DECLARED OFFICIAL SINGLE-THREAD BUILD AND SOURCE PINS

Primary build source: ffmpegwasm/ffmpeg.wasm tag v12.15,
commit 71aa99d37c02a7b4c435275ca9ef50e612f6efa1.
The repository includes Dockerfile, Makefile, all build/*.sh scripts, complete
src/bind glue, src/fftools overlay, package sources and package build configuration.
The corresponding tar.gz is in archives/ffmpeg-wasm-<commit>.tar.gz.

Official core build recipe:
  make prd
which calls build-st with FFMPEG_ST=yes and EXTRA_CFLAGS='-O3 -msimd128', then
docker buildx build --build-arg EXTRA_CFLAGS --build-arg EXTRA_LDFLAGS
--build-arg FFMPEG_MT --build-arg FFMPEG_ST -o ./packages/core .
See the untouched Makefile for exact expansion. The single-thread path disables
pthreads, w32threads and os2threads, uses initial memory 32MB with memory growth.
Core links SDL2 with -sUSE_SDL=2 and workerfs through Emscripten, exporting the
functions defined in src/bind/ffmpeg/export.js/export-runtime.js.

Dockerfile explicitly runs build/ffmpeg.sh with:
--enable-gpl --enable-libx264 --enable-libx265 --enable-libvpx
--enable-libmp3lame --enable-libtheora --enable-libvorbis --enable-libopus
--enable-zlib --enable-libwebp --enable-libfreetype --enable-libfribidi
--enable-libass --enable-libzimg.
build/ffmpeg.sh also declares --target-os=none --arch=x86_32
--enable-cross-compile --disable-asm --disable-stripping --disable-programs
--disable-doc --disable-debug --disable-runtime-cpudetect --disable-autodetect,
emcc/em++/emnm/emar/emranlib and Emscripten C/C++ include/link flags.
The official scripts provide complete per-library configure/cmake/autotools flags.
Do not silently substitute another FFmpeg version or remove dependency notices.

Dependency mapping (repository, exact ref declared by Dockerfile/toolchain):
FFmpeg/FFmpeg                     n5.1.4
ffmpegwasm/x264                    4-cores       [floating branch]
ffmpegwasm/x265                    3.4
ffmpegwasm/libvpx                  v1.13.1
ffmpegwasm/lame                    master        [floating branch]
ffmpegwasm/Ogg                     v1.3.4
ffmpegwasm/theora                  v1.1.1
ffmpegwasm/opus                    v1.3.1
ffmpegwasm/vorbis                  v1.3.3
ffmpegwasm/zlib                    v1.2.11
ffmpegwasm/libwebp                 v1.3.2
ffmpegwasm/freetype2               VER-2-10-4
fribidi/fribidi                    v1.0.9
harfbuzz/harfbuzz                  5.2.0
libass/libass                     0.15.0
sekrit-twc/zimg                   release-3.0.5
emscripten-core/emscripten         3.1.40
emscripten-core/emsdk              3.1.40
libsdl-org/SDL                    release-2.24.2 (Emscripten tools/ports/sdl2.py)
google/googletest                  703bd9caab50b139428cea1aaff9974ebee5742e
  (zimg test/extra/googletest recursive submodule; not a claimed linked codec).

Exact resolved commit, download URL and archive SHA-256 for every dependency are
in source-provenance.json. Ref names are case-sensitive. The SDL2 original port
definition, including its upstream zip SHA-512, is preserved in Emscripten source
tools/ports/sdl2.py. This bundle uses a tar archive pinned to the corresponding
Git commit; its tar SHA-256 is not the port definition's zip SHA-512.

Using included sources:
Extract each archive to a separate directory using its ordinary tar top-level
directory. A source archive does not embed git metadata or submodules; googletest
is included separately and should be placed at zimg/test/extra/googletest if
reconstructing the recursive source checkout. Upstream Dockerfile normally fetches
GitHub refs. To build using this stored bundle, supply the unpacked source trees at
the corresponding Docker build stages and retain the original flags and overlays.
Such a local archive-source adaptation would be a NEW local build recipe, not
proof that a resulting binary matches the original npm binary byte-for-byte.

General build dependencies declared upstream:
Docker/buildx, make, Node/npm for wrapper builds; emscripten/emsdk:3.1.40;
apt pkg-config, autoconf, automake, libtool, ragel, git; Python and CMake/toolchain
as supplied by the emsdk image. General-purpose compiler/build-tool binaries are
not bundled. Tool sources/documentation:
https://github.com/emscripten-core/emsdk/tree/3.1.40
https://github.com/emscripten-core/emscripten/tree/3.1.40
https://github.com/llvm/llvm-project
https://github.com/WebAssembly/binaryen
https://github.com/docker/buildx
https://www.gnu.org/software/make/
https://www.gnu.org/software/autoconf/
https://www.gnu.org/software/automake/
https://www.gnu.org/software/libtool/
https://www.freedesktop.org/wiki/Software/pkg-config/
https://www.colm.net/open-source/ragel/
https://git-scm.com/
https://cmake.org/
https://github.com/nodejs/node
https://www.python.org/

Wrapper source build (MIT wrapper only): repository packages/ffmpeg/package.json
declares npm run clean, tsc -p tsconfig.esm.json, and webpack. Its exact package
configuration and upstream lockfile are included in the ffmpeg-wasm archive.
@ffmpeg/types ^0.12.4 is a compile-time type dependency, not a separate claimed
runtime engine binary. The distributed wrapper UMD artifacts were not rebuilt.

Publication is not performed by this source preparation task. The website owner
must actually host the source zip and notices and verify source access with the
engine download. No legal-compliance or patent-clearance conclusion is implied.
