[jongio]

Summary

Related tracking issue: #11. That public-release blocker remains open; this PR does not clear the three upstream license gaps.

• Derive a deterministic inventory from positive byte contributions to esbuild's executable output and ship available full dependency notices alongside the existing inline legal comments.
• Include all 168 contributing package identities: 165 have included license-text evidence; binary@0.3.0, buffers@0.1.1, and chainsaw@0.1.0 remain explicitly marked missing-license-text. No license is inferred for buffers.
• Preserve complete README license sections when supplied. Use the upstream license pinned to the npm-published gitHead for @nodable/entities@3.1.0. Retain both authoritative BSD source headers alongside the Apache license for @protobuf-ts/runtime@2.11.1.
• Extend source-to-distribution verification to the generated notice and inventory files, and add packaging regressions for full YAML terms, deterministic output, README/attribution handling, complete protobuf license components, real tree-shaking, and honest missing-license reporting.

The executable dist/index.cjs and existing dist/index.cjs.LEGAL.txt are byte-for-byte unchanged. No Action inputs, native execution, authentication, reporting, or artifact-upload behavior changes. The canonical build owner remains tooling/build.mjs; runtime command variants and the native Vally owner are unchanged.

Verification

• Model-free checks and source-to-bundle verification pass.
• Native integration evidence is distinguished from synthetic controls.
• Credential, process and artifact boundaries were reviewed.
• Documentation and packaged dist match source.

Command or check	Result
node --test tooling\packaged.test.mjs before implementation	Existing consumer control passed; new YAML-notice regression failed as expected because dist/THIRD-PARTY-NOTICES.txt was missing.
pnpm install --frozen-lockfile --ignore-scripts	Passed; pinned dependencies restored with lifecycle scripts disabled.
pnpm build	Passed; generated notices and inventory.
pnpm check	Passed: typecheck, lint, 165 tests, deterministic distribution check, and 6 packaging tests.
pnpm test:packaged	Passed: 6 tests.
pnpm check:dist	Passed.
pnpm exec oxlint --deny-warnings tooling\build.mjs tooling\license-notices.mjs tooling\packaged.test.mjs	Passed.
git diff --check and git diff --cached --check	Passed.
git diff --exit-code -- dist\index.cjs dist\index.cjs.LEGAL.txt	Passed: executable and existing inline notices unchanged.
Scoped Test Doctor, Doc Doctor, light security review, and complementary-family review	Completed. The README-section review finding was corrected and verified by a focused follow-up review. New local documentation links resolve to the generated files.

Configured runtime coverage passed all unchanged 80% floors: statements 93%, branches 90.25%, functions 96.63%, lines 96.5%. The new .mjs build helper is exercised by the Node packaging tests; it is not included in the existing Vitest src/**/*.ts coverage policy. No thresholds or exclusions changed.

Local checks were model-free. The existing hosted Copilot E2E job is separately authorized for this PR's unchanged bounded workload: one stimulus, one trial, one worker, zero retries. Hosted results are separate from local synthetic/model-free evidence; no broader model execution is authorized.

Limitations

• The three exact upstream license gaps remain public-release blockers in Public release: resolve license evidence for three bundled dependencies #11. Build, CI, review, or merge success does not supply permission or close them.
• Inclusion of a license file is evidence, not legal or release-owner approval. The generator retains published terms and provenance rather than inventing missing terms.
• No dependency versions, version-specific tags, moving tags, releases, Marketplace listing, or repository visibility are changed.
• The native Action runtime and its integration are unchanged; this PR adds distribution evidence rather than claiming new native capabilities or public availability.

[github-actions]

Evals: passed

Suite: copilot-smoke

Lint: validated (no model execution) - Evidence

Run: passed - 1 trial - Evidence

Eval	Trials	Result
copilot-skill-smoke	1	passed

Exact revision | Workflow run

[Copilot]

🟡 Changes recommended

License collection can omit required terms while marking incomplete license evidence as included.

1 open issue

• Attribution-only notices suppress README license terms · New

What changed in this PR

Adds build-time license evidence to the Action’s committed distribution without changing runtime behavior. The public-release blockers tracked in #11 remain unresolved.

Changes:

• Generate deterministic dependency notices and inventory from esbuild metadata.
• Include version-bound supplemental license evidence and explicit missing-license reporting.
• Extend distribution verification, packaging tests, and contributor documentation.

File	Description
tooling/​packaged.test.mjs	Tests deterministic notices, README extraction, YAML terms, and unresolved gaps.
tooling/​licenses/​nodable-entities-3.1.0.txt	Supplies the pinned upstream license supplement.
tooling/​license-notices.mjs	Collects dependency identities, notice text, provenance, and evidence status.
tooling/​build.mjs	Generates and verifies the new distribution files.
README.md	Links license evidence and explains release-clearance limits.
dist/​bundled-dependencies.json	Records dependency identities, declared licenses, sources, and evidence status.
CONTRIBUTING.md	Documents notice generation, provenance, and unresolved-license handling.

_{Review effort: Max}

[jongio]

Review 5630221544 — Attribution-only notices suppress README license terms: fixed in f45e092 by separating attribution from license evidence and covering NOTICE-only, README, and supplemental fallbacks.

[Copilot]

🟡 Changes recommended

The generated license evidence does not yet account for all declared license components.

1 open issue

• Add missing BSD terms and attribution for protobuf-ts bundle code · New

1 previously missed issue

In code that hasn't changed since last review

Exclude tree-shaken modules from the distributed dependency inventory

tooling/​build.mjs:20

metafile.inputs lists every module esbuild parsed, including modules removed completely by tree-shaking. Using it here includes those packages even though the generated header says the inventory describes packages contributing code to dist/index.cjs. It can also classify a missing license for code that is not distributed as a release blocker. Use the executable output's input contributions with bytesInOutput > 0, or explicitly describe the inventory as a conservative superset of parsed dependencies. Regenerate the notices and inventory after changing the selection.

1 resolved since last review

• Attribution-only notices suppress README license terms

_{Review effort: Max}

[jongio]

Review 5631148338, fixed in 14db1ff:

• Add missing BSD terms and attribution for protobuf-ts bundle code: include both upstream source headers alongside Apache terms, with complete-component regressions.
• Exclude tree-shaken modules from the distributed dependency inventory: use positive executable-output contributions; the real tree-shaking regression passes. Actual inventory: 168 packages; the same three unresolved gaps remain.

[Copilot]

🟢 Approval recommended

No blocking implementation defects were identified, and these build-time changes preserve runtime behavior without clearing the separate public-release blockers.

No open issues 🎉

1 resolved since last review

• Add missing BSD terms and attribution for protobuf-ts bundle code

_{Review effort: Max}

[wbreza]

The generated notice and inventory pipeline is deterministic, derives dependencies from positive executable bundle contributions, preserves the required composite license components, and fails closed on stale output. The full project validation passes.