Skip to content

fix(build): generate the license surface and make build-metrics staleness fail (TIN-161) #270

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
Jesssullivan wants to merge 2 commits into
base: main
Choose a base branch
from
Draft

fix(build): generate the license surface and make build-metrics staleness fail (TIN-161) #270

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
afc57dd
fix(build): generate the license surface and make build-metrics stale…
Jesssullivan Aug 29, 2026
28c8539
fix(build): run the license guard, generate the published page, and t…
Jesssullivan Aug 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -185,6 +185,13 @@ jobs:
node-version-file: '.nvmrc'
cache: 'npm'

# TIN-161. The vitest suite covers this too, but it runs in a copied
# sandbox with no .git, so the build-metrics provenance check is only
# reachable here — at a real checkout with history. Dependency-free by
# design: no install step required.
- name: Truth surfaces
run: node scripts/truth-surfaces.mjs

- run: npm ci

- name: Static production dependency audit
Expand Down
5 changes: 5 additions & 0 deletions BUILD.bazel
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,11 @@ filegroup(
allow_empty = True,
) + [
".npmrc",
# Truth surfaces checked by scripts/truth-surfaces.test.mts (TIN-161):
# the test compares these documents against package-lock.json, so they
# have to reach the Vitest sandbox alongside it.
"THIRD-PARTY-LICENSES.md",
"docs/build-metrics.md",
"package-lock.json",
"package.json",
"pnpm-lock.yaml",
Expand Down
190 changes: 144 additions & 46 deletions THIRD-PARTY-LICENSES.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,55 +1,153 @@
# Third-Party Licenses

This project (transscendsurvival.org) is dedicated to the public domain
under [CC0 1.0 Universal](https://creativecommons.org/publicdomain/zero/1.0/).
<!-- generated by scripts/truth-surfaces.mjs -- do not hand-edit -->

The site is built with open-source software. Below is an attribution of
all direct dependencies and their licenses.
This project (transscendsurvival.org) is dedicated to the public domain under
[CC0 1.0 Universal](https://creativecommons.org/publicdomain/zero/1.0/).

Every figure below is derived from `package-lock.json` — the package name and
its declared range from `package.json`, the resolved version, license string
and source URL from the lockfile entry for that exact resolution. Nothing here
is hand-entered, so nothing here can drift without `scripts/truth-surfaces.mjs`
failing.

Regenerate with:

```sh
node scripts/truth-surfaces.mjs --write
```

That command writes this file and `src/lib/data/third-party-licenses.json`, which
`src/routes/THIRD-PARTY-LICENSES/+page.svelte` renders — the published page and
this document are the same data, so they cannot disagree.

A dependency whose lockfile entry declares no license is printed as
`UNDECLARED`. It is never guessed from the package name, the organisation, or
a sibling version.

The previous revision of this file was hand-maintained and had drifted: it
listed `shiki 3.22.0`, `vite 6.4.1`, `svelte 5.50.1` and `sharp 0.33.5`
against resolutions of 4.2.0, 8.0.14, 5.55.4 and 0.34.5, carried `mermaid` as
a runtime dependency it no longer is, and omitted most of the direct set.

