@satzstrom/linux-x64 0.1.0

package/LICENSE

@@ -0,0 +1,29 @@
+# Satzstrom Community Binary License 0.1
+
+Copyright (c) 2026 Lukas Brückner. All rights reserved.
+
+This license applies only to the native Satzstrom renderer binaries. The public
+launcher, primitives, documentation, skill, and examples are licensed
+separately under the MIT License.
+
+You may use the binaries for personal work, manual commercial work, and
+automated development or testing. Automated commercial production use,
+including server, API, scheduled, batch, or customer-document generation,
+requires a separate Enterprise license.
+
+You may not redistribute the binaries, make them available to third parties as
+a standalone product or service, reverse engineer or circumvent protections,
+or use them to create or improve a competing document renderer.
+
+These restrictions do not limit rights granted by third-party licenses. In
+particular, you may reverse engineer the executable as necessary to debug your
+modifications to LGPL-covered components, extract the opaque Satzstrom payload,
+and relink that unchanged payload with a modified compatible runtime for your
+own otherwise licensed use. You may copy and redistribute LGPL-covered
+components and their corresponding source under their respective licenses.
+These permissions do not grant a right to redistribute the proprietary
+Satzstrom payload or a complete Satzstrom binary.
+
+The binaries are provided "as is", without warranties or conditions of any
+kind. To obtain an Enterprise license, contact the project owner through the
+Satzstrom GitHub repository.

package/compliance/bun/README.md

@@ -0,0 +1,19 @@
+# Bun Runtime Compliance Bundle
+
+Satzstrom platform executables contain the proprietary Satzstrom payload inside a statically linked Bun 1.4.0 runtime. That runtime contains JavaScriptCore, WTF, and bmalloc from Bun's patched WebKit. JavaScriptCore is covered by GNU Library General Public License version 2; other Bun and WebKit portions carry the licenses and notices reproduced in `licenses/` and in the complete corresponding source.
+
+This directory is release material, not Satzstrom source. Every platform package must contain it unchanged at `compliance/bun/`.
+
+The immutable source identities are in `source-manifest.json`. `REBUILD-AND-RELINK.md` explains how a recipient can modify JavaScriptCore, rebuild Bun, and recombine the rebuilt runtime with the unchanged opaque Satzstrom standalone payload. The process does not use or require the Satzstrom TypeScript source.
+
+## Distributor requirements
+
+Before making any executable available:
+
+1. Run `pnpm verify:compliance` and the platform binary smoke test.
+2. Make the exact Bun and WebKit corresponding-source archives available from the same download location as the binaries. Include all build scripts, dependency lockfiles, patches, generated-source prerequisites, and license files from those exact revisions. Do not rely only on a mutable branch or tag.
+3. Keep `source-manifest.json`, the corresponding-source archives, and their published hashes for as long as the binaries remain available. If counsel chooses a written-offer route instead, replace `SOURCE-OFFER.md` with the approved offer before release and retain the material for the full required period.
+4. Preserve the recipient's right to modify the LGPL-covered library and reverse engineer the executable for debugging those modifications. Distribution terms or technical controls must not contradict those rights.
+5. Perform and record the platform verification checklist in `REBUILD-AND-RELINK.md` for every distributed executable. Version `0.1.0` distributes Windows x64 and Linux x64 only.
+
+`pnpm verify:compliance` checks repository and package consistency. It cannot prove that source archives were uploaded, that a download remains available, or that commercial terms satisfy a license. Those are release-owner and legal-review responsibilities.

