# Frozen site vendor notices

`manifest.json` pins the already-identified Monaco 0.30.1 and vConsole 3.15.0
archives, corresponding files and upstream notice texts. It does not clear other
site dependencies or grant rights to samples/fonts. The vConsole LICENSE is
preserved verbatim but is incomplete: it promises an MIT copy that is absent.
Its completion and bundled dependency notices remain open under SITE-07.
Monaco's supplied notices also lack a Codicons entry. Match the included font to
its historical source and attribution before claiming the font review complete;
the Monaco MIT statement does not establish the separate font's license.

`notices.ts` validates the exact file inventory and fingerprints before preparing
outputs. JavaScript/CSS comparisons normalize CRLF to LF; font bytes are exact.
This preserves the previously verified Monaco CSS newline-only difference while
rejecting code or added/removed files. It never rewrites runtime assets. Notice
files retain their exact upstream bytes, including final blank lines.

`../build-site-notices.mjs` provides `yarn build:site-notices` and read-only
`yarn check:site-notices`. The write command cannot bless altered vendor assets;
review the new archive and license evidence before changing the manifest. The
CLI prevents accidentally dropping either verified component. Source notices
live in `refactor/baselines/site-vendor/`; generated delivery files live under
`docs/licenses/` with an explicitly limited `docs/THIRD_PARTY_NOTICES.md` index.

CI runs the read-only check before building, and generation during ci:build.
Library builds remain independent. Pages preparation copies the notices into its
own fingerprinted site. `.gitattributes` preserves text bytes across Windows/Linux.

`yarn test:site-notices` tests missing/extra/modified assets, changed or incomplete
inputs, path escape and read-only output drift. The browser fixture
`test/browser/site-vendor.spec.js` checks actual mobile logging, native playback,
HTTP notice contents and destruction. The fixed-source lifecycle patch and its
old-build reproduction are maintained in `vconsole/README.md`; generated asset
checks run before the notice checks. Do not skip destruction or catch page errors.
Existing desktop TypeScript editor tests cover the real Monaco worker and Run.

Follow-up: restore complete licensing from fixed upstream evidence, then recover the
console.js build and resolve remaining fonts/media. Do not upgrade these assets
without verifying globals, AMD/worker paths, CSS, consoleLog and user interaction.