# Corresponding source and build instructions

The exact distributed full single-thread engine is the stockfish npm package
17.1.0, upstream commit 602fd7e1a571a2be71f242942db90483731f2a1f.
The source archive is byte-pinned; its prebuilt JS/WASM matches npm byte-for-byte.
Both full NNUE files are supplied separately, with SHA256 in prepare-engine.mjs.
No engine patches are applied. public/stockfish-loader-v1.js wraps asset fetching for
progress, bounded versioned CacheStorage and local startup timings. The original
engine JS/WASM is byte-identical. Build-time gzip files decode to those same assets. The adapter and original Python rules are included
in kinglet-browser-integration.tar.gz, alongside the complete browser source.
Original MIT notices are retained. Stockfish and python-chess remain GPLv3;
Pyodide is MPL 2.0, Python PSF, Emscripten includes MIT/LLVM and third-party notices.
No backend, credentials, databases or private configuration are included.

## Rebuild engine

Extract stockfish-17.1.0-source.tar.gz. Copy nn-1c0000000000.nnue and
nn-37f18f62d772.nnue into its src directory. Install/activate Emscripten 3.1.7
with emsdk, and Node.js. In the extracted root run:

    rm -f src/stockfish.js src/stockfish.wasm src/stockfish.worker.js
    node build.js --single-threaded --hash

Remove these generated entrypoints first: the archive contains prebuilt loader
symlinks. Upstream --force-linking does not reliably remove them in this revision;
otherwise a build may rename a symlink rather than the newly compiled loader.
Do not pass --lite. Consult node build.js --help for platform options.
Upstream source includes build scripts, loader/glue sources and its uglify-js
build dependency. The release verification rebuilds this source with Emscripten 3.1.7 and tests
UCI initialization and a search; see the release evidence for results.
Bit reproducibility across different toolchains is not claimed. The source/binary
match is verified against the upstream commit and all shipped assets are hashed.

## Rebuild browser integration

Extract kinglet-browser-integration.tar.gz into an empty directory, use Node 22
and run npm ci --ignore-scripts, npm run build. prepare:engine downloads the pinned
source archives/networks, verifies SHA256, copies npm-lockfile-verified binaries,
and packages these sources beside the site. No runtime CDN is used.
Pyodide/CPython source and upstream patches/build scripts are supplied separately.
See pyodide-0.27.7-source/cpython/README.md and its Makefile for their toolchain.

## Distribution

Serve /engine-sources/ alongside /engine/ without authentication or extra charge,
and retain the /licenses link. A latest-upstream link alone is insufficient.
The source archive includes the complete delivered browser application to avoid
assuming that Worker separation automatically settles GPL combination questions.
This does not change the repository-wide MIT license or require publication of
private server data. Compatible MIT notices remain attached to those files;
GPL obligations for the distributed combination must still be observed.

## Pinned release build

The Dockerfile pins the Node and Nginx base manifests for linux/amd64. Run
`docker build --platform linux/amd64 --build-arg KINGLET_BUILD_ID=<commit> .`.
Its GNU tar build uses SOURCE_DATE_EPOCH=0 to normalize archive member metadata.
Ordinary host builds also work without that variable; GNU tar is required if set.
The manifest includes SHA256 for the browser archive, engine sources and networks.
Preserve the complete engine-sources directory under the release ID together with
its manifest; never overwrite a released set.

A reproducible toolchain for the engine check is
`emscripten/emsdk:3.1.7@sha256:6143f5b3d58fe6e7faf9f279d27ea9ea975983ee2b5490478abda126a6762f34`
with `--platform linux/amd64`. Mount the extracted source directory as /src,
work in /src and run the build command above. This compiler container is only
a build tool and is not part of the delivered runtime.

See BROWSER-LICENSE.md for the GPLv3 terms of the distributed browser combination.