@brianmsm/quarto-bento 0.0.0-stage → 0.1.0

package/distribution/runtime/src/widgets/presenter.ts

@@ -0,0 +1,367 @@
+import { canonical } from "../state/json.ts";
+import type { Element, Origin } from "../render/types.ts";
+import { scanSource, type SourceDocument } from "../source/mod.ts";
+import { hashSource } from "../source/mod.ts";
+import { fail, parsePlotlyPayload, type PlotlyCandidate } from "./plotly.ts";
+
+/** Exact local runtime proved by this adapter, never fetched from a CDN. */
+export const PLOTLY_RUNTIME = {
+  version: "2.25.2",
+  sha256: "419deebe105f4c993feb7e6d1fe94fb1c2f7f98716db5d9b8fe3e37773838898",
+  licenseSha256:
+    "67a26cf80f03ff388f26945dfc1f6caed1a0746ff43871190339b3aee49b94bb",
+} as const;
+export interface PlotlyRuntime {
+  javascript: string;
+  license: string;
+}
+export interface PlotlyBundle {
+  version: 1;
+  candidate: PlotlyCandidate;
+  runtime: typeof PLOTLY_RUNTIME;
+  fallback: { mime: "image/svg+xml"; svg: string; sha256: string };
+}
+/** Store separately in the trusted generation receipt, never load from the bundle. */
+export interface PlotlyReceipt {
+  version: 1;
+  bundleHash: string;
+  source: PlotlyCandidate["source"];
+  specHash: string;
+  runtimeSha256: string;
+}
+export interface PlotlyContext {
+  source: SourceDocument;
+  expectedReceipt: PlotlyReceipt;
+}
+const encode = (value: string) => {
+  let binary = "";
+  for (const byte of new TextEncoder().encode(value)) {
+    binary += String.fromCharCode(byte);
+  }
+  return btoa(binary);
+};
+const html = (value: string) =>
+  value.replaceAll("&", "&").replaceAll('"', """).replaceAll(
+    "<",
+    "&lt;",
+  ).replaceAll(">", "&gt;");
+const json = (value: unknown) =>
+  JSON.stringify(value).replaceAll("<", "\\u003c");
+async function sha256(value: string): Promise<string> {
+  return [
+    ...new Uint8Array(
+      await crypto.subtle.digest("SHA-256", new TextEncoder().encode(value)),
+    ),
+  ].map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+export async function verifyPlotlyRuntime(
+  runtime: PlotlyRuntime,
+): Promise<void> {
+  if (
+    await sha256(runtime.javascript) !== PLOTLY_RUNTIME.sha256 ||
+    await sha256(runtime.license) !== PLOTLY_RUNTIME.licenseSha256
+  ) fail("Plotly runtime or license differs from the verified local pin");
+}
+/** Deliberately rejects active elements, hyperlinks, images and nonlocal CSS refs. */
+export function verifyStaticSvg(svg: string): void {
+  if (
+    svg.length > 5_000_000 || !/^<svg\s/.test(svg) || !/<\/svg>\s*$/.test(svg)
+  ) fail("invalid or oversized SVG snapshot");
+  if (
+    /<!|<\?|\bon[a-z]+\s*=|(?:href|src|xml:base)\s*=|@import|\\|&(?!(?:amp|lt|gt|quot|apos);)/i
+      .test(svg)
+  ) fail("active or external SVG content");
+  const tags = new Set(
+    "svg g defs clipPath rect path line polyline polygon circle ellipse text tspan title desc"
+      .split(" "),
+  );
+  for (const matched of svg.matchAll(/<\/?([A-Za-z][\w:-]*)\b/g)) {
+    if (!tags.has(matched[1])) {
+      fail(`SVG element ${matched[1]} is not supported`);
+    }
+  }
+  const attributes = new Set(
+    "xmlns xmlns:xlink class id d x y x1 y1 x2 y2 cx cy r rx ry dx dy height width viewBox transform style clip-path text-anchor dominant-baseline fill fill-opacity stroke stroke-width stroke-opacity stroke-linecap stroke-linejoin stroke-miterlimit stroke-dasharray stroke-dashoffset opacity font-family font-size font-weight font-style vector-effect points"
