build: ship generated dependency licenses with the app and SDK

.gitignore

@@ -122,3 +122,7 @@ packages/glyph-info/resources/*.db
 
 
 .claude/schedule*
+
+# Generated at packaging time
+apps/desktop/.generated/
+packages/sdk/THIRD_PARTY_LICENSES.txt

apps/desktop/electron-builder.config.ts

@@ -1,6 +1,6 @@
 import { execFile } from "node:child_process";
 import { readFileSync } from "node:fs";
-import { copyFile, mkdtemp, rm } from "node:fs/promises";
+import { copyFile, mkdir, mkdtemp, rm } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
 import { promisify } from "node:util";
@@ -84,6 +84,22 @@ if (signMacos) {
   }
 }
 
+const thirdPartyLicensesPath = path.join(__dirname, ".generated", "THIRD_PARTY_LICENSES.txt");
+
+/** Regenerates the license texts of every npm package and crate this build ships. */
+async function writeThirdPartyLicenses() {
+  await mkdir(path.dirname(thirdPartyLicensesPath), { recursive: true });
+  await execFileAsync(
+    process.execPath,
+    [
+      path.join(__dirname, "../../scripts/generate-third-party-licenses.mjs"),
+      "desktop",
+      thirdPartyLicensesPath,
+    ],
+    { maxBuffer: 64 * 1024 * 1024 },
+  );
+}
+
 async function compileMacosAssetCatalog(context: AfterPackContext) {
   if (context.electronPlatformName !== "darwin") return;
 
@@ -131,6 +147,7 @@ async function compileMacosAssetCatalog(context: AfterPackContext) {
 }
 
 const config: Configuration = {
+  beforePack: writeThirdPartyLicenses,
   afterPack: compileMacosAssetCatalog,
   appId,
   productName,
@@ -162,6 +179,7 @@ const config: Configuration = {
     { from: "../../LICENSE-MIT", to: "LICENSE-MIT" },
     { from: "../../LICENSE-APACHE", to: "LICENSE-APACHE" },
     { from: "../../THIRD_PARTY_NOTICES.md", to: "THIRD_PARTY_NOTICES.md" },
+    { from: ".generated/THIRD_PARTY_LICENSES.txt", to: "THIRD_PARTY_LICENSES.txt" },
     { from: "THIRD_PARTY_THEMES.md", to: "THIRD_PARTY_THEMES.md" },
   ],
   asar: true,

packages/sdk/package.json

@@ -26,10 +26,12 @@
     "dist",
     "LICENSE-APACHE",
     "LICENSE-MIT",
+    "THIRD_PARTY_LICENSES.txt",
     "THIRD_PARTY_NOTICES.md"
   ],
   "scripts": {
     "build": "node scripts/build.mjs",
+    "prepack": "node ../../scripts/generate-third-party-licenses.mjs sdk THIRD_PARTY_LICENSES.txt",
     "typecheck": "tsgo --noEmit",
     "generate:inter-a-fixture": "node scripts/generate-inter-a-fixture.mjs",
     "test:packed": "pnpm build && node scripts/test-packed-consumers.mjs",

packages/sdk/scripts/test-packed-consumers.mjs

@@ -27,6 +27,10 @@ try {
     "package/dist/ui.js",
     "package/dist/ui.d.ts",
     "package/dist/style.css",
+    "package/LICENSE-MIT",
+    "package/LICENSE-APACHE",
+    "package/THIRD_PARTY_NOTICES.md",
+    "package/THIRD_PARTY_LICENSES.txt",
   ]) {
     assert(entries.includes(required), `packed SDK is missing ${required}`);
   }

scripts/generate-third-party-licenses.mjs

@@ -0,0 +1,284 @@
+#!/usr/bin/env node
+/**
+ * Writes the license texts of the third-party dependencies a Shift artifact ships.
+ *
+ * Usage:
+ *   node scripts/generate-third-party-licenses.mjs desktop <output>
+ *   node scripts/generate-third-party-licenses.mjs sdk <output>
+ *
+ * `desktop` covers the production npm closure of `@shift/desktop` and the Rust
+ * crates compiled into the native bridge. `sdk` covers the npm packages whose
+ * sources appear in the built SDK's source maps, so it must run after a build.
+ * Packages sharing an identical license text are grouped under one copy.
+ */
+import { execFileSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { existsSync, readdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const repositoryRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const MIT_TEXT = `MIT License
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.`;
+const LICENSE_FILE = /^(?:licen[sc]e|copying|notice)(?:[.-].*)?$/i;
+
+const [target, output] = process.argv.slice(2);
+if (!["desktop", "sdk"].includes(target) || !output) {
+  throw new Error("Usage: generate-third-party-licenses.mjs <desktop|sdk> <output>");
+}
+
+const packages =
+  target === "desktop" ? [...desktopNpmPackages(), ...bridgeCrates()] : sdkNpmPackages();
+writeFileSync(resolve(output), render(target, packages));
+console.log(`Wrote licenses for ${packages.length} ${target} dependencies to ${output}`);
+
+/** Production npm closure of the desktop app, excluding workspace packages. */
+function desktopNpmPackages() {
+  const tree = JSON.parse(
+    execFileSync(
+      "pnpm",
+      ["list", "--filter", "@shift/desktop", "--prod", "--depth", "Infinity", "--json"],
+      {
+        cwd: repositoryRoot,
+        encoding: "utf8",
+        maxBuffer: 256 * 1024 * 1024,
+        // pnpm is a .cmd shim on Windows, which only starts through a shell.
+        shell: process.platform === "win32",
+      },
+    ),
+  );
+  const wanted = new Set();
+  const walk = (dependencies) => {
+    for (const [name, info] of Object.entries(dependencies ?? {})) {
+      const workspace = String(info.version ?? "").startsWith("link:");
+      const key = `${name}@${info.version}`;
+      if (!workspace && wanted.has(key)) continue;
+      if (!workspace) wanted.add(key);
+      walk(info.dependencies);
+    }
+  };
+  for (const root of tree) walk(root.dependencies);
+
+  const directories = npmPackageDirectories();
+  return [...wanted].sort().map((key) => npmPackage(key, directories.get(key)));
+}
+
+/** npm packages whose modules were bundled into the SDK, read from its source maps. */
+function sdkNpmPackages() {
+  const dist = join(repositoryRoot, "packages/sdk/dist");
+  if (!existsSync(dist)) throw new Error("Build the SDK before generating its licenses");
+
+  const packageDirectories = new Set();
+  for (const file of readdirSync(dist).filter((name) => name.endsWith(".js.map"))) {
+    for (const source of JSON.parse(readFileSync(join(dist, file), "utf8")).sources ?? []) {
+      const path = resolve(dist, source);
+      if (path.endsWith("/src/useSyncExternalStoreWithSelector.ts")) {
+        // Vendored adaptation of React's shim; credit the upstream package.
+        packageDirectories.add(join(repositoryRoot, "node_modules/use-sync-external-store"));
+        continue;
+      }
+      const index = path.lastIndexOf("/node_modules/");
+      if (index === -1) continue;
+      const rest = path.slice(index + "/node_modules/".length).split("/");
+      const name = rest[0].startsWith("@") ? `${rest[0]}/${rest[1]}` : rest[0];
+      packageDirectories.add(join(path.slice(0, index), "node_modules", name));
+    }
+  }
+  // The stylesheet embeds CSS generated by Tailwind.
+  const tailwind = join(repositoryRoot, "node_modules/tailwindcss");
+  if (existsSync(tailwind)) packageDirectories.add(tailwind);
+
+  return [...packageDirectories]
+    .map((directory) => {
+      const { name, version } = JSON.parse(readFileSync(join(directory, "package.json"), "utf8"));
+      return npmPackage(`${name}@${version}`, directory);
+    })
+    .sort((left, right) => left.name.localeCompare(right.name));
+}
+
+/** Maps `name@version` to its installed directory across the hoisted and nested trees. */
+function npmPackageDirectories() {
+  const directories = new Map();
+  const visit = (nodeModules) => {
+    if (!existsSync(nodeModules)) return;
+    for (const entry of readdirSync(nodeModules)) {
+      if (entry.startsWith(".")) continue;
+      const path = join(nodeModules, entry);
+      if (entry.startsWith("@")) {
+        for (const scoped of readdirSync(path)) visitPackage(join(path, scoped));
+      } else {
+        visitPackage(path);
+      }
+    }
+  };
+  const visitPackage = (path) => {
+    const manifest = join(path, "package.json");
+    if (!existsSync(manifest)) return;
+    const { name, version } = JSON.parse(readFileSync(manifest, "utf8"));
+    if (name && version && !directories.has(`${name}@${version}`)) {
+      directories.set(`${name}@${version}`, path);
+    }
+    visit(join(path, "node_modules"));
+  };
+
+  visit(join(repositoryRoot, "node_modules"));
+  for (const group of ["apps", "packages"]) {
+    for (const entry of readdirSync(join(repositoryRoot, group))) {
+      visit(join(repositoryRoot, group, entry, "node_modules"));
+    }
+  }
+  return directories;
+}
+
+function npmPackage(key, directory) {
+  const separator = key.lastIndexOf("@");
+  const name = key.slice(0, separator);
+  const version = key.slice(separator + 1);
+  if (!directory) return { ecosystem: "npm", name, version, license: "UNKNOWN", texts: [] };
+
+  const manifest = JSON.parse(readFileSync(join(directory, "package.json"), "utf8"));
+  const license =
+    typeof manifest.license === "string"
+      ? manifest.license
+      : (manifest.license?.type ??
+        manifest.licenses?.map((entry) => entry.type ?? entry).join(" OR ") ??
+        "UNKNOWN");
+  return {
+    ecosystem: "npm",
+    name,
+    version,
+    license,
+    repository: repositoryUrl(manifest.repository),
+    texts: licenseTexts(directory),
+  };
+}
+
+/** Third-party crates in the native bridge's normal (shipped) dependency graph. */
+function bridgeCrates() {
+  const metadata = JSON.parse(
+    execFileSync("cargo", ["metadata", "--format-version", "1", "--locked"], {
+      cwd: repositoryRoot,
+      encoding: "utf8",
+      maxBuffer: 256 * 1024 * 1024,
+    }),
+  );
+  const packagesById = new Map(metadata.packages.map((entry) => [entry.id, entry]));
+  const nodes = new Map(metadata.resolve.nodes.map((node) => [node.id, node]));
+  const members = new Set(metadata.workspace_members);
+  const bridge = metadata.packages.find((entry) => entry.name === "shift-bridge");
+  if (!bridge) throw new Error("shift-bridge is missing from the Cargo workspace");
+
+  const shipped = new Set();
+  const pending = [bridge.id];
+  while (pending.length > 0) {
+    for (const dependency of nodes.get(pending.pop())?.deps ?? []) {
+      if (!dependency.dep_kinds.some((kind) => kind.kind === null)) continue;
+      if (shipped.has(dependency.pkg)) continue;
+      shipped.add(dependency.pkg);
+      pending.push(dependency.pkg);
+    }
+  }
+
+  return [...shipped]
+    .filter((id) => !members.has(id))
+    .map((id) => packagesById.get(id))
+    .sort(
+      (left, right) =>
+        left.name.localeCompare(right.name) || left.version.localeCompare(right.version),
+    )
+    .map((entry) => ({
+      ecosystem: "crate",
+      name: entry.name,
+      version: entry.version,
+      license: entry.license ?? (entry.license_file ? `see ${entry.license_file}` : "UNKNOWN"),
+      repository: entry.repository ?? undefined,
+      texts: licenseTexts(dirname(entry.manifest_path)),
+    }));
+}
+
+function licenseTexts(directory) {
+  return readdirSync(directory)
+    .filter((name) => LICENSE_FILE.test(name) && statSync(join(directory, name)).isFile())
+    .sort()
+    .map((name) => readFileSync(join(directory, name), "utf8").replace(/\r\n/g, "\n").trim());
+}
+
+function repositoryUrl(repository) {
+  const url = typeof repository === "string" ? repository : repository?.url;
+  return url?.replace(/^git\+/, "").replace(/\.git$/, "");
+}
+
+function render(target, entries) {
+  const artifact = target === "desktop" ? "the Shift desktop application" : "@shift-editor/sdk";
+  const lines = [
+    `Third-party licenses for ${artifact}`,
+    "",
+    "Generated from the dependencies shipped in this build. Shift itself is",
+    "licensed under MIT OR Apache-2.0; fonts, glyph data, and other bundled",
+    "material are listed in THIRD_PARTY_NOTICES.md.",
+    "",
+  ];
+
+  const groups = new Map();
+  const withoutFiles = [];
+  for (const entry of entries) {
+    if (entry.texts.length === 0) {
+      withoutFiles.push(entry);
+      continue;
+    }
+    const text = entry.texts.join("\n\n---\n\n");
+    const key = createHash("sha256").update(text.replace(/\s+/g, " ")).digest("hex");
+    if (!groups.has(key)) groups.set(key, { text, entries: [] });
+    groups.get(key).entries.push(entry);
+  }
+
+  const rule = "=".repeat(78);
+  for (const { text, entries: members } of groups.values()) {
+    lines.push(rule, "", "The following packages are distributed under the license below:", "");
+    for (const entry of members) lines.push(`- ${describe(entry)}`);
+    lines.push("", text, "");
+  }
+
+  if (withoutFiles.length > 0) {
+    lines.push(rule, "", "The following packages declare a license but ship no license file:", "");
+    for (const entry of withoutFiles) {
+      lines.push(`- ${describe(entry)}${entry.repository ? ` <${entry.repository}>` : ""}`);
+    }
+    lines.push(
+      "",
+      "Their declared licenses apply with the copyright held by each package's",
+      "authors. The standard texts follow.",
+      "",
+      rule,
+      "",
+      MIT_TEXT,
+      "",
+      rule,
+      "",
+      readFileSync(join(repositoryRoot, "LICENSE-APACHE"), "utf8").trim(),
+      "",
+    );
+  }
+  return `${lines.join("\n")}\n`;
+}
+
+function describe(entry) {
+  return `${entry.name} ${entry.version} (${entry.ecosystem}, ${entry.license})`;
+}

scripts/smoke-packaged.mjs

@@ -1,4 +1,5 @@
 import { spawn, spawnSync } from "node:child_process";
+import { existsSync } from "node:fs";
 import { mkdtemp, rm } from "node:fs/promises";
 import { createServer } from "node:net";
 import os from "node:os";
@@ -136,7 +137,26 @@ function verifyMacosDocumentIcon() {
   }
 }
 
+/** Fails when a packaged app omits the license texts it must redistribute. */
+function verifyLicenseResources() {
+  const resourcesPath =
+    process.platform === "darwin"
+      ? path.join(packagePath, `${packageName}.app`, "Contents", "Resources")
+      : path.join(packagePath, "resources");
+  for (const name of [
+    "LICENSE-MIT",
+    "LICENSE-APACHE",
+    "THIRD_PARTY_NOTICES.md",
+    "THIRD_PARTY_LICENSES.txt",
+  ]) {
+    if (!existsSync(path.join(resourcesPath, name))) {
+      throw new Error(`Packaged app is missing ${name}`);
+    }
+  }
+}
+
 verifyMacosDocumentIcon();
+verifyLicenseResources();
 
 async function reservePort() {
   const server = createServer();