# Source identity

- Project: Regex Tools
- Release version: `0.4.0`
- Release tag: `v0.4.0`
- Repository: <https://git.add-ideas.de/zemion/regex-tools>
- Previous release tag: `v0.3.0`
- Licence: GPL-3.0-or-later
- Copyright: © 2026 Albrecht Degering

The release ZIP is generated from the tagged repository with:

```sh
npm ci
npm run release:artifact
```

The build uses only pinned npm packages from `package-lock.json`. It performs no
runtime or build-time CDN fetch. Complete preferred-form source is the tagged
repository. The release archive contains compiled static assets plus legal,
source-identity and attribution documents.

The engine-pack inputs and rebuild gates are documented in
`docs/ENGINE_BUILDS.md`.

- PCRE2 source is not vendored: the gate accepts only the pinned, clean
  official 10.47 checkout and Emscripten 6.0.4 compiler.
- The Python pack is copied from the exact pinned Pyodide 314.0.3 npm package
  and contains its CPython 3.14.2 runtime, Python standard library, loader,
  WebAssembly module, metadata, checksums and licence material.
  `SOURCE-MANIFEST.json` closes the base-runtime inventory with exact archive
  hashes or Git commit/tree identities for Pyodide, pyodide-build, the
  vendored Error Stack Parser and StackFrame ports, CPython, libffi, Hiwire,
  liblzma, Zstandard, SQLite, bzip2, zlib, Emscripten and HACL*. It also pins
  every Pyodide CPython/Emscripten patch and build recipe, documents the one
  Regex Tools loader transformation, and maps each linked component to
  independently anchored legal text.
- The Java bridge source is under `engines/java/`. Its bundled module is
  compiled against TeaVM 0.15.0's `java.util.regex` class library and is
  identified as TeaVM rather than OpenJDK.
- The PHP bridge source is under `engines/php/`. The runtime pack comes from
  the pinned `@php-wasm/web-8-5` and support packages at 3.1.46, executes PHP
  8.5.8, and reports its embedded PCRE2 as 10.44. This identity is separate
  from the standalone PCRE2 10.47 pack. Its `native-components.json` binds the
  exact WebAssembly to the WordPress Playground/PHP/Emscripten commits,
  inventories all 32 linked native/source surfaces, records exact archive or
  Git routes and explicitly bounds the upstream recipe's one unpinned
  Oniguruma clone. Every linked component maps to independently pinned legal
  text; runtime and binary audits distinguish GMP, libsodium, tidy, ICU/intl,
  FreeType, ImageMagick and the adjacent AOM 3.13.1 recipe from what is
  actually linked.
- The Perl bridge source is under `engines/perl/`. The byte-for-byte WebPerl
  0.09-beta prebuilt archive contains Perl 5.28.1 and Emscripten 1.38.28
  output. It is shipped only as a visibly legacy beta target; user values cross
  a fixed data-only bridge.
- The Ruby pack comes from the pinned minimal `@ruby/4.0-wasm-wasi` and
  `@ruby/wasm-wasi` packages at 2.9.3-2.9.4 and executes CRuby 4.0.0. The
  application bridge under `engines/ruby/` uses bounded length-prefixed
  worker-local WASI file input and inert JSON output instead of ruby.wasm's
  JavaScript-eval object-conversion path.
- The C++ bridge source is under `engines/cpp/`. Emscripten 6.0.4 compiles it
  against libc++ `std::wregex` with dynamic JavaScript execution disabled. Its
  `SOURCE-MANIFEST.json` pins the Emscripten, emsdk and LLVM identities and
  maps the exact traced musl, emmalloc, compiler-rt, libc++ and libc++abi link
  inputs to preferred-source paths and legal files. libunwind is retained as
  an explicit audited exclusion because the selected JavaScript-exception
  build links no `libunwind.a` member.
- The Go bridge source is under `engines/go/`. The official Go 1.26.5
  linux/amd64 distribution cross-compiles standard-library `regexp` for
  `js/wasm`.
- The Rust bridge source and exact Cargo lock are under `engines/rust/`.
  rustc 1.97.1 and wasm-bindgen 0.2.126 compile `regex` crate 1.13.1 for
  `wasm32-unknown-unknown`.
- The .NET bridge source is under `engines/dotnet/`. .NET SDK 10.0.302 with
  runtime 10.0.10 and its `wasm-tools` workload publishes the
  `System.Text.RegularExpressions` browser-WASM pack.
- Scala compatibility has no additional engine pack. It deliberately uses the
  verified TeaVM Java pack and labels that shared runtime in every result.

Generated staging is ignored. Only verified runtime packs with deterministic
metadata, closed file sets, checksums and exact licence/notice material are
installed under `public/engines/` and included in the application source and
build.

The v0.4.0 release includes native browser ECMAScript, standalone PCRE2 10.47,
PHP 8.5.8 `preg` with PCRE2 10.44, legacy Perl 5.28.1 via WebPerl 0.09-beta,
CPython 3.14.2 `re`, CRuby 4.0.0 `Regexp`, TeaVM 0.15.0 `java.util.regex`,
Emscripten 6.0.4 libc++ `std::wregex`, Go 1.26.5 `regexp`, Rust `regex` 1.13.1,
.NET 10.0.10 `System.Text.RegularExpressions`, and the explicitly shared
TeaVM-backed Scala/JVM compatibility profile.

Earlier releases remain available under their historical tags and artifact
coordinates. A future public artifact must bump package, manifest, tag and
source identity together; it must not reuse `v0.4.0`.
