https://github.com/zaxified/zig-libs

Foundational Zig 0.16 modules — RFC-complete, 100% pure-Zig (no C/libc/external deps). HTTP/1.1+2, DNS, SNMP v1/v2c/v3, MQTT, CoAP, JWT/OIDC, ACME, WireGuard, crypto, and more.
https://github.com/zaxified/zig-libs

acme coap dns http2 jwt mqtt networking protocols pure-zig rfc snmp wireguard zero-dependency zig zig-lang zig-library zig-package ziglang

Last synced: 3 days ago
JSON representation

Foundational Zig 0.16 modules — RFC-complete, 100% pure-Zig (no C/libc/external deps). HTTP/1.1+2, DNS, SNMP v1/v2c/v3, MQTT, CoAP, JWT/OIDC, ACME, WireGuard, crypto, and more.

• Host: GitHub
• URL: https://github.com/zaxified/zig-libs
• Owner: zaxified
• License: mit
• Created: 2026-07-10T05:07:23.000Z (15 days ago)
• Default Branch: main
• Last Pushed: 2026-07-10T06:25:38.000Z (15 days ago)
• Last Synced: 2026-07-10T08:06:40.122Z (15 days ago)
• Topics: acme, coap, dns, http2, jwt, mqtt, networking, protocols, pure-zig, rfc, snmp, wireguard, zero-dependency, zig, zig-lang, zig-library, zig-package, ziglang
• Language: Zig
• Size: 2.14 MB
• Stars: 0
• Watchers: 0
• Forks: 0
• Open Issues: 0
• Metadata Files:
  • Readme: README.md
  • License: LICENSE
  • Security: SECURITY.md
  • Notice: NOTICE

Awesome Lists containing this project

README

          
# zig-libs

[![CI](https://github.com/zaxified/zig-libs/actions/workflows/ci.yml/badge.svg)](https://github.com/zaxified/zig-libs/actions/workflows/ci.yml)

A curated collection of **foundational Zig modules** — performance-minded, universal where

possible, each modeled after a proven implementation in another language rather than invented from

scratch.

Not a dumping ground: ship **solid, not many**. Every member is a foundational,

cross-project-reusable capability — a production-grade implementation of a protocol/format/algorithm,

or a fill for a genuine gap in the Zig ecosystem. zig-libs is the canonical home for these; the

authors' other projects depend on it, not the reverse.

**Status:** 77 modules · 1844 tests (Zig 0.16, green in Debug + ReleaseFast) · **MIT** (see `LICENSE`;

third-party-derived wire formats & required attributions in `NOTICE`).

## Using a module

- **Local path (dev, no tags/push):** in the consumer's `build.zig.zon`,

  `.zig_libs = .{ .path = "../zig-libs" }`, then in `build.zig`

  `exe.root_module.addImport("http", b.dependency("zig_libs", .{}).module("http"));`

- **Fetch:** `zig fetch --save git+https://github.com/.../zig-libs` then the same `dependency().module(...)`.

  (`zig fetch` can't target a subdirectory — ziglang/zig#23012 — so the whole repo is one package;

  you still import only the module you name. Unused modules aren't compiled.)

## Build

```

zig build test           # run all module tests

zig build test-    # run one module's tests

```

## Layout & conventions

```

build.zig      # single root build — registers every module by name + a test step each

build.zig.zon  # one package manifest for the whole collection

CONVENTIONS.md # naming + `meta` tag vocabulary + provenance/SPDX rules

modules//src/root.zig  # `// SPDX-License-Identifier: MIT`, `pub const meta`, API, tests

modules//README.md     # what it is + a Provenance line

```

`CONVENTIONS.md` has the full rules; `modules/_template/` is the starting point for a new module.

Roadmap notes live in the "Roadmap / not yet built" section above and the git history.

