diff --git a/refactor/README.md b/refactor/README.md
index 800500b7d..207d98775 100644
--- a/refactor/README.md
+++ b/refactor/README.md
@@ -37,6 +37,9 @@
| [任务数据](tasks.json) | 任务状态和依赖的唯一数据来源 |
| [包基线](package-inventory.json) | 包版本、入口、声明、源码清单及对应 demo 的初始快照 |
| [发布基线与重跑说明](baselines/README.md) | 固定 npm tarball、完整性及已知源码/发布差异 |
+| [差异与风险索引](risk-table.md) | 已复现问题、源码事实和待核实事项的责任任务 |
+| [风险维护说明](risk-guide.md) | 证据等级、关闭条件、第三方边界和校验命令 |
+| [第三方来源清单](third-party.json) | 依赖解析、vendor 文件指纹、SDK/CDN 与许可来源缺口 |
## 维护规则
diff --git a/refactor/changes/2026-09-10-BASE-07-risk-register.md b/refactor/changes/2026-09-10-BASE-07-risk-register.md
new file mode 100644
index 000000000..5107a3cc8
--- /dev/null
+++ b/refactor/changes/2026-09-10-BASE-07-risk-register.md
@@ -0,0 +1,19 @@
+# BASE-07：差异与第三方风险台账
+
+日期 2026-09-10；分支 codex/compatible-modernization；起点 e01f39ff。
+
+## 交付
+
+将 15 项已有基线发现与发布来源、站点/素材、vendor 和 SDK 缺口统一为 39 项风险，全部保留 open。逐项记录证据等级、后续任务、兼容处理路线与关闭条件，区分发布包问题和工作区已存在的修复，未把源码观察扩写成完整浏览器复现。
+
+第三方清单覆盖 22 包、9 个直接运行依赖的锁定版本和已安装许可证元数据、8 组内嵌资源的 123 个文件指纹以及 12 个集成边界。上游许可入口与本地来源不确定性分别记录；没有调用外部 SDK、广告、模型或 ASR 服务，没有宣称完成传递依赖/许可证审计。
+
+新增风险/来源校验器、生成索引及两项带负例的 Node 测试，自动并入现有 test:baseline。相关包、核心、站点与发布准入任务已补充接续验收条件。详见 [维护说明](../risk-guide.md)、[风险索引](../risk-table.md)、[机器台账](../risks.json) 与 [第三方清单](../third-party.json)。
+
+## 验证与接续
+
+风险校验和两项专门测试通过；完整 ci:check 通过工具链/计划/链接/只读 lint、21 项既有 Node 测试与 17 项基线测试，共 38 项，无失败或跳过。负例覆盖遗漏基线发现、无任务责任、无证据关闭、越界证据、遗漏包/vendor/SDK、指纹变化与错误锁定版本。没有修改生产源码、声明、依赖或构建产物。
+
+本任务独立本地提交，主题含 BASE-07；不推送/发布。撤销本提交可移除新增台账和校验，原有基线报告不受影响。下一项 BASE-08 完成环境与能力验证矩阵，随后进入必要 TS 工程配置和 chapter 试点；未完成的真机/SDK 验证明确留给对应任务，不阻塞无关源码工作的启动。
+
+用户要求明确报告源码重构进度：截至本任务，生产源码 TS 迁移为零；基础设施和文档任务完成数不能代表源码迁移比例。后续进度必须分别说明。
diff --git a/refactor/plan.md b/refactor/plan.md
index 7b794ec4b..a6bb3ce4f 100644
--- a/refactor/plan.md
+++ b/refactor/plan.md
@@ -4,7 +4,7 @@
基线：`40fcda6a37d0049d42e49c1e64e70d4fd9ba5f7f`。总任务 214 项，范围 22 个包及工作区/示例。
-状态：todo 191 / doing 0 / blocked 0 / done 23 / deferred 0。风险 L/M/H 表示兼容风险，不表示工期。
+状态：todo 190 / doing 0 / blocked 0 / done 24 / deferred 0。风险 L/M/H 表示兼容风险，不表示工期。
前置依赖是启动条件；验收是完成条件。任务可以继续拆分，但不能复用或悄悄删除旧 ID。
@@ -66,7 +66,7 @@
| BASE-04 | workspace
捕获 DOM、CSS 和官方 demo | BASE-02 | 核心模板/类名/变量、键盘/焦点/可访问名称基线及全 demo 路径映射；docs-browser-testing.md 中 HTML/编辑器的脚本来源与存储状态；登记契约/版本/固定测试 ID/命令/报告与负责任务 | 核心/试点用户样式和输入用法已记录，其他 demo 运行状态与未知项明确；使用已发布包和最小可重跑探针启动，不等待后续 ENG 服务 | M | done |
| BASE-05 | workspace
捕获包入口、资源和类型消费 | BASE-01 | 全包 manifest/资源路径清单；核心/试点的 UMD/AMD/ESM/CJS/legacy/i18n 和类型消费者基线；登记契约/版本/固定测试 ID/命令/报告与负责任务；区分库/npm 与站点实际分发类别，SSR import/模板/非浏览器构造错误分别捕获 | 核心/试点隔离消费可运行，其他包由各自契约任务验证，thumbnail tool 差异已登记 | H | done |
| BASE-06 | workspace
记录性能与资源基线 | BASE-03, BASE-04 | 固定媒体/设备测量、包体积、反复装卸资源报告 | 多次采样可重跑，指标和审查阈值确定，不承诺未经测量的收益；使用已发布包和最小可重跑探针启动，不等待后续 ENG 服务 | M | done |
-| BASE-07 | workspace
建立差异和风险台账 | BASE-03, BASE-05 | 销毁/切源/类型差异、vendored 许可和外部 SDK 清单 | 已确认与待复现分开，每项有负责任务及兼容处理路线；纳入 BASE-TYPE-01/02/03/04 和 BASE-DIST-01 的发布/声明/工作区证据；纳入 BASE-PERF-01 销毁后 resize/notice 延迟工作 | H | todo |
+| BASE-07 | workspace
建立差异和风险台账 | BASE-03, BASE-05 | 销毁/切源/类型差异、vendored 许可和外部 SDK 清单 | 已确认与待复现分开，每项有负责任务及兼容处理路线；纳入 BASE-TYPE-01/02/03/04 和 BASE-DIST-01 的发布/声明/工作区证据；纳入 BASE-PERF-01 销毁后 resize/notice 延迟工作 | H | done |
| BASE-08 | workspace
建立消费者与真实环境验证矩阵 | BASE-01, BASE-05 | 每包版本/浏览器/codec/SDK/设备/样本、证据和负责验证任务的矩阵 | 格式兼容与运行能力分开，未知/缺环境不算通过，明确哪些检查阻止哪些批次发布 | H | todo |
## 2 工程保障
@@ -83,7 +83,7 @@
| ENG-07 | workspace
建立 tarball 消费与产物检查 | ENG-04, ENG-06 | 隔离 npm 消费 fixtures、API/声明/入口差分 | 不借 workspace 源码通过，能识别缺文件与默认导出变化 | H | todo |
| ENG-08 | workspace
增加覆盖率、资源与性能报告 | ENG-03, ENG-05, BASE-06 | 覆盖率基线、资源清理断言、性能报告与阈值 | 关键生命周期分支有门槛，报告不靠无意义断言堆数量；将 BASE-06 的同环境多组配对、计时/压缩审查阈值与资源异常分开接入候选，不把历史现象冻结成正常要求 | M | todo |
| ENG-09 | workspace
建立全包依赖影响和文档检查 | ENG-07, DOC-04 | 共享核心/构建影响映射、文档及每任务完成提交的 Git 审计接入；契约-支持版本-测试 ID-命令-候选/报告-任务的覆盖索引 | 核心变化触发必需生态检查；原有 DOC-01 至 04 基线例外明确，后续 done 任务不能缺失独立 commit；计划/已执行/缺证据分开，识别缺少验证归属的公开契约 | M | todo |
-| ENG-10 | workspace
建立历史失败分级和测试可靠性规则 | ENG-03, ENG-04, ENG-05, ENG-07, BASE-07 | 历史失败 ID/环境/旧版复现/负责修复任务、逐模块门槛、受控等待与 trace/retry 规则 | 不靠全局忽略或无理由 skip 隐藏问题，新增回归阻止交付，设备缺口和偶发失败单独可见 | M | todo |
+| ENG-10 | workspace
建立历史失败分级和测试可靠性规则 | ENG-03, ENG-04, ENG-05, ENG-07, BASE-07 | 历史失败 ID/环境/旧版复现/负责修复任务、逐模块门槛、受控等待与 trace/retry 规则 | 不靠全局忽略或无理由 skip 隐藏问题，新增回归阻止交付，设备缺口和偶发失败单独可见；以 risks.json 为统一差异索引；关闭必须有 resolutionEvidence/rationale，已复现、源码事实、未验证分开，登记不等于豁免 | M | todo |
## 2.2 GitHub CI/CD
@@ -115,7 +115,7 @@
| CORE-09 | artplayer
整理 URL 与切源操作 | CORE-04, CORE-06, CORE-08 | url/switch/customType 的操作身份及取消方案 | 并发切源、错误、同 URL、销毁和 Promise 结算有契约；处理 baselines/lifecycle-coverage.md 的 BASE-LIFE-01/02/06 并增加候选正向回归 | H | todo |
| CORE-10 | artplayer
迁移播放与时间/状态属性 | CORE-09 | play/pause/toggle/seek/volume/rate/duration 等模块 | 旧返回值、拒绝、mutex、位置恢复、属性描述符与事件通过 | H | todo |
| CORE-11 | artplayer
整理媒体事件、ready 与重连 | CORE-10 | 媒体转发、重连、UI 响应职责分离 | readiness 次数/顺序、过期重连、原错误参数有回归 | H | todo |
-| CORE-12 | artplayer
迁移模板及公开资源入口 | CORE-06, CORE-04, BASE-04 | template/icons/i18n/style、SSR 与 proxy 挂载 | DOM/CSS/global/样式注入、i18n 子路径及 SSR import 保持；不把 SSR import/useSSR 保持扩大为服务端构造播放器；复跑 BASE-05 的 SSR import/模板、浏览器 useSSR 节点复用和非浏览器构造错误 | H | todo |
+| CORE-12 | artplayer
迁移模板及公开资源入口 | CORE-06, CORE-04, BASE-04 | template/icons/i18n/style、SSR 与 proxy 挂载 | DOM/CSS/global/样式注入、i18n 子路径及 SSR import 保持；不把 SSR import/useSSR 保持扩大为服务端构造播放器；复跑 BASE-05 的 SSR import/模板、浏览器 useSSR 节点复用和非浏览器构造错误；接续 VENDOR-01/02，核对 screenfull/hint 复制版本、修改与分发通知，保留 DOM/CSS/fullscreen 行为 | H | todo |
| CORE-13 | artplayer
迁移组件注册与控件 | CORE-12, CORE-08 | Component/control/layer/contextmenu 的资源与 TS 边界 | add/update/remove、name、selector、mounted/beforeUnmount 通过；处理 BASE-DOM-02 窄容器控件裁切，保留 controls.update 的旧 undefined 返回值 | H | todo |
| CORE-14 | artplayer
拆分设置树、渲染和布局 | CORE-13 | setting model/selection/render/layout 的分批实现 | 不强行统一控件返回值，嵌套选择、默认高亮、更新清理通过；结合 BASE-DOM-02 验证窄容器设置定位 | H | todo |
| CORE-15 | artplayer
迁移字幕获取、解析和渲染 | CORE-11, CORE-13 | subtitle 请求/track/DOM/URL 生命周期与类型 | 过期结果、偏移、cue 数组、原生全屏及错误路径通过 | H | todo |
@@ -209,7 +209,7 @@
| ID | 范围 / 步骤 | 前置依赖 | 交付物 | 验收条件 | 风险 | 状态 |
| --- | --- | --- | --- | --- | --- | --- |
-| PKG-MULTI-SUB-01 | artplayer-plugin-multiple-subtitles
核对包契约与历史用法 | BASE-05 | subtitles/onParser、multipleSubtitles 名称及实际返回方法 | 源码/声明/README/demo/发布包差异已登记；公开形状和版本范围冻结 | H | todo |
+| PKG-MULTI-SUB-01 | artplayer-plugin-multiple-subtitles
核对包契约与历史用法 | BASE-05 | subtitles/onParser、multipleSubtitles 名称及实际返回方法 | 源码/声明/README/demo/发布包差异已登记；公开形状和版本范围冻结；接续 VENDOR-03，定位 WebVTT parser 来源/修订及 CC0 头，保留解析/序列化行为 | H | todo |
| PKG-MULTI-SUB-02 | artplayer-plugin-multiple-subtitles
建立特有行为与错误测试 | PKG-MULTI-SUB-01, ENG-03, ENG-05 | VTT/SRT/ASS、编码/重叠 cue/排序/空轨/失败与切换 | 旧版本行为可重跑，成功/失败/切源/销毁有必要断言 | H | todo |
| PKG-MULTI-SUB-03 | artplayer-plugin-multiple-subtitles
整理内部职责与资源 | PKG-MULTI-SUB-02, CORE-15 | 解析与合并/获取/渲染分离，过期请求及对象 URL 清理 | 结构变化和缺陷修复分开记录；原 API/事件/资源生命周期通过 | H | todo |
| PKG-MULTI-SUB-04 | artplayer-plugin-multiple-subtitles
迁移自有源码和公开类型 | PKG-MULTI-SUB-03, ENG-04, ENG-06, CORE-07 | 准确 parser/cue/tree/result 类型与真实异步形状 | 严格类型检查、旧消费样例通过；声明路径/导出和同步异步兼容 | H | todo |
@@ -220,7 +220,7 @@
| ID | 范围 / 步骤 | 前置依赖 | 交付物 | 验收条件 | 风险 | 状态 |
| --- | --- | --- | --- | --- | --- | --- |
-| PKG-JASSUB-01 | artplayer-plugin-jassub
核对包契约与历史用法 | BASE-05 | 选项透传、result.instance、vendor 来源、worker/WASM/font 路径 | 源码/声明/README/demo/发布包差异已登记；公开形状和版本范围冻结 | H | todo |
+| PKG-JASSUB-01 | artplayer-plugin-jassub
核对包契约与历史用法 | BASE-05 | 选项透传、result.instance、vendor 来源、worker/WASM/font 路径 | 源码/声明/README/demo/发布包差异已登记；公开形状和版本范围冻结；接续 VENDOR-04/05，核对 wrapper/worker/WASM/font 的独立来源与通知，保持资源路径和选项透传 | H | todo |
| PKG-JASSUB-02 | artplayer-plugin-jassub
建立特有行为与错误测试 | PKG-JASSUB-01, ENG-03, ENG-05 | ASS 字体、时钟/seek/倍率/resize、加载失败和销毁 | 旧版本行为可重跑，成功/失败/切源/销毁有必要断言 | H | todo |
| PKG-JASSUB-03 | artplayer-plugin-jassub
整理内部职责与资源 | PKG-JASSUB-02, CORE-15, CORE-16 | 仅整理自有 adapter/销毁；保留第三方文件及来源 | 结构变化和缺陷修复分开记录；原 API/事件/资源生命周期通过 | H | todo |
| PKG-JASSUB-04 | artplayer-plugin-jassub
迁移自有源码和公开类型 | PKG-JASSUB-03, ENG-04, ENG-06, CORE-07 | JASSUB option/instance 的兼容类型包装，vendor JS 例外记录 | 严格类型检查、旧消费样例通过；声明路径/导出和同步异步兼容 | H | todo |
@@ -231,7 +231,7 @@
| ID | 范围 / 步骤 | 前置依赖 | 交付物 | 验收条件 | 风险 | 状态 |
| --- | --- | --- | --- | --- | --- | --- |
-| PKG-MASK-01 | artplayer-plugin-danmuku-mask
核对包契约与历史用法 | BASE-05 | 模型参数、start/stop、默认下载路径及 mask 样式 | 源码/声明/README/demo/发布包差异已登记；公开形状和版本范围冻结 | H | todo |
+| PKG-MASK-01 | artplayer-plugin-danmuku-mask
核对包契约与历史用法 | BASE-05 | 模型参数、start/stop、默认下载路径及 mask 样式 | 源码/声明/README/demo/发布包差异已登记；公开形状和版本范围冻结；接续 SDK-08，分别核实 Yarn 解析版本、未固定版本的模型 solutionPath 和资源来源 | H | todo |
| PKG-MASK-02 | artplayer-plugin-danmuku-mask
建立特有行为与错误测试 | PKG-MASK-01, ENG-03, ENG-05 | 加载期间停止/销毁、重复启动、推理失败、WebGL/CPU 边界 | 旧版本行为可重跑，成功/失败/切源/销毁有必要断言 | H | todo |
| PKG-MASK-03 | artplayer-plugin-danmuku-mask
整理内部职责与资源 | PKG-MASK-02, CORE-18, PKG-DANMUKU-07 | 模型加载/推理/画布输出分离，阻止重叠推理与过期写入 | 结构变化和缺陷修复分开记录；原 API/事件/资源生命周期通过 | H | todo |
| PKG-MASK-04 | artplayer-plugin-danmuku-mask
迁移自有源码和公开类型 | PKG-MASK-03, ENG-04, ENG-06, CORE-07 | 模型 adapter、canvas 和选项的精确类型 | 严格类型检查、旧消费样例通过；声明路径/导出和同步异步兼容 | H | todo |
@@ -322,7 +322,7 @@
| ID | 范围 / 步骤 | 前置依赖 | 交付物 | 验收条件 | 风险 | 状态 |
| --- | --- | --- | --- | --- | --- | --- |
-| PKG-MB-01 | artplayer-proxy-mediabunny
核对 shim 与媒体契约 | BASE-05 | 全部 option、art.mediabunny、canvas/shim 属性及事件表 | 公开暴露成员和实际发布依赖/资源范围明确 | H | todo |
+| PKG-MB-01 | artplayer-proxy-mediabunny
