Hinge Bootstrap: The Package Manager is Written in Janus

The Package Manager is Written in Janus

v2026.3.20 — Hinge can now init, add, resolve, lock, and build – written in Janus. Here’s what that means.

Every language makes promises. Janus ships proof. As of today, the core lifecycle of Hinge – Janus’s package manager – runs as pure Janus code, compiled by the Janus compiler, tested through janus build. Not a demo. Not a spec. Working software that parses real manifests, reads real lockfiles, resolves real dependency graphs, and detects real cycles.

This is the bootstrap moment. When your package manager is written in the language it manages, developers don’t need to take your word for it – the tool they use every day is the proof that the language works. SemVer constraint matching, KDL manifest parsing, RFC 8785 JSON lockfile reading, BFS dependency resolution with topological sort – these aren’t toy problems. They’re string processing, file I/O, graph algorithms, and structured data access. The kind of work that exposes every gap in a young language. Janus has 114 tests across five modules that say: no gaps found.

What makes this different from bolting a package manager onto a compiler is the architecture. Janus code calls into Zig’s standard library through use zig – zero-cost, no FFI boundary, no serialization overhead. The SIMD JSON parser that reads your lockfile is the same native Zig code that powers the compiler’s own configuration. The HashMap that resolves your dependency graph is Zig’s production StringHashMap behind a thin 161-line bridge. Janus doesn’t reinvent what Zig already perfected; it composes sovereign application logic on top of systems-grade infrastructure. That’s the whole thesis of the language, and now it’s not a thesis anymore – it’s a shipping product.

What Shipped

Module	LOC	Tests	What It Does
SemVer	723	45	Full SemVer 2.0.0: parse, compare, caret/tilde/range constraints, best-match
Manifest	398	17	Reads `janus.kdl` project files – name, version, profile, license, deps
Lockfile	312	19	Parses `janus.lock` (RFC 8785 JSON) via native SIMD JSON bridge
HashMap	180	14	O(1) key-value store bridging Zig’s `StringHashMap` for Janus programs
Resolver	540	13	DFS cycle detection + Kahn’s topological sort for install ordering
Total	2,153	114

Try It

# Clone and build
git clone https://git.sovereign-society.org/janus/janus-lang
cd janus-lang
zig build install-janus

# Run the semver test suite
./zig-out/bin/janus build std/hinge/semver_test.jan
./semver_test
# → 45 passed, 0 failed — ALL SEMVER TESTS PASSED

# Run the full resolver
./zig-out/bin/janus build std/hinge/resolver_test.jan
./resolver_test
# → 13 passed, 0 failed — ALL RESOLVER TESTS PASSED

What’s Next

The Tier A lifecycle is complete. Next: wire these modules into the janus CLI so that janus init myproject && janus add blake3 "^1.0.0" && janus resolve runs end-to-end in a single binary. Cryptographic signing, transparency logs, and the registry protocol stay as use zig bridges – those are legitimate systems boundaries, not gaps. The application logic is Janus. The infrastructure is Zig. That’s the design.

v2026.3.20 — tagged on stable, merged across all branches.