## Licensing

zig-libs' own code is MIT throughout. Four modules — `icmp`, `seqmap`, `netaddr`, `dns` — descend

from fping (https://github.com/schweikert/fping), which carries a non-standard Stanford

"BSD-with-advertising" license, not a plain permissive one. That license affirmatively requires

that documentation and advertising materials for redistributions acknowledge the software was

developed by Stanford University. Redistributors of those four modules (or of zig-libs as a whole)

must preserve that fping attribution, reproduced in full in `NOTICE` §1.

## Modules

Every module is imported by its `name` (`@import("http")`); hyphenated names work too

(`@import("security-headers")`). `Deps` are sibling modules; everything else is `std`-only.

### Web / HTTP & API — an internet-facing service, no reverse proxy required

| Module | What it does | Platform | Deps |

|---|---|---|---|

| `http` | HTTP/1.1 client (TLS via `std.crypto.tls`) **and** server, hardened for direct exposure (peer addr, conn caps, size limits, slowloris timeouts, gzip, **conditional requests** ETag/If-\* → 304/412, **request-body parsing** — `Content-Type`, urlencoded, **multipart/form-data** RFC 7578, **Server-Sent Events** encoder + incremental `flush()`, **inbound gzip** request bodies (zip-bomb-capped), **multiple Set-Cookie**, chunked-trailer capture, **`Range` / 206 Partial Content** RFC 7233 — `bytes=` parser + resolve-against-length → `Content-Range` + 206/416 response staging + `multipart/byteranges` body for multi-range requests, **content negotiation** — `Accept` / `Accept-Language` (RFC 4647) / `Accept-Encoding` parsers + `negotiate` server-offers→best-match / 406, RFC 9110 §12.5). Also speaks **HTTP/2** (bidirectional, TLS-deployable) — HPACK (RFC 7541) + framing/flow-control (RFC 9113) + a **DoS-hardened h2c server** + a **multiplexing h2 client** + an **ALPN/bring-your-own-TLS seam**. Not `std.http`. | any | netaddr |

| `router` | REST routing — trie matcher (params/wildcards), middleware chain, groups, 404/405 | any | http |

| `ratelimit` | Token-bucket per-client rate limit → 429 + Retry-After | any | router, http, netaddr |

| `abuseguard` | Per-IP + global connection caps, ban/greylist, strike→ban (accept-time) | posix | http, netaddr, router |

| `throttle` | Global concurrency limit + load-shedding → 503 | posix | router, http |

| `security-headers` | Secure-by-default response headers (HSTS/CSP/nosniff/frame/referrer/COOP/CORP) | any | router, http |

| `cors` | CORS preflight + header injection (secure defaults) | any | router, http |

| `validate` | Request body/query/params validation → aggregated 400 (typed + schema + string `format`: email/uri/uuid/ip/hostname/date-time/…) + **JSON DoS caps** (depth/array/field) | any | router, http, netaddr |

| `metrics` | Prometheus registry (counter/gauge/histogram) + `/metrics` + request middleware + **access-log writer** (combined/JSON) | posix | router, http |

| `health` | Liveness (`/healthz`) + readiness (`/readyz`) probe middleware — 200/503 from registered dependency checks (k8s probe contract) | any | router, http |

| `requestid` | Request/correlation-ID middleware — adopt incoming `X-Request-Id` or generate, echo on the response, expose via `current()` (composes with auth) | any | router, http |

| `tracecontext` | **W3C Trace Context** — `traceparent`/`tracestate` parse + generate + a propagation middleware (child span per hop, `current()`) for distributed tracing | any | router, http |

| `webhooksig` | **HMAC webhook signatures** (GitHub/Stripe style) — `sign`/`verify` (constant-time) + a middleware gating requests by `HMAC-SHA256(secret, body)`, key rotation | any | router, http |

| `idempotency` | **Idempotency-Key** dedup of unsafe retries — a middleware + ramcache-backed `Store` replaying a key's cached response without re-running the handler | any | router, http, ramcache |

| `resilience` | Circuit breaker + retry/backoff + timeout + **bulkhead** (concurrency limiter) for calling upstreams (generic) | posix | — |