## Runtime Dependencies

| Package | Version | License | Repository |
|---------|---------|---------|------------|
| @skeletonlabs/skeleton | 5.0.0 | MIT | https://github.com/skeletonlabs/skeleton |
| @skeletonlabs/skeleton-svelte | 5.0.0 | MIT | https://github.com/skeletonlabs/skeleton |
| mdsvex | 0.12.6 | MIT | https://github.com/pngwn/MDsveX |
| mermaid | 11.12.2 | MIT | https://github.com/mermaid-js/mermaid |
| shiki | 3.22.0 | MIT | https://github.com/shikijs/shiki |
| tailwindcss | 4.1.18 | MIT | https://github.com/tailwindlabs/tailwindcss |
| Package | Declared | Resolved | License | Source |
| --- | --- | --- | --- | --- |
| @fontsource/crimson-pro | `^5.2.8` | 5.2.8 | OFL-1.1 | <https://registry.npmjs.org/@fontsource/crimson-pro/-/crimson-pro-5.2.8.tgz> |
| @fontsource/fira-code | `^5.2.7` | 5.2.7 | OFL-1.1 | <https://registry.npmjs.org/@fontsource/fira-code/-/fira-code-5.2.7.tgz> |
| @fontsource/inter | `^5.2.8` | 5.2.8 | OFL-1.1 | <https://registry.npmjs.org/@fontsource/inter/-/inter-5.2.8.tgz> |
| @fontsource/raleway | `^5.2.8` | 5.2.8 | OFL-1.1 | <https://registry.npmjs.org/@fontsource/raleway/-/raleway-5.2.8.tgz> |
| @skeletonlabs/skeleton | `5.0.0` | 5.0.0 | MIT | <https://registry.npmjs.org/@skeletonlabs/skeleton/-/skeleton-5.0.0.tgz> |
| @skeletonlabs/skeleton-svelte | `5.0.0` | 5.0.0 | MIT | <https://registry.npmjs.org/@skeletonlabs/skeleton-svelte/-/skeleton-svelte-5.0.0.tgz> |
| @tummycrypt/tinyvectors | `https://github.com/tinyland-inc/tinyvectors/archive/refs/tags/v0.3.5.tar.gz` | 0.3.5 | Zlib | <https://github.com/tinyland-inc/tinyvectors/archive/refs/tags/v0.3.5.tar.gz> |
| dompurify | `^3.4.13` | 3.4.13 | (MPL-2.0 OR Apache-2.0) | <https://registry.npmjs.org/dompurify/-/dompurify-3.4.13.tgz> |
| flexsearch | `^0.8.212` | 0.8.212 | Apache-2.0 | <https://registry.npmjs.org/flexsearch/-/flexsearch-0.8.212.tgz> |
| marked | `^4.3.0` | 4.3.0 | MIT | <https://registry.npmjs.org/marked/-/marked-4.3.0.tgz> |
| mdsvex | `^0.12.7` | 0.12.7 | MIT | <https://registry.npmjs.org/mdsvex/-/mdsvex-0.12.7.tgz> |
| shiki | `^4.2.0` | 4.2.0 | MIT | <https://registry.npmjs.org/shiki/-/shiki-4.2.0.tgz> |
| tailwindcss | `^4.2.2` | 4.2.2 | MIT | <https://registry.npmjs.org/tailwindcss/-/tailwindcss-4.2.2.tgz> |

## Build / Dev Dependencies

| Package | Version | License | Repository |
|---------|---------|---------|------------|
| @sveltejs/adapter-static | 3.0.10 | MIT | https://github.com/sveltejs/kit |
| @sveltejs/enhanced-img | 0.10.0 | MIT | https://github.com/sveltejs/kit |
| @sveltejs/kit | 2.50.2 | MIT | https://github.com/sveltejs/kit |
| @sveltejs/vite-plugin-svelte | 6.2.4 | MIT | https://github.com/sveltejs/vite-plugin-svelte |
| @tailwindcss/vite | 4.1.18 | MIT | https://github.com/tailwindlabs/tailwindcss |
| pagefind | 1.4.0 | MIT | https://github.com/CloudCannon/pagefind |
| sharp | 0.33.5 | Apache-2.0 | https://github.com/lovell/sharp |
| svelte | 5.50.1 | MIT | https://github.com/sveltejs/svelte |
| svelte-check | 4.3.6 | MIT | https://github.com/sveltejs/language-tools |
| typescript | 5.9.3 | Apache-2.0 | https://github.com/microsoft/TypeScript |
| vite | 6.4.1 | MIT | https://github.com/vitejs/vite |