package/compliance/bun/REBUILD-AND-RELINK.md

@@ -0,0 +1,82 @@
+# Rebuild Bun with Modified JavaScriptCore and Relink Satzstrom
+
+These instructions operate on the LGPL-covered runtime and the opaque standalone payload already present in a distributed Satzstrom executable. They do not require Satzstrom TypeScript source.
+
+## 1. Obtain and verify corresponding source
+
+Install Git, Node.js 24 or newer, and the native build prerequisites documented by the pinned Bun revision. From this directory run:
+
+```sh
+node tools/fetch-corresponding-source.mjs --destination ./corresponding-source
+```
+
+The tool fetches Bun commit `34cbb9a40b4bd1bd767d134a7065e66c2432a676` and WebKit commit `0f966e81b78c84bb23213e391bc679c4ef83e56b`, checks their commit and tree hashes in `source-manifest.json`, and checks out detached worktrees. The release source bundle contains verified Git bundles for Bun, WebKit, and every pinned native build dependency. Each bundle exposes `refs/tags/source` as a deterministic, parentless snapshot commit whose tree is byte-identical to the pinned upstream revision; `archives.json` records both identities. Clone a contained `.bundle` file with `git clone --branch source <archive>.bundle <directory>` to recover its exact source tree without requiring upstream history. Candidate assembly clones every bundle, runs `git fsck --full`, and verifies the snapshot commit and tree. The outer release checksum proves availability of the same audited source bundle. Network archives published by the distributor must also be checked against their release hashes; a Git commit/tree identity verifies content, but does not by itself prove source availability.
+
+## 2. Modify and build JavaScriptCore
+
+Make desired changes in `corresponding-source/WebKit`. Preserve license headers and add prominent change/date notices where the license requires them. Then build Bun from `corresponding-source/bun` using the local WebKit checkout:
+
+PowerShell:
+
+```powershell
+$env:BUN_WEBKIT_PATH = (Resolve-Path ..\WebKit)
+bun install --frozen-lockfile
+bun run build:release:local
+```
+
+POSIX shell:
+
+```sh
+export BUN_WEBKIT_PATH="$(cd ../WebKit && pwd)"
+bun install --frozen-lockfile
+bun run build:release:local
+```
+
+The expected native output is `build/release-local/bun` (`bun.exe` on Windows). Use a verified Bun 1.4.0 bootstrap executable. The bootstrap npm package integrities for all supported targets are recorded in `source-manifest.json` and `pnpm-lock.yaml`.
+
+Bun's pinned source defines the same local-JSC build as `PORT=JSCOnly`, `ENABLE_STATIC_JSC=ON`, `USE_BUN_JSC_ADDITIONS=ON`, and `USE_BUN_EVENT_LOOP=ON`. Do not substitute an unpatched Apple WebKit checkout.
+
+## 3. Recombine the unchanged proprietary payload
+
+Run the relinker on the same operating system and architecture as the original binary and rebuilt runtime:
+
+```sh
+node tools/relink-standalone-payload.mjs \
+  --original /path/to/distributed/satzstrom \
+  --runtime /path/to/corresponding-source/bun/build/release-local/bun \
+  --output /path/to/satzstrom-relinked
+```
+
+On Windows, use `.exe` paths. The tool:
+
+1. locates and validates Bun's serialized standalone-module-graph trailer;
+2. compiles a same-size carrier executable with the recipient-built runtime;
+3. replaces only the carrier graph with the byte-identical opaque Satzstrom graph;
+4. verifies the payload SHA-256 after replacement; and
+5. applies executable permissions and ad-hoc signs the modified Mach-O on macOS.
+
+The carrier method preserves the rebuilt Bun/WebKit runtime and replaces no runtime bytes. It deliberately does not decode or reconstruct Satzstrom source. Use `--codesign-identity <identity>` on macOS if an identity other than ad-hoc signing is required. Code signing and notarization policy is separate from LGPL relinking.
+
+For an official release-candidate proof, use the repository wrapper. It accepts only the runtime at `build/release-local/bun` inside the pinned Bun checkout, verifies the Bun and WebKit commit/tree identities, performs the relink, confirms the unchanged payload and runs the complete private binary smoke suite against the relinked executable. The proof records the full executable and standalone-payload SHA-256 values; candidate assembly must match both values to the executable extracted from the corresponding platform tarball:
+
+```sh
+pnpm prove:runtime-relink -- \
+  --original /path/to/distributed/satzstrom \
+  --bun-source /path/to/corresponding-source/bun \
+  --webkit-source /path/to/corresponding-source/WebKit \
+  --output /path/to/satzstrom-relinked \
+  --evidence /path/to/relink-<target>.json
+```
+
+## 4. Verification matrix
+
+For every release version, archive a log for each distributed target. Version `0.1.0` distributes Windows x64 and Linux x64 only. The macOS rows document future targets and are not part of this release.
+
+| Target      | Required verification                                                                                                                                                                                                    |
+| ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| Windows x64 | Build local-JSC Bun with MSVC/Clang prerequisites; relink `.exe`; confirm payload hash; run `satzstrom --version` and the private binary smoke test; inspect that Authenticode expectations are handled after relinking. |
+| Linux x64   | Build against the documented glibc baseline; relink ELF; confirm payload hash and executable mode; run `satzstrom --version` and the private binary smoke test on the oldest supported glibc host.                       |
+| macOS x64   | Build on Intel macOS; relink Mach-O; confirm payload hash; ad-hoc or release-sign; run Gatekeeper/signature inspection and the private binary smoke test.                                                                |
+| macOS arm64 | Build natively on Apple Silicon; relink Mach-O; confirm payload hash; ad-hoc or release-sign; run Gatekeeper/signature inspection and the private binary smoke test.                                                     |
+
+Changing JavaScriptCore can intentionally change behavior or break Bun's internal ABI. Successful compilation and payload recombination prove relinkability, not compatibility of every possible JavaScriptCore modification.

