Pagefind 1.5.2 search runtime: corresponding source
==================================================

This archive accompanies the unmodified Pagefind 1.5.2 search assets redistributed
by Tiller. It does not change the MIT license of independent Tiller code.
The linked Pagefind WASM runtime incorporates pagefind_microjson 0.1.4, whose
Cargo metadata says GPL-3.0-only and whose source header says GPL version 3 or
later. COPYING is the full actual GPL version 3 text distributed in that crate.
Redistribution of the combined covered WASM program is under GPL version 3;
individual source files also retain their original upstream notices/licenses.

Newly authored redistribution packaging material (build-wasm.sh, README.txt,
.cargo/config.toml, source-provenance.json, source-inventory.json and generated
vendor/*/.cargo-checksum.json files) is MIT licensed by Tiller. The full actual
Tiller copyright and MIT permission/warranty text is provided separately in
TILLER-WRAPPER-LICENSE.txt. That license applies only to these packaging
additions; it does not replace upstream source licenses or the GPL terms
applicable to the combined covered WASM runtime.

The original published Pagefind crate retained under upstream/ also contains
prebundled JavaScript assets. notices/npm/ provides the complete already-
collected MIT copyright/permission/warranty texts for adequate-little-templates
1.0.2 (component UI), mark.js 8.11.1 (highlighting), the fflate source shipped
by Pagefind 1.5.2 (decompression), and the default UI bundle's Pagefind,
Svelte 4.2.20, bcp-47 2.1.0 and is-* dependencies. The exact notice provenance
and versions are recorded in notices/npm-notices.json. These upstream notices
apply to the original bundled JS copies inside this standalone archive as
well as the associated upstream source; they are not Tiller's wrapper license.

Contents and exact provenance
-----------------------------
pagefind/ contains the complete unmodified upstream v1.5.2 tagged source tree,
commit bf17396721be637cc67c8ed7ead1dc7b8ac43d96, including Rust and JS sources,
build scripts, workflow, lockfiles, and the bundled pagefind_stem source.
upstream/ contains the original fetched tag archive, successful release-run
checkout archive, published pagefind-1.5.2.crate (including all 34 shipped WASM
variants), and original checked Rust rust-src package. The successful release
workflow run is https://github.com/Pagefind/pagefind/actions/runs/24306631111,
head commit a2e9f40ef326f9a7926247695df25981a6f3ef4b. Comparison with the tag
found only CHANGELOG.md different across the complete two snapshots; all
pagefind_web, pagefind_stem, pagefind_web_js, workflow and build-script bytes
are identical. source-provenance.json records URLs, hashes and inventory.

The published Pagefind crate records an ephemeral release commit
1d9201144e8bad531c6e19ddb21b5aa533f1a119 and dirty=true. That commit could not
be retrieved (GitHub commit API 422, raw source and codeload 404). The upstream
workflow makes a throw-away deploy_branch commit for version changes, then
generates vendor assets, so dirty=true is consistent with the documented
packaging. The unseen ephemeral working tree is NOT asserted to be identical
to the tag. The available workflow checkout/tag, exact published artifacts,
versioning script and source snapshots are provided without concealing that
upstream provenance limitation. The published root lock differs from the tag
by Pagefind's package version (1.5.2 rather than 0.0.0); dependency package
name/version sets are otherwise identical. The separate pagefind_web lock
is the source of the WASM crate closure.

vendor/ contains full checksummed crates.io distributions for every package
in pagefind_web/Cargo.lock and every registry package in the exact Rust
library/Cargo.lock. This is deliberately conservative: compiler-only crates,
unenabled serde dependencies, Rust test dependencies and non-WASM target
packages are included, not falsely described as linked WASM code. The
pagefind_stem 1.0.0 registry source (actually referenced by pagefind_web) is
included independently of the in-repository stem source. Their only source
differences are a doc-comment typo and an end-of-file newline. It includes
the actual Jakob Demler MIT and Snowball BSD-3-Clause notices in src/lib.rs.

rust-source/ contains the full library and support sources from the official
checksummed 2026-04-12 rust-src nightly package, including compiler-builtins,
libm, stdarch, portable-simd and libunwind source. It is the source matching
all 34 published WASM producers: rustc 1.97.0-nightly (bf4fbfb7a 2026-04-11),
full commit bf4fbfb7a18d74e7cd8eef93af7329c58fbb5344. All WASM producers also
identify wasm-bindgen 0.2.117 (fb403cfef) and walrus 0.26.1. notices/ includes
all collected crate licenses and the complete official COPYRIGHT-library.html
from that exact nightly rustc distribution, including embedded third-party
copyrights and full license terms. The Rust toolchain itself is an external
build tool; compiler executables are not included here.