## Notable Transitive Dependencies

| Package | License | Notes |
|---------|---------|-------|
| chevrotain | Apache-2.0 | Parser toolkit (mermaid dependency) |
| d3 | ISC / BSD-3-Clause | Visualization library (mermaid dependency) |
| dompurify | MPL-2.0 OR Apache-2.0 | HTML sanitizer (mermaid dependency) |
| @iconify/utils | MIT | Icon utilities (skeleton dependency) |
| @floating-ui/dom | MIT | Positioning runtime (Skeleton/Zag dependency) |

## License Summary

All 243 production packages break down as:

- **MIT**: 190
- **ISC**: 34
- **Apache-2.0**: 8
- **BSD-3-Clause**: 6
- **MPL-2.0 OR Apache-2.0**: 1
- **Unlicense**: 1
| Package | Declared | Resolved | License | Source |
| --- | --- | --- | --- | --- |
| @eslint/js | `^9.39.2` | 9.39.4 | MIT | <https://registry.npmjs.org/@eslint/js/-/js-9.39.4.tgz> |
| @mermaid-js/mermaid-cli | `^11.15.0` | 11.15.0 | MIT | <https://registry.npmjs.org/@mermaid-js/mermaid-cli/-/mermaid-cli-11.15.0.tgz> |
| @playwright/test | `^1.59.1` | 1.59.1 | Apache-2.0 | <https://registry.npmjs.org/@playwright/test/-/test-1.59.1.tgz> |
| @sveltejs/adapter-node | `^5.5.7` | 5.5.7 | MIT | <https://registry.npmjs.org/@sveltejs/adapter-node/-/adapter-node-5.5.7.tgz> |
| @sveltejs/adapter-static | `^3.0.10` | 3.0.10 | MIT | <https://registry.npmjs.org/@sveltejs/adapter-static/-/adapter-static-3.0.10.tgz> |
| @sveltejs/kit | `^2.61.1` | 2.61.1 | MIT | <https://registry.npmjs.org/@sveltejs/kit/-/kit-2.61.1.tgz> |
| @sveltejs/vite-plugin-svelte | `^7.1.2` | 7.1.2 | MIT | <https://registry.npmjs.org/@sveltejs/vite-plugin-svelte/-/vite-plugin-svelte-7.1.2.tgz> |
| @tailwindcss/vite | `^4.2.2` | 4.2.2 | MIT | <https://registry.npmjs.org/@tailwindcss/vite/-/vite-4.2.2.tgz> |
| @tummycrypt/vite-plugin-a11y | `^0.2.2` | 0.2.2 | Zlib AND LicenseRef-Tinyland-Proprietary | <https://registry.npmjs.org/@tummycrypt/vite-plugin-a11y/-/vite-plugin-a11y-0.2.2.tgz> |
| @types/node | `^25.2.3` | 25.5.0 | MIT | <https://registry.npmjs.org/@types/node/-/node-25.5.0.tgz> |
| @vitest/coverage-v8 | `^4.1.4` | 4.1.4 | MIT | <https://registry.npmjs.org/@vitest/coverage-v8/-/coverage-v8-4.1.4.tgz> |
| eslint | `^9.39.2` | 9.39.4 | MIT | <https://registry.npmjs.org/eslint/-/eslint-9.39.4.tgz> |
| eslint-config-prettier | `^10.1.8` | 10.1.8 | MIT | <https://registry.npmjs.org/eslint-config-prettier/-/eslint-config-prettier-10.1.8.tgz> |
| eslint-plugin-svelte | `^3.17.0` | 3.17.0 | MIT | <https://registry.npmjs.org/eslint-plugin-svelte/-/eslint-plugin-svelte-3.17.0.tgz> |
| pagefind | `^1.5.2` | 1.5.2 | MIT | <https://registry.npmjs.org/pagefind/-/pagefind-1.5.2.tgz> |
| prettier | `^3.8.1` | 3.8.1 | MIT | <https://registry.npmjs.org/prettier/-/prettier-3.8.1.tgz> |
| prettier-plugin-svelte | `^3.4.1` | 3.5.1 | MIT | <https://registry.npmjs.org/prettier-plugin-svelte/-/prettier-plugin-svelte-3.5.1.tgz> |
| puppeteer | `^24.43.1` | 24.43.1 | Apache-2.0 | <https://registry.npmjs.org/puppeteer/-/puppeteer-24.43.1.tgz> |
| rehype-slug | `^6.0.0` | 6.0.0 | MIT | <https://registry.npmjs.org/rehype-slug/-/rehype-slug-6.0.0.tgz> |
| rollup-plugin-visualizer | `^6.0.5` | 6.0.11 | MIT | <https://registry.npmjs.org/rollup-plugin-visualizer/-/rollup-plugin-visualizer-6.0.11.tgz> |
| serve | `^14.2.5` | 14.2.6 | MIT | <https://registry.npmjs.org/serve/-/serve-14.2.6.tgz> |
| sharp | `^0.34.5` | 0.34.5 | Apache-2.0 | <https://registry.npmjs.org/sharp/-/sharp-0.34.5.tgz> |
| svelte | `^5.55.4` | 5.55.4 | MIT | <https://registry.npmjs.org/svelte/-/svelte-5.55.4.tgz> |
| svelte-check | `^4.4.5` | 4.4.5 | MIT | <https://registry.npmjs.org/svelte-check/-/svelte-check-4.4.5.tgz> |
| tsx | `^4.21.0` | 4.21.0 | MIT | <https://registry.npmjs.org/tsx/-/tsx-4.21.0.tgz> |
| typescript | `^5.9.3` | 5.9.3 | Apache-2.0 | <https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz> |
| typescript-eslint | `^8.58.2` | 8.58.2 | MIT | <https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.58.2.tgz> |
| vite | `^8.0.14` | 8.0.14 | MIT | <https://registry.npmjs.org/vite/-/vite-8.0.14.tgz> |
| vitest | `^4.1.4` | 4.1.4 | MIT | <https://registry.npmjs.org/vitest/-/vitest-4.1.4.tgz> |