package/compliance/bun/SOURCE-OFFER.md

@@ -0,0 +1,15 @@
+# Corresponding Source Availability
+
+Satzstrom platform binaries use Bun 1.4.0 and statically link the LGPL-covered JavaScriptCore/WTF portions identified in `source-manifest.json`.
+
+For Satzstrom 0.1.0, complete corresponding source for the exact Bun and WebKit revisions is published beside the binary packages in the durable public release at:
+
+https://github.com/LukasB97/satzstrom/releases/tag/v0.1.0
+
+The published source includes the complete revision contents, build and installation scripts, dependency metadata, interface definitions, notices, and every distributor modification. Cryptographic hashes and a reconstruction manifest accompany the release. A fresh download must be verified before any binary package is published.
+
+The release assets and their checksums must be retained for as long as the corresponding Satzstrom binaries are distributed. Questions or source-access problems can be reported through GitHub private vulnerability reporting or `lukas@lb-engineering.org`.
+
+The repository does not assert that this text alone is a legally sufficient written offer. If corresponding source will not accompany the download, counsel must approve a written offer, its delivery method, duration, territory, and fulfillment process before publication. Record the approved contact and source location in the release notes; do not ship placeholders.
+
+For the build and relink procedure, see `REBUILD-AND-RELINK.md`.

package/compliance/bun/licenses/BUN-CLAP-UNLICENSE.txt

@@ -0,0 +1,24 @@
+This is free and unencumbered software released into the public domain.
+
+Anyone is free to copy, modify, publish, use, compile, sell, or
+distribute this software, either in source code form or as a compiled
+binary, for any purpose, commercial or non-commercial, and by any
+means.
+
+In jurisdictions that recognize copyright laws, the author or authors
+of this software dedicate any and all copyright interest in the
+software to the public domain. We make this dedication for the benefit
+of the public at large and to the detriment of our heirs and
+successors. We intend this dedication to be an overt act of
+relinquishment in perpetuity of all present and future rights to this
+software under copyright law.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR
+OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+OTHER DEALINGS IN THE SOFTWARE.
+
+For more information, please refer to <http://unlicense.org>