+      .split(" "),
+  );
+  const properties = new Set(
+    "font-family font-size font-weight font-style fill fill-opacity stroke stroke-width stroke-opacity stroke-linecap stroke-linejoin stroke-miterlimit stroke-dasharray stroke-dashoffset opacity white-space vector-effect display visibility paint-order"
+      .split(" "),
+  );
+  for (const tag of svg.matchAll(/<([A-Za-z][\w:-]*)([^>]*)>/g)) {
+    let rest = tag[2].replace(/\/\s*$/, "");
+    while (rest.trim()) {
+      const attribute = rest.match(/^\s+([\w:-]+)\s*=\s*("[^"]*"|'[^']*')/);
+      if (!attribute || !attributes.has(attribute[1])) {
+        fail("unsupported SVG attribute syntax");
+      }
+      const name = attribute[1], value = attribute[2].slice(1, -1);
+      if (name === "style") {
+        for (
+          const declaration of value.split(";").map((v) => v.trim()).filter(
+            Boolean,
+          )
+        ) {
+          const colon = declaration.indexOf(":");
+          if (
+            colon < 0 || !properties.has(declaration.slice(0, colon).trim())
+          ) fail("unsupported SVG style property");
+          const css = declaration.slice(colon + 1);
+          if (
+            /[{}@&]/.test(css) ||
+            [...css.matchAll(/([\w-]+)\s*\(/g)].some((m) =>
+              !["rgb", "rgba", "url"].includes(m[1])
+            )
+          ) fail("unsupported SVG style function");
+        }
+      } else if (["fill", "stroke", "clip-path"].includes(name)) {
+        if (
+          /[{}@&]/.test(value) ||
+          [...value.matchAll(/([\w-]+)\s*\(/g)].some((m) =>
+            !["rgb", "rgba", "url"].includes(m[1])
+          )
+        ) fail("unsupported SVG presentation function");
+      }
+      rest = rest.slice(attribute[0].length);
+    }
+  }
+  for (const matched of svg.matchAll(/url\s*\(([^)]*)\)/gi)) {
+    if (!/^#[A-Za-z0-9_.:-]+$/.test(matched[1])) {
+      fail("SVG CSS reference is not an internal fragment");
+    }
+  }
+}
+function verifyCandidate(candidate: PlotlyCandidate) {
+  if (
+    candidate.version !== 1 || candidate.kind !== "plotly" ||
+    candidate.specHash !== hashSource(canonical(candidate.spec))
+  ) fail("widget candidate changed after projection");
+  const config = structuredClone(candidate.spec.config);
+  if (
+    config.responsive !== false || config.displaylogo !== false ||
+    config.plotGlPixelRatio !== 1 ||
+    JSON.stringify(config.modeBarButtonsToRemove) !==
+      JSON.stringify(["toImage", "sendDataToCloud"])
+  ) fail("widget config changed after projection");
+  delete config.responsive;
+  delete config.plotGlPixelRatio;
+  delete config.modeBarButtonsToRemove;
+  const checked = parsePlotlyPayload(
+    JSON.stringify({
+      x: { data: candidate.spec.data, layout: candidate.spec.layout, config },
+      evals: [],
+      jsHooks: [],
+    }),
+  );
+  if (canonical(checked) !== canonical(candidate.spec)) {
+    fail("widget spec changed after projection");
+  }
+  if (
+    !Number.isInteger(candidate.width) || !Number.isInteger(candidate.height) ||
+    candidate.width < 100 || candidate.width > 1600 || candidate.height < 100 ||
+    candidate.height > 1600
+  ) fail("invalid widget dimensions");
+}
+export function createPlotlyBundle(
+  candidate: PlotlyCandidate,
+  svg: string,
+): PlotlyBundle {
+  verifyCandidate(candidate);
+  verifyStaticSvg(svg);
+  return {
+    version: 1,