核对 shim 与媒体契约 | BASE-05 | 全部 option、art.mediabunny、canvas/shim 属性及事件表 | 公开暴露成员和实际发布依赖/资源范围明确；核实 third-party.json 所记录依赖 MPL-2.0 元数据与实际 bundle 的许可/通知范围，不从根 MIT 推断 | H | todo |
| PKG-MB-02 | artplayer-proxy-mediabunny
建立真实媒体与事件基线 | PKG-MB-01, ENG-05, ENG-08 | MP4/WebM/HLS/Blob/Stream、seek/错误/轨道切换样本 | ready 事件顺序、音画同步、超时和释放可重跑 | H | todo |
| PKG-MB-03 | artplayer-proxy-mediabunny
整理 input 与加载取消 | PKG-MB-02, CORE-09 | input.js 源检测、输入资源、Range 与取消 | HLS 检测在 input 边界，旧来源类型和超时保持 | H | todo |
| PKG-MB-04 | artplayer-proxy-mediabunny
整理 VideoShim/EventTarget/Engine 协调 | PKG-MB-03, CORE-06, CORE-11 | shim 描述符、事件桥、加载状态和操作隔离 | 公开属性/同步异步返回与事件重入顺序保持 | H | todo |
@@ -359,7 +359,7 @@
| ID | 范围 / 步骤 | 前置依赖 | 交付物 | 验收条件 | 风险 | 状态 |
| --- | --- | --- | --- | --- | --- | --- |
-| SITE-01 | artplayer-vitepress
清点文档/示例/生成链 | BASE-04, BASE-05 | 中英文文档、插件页面、demo URL、编辑器声明与生成目录清单；六类 HTML 入口、prod/libs/code/example 加载行为及移动重定向 | 所有公开 API/插件有对应页面或明确补充任务；核实 BASE-DEMO-01 的历史 thumbnail 插件来源及 29 示例/36 HTML 路径；明确 BASE-05 所记录站点实际分发与未设 private 的 manifest 意图 | M | todo |
+| SITE-01 | artplayer-vitepress
清点文档/示例/生成链 | BASE-04, BASE-05 | 中英文文档、插件页面、demo URL、编辑器声明与生成目录清单；六类 HTML 入口、prod/libs/code/example 加载行为及移动重定向 | 所有公开 API/插件有对应页面或明确补充任务；核实 BASE-DEMO-01 的历史 thumbnail 插件来源及 29 示例/36 HTML 路径；明确 BASE-05 所记录站点实际分发与未设 private 的 manifest 意图；接续 VENDOR-05/06/07/08 和 BASE-SITE-01/BASE-MEDIA-01，核对字体、Monaco、vConsole、console bundle 与样本来源及分发范围 | M | todo |
| SITE-02 | artplayer-vitepress
整理声明与示例生成器 | SITE-01, ENG-04, ENG-06 | build-ts/build-test 生成链的可验证 TS 脚本 | 不靠字符串拼接掩盖声明错误，生成示例有真实断言或仅标 smoke；替换固定 100ms 成功判定，明确异步错误、清理和生成覆盖限制 | M | todo |
| SITE-03 | artplayer-vitepress
整理 i18n/文档/LLM 生成流程 | SITE-02 | build-i18n/build-docs/build-llm/trans-docs 的任务边界和错误处理 | 原命令兼容、生成可复现，翻译步骤不隐式运行远程服务 | M | todo |
| SITE-04 | artplayer-vitepress
交叉核对逐包持续维护的文档 | CORE-21, SITE-03, PKG-CHAPTER-04, PKG-AMBILIGHT-04, PKG-AUDIO-04, PKG-AUTO-THUMB-04, PKG-VTT-THUMB-04, PKG-HLS-04, PKG-DASH-04, PKG-MULTI-SUB-04, PKG-JASSUB-04, PKG-MASK-04, PKG-ASR-04, PKG-ADS-04, PKG-VAST-04, PKG-CAST-04, PKG-DPIP-04, PKG-CANVAS-04, PKG-IFRAME-04, PKG-TOOL-THUMB-04, PKG-DANMUKU-06, PKG-MB-08 | 已随实现更新的中文/英文 API、包内实现地图、旧 JS 示例及已知能力限制的全包核对 | 未把缺环境的能力写成已验证，静态核对不等待设备任务；最终 demo 仍由 EX-03 验收 | M | todo |
@@ -383,7 +383,7 @@
| ID | 范围 / 步骤 | 前置依赖 | 交付物 | 验收条件 | 风险 | 状态 |
| --- | --- | --- | --- | --- | --- | --- |
-| REL-08 | workspace
提前建立逐包发布准入台账 | BASE-08, ENG-07 | 每批包/版本/源码/锁文件/工具/tarball integrity、必需测试/设备证据、限制和回退映射 | 受影响能力缺证据明确阻止对应批次；无关批次可独立准备，旧证据在候选内容变化后失效；站点采用真实构建/URL/资源验收，npm 分发依据历史核实，不从版本清单推断新增发布范围 | H | todo |
+| REL-08 | workspace
提前建立逐包发布准入台账 | BASE-08, ENG-07 | 每批包/版本/源码/锁文件/工具/tarball integrity、必需测试/设备证据、限制和回退映射 | 受影响能力缺证据明确阻止对应批次；无关批次可独立准备，旧证据在候选内容变化后失效；站点采用真实构建/URL/资源验收，npm 分发依据历史核实，不从版本清单推断新增发布范围；关联 risks.json 和 third-party.json；受影响 bundle/worker/WASM/font/模型的来源与许可通知缺口必须有审查结论，未决项阻止对应批次 | H | todo |
| REL-01 | workspace
提前确定分包版本与差异方案 | REL-08, CORE-21, SITE-03, PKG-CHAPTER-04, PKG-AMBILIGHT-04, PKG-AUDIO-04, PKG-AUTO-THUMB-04, PKG-VTT-THUMB-04, PKG-HLS-04, PKG-DASH-04, PKG-MULTI-SUB-04, PKG-JASSUB-04, PKG-MASK-04, PKG-ASR-04, PKG-ADS-04, PKG-VAST-04, PKG-CAST-04, PKG-DPIP-04, PKG-CANVAS-04, PKG-IFRAME-04, PKG-TOOL-THUMB-04, PKG-DANMUKU-06, PKG-MB-08 | 每包版本/变更日志/依赖/类型差异方案和独立准入状态；按 version-policy.md 冻结各包下一 major（minor/patch 归零）并核实 registry 占用 | 所有包有方案和剩余门槛，未决项明确阻止相应发布；本步骤不声称已经可发布；全部包有 major 目标，版本冲突明确处理，独立准备任务同步 manifest/锁/依赖/日志；按 BASE-05 区分 21 库与文档站分发，不机械把文档站当库上传 npm | H | todo |
| REL-09 | workspace
落实全包下一 major 版本及依赖元数据 | REL-01, DOC-11 | 22 包版本目标落实、适用锁文件/依赖范围/示例/变更日志同步，核实 registry 版本占用 | 版本与 policy 一致，旧核心支持保留；必要拆子任务各自提交，候选构建前完成，不执行 publish | H | todo |
| REL-02 | workspace
生成候选 tarball 并验证新旧组合 | REL-01, CORE-22, ENG-07, REL-09 | 各候选本地 tarball/integrity 与新旧核心/插件消费者验证报告，外部门槛单独标注 | 隔离安装和可自动化组合通过；设备结论不伪造，最终发布绑定同一候选内容；在目标 major 版本确定后构建 pack，不在测试后改版本 | H | todo |
@@ -423,6 +423,7 @@
- BASE-04: [记录](changes/2026-09-10-BASE-04-dom.md) [记录](baselines/dom.json) [记录](baselines/dom-coverage.md) [记录](baselines/demo-inventory.json)
- BASE-05: [记录](changes/2026-09-10-BASE-05-consumers.md) [记录](baselines/consumer-coverage.md) [记录](baselines/consumers.json) [记录](baselines/ssr.json) [记录](baselines/distribution.json)
- BASE-06: [记录](changes/2026-09-10-BASE-06-performance.md) [记录](baselines/performance-coverage.md) [记录](baselines/performance.json) [记录](baselines/sizes.json)
+- BASE-07: [记录](changes/2026-09-10-BASE-07-risk-register.md) [记录](risk-guide.md) [记录](risk-table.md) [记录](risks.json) [记录](third-party.json)
- ENG-01: [记录](changes/2026-09-10-ENG-01-reproducible-toolchain.md) [记录](baselines/toolchain-validation.json)
- ENG-PM-01: [记录](changes/2026-09-10-ENG-PM-01-yarn-toolchain.md) [记录](baselines/yarn-validation.json)
- ENG-02: [记录](changes/2026-09-10-ENG-02-readonly-ci.md) [记录](baselines/ci-validation.json)
diff --git a/refactor/progress.md b/refactor/progress.md
index 34bff26b0..57ffffc65 100644
--- a/refactor/progress.md
+++ b/refactor/progress.md
@@ -1,5 +1,11 @@
# 进度与证据
+## 当前实施：BASE-07 风险与第三方来源台账完成
+
+39 项差异/来源缺口已关联责任任务、证据与关闭条件，22 包运行依赖、8 组内嵌资源（123 个文件）及 12 个集成边界可校验。全部风险仍 open，不能把清点完成视为已修复或获准发布。见 [BASE-07](changes/2026-09-10-BASE-07-risk-register.md)。
+
+当前 214 项任务，24 完成、190 待办。生产源码 TS 迁移仍为零；已完成工作主要是规划、工程流程与基线，后续继续单独报告源码迁移进度。BASE-06 已提交 e01f39ff；本轮独立提交 BASE-07。下一任务 BASE-08，随后进入必要 TS 工程配置和 chapter 试点；没有推送或发布。
+
## 当前实施：BASE-06 性能与资源基线完成
内置浏览器两轮各 12 个计时样本和 6 组资源探针已保存；真实播放及基本清理通过，同时复现销毁后 resize 防抖重新安排 notice timer，已分配 CORE-17/04/18。28 个发布 JS 与 85 个工作区 JS 的压缩体积独立记录。阈值只用于复测/审查，无生产优化或无内存泄漏结论。见 [BASE-06](changes/2026-09-10-BASE-06-performance.md)。
diff --git a/refactor/risk-guide.md b/refactor/risk-guide.md
new file mode 100644
index 000000000..ff1da5dee
--- /dev/null
+++ b/refactor/risk-guide.md
@@ -0,0 +1,53 @@
+# 差异、第三方来源与关闭证据
+
+BASE-07 将先前基线发现和第三方来源缺口纳入同一份责任台账。入口为 [风险索引](risk-table.md)、[完整处理与关闭条件](risks.json) 和 [第三方清单](third-party.json)。任务完成代表清点和接续规则建立，不代表其中的问题已经修复。
+
+## 如何读取状态
+
+39 项目前均为 open。reproduced 表示已保存复现结果；source-observed 表示在源码、声明或产物中看到事实；unverified 表示来源、环境或行为仍需取证。证据等级与处理状态互相独立，不能把 39 项全部称为缺陷，也不能因建立了测试基线而自动接受旧缺陷。
+
+其中 15 项来自生命周期、DOM/示例、消费者类型/分发和性能基线；其余包含发布来源、站点分发、素材来源、8 组内嵌资源和 12 个集成边界。每项都列出负责的任务 ID、证据路径、兼容处理路线与关闭条件。具体复现仍以原基线报告为准。
+
+特别注意 BASE-LIFE-06：已发布包的恢复播放拒绝问题不等于当前源码仍然相同。当前 switchMix 使用 silencePromise，已有 playback 测试；迁移必须保留该修复，再对候选进行验证。BASE-TYPE-04 同时涉及 plugins.add 和 toggle，浏览器直接复现、当前源码及类型测试的覆盖不同，不声称每个子差异都独立做过浏览器复现。
+
+resolved 或 accepted-with-scope 必须提供 resolutionEvidence 和 resolutionRationale。校验器检查文件与字段存在；负责人仍须审查证据是否满足对应 closureCriteria。范围接受需要说明受影响能力、有效环境和发布限制，不能用于全局忽略测试、默认放宽兼容契约或掩盖缺少真机证据。ENG-10 接续历史失败分类，REL-08 将未关闭事项映射到受影响的发布批次。
+
+## 清单范围与来源
+
+第三方清单覆盖 22 包的 manifest 依赖，记录 9 个直接运行依赖在当前 yarn.lock 与本地安装中的版本、许可证元数据。文档包的开发依赖另列；根目录私有工具链由工程任务维护。这不是完整传递依赖 SBOM，也不是完整许可证或安全审计。
+
+当前 Mediabunny 解析为 1.56.1，其已安装 manifest 声明 MPL-2.0。TensorFlow 四个直接依赖解析为 4.22.0，不能把声明范围 ^4.21.0 写成实际安装版本。依赖元数据仅是来源证据，实际 bundle 所含代码、NOTICE、源码提供方式等仍由相应包任务核实。
+
+8 组内嵌资源保存 123 个文件指纹：screenfull、hint.less、WebVTT parser、JASSUB wrapper/worker/WASM、JASSUB 字体、Monaco 静态文件、vConsole 和 console bundle。文本按 LF 计算 SHA-256，二进制直接计算；这些指纹用于识别变化，不证明来源或重新分发许可。并未穷举仓库所有视频、图片、模型和字体，剩余样本来源由 BASE-MEDIA-01、SITE-01 和具体集成任务接续。
+
+已核对的上游入口如下，但当前上游分支不能证明本地复制文件的精确版本、修改历史或全部组成：
+
+| 内容 | 当前证据与后续核实 |
+| --- | --- |
+| screenfull | 上游 [MIT license](https://github.com/sindresorhus/screenfull/blob/main/license)；本地缺少版本/许可证头，需定位版本与本地差异 |
+| Hint.css | 本地头标 2.7.0，已改为 Less；上游 [MIT license](https://github.com/chinchang/hint.css/blob/master/LICENSE)，仍需核对修改与分发通知 |
+| WebVTT parser | 本地保留公共领域/CC0 头；[上游项目](https://github.com/w3c/webvtt.js) 标明 CC0，精确 revision 待定 |
+| JASSUB | [上游 wrapper 许可证](https://github.com/ThaUnknown/jassub/blob/main/LICENSE) 为 MIT；worker/WASM 的库组成、构建来源和字体必须分别核实 |
+| Monaco/vConsole | 本地头标 Monaco 0.30.1、vConsole 3.15.0 及 MIT；Monaco bundle 还包含 DOMPurify 通知，完整组成和 notices 待核对 |
+| console bundle | 可见 Parcel/console-feed 特征，原始构建、版本与组成待定位；不从根 MIT 推导结论 |
+
+12 个集成边界分别为 HLS、DASH、FLV、MPEG-TS、WebTorrent、Cast、IMA、MediaPipe/TensorFlow、JASSUB、Mediabunny、调用方 ASR 服务和 option-validator。清单区分运行依赖、调用方对象、CDN 动态脚本及 worker/model/font URL。Yarn 锁定不能锁住没有固定版本的远端 solutionPath。
+
+ASR 插件向调用方回调输出 PCM，插件本身没有内置 ASR SDK；示例才调用远端服务取得 WebSocket 地址。本次只检查代码，没有访问该服务或其他 SDK/广告/模型运行服务。源码中出现 URL 不等于 SDK、设备、网络或媒体能力已通过测试；BASE-08 接续能力与环境矩阵。
+
+## 迁移与维护方式
+
+1. 先读取对应风险的关闭条件与负责任务，再修改生产实现。历史缺陷可修复，但要明确候选行为、老用法兼容性和回归证据。
+2. 第三方复制代码保持独立边界；优先为调用层建立 TS 类型与适配器。不要把上游压缩代码机械拆分或转写成 TS。替换 vendor 时记录原/新版本、源地址、差异、通知文件和受影响测试。
+3. worker/WASM/font 路径、构造参数、返回实例、DOM/CSS 和媒体事件仍受兼容契约保护。文档静态资源更新也需验证现有编辑器、移动入口和示例。
+4. 有意修改包依赖、vendor 内容或集成范围时，同任务更新 third-party.json 及风险证据；重新计算指纹前先审查差异，不以重写指纹绕过检查。保留 Git 历史中的初始快照。
+5. 修改 risks.json 后运行以下命令生成索引并检查，完成任务时同时提交实现、测试、记录和任务表。
+
+```sh
+node refactor/scripts/risk-register.mjs --write
+node refactor/scripts/risk-register.mjs --check
+node refactor/scripts/plan.mjs --write
+yarn ci:check
+```
+
+校验已包含在 test:baseline 中：保护既有基线发现、任务引用、证据路径、生成索引、包覆盖、依赖解析和内嵌文件指纹。负例覆盖漏项、错误任务、无证据关闭、越界路径、错误哈希和锁文件版本偏移。它不能自动发现所有新的第三方文件或判定许可证合规，新增资源仍须进入人工/AI 审查与包任务验收。
diff --git a/refactor/risk-table.md b/refactor/risk-table.md
new file mode 100644
index 000000000..b66e7ae73
--- /dev/null
+++ b/refactor/risk-table.md
@@ -0,0 +1,45 @@
+# 重构风险与差异索引
+
+由 risks.json 生成；运行 node refactor/scripts/risk-register.mjs --write 更新。状态 open 表示尚缺关闭证据，不等于每项都是已复现缺陷。处理方案、关闭条件与证据见 [机器台账](risks.json)，来源与范围见 [维护说明](risk-guide.md)。
+
+| ID | 状态 / 证据等级 | 条目 | 后续任务 |
+| --- | --- | --- | --- |
