# Source identity - Project: Regex Tools - Release version: `0.4.2` - Release tag: `v0.4.2` - Repository: - Previous release tag: `v0.4.1` - Licence: GPL-3.0-or-later - Copyright: © 2026 Albrecht Degering The release ZIP is generated from the tagged repository with: ```sh npm ci npm run release:artifact ``` The build uses only pinned npm packages from `package-lock.json`. It performs no runtime or build-time CDN fetch. Complete preferred-form source is the tagged repository. The release archive contains compiled static assets plus legal, source-identity and attribution documents. The engine-pack inputs and rebuild gates are documented in `docs/ENGINE_BUILDS.md`. - PCRE2 source is not vendored: the gate accepts only the pinned, clean official 10.47 checkout and Emscripten 6.0.4 compiler. - The Python pack is copied from the exact pinned Pyodide 314.0.3 npm package and contains its CPython 3.14.2 runtime, Python standard library, loader, WebAssembly module, metadata, checksums and licence material. `SOURCE-MANIFEST.json` closes the base-runtime inventory with exact archive hashes or Git commit/tree identities for Pyodide, pyodide-build, the vendored Error Stack Parser and StackFrame ports, CPython, libffi, Hiwire, liblzma, Zstandard, SQLite, bzip2, zlib, Emscripten and HACL*. It also pins every Pyodide CPython/Emscripten patch and build recipe, documents the one Regex Tools loader transformation, and maps each linked component to independently anchored legal text. - The Java bridge source is under `engines/java/`. Its bundled module is compiled against TeaVM 0.15.0's `java.util.regex` class library and is identified as TeaVM rather than OpenJDK. - The PHP bridge source is under `engines/php/`. The runtime pack comes from the pinned `@php-wasm/web-8-5` and support packages at 3.1.46, executes PHP 8.5.8, and reports its embedded PCRE2 as 10.44. This identity is separate from the standalone PCRE2 10.47 pack. Its `native-components.json` binds the exact WebAssembly to the WordPress Playground/PHP/Emscripten commits, inventories all 32 linked native/source surfaces, records exact archive or Git routes and explicitly bounds the upstream recipe's one unpinned Oniguruma clone. Every linked component maps to independently pinned legal text; runtime and binary audits distinguish GMP, libsodium, tidy, ICU/intl, FreeType, ImageMagick and the adjacent AOM 3.13.1 recipe from what is actually linked. - The Perl bridge source is under `engines/perl/`. The byte-for-byte WebPerl 0.09-beta prebuilt archive contains Perl 5.28.1 and Emscripten 1.38.28 output. It is shipped only as a visibly legacy beta target; user values cross a fixed data-only bridge. - The Ruby pack comes from the pinned minimal `@ruby/4.0-wasm-wasi` and `@ruby/wasm-wasi` packages at 2.9.3-2.9.4 and executes CRuby 4.0.0. The application bridge under `engines/ruby/` uses bounded length-prefixed worker-local WASI file input and inert JSON output instead of ruby.wasm's JavaScript-eval object-conversion path. - The C++ bridge source is under `engines/cpp/`. Emscripten 6.0.4 compiles it against libc++ `std::wregex` with dynamic JavaScript execution disabled. Its `SOURCE-MANIFEST.json` pins the Emscripten, emsdk and LLVM identities and maps the exact traced musl, emmalloc, compiler-rt, libc++ and libc++abi link inputs to preferred-source paths and legal files. libunwind is retained as an explicit audited exclusion because the selected JavaScript-exception build links no `libunwind.a` member. - The Go bridge source is under `engines/go/`. The official Go 1.26.5 linux/amd64 distribution cross-compiles standard-library `regexp` for `js/wasm`. - The Rust bridge source and exact Cargo lock are under `engines/rust/`. rustc 1.97.1 and wasm-bindgen 0.2.126 compile `regex` crate 1.13.1 for `wasm32-unknown-unknown`. - The .NET bridge source is under `engines/dotnet/`. .NET SDK 10.0.302 with runtime 10.0.10 and its `wasm-tools` workload publishes the `System.Text.RegularExpressions` browser-WASM pack. - Scala compatibility has no additional engine pack. It deliberately uses the verified TeaVM Java pack and labels that shared runtime in every result. Generated staging is ignored. Only verified runtime packs with deterministic metadata, closed file sets, checksums and exact licence/notice material are installed under `public/engines/` and included in the application source and build. The v0.4.2 release includes native browser ECMAScript, standalone PCRE2 10.47, PHP 8.5.8 `preg` with PCRE2 10.44, legacy Perl 5.28.1 via WebPerl 0.09-beta, CPython 3.14.2 `re`, CRuby 4.0.0 `Regexp`, TeaVM 0.15.0 `java.util.regex`, Emscripten 6.0.4 libc++ `std::wregex`, Go 1.26.5 `regexp`, Rust `regex` 1.13.1, .NET 10.0.10 `System.Text.RegularExpressions`, and the explicitly shared TeaVM-backed Scala/JVM compatibility profile. Earlier releases remain available under their historical tags and artifact coordinates. A future public artifact must bump package, manifest, tag and source identity together; it must not reuse `v0.4.2`.