+    candidate: structuredClone(candidate),
+    runtime: PLOTLY_RUNTIME,
+    fallback: { mime: "image/svg+xml", svg, sha256: hashSource(svg) },
+  };
+}
+function innerPage(
+  candidate: PlotlyCandidate,
+  runtime: PlotlyRuntime,
+  nonce: string,
+  exportSvg: boolean,
+) {
+  const csp =
+    `default-src 'none'; script-src 'nonce-${nonce}' data:; style-src 'unsafe-inline'; img-src data:; font-src 'none'; connect-src 'none'; media-src 'none'; object-src 'none'; base-uri 'none'; form-action 'none'; frame-src 'none'; worker-src 'none'`;
+  const script = `"use strict";
+const spec=${
+    json(candidate.spec)
+  }, width=${candidate.width}, height=${candidate.height};
+window.PlotlyConfig={MathJaxConfig:'local'};
+const chart=document.getElementById('chart');
+const report=value=>parent.postMessage({qbentoWidget:${
+    json(nonce)
+  },...value},'*');
+const layout={...spec.layout,width,height};
+Plotly.newPlot(chart,spec.data,layout,spec.config).then(async()=>{
+  if(${exportSvg}){
+    const uri=await Plotly.toImage(chart,{format:'svg',width,height});
+    if(!uri.startsWith('data:image/svg+xml,'))throw new Error('Expected an SVG data URI');
+    report({svg:decodeURIComponent(uri.slice(uri.indexOf(',')+1)),ready:true});
+  }else report({ready:true});
+}).catch(error=>report({error:String(error)}));`;
+  return `<!doctype html><html><head><meta charset="utf-8"><meta http-equiv="Content-Security-Policy" content="${
+    html(csp)
+  }"><style>html,body{margin:0;width:100%;height:100%;overflow:hidden}#chart{width:${candidate.width}px;height:${candidate.height}px}</style></head><body><div id="chart"></div><script nonce="${nonce}" src="data:text/javascript;base64,${
+    encode(runtime.javascript)
+  }"></script><script nonce="${nonce}">${script}</script></body></html>`;
+}
+/** Isolated opaque-origin child; no same-origin, forms, downloads, popups or navigation grants. */
+async function page(
+  candidate: PlotlyCandidate,
+  runtime: PlotlyRuntime,
+  bundle?: PlotlyBundle,
+): Promise<string> {
+  verifyCandidate(candidate);
+  await verifyPlotlyRuntime(runtime);
+  const nonce = crypto.randomUUID().replaceAll("-", "");
+  const csp =
+    `default-src 'none'; script-src 'nonce-${nonce}' data:; style-src 'unsafe-inline'; img-src data:; frame-src 'self'; connect-src 'none'; object-src 'none'; base-uri 'none'; form-action 'none'; worker-src 'none'`;
+  const child = innerPage(candidate, runtime, nonce, !bundle);
+  const fallback = bundle
+    ? `<img id="fallback" alt="Gráfico calculado; versión estática" width="${candidate.width}" height="${candidate.height}" src="data:image/svg+xml;base64,${
+      encode(bundle.fallback.svg)
+    }">`
+    : "";
+  const controls = bundle
+    ? '<button id="activate" disabled>Activar gráfico interactivo</button><p id="status" role="status">Cargando recursos locales…</p>'
+    : '<p id="status">Preparando SVG…</p>';
+  const script = `"use strict";const iframe=document.getElementById('widget');
+const result=document.getElementById('qb-widget-result'),status=document.getElementById('status');
+window.addEventListener('message',event=>{
+ if(event.source!==iframe.contentWindow||event.origin!=='null'||event.data?.qbentoWidget!==${
+    json(nonce)
+  })return;
+ if(event.data.error){status.textContent='No se pudo representar el widget: '+event.data.error;result.textContent=JSON.stringify({error:event.data.error});return;}