package/compliance/bun/licenses/BUN-LICENSE.md

@@ -0,0 +1,84 @@
+Bun itself is MIT-licensed.
+
+## JavaScriptCore
+
+Bun statically links JavaScriptCore (and WebKit) which is LGPL-2 licensed. WebCore files from WebKit are also licensed under LGPL2. Per LGPL2:
+
+> (1) If you statically link against an LGPL’d library, you must also provide your application in an object (not necessarily source) format, so that a user has the opportunity to modify the library and relink the application.
+
+You can find the patched version of WebKit used by Bun here: <https://github.com/oven-sh/webkit>. If you would like to relink Bun with changes:
+
+- `git clone https://github.com/oven-sh/WebKit vendor/WebKit`
+- `bun sync-webkit-source` (checks out the version pinned in `WEBKIT_VERSION` in `scripts/build/deps/webkit.ts`)
+- `bun run build:local`
+
+This compiles JavaScriptCore, compiles Bun’s `.cpp` bindings for JavaScriptCore (which are the object files using JavaScriptCore) and outputs a new `bun` binary with your changes.
+
+## Linked libraries
+
+Bun statically links these libraries:
+
+| Library | License |
+|---------|---------|
+| [`boringssl`](https://boringssl.googlesource.com/boringssl/) | [several licenses](https://boringssl.googlesource.com/boringssl/+/refs/heads/master/LICENSE) |
+| [`brotli`](https://github.com/google/brotli) | MIT |
+| [`libarchive`](https://github.com/libarchive/libarchive) | [several licenses](https://github.com/libarchive/libarchive/blob/master/COPYING) |
+| [`lol-html`](https://github.com/cloudflare/lol-html/tree/master/c-api) | BSD 3-Clause |
+| [`ls-hpack`](https://github.com/litespeedtech/ls-hpack) | MIT |
+| [`ls-qpack`](https://github.com/litespeedtech/ls-qpack) | MIT |
+| [`lsquic`](https://github.com/litespeedtech/lsquic) | MIT (portions derived from [Chromium proto-quic](https://github.com/litespeedtech/lsquic/blob/master/LICENSE.chrome), BSD 3-Clause) |
+| [`mimalloc`](https://github.com/microsoft/mimalloc) | MIT |
+| [`picohttp`](https://github.com/h2o/picohttpparser) | dual-licensed under the Perl License or the MIT License |
+| [`zstd`](https://github.com/facebook/zstd) | dual-licensed under the BSD License or GPLv2 license |
+| [`simdutf`](https://github.com/simdutf/simdutf) | Apache 2.0 |
+| [`tinycc`](https://github.com/tinycc/tinycc) | LGPL v2.1 |
+| [`uSockets`](https://github.com/uNetworking/uSockets) | Apache 2.0 |
+| [`zlib-ng`](https://github.com/zlib-ng/zlib-ng) | zlib |
+| [`c-ares`](https://github.com/c-ares/c-ares) | MIT licensed |
+| [`libicu`](https://github.com/unicode-org/icu) 78 | [license here](https://github.com/unicode-org/icu/blob/main/icu4c/LICENSE) |
+| [`libbase64`](https://github.com/aklomp/base64/blob/master/LICENSE) | BSD 2-Clause |
+| [`libuv`](https://github.com/libuv/libuv) (on Windows) | MIT |
+| [`libdeflate`](https://github.com/ebiggers/libdeflate) | MIT |
+| [`libjpeg-turbo`](https://github.com/libjpeg-turbo/libjpeg-turbo) | [BSD 3-Clause / IJG / zlib](https://github.com/libjpeg-turbo/libjpeg-turbo/blob/main/LICENSE.md) |
+| [`libspng`](https://github.com/randy408/libspng) | BSD 2-Clause |
+| [`libwebp`](https://github.com/webmproject/libwebp) | BSD 3-Clause |
+| [`highway`](https://github.com/google/highway) | Apache 2.0 |
+| [`uucode`](https://github.com/jacobsandlund/uucode) | MIT |
+| A fork of [`uWebsockets`](https://github.com/jarred-sumner/uwebsockets) | Apache 2.0 licensed |
+| Parts of [Tigerbeetle's IO code](https://github.com/tigerbeetle/tigerbeetle/blob/532c8b70b9142c17e07737ab6d3da68d7500cbca/src/io/windows.zig#L1) | Apache 2.0 licensed |
+| `__cxa_thread_atexit` fallback from [LLVM libc++abi](https://github.com/llvm/llvm-project/blob/llvmorg-19.1.0/libcxxabi/src/cxa_thread_atexit.cpp) | Apache 2.0 with LLVM exception |
+
+## Polyfills
+
+For compatibility reasons, the following packages are embedded into Bun's binary and injected if imported.
+
+| Package | License |
+|---------|---------|
+| [`acorn`](https://github.com/acornjs/acorn) | MIT |
+| [`acorn-walk`](https://github.com/acornjs/acorn) | MIT |
+| [`assert`](https://npmjs.com/package/assert) | MIT |
+| [`browserify-zlib`](https://npmjs.com/package/browserify-zlib) | MIT |
+| [`buffer`](https://npmjs.com/package/buffer) | MIT |
+| [`constants-browserify`](https://npmjs.com/package/constants-browserify) | MIT |
+| [`crypto-browserify`](https://npmjs.com/package/crypto-browserify) | MIT |
+| [`domain-browser`](https://npmjs.com/package/domain-browser) | MIT |
+| [`events`](https://npmjs.com/package/events) | MIT |
+| [`https-browserify`](https://npmjs.com/package/https-browserify) | MIT |
+| [`os-browserify`](https://npmjs.com/package/os-browserify) | MIT |
+| [`path-browserify`](https://npmjs.com/package/path-browserify) | MIT |
+| [`process`](https://npmjs.com/package/process) | MIT |
+| [`punycode`](https://npmjs.com/package/punycode) | MIT |
+| [`querystring-es3`](https://npmjs.com/package/querystring-es3) | MIT |
+| [`stream-browserify`](https://npmjs.com/package/stream-browserify) | MIT |
+| [`stream-http`](https://npmjs.com/package/stream-http) | MIT |
+| [`string_decoder`](https://npmjs.com/package/string_decoder) | MIT |
+| [`timers-browserify`](https://npmjs.com/package/timers-browserify) | MIT |
+| [`tty-browserify`](https://npmjs.com/package/tty-browserify) | MIT |
+| [`url`](https://npmjs.com/package/url) | MIT |
+| [`util`](https://npmjs.com/package/util) | MIT |
+| [`vm-browserify`](https://npmjs.com/package/vm-browserify) | MIT |
+
+## Additional credits
+
+- Bun's JS transpiler, CSS lexer, and Node.js module resolver source code is a port of [@evanw](https://github.com/evanw)’s [esbuild](https://github.com/evanw/esbuild) project.
+- Credit to [@kipply](https://github.com/kipply) for the name "Bun"!