build(site): [SITE-07] verify vConsole sources and complete notices

scripts/site-vendor/vconsole/README.md

@@ -50,8 +50,49 @@ test to reproduce failures; normal CI serves the candidate and expects no errors
 The scroller case holds zero-delay timers to force the late continuation while
 using native rendering, ResizeObserver and RAF; this is explicit fault injection.
 
-This patch does not claim complete upstream lifecycle coverage, device coverage,
-or permission clearance. The upstream LICENSE is distributed verbatim, but its
-missing MIT body and bundled dependency notices remain open in VENDOR-07/SITE-07.
-Do not replace or upgrade the bundle to resolve these issues without separately
-checking entrypoints, logging, CSS and the full dependency notices.
+This patch does not claim complete upstream lifecycle or device coverage. The
+notice set now preserves the original LICENSE, supplies its missing MIT body in a
+separate file, and includes the complete licenses of the verified bundled runtime
+components. Do not upgrade the bundle without reviewing entrypoints, logging,
+CSS and the new dependency notices.
+
+## Historical bundle reconstruction and notices
+
+`refactor/baselines/vconsole-notices-provenance.json` pins 81 original source/config
+files from the commit above, the upstream lockfile, nine notice-bearing component
+archives and the observed runtime resource paths. The original npm bundle was
+reproduced byte for byte using Node 24.21.0 and the frozen upstream npm lockfile.
+No upstream install scripts ran. This is an isolated historical reconstruction;
+ArtPlayer remains on Yarn Classic with its root yarn.lock.
+
+Prepare a checkout of the exact upstream commit inside `refactor/.cache/`, then
+run `npm ci --ignore-scripts --no-audit --no-fund` there. The 81 source/config files
+can also be fetched from fixed raw GitHub URLs using the recorded Git blob IDs
+and SHA-256 values when the source archive host is unavailable. Return to the
+ArtPlayer root and run:
+
+```powershell
+yarn verify:vconsole-source refactor/.cache/<upstream-checkout>
+```
+
+The helper checks every pinned input and dependency version before loading the
+upstream build configuration. It builds only in the ignored checkout, requires
+the exact npm bundle SHA-256, rejects hidden/truncated module statistics, and
+compares all dependency resources and webpack bootstrap modules to the reviewed
+notice set. It never copies the rebuilt bundle over ArtPlayer's patched asset.
+Upstream size warnings and its old Browserslist dataset remain visible; do not
+update the lockfile or dataset to silence them during historical reconstruction.
+
+The eight runtime packages are @babel/runtime, copy-text-to-clipboard, core-js,
+css-loader, mutation-observer, regenerator-runtime, style-loader and svelte.
+Only actual resource paths count: less-loader's appearance in a loader chain does
+not make it a runtime dependency. Webpack's four generated bootstrap modules also
+have a license entry. Mutation-observer's two BSD notices are both retained.
+Other packages' MIT licenses retain their own copyright holders.
+
+The published vConsole header explicitly links the MIT license. The upstream
+LICENSE omits its promised body, so ArtPlayer supplies `MIT-LICENSE` with that
+body and the original Tencent copyright, without pretending it came verbatim
+from the archive. `ATTRIBUTION.md` identifies this assembly, original sources and
+the local lifecycle modifications. These files and all dependency licenses are
+generated into `docs/licenses/vconsole/`; never edit the outputs by hand.

scripts/site-vendor/vconsole/reproduce.ts

@@ -0,0 +1,79 @@
+import assert from 'node:assert/strict'
+import { createHash } from 'node:crypto'
+import fs from 'node:fs'
+import { createRequire } from 'node:module'
+import path from 'node:path'
+import process from 'node:process'
+import { fileURLToPath } from 'node:url'
+
+interface Module {
+  name?: string
+  nameForCondition?: string
+  moduleType?: string
+  filteredChildren?: number
+  modules?: Module[]
+}
+interface Stats {
+  hasErrors: () => boolean
+  toJson: (options: Record<string, unknown>) => { modules: Module[], errors: unknown[], warnings: unknown[] }
+}
+interface Provenance {
+  upstream: { bundleSha256: string }
+  reconstruction: { sources: { path: string, sha256: string }[] }
+  dependencies: { name: string, version: string, runtimeResources: string[] }[]
+}
+
+const repository = fileURLToPath(new URL('../../../', import.meta.url))
+const cache = fs.realpathSync(path.join(repository, 'refactor/.cache'))
+assert.equal(process.argv.length, 3, 'Pass a prepared upstream checkout inside refactor/.cache')
+const checkout = fs.realpathSync(process.argv[2]!)
+assert(checkout.startsWith(`${cache}${path.sep}`), 'Reconstruction must stay inside the ignored cache')
+const provenance: Provenance = JSON.parse(fs.readFileSync(path.join(repository, 'refactor/baselines/vconsole-notices-provenance.json'), 'utf8'))
+const hash = (bytes: Uint8Array) => createHash('sha256').update(bytes).digest('hex')
+for (const source of provenance.reconstruction.sources) {
+  const filename = fs.realpathSync(path.join(checkout, source.path))
+  assert(filename.startsWith(`${checkout}${path.sep}`), 'Source must stay in the prepared checkout')
+  assert.equal(hash(fs.readFileSync(filename)), source.sha256, `Frozen source changed: ${source.path}`)
+}
+for (const dependency of provenance.dependencies) {
+  const manifest = JSON.parse(fs.readFileSync(path.join(checkout, 'node_modules', dependency.name, 'package.json'), 'utf8'))
+  assert.equal(manifest.version, dependency.version, `Installed version changed: ${dependency.name}`)
+}
+
+// The verified upstream config resolves aliases and compiler targets from cwd.
+process.chdir(checkout)
+const require = createRequire(path.join(checkout, 'package.json'))
+const config = require('./webpack.config.js')({ target: 'web' }, { mode: 'production' })
+
+const stats = await new Promise<Stats>((resolve, reject) => {
+  require('webpack')(config, (error: Error | null, result: Stats) => error ? reject(error) : resolve(result))
+})
+const report = stats.toJson({
+  all: true,
+  groupModulesByAttributes: false,
+  groupModulesByType: false,
+  groupModulesByPath: false,
+  groupModulesByCacheStatus: false,
+  groupModulesByExtension: false,
+  groupModulesByLayer: false,
+  modulesSpace: Infinity,
+  nestedModulesSpace: Infinity,
+  chunkModulesSpace: Infinity,
+})
+assert(!stats.hasErrors(), JSON.stringify(report.errors))
+assert.equal(hash(fs.readFileSync('dist/vconsole.min.js')), provenance.upstream.bundleSha256, 'Rebuilt bundle differs from the frozen npm bundle')
+const resources = new Set<string>()
+function visit(module: Module) {
+  assert(!module.filteredChildren, 'Webpack hid modules; this is incomplete provenance')
+  const resource = module.nameForCondition?.replaceAll('\\', '/')
+  if (resource?.includes('/node_modules/'))
+    resources.add(`node_modules/${resource.split('/node_modules/').pop()}`)
+  if (module.moduleType === 'runtime') {
+    assert(module.name)
+    resources.add(module.name)
+  }
+  module.modules?.forEach(visit)
+}
+report.modules.forEach(visit)
+assert.deepEqual([...resources].sort(), [...new Set(provenance.dependencies.flatMap(dependency => dependency.runtimeResources))].sort(), 'Bundled component resources differ from the reviewed notice set')
+console.log(JSON.stringify({ exactBundle: true, sha256: provenance.upstream.bundleSha256, resources: resources.size, notices: provenance.dependencies.length, warnings: report.warnings }))