+ if(event.data.ready){status.textContent='Listo · recursos incluidos · sin conexión';result.textContent=JSON.stringify({ready:true,svg:event.data.svg});const button=document.getElementById('activate');if(button)button.disabled=false;}
+});
+const button=document.getElementById('activate');if(button)button.addEventListener('click',()=>{const active=iframe.hidden;iframe.hidden=!active;document.getElementById('fallback').hidden=active;button.textContent=active?'Mostrar versión estática':'Activar gráfico interactivo';});
+iframe.srcdoc=${json(child)};`;
+  return `<!doctype html><html lang="es"><head><meta charset="utf-8"><meta name="referrer" content="no-referrer"><meta http-equiv="Content-Security-Policy" content="${
+    html(csp)
+  }"><title>Plotly · Presenter aislado</title><style>body{margin:24px;font:16px system-ui;background:#f4f6f7;color:#172a35}main{max-width:${candidate.width}px;margin:auto}iframe{border:0;background:white}button{padding:10px 16px}img{display:block}img[hidden],iframe[hidden]{display:none}@media print{body{margin:0}button,#status,details,iframe{display:none!important}#fallback{display:block!important}}details{margin-top:20px}pre{white-space:pre-wrap;font-size:12px}</style></head><body><main>${controls}${fallback}<iframe id="widget" title="Gráfico Plotly aislado" sandbox="allow-scripts" referrerpolicy="no-referrer" width="${candidate.width}" height="${candidate.height}" ${
+    bundle ? "hidden" : ""
+  }></iframe><script id="qb-widget-result" type="application/json">{}</script><details><summary>Plotly ${PLOTLY_RUNTIME.version} · licencia</summary><pre>${
+    html(runtime.license)
+  }</pre></details></main><script nonce="${nonce}">${script}</script></body></html>`;
+}
+export const createPlotlySnapshotPage = (
+  candidate: PlotlyCandidate,
+  runtime: PlotlyRuntime,
+): Promise<string> => page(candidate, runtime);
+/** Call only for a newly captured bundle, before its generation is published. */
+export function createPlotlyReceipt(bundle: PlotlyBundle): PlotlyReceipt {
+  verifyCandidate(bundle.candidate);
+  verifyStaticSvg(bundle.fallback.svg);
+  if (
+    bundle.version !== 1 ||
+    bundle.fallback.sha256 !== hashSource(bundle.fallback.svg) ||
+    canonical(bundle.runtime) !== canonical(PLOTLY_RUNTIME)
+  ) fail("invalid freshly captured widget bundle");
+  return {
+    version: 1,
+    bundleHash: hashSource(canonical(bundle)),
+    source: structuredClone(bundle.candidate.source),
+    specHash: bundle.candidate.specHash,
+    runtimeSha256: PLOTLY_RUNTIME.sha256,
+  };
+}
+/** Validate against current QMD and a receipt obtained from the trusted core generation. */
+function verifyBundleContext(
+  bundle: PlotlyBundle,
+  context: PlotlyContext,
+): void {
+  const receipt = createPlotlyReceipt(bundle);
+  if (canonical(receipt) !== canonical(context.expectedReceipt)) {
+    fail("bundle does not match the expected generation receipt");
+  }
+  const original = context.source;
+  if (
+    hashSource(original.text) !== original.hash ||
+    original.hash !== receipt.source.sourceHash
+  ) fail("widget source snapshot is stale");
+  const source = scanSource(original.text);
+  if (source.diagnostics.length) {
+    fail("source mapping diagnostics must be resolved first");
+  }
+  const wrapper = source.blocks.find((b) =>
+    b.id === receipt.source.sourceId && b.kind === "div" && b.stable
+  );
+  const children = wrapper
+    ? source.blocks.filter((b) => b.parentId === wrapper.id)
+    : [];
+  if (
