build(site): [SITE-07] retain shallowequal upstream attribution

scripts/build-site-notices.mjs

@@ -55,6 +55,7 @@ assert.deepEqual(consoleGroup?.components?.map(component => component.name).sort
   'react-dom',
   'react-inspector',
   'react-is',
+  'react-pure-render (shallowequal origin)',
   'regenerator-runtime',
   'replicator (console-feed fork)',
   'scheduler',
@@ -65,7 +66,7 @@ assert.deepEqual(consoleGroup?.components?.map(component => component.name).sort
   'stylis (Emotion fork)',
   'stylis-rule-sheet',
 ], 'Do not silently drop verified console component attribution')
-assert.equal(consoleGroup?.notices.length, 45, 'Missing reviewed console notice')
+assert.equal(consoleGroup?.notices.length, 47, 'Missing reviewed console notice')
 const vconsoleNotices = manifest.groups.find(group => group.name === 'vconsole')?.notices.map(notice => notice.target)
 for (const name of ['LICENSE', 'MIT-LICENSE', 'ATTRIBUTION.md'])
   assert(vconsoleNotices?.includes(`docs/licenses/vconsole/${name}`), `Missing vConsole notice: ${name}`)

scripts/site-vendor/README.md

@@ -23,7 +23,7 @@ files retain their exact upstream bytes, including final blank lines.
 `yarn check:site-notices`. The write command cannot bless altered vendor assets;
 review the new archive and license evidence before changing the manifest. The
 CLI prevents accidentally dropping any of the three groups, the ten reviewed
-Monaco/vConsole components, the 43 identified console components or their notice
+Monaco/vConsole components, the 44 identified console components or their notice
 count, and vConsole's original license, supplemental MIT body and attribution.
 Component references require their runtime assets and every notice before writing.
 Source notices
@@ -60,7 +60,7 @@ The desktop console's owned TS entry/view and lifecycle now build through
 `build:console` / `check:console`; see [console maintenance](console/README.md).
 Its other 100 Parcel modules remain frozen and now reproduce exactly from fixed
 archives, including the Parcel loader. Its package/loader licenses, two embedded
-headers, embedded dependency licenses and upstream author notices now ship as 45 files
+headers, embedded dependency licenses and upstream author notices now ship as 47 files
 under `docs/licenses/console/`. Full embedded
 attribution remains open; the generated index explicitly preserves that boundary.
 

scripts/site-vendor/console/README.md

@@ -197,8 +197,14 @@ minimal revision response, source and full license; the public attribution credi
 Alexander Mills and Rob W. A generated bundle comment retains the license and
 links even when the script is read separately from the site notice index.
 
-There are now 45 console notice outputs for 43 components. This includes a
+The shallowequal 1.1.0 README identifies react-pure-render as its code origin.
+The derived-attribution record freezes the original source and Dan Abramov MIT
+license at commit 729cdbd51df00068816376544738cc1fc4720cf2. These are verified with
+the same Git-content helper, alongside the published README and modified runtime
+member. Callback/context support and other changes prevent an exact-source claim;
+the public attribution explains that boundary and retains both authors' notices.
+
+There are now 47 console notice outputs for 44 components. This includes a
 CC BY-SA snippet; never describe the bundle as MIT-only. Final embedded-source
-and mixed-license distribution review remains open. The shallowequal 1.1.0 README
-explicitly identifies react-pure-render as its code origin; review that original
-notice before closing VENDOR-08. Exact Parcel module reproduction alone is insufficient.
+and mixed-license distribution review remains open. Exact Parcel module
+reproduction alone is insufficient to close VENDOR-08.

