Dependencies and build reproducibility
Use pnpm for the shared TypeScript/Vite and Capacitor app, Gradle wrapper plus Android SDK for Android, Composer for independently versioned PHP libraries, and Xcode on macOS for iOS. Do not install Node, Gradle or Composer globally on Virtualmin as an HSLG release action.
Pin first-party and transitive dependencies in reviewed lockfiles. An uploaded .tgz, .jar or .pom provides only one artifact, not a complete install. Keep provenance/checksums in docs/history/dependency-downloads.csv; do not store unaudited vendor/node_modules inside published WordPress directories.
The native source still lacks a verified full pnpm/Gradle dependency resolution and Android sync. The dependency setup is a prerequisite, not a completed APK proof. Track actual missing packages through the native preflight output.
Dependency layers
HSLG involves PHP/WordPress dependencies, JavaScript/TypeScript packages and Android/iOS native toolchains. These are separate dependency graphs. WordPress plugins are distributable PHP packages; the shared UI and mobile native web code use Node, pnpm, TypeScript and Vite; Capacitor supplies native bridge plugins; Android Gradle resolves Java/Kotlin/AndroidX artifacts from repositories. Installing one layer does not satisfy the next. iOS additionally requires Xcode and platform signing resources on macOS.
What is already recorded
The historical toolchain checkpoint includes Node 22.x, pnpm 10.15.0, Java 21, Gradle 8.14.3 and Android SDK platform/build tools 36. Direct Capacitor and related npm tarballs were uploaded to the AI file library. Those uploads are recorded with version and source, but the complete npm transitive closure and Android Maven dependencies were not established. A top-level npm .tgz does not contain every dependency. An Android Gradle Plugin .jar is not equivalent to its full resolved classpath or a generated Capacitor Android project.
Repeatable installation strategy
Pin exact package versions and resolve an auditable lockfile. Install source dependencies in a private workspace, not a public WordPress directory. Prefer project-local tools over global modifications to the Virtualmin host. Validate checksums and origin; preserve only approved commercial-use dependencies. Build the native web entry, synchronize Capacitor, resolve Gradle dependencies and compile/sign the Android output. Record the versions and source fingerprint used by the build; do not simply record the tool versions currently present on the host after the fact.
Failure handling and cost
If the AI workspace cannot access repositories, the private Ubuntu build environment may resolve dependency caches and export a reviewed bundle for repeatable offline use. Avoid requesting individual JAR downloads indefinitely when a transitive dependency graph is needed. Do not suppress dependency warnings or invent a 'working APK' from UI assets. A small pinned cache and a working install script reduce future effort, but must remain patchable when upstream security issues require version changes.
Commercial and operational review
Every new dependency needs its actual licence, redistribution implications, notice obligations, source origin and security review recorded. Native SDKs may have usage terms beyond the package's SPDX label. App-store rules, payment-provider terms and image/font rights are separate review items. Do not ship a commercial APK merely because its Gradle build completed.