+    children.length !== 1 || children[0].kind !== "chunk" ||
+    !children[0].stable || children[0].id !== receipt.source.producerId ||
+    children[0].slideId !== receipt.source.slideId ||
+    hashSource(children[0].raw) !== receipt.source.chunkHash
+  ) fail("widget producer no longer matches original source");
+  if (/results\s*[:=]\s*["']?asis|asis_output\s*\(/i.test(children[0].raw)) {
+    fail("unsupported asis producer");
+  }
+}
+/** Loading untrusted persisted JSON always requires both fresh QMD and an external receipt. */
+export async function loadPlotlyBundle(
+  serialized: string,
+  options: PlotlyContext & { runtime: PlotlyRuntime },
+): Promise<PlotlyBundle> {
+  if (serialized.length > 8_000_000) fail("widget bundle exceeds 8 MB");
+  let bundle: PlotlyBundle;
+  try {
+    bundle = JSON.parse(serialized);
+    verifyBundleContext(bundle, options);
+  } catch (error) {
+    if (
+      error instanceof Error && error.message.startsWith("UNSUPPORTED_WIDGET:")
+    ) throw error;
+    fail("malformed widget bundle or context");
+  }
+  await verifyPlotlyRuntime(options.runtime);
+  return bundle!;
+}
+export function createPlotlyPresenter(
+  bundle: PlotlyBundle,
+  runtime: PlotlyRuntime,
+  context: PlotlyContext,
+): Promise<string> {
+  verifyBundleContext(bundle, context);
+  if (
+    bundle.version !== 1 || bundle.runtime.sha256 !== PLOTLY_RUNTIME.sha256 ||
+    bundle.fallback.sha256 !== hashSource(bundle.fallback.svg)
+  ) fail("widget bundle integrity mismatch");
+  verifyStaticSvg(bundle.fallback.svg);
+  return page(bundle.candidate, runtime, bundle);
+}
+
+/** Integration boundary: only the checked static image enters pure-data BentoDoc. */
+export function plotlyStaticElement(
+  bundle: PlotlyBundle,
+  context: PlotlyContext,
+): { element: Element; origin: Origin } {
+  verifyBundleContext(bundle, context);
+  if (bundle.fallback.sha256 !== hashSource(bundle.fallback.svg)) {
+    fail("widget fallback changed");
+  }
+  verifyCandidate(bundle.candidate);
+  verifyStaticSvg(bundle.fallback.svg);
+  const c = bundle.candidate;
+  return {
+    element: {
+      id: c.source.sourceId,
+      type: "image",
+      x: 160,
+      y: 130,
+      w: 880,
+      h: Math.min(480, c.height),
+      rotation: 0,
+      opacity: 1,
+      src: `data:image/svg+xml;base64,${encode(bundle.fallback.svg)}`,
+      fit: "contain",
+    },
+    origin: {
+      origin: "computed",
+      sourceId: c.source.sourceId,
+      producer: c.source.producerId,
+    },
+  };
+}

package/distribution/runtime/src/widgets/snapshot.ts

@@ -0,0 +1,116 @@
+/** Optional local Chromium exporter; requires a compatible browser already installed. */
+import { pathToFileURL } from "node:url";
+import {
+  createPlotlyBundle,
+  createPlotlySnapshotPage,
+  type PlotlyBundle,
+  type PlotlyRuntime,
+  verifyStaticSvg,
+} from "./presenter.ts";
+import { fail, type PlotlyCandidate } from "./plotly.ts";
+export async function snapshotPlotly(
+  candidate: PlotlyCandidate,
+  runtime: PlotlyRuntime,
+  options: { chromium?: string; timeoutMs?: number } = {},
+): Promise<PlotlyBundle> {
+  const page = await createPlotlySnapshotPage(candidate, runtime);
+  const dir = await Deno.makeTempDir({ prefix: "qbento-plotly-snapshot-" });
+  let child: Deno.ChildProcess | undefined;
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  try {
+    await Deno.writeTextFile(`${dir}/snapshot.html`, page);
