build(site): [SITE-07] distribute verified console package and embedded notices

scripts/site-vendor/console/README.md

@@ -132,3 +132,26 @@ The fetch command verifies that immutable upstream text through GitHub's Content
 API too (the raw URL had connection resets); both URLs and the blob ID are
 recorded, and decoded content must match the same hash. Offline mode checks
 the frozen bytes. Full embedded-component attribution remains open.
+
+## Public notice delivery and embedded sources
+
+The site manifest now delivers all 32 runtime package licenses, Parcel's loader
+license, and two embedded headers through `yarn build:site-notices`. The hashes
+are tied to the current generated console asset. `check:console` must run before
+`check:site-notices`; adapter changes require an explicit manifest fingerprint
+update after runtime validation. No runtime code is appended by the notice build.
+
+`embedded-notices.ts` extracts exact license comment blocks from verified archive
+members, or from a unique source in the member's source map. It verifies member,
+source and excerpt hashes, without removing comment markers or changing lines.
+`reproduce.ts` compares those excerpts with the preserved files. The record is
+`refactor/baselines/console-embedded-notices.json`; Chromium's complete BSD header
+comes from console-feed string-utils, and Sultan Tarimo's MIT header comes from
+styled-components' rule-sheet source map. Both are independently attributed in
+the public index and protected by the notice CLI's omission checks.
+
+This is partial embedded review. The record lists replicator, simple-html-tokenizer,
+Emotion stylis/hash/cache, the Component Stack Overflow reference, and Babel/
+regenerator inside react-inspector as follow-ups. Source-map names and comment
+links are leads, not proof of a particular upstream version or complete notice
+coverage. Do not close VENDOR-08 solely because all Parcel modules reproduce.

scripts/site-vendor/console/embedded-notices.ts

@@ -0,0 +1,35 @@
+import assert from 'node:assert/strict'
+import { hash } from './provenance.ts'
+
+export interface EmbeddedNotice {
+  archive: string
+  member: string
+  memberSha256: string
+  mapSource?: string
+  sourceSha256: string
+  start: string
+  end: string
+  source: string
+  sha256: string
+}
+
+export function extractNotice(bytes: Uint8Array, notice: EmbeddedNotice): string {
+  assert.equal(hash(bytes), notice.memberSha256, 'Embedded notice archive member changed')
+  let source = new TextDecoder().decode(bytes)
+  if (notice.mapSource) {
+    const map: { sources: string[], sourcesContent: (string | null)[] } = JSON.parse(source)
+    const indices = map.sources.flatMap((name, index) => name === notice.mapSource ? [index] : [])
+    assert.equal(indices.length, 1, 'Missing or duplicate embedded notice map source')
+    const content = map.sourcesContent[indices[0]!]
+    assert.equal(typeof content, 'string', 'Missing embedded notice source content')
+    source = content!
+  }
+  assert.equal(hash(source), notice.sourceSha256, 'Embedded notice source changed')
+  const start = source.indexOf(notice.start)
+  assert(start >= 0 && !source.includes(notice.start, start + 1), 'Missing or duplicate notice start')
+  const end = source.indexOf(notice.end, start)
+  assert(end >= start, 'Missing notice end')
+  const text = source.slice(start, end + notice.end.length)
+  assert.equal(hash(text), notice.sha256, 'Embedded notice excerpt changed')
+  return text
+}

scripts/site-vendor/console/reproduce.ts

@@ -1,3 +1,4 @@
+import type { EmbeddedNotice } from './embedded-notices.ts'
 import type { Archive, External, Source } from './provenance.ts'
 import type { BabelRuntime, EsmSource } from './reconstruction.ts'
 import assert from 'node:assert/strict'
@@ -8,6 +9,7 @@ import { createRequire } from 'node:module'
 import path from 'node:path'
 import process from 'node:process'
 import { fileURLToPath } from 'node:url'
+import { extractNotice } from './embedded-notices.ts'
 import { hash, parcelModules, verifyArchive, verifyModules, verifyPackageEdges } from './provenance.ts'
 import { reconstructModule, verifyPrelude } from './reconstruction.ts'
 
@@ -168,4 +170,12 @@ for (const notice of esm.supplementalNotices) {
     assert.equal(hash(bytes), notice.sha256, 'Upstream supplemental notice changed')
   }
 }
-console.log(JSON.stringify({ exactModules: identified.size, consoleFeed: count, commonjs: commonCount, esm: esmCount, parcelPrelude: true, packageEdges: true, unresolved: 0, licenseClosure: false }))
+const embedded: { notices: EmbeddedNotice[] } = JSON.parse(fs.readFileSync(path.join(root, 'refactor/baselines/console-embedded-notices.json'), 'utf8'))
+assert.equal(embedded.notices.length, 2, 'Incomplete reviewed embedded notice scope')
+assert.equal(new Set(embedded.notices.map(notice => notice.source)).size, 2, 'Duplicate embedded notice source')
+for (const notice of embedded.notices) {
+  assert(archiveIds.has(notice.archive) || notice.archive === 'console-feed-3.2.2', 'Unknown embedded notice archive')
+  const text = extractNotice(readMember(`${notice.archive}.tgz`, notice.member), notice)
+  assert.equal(fs.readFileSync(path.join(root, notice.source), 'utf8'), text, 'Frozen embedded notice changed')
+}
+console.log(JSON.stringify({ exactModules: identified.size, consoleFeed: count, commonjs: commonCount, esm: esmCount, parcelPrelude: true, packageEdges: true, embeddedNotices: embedded.notices.length, unresolved: 0, licenseClosure: false }))