+| BASE-LIFE-06 | open / 已复现 | Published switch leaves an unhandled rejection and an unsettled promise when resume fails | CORE-09 |
+| BASE-LIFE-01 | open / 已复现 | Superseded switch resolves along with the latest source | CORE-09 |
+| BASE-LIFE-02 | open / 已复现 | Switch remains unsettled during the bounded observation after destroy | CORE-09 |
+| BASE-LIFE-03 | open / 已复现 | Async plugin registers its result after destroy | CORE-08 |
+| BASE-LIFE-04 | open / 已复现 | Destroying an instance twice unregisters a different live instance | CORE-04 |
+| BASE-LIFE-05 | open / 已复现 | Failed constructor leaves initialized markup/listeners until explicit probe cleanup | CORE-04 |
+| BASE-DOM-01 | open / 已复现 | 控件 Tab 不可达 | CORE-23, CORE-17 |
+| BASE-DOM-02 | open / 已复现 | 窄容器中控件裁切 | CORE-13, CORE-14 |
+| BASE-DEMO-01 | open / 源码/产物事实 | 旧 thumbnail 插件示例不对应当前 workspace 包 | SITE-01, EX-03 |
+| BASE-TYPE-01 | open / 已复现 | NodeNext ESM 默认导出与声明互操作失配 | ENG-04, CORE-07, PKG-CHAPTER-04 |
+| BASE-TYPE-02 | open / 已复现 | chapter 可选运行时参数被声明为必填 | PKG-CHAPTER-02 |
+| BASE-TYPE-03 | open / 已复现 | chapter legacy 缺旧模块解析的声明回退 | ENG-04, PKG-CHAPTER-04 |
+| BASE-TYPE-04 | open / 源码/产物事实 | plugins.add / toggle 的旧声明返回值与运行时不同 | CORE-07 |
+| BASE-DIST-01 | open / 源码/产物事实 | thumbnail tool 分发入口与类型文件缺失 | PKG-TOOL-THUMB-01, PKG-TOOL-THUMB-04 |
+| BASE-PERF-01 | open / 已复现 | 销毁后的 resize 防抖重新创建 notice timer | CORE-17, CORE-04, CORE-18 |
+| BASE-SOURCE-01 | open / 源码/产物事实 | 工作区 5.4.1 与采集时真实发布 5.4.0 不同 | BASE-08, REL-01 |
+| BASE-SOURCE-02 | open / 源码/产物事实 | registry gitHead 与发布包版本对应不可靠 | ENG-07, REL-01 |
+| BASE-SITE-01 | open / 源码/产物事实 | 文档站实际为静态站点但 manifest 未设 private | SITE-01, REL-01 |
+| BASE-MEDIA-01 | open / 待取证 | 示例媒体和字体的完整来源/授权链待核实 | BASE-08, SITE-01, EX-03 |
+| VENDOR-01 | open / 待取证 | screenfull 来源、版本与许可闭环 | CORE-12 |
+| VENDOR-02 | open / 待取证 | hint.css 来源、版本与许可闭环 | CORE-12 |
+| VENDOR-03 | open / 待取证 | webvtt-parser 来源、版本与许可闭环 | PKG-MULTI-SUB-01 |
+| VENDOR-04 | open / 待取证 | jassub-code-and-workers 来源、版本与许可闭环 | PKG-JASSUB-01 |
+| VENDOR-05 | open / 待取证 | jassub-font-assets 来源、版本与许可闭环 | PKG-JASSUB-01, SITE-01 |
+| VENDOR-06 | open / 待取证 | monaco-static-assets 来源、版本与许可闭环 | SITE-01, SITE-05 |
+| VENDOR-07 | open / 待取证 | vconsole 来源、版本与许可闭环 | SITE-01 |
+| VENDOR-08 | open / 待取证 | console-bundle 来源、版本与许可闭环 | SITE-01 |
+| SDK-01 | open / 待取证 | hls.js 实际集成验证范围 | PKG-HLS-01, EX-03 |
+| SDK-02 | open / 待取证 | dash.js 实际集成验证范围 | PKG-DASH-01, EX-03 |
+| SDK-03 | open / 待取证 | flv.js 实际集成验证范围 | EX-03 |
+| SDK-04 | open / 待取证 | mpegts.js 实际集成验证范围 | EX-03 |
+| SDK-05 | open / 待取证 | webtorrent 实际集成验证范围 | EX-03 |
+| SDK-06 | open / 待取证 | google-cast 实际集成验证范围 | PKG-CAST-01, PKG-CAST-05 |
+| SDK-07 | open / 待取证 | ima-via-glomex 实际集成验证范围 | PKG-VAST-01, PKG-VAST-05 |
+| SDK-08 | open / 待取证 | mediapipe-tensorflow 实际集成验证范围 | PKG-MASK-01, PKG-MASK-05 |
+| SDK-09 | open / 待取证 | jassub-worker-wasm-fonts 实际集成验证范围 | PKG-JASSUB-01, PKG-JASSUB-05 |
+| SDK-10 | open / 待取证 | mediabunny 实际集成验证范围 | PKG-MB-01, PKG-MB-09 |
+| SDK-11 | open / 待取证 | asr-caller-service 实际集成验证范围 | PKG-ASR-01, PKG-ASR-05, EX-03 |
+| SDK-12 | open / 待取证 | option-validator 实际集成验证范围 | CORE-01, CORE-07 |
diff --git a/refactor/risks.json b/refactor/risks.json
new file mode 100644
index 000000000..ce483d540
--- /dev/null
+++ b/refactor/risks.json
@@ -0,0 +1,613 @@
+{
+ "schemaVersion": 1,
+ "task": "BASE-07",
+ "sourceCommit": "e01f39ff",
+ "updatedAt": "2026-09-10T12:58:34.267Z",
+ "note": "Open means closure evidence is outstanding; source-observed and unverified are not reproduced runtime bugs. A source issue already mitigated in the workspace still requires candidate regression evidence. No accepted-with-scope item is implied by baseline task completion.",
+ "items": [
+ {
+ "id": "BASE-LIFE-06",
+ "title": "Published switch leaves an unhandled rejection and an unsettled promise when resume fails",
+ "confirmation": "reproduced",
+ "status": "open",
+ "owners": [
+ "CORE-09"
+ ],
+ "evidence": [
+ "refactor/baselines/lifecycle.json",
+ "refactor/baselines/lifecycle-coverage.md",
+ "test/playback.test.js"
+ ],
+ "compatibleResolution": "按对应 CORE 任务修复，保持合法旧调用；异步取消需明确结算策略，不把 pending 或重复销毁当正常兼容要求。",
+ "closureCriteria": "候选正向回归和旧新差异记录通过；有界观察问题不得仅靠延长等待隐藏。",
+ "workspaceState": "Current switchMix uses silencePromise and test/playback.test.js covers resume rejection. Published baseline still reproduces the old failure; preserve the existing workspace mitigation during migration."
+ },
+ {
+ "id": "BASE-LIFE-01",
+ "title": "Superseded switch resolves along with the latest source",
+ "confirmation": "reproduced",
+ "status": "open",
+ "owners": [
+ "CORE-09"
+ ],
+ "evidence": [
+ "refactor/baselines/lifecycle.json",
+ "refactor/baselines/lifecycle-coverage.md"
+ ],
+ "compatibleResolution": "按对应 CORE 任务修复，保持合法旧调用；异步取消需明确结算策略，不把 pending 或重复销毁当正常兼容要求。",
+ "closureCriteria": "候选正向回归和旧新差异记录通过；有界观察问题不得仅靠延长等待隐藏。"
+ },
+ {
+ "id": "BASE-LIFE-02",
+ "title": "Switch remains unsettled during the bounded observation after destroy",
+ "confirmation": "reproduced",
+ "status": "open",
+ "owners": [
+ "CORE-09"
+ ],
+ "evidence": [
+ "refactor/baselines/lifecycle.json",
+ "refactor/baselines/lifecycle-coverage.md"
+ ],
+ "compatibleResolution": "按对应 CORE 任务修复，保持合法旧调用；异步取消需明确结算策略，不把 pending 或重复销毁当正常兼容要求。",
+ "closureCriteria": "候选正向回归和旧新差异记录通过；有界观察问题不得仅靠延长等待隐藏。"
+ },
+ {
+ "id": "BASE-LIFE-03",
+ "title": "Async plugin registers its result after destroy",
+ "confirmation": "reproduced",
+ "status": "open",
+ "owners": [
+ "CORE-08"
+ ],
+ "evidence": [
+ "refactor/baselines/lifecycle.json",
+ "refactor/baselines/lifecycle-coverage.md"
+ ],
+ "compatibleResolution": "按对应 CORE 任务修复，保持合法旧调用；异步取消需明确结算策略，不把 pending 或重复销毁当正常兼容要求。",
+ "closureCriteria": "候选正向回归和旧新差异记录通过；有界观察问题不得仅靠延长等待隐藏。"
+ },
+ {
+ "id": "BASE-LIFE-04",
+ "title": "Destroying an instance twice unregisters a different live instance",
+ "confirmation": "reproduced",
+ "status": "open",
+ "owners": [
+ "CORE-04"
+ ],
+ "evidence": [
+ "refactor/baselines/lifecycle.json",
+ "refactor/baselines/lifecycle-coverage.md"
+ ],
+ "compatibleResolution": "按对应 CORE 任务修复，保持合法旧调用；异步取消需明确结算策略，不把 pending 或重复销毁当正常兼容要求。",
+ "closureCriteria": "候选正向回归和旧新差异记录通过；有界观察问题不得仅靠延长等待隐藏。"
+ },
+ {
+ "id": "BASE-LIFE-05",
+ "title": "Failed constructor leaves initialized markup/listeners until explicit probe cleanup",
+ "confirmation": "reproduced",
+ "status": "open",
+ "owners": [
+ "CORE-04"
+ ],
+ "evidence": [
+ "refactor/baselines/lifecycle.json",
+ "refactor/baselines/lifecycle-coverage.md"
+ ],
+ "compatibleResolution": "按对应 CORE 任务修复，保持合法旧调用；异步取消需明确结算策略，不把 pending 或重复销毁当正常兼容要求。",
+ "closureCriteria": "候选正向回归和旧新差异记录通过；有界观察问题不得仅靠延长等待隐藏。"
+ },
+ {
+ "id": "BASE-DOM-01",
+ "title": "控件 Tab 不可达",
+ "confirmation": "reproduced",
+ "status": "open",
+ "owners": [
+ "CORE-23",
+ "CORE-17"
+ ],
+ "evidence": [
+ "refactor/baselines/dom.json"
+ ],
+ "compatibleResolution": "补键盘可达性、焦点及名称，保留旧 DOM/CSS 和快捷键。",
+ "closureCriteria": "真实键盘与焦点回归通过，不只检查静态属性。"
+ },
+ {
+ "id": "BASE-DOM-02",
+ "title": "窄容器中控件裁切",
+ "confirmation": "reproduced",
+ "status": "open",
+ "owners": [
+ "CORE-13",
+ "CORE-14"
+ ],
+ "evidence": [
+ "refactor/baselines/dom.json"
+ ],
+ "compatibleResolution": "在保留自定义控件扩展入口下修正布局。",
+ "closureCriteria": "320px 及正常容器的设置/模式操作真实可用。"
+ },
+ {
+ "id": "BASE-DEMO-01",
+ "title": "旧 thumbnail 插件示例不对应当前 workspace 包",
+ "confirmation": "source-observed",
+ "status": "open",
+ "owners": [
+ "SITE-01",
+ "EX-03"
+ ],
+ "evidence": [
+ "docs/assets/example/thumbnail.js",
+ "refactor/baselines/demo-inventory.json"
+ ],
+ "compatibleResolution": "核实旧外部插件和链接，不自动替换为不同 API 的 auto-thumbnail。",
+ "closureCriteria": "示例依赖有来源，旧参数/URL 的保留或迁移解释完整。"
+ },
+ {
+ "id": "BASE-TYPE-01",
+ "title": "NodeNext ESM 默认导出与声明互操作失配",
+ "confirmation": "reproduced",
+ "status": "open",
+ "owners": [
+ "ENG-04",
+ "CORE-07",
+ "PKG-CHAPTER-04"
+ ],
+ "evidence": [
+ "refactor/baselines/consumers.json"
+ ],
+ "compatibleResolution": "分配 ESM/CJS 声明入口，保留旧解析模式，避免 any/skipLibCheck 掩盖。",
+ "closureCriteria": "四模式原合法消费通过，NodeNext ESM 对实际默认导出可构造/调用。"
+ },
+ {
+ "id": "BASE-TYPE-02",
+ "title": "chapter 可选运行时参数被声明为必填",
+ "confirmation": "reproduced",
+ "status": "open",
+ "owners": [
+ "PKG-CHAPTER-02"
+ ],
+ "evidence": [
+ "refactor/baselines/consumers.json",
+ "refactor/fixtures/api.js"
+ ],
+ "compatibleResolution": "补充兼容可选参数，不删除已接受的配置。",
+ "closureCriteria": "无参数和正确参数编译，错误参数依旧被拒绝，运行时一致。"
+ },
+ {
+ "id": "BASE-TYPE-03",
+ "title": "chapter legacy 缺旧模块解析的声明回退",
+ "confirmation": "reproduced",
+ "status": "open",
+ "owners": [
+ "ENG-04",
+ "PKG-CHAPTER-04"
+ ],
+ "evidence": [
+ "refactor/baselines/consumers.json"
+ ],
+ "compatibleResolution": "保留 legacy 文件和导入路径，补旧解析类型回退。",
+ "closureCriteria": "Node10 解析和 NodeNext/Bundler 消费均有正向证据。"
+ },
+ {
+ "id": "BASE-TYPE-04",
+ "title": "plugins.add / toggle 的旧声明返回值与运行时不同",
+ "confirmation": "source-observed",
+ "status": "open",
+ "owners": [
+ "CORE-07"
+ ],
+ "evidence": [
+ "refactor/baselines/consumers.json",
+ "refactor/baselines/public-api.json",
+ "refactor/baselines/lifecycle.json"
+ ],
+ "compatibleResolution": "保留旧声明接受范围并协调精确重载/扩展，不静默把同步注册改成 async。",
+ "closureCriteria": "返回值类型与运行时差异逐项说明，旧合法消费和拒绝传播回归通过。",
+ "scopeNote": "plugins.add synchronous result is browser-reproduced; toggle return comparison also relies on current source/playback tests. Do not claim every declaration mismatch was independently browser-reproduced."
