build(site): [SITE-07] verify modified forks and preserve upstream author notices

test/browser/site-vendor.spec.js

@@ -34,6 +34,10 @@ test('mobile vConsole shows logs and upstream site notice texts are served uncha
   expect(await index.text()).toContain('Included component: @babel/runtime (react-inspector embedded) 7.13.10')
   expect(await index.text()).toContain('Included component: regenerator-runtime 0.13.7')
   expect(await index.text()).toContain('Included component: simple-html-tokenizer git-04799f4638ec5ed903a4e5aa6e832269fa59be6b')
+  expect(await index.text()).toContain('Included component: replicator (console-feed fork)')
+  expect(await index.text()).toContain('Included component: stylis (Emotion fork)')
+  expect(await index.text()).toContain('Included component: murmurhash-js (Gary Court)')
+  expect(await index.text()).toContain('Included component: murmurhash2 (Austin Appleby)')
   expect(await index.text()).toContain('Embedded attribution review is still incomplete')
   await page.evaluate(() => {
     window.vConsole.destroy()

test/site-console.test.js

@@ -6,6 +6,7 @@ import process from 'node:process'
 // eslint-disable-next-line test/no-import-node-test -- Native console subscription and frozen build boundaries.
 import test from 'node:test'
 import ts from 'typescript'
+import { decodeGitSource, verifyForkOutput, verifyGitSource } from '../scripts/site-vendor/console/attribution.ts'
 import { generateConsole, moduleRanges, obsoleteMap, upstreamSha256 } from '../scripts/site-vendor/console/build.ts'
 import { extractNotice } from '../scripts/site-vendor/console/embedded-notices.ts'
 import { verifyMappedSources, verifyTransformedSources } from '../scripts/site-vendor/console/embedded-sources.ts'
@@ -15,6 +16,28 @@ import { errorArgument } from '../scripts/site-vendor/console/runtime/errors.ts'
 import { css } from '../scripts/site-vendor/console/runtime/style.ts'
 import { createSubscriptions } from '../scripts/site-vendor/console/runtime/subscriptions.ts'
 
+test('Immutable Git attribution verifies original blob identity and rejects altered API content', () => {
+  const record = JSON.parse(fs.readFileSync('refactor/baselines/console-derived-attribution.json', 'utf8'))
+  const source = record.remotes.find(source => source.id === 'gary-readme')
+  const bytes = fs.readFileSync(source.source)
+  const response = Buffer.from(JSON.stringify({ encoding: 'base64', content: bytes.toString('base64') }))
+  assert.deepEqual(decodeGitSource(response, source), bytes)
+  assert.throws(() => verifyGitSource(bytes, { ...source, gitBlobSha: '0'.repeat(40) }), /blob identity/)
+  assert.throws(() => verifyGitSource(Buffer.from('shortened license'), source), /content changed/)
+  assert.throws(() => decodeGitSource(Buffer.from(JSON.stringify({ encoding: 'utf8', content: bytes.toString() })), source), /encoding/)
+  assert.throws(() => decodeGitSource(Buffer.from('{"encoding":"base64"}'), source), /Missing Git/)
+})
+
+test('Fork reproduction permits only the pinned terminal source map and exact runtime bytes', () => {
+  const code = 'var value = 1;\n'
+  const trailer = '//# sourceMappingURL=data:application/json;base64,e30='
+  verifyForkOutput(code, code + trailer)
+  assert.throws(() => verifyForkOutput(code, code), /one terminal/)
+  assert.throws(() => verifyForkOutput(code, code + trailer + trailer), /one terminal/)
+  assert.throws(() => verifyForkOutput(code, `${code + trailer}\nrun()`), /trailer/)
+  assert.throws(() => verifyForkOutput('var value = 2;\n', code + trailer), /runtime differs/)
+})
+
 test('Embedded source maps reject omitted dependencies and content from a different release', () => {
   const upstream = Buffer.from('export const value = 1;\n')
   const map = { sources: ['../../src/owned.js', '../../node_modules/library/index.js'], sourcesContent: ['owned', upstream.toString()] }

test/site-notices.test.js

@@ -111,7 +111,7 @@ test('Console notice CLI rejects omitted package or embedded attribution before
   const manifestPath = path.join(root, 'scripts/site-vendor/manifest.json')
   fs.mkdirSync(path.dirname(manifestPath), { recursive: true })
   const original = JSON.parse(fs.readFileSync('scripts/site-vendor/manifest.json', 'utf8'))
-  for (const name of ['console-feed', 'parcel-bundler', 'styled-components', 'chromium-string-utils', 'stylis-rule-sheet', '@babel/runtime (react-inspector embedded)', 'regenerator-runtime', 'simple-html-tokenizer']) {
+  for (const name of ['console-feed', 'parcel-bundler', 'styled-components', 'chromium-string-utils', 'stylis-rule-sheet', '@babel/runtime (react-inspector embedded)', 'regenerator-runtime', 'simple-html-tokenizer', 'replicator (console-feed fork)', 'stylis (Emotion fork)', 'murmurhash-js (Gary Court)', 'murmurhash2 (Austin Appleby)']) {
     for (const field of ['components', 'notices']) {
       const manifest = structuredClone(original)
       const group = manifest.groups.find(group => group.name === 'console')