+    child = new Deno.Command(options.chromium ?? "chromium", {
+      args: [
+        "--headless",
+        "--no-first-run",
+        "--no-default-browser-check",
+        "--disable-background-networking",
+        "--disable-extensions",
+        "--disable-sync",
+        "--no-pings",
+        `--user-data-dir=${dir}/profile`,
+        "--dump-dom",
+        "--virtual-time-budget=5000",
+        pathToFileURL(`${dir}/snapshot.html`).href,
+      ],
+      stdout: "piped",
+      stderr: "piped",
+    }).spawn();
+    const timeout = new Promise<never>((_, reject) => {
+      timer = setTimeout(() => {
+        try {
+          child?.kill("SIGKILL");
+        } catch { /* Already exited. */ }
+        reject(
+          new Error(
+            "WIDGET_SNAPSHOT_TIMEOUT: local Chromium did not produce a snapshot",
+          ),
+        );
+      }, options.timeoutMs ?? 30_000);
+    });
+    const output = await Promise.race([child.output(), timeout]);
+    if (!output.success) {
+      fail(
+        `local Chromium export failed: ${
+          new TextDecoder().decode(output.stderr).slice(-2000)
+        }`,
+      );
+    }
+    const dom = new TextDecoder().decode(output.stdout);
+    const matched = dom.match(
+      /<script id="qb-widget-result" type="application\/json">([\s\S]*?)<\/script>/,
+    );
+    if (!matched) fail("Chromium did not emit an export result");
+    const result = JSON.parse(matched![1]);
+    if (result.ready !== true || typeof result.svg !== "string") {
+      fail(
+        `Chromium did not finish SVG export${
+          result.error ? `: ${result.error}` : ""
+        }`,
+      );
+    }
+    return createPlotlyBundle(
+      candidate,
+      canonicalPlotlySvg(result.svg, candidate.specHash),
+    );
+  } finally {
+    if (timer !== undefined) clearTimeout(timer);
+    await Deno.remove(dir, { recursive: true });
+  }
+}
+
+/** Plotly assigns random SVG IDs/trace class tokens; never rewrite user label text. */
+export function canonicalPlotlySvg(svg: string, specHash: string): string {
+  verifyStaticSvg(svg);
+  const ids = new Map<string, string>();
+  const tags = (
+    input: string,
+    update: (name: string, value: string) => string,
+  ) =>
+    input.replace(
+      /<[A-Za-z][^<>]*>/g,
+      (tag) =>
+        tag.replace(/\s([\w:-]+)=(["'])(.*?)\2/g, (_, name, quote, value) =>
+          ` ${name}=${quote}${update(name, value)}${quote}`),
+    );
+  tags(svg, (name, value) => {
+    if (name === "id") {
+      if (ids.has(value)) fail("duplicate SVG identity");
+      ids.set(value, `qb-plotly-${specHash.slice(0, 16)}-${ids.size}`);
+    }
+    return value;
+  });
+  svg = tags(svg, (name, value) => {
+    if (name === "id") return ids.get(value)!;
+    if (name === "class") {
+      return value.split(/\s+/).filter((c) => !/^trace[0-9a-f]{6}$/.test(c))
+        .join(" ");
+    }
+    return value.replace(/url\(#([^)]+)\)/g, (_, id) => {
+      if (!ids.has(id)) fail("unbound SVG fragment");
+      return `url(#${ids.get(id)})`;
+    });
+  });
+  verifyStaticSvg(svg);
+  return svg;
+}

package/distribution/runtime/vendor/bento/FONT_NOTICES.md

@@ -0,0 +1,49 @@
+# Embedded font provenance and notices
+
+This note supplements the pinned Bento files. It records the embedded font
+assets and the exact official OFL text sources used by this package. The
+upstream `THIRD_PARTY_NOTICES.md` and `shell.html` remain byte-for-byte
+unchanged.
