# M0 library replacement and application rebuild material

Verovio6.4.0 is loaded from two independent, unmodified files at `vendor/verovio/verovio.mjs` and `vendor/verovio/verovio-module.mjs`. Their SHA-256 values are published in `vendor/verovio/manifest.json`. These files are not minified again or embedded into the M0 application bundle. Browser operation and actual swapping with a modified compatible build remain untested.

New M0 application source and exact package lock are copied to `replaceable-app/` during build. They exclude private task instructions, private reports and unrelated repository data. Source file list: package.json, package-lock.json, tsconfig.json, vite.config.ts, index.html, src/, scripts/, public/licenses/.

For a local reconstruction, obtain those files while retaining paths, run `npm ci`, then `npm run build` with Node24.22.1. The generated site is in dist/. To test a compatible modified Verovio build, replace the two dist/vendor/verovio/ files together. The application imports the toolkit API described in the fixed upstream version. This procedure does not grant permission to omit or alter license notices.

The M0 source kit was type-checked and built in the cloud using the same already-installed pinned dependencies through a temporary local link. This is not a clean install test or a successful browser replacement test. No signature check or deliberate replacement restriction is added to the demo code.

This material alone is not a representation that every LGPL distribution requirement, exact corresponding source requirement, font license or OSMD bundled dependency notice has been satisfied. See NOTICE.md. Public release remains held pending unresolved packaging checks.

## Pinned official library source

The build also publishes `sources/verovio-6.4.0-source.tar.gz` and its hash/provenance manifest on the same site. The official annotated `version-6.4.0` tag resolves to `cb5fcfa1178238138aa7f51f1e55f6a743eb26cc`, identical to the official npm6.4.0 gitHead. The archive includes upstream source, font data, licensing and emscripten build scripts. It is not a claim of bit-for-bit binary reproduction. Official build entry: emscripten/buildNpmPackage; modularized non-Humdrum WASM command: ./buildToolkit -c -w -M -H -m.