+ },
+ {
+ "id": "BASE-DIST-01",
+ "title": "thumbnail tool 分发入口与类型文件缺失",
+ "confirmation": "source-observed",
+ "status": "open",
+ "owners": [
+ "PKG-TOOL-THUMB-01",
+ "PKG-TOOL-THUMB-04"
+ ],
+ "evidence": [
+ "refactor/baselines/distribution.json"
+ ],
+ "compatibleResolution": "核实真实旧 npm 后保留 .esm.js 等历史路径的兼容入口并补声明。",
+ "closureCriteria": "隔离打包消费者能加载所有原承诺路径，dist 不作为源码直接手改。"
+ },
+ {
+ "id": "BASE-PERF-01",
+ "title": "销毁后的 resize 防抖重新创建 notice timer",
+ "confirmation": "reproduced",
+ "status": "open",
+ "owners": [
+ "CORE-17",
+ "CORE-04",
+ "CORE-18"
+ ],
+ "evidence": [
+ "refactor/baselines/performance.json"
+ ],
+ "compatibleResolution": "为 debounce/晚到 UI 工作建立销毁归属；不靠等待自然过期掩盖。",
+ "closureCriteria": "正常 resize 保持，destroy 后无该回调及新 notice timer。"
+ },
+ {
+ "id": "BASE-SOURCE-01",
+ "title": "工作区 5.4.1 与采集时真实发布 5.4.0 不同",
+ "confirmation": "source-observed",
+ "status": "open",
+ "owners": [
+ "BASE-08",
+ "REL-01"
+ ],
+ "evidence": [
+ "refactor/baselines/releases.json"
+ ],
+ "compatibleResolution": "分别保留工作区与 npm 基线，目标大版本不变；更新发布窗口需新取证。",
+ "closureCriteria": "候选报告明确比较版本与 tarball，不声称工作区版本即已发布。"
+ },
+ {
+ "id": "BASE-SOURCE-02",
+ "title": "registry gitHead 与发布包版本对应不可靠",
+ "confirmation": "source-observed",
+ "status": "open",
+ "owners": [
+ "ENG-07",
+ "REL-01"
+ ],
+ "evidence": [
+ "refactor/baselines/releases.json"
+ ],
+ "compatibleResolution": "以 tarball 内容和可验证的构建来源为准，不能据 gitHead 自动声称复现。",
+ "closureCriteria": "候选 commit、工具链、包内容可关联，旧来源未知仍明确。"
+ },
+ {
+ "id": "BASE-SITE-01",
+ "title": "文档站实际为静态站点但 manifest 未设 private",
+ "confirmation": "source-observed",
+ "status": "open",
+ "owners": [
+ "SITE-01",
+ "REL-01"
+ ],
+ "evidence": [
+ "refactor/baselines/distribution.json"
+ ],
+ "compatibleResolution": "区分站点部署和库 npm 发布；自身 next-major 要求保留。",
+ "closureCriteria": "发布流程显式列出站点处理方式，不机械将其当库发布。"
+ },
+ {
+ "id": "BASE-MEDIA-01",
+ "title": "示例媒体和字体的完整来源/授权链待核实",
+ "confirmation": "unverified",
+ "status": "open",
+ "owners": [
+ "BASE-08",
+ "SITE-01",
+ "EX-03"
+ ],
+ "evidence": [
+ "docs/assets/sample",
+ "docs/assets/jassub"
+ ],
+ "compatibleResolution": "复用现有样本时记录来源；缺许可的公开分发样本需补证据或可兼容替代，不能从文件名猜授权。",
+ "closureCriteria": "候选实际分发样本有来源、许可/使用依据和测试映射。"
+ },
+ {
+ "id": "VENDOR-01",
+ "title": "screenfull 来源、版本与许可闭环",
+ "confirmation": "unverified",
+ "status": "open",
+ "owners": [
+ "CORE-12"
+ ],
+ "evidence": [
+ "refactor/third-party.json",
+ "packages/artplayer/src/libs/screenfull.js"
+ ],
+ "compatibleResolution": "Keep separate from owned TS migration. Verify source/version/diff and license notices before replacement; preserve API/CSS/worker URLs and run owning package tests.",
+ "closureCriteria": "固定上游版本/内容差异、完整组件许可与分发 notices，兼容测试通过；仅当前上游许可证名称不足以关闭。"
+ },
+ {
+ "id": "VENDOR-02",
+ "title": "hint.css 来源、版本与许可闭环",
+ "confirmation": "unverified",
+ "status": "open",
+ "owners": [
+ "CORE-12"
+ ],
+ "evidence": [
+ "refactor/third-party.json",
+ "packages/artplayer/src/style/hint.less"
+ ],
+ "compatibleResolution": "Keep separate from owned TS migration. Verify source/version/diff and license notices before replacement; preserve API/CSS/worker URLs and run owning package tests.",
+ "closureCriteria": "固定上游版本/内容差异、完整组件许可与分发 notices，兼容测试通过；仅当前上游许可证名称不足以关闭。"
+ },
+ {
+ "id": "VENDOR-03",
+ "title": "webvtt-parser 来源、版本与许可闭环",
+ "confirmation": "unverified",
+ "status": "open",
+ "owners": [
+ "PKG-MULTI-SUB-01"
+ ],
+ "evidence": [
+ "refactor/third-party.json",
+ "packages/artplayer-plugin-multiple-subtitles/src/parser.js"
+ ],
+ "compatibleResolution": "Keep separate from owned TS migration. Verify source/version/diff and license notices before replacement; preserve API/CSS/worker URLs and run owning package tests.",
+ "closureCriteria": "固定上游版本/内容差异、完整组件许可与分发 notices，兼容测试通过；仅当前上游许可证名称不足以关闭。"
+ },
+ {
+ "id": "VENDOR-04",
+ "title": "jassub-code-and-workers 来源、版本与许可闭环",
+ "confirmation": "unverified",
+ "status": "open",
+ "owners": [
+ "PKG-JASSUB-01"
+ ],
+ "evidence": [
+ "refactor/third-party.json",
+ "packages/artplayer-plugin-jassub/src/jassub.es.js",
+ "packages/artplayer-plugin-jassub/worker",
+ "docs/assets/jassub/jassub-worker.js",
+ "docs/assets/jassub/jassub-worker.wasm",
+ "docs/assets/jassub/jassub-worker-modern.wasm"
+ ],
+ "compatibleResolution": "Keep separate from owned TS migration. Verify source/version/diff and license notices before replacement; preserve API/CSS/worker URLs and run owning package tests.",
+ "closureCriteria": "固定上游版本/内容差异、完整组件许可与分发 notices，兼容测试通过；仅当前上游许可证名称不足以关闭。"
+ },
+ {
+ "id": "VENDOR-05",
+ "title": "jassub-font-assets 来源、版本与许可闭环",
+ "confirmation": "unverified",
+ "status": "open",
+ "owners": [
+ "PKG-JASSUB-01",
+ "SITE-01"
+ ],
+ "evidence": [
+ "refactor/third-party.json",
+ "docs/assets/jassub/default.woff2",
+ "docs/assets/jassub/fonts"
+ ],
+ "compatibleResolution": "Keep separate from owned TS migration. Verify source/version/diff and license notices before replacement; preserve API/CSS/worker URLs and run owning package tests.",
+ "closureCriteria": "固定上游版本/内容差异、完整组件许可与分发 notices，兼容测试通过；仅当前上游许可证名称不足以关闭。"
+ },
+ {
+ "id": "VENDOR-06",
+ "title": "monaco-static-assets 来源、版本与许可闭环",
+ "confirmation": "unverified",
+ "status": "open",
+ "owners": [
+ "SITE-01",
+ "SITE-05"
+ ],
+ "evidence": [
+ "refactor/third-party.json",
+ "docs/assets/js/vs"
+ ],
+ "compatibleResolution": "Keep separate from owned TS migration. Verify source/version/diff and license notices before replacement; preserve API/CSS/worker URLs and run owning package tests.",
+ "closureCriteria": "固定上游版本/内容差异、完整组件许可与分发 notices，兼容测试通过；仅当前上游许可证名称不足以关闭。"
+ },
+ {
+ "id": "VENDOR-07",
+ "title": "vconsole 来源、版本与许可闭环",
+ "confirmation": "unverified",
+ "status": "open",
+ "owners": [
+ "SITE-01"
+ ],
+ "evidence": [
+ "refactor/third-party.json",
+ "docs/assets/js/vconsole.min.js"
+ ],
+ "compatibleResolution": "Keep separate from owned TS migration. Verify source/version/diff and license notices before replacement; preserve API/CSS/worker URLs and run owning package tests.",
+ "closureCriteria": "固定上游版本/内容差异、完整组件许可与分发 notices，兼容测试通过；仅当前上游许可证名称不足以关闭。"
+ },
+ {
+ "id": "VENDOR-08",
+ "title": "console-bundle 来源、版本与许可闭环",
+ "confirmation": "unverified",
+ "status": "open",
+ "owners": [
+ "SITE-01"
+ ],
+ "evidence": [
+ "refactor/third-party.json",
+ "docs/assets/js/console.js"
+ ],
+ "compatibleResolution": "Keep separate from owned TS migration. Verify source/version/diff and license notices before replacement; preserve API/CSS/worker URLs and run owning package tests.",
+ "closureCriteria": "固定上游版本/内容差异、完整组件许可与分发 notices，兼容测试通过；仅当前上游许可证名称不足以关闭。"
+ },
+ {
+ "id": "SDK-01",
+ "title": "hls.js 实际集成验证范围",
+ "confirmation": "unverified",
+ "status": "open",
+ "owners": [
+ "PKG-HLS-01",
+ "EX-03"
+ ],
+ "evidence": [
+ "packages/artplayer-plugin-hls-control/src/index.js",
+ "docs/assets/example/hls.control.js"
+ ],
+ "compatibleResolution": "Caller supplies art.hls; homepage demo loads hls.js 1.5.17. Preserve quality/audio selectors and old core integration.",
+ "closureCriteria": "固定 SDK/外部资源版本和环境；成功/失败/切换/销毁有真实证据，设备和网络限制逐项记录。"
+ },
+ {
+ "id": "SDK-02",
+ "title": "dash.js 实际集成验证范围",
+ "confirmation": "unverified",
+ "status": "open",
+ "owners": [
+ "PKG-DASH-01",
+ "EX-03"
+ ],
+ "evidence": [
+ "packages/artplayer-plugin-dash-control/src/index.js",
+ "docs/assets/example/dash.control.js"
+ ],
+ "compatibleResolution": "Caller supplies art.dash; homepage demo loads dash.js 5.2.1. Preserve representation IDs, Auto/manual and audio topology.",
+ "closureCriteria": "固定 SDK/外部资源版本和环境；成功/失败/切换/销毁有真实证据，设备和网络限制逐项记录。"
+ },
+ {
+ "id": "SDK-03",
+ "title": "flv.js 实际集成验证范围",
+ "confirmation": "unverified",
+ "status": "open",
+ "owners": [
+ "EX-03"
+ ],
+ "evidence": [
+ "docs/assets/example/flv.js"
+ ],
+ "compatibleResolution": "Demo dependency flv.js 1.6.2; customType playback/teardown must be tested with actual SDK.",
+ "closureCriteria": "固定 SDK/外部资源版本和环境；成功/失败/切换/销毁有真实证据，设备和网络限制逐项记录。"
+ },
+ {
+ "id": "SDK-04",
+ "title": "mpegts.js 实际集成验证范围",
+ "confirmation": "unverified",
+ "status": "open",
+ "owners": [
+ "EX-03"
+ ],
+ "evidence": [
+ "docs/assets/example/mpegts.js"
+ ],
+ "compatibleResolution": "Demo dependency mpegts.js 1.7.3; actual codec/stream/browser support remains unverified.",
+ "closureCriteria": "固定 SDK/外部资源版本和环境；成功/失败/切换/销毁有真实证据，设备和网络限制逐项记录。"
+ },
+ {
+ "id": "SDK-05",
+ "title": "webtorrent 实际集成验证范围",
+ "confirmation": "unverified",
+ "status": "open",
+ "owners": [
+ "EX-03"
+ ],
+ "evidence": [
+ "docs/assets/example/webtorrent.js"
+ ],
+ "compatibleResolution": "Demo URL uses webtorrent@1, a moving major selector; preserve caller integration and explicitly capture actual runtime version.",
+ "closureCriteria": "固定 SDK/外部资源版本和环境；成功/失败/切换/销毁有真实证据，设备和网络限制逐项记录。"
+ },
+ {
+ "id": "SDK-06",
+ "title": "google-cast 实际集成验证范围",
+ "confirmation": "unverified",
+ "status": "open",
+ "owners": [
+ "PKG-CAST-01",
+ "PKG-CAST-05"
+ ],
+ "evidence": [
+ "packages/artplayer-plugin-chromecast/src/index.js"
+ ],
+ "compatibleResolution": "Default remote cast_sender.js?loadCastFramework=1; sdk URL/options and actual Cast device/session behavior require separate validation.",
+ "closureCriteria": "固定 SDK/外部资源版本和环境；成功/失败/切换/销毁有真实证据，设备和网络限制逐项记录。"
+ },
+ {
+ "id": "SDK-07",
+ "title": "ima-via-glomex 实际集成验证范围",
+ "confirmation": "unverified",
+ "status": "open",
+ "owners": [
+ "PKG-VAST-01",
+ "PKG-VAST-05"
+ ],
+ "evidence": [
+ "packages/artplayer-plugin-vast/src/index.js"
+ ],
+ "compatibleResolution": "@glomex/vast-ima-player loadImaSdk loads external IMA; preserve event/content/ad state and teardown, do not equate mocks with vendor service acceptance.",
+ "closureCriteria": "固定 SDK/外部资源版本和环境；成功/失败/切换/销毁有真实证据，设备和网络限制逐项记录。"
+ },
+ {
+ "id": "SDK-08",
+ "title": "mediapipe-tensorflow 实际集成验证范围",
+ "confirmation": "unverified",
+ "status": "open",
+ "owners": [
+ "PKG-MASK-01",
+ "PKG-MASK-05"
+ ],
+ "evidence": [
+ "packages/artplayer-plugin-danmuku-mask/src/index.js"
+ ],
+ "compatibleResolution": "Npm dependency versions are separate from unversioned solutionPath CDN assets; keep option override, backend fallback, model result disposal and masks.",
+ "closureCriteria": "固定 SDK/外部资源版本和环境；成功/失败/切换/销毁有真实证据，设备和网络限制逐项记录。"
+ },
+ {
+ "id": "SDK-09",
+ "title": "jassub-worker-wasm-fonts 实际集成验证范围",
+ "confirmation": "unverified",
+ "status": "open",
+ "owners": [
+ "PKG-JASSUB-01",
+ "PKG-JASSUB-05"
+ ],
+ "evidence": [
+ "packages/artplayer-plugin-jassub/src/index.js",
+ "docs/assets/example/jassub.js"
+ ],
+ "compatibleResolution": "Preserve options pass-through, result.instance and worker/wasm/font URLs. Wrapper, worker and WASM must be a verified compatible set.",
+ "closureCriteria": "固定 SDK/外部资源版本和环境；成功/失败/切换/销毁有真实证据，设备和网络限制逐项记录。"
+ },
+ {
+ "id": "SDK-10",
+ "title": "mediabunny 实际集成验证范围",
+ "confirmation": "unverified",
+ "status": "open",
+ "owners": [
+ "PKG-MB-01",
+ "PKG-MB-09"
+ ],
+ "evidence": [
+ "packages/artplayer-proxy-mediabunny/src/input.js",
+ "packages/artplayer-proxy-mediabunny/package.json"
+ ],
+ "compatibleResolution": "Preserve native-video-like events, HLS input and topology, codec capability failures and AV sync; actual library/codec environment still requires verification.",
+ "closureCriteria": "固定 SDK/外部资源版本和环境；成功/失败/切换/销毁有真实证据，设备和网络限制逐项记录。"
+ },
+ {
+ "id": "SDK-11",
+ "title": "asr-caller-service 实际集成验证范围",
+ "confirmation": "unverified",
+ "status": "open",
+ "owners": [
+ "PKG-ASR-01",
+ "PKG-ASR-05",
+ "EX-03"
+ ],
+ "evidence": [
+ "packages/artplayer-plugin-asr/src/index.js",
+ "docs/assets/example/asr.js"
+ ],
+ "compatibleResolution": "Core plugin supplies PCM to caller onAudioChunk. Example fetches an external ASR endpoint and opens its returned WebSocket; not an embedded ASR SDK or a verified service.",
+ "closureCriteria": "固定 SDK/外部资源版本和环境；成功/失败/切换/销毁有真实证据，设备和网络限制逐项记录。"
+ },
+ {
+ "id": "SDK-12",
+ "title": "option-validator 实际集成验证范围",
+ "confirmation": "unverified",
+ "status": "open",
+ "owners": [
+ "CORE-01",
+ "CORE-07"
+ ],
+ "evidence": [
+ "packages/artplayer/src/index.js"
+ ],
+ "compatibleResolution": "Bundled validation dependency; preserve validation/default/merge behavior and failure cleanup when typing constructor boundaries.",
+ "closureCriteria": "固定 SDK/外部资源版本和环境；成功/失败/切换/销毁有真实证据，设备和网络限制逐项记录。"
+ }
+ ]
+}
diff --git a/refactor/scripts/risk-register.mjs b/refactor/scripts/risk-register.mjs
new file mode 100644
index 000000000..b02a2fec0
--- /dev/null
+++ b/refactor/scripts/risk-register.mjs
@@ -0,0 +1,94 @@
+import assert from 'node:assert/strict'
+import fs from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+import lockfile from '@yarnpkg/lockfile'
+import { hash, refactorDir } from './releases.mjs'
+
+const root = path.resolve(refactorDir, '..')