+
+## Embedded assets
+
+| Font asset in Bento | Subset and size | Asset SHA-256 | Release version |
+| --- | --- | --- | --- |
+| Fraunces `FRAUNCES_900` | Latin, 34,632-byte WOFF2 | `628051c1bd196ee82e88cb02015e46b8fc30f505215b424d29627ec613395a0d` | Unknown |
+| Instrument Sans `INSTRUMENT_VAR` | Latin, 29,904-byte WOFF2 | `6219bc4bfdfc5d9b2201dcdf046218b122a758f932e25ed5f168f929b7ca2311` | Unknown |
+
+The byte counts and asset hashes come from the base64 WOFF2 data in Bento's
+pinned `slides/src/fontdata.ts` at
+`3d6f7f1fcdf2308e875345ce4f1e0ec0820c914b`. Its source comments identify the
+families and Latin subsets. No upstream font release identifier is present in
+that pinned source; the package records the release versions as unknown and
+does not infer them from the font binary metadata.
+
+## License text sources
+
+The complete upstream license texts are included at the paths below and
+integrity-pinned in `pin.json`. Each source URL includes an immutable upstream
+Git commit, and the SHA-256 covers the exact vendored file bytes.
+
+| Font | License file | Official source at immutable commit | SHA-256 |
+| --- | --- | --- | --- |
+| Fraunces | `font-licenses/fraunces-OFL.txt` | https://raw.githubusercontent.com/undercasetype/Fraunces/284bc5ea73b1233a05d6ec644e641b9404cba8a0/OFL.txt | `bdf4c22802eaf804f998195871c6b8938aac2ac14b2d78a8bd66a6f1eced833b` |
+| Instrument Sans | `font-licenses/instrument-sans-OFL.txt` | https://raw.githubusercontent.com/Instrument/instrument-sans/24690a4ab2f92d45aa23246abeba515712145d75/OFL.txt | `9e27a72ed30eb49a08678f6a5d6ed98ec7ba5368f541637ee0683ec9134ef966` |
+
+## Attribution evidence
+
+Bento's pinned `THIRD_PARTY_NOTICES.md` attributes Fraunces to
+`Copyright 2020 The Fraunces Project Authors`. The official Fraunces OFL text
+included here begins `Copyright 2018 The Fraunces Project Authors`. The
+upstream Fraunces commit at
+https://github.com/undercasetype/Fraunces/commit/284bc5ea73b1233a05d6ec644e641b9404cba8a0
+records the project-author attribution change; the license header still says
+2018. This package records both observations without editing or replacing
+Bento's supplied attribution.
+
+For Instrument Sans, Bento's notice and the included official OFL both state
+`Copyright 2022 The Instrument Sans Project Authors`.
+
+This is provenance and notice coverage for these two embedded fonts only. It
+does not constitute a complete legal review of Bento, its runtime components,
+the font binaries' exact upstream releases, or Quarto-Bento's own licensing.

package/distribution/runtime/vendor/bento/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 The Bento authors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/distribution/runtime/vendor/bento/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,51 @@
+# Third-party notices
+
+bento/slides is MIT-licensed (© 2026 The Bento authors; see `LICENSE`).
+The shippable single-file shell (`Bento_Slides.bento.html`) bundles the
+following third-party open-source components. Their license terms require that
+these notices accompany copies, so the same text is embedded as a `NOTICE`
+comment near the top of every built shell and every saved Bento document.
+
+## Bundled runtime (ships inside the shell)
+
+### reveal.js
+- License: MIT
+- Copyright (C) 2011-2024 Hakim El Hattab, http://hakim.se, and reveal.js contributors
+- Project: https://revealjs.com / https://github.com/hakimel/reveal.js
+- Use: powers the present-mode fullscreen slideshow overlay.
+
+### Moