fix: retain third-party license notices in distributions

TH
4d ago
+908-2

Summary

Published bundles include third-party code but omitted its license texts. Generate dist/src/THIRD_PARTY_NOTICES.txt from modules retained in each build, including upstream NOTICE files and jpeg-js's source-level notices. Externalized or tree-shaken dependencies drop out automatically. Identical texts are shared, while distinct copyrights remain separate.

Retain the Apache-2.0 license and provenance for vendored Maestro fixtures and the Gradle wrapper. Require a non-empty generated notice file in the actual npm tarball.

13 files changed. Packaging and development compliance only; no CLI, Node.js, or device behavior changes.

Validation

Current head: c80338229d.

  • Missing-notice regression, same test command with the new test added to the base:

    base 0f7e668007head 7410a5be4b
    Fails: missing expected exceptionPasses: missing/empty notices rejected

  • Focused license-generation and package-content tests: 8 passed, including shared-text deduplication, distinct copyrights, minification, external/tree-shaken dependencies, missing license text, and jpeg-js source notices.

  • pnpm build generated the license report for the real bundle.

  • Full checks passed at 7410a5be4b. pnpm check:affected --base 7410a5be4b --run --head c80338229d also passed all runnable checks with exactCommit: true.

  • Size versus 7410a5be4b: notices 92,631 → 47,966 bytes; packed tarball 1,543,992 → 1,541,891 bytes. All 27 packages and 57 distinct copyright lines retained.

  • Independent review of the initial change and the compact formatter: no actionable findings.

  • GitHub CI pending; no device runs required for this packaging-only change.