## Resolved Tree

`package-lock.json` records 1150 installs under `node_modules/`.
That is a count of install paths, not of packages: npm records a package once
per place it lands, so a dependency it cannot hoist appears many times over.
Deduplicated on `name@version`, the tree is **1078** distinct
third-party packages, of which **361** are reachable
outside `devDependencies`.

### Runtime Packages

This is the set that governs attribution: the site is a prerendered static
build, so only these licenses travel to a reader.

| License | Packages |
| --- | --- |
| MIT | 225 |
| Apache-2.0 | 106 |
| BSD-3-Clause | 11 |
| ISC | 10 |
| OFL-1.1 | 4 |
| (MPL-2.0 OR Apache-2.0) | 1 |
| 0BSD | 1 |
| BSD-2-Clause | 1 |
| UNDECLARED | 1 |
| Zlib | 1 |

### Full Resolved Tree

Development-only packages included. Licenses appearing here but not above are
build-time only and are not distributed.

| License | Packages |
| --- | --- |
| MIT | 769 |
| Apache-2.0 | 162 |
| ISC | 63 |
| BSD-3-Clause | 29 |
| MPL-2.0 | 12 |
| BSD-2-Clause | 10 |
| LGPL-3.0-or-later | 10 |
| OFL-1.1 | 4 |
| Apache-2.0 AND LGPL-3.0-or-later | 3 |
| UNDECLARED | 2 |
| (BSD-2-Clause OR MIT OR Apache-2.0) | 1 |
| (CC-BY-4.0 AND OFL-1.1 AND MIT) | 1 |
| (MIT AND Zlib) | 1 |
| (MIT OR CC0-1.0) | 1 |
| (MPL-2.0 OR Apache-2.0) | 1 |
| (WTFPL OR MIT) | 1 |
| 0BSD | 1 |
| Apache-2.0 AND LGPL-3.0-or-later AND MIT | 1 |
| BlueOak-1.0.0 | 1 |
| EPL-2.0 | 1 |
| Python-2.0 | 1 |
| Unlicense | 1 |
| Zlib | 1 |
| Zlib AND LicenseRef-Tinyland-Proprietary | 1 |

## Undeclared Licenses

2 resolved third-party package(s) declare no license field in the lockfile:

- `@better-fetch/fetch@1.1.21`
- `khroma@2.1.0`

Each one is an unreviewed license and a follow-up, not a silent MIT.

The lockfile also carries 3 workspace link(s) — `@blog/agent`, `@blog/pulse-client`, `@blog/pulse-core` — which are this repository's own code under its CC0 dedication. They are not third party and are excluded from every figure above.
37 changes: 33 additions & 4 deletions docs/build-metrics.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,25 @@
# Build Metrics Baseline

> Superseded 2026-08-28: Vite 8 shipped (`package.json` pins `^8.0.14`). The
> numbers below are the Vite 6.4.1 baseline, kept for comparison only.
- **Status:** STALE — superseded 2026-08-28. Vite 8 shipped and the toolchain
below no longer exists in this repo. The numbers are kept as the Vite 6.4.1
comparison point, not as a description of the current build.
- **Captured:** 2026-02-11 on branch `feature/sprint3-week8` (commit `9aac474`)
- **Checked by:** `scripts/truth-surfaces.mjs`. The toolchain table below is
machine-compared against `package.json`. If the versions match again this
page must drop the STALE marker; while they differ it must carry it. A
metrics page cannot silently keep presenting itself as current (TIN-161).

Captured: 2026-02-11 | Branch: `feature/sprint3-week8` | Vite 6.4.1
## Toolchain At Capture

Declared ranges read from `9aac474:package.json`, the commit that added this
file — not the resolved versions, so the comparison is like-for-like against
`package.json` today.

| Package | Declared at capture |
| --- | --- |
| `vite` | ^6.4.1 |
| `svelte` | ^5.19.0 |
| `@sveltejs/kit` | ^2.16.0 |

## Build Time

Expand Down Expand Up @@ -49,4 +65,17 @@ All heavy chunks are lazy-loaded — they don't affect first-load performance.

## Vite 8 / Rolldown Status

**NOGO** — Vite 8.0.0-beta.13 (Feb 2026). Dead code elimination broken for `esm-env` conditions. No stable SvelteKit support. See [issue #16](https://github.com/Jesssullivan/jesssullivan.github.io/issues/16).
**NOGO at capture** — Vite 8.0.0-beta.13 (Feb 2026). Dead code elimination
broken for `esm-env` conditions. No stable SvelteKit support. See
[issue #16](https://github.com/Jesssullivan/jesssullivan.github.io/issues/16).
**Overtaken by events:** `package.json` declares `vite ^8.0.14` as of
2026-08-28, so this row records what was true in February and not a current
posture.

## Recapture

There is no measured replacement for this page yet. Producing one needs a real
build, which is the rest of TIN-161; until then the STALE marker and the
machine check are what keep the page honest. When it is recaptured, update the
toolchain table in the same commit as the numbers — the check pairs them
deliberately, so metrics cannot land without the toolchain that produced them.
4 changes: 4 additions & 0 deletions scripts/run-vitest-bazel.mjs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,6 +48,10 @@ function copyInputsToBuildRoot() {

for (const file of [
'.npmrc',
// TIN-161 truth surfaces: scripts/truth-surfaces.test.mts checks these
// documents against package-lock.json, so they travel with it.
'THIRD-PARTY-LICENSES.md',
'docs/build-metrics.md',
'package-lock.json',
'package.json',
'pnpm-lock.yaml',
Expand Down
Loading