2.5 KiB
Frozen site vendor notices
manifest.json pins the already-identified Monaco 0.30.1 and vConsole 3.15.0
archives, corresponding files and upstream notice texts. It does not clear other
site dependencies or grant rights to samples/fonts. The vConsole LICENSE is
preserved verbatim but is incomplete: it promises an MIT copy that is absent.
Its completion and bundled dependency notices remain open under SITE-07.
Monaco's supplied notices also lack a Codicons entry. Match the included font to
its historical source and attribution before claiming the font review complete;
the Monaco MIT statement does not establish the separate font's license.
notices.ts validates the exact file inventory and fingerprints before preparing
outputs. JavaScript/CSS comparisons normalize CRLF to LF; font bytes are exact.
This preserves the previously verified Monaco CSS newline-only difference while
rejecting code or added/removed files. It never rewrites runtime assets. Notice
files retain their exact upstream bytes, including final blank lines.
../build-site-notices.mjs provides yarn build:site-notices and read-only
yarn check:site-notices. The write command cannot bless altered vendor assets;
review the new archive and license evidence before changing the manifest. The
CLI prevents accidentally dropping either verified component. Source notices
live in refactor/baselines/site-vendor/; generated delivery files live under
docs/licenses/ with an explicitly limited docs/THIRD_PARTY_NOTICES.md index.
CI runs the read-only check before building, and generation during ci:build.
Library builds remain independent. Pages preparation copies the notices into its
own fingerprinted site. .gitattributes preserves text bytes across Windows/Linux.
yarn test:site-notices tests missing/extra/modified assets, changed or incomplete
inputs, path escape and read-only output drift. The browser fixture
test/browser/site-vendor.spec.js checks actual mobile logging, native playback,
HTTP notice contents and destruction. The fixed-source lifecycle patch and its
old-build reproduction are maintained in vconsole/README.md; generated asset
checks run before the notice checks. Do not skip destruction or catch page errors.
Existing desktop TypeScript editor tests cover the real Monaco worker and Run.
Follow-up: restore complete licensing from fixed upstream evidence, then recover the console.js build and resolve remaining fonts/media. Do not upgrade these assets without verifying globals, AMD/worker paths, CSS, consoleLog and user interaction.