtime closure]
|
|
@internationalized/date 3.12.3 Apache-2.0
|
|
@internationalized/number 3.6.7 Apache-2.0
|
|
@internationalized/string 3.2.10 Apache-2.0
|
|
@react-types/shared 3.36.1 Apache-2.0
|
|
@stylexjs/stylex 0.19.0 MIT
|
|
@swc/helpers 0.5.23 Apache-2.0
|
|
@tanstack/history 1.162.0 MIT
|
|
@tanstack/query-core 5.101.4 MIT
|
|
@tanstack/react-query 5.101.4 MIT
|
|
@tanstack/react-router 1.170.18 MIT
|
|
@tanstack/react-store 0.9.3 MIT
|
|
@tanstack/router-core 1.171.15 MIT
|
|
@tanstack/store 0.9.3 MIT
|
|
@types/d3-array 3.0.3 MIT
|
|
@types/d3-color 3.1.0 MIT
|
|
@types/d3-delaunay 6.0.1 MIT
|
|
@types/d3-format 3.0.1 MIT
|
|
@types/d3-geo 3.1.0 MIT
|
|
@types/d3-interpolate 3.0.1 MIT
|
|
@types/d3-path 3.1.1 MIT
|
|
@types/d3-scale 4.0.2 MIT
|
|
@types/d3-shape 3.1.7 MIT
|
|
@types/d3-time 3.0.0 MIT
|
|
@types/d3-time-format 2.1.0 MIT
|
|
@types/geojson 7946.0.16 MIT
|
|
@types/react 19.2.17 MIT
|
|
@types/react-dom 19.2.3 MIT
|
|
@visx/axis 4.0.0 MIT
|
|
@visx/bounds 4.0.0 MIT
|
|
@visx/curve 4.0.0 MIT
|
|
@visx/grid 4.0.0 MIT
|
|
@visx/group 4.0.0 MIT
|
|
@visx/point 4.0.0 MIT
|
|
@visx/scale 4.0.0 MIT
|
|
@visx/shape 4.0.0 MIT
|
|
@visx/text 4.0.0 MIT
|
|
@visx/tooltip 4.0.0 MIT
|
|
@visx/vendor 4.0.0 MIT and ISC
|
|
aria-hidden 1.2.6 MIT
|
|
balanced-match 0.4.2 MIT
|
|
classnames 2.5.1 MIT
|
|
client-only 0.0.1 MIT
|
|
clsx 2.1.1 MIT
|
|
cookie-es 3.1.1 MIT
|
|
css-mediaquery 0.1.2 BSD
|
|
csstype 3.2.3 MIT
|
|
d3-array 3.2.1 ISC
|
|
d3-color 3.1.0 ISC
|
|
d3-delaunay 6.0.2 ISC
|
|
d3-format 3.1.0 ISC
|
|
d3-geo 3.1.0 ISC
|
|
d3-interpolate 3.0.1 ISC
|
|
d3-path 3.1.0 ISC
|
|
d3-scale 4.0.2 ISC
|
|
d3-shape 3.2.0 ISC
|
|
d3-time 3.1.0 ISC
|
|
d3-time-format 4.1.0 ISC
|
|
delaunator 5.1.0 ISC
|
|
internmap 2.0.3 ISC
|
|
invariant 2.2.4 MIT
|
|
isbot 5.2.1 Unlicense
|
|
js-tokens 4.0.0 MIT
|
|
loose-envify 1.4.0 MIT
|
|
math-expression-evaluator 1.4.0 MIT
|
|
react 19.2.8 MIT
|
|
react-aria 3.51.0 Apache-2.0
|
|
react-aria-components 1.20.0 Apache-2.0
|
|
react-dom 19.2.8 MIT
|
|
react-stately 3.49.0 Apache-2.0
|
|
react-use-measure 2.1.7 MIT
|
|
reduce-css-calc 1.3.0 MIT
|
|
reduce-function-call 1.0.3 MIT
|
|
balanced-match 1.0.2 MIT
|
|
robust-predicates 3.0.3 Unlicense
|
|
scheduler 0.27.0 MIT
|
|
seroval 1.5.6 MIT
|
|
seroval-plugins 1.5.6 MIT
|
|
styleq 0.2.1 MIT
|
|
tslib 2.8.1 0BSD
|
|
use-sync-external-store 1.6.0 MIT
|
|
|
|
[npm build-time generators whose output ships]
|
|
rolldown 1.1.5 MIT
|
|
vite 8.1.5 MIT
|
|
|
|
[container base image]
|
|
alpine:3.22@sha256:14358309a308569c32bdc37e2e0e9694be33a9d99e68afb0f5ff33cc1f695dce
|
|
|
|
[npm packages bundled into admin/dist]
|
|
@internationalized/string
|
|
@stylexjs/stylex
|
|
@tanstack/history
|
|
@tanstack/query-core
|
|
@tanstack/react-query
|
|
@tanstack/react-router
|
|
@tanstack/react-store
|
|
@tanstack/router-core
|
|
@tanstack/store
|
|
@visx/axis
|
|
@visx/bounds
|
|
@visx/grid
|
|
@visx/group
|
|
@visx/point
|
|
@visx/scale
|
|
@visx/shape
|
|
@visx/text
|
|
@visx/tooltip
|
|
balanced-match
|
|
classnames
|
|
clsx
|
|
d3-array
|
|
d3-color
|
|
d3-format
|
|
d3-interpolate
|
|
d3-path
|
|
d3-scale
|
|
d3-shape
|
|
d3-time
|
|
internmap
|
|
math-expression-evaluator
|
|
react
|
|
react-aria
|
|
react-aria-components
|
|
react-dom
|
|
react-stately
|
|
reduce-css-calc
|
|
reduce-function-call
|
|
scheduler
|
|
use-sync-external-store
|