+const read = name => JSON.parse(fs.readFileSync(path.join(refactorDir, name), 'utf8'))
+export function referencedFindings() {
+ const files = ['baselines/lifecycle-coverage.md', 'baselines/dom-coverage.md', 'baselines/consumer-coverage.md', 'baselines/performance-coverage.md']
+ return [...new Set(files.flatMap(name => fs.readFileSync(path.join(refactorDir, name), 'utf8').match(/BASE-(?:LIFE|DOM|DEMO|TYPE|DIST|PERF)-\d{2}/g) || []))].sort()
+}
+function evidenceExists(name) {
+ const absolute = path.resolve(root, name)
+ assert(absolute.startsWith(root + path.sep) && fs.existsSync(absolute), `Missing or invalid evidence: ${name}`)
+}
+export function validateRisks(register) {
+ const tasks = new Set(read('tasks.json').tasks.map(task => task.id))
+ const ids = new Set(register.items.map(item => item.id))
+ assert.equal(ids.size, register.items.length, 'Duplicate risk ID')
+ for (const id of referencedFindings()) assert(ids.has(id), `Unregistered baseline finding: ${id}`)
+ for (const item of register.items) {
+ assert(['reproduced', 'source-observed', 'unverified'].includes(item.confirmation))
+ assert(['open', 'resolved', 'accepted-with-scope'].includes(item.status))
+ assert(item.owners.length && item.owners.every(id => tasks.has(id)), `Unowned risk: ${item.id}`)
+ assert(item.evidence.length && item.compatibleResolution && item.closureCriteria, `Incomplete risk: ${item.id}`)
+ item.evidence.forEach(evidenceExists)
+ if (item.status !== 'open') {
+ assert(item.resolutionEvidence?.length && item.resolutionRationale, `Premature closure: ${item.id}`)
+ item.resolutionEvidence.forEach(evidenceExists)
+ }
+ }
+}
+export function assetFingerprints(inputs) {
+ const walk = name => {
+ const absolute = path.resolve(root, name)
+ evidenceExists(name)
+ return fs.statSync(absolute).isDirectory() ? fs.readdirSync(absolute).flatMap(child => walk(`${name}/${child}`)) : [name]
+ }
+ return inputs.flatMap(walk).sort().map(name => {
+ const bytes = fs.readFileSync(path.join(root, name))
+ const text = /\.(?:[cm]?[jt]s|css|less|json|html|svg|txt|md)$/.test(name)
+ return { path: name, algorithm: text ? 'sha256-lf' : 'sha256', sha256: hash(text ? bytes.toString('utf8').replaceAll('\r\n', '\n') : bytes) }
+ })
+}
+export function validateThirdParty(inventory, register) {
+ const tasks = new Set(read('tasks.json').tasks.map(task => task.id))
+ const risks = new Set(register.items.map(item => item.id))
+ const initial = read('package-inventory.json').packages.map(pkg => pkg.name).sort()
+ assert.deepEqual(inventory.packages.map(pkg => pkg.name).sort(), initial, 'External dependency package coverage missing')
+ const lock = lockfile.parse(fs.readFileSync(path.join(root, 'yarn.lock'), 'utf8')).object
+ for (const pkg of inventory.packages) {
+ const current = JSON.parse(fs.readFileSync(path.join(root, 'packages', pkg.name, 'package.json'), 'utf8'))
+ assert.deepEqual(pkg.declaredRuntimeDependencies, current.dependencies || {}, `Update dependency inventory: ${pkg.name}`)
+ assert.deepEqual(pkg.developmentDependencies, current.devDependencies || {}, `Update development dependency inventory: ${pkg.name}`)
+ assert.deepEqual(pkg.resolvedRuntimeDependencies.map(dependency => dependency.name).sort(), Object.keys(current.dependencies || {}).sort(), 'Missing resolved dependency')
+ for (const dependency of pkg.resolvedRuntimeDependencies) {
+ assert.equal(dependency.range, current.dependencies[dependency.name], 'Dependency range changed')
+ const installed = JSON.parse(fs.readFileSync(path.join(root, 'node_modules', dependency.name, 'package.json'), 'utf8'))
+ assert.equal(dependency.lockedVersion, lock[`${dependency.name}@${dependency.range}`]?.version, 'Dependency lock changed; update provenance')
+ assert.equal(dependency.installedVersion, installed.version, 'Installed dependency changed')
+ assert.equal(dependency.manifestLicense, installed.license || null, 'Dependency license metadata changed')
+ }
+ }
+ assert.deepEqual(inventory.vendored.map(vendor => vendor.riskId).sort(), [...risks].filter(id => id.startsWith('VENDOR-')).sort(), 'Missing vendored group')
+ assert.deepEqual(inventory.integrations.map(sdk => sdk.riskId).sort(), [...risks].filter(id => id.startsWith('SDK-')).sort(), 'Missing SDK integration')
+ for (const vendor of inventory.vendored) {
+ assert(risks.has(vendor.riskId) && vendor.owners.length && vendor.owners.every(id => tasks.has(id)))
+ assert(vendor.sourceStatus && vendor.licenseStatus && vendor.updatePolicy)
+ assert.deepEqual(assetFingerprints(vendor.inputs), vendor.fingerprints, `Vendored files changed without reviewed provenance: ${vendor.id}`)
+ }
+ for (const sdk of inventory.integrations) {
+ assert(risks.has(sdk.riskId) && sdk.owners.length && sdk.owners.every(id => tasks.has(id)))
+ assert(sdk.sourceFiles.length && sdk.validationStatus && sdk.contract)
+ sdk.sourceFiles.forEach(evidenceExists)
+ }
+}
+export function renderRisks(register) {
+ const labels = { reproduced: '已复现', 'source-observed': '源码/产物事实', unverified: '待取证' }
+ const escape = text => text.replaceAll('|', '\\|').replaceAll('\n', ' ')
+ return `# 重构风险与差异索引\n\n由 risks.json 生成；运行 node refactor/scripts/risk-register.mjs --write 更新。状态 open 表示尚缺关闭证据，不等于每项都是已复现缺陷。处理方案、关闭条件与证据见 [机器台账](risks.json)，来源与范围见 [维护说明](risk-guide.md)。\n\n| ID | 状态 / 证据等级 | 条目 | 后续任务 |\n| --- | --- | --- | --- |\n${register.items.map(item => `| ${item.id} | ${item.status} / ${labels[item.confirmation]} | ${escape(item.title)} | ${item.owners.join(', ')} |`).join('\n')}\n`
+}
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+ assert(process.argv.slice(2).every(arg => ['--check', '--write'].includes(arg)), 'Use --check or --write')
+ const register = read('risks.json')
+ const inventory = read('third-party.json')
+ validateRisks(register)
+ validateThirdParty(inventory, register)
+ const rendered = renderRisks(register)
+ if (process.argv.includes('--write')) fs.writeFileSync(path.join(refactorDir, 'risk-table.md'), rendered)
+ else assert.equal(fs.readFileSync(path.join(refactorDir, 'risk-table.md'), 'utf8').replaceAll('\r\n', '\n'), rendered, 'Regenerate risk-table.md')
+ console.log(`Risk register checked: ${register.items.length} items, ${inventory.vendored.length} vendored groups, ${inventory.integrations.length} integrations; no unresolved item is waived`)
+}
diff --git a/refactor/scripts/risk-register.test.mjs b/refactor/scripts/risk-register.test.mjs
new file mode 100644
index 000000000..d32fdd3f8
--- /dev/null
+++ b/refactor/scripts/risk-register.test.mjs
@@ -0,0 +1,39 @@
+import assert from 'node:assert/strict'
+import fs from 'node:fs'
+import path from 'node:path'
+import test from 'node:test'
+import { renderRisks, validateRisks, validateThirdParty } from './risk-register.mjs'
+import { refactorDir } from './releases.mjs'
+
+const read = name => JSON.parse(fs.readFileSync(path.join(refactorDir, name), 'utf8'))
+test('Risk register rejects omitted findings, missing owners and unsupported closure', () => {
+ const register = read('risks.json')
+ validateRisks(register)
+ assert.equal(fs.readFileSync(path.join(refactorDir, 'risk-table.md'), 'utf8').replaceAll('\r\n', '\n'), renderRisks(register))
+ for (const mutate of [
+ value => value.items = value.items.filter(item => item.id !== 'BASE-LIFE-04'),
+ value => value.items[0].owners = ['NO-SUCH-TASK'],
+ value => value.items[0].status = 'resolved',
+ value => value.items[0].evidence = ['../outside-workspace'],
+ ]) {
+ const changed = structuredClone(register)
+ mutate(changed)
+ assert.throws(() => validateRisks(changed))
+ }
+})
+test('Third-party provenance cannot silently omit copied assets, SDKs or change fingerprints', () => {
+ const register = read('risks.json')
+ const inventory = read('third-party.json')
+ validateThirdParty(inventory, register)
+ for (const mutate of [
+ value => value.packages.pop(),
+ value => value.vendored.pop(),
+ value => value.integrations.pop(),
+ value => value.vendored[0].fingerprints[0].sha256 = 'incorrect',
+ value => value.packages.find(pkg => pkg.resolvedRuntimeDependencies.length).resolvedRuntimeDependencies[0].lockedVersion = '0.0.0',
+ ]) {
+ const changed = structuredClone(inventory)
+ mutate(changed)
+ assert.throws(() => validateThirdParty(changed, register))
+ }
+})
diff --git a/refactor/tasks.json b/refactor/tasks.json
index 2977661a2..60f3682cf 100644
--- a/refactor/tasks.json
+++ b/refactor/tasks.json
@@ -391,11 +391,17 @@
"BASE-03",
"BASE-05"
],
- "status": "todo",
+ "status": "done",
"risk": "H",
"deliverable": "销毁/切源/类型差异、vendored 许可和外部 SDK 清单",
"acceptance": "已确认与待复现分开，每项有负责任务及兼容处理路线；纳入 BASE-TYPE-01/02/03/04 和 BASE-DIST-01 的发布/声明/工作区证据；纳入 BASE-PERF-01 销毁后 resize/notice 延迟工作",
- "evidence": []
+ "evidence": [
+ "changes/2026-09-10-BASE-07-risk-register.md",
+ "risk-guide.md",
+ "risk-table.md",
+ "risks.json",
+ "third-party.json"
+ ]
},
{
"scope": [
@@ -611,7 +617,7 @@
"BASE-07"
],
"deliverable": "历史失败 ID/环境/旧版复现/负责修复任务、逐模块门槛、受控等待与 trace/retry 规则",
- "acceptance": "不靠全局忽略或无理由 skip 隐藏问题，新增回归阻止交付，设备缺口和偶发失败单独可见"
+ "acceptance": "不靠全局忽略或无理由 skip 隐藏问题，新增回归阻止交付，设备缺口和偶发失败单独可见；以 risks.json 为统一差异索引；关闭必须有 resolutionEvidence/rationale，已复现、源码事实、未验证分开，登记不等于豁免"
},
{
"id": "CI-01",
@@ -910,7 +916,7 @@
"status": "todo",
"risk": "H",
"deliverable": "template/icons/i18n/style、SSR 与 proxy 挂载",
- "acceptance": "DOM/CSS/global/样式注入、i18n 子路径及 SSR import 保持；不把 SSR import/useSSR 保持扩大为服务端构造播放器；复跑 BASE-05 的 SSR import/模板、浏览器 useSSR 节点复用和非浏览器构造错误",
+ "acceptance": "DOM/CSS/global/样式注入、i18n 子路径及 SSR import 保持；不把 SSR import/useSSR 保持扩大为服务端构造播放器；复跑 BASE-05 的 SSR import/模板、浏览器 useSSR 节点复用和非浏览器构造错误；接续 VENDOR-01/02，核对 screenfull/hint 复制版本、修改与分发通知，保留 DOM/CSS/fullscreen 行为",
"evidence": []
},
{
@@ -1854,7 +1860,7 @@
"status": "todo",
"risk": "H",
"deliverable": "subtitles/onParser、multipleSubtitles 名称及实际返回方法",
- "acceptance": "源码/声明/README/demo/发布包差异已登记；公开形状和版本范围冻结",
+ "acceptance": "源码/声明/README/demo/发布包差异已登记；公开形状和版本范围冻结；接续 VENDOR-03，定位 WebVTT parser 来源/修订及 CC0 头，保留解析/序列化行为",
"evidence": []
},
{
@@ -1958,7 +1964,7 @@
"status": "todo",
"risk": "H",
"deliverable": "选项透传、result.instance、vendor 来源、worker/WASM/font 路径",
- "acceptance": "源码/声明/README/demo/发布包差异已登记；公开形状和版本范围冻结",
+ "acceptance": "源码/声明/README/demo/发布包差异已登记；公开形状和版本范围冻结；接续 VENDOR-04/05，核对 wrapper/worker/WASM/font 的独立来源与通知，保持资源路径和选项透传",
"evidence": []
},
{
@@ -2063,7 +2069,7 @@
"status": "todo",
"risk": "H",
"deliverable": "模型参数、start/stop、默认下载路径及 mask 样式",
- "acceptance": "源码/声明/README/demo/发布包差异已登记；公开形状和版本范围冻结",
+ "acceptance": "源码/声明/README/demo/发布包差异已登记；公开形状和版本范围冻结；接续 SDK-08，分别核实 Yarn 解析版本、未固定版本的模型 solutionPath 和资源来源",
"evidence": []
},
{
@@ -2953,7 +2959,7 @@
"status": "todo",
"risk": "H",
"deliverable": "全部 option、art.mediabunny、canvas/shim 属性及事件表",
- "acceptance": "公开暴露成员和实际发布依赖/资源范围明确",
+ "acceptance": "公开暴露成员和实际发布依赖/资源范围明确；核实 third-party.json 所记录依赖 MPL-2.0 元数据与实际 bundle 的许可/通知范围，不从根 MIT 推断",
"evidence": []
},
{
@@ -3334,7 +3340,7 @@
"status": "todo",
"risk": "M",
"deliverable": "中英文文档、插件页面、demo URL、编辑器声明与生成目录清单；六类 HTML 入口、prod/libs/code/example 加载行为及移动重定向",
- "acceptance": "所有公开 API/插件有对应页面或明确补充任务；核实 BASE-DEMO-01 的历史 thumbnail 插件来源及 29 示例/36 HTML 路径；明确 BASE-05 所记录站点实际分发与未设 private 的 manifest 意图",
+ "acceptance": "所有公开 API/插件有对应页面或明确补充任务；核实 BASE-DEMO-01 的历史 thumbnail 插件来源及 29 示例/36 HTML 路径；明确 BASE-05 所记录站点实际分发与未设 private 的 manifest 意图；接续 VENDOR-05/06/07/08 和 BASE-SITE-01/BASE-MEDIA-01，核对字体、Monaco、vConsole、console bundle 与样本来源及分发范围",
"evidence": []
},
{
@@ -3616,7 +3622,7 @@
"ENG-07"
],
"deliverable": "每批包/版本/源码/锁文件/工具/tarball integrity、必需测试/设备证据、限制和回退映射",
- "acceptance": "受影响能力缺证据明确阻止对应批次；无关批次可独立准备，旧证据在候选内容变化后失效；站点采用真实构建/URL/资源验收，npm 分发依据历史核实，不从版本清单推断新增发布范围"
+ "acceptance": "受影响能力缺证据明确阻止对应批次；无关批次可独立准备，旧证据在候选内容变化后失效；站点采用真实构建/URL/资源验收，npm 分发依据历史核实，不从版本清单推断新增发布范围；关联 risks.json 和 third-party.json；受影响 bundle/worker/WASM/font/模型的来源与许可通知缺口必须有审查结论，未决项阻止对应批次"
},
{
"id": "REL-01",
diff --git a/refactor/third-party.json b/refactor/third-party.json
new file mode 100644
index 000000000..76076d2bc
--- /dev/null
+++ b/refactor/third-party.json
@@ -0,0 +1,1178 @@
+{
+ "schemaVersion": 1,
+ "task": "BASE-07",
+ "sourceCommit": "e01f39ff",
+ "capturedAt": "2026-09-10T12:58:34.266Z",
+ "note": "Maintained provenance inventory. Unknown versions/licenses remain open. No complete legal, security or runtime audit is claimed; remote services were not invoked. Fingerprints cover selected copied assets, not every repository media file.",
+ "packages": [
+ {
+ "name": "artplayer",
+ "declaredRuntimeDependencies": {
+ "option-validator": "^2.0.6"
+ },
+ "resolvedRuntimeDependencies": [
+ {
+ "name": "option-validator",
+ "range": "^2.0.6",
+ "lockedVersion": "2.0.6",
+ "installedVersion": "2.0.6",
+ "manifestLicense": "MIT",
+ "licenseEvidence": "Installed package manifest claim; bundled notice and transitive/license review remain with the owning package."
+ }
+ ],
+ "developmentDependencies": {}
+ },
+ {
+ "name": "artplayer-plugin-ads",
+ "declaredRuntimeDependencies": {},
+ "resolvedRuntimeDependencies": [],
+ "developmentDependencies": {}
+ },
+ {
+ "name": "artplayer-plugin-ambilight",
+ "declaredRuntimeDependencies": {},
+ "resolvedRuntimeDependencies": [],
+ "developmentDependencies": {}
+ },
+ {
+ "name": "artplayer-plugin-asr",
+ "declaredRuntimeDependencies": {},
+ "resolvedRuntimeDependencies": [],
+ "developmentDependencies": {}
+ },
+ {
+ "name": "artplayer-plugin-audio-track",
+ "declaredRuntimeDependencies": {},
+ "resolvedRuntimeDependencies": [],
+ "developmentDependencies": {}
+ },
+ {
+ "name": "artplayer-plugin-auto-thumbnail",
+ "declaredRuntimeDependencies": {},
+ "resolvedRuntimeDependencies": [],
+ "developmentDependencies": {}
+ },
+ {
+ "name": "artplayer-plugin-chapter",
+ "declaredRuntimeDependencies": {},
+ "resolvedRuntimeDependencies": [],
+ "developmentDependencies": {}
+ },
+ {
+ "name": "artplayer-plugin-chromecast",
+ "declaredRuntimeDependencies": {},
+ "resolvedRuntimeDependencies": [],
+ "developmentDependencies": {}
+ },
+ {
+ "name": "artplayer-plugin-danmuku",
+ "declaredRuntimeDependencies": {},
+ "resolvedRuntimeDependencies": [],
+ "developmentDependencies": {}
+ },
+ {
+ "name": "artplayer-plugin-danmuku-mask",
+ "declaredRuntimeDependencies": {
+ "@mediapipe/selfie_segmentation": "^0.1.1675465747",
+ "@tensorflow-models/body-segmentation": "^1.0.2",
+ "@tensorflow/tfjs-backend-cpu": "^4.21.0",
+ "@tensorflow/tfjs-backend-webgl": "^4.21.0",
+ "@tensorflow/tfjs-converter": "^4.21.0",
+ "@tensorflow/tfjs-core": "^4.21.0"
+ },
+ "resolvedRuntimeDependencies": [
+ {
+ "name": "@mediapipe/selfie_segmentation",
+ "range": "^0.1.1675465747",
+ "lockedVersion": "0.1.1675465747",
+ "installedVersion": "0.1.1675465747",
+ "manifestLicense": "Apache-2.0",
+ "licenseEvidence": "Installed package manifest claim; bundled notice and transitive/license review remain with the owning package."
+ },
+ {
+ "name": "@tensorflow-models/body-segmentation",
+ "range": "^1.0.2",
+ "lockedVersion": "1.0.2",
+ "installedVersion": "1.0.2",
+ "manifestLicense": "Apache-2.0",
+ "licenseEvidence": "Installed package manifest claim; bundled notice and transitive/license review remain with the owning package."
+ },
+ {
+ "name": "@tensorflow/tfjs-backend-cpu",
+ "range": "^4.21.0",
+ "lockedVersion": "4.22.0",
+ "installedVersion": "4.22.0",
+ "manifestLicense": "Apache-2.0",
+ "licenseEvidence": "Installed package manifest claim; bundled notice and transitive/license review remain with the owning package."
+ },
+ {
+ "name": "@tensorflow/tfjs-backend-webgl",
+ "range": "^4.21.0",
+ "lockedVersion": "4.22.0",
+ "installedVersion": "4.22.0",
+ "manifestLicense": "Apache-2.0",
+ "licenseEvidence": "Installed package manifest claim; bundled notice and transitive/license review remain with the owning package."
+ },
+ {
+ "name": "@tensorflow/tfjs-converter",
+ "range": "^4.21.0",
+ "lockedVersion": "4.22.0",
+ "installedVersion": "4.22.0",
+ "manifestLicense": "Apache-2.0",
+ "licenseEvidence": "Installed package manifest claim; bundled notice and transitive/license review remain with the owning package."
+ },
+ {
+ "name": "@tensorflow/tfjs-core",
+ "range": "^4.21.0",
+ "lockedVersion": "4.22.0",
+ "installedVersion": "4.22.0",
+ "manifestLicense": "Apache-2.0",
+ "licenseEvidence": "Installed package manifest claim; bundled notice and transitive/license review remain with the owning package."
+ }
+ ],
+ "developmentDependencies": {}
+ },
+ {
+ "name": "artplayer-plugin-dash-control",
+ "declaredRuntimeDependencies": {},
+ "resolvedRuntimeDependencies": [],
+ "developmentDependencies": {}
+ },
+ {
+ "name": "artplayer-plugin-document-pip",
+ "declaredRuntimeDependencies": {},
+ "resolvedRuntimeDependencies": [],
+ "developmentDependencies": {}
+ },
+ {
+ "name": "artplayer-plugin-hls-control",
+ "declaredRuntimeDependencies": {},
+ "resolvedRuntimeDependencies": [],
+ "developmentDependencies": {}
+ },
+ {
+ "name": "artplayer-plugin-jassub",
+ "declaredRuntimeDependencies": {},
+ "resolvedRuntimeDependencies": [],
+ "developmentDependencies": {}
+ },
+ {
+ "name": "artplayer-plugin-multiple-subtitles",
+ "declaredRuntimeDependencies": {},
+ "resolvedRuntimeDependencies": [],
+ "developmentDependencies": {}
+ },
+ {
+ "name": "artplayer-plugin-vast",
+ "declaredRuntimeDependencies": {
+ "@glomex/vast-ima-player": "^1.21.2"
+ },
+ "resolvedRuntimeDependencies": [
+ {
+ "name": "@glomex/vast-ima-player",
+ "range": "^1.21.2",
+ "lockedVersion": "1.21.2",
+ "installedVersion": "1.21.2",
+ "manifestLicense": "Apache-2.0",
+ "licenseEvidence": "Installed package manifest claim; bundled notice and transitive/license review remain with the owning package."
+ }
+ ],
+ "developmentDependencies": {}
+ },
+ {
+ "name": "artplayer-plugin-vtt-thumbnail",
+ "declaredRuntimeDependencies": {},
+ "resolvedRuntimeDependencies": [],
+ "developmentDependencies": {}
+ },
+ {
+ "name": "artplayer-proxy-canvas",
+ "declaredRuntimeDependencies": {},
+ "resolvedRuntimeDependencies": [],
+ "developmentDependencies": {}
+ },
+ {
+ "name": "artplayer-proxy-mediabunny",
+ "declaredRuntimeDependencies": {
+ "mediabunny": "^1.43.1"
+ },
+ "resolvedRuntimeDependencies": [
+ {
+ "name": "mediabunny",
+ "range": "^1.43.1",
+ "lockedVersion": "1.56.1",
+ "installedVersion": "1.56.1",
+ "manifestLicense": "MPL-2.0",
+ "licenseEvidence": "Installed package manifest claim; bundled notice and transitive/license review remain with the owning package."
+ }
+ ],
+ "developmentDependencies": {}
+ },
+ {
+ "name": "artplayer-tool-iframe",
+ "declaredRuntimeDependencies": {},
+ "resolvedRuntimeDependencies": [],
+ "developmentDependencies": {}
+ },
+ {
+ "name": "artplayer-tool-thumbnail",
+ "declaredRuntimeDependencies": {},
+ "resolvedRuntimeDependencies": [],
+ "developmentDependencies": {}
+ },
+ {
+ "name": "artplayer-vitepress",
+ "declaredRuntimeDependencies": {},
+ "resolvedRuntimeDependencies": [],
+ "developmentDependencies": {
+ "flexsearch": "0.8.158",
+ "markdown-it": "14.1.0",
+ "vitepress": "1.6.3",
+ "vitepress-plugin-search": "1.0.4-alpha.22",
+ "vue": "3.5.13"
+ }
+ }
+ ],
+ "vendored": [
+ {
+ "id": "screenfull",
+ "riskId": "VENDOR-01",
+ "inputs": [
+ "packages/artplayer/src/libs/screenfull.js"
+ ],
+ "owners": [
+ "CORE-12"
+ ],
+ "sourceStatus": "Local filename/implementation identifies screenfull; exact upstream revision not established.",
+ "licenseStatus": "Current upstream license is MIT; local copied file lacks a license header. Exact version and notice coverage remain unverified.",
+ "upstreamSources": [
+ "https://github.com/sindresorhus/screenfull/blob/main/license"
+ ],
+ "upstreamReviewedAt": "2026-09-10",
+ "updatePolicy": "Keep separate from owned TS migration. Verify source/version/diff and license notices before replacement; preserve API/CSS/worker URLs and run owning package tests.",
+ "fingerprints": [
+ {
+ "path": "packages/artplayer/src/libs/screenfull.js",
+ "algorithm": "sha256-lf",
+ "sha256": "2332b50c0c6364d5c99080be0f5739255e4b9e465d2cca40f761adce9a1908f8"
+ }
+ ]
+ },
+ {
+ "id": "hint.css",
+ "riskId": "VENDOR-02",
+ "inputs": [
+ "packages/artplayer/src/style/hint.less"
+ ],
+ "owners": [
+ "CORE-12"
+ ],
+ "sourceStatus": "Local header names Hint.css 2.7.0, 2021-10-01; code is scoped/adapted in Less.",
+ "licenseStatus": "Local copyright header and current upstream MIT license observed; exact upstream diff and shipped notices pending.",
+ "upstreamSources": [
+ "https://github.com/chinchang/hint.css/blob/master/LICENSE"
+ ],
+ "upstreamReviewedAt": "2026-09-10",
+ "updatePolicy": "Keep separate from owned TS migration. Verify source/version/diff and license notices before replacement; preserve API/CSS/worker URLs and run owning package tests.",
+ "fingerprints": [
+ {
+ "path": "packages/artplayer/src/style/hint.less",
+ "algorithm": "sha256-lf",
+ "sha256": "e2dc4940e6b212d8da75a404fd5ff1ad894008457677bc37554c6b64b735bc31"
+ }
+ ]
+ },
+ {
+ "id": "webvtt-parser",
+ "riskId": "VENDOR-03",
+ "inputs": [
+ "packages/artplayer-plugin-multiple-subtitles/src/parser.js"
+ ],
+ "owners": [
+ "PKG-MULTI-SUB-01"
+ ],
+ "sourceStatus": "Local WebVTTParser/Serializer and CC0 header correspond to the upstream family; exact revision/diff unknown.",
+ "licenseStatus": "Local public-domain/CC0 dedication present; upstream repository identifies CC0-1.0.",
+ "upstreamSources": [
+ "https://github.com/w3c/webvtt.js",
+ "https://raw.githubusercontent.com/w3c/webvtt.js/master/parser.js"
+ ],
+ "upstreamReviewedAt": "2026-09-10",
+ "updatePolicy": "Keep separate from owned TS migration. Verify source/version/diff and license notices before replacement; preserve API/CSS/worker URLs and run owning package tests.",
+ "fingerprints": [
+ {
+ "path": "packages/artplayer-plugin-multiple-subtitles/src/parser.js",
+ "algorithm": "sha256-lf",
+ "sha256": "ba582074d57fa2d72880e6e4253fe14646787916b2b68e2a1e748e685cf96ab1"
+ }
+ ]
+ },
+ {
+ "id": "jassub-code-and-workers",
+ "riskId": "VENDOR-04",
+ "inputs": [
+ "packages/artplayer-plugin-jassub/src/jassub.es.js",
+ "packages/artplayer-plugin-jassub/worker",
+ "docs/assets/jassub/jassub-worker.js",
+ "docs/assets/jassub/jassub-worker.wasm",
+ "docs/assets/jassub/jassub-worker-modern.wasm"
+ ],
+ "owners": [
+ "PKG-JASSUB-01"
+ ],
+ "sourceStatus": "JASSUB example links upstream; exact wrapper/worker/WASM build version and subcomponent graph not established.",
+ "licenseStatus": "Current upstream wrapper LICENSE is MIT; this does not certify linked WASM libraries, fonts, or the exact local build.",
+ "upstreamSources": [
+ "https://github.com/ThaUnknown/jassub/blob/main/LICENSE"
+ ],
+ "upstreamReviewedAt": "2026-09-10",
+ "updatePolicy": "Keep separate from owned TS migration. Verify source/version/diff and license notices before replacement; preserve API/CSS/worker URLs and run owning package tests.",
+ "fingerprints": [
+ {
+ "path": "docs/assets/jassub/jassub-worker-modern.wasm",
+ "algorithm": "sha256",
+ "sha256": "8a8b37463713d1f2ddbc1fbb8a35889d9565e5a6670851758b46b2216d8e513c"
+ },
+ {
+ "path": "docs/assets/jassub/jassub-worker.js",
+ "algorithm": "sha256-lf",
+ "sha256": "0fb9a83f96fc39426e733a94f3e7fe4e37099324c08328450ba032b653e85707"
+ },
+ {
+ "path": "docs/assets/jassub/jassub-worker.wasm",
+ "algorithm": "sha256",
+ "sha256": "73880d99ba9260ac39fc4476491cf254ca784c76f3af2fb03f3f9be8065ad3c0"
+ },
+ {
+ "path": "packages/artplayer-plugin-jassub/src/jassub.es.js",
+ "algorithm": "sha256-lf",
+ "sha256": "b973508ade00b5b9cea2f299d49f4943003372729be7350b6938e44fddb32038"
+ },
+ {
+ "path": "packages/artplayer-plugin-jassub/worker/jassub-worker-modern.wasm",
+ "algorithm": "sha256",
+ "sha256": "8a8b37463713d1f2ddbc1fbb8a35889d9565e5a6670851758b46b2216d8e513c"
+ },
+ {
+ "path": "packages/artplayer-plugin-jassub/worker/jassub-worker.js",
+ "algorithm": "sha256-lf",
+ "sha256": "0fb9a83f96fc39426e733a94f3e7fe4e37099324c08328450ba032b653e85707"
+ },
+ {
+ "path": "packages/artplayer-plugin-jassub/worker/jassub-worker.wasm",
+ "algorithm": "sha256",
+ "sha256": "73880d99ba9260ac39fc4476491cf254ca784c76f3af2fb03f3f9be8065ad3c0"
+ }
+ ]
+ },
+ {
+ "id": "jassub-font-assets",
+ "riskId": "VENDOR-05",
+ "inputs": [
+ "docs/assets/jassub/default.woff2",
+ "docs/assets/jassub/fonts"
+ ],
+ "owners": [
+ "PKG-JASSUB-01",
+ "SITE-01"
+ ],
+ "sourceStatus": "Mixed named font files; version/source provenance unavailable from file names alone.",
+ "licenseStatus": "Font redistribution rights are unverified; do not infer licenses from root MIT or font names.",
+ "upstreamSources": [],
+ "upstreamReviewedAt": null,
+ "updatePolicy": "Keep separate from owned TS migration. Verify source/version/diff and license notices before replacement; preserve API/CSS/worker URLs and run owning package tests.",
+ "fingerprints": [
+ {
+ "path": "docs/assets/jassub/default.woff2",
+ "algorithm": "sha256",
+ "sha256": "886929903707c5bb28b07cd2eed69921b3d5ef5c49c73a0dd1e187ebf6546a4c"
+ },
+ {
+ "path": "docs/assets/jassub/fonts/Averia Sans Libre Light.ttf",
+ "algorithm": "sha256",
+ "sha256": "df4ca526f9a941afda1f9c5a275695beb066a531f5b008c1e28ddc2c5f6e4390"
+ },
+ {
+ "path": "docs/assets/jassub/fonts/Averia Serif Simple Light.ttf",
+ "algorithm": "sha256",
+ "sha256": "fb6398238298a7010920e1c216f7b29bc920477bc810f8bcc677ae4e6f411b4b"
+ },
+ {
+ "path": "docs/assets/jassub/fonts/FRABK.TTF",
+ "algorithm": "sha256",
+ "sha256": "9ad3d0e5ef31c4a9a98cb0e169e4e625286aa34c712add3e001c0100138730d4"
+ },
+ {
+ "path": "docs/assets/jassub/fonts/Gramond.ttf",
+ "algorithm": "sha256",
+ "sha256": "072859788bc577d35df2e852225c52cc5670339a4859d86b5edb96b1724a2177"
+ },
+ {
+ "path": "docs/assets/jassub/fonts/Lato-Regular.ttf",
+ "algorithm": "sha256",
+ "sha256": "6f6940be0835c3ddec9199e5fc42be4cbc61ebcfd58c623fdf719366253f1780"
+ },
+ {
+ "path": "docs/assets/jassub/fonts/SlatePro-Medium.otf",
+ "algorithm": "sha256",
+ "sha256": "56aa0fc2878bf782c10e5bba6dc45de1982a572d14ba9e10cd9d5a4414b6171e"
+ },
+ {
+ "path": "docs/assets/jassub/fonts/allison-script.regular.otf",
+ "algorithm": "sha256",
+ "sha256": "97cd66bb6f89bdd32af2a9592f439536c85aa7553516514e2623bb1e81c65bd6"
+ },
+ {
+ "path": "docs/assets/jassub/fonts/architext.regular.ttf",
+ "algorithm": "sha256",
+ "sha256": "a6b8e33ce190ee9c871590b982cff37e137b303bb73dcab55ef3ff7154ba143a"
+ },
+ {
+ "path": "docs/assets/jassub/fonts/arial.ttf",
+ "algorithm": "sha256",
+ "sha256": "c9b76220a5be42ead4733611e417cd65c5fd8aeaa33eb56576ac378a37d130a1"
+ },
+ {
+ "path": "docs/assets/jassub/fonts/chawp.otf",
+ "algorithm": "sha256",
+ "sha256": "9107241585a4328ce1438dfeabbfb1a8d0cd513dab6902be9a1a5774eab607c6"
+ },
+ {
+ "path": "docs/assets/jassub/fonts/default.woff2",
+ "algorithm": "sha256",
+ "sha256": "886929903707c5bb28b07cd2eed69921b3d5ef5c49c73a0dd1e187ebf6546a4c"
+ }
+ ]
+ },
+ {
+ "id": "monaco-static-assets",
+ "riskId": "VENDOR-06",
+ "inputs": [
+ "docs/assets/js/vs"
+ ],
+ "owners": [
+ "SITE-01",
+ "SITE-05"
+ ],
+ "sourceStatus": "Local headers name Monaco build 0.30.1 (829382514cb1065f5ebb90f436e1c6103e153953).",
+ "licenseStatus": "Headers identify MIT; editor.main also includes third-party notices such as DOMPurify. Full component/notice closure is pending.",
+ "upstreamSources": [],
+ "upstreamReviewedAt": null,
+ "updatePolicy": "Keep separate from owned TS migration. Verify source/version/diff and license notices before replacement; preserve API/CSS/worker URLs and run owning package tests.",
+ "fingerprints": [
+ {
+ "path": "docs/assets/js/vs/base/browser/ui/codicons/codicon/codicon.ttf",
+ "algorithm": "sha256",
+ "sha256": "ff6b888d65cfd8077d49c6c704c1bfc8f2ce1ed71db9c583c63e0a49f046c79c"
+ },
+ {
+ "path": "docs/assets/js/vs/base/worker/workerMain.js",
+ "algorithm": "sha256-lf",
+ "sha256": "3ebdb68f45f9fed1c587901c9db42dd70e8a552421e330f39116fc7b078ba67e"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/abap/abap.js",
+ "algorithm": "sha256-lf",
+ "sha256": "49638217243bab4ed7d928d194bafe334abb614777440bf46f8636b9e5dfe0a4"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/apex/apex.js",
+ "algorithm": "sha256-lf",
+ "sha256": "034f340001e4c340b80e18abe45c990564931c4a061b4e74de86c012fb7d7a21"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/azcli/azcli.js",
+ "algorithm": "sha256-lf",
+ "sha256": "be50c776891279c9717db0d48a20d6d99f07cb60d2d8d279422fa917826683cf"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/bat/bat.js",
+ "algorithm": "sha256-lf",
+ "sha256": "3ec5d66f73ee7e7dc2b43db5999a768d1a54e933de9f507015fe7709a184adee"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/bicep/bicep.js",
+ "algorithm": "sha256-lf",
+ "sha256": "59d02b8930e36e2cbc3e472e263f881a82d84da292a79faf1d379cb060a2d7e1"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/cameligo/cameligo.js",
+ "algorithm": "sha256-lf",
+ "sha256": "f93cd405c71f97f26b4739f7f917b242e82a993ad42884422a43bf27d5b413e2"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/clojure/clojure.js",
+ "algorithm": "sha256-lf",
+ "sha256": "9e99cf86bcfb25c1b33bac9e26e11e4646868fa753356c7d737cfb24b7b1e49c"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/coffee/coffee.js",
+ "algorithm": "sha256-lf",
+ "sha256": "90d6aae23c9f5e4f335df5cb57634fa0193a102629deb88b98f238b4025f0551"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/cpp/cpp.js",
+ "algorithm": "sha256-lf",
+ "sha256": "ece3d119688eaf8a37fffae388118b12f8724ac2c3c8ff10d44caf2e91026424"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/csharp/csharp.js",
+ "algorithm": "sha256-lf",
+ "sha256": "d6367d0d67c0612cf37d25319e00cda2e4e38869a3c3200b1bfcd856cfe7fb4b"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/csp/csp.js",
+ "algorithm": "sha256-lf",
+ "sha256": "01241c709a7dddc0b5cedffb6dcf913a5d95c826eb68e2c27f114640719af7df"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/css/css.js",
+ "algorithm": "sha256-lf",
+ "sha256": "1f8468a126f6bfdc43d49a75e0ae758de913ebf55e685165adb6d069a454de5c"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/dart/dart.js",
+ "algorithm": "sha256-lf",
+ "sha256": "6b410bbe17b8ebcaed969bdfcf8049df6fe863482756ae73d2aebb919630034c"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/dockerfile/dockerfile.js",
+ "algorithm": "sha256-lf",
+ "sha256": "315769a72a2877f8ddddf9497a2e7e259e8df51cc38232ddf76fbe4556c0d7cd"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/ecl/ecl.js",
+ "algorithm": "sha256-lf",
+ "sha256": "fc412fe18e564cff17e9a0bcd5674ba15c49f4739417cf589ce1c546b21033a9"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/elixir/elixir.js",
+ "algorithm": "sha256-lf",
+ "sha256": "130d310090d723f51111d573000a72aa26fe44c9d79e6d04d12524e6631cfb6b"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/flow9/flow9.js",
+ "algorithm": "sha256-lf",
+ "sha256": "fafd88d973aed314454cd7d842b270125553f7a7613bb068c3c799a21ac61b64"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/fsharp/fsharp.js",
+ "algorithm": "sha256-lf",
+ "sha256": "32027afd4be75ddeca6c7beb9b52eda07d59afe3ea39a84f0696a6b3d074dcbf"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/go/go.js",
+ "algorithm": "sha256-lf",
+ "sha256": "c93466a4479ee8aa5e3ec70a89b469db1277b801d1551d40ad700d5abd367363"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/graphql/graphql.js",
+ "algorithm": "sha256-lf",
+ "sha256": "60a8825e939ca81540eb6ac00b17867b3e55af97bff99a9fa40c422a4281bdcf"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/handlebars/handlebars.js",
+ "algorithm": "sha256-lf",
+ "sha256": "5a174247aa64c7a064fc977365bb1c7161b4c97e559a6121773188c25df9d9a2"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/hcl/hcl.js",
+ "algorithm": "sha256-lf",
+ "sha256": "6053e90b8aa918c9744f41dcb1c0e58229a4946f0968a39b00776c3893538f54"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/html/html.js",
+ "algorithm": "sha256-lf",
+ "sha256": "6e7ae0ce7f07ec01c64db1368869715c115690e40fb5c183d5ced0d2716038bd"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/ini/ini.js",
+ "algorithm": "sha256-lf",
+ "sha256": "ecdb5c36a38a8b68af6384789c380d0e28b5b3df86de9c3419d348e688b8810e"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/java/java.js",
+ "algorithm": "sha256-lf",
+ "sha256": "8fd9c491b67dfa9ab831ed71a3973cc6ffc840f438f41114a794163672f4cf9c"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/javascript/javascript.js",
+ "algorithm": "sha256-lf",
+ "sha256": "bbd7fb1b714d347704eae4c74cb36c352876864f2103a69af3965f32c1c982c6"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/julia/julia.js",
+ "algorithm": "sha256-lf",
+ "sha256": "ef3783cbb81cee25697c0bddc9476813b593fb64712c21bc60099c8109c748f0"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/kotlin/kotlin.js",
+ "algorithm": "sha256-lf",
+ "sha256": "31b082803acb08622aa2dd736dca42772f6a0d3224fdb7c0e9c3e1f17800ca32"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/less/less.js",
+ "algorithm": "sha256-lf",
+ "sha256": "5ba9296cc5c6a7699028ac6e263631eb9284f80bfbffe99a4429f6c85dfc0589"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/lexon/lexon.js",
+ "algorithm": "sha256-lf",
+ "sha256": "2be27259788a7a4a6fb94a59150b47d169ef6e04933f76977e568c4cb0227f57"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/liquid/liquid.js",
+ "algorithm": "sha256-lf",
+ "sha256": "f4454c09b7e66ab2ffd81451aef2f12c79c0011839e19bcdb0fce42928acce6b"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/lua/lua.js",
+ "algorithm": "sha256-lf",
+ "sha256": "f39154e727c8d3df5c70ecab1737c0a07df3011977288ba4adc7d25c8ef639b5"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/m3/m3.js",
+ "algorithm": "sha256-lf",
+ "sha256": "a3b616444441f34b90b4e06a6a3a845f2804da67220c19721b9461140eb7f074"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/markdown/markdown.js",
+ "algorithm": "sha256-lf",
+ "sha256": "47ae9f567af2e69e682d14703bf4ad5428708464edb3d30791f3255a2863a52e"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/mips/mips.js",
+ "algorithm": "sha256-lf",
+ "sha256": "fcc6104a8c7092794744a1472511cd348d585d1cba0421e61e5eb8e0c58af186"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/msdax/msdax.js",
+ "algorithm": "sha256-lf",
+ "sha256": "f98e43f6600e629bfc354196006a02f9f9cc26480de064cc480e3bc885beb283"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/mysql/mysql.js",
+ "algorithm": "sha256-lf",
+ "sha256": "1cafe5b6c81234fc6680a421dd6290ec590ce03b9e525eacb0936a78ab50aeae"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/objective-c/objective-c.js",
+ "algorithm": "sha256-lf",
+ "sha256": "7cfdb8b492b6f1c5a1d83fefc3bd349bb1acdd489516534aefacd553c2850e75"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/pascal/pascal.js",
+ "algorithm": "sha256-lf",
+ "sha256": "f2886264f5ad42d173ef18e8ea961f674090be7513f48af95dcef4eb1191cac3"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/pascaligo/pascaligo.js",
+ "algorithm": "sha256-lf",
+ "sha256": "3d3317429e0837f6960e33829a2c2fd62119ca1514ad735f62345da8fd1dd817"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/perl/perl.js",
+ "algorithm": "sha256-lf",
+ "sha256": "317b527f0ade315a7cb066eac72672e5f2ba6d0c02c6014be052c32fb6566aed"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/pgsql/pgsql.js",
+ "algorithm": "sha256-lf",
+ "sha256": "f58b4ab8529e311f7f98f690ed39e13de22f3ae29cc8916bf99c21ac86917970"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/php/php.js",
+ "algorithm": "sha256-lf",
+ "sha256": "3d7d187fb2e3b959adfda7b7557ccda4b6f690f838babc525cabffbe0dda7dd0"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/pla/pla.js",
+ "algorithm": "sha256-lf",
+ "sha256": "6138b0b0a1be95370c00afe6eca5022ea10e8b0f11f1db9382163f28975373e6"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/postiats/postiats.js",
+ "algorithm": "sha256-lf",
+ "sha256": "5b18eac81236e88ffca2e67e527fa1d6fb42f53a4df42c1fbeb37312a9ec2fe4"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/powerquery/powerquery.js",
+ "algorithm": "sha256-lf",
+ "sha256": "fb9705793a687b03fe08605f19c3f1019d83cf06394a8381db541bda92e230d4"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/powershell/powershell.js",
+ "algorithm": "sha256-lf",
+ "sha256": "b80339b4a8450fd3a5bb5bf3817fb1b67fe6202690fc1ce97ef22336bcd7053b"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/protobuf/protobuf.js",
+ "algorithm": "sha256-lf",
+ "sha256": "18f13fbd6b421023eec480901e48354d249bc9c3dce9d0e0cc842cbab4393fd3"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/pug/pug.js",
+ "algorithm": "sha256-lf",
+ "sha256": "dbce9bb879b84cf3bf8bd05643a4d3d2ae6ded03b4a9234a0e8d2ebfab6ade44"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/python/python.js",
+ "algorithm": "sha256-lf",
+ "sha256": "b0c9cb9c96d3b289b4ee1bb6ca921e810d87ec2967ebaf8608d5570865ac6524"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/qsharp/qsharp.js",
+ "algorithm": "sha256-lf",
+ "sha256": "6cf9e660e8082f7a8dff4e8041c58c5e9fed1e622e0301b359886a5148c15327"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/r/r.js",
+ "algorithm": "sha256-lf",
+ "sha256": "889684005db07d8b2e8c6f17d54b7bbf1bd67ad948b0b9ca411c2e55ba3433dd"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/razor/razor.js",
+ "algorithm": "sha256-lf",
+ "sha256": "da07ee116d392fbf97f5adc9d4f1fd46e5bbbe9765949c8cb9a6f6a4917ce6cb"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/redis/redis.js",
+ "algorithm": "sha256-lf",
+ "sha256": "286518ee6a7e76356149bebfbcdc19d2d30c19a5fa48d4bfcbf2f7a946783bd0"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/redshift/redshift.js",
+ "algorithm": "sha256-lf",
+ "sha256": "8b865d41e76c227f3e1eb3bc74f8e9cf24627b449cc94164c803c1e515a9bbfd"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/restructuredtext/restructuredtext.js",
+ "algorithm": "sha256-lf",
+ "sha256": "32c72e9b8fa318289b628efee24bc5b573e3f74f8ab7dd544dead1b3545fc351"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/ruby/ruby.js",
+ "algorithm": "sha256-lf",
+ "sha256": "93a9fbda62d9b4ef5537de37d7b4c77a89d8e2b0a2193dddac534ce98da47b5f"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/rust/rust.js",
+ "algorithm": "sha256-lf",
+ "sha256": "6352c16af73494a44e09b5ccad8a61c0369933d94881fcf58a7e8a75a27315cf"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/sb/sb.js",
+ "algorithm": "sha256-lf",
+ "sha256": "7323046d28f72e54b5abda684d4ec67d55b688a0b5e1d23ffe1d675c1c141b69"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/scala/scala.js",
+ "algorithm": "sha256-lf",
+ "sha256": "57309bc0e00edda2c4edb5fd255e042e1ef6ce8d51f51c7e822a74268e04f444"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/scheme/scheme.js",
+ "algorithm": "sha256-lf",
+ "sha256": "3fe89a5618aa1c4eafa5c65aad212fcf2ba34e302de73df7db0867ba01dbd866"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/scss/scss.js",
+ "algorithm": "sha256-lf",
+ "sha256": "b01dfbdbd787642ed55a3ca7b0b89b2edb80e4aa486d89fee0ba748124dad4f9"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/shell/shell.js",
+ "algorithm": "sha256-lf",
+ "sha256": "39063f662fa62eb543e5d8f9b792b31d14c484abafd9a67943dae52fc9f5ce36"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/solidity/solidity.js",
+ "algorithm": "sha256-lf",
+ "sha256": "e25859bb2a1babe193f03028489c95296b1bfe98a92dcb450d4c539661b5a86d"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/sophia/sophia.js",
+ "algorithm": "sha256-lf",
+ "sha256": "4ba061aa0beb82ba64efeb6bd1128da0d3445ac8cfc26d3f4591c66df0fa4bb0"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/sparql/sparql.js",