| `upstream` | Load-balanced upstream pool + failover — round-robin/weighted/least-conn/EWMA strategies, per-upstream breaker+bulkhead, active+passive health | any | resilience, probe |

| `openapi` | OpenAPI 3.1 spec generated from the route table + `/openapi.json` | any | router, http |

| `aaa-gate` | Bearer + **API-key** auth (constant-time) + audit hook + denied-request throttle | any | router, http |

| `jwt` | JWT/JWS + **OIDC resource-server** validator (RFC 7515/7519/7517/8725) — parse + claims + verify (HS/ES/EdDSA/RSA, alg-confusion-safe) + JWKS-by-`kid` + **OIDC discovery/fetch** (cache + key-rotation) + a **`router` Bearer middleware** (RFC 6750 challenge, scope check, identity on ctx) | any | http, router |

| `acme` | Let's Encrypt / ACME v2 (RFC 8555): HTTP-01 issuance + renewal, ES256 JWS, CSR | any | http, router |

| `sessions` | Server-side web sessions + OWASP-hardened cookies + signed double-submit **CSRF** middleware | any | router, http, cookies, ramcache |

| `llmclient` | Anthropic Messages API client (buffered + streaming SSE) over `http` — no third-party SDK | any | http |

### Networking

| Module | What it does | Platform | Deps |

|---|---|---|---|

| `netaddr` | IP parse/format (RFC 5952) + RFC 6724 source/dest selection + **CIDR/Prefix** ops (contains/overlaps/supernet, range↔prefix summarize) | any | — |

| `dns` | RFC 1035 resolver — A/AAAA/PTR/CNAME/NS/MX/TXT/SOA/SRV/CAA over UDP/TCP + DoH | any | netaddr, http |

| `netlink` | rtnetlink dumps: links / addresses / routes / neighbors | **linux** | — |

| `wireguard` | Native WireGuard device config over genetlink — get/set device, peers, allowed-ips (retires `wg` shell-outs) | **linux** | netlink |

| `nftables` | Typed firewall-ruleset builder → libnftables JSON for `nft -j -f -` (families/chains/rules/sets, match + verdict statements) | any (apply: linux) | — |

| `modbus` | Modbus TCP (MBAP) + RTU (CRC-16) codec + master client — core function codes, exceptions, transport-agnostic seam | any | — |

| `mqtt` | MQTT 3.1.1 client — all 14 control packets, QoS 0/1/2 state machine, topic-filter wildcards, transport-agnostic seam | any | — |

| `coap` | CoAP (RFC 7252) — a full client/server stack: message codec (header/token/**delta-encoded options**/payload), `options` (registry, CoAP uint, **URI ↔ options** §6), `reliability` (CON **retransmission** §4.2 + message-ID **dedup** §4.5), `client` (URI→request + reply correlation), `server` (dispatch + piggyback/separate responses). Zero-alloc, transport-/clock-agnostic (block-wise + observe are follow-ups) | any | — |

| `snmp` | SNMP v1/v2c — BER/ASN.1 codec + OID + all 8 PDUs + manager client (get/next/bulk/set/walk) + a **trap/notification receiver** (v1 Trap / v2c Trap / Inform → one normalized `TrapEvent` + `Dispatcher` + `ackInform` byte-faithful Response ack) + **SNMPv3** (RFC 3412 message framing + ScopedPDU, plaintext/noAuthNoPriv) + **USM** (RFC 3414) — `UsmSecurityParameters` (de)serializer + **auth**: password→key localization + HMAC-MD5-96 / HMAC-SHA-1-96 sign/verify (constant-time, RFC A.3 KAT-checked; privacy crypto in progress), transport-agnostic seam | any | — |

| `whois` | RFC 3912 whois client — query format + referral chasing (IANA→registrar) + field extraction, transport-agnostic seam | any | — |