Prerequisites (external build tools)
-----------------------------------
A POSIX host with Bash, Node.js 24, gzip, and rustup; install Rust toolchain
nightly-2026-04-12 with wasm32-unknown-unknown and rust-src components.
The official release workflow used wasm-pack v0.14.0. Install wasm-pack 0.14.0,
wasm-bindgen-cli 0.2.117 and wasm-opt before starting an offline build.
wasm-bindgen-cli 0.2.117 is required to match the locked wasm-bindgen crate.
The original workflow lets wasm-pack choose/download wasm-opt and does not
pin its version. No wasm-opt version or bit-for-bit reproduction claim is
invented here. Rust compiler installation/tool downloads need network unless
those tools have already been installed or cached. They are general-purpose
build tools and not linked source dependencies of the search program.

The bundled rust-source/lib/rustlib/src/rust/ can be copied into the matching
nightly toolchain's lib/rustlib/src/rust/ if rust-src was not preinstalled.
Do not replace the source of a different toolchain: the version must match.
The original rust-src package's install.sh is also retained under upstream/
in its original tar.xz archive.

Building and modifying the WASM runtime
--------------------------------------
Extract this archive into a writable directory. Starting from a fresh copy,
run ./build-wasm.sh. It invokes the unmodified upstream versioning script,
then the same upstream wasm-pack release target, -Z build-std=panic_abort,std,
size optimization, immediate-abort flag and language feature set. It uses the
pinned dated Rust toolchain, local vendored Cargo sources, offline Cargo and
wasm-pack's no-install mode. New support files build-wasm.sh and the top-level
.cargo/config.toml are redistribution additions; upstream source files are
unchanged in the delivered archive. Running the script changes only release
version metadata as the upstream versioning script specifies, then generates
build outputs. The packaging wrapper uses gzip -n to avoid gzip timestamps;
this differs from upstream gzip packaging, not the decompressed WASM code.

Outputs are pagefind/pagefind/vendor/pagefind_web.1.5.2.js and
pagefind/pagefind/vendor/wasm/pagefind_web_bg.<language>.1.5.2.wasm.gz.
The gzip payload begins with pagefind_dcd followed by the actual WASM binary,
matching upstream packaging. The generic variant is language unknown.
To modify the search engine, edit pagefind/pagefind_web/src/; to modify a
stemmer, edit vendor/pagefind_stem-1.0.0/src/. Cargo's generated per-file
checksums in .cargo-checksum.json must be updated for intentional vendor
changes, or use a normal Cargo [patch.crates-io] path override to an editable
copy of the full crate and regenerate the local lock as appropriate.
The caller-facing coupled JS sources and original esbuild script/lock are
also included in pagefind/pagefind_web_js/. They are not required to compile
the WASM. Rebuilding those JS bundles uses npm ci then npm run build-coupled
in that directory and therefore requires npm downloads or a populated npm
cache. The README does not claim that unrelated native Pagefind CLI/UI/test
workspaces can build offline using only the WASM/Rust-library vendor set.

Reproducibility and redistribution boundary
------------------------------------------
No builds, tests or byte-identical reproduction checks were performed while
assembling this archive. Source inventories and upstream download checksums
were examined; paths/tool versions beyond the evidence above remain unknown.
The archive itself has sorted members, fixed timestamps/ownership and stable
gzip headers; it is a reproducible packaging of the captured inputs, not a
claim that upstream's compiler output can be recreated byte-for-byte.
Recipients can modify and rebuild the covered search program without keys,
passwords or an installation authorization mechanism. Keep COPYING, upstream
copyright notices and corresponding source available alongside downloaded
covered search assets; retaining these files is not a warranty of legal advice.
