Agent Zoo — libavoid-js 0.5.0-beta.5 distribution materials

LICENSE AND COPYRIGHT
LGPL-2.1-or-later. See ../LICENSE, ../NOTICE.txt, ADAPTAGRAMS-COPYING,
ADAPTAGRAMS-LICENSE, source/PATCHES.txt, and the original notices in both
source archives. Emscripten runtime notices: EMSCRIPTEN-LICENSE.
No warranty. Runtime files are copied unchanged from the pinned npm package.

RUNTIME BOUNDARY
index.js (the complete upstream ESM binding, including Emscripten glue),
index.js.map and libavoid.wasm are independently replaceable files.
The application Worker imports index.js at runtime rather than bundling the
library into its application code. No private Agent Zoo code is statically
compiled into libavoid.wasm. The adapter calls the public API.
The normal routing algorithm, Worker deadline and safe-result gates remain
application code; a failed replacement leaves normal routing available.

SOURCE AND PROVENANCE
source/libavoid-js-5062a42.tar.gz:
  Aksem/libavoid-js commit 5062a42fbd82fff562afeebcbb7b1ed45eed8e75,
  as declared by npm's gitHead for 0.5.0-beta.5.
source/adaptagrams-e611668.tar.gz:
  Aksem/adaptagrams commit e611668f30cacb0071323d2c209c565df1f8647b,
  v1.0.6, providing ConnRef::hasValidRoute and hasCrossingObstacles.
source/embind-route-validation.patch:
  Exposes those two C++ methods in the archived binding; see PATCHES.txt.
  This reconstruction patch is LGPL-2.1-or-later, dated 3 November 2026.
These materials are served here without authentication, not just as external
GitHub links. They include C++, binding sources, lockfile and build tools.
provenance.json contains exact hashes and current verification results.
IMPORTANT: npm's declared gitHead is incomplete: its package.json still says
beta.4 and its build script selects v1.0.5, which lacks the two validation
methods present in npm's WASM. The source inputs above reconstruct that API.
Do not equate the package's gitHead alone with its full corresponding source.
Verified on 3 November 2026: the reconstructed source builds a 492,029-byte
WASM with SHA-256 65deb7172894049eb554cf6e02c520274ac117a1992d3d16a3f346c09ceb41e5,
identical to the npm WASM distributed here. No library upgrade or downgrade.

BUILD A COMPATIBLE REPLACEMENT
Download rebuild.py, provenance.json, both source/ archives and
source/embind-route-validation.patch, keeping the same relative paths.
Requirements: Python >=3.12, patch, Docker, Node/npm, internet access for the
pinned compiler image and locked npm build tools. Run: python3 rebuild.py
The helper checks source/patch hashes, extracts to a new temporary directory,
applies the binding patch, and uses the archived production compiler command
with Emscripten 4.0.7 pinned by image digest for linux/amd64. It uses the exact
archived v1.0.6 checkout rather than downloading the v1.0.5 tag in the binding's
obsolete full-build entry point. It then bundles with the locked esbuild.
It prints output hashes and the replacement directory. No Agent Zoo code or
credentials are needed. For further modifications, edit the extracted source
and rerun the compiler and esbuild commands shown in rebuild.py. The helper
does not install a replacement into the production service.

REPLACE THE LIBRARY FOR YOUR OWN USE (CHROMIUM)
1. Build an interface-compatible index.js and libavoid.wasm. The module must
   export AvoidLib with load(wasmURL) and getInstance(), and implement the
   Libavoid API used by the editor (Router, shapes, pins and connectors,
   including ConnRef.hasValidRoute). Use the same build for both files.
2. Open Agent Zoo in Chrome/Edge. In DevTools > Sources > Overrides, select
   a local folder and grant the browser access. This is a browser-local
   operation, not an upload to Agent Zoo. Keep DevTools open while testing.
3. Trigger a fixed-routing Worker (a sufficiently obstructed connection
   after a drag). In Network find these URLs and use Override content:
   /vendor/libavoid/0.5.0-beta.5/index.js
   /vendor/libavoid/0.5.0-beta.5/libavoid.wasm
   Save your corresponding replacement bytes in those override files. If
   useful for debugging, override index.js.map too.
4. Reload, disable cache, and trigger routing again. In Network verify both
   resources are served from local overrides. Workers are recreated for
   each routing job; no application rebuild or server change is needed.
5. Clear/disable Overrides to return to the distributed library.
No runtime hash allowlist or signature prevents installing a compatible
modified library. Build-time hashes protect our normal distribution only.
Syntax/API compatibility, browser capabilities, the existing 5-second Worker
budget and application geometry validation still apply. An invalid module
or WASM fails safely, leaving ordinary routing available.

TERMS
Agent Zoo's terms preserve rights granted by third-party licenses, including
modification for your own use and reverse engineering to debug modifications
to LGPL components. See /terms and /licenses.