+ "algorithm": "sha256-lf",
+ "sha256": "162783ddf2dd67384d379ebf485f6ed0cafd820e892e4d89e82c8ba8617390c4"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/sql/sql.js",
+ "algorithm": "sha256-lf",
+ "sha256": "3b1decbf86cb0b163070cc144e826f104ba10468798b36e6d0e64257a35fd1f8"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/st/st.js",
+ "algorithm": "sha256-lf",
+ "sha256": "b3ac35684d5668c2d08105cec31f43e8d897e4ab94103d8bd64ac804d256c20c"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/swift/swift.js",
+ "algorithm": "sha256-lf",
+ "sha256": "288a0ad2974e332bb873bacbb2a284f8f39cdc7d12b1fd5e3c46699147a63633"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/systemverilog/systemverilog.js",
+ "algorithm": "sha256-lf",
+ "sha256": "40b18f15d29e3201142eb02fd5cc5ad690b32386bbe5dc0a874fd68a2f176f41"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/tcl/tcl.js",
+ "algorithm": "sha256-lf",
+ "sha256": "317b63a872ce538d4eef5dae701641670fd3f99dfc0439465d444b2992b69bea"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/twig/twig.js",
+ "algorithm": "sha256-lf",
+ "sha256": "c3442379367d5ef43f1377a14e3c6a04ec451dabb05bed200571ea6dc328dfa0"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/typescript/typescript.js",
+ "algorithm": "sha256-lf",
+ "sha256": "25dd318efd5aada375fdf391c488bd0b5ec0d665ba16e49f1e7968217ad01139"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/vb/vb.js",
+ "algorithm": "sha256-lf",
+ "sha256": "41d3d863c8b955c53eddb8724866a487d3632995114c77c0e9bc416227d148bf"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/xml/xml.js",
+ "algorithm": "sha256-lf",
+ "sha256": "95ddef452d5ff87f5c9f807d56f3f74964727677b5a55baa13a0a4870e2ae850"
+ },
+ {
+ "path": "docs/assets/js/vs/basic-languages/yaml/yaml.js",
+ "algorithm": "sha256-lf",
+ "sha256": "a6ffa854247873af58df3ad550bbdd474b2d8dbc1d1c730fce4e44dfcb5f9b62"
+ },
+ {
+ "path": "docs/assets/js/vs/editor/editor.main.css",
+ "algorithm": "sha256-lf",
+ "sha256": "6240d544d93236ac40dd3bd1ee49afbd27cb43e056c24c04a0c2cb37f1fd4587"
+ },
+ {
+ "path": "docs/assets/js/vs/editor/editor.main.js",
+ "algorithm": "sha256-lf",
+ "sha256": "05a50ed50bb013b6e7a82d25686186aa7bdff8b8209c7badab00e046b5e99618"
+ },
+ {
+ "path": "docs/assets/js/vs/editor/editor.main.nls.de.js",
+ "algorithm": "sha256-lf",
+ "sha256": "e31a518baf29ffce15a27ac80a6b5406ebf21c76657f3344f46c9ac0e6d0c202"
+ },
+ {
+ "path": "docs/assets/js/vs/editor/editor.main.nls.es.js",
+ "algorithm": "sha256-lf",
+ "sha256": "f86887a1575bc71f035e92eb68b3d4e8c4e351d93f3b98520660933fed984007"
+ },
+ {
+ "path": "docs/assets/js/vs/editor/editor.main.nls.fr.js",
+ "algorithm": "sha256-lf",
+ "sha256": "673214777e1ba3518abe1bbde8b5250cb18d65257054c8adf9cb5e1e49918d27"
+ },
+ {
+ "path": "docs/assets/js/vs/editor/editor.main.nls.it.js",
+ "algorithm": "sha256-lf",
+ "sha256": "66df8e46d4aa40b5393489efda7e8aee5ad5589fdf68fef03832e665f0aabc9c"
+ },
+ {
+ "path": "docs/assets/js/vs/editor/editor.main.nls.ja.js",
+ "algorithm": "sha256-lf",
+ "sha256": "4688d4dfa1ddf91cbfa7005e1110b12f79315706e7d56463c96e8bc688a3d60d"
+ },
+ {
+ "path": "docs/assets/js/vs/editor/editor.main.nls.js",
+ "algorithm": "sha256-lf",
+ "sha256": "4d4915b0ff284b77938d3be70b9000911554fc451263a7baa594d199ef170a0e"
+ },
+ {
+ "path": "docs/assets/js/vs/editor/editor.main.nls.ko.js",
+ "algorithm": "sha256-lf",
+ "sha256": "a6d39e2202fa271bfd5e04b83a5265bbe7ef73a945471c9e9fcb65ff8f1a8663"
+ },
+ {
+ "path": "docs/assets/js/vs/editor/editor.main.nls.ru.js",
+ "algorithm": "sha256-lf",
+ "sha256": "345850b05cc97c0c1978df43ee996a32da7cd33ba1a85be3b6958884a8307040"
+ },
+ {
+ "path": "docs/assets/js/vs/editor/editor.main.nls.zh-cn.js",
+ "algorithm": "sha256-lf",
+ "sha256": "30ce784d1733d424e221009e097760b813e629d63579bddb62f7a4f229b9011f"
+ },
+ {
+ "path": "docs/assets/js/vs/editor/editor.main.nls.zh-tw.js",
+ "algorithm": "sha256-lf",
+ "sha256": "ab5c148283e9afd0577afb5e522e45c6c2b323a0a12215b71f92155fbf003b74"
+ },
+ {
+ "path": "docs/assets/js/vs/language/css/cssMode.js",
+ "algorithm": "sha256-lf",
+ "sha256": "c0f3a99395d07b421ef75f6eb78389c6ef29477f6a05556f9b94e2bb918dd6c1"
+ },
+ {
+ "path": "docs/assets/js/vs/language/css/cssWorker.js",
+ "algorithm": "sha256-lf",
+ "sha256": "073e09f9301dcf147e40ef675e3f18d8cc29de9f49673ec8d17711569144552d"
+ },
+ {
+ "path": "docs/assets/js/vs/language/html/htmlMode.js",
+ "algorithm": "sha256-lf",
+ "sha256": "91f7b295ddc3b0b679c669b84865f3ace79fdd30bfcd814f2960c06f3e24d600"
+ },
+ {
+ "path": "docs/assets/js/vs/language/html/htmlWorker.js",
+ "algorithm": "sha256-lf",
+ "sha256": "0b14f0af7ae7ab85732574fb384496dae3e85d28f953188cc842eec468a8a457"
+ },
+ {
+ "path": "docs/assets/js/vs/language/json/jsonMode.js",
+ "algorithm": "sha256-lf",
+ "sha256": "9abacb664dcd8564f28ef004465da0f4b3c551b2741424bf42e61c0a26e61adb"
+ },
+ {
+ "path": "docs/assets/js/vs/language/json/jsonWorker.js",
+ "algorithm": "sha256-lf",
+ "sha256": "0eb929c56d44afddb3030c011913010311ce34e5eadb1129a3ce9cbafd4c771d"
+ },
+ {
+ "path": "docs/assets/js/vs/language/typescript/tsMode.js",
+ "algorithm": "sha256-lf",
+ "sha256": "35d94edaf7982c8b59c95cda38c5ebffcf93479ee91a5c9820b9bf60719351c2"
+ },
+ {
+ "path": "docs/assets/js/vs/language/typescript/tsWorker.js",
+ "algorithm": "sha256-lf",
+ "sha256": "95d7d318d3b6076692705bda50f69ccf2981aae6b06f240de5ac642f32970bf4"
+ },
+ {
+ "path": "docs/assets/js/vs/loader.js",
+ "algorithm": "sha256-lf",
+ "sha256": "be92515f6d2cbfc75cd240076246e8ccf6f698269c0402e367d2ee371655bbeb"
+ }
+ ]
+ },
+ {
+ "id": "vconsole",
+ "riskId": "VENDOR-07",
+ "inputs": [
+ "docs/assets/js/vconsole.min.js"
+ ],
+ "owners": [
+ "SITE-01"
+ ],
+ "sourceStatus": "Local header identifies vConsole 3.15.0 and Tencent copyright.",
+ "licenseStatus": "Local header identifies MIT; original tarball correspondence and deployment notices not yet verified.",
+ "upstreamSources": [],
+ "upstreamReviewedAt": null,
+ "updatePolicy": "Keep separate from owned TS migration. Verify source/version/diff and license notices before replacement; preserve API/CSS/worker URLs and run owning package tests.",
+ "fingerprints": [
+ {
+ "path": "docs/assets/js/vconsole.min.js",
+ "algorithm": "sha256-lf",
+ "sha256": "671f47427e1e3048919147c765e9fb71e4ea40d79a8c2829089f499d3e9b9bf4"
+ }
+ ]
+ },
+ {
+ "id": "console-bundle",
+ "riskId": "VENDOR-08",
+ "inputs": [
+ "docs/assets/js/console.js"
+ ],
+ "owners": [
+ "SITE-01"
+ ],
+ "sourceStatus": "Parcel bundle contains console-feed identifiers; originating source/build/dependency versions unresolved.",
+ "licenseStatus": "Root MIT is not sufficient evidence for all bundled components; inventory and notices pending.",
+ "upstreamSources": [],
+ "upstreamReviewedAt": null,
+ "updatePolicy": "Keep separate from owned TS migration. Verify source/version/diff and license notices before replacement; preserve API/CSS/worker URLs and run owning package tests.",
+ "fingerprints": [
+ {
+ "path": "docs/assets/js/console.js",
+ "algorithm": "sha256-lf",
+ "sha256": "e00bbf82bf08c452825690372ded39a9b60f4baf438f0e7ce8300e9bc4629c03"
+ }
+ ]
+ }
+ ],
+ "integrations": [
+ {
+ "id": "hls.js",
+ "riskId": "SDK-01",
+ "owners": [
+ "PKG-HLS-01",
+ "EX-03"
+ ],
+ "sourceFiles": [
+ "packages/artplayer-plugin-hls-control/src/index.js",
+ "docs/assets/example/hls.control.js"
+ ],
+ "contract": "Caller supplies art.hls; homepage demo loads hls.js 1.5.17. Preserve quality/audio selectors and old core integration.",
+ "validationStatus": "Source integration observed; complete real SDK/service/device matrix not yet verified.",
+ "demoPathsSource": "refactor/baselines/demo-inventory.json"
+ },
+ {
+ "id": "dash.js",
+ "riskId": "SDK-02",
+ "owners": [
+ "PKG-DASH-01",
+ "EX-03"
+ ],
+ "sourceFiles": [
+ "packages/artplayer-plugin-dash-control/src/index.js",
+ "docs/assets/example/dash.control.js"
+ ],
+ "contract": "Caller supplies art.dash; homepage demo loads dash.js 5.2.1. Preserve representation IDs, Auto/manual and audio topology.",
+ "validationStatus": "Source integration observed; complete real SDK/service/device matrix not yet verified.",
+ "demoPathsSource": "refactor/baselines/demo-inventory.json"
+ },
+ {
+ "id": "flv.js",
+ "riskId": "SDK-03",
+ "owners": [
+ "EX-03"
+ ],
+ "sourceFiles": [
+ "docs/assets/example/flv.js"
+ ],
+ "contract": "Demo dependency flv.js 1.6.2; customType playback/teardown must be tested with actual SDK.",
+ "validationStatus": "Source integration observed; complete real SDK/service/device matrix not yet verified.",
+ "demoPathsSource": "refactor/baselines/demo-inventory.json"
+ },
+ {
+ "id": "mpegts.js",
+ "riskId": "SDK-04",
+ "owners": [
+ "EX-03"
+ ],
+ "sourceFiles": [
+ "docs/assets/example/mpegts.js"
+ ],
+ "contract": "Demo dependency mpegts.js 1.7.3; actual codec/stream/browser support remains unverified.",
+ "validationStatus": "Source integration observed; complete real SDK/service/device matrix not yet verified.",
+ "demoPathsSource": "refactor/baselines/demo-inventory.json"
+ },
+ {
+ "id": "webtorrent",
+ "riskId": "SDK-05",
+ "owners": [
+ "EX-03"
+ ],
+ "sourceFiles": [
+ "docs/assets/example/webtorrent.js"
+ ],
+ "contract": "Demo URL uses webtorrent@1, a moving major selector; preserve caller integration and explicitly capture actual runtime version.",
+ "validationStatus": "Source integration observed; complete real SDK/service/device matrix not yet verified.",
+ "demoPathsSource": "refactor/baselines/demo-inventory.json"
+ },
+ {
+ "id": "google-cast",
+ "riskId": "SDK-06",
+ "owners": [
+ "PKG-CAST-01",
+ "PKG-CAST-05"
+ ],
+ "sourceFiles": [
+ "packages/artplayer-plugin-chromecast/src/index.js"
+ ],
+ "contract": "Default remote cast_sender.js?loadCastFramework=1; sdk URL/options and actual Cast device/session behavior require separate validation.",
+ "validationStatus": "Source integration observed; complete real SDK/service/device matrix not yet verified.",
+ "demoPathsSource": "refactor/baselines/demo-inventory.json"
+ },
+ {
+ "id": "ima-via-glomex",
+ "riskId": "SDK-07",
+ "owners": [
+ "PKG-VAST-01",
+ "PKG-VAST-05"
+ ],
+ "sourceFiles": [
+ "packages/artplayer-plugin-vast/src/index.js"
+ ],
+ "contract": "@glomex/vast-ima-player loadImaSdk loads external IMA; preserve event/content/ad state and teardown, do not equate mocks with vendor service acceptance.",
+ "validationStatus": "Source integration observed; complete real SDK/service/device matrix not yet verified.",
+ "demoPathsSource": "refactor/baselines/demo-inventory.json"
+ },
+ {
+ "id": "mediapipe-tensorflow",
+ "riskId": "SDK-08",
+ "owners": [
+ "PKG-MASK-01",
+ "PKG-MASK-05"
+ ],
+ "sourceFiles": [
+ "packages/artplayer-plugin-danmuku-mask/src/index.js"
+ ],
+ "contract": "Npm dependency versions are separate from unversioned solutionPath CDN assets; keep option override, backend fallback, model result disposal and masks.",
+ "validationStatus": "Source integration observed; complete real SDK/service/device matrix not yet verified.",
+ "demoPathsSource": "refactor/baselines/demo-inventory.json"
+ },
+ {
+ "id": "jassub-worker-wasm-fonts",
+ "riskId": "SDK-09",
+ "owners": [
+ "PKG-JASSUB-01",
+ "PKG-JASSUB-05"
+ ],
+ "sourceFiles": [
+ "packages/artplayer-plugin-jassub/src/index.js",
+ "docs/assets/example/jassub.js"
+ ],
+ "contract": "Preserve options pass-through, result.instance and worker/wasm/font URLs. Wrapper, worker and WASM must be a verified compatible set.",
+ "validationStatus": "Source integration observed; complete real SDK/service/device matrix not yet verified.",
+ "demoPathsSource": "refactor/baselines/demo-inventory.json"
+ },
+ {
+ "id": "mediabunny",
+ "riskId": "SDK-10",
+ "owners": [
+ "PKG-MB-01",
+ "PKG-MB-09"
+ ],
+ "sourceFiles": [
+ "packages/artplayer-proxy-mediabunny/src/input.js",
+ "packages/artplayer-proxy-mediabunny/package.json"
+ ],
+ "contract": "Preserve native-video-like events, HLS input and topology, codec capability failures and AV sync; actual library/codec environment still requires verification.",
+ "validationStatus": "Source integration observed; complete real SDK/service/device matrix not yet verified.",
+ "demoPathsSource": "refactor/baselines/demo-inventory.json"
+ },
+ {
+ "id": "asr-caller-service",
+ "riskId": "SDK-11",
+ "owners": [
+ "PKG-ASR-01",
+ "PKG-ASR-05",
+ "EX-03"
+ ],
+ "sourceFiles": [
+ "packages/artplayer-plugin-asr/src/index.js",
+ "docs/assets/example/asr.js"
+ ],
+ "contract": "Core plugin supplies PCM to caller onAudioChunk. Example fetches an external ASR endpoint and opens its returned WebSocket; not an embedded ASR SDK or a verified service.",
+ "validationStatus": "Source integration observed; complete real SDK/service/device matrix not yet verified.",
+ "demoPathsSource": "refactor/baselines/demo-inventory.json"
+ },
+ {
+ "id": "option-validator",
+ "riskId": "SDK-12",
+ "owners": [
+ "CORE-01",
+ "CORE-07"
+ ],
+ "sourceFiles": [
+ "packages/artplayer/src/index.js"
+ ],
+ "contract": "Bundled validation dependency; preserve validation/default/merge behavior and failure cleanup when typing constructor boundaries.",
+ "validationStatus": "Source integration observed; complete real SDK/service/device matrix not yet verified.",
+ "demoPathsSource": "refactor/baselines/demo-inventory.json"
+ }
+ ]
+}