scripts/site-vendor/console/reproduce.ts

@@ -58,6 +58,7 @@ interface DerivedProvenance {
   stylis: { source: string, target: Member, dependency: Member, dependencyVersion: string, recipe: string }
   hash: { source: string, notice: EmbeddedNotice, reference: Member, references: string[] }
   cache: { reference: Member, upstreamUrl: string, notice: string }
+  shallow: { source: string, license: string, reference: Member, target: Member, upstreamUrl: string }
 }
 interface HistoricalTypeScript { version: string, transpileModule: (source: string, options: { compilerOptions: DerivedProvenance['compiler']['options'] }) => { outputText: string } }
 interface StackOverflowProvenance {
@@ -247,7 +248,7 @@ assert.deepEqual(compiler.options, { presets: [['es2015', { loose: true }]] }, '
 const transformedCount = verifyTransformedSources(tokenizer.sources, readEmbedded, source => legacyBabel.transform(source, compiler.options).code)
 assert.equal(transformedCount, 7, 'Incomplete tokenizer scope')
 const gitSources = new Map<string, Buffer>()
-assert.equal(derived.remotes.length, 5, 'Incomplete derived Git source scope')
+assert.equal(derived.remotes.length, 7, 'Incomplete derived Git source scope')
 for (const source of derived.remotes) {
   assert(!gitSources.has(source.id), 'Duplicate derived Git source')
   const bytes = fs.readFileSync(path.join(root, source.source))
@@ -288,6 +289,10 @@ const publicDomain = extractNotice(gitSource(derived.hash.source), derived.hash.
 assert.equal(fs.readFileSync(path.join(root, derived.hash.notice.source), 'utf8'), publicDomain, 'Public domain notice changed')
 assert(derivedMember(derived.cache.reference).toString('utf8').includes(derived.cache.upstreamUrl), 'Rule-sheet source attribution changed')
 assert(fs.readFileSync(path.join(root, derived.cache.notice), 'utf8').includes('Copyright (c) 2016 Sultan Tarimo'), 'Rule-sheet attribution missing')
+assert(derivedMember(derived.shallow.reference).toString('utf8').includes(derived.shallow.upstreamUrl), 'Shallowequal source attribution changed')
+assert(gitSource(derived.shallow.source).toString('utf8').startsWith('export default function shallowEqual('), 'Original shallowEqual source missing')
+assert(gitSource(derived.shallow.license).toString('utf8').includes('Copyright (c) 2015 Dan Abramov'), 'Original shallowEqual license missing')
+derivedMember(derived.shallow.target)
 const answerSnapshot = fs.readFileSync(path.join(root, stackOverflow.response.source))
 assert.equal(hash(answerSnapshot), stackOverflow.response.sha256, 'Frozen answer revision changed')
 const snippet = revisionSnippet(answerSnapshot, stackOverflow.revision)

scripts/site-vendor/manifest.json

@@ -1180,6 +1180,16 @@
           "source": "refactor/baselines/site-vendor/console-stackoverflow/ATTRIBUTION.txt",
           "target": "docs/licenses/console/stackoverflow/ATTRIBUTION.md",
           "sha256": "4ac7ae9b19a1201b6cfe6af1d35ec85d015a2de8fb1aac6b03796145e648a667"
+        },
+        {
+          "source": "refactor/baselines/site-vendor/console-attribution/react-pure-render-license.txt",
+          "target": "docs/licenses/console/react-pure-render/LICENSE",
+          "sha256": "65a1f00f35ea469048896fbfec3c5faed7d3fe7c7e0be2a0478470b59d9e1439"
+        },
+        {
+          "source": "refactor/baselines/site-vendor/console-attribution/react-pure-render-ATTRIBUTION.txt",
+          "target": "docs/licenses/console/react-pure-render/ATTRIBUTION.md",
+          "sha256": "9069fed07cc10fc36ef6b168ab0a75c3f1c882c077d5117b992f5c96d1eea0cc"
         }
       ],
       "components": [
@@ -1657,6 +1667,18 @@
             "docs/licenses/console/stackoverflow/SOURCE.js",
             "docs/licenses/console/stackoverflow/ATTRIBUTION.md"
           ]
+        },
+        {
+          "name": "react-pure-render (shallowequal origin)",
+          "version": "source commit 729cdbd",
+          "tarball": "https://github.com/gaearon/react-pure-render/blob/729cdbd51df00068816376544738cc1fc4720cf2/LICENSE",
+          "assets": [
+            "docs/assets/js/console.js"
+          ],
+          "notices": [
+            "docs/licenses/console/react-pure-render/LICENSE",
+            "docs/licenses/console/react-pure-render/ATTRIBUTION.md"
+          ]
         }
       ]
     }