| `rdap` | RDAP client (RFC 7480–7484) — JSON-over-HTTPS whois successor: query URLs, typed response model, IANA bootstrap, fetch seam | any | http, netaddr |

| `icmp` | ICMP echo (ping) engine — v4/v6 codec, batched socket, pacing | **linux** | seqmap, netaddr |

| `traceroute` | ICMP-echo path discovery — TTL-stepped probes, per-hop address + RTT stats, load-balanced-path aware | **linux** | icmp, netaddr, latency-stats |

| `probe` | TCP-connect reachability prober — up/refused/timeout + RTT, fan-out with bounded concurrency, latency aggregation | any | netaddr, latency-stats |

| `l2disco` | Layer-2 / neighbor discovery codec — LLDP (802.1AB) + CDP + ARP (RFC 826) + DHCP options (RFC 2131/2132) + MAC helper | any | netaddr |

| `seqmap` | Fixed 65 536-slot 16-bit request/reply correlation map, O(1) | any | — |

| `latency-stats` | Online RTT stats — min/max/mean/stddev + RFC 3550 jitter + loss % (O(1)/sample, no alloc) + an **HdrHistogram** for bounded-error percentiles (p50–p99.9) | any | — |

| `procnet` | Linux `/proc`+`/sys` parsers — ARP/routes/TCP+UDP sockets/conntrack/process stats/device health, typed | **linux** | netaddr |

| `rawsock` | Linux **AF_PACKET** raw-frame capture + inject — BPF filter, promiscuous mode, typed frame decode | **linux** | netaddr |

| `stun` | STUN client (RFC 8489) — NAT reflexive-address discovery: XOR-MAPPED-ADDRESS + MESSAGE-INTEGRITY + FINGERPRINT | any | netaddr |

| `sntp` | SNTP client (RFC 4330) — NTP packet codec + UDP query, clock offset / round-trip delay | any | — |

| `syslog` | RFC 5424 syslog formatter + emitter, RFC 3164 legacy encoder, RFC 6587 TCP octet framing | any | — |

### Data & storage

| Module | What it does | Platform | Deps |

|---|---|---|---|

| `kv` | Crash-consistent embedded KV store (Bitcask-style log + **randomized seeded VOPR**: model-checked crash recovery across fuzzed fault schedules) | any | — |

| `ramcache` | Bounded in-memory cache — **W-TinyLFU** admission/eviction (window+SLRU+CMS sketch) + TTL + generation invalidation | any | — |

| `decimal` | Exact i128 fixed-point decimal (money math), float-free — with IEEE/GDA rounding modes, rescale + rounded division | any | — |

| `jobqueue` | Durable background-job queue over `kv` — lease/retry/DLQ, per-partition FIFO under priority, scheduled visibility | posix | kv |

| `blobstore` | Content-addressed blob store (git-object/restic style) + name-addressed + small named-record layers, crash-safe | posix | hashdigest |

| `filestore` | DB-less durable keyed document store — one atomically-written file per record + a typed-JSON convenience layer | posix | — |

| `dataset` | Canonical in-memory columnar-typed table — the normalization seam between data sources and consumers | any | — |

| `tabular` | Dataset algebra (pandas/dplyr-style verbs) over `dataset` — aggregate/pivot/resample/rolling/join, fx-aware | any | dataset |

| `jsonshape` | JSON → `dataset` reshaping — dot-path descent + typed column projection (jq-style minimal subset) | any | dataset |

| `finstats` | Portfolio/financial statistics over `dataset` — XIRR/TWR/risk/beta/Monte-Carlo/correlation matrix | any | dataset |

### Crypto

| Module | What it does | Platform | Deps |

|---|---|---|---|

| `hashdigest` | Streaming digests — one-shot / incremental / file (EOF-read, size-0 `/proc` safe); SHA-256 convenience + a multi-algorithm layer (SHA-2/SHA-3/BLAKE2b/BLAKE3) | any | — |

| `sealedbox` | NaCl `crypto_box_seal` — anonymous-sender X25519 public-key encryption (thin over `std.crypto`) + base64/hex key serialization | any | — |

### Serialization / OS / agent

| Module | What it does | Platform | Deps |

|---|---|---|---|

| `tar` | ustar/GNU tar reader+writer (preserves uid/gid/mtime) + gzip | any (packer: linux) | — |

| `linkheader` | Web Linking (RFC 8288) `Link` header build + parse (rel/title/type), `pagination` (first/prev/next/last), `find(rel)` — zero-alloc | any | — |

| `cookies` | HTTP cookies (RFC 6265) — `Cookie` request parser (`parse`/`find`) **and** `Set-Cookie` builder (`SetCookie` w/ Path/Domain/Max-Age/Expires/**Secure/HttpOnly/SameSite**, injection-guarded, SameSite=None⇒Secure) + `get`/`set` http helpers | any | http |

| `blobmsg` | OpenWRT ubus client + blob/blobmsg wire codec | **linux** (codec itself: any) | — |

| `mcp` | Model Context Protocol server (JSON-RPC 2.0) — tools + resources + prompts, app-state ctx | any | — |

| `mcp-http` | MCP **Streamable HTTP** transport (2025-06-18) — `POST /mcp` → JSON-RPC response (`application/json` **or live SSE** with tool-progress streaming) / 202, as a `router` middleware over a `mcp.Server`. Optional **sessions** (`Mcp-Session-Id` + `GET /mcp` server→client SSE stream with `Last-Event-ID` resumable replay + `DELETE` teardown); built-in **Origin** (DNS-rebinding) guard, size cap, Lock seam | any | router, http, mcp |

| `uci` | OpenWRT UCI config parser + serializer + typed model (stable round-trip) | any | — |

| `argsafe` | Allowlist validators + a typed argv builder — neutralizes argument/flag injection into an exec `argv` | any | — |

| `procrun` | Subprocess runner: reap-race-tolerant wait, deadlock-free capped stdio capture, timeout, streaming + cancel | any | — |

| `pollworker` | Single-owner `poll(2)` loop + a lock-free fork/exec job table for offloading blocking work off the loop thread | **linux** | — |

| `ipcbus` | Same-host unix-socket control plane — request/reply server + a capped in-memory scratch key→bytes bus | **linux** | framing |

| `framing` | Length-prefixed stream framing (`writeFrame`/`readFrame`) + a generic JSON tagged-union envelope codec | any | — |

| `csvstream` | Streaming RFC 4180 CSV reader that preserves byte offsets, bounded memory regardless of file size | any | — |

| `csvsafe` | OWASP CSV formula-injection guard (`=`/`+`/`-`/`@` cell leads) | any | — |

| `json5` | Single-pass JSON5→JSON preprocessor (comments, unquoted keys, trailing commas, single-quoted strings) | any | — |

| `zipstream` | Streaming ZIP archive reader — walk the central directory once, stream decompressed member bytes on demand | any | — |

| `encoding` | Legacy single-byte code page ↔ UTF-8 transcoding (5 European code pages: windows-125x, ISO-8859-1/2/15) | any | — |

| `datefmt` | Civil calendar + token-based date/time parse/format + calendar arithmetic, correct before 1970 | any | — |

| `tz` | IANA time-zone offset lookup — zone name → UTC offset/DST at a given instant (600 zones + POSIX-TZ footer) | any | datefmt |

| `numparse` | Locale-aware grouped-number parsing (thousands/decimal separators) into an exact `decimal.Decimal` | any | decimal |

| `diagnostics` | LSP-style structured validation-finding collector — severity, dot-path, position, code, suggestion | any | — |

## Roadmap / not yet built

Research-verdicted **DON'T-BUILD-YET** — no consumer demands them today; see each

module's `SPEC.md` (once built) or the git history for the full reasoning and the

"when greenlit" path for each:

- **`testkit`** (shared test harness) — deferred; the honest remaining scope (a

  `runWire` HTTP-wire test wrapper + `expectStatus` family + fake-clocks) needs a

  `build.zig` test-only-dep mechanism with no precedent in this repo, plus a 19-module

  refactor to pay off.

- **`Reconcilable(T)`** (generic desired-vs-actual reconciler) — no second consumer

  exists yet; extract a small `RollbackTimer` (arm/confirm/overdue) first, once one

  appears.

- **`kv` on-disk MVCC / transactions / ordered scans** — a multi-week B-tree + WAL build

  with zero current consumers demanding scans or transactions; the existing Bitcask-style

  log is enough until one does.

## Non-goals — deliberately not built here

Durable scope decisions (candidate audit, 2026-07-09): capabilities this collection will

not own, and what to reach for instead.

### Adopt instead of building

| Capability | Adopt instead | Why not a module |

|---|---|---|

| Hardened/read-only SQLite | `vrischmann/zig-sqlite` or `karlseguin/zqlite.zig`, wrapped consumer-side | The enforcement (`authorizer`/`PRAGMA query_only`/`open_v2(READONLY)`) is raw C-API — breaks the pure-Zig/no-libc invariant |

| SSH | bind `libssh2` | Pure-Zig SSH is a huge build; externally-coupled, stays consumer-side |

| Kafka | bind `librdkafka` | External C client, no pure-Zig alternative |

| gRPC | build over our HTTP/2 + adopt `Arwalk/zig-protobuf` | Needs an external protobuf codec; no trustworthy pure-Zig gRPC exists |

| OPC-UA | adopt/bind an existing stack | Huge industrial protocol stack, not a Zig-native win |

| Regex | `mnemnion/mvzr` (no captures) or `zig-utils/zig-regex` (captures) | Two mature pure-Zig libs already exist |

| PostgreSQL (wire v3) | `karlseguin/pg.zig` | Mature MIT lib, pooling + TLS |

| MySQL/MariaDB | `speed2exe/myzql` | Only viable option |

| SMTP | `karlseguin/smtp_client.zig` | Mature MIT lib (TLS-1.2 caveat) |

| WebSocket | `karlseguin/websocket.zig` | Mature MIT lib, both roles |

| protobuf | `Arwalk/zig-protobuf` | De-facto pure-Zig implementation |

| TOML | `mattyhall/tomlz` | Mature MIT config parser |

| Templates | `jetzig/zmpl` (comptime-typed) / `batiati/mustache-zig` (logic-less) / `gremlin-labs/vibe-jinja` (runtime `.jinja` corpora only, pilot) | Zig comptime makes a runtime engine mostly unnecessary |

| Structured logging | `karlseguin/log.zig` | Cleanest "just use it" |

| S3 | `lobo/aws-sdk-for-zig` | SigV4 built in |

| Redis/Valkey | `kristoff-it/zig-okredis` (partial/alpha) | Best available design |

| YAML (flat/nested config) | `kubkon/zig-yaml` / `pwbh/ymlz` (both partial — no anchors/tags) | Fine for config; not 1.2-complete (see full YAML below) |

### Won't build

- **`exprcalc`** — app-specific spreadsheet/rules engine, not reused cross-project, and needs external regex.

- **`unaccent`** — fully dependent on external `uucode` tables; not included.

- **`roquery`** — C-level SQLite hardening (authorizer/query_only enforcement); lives consumer-side over adopted zig-sqlite.

- **`taskqueue`** — folded into `jobqueue`.

- **`chunkframe`** — too small to be a module; a documented ~20-LOC pattern instead.

- **YAML 1.2 (full spec)** — no adoptable complete pure-Zig implementation; the partial libs above cover config use.

- **Jinja** — Zig comptime templating covers dev-authored use; `vibe-jinja` is a consumer-side pilot option for runtime `.jinja` corpora only.

- **IMAP** — no mature pure-Zig lib; stays unbuilt.

- **HTTP/3 (QUIC)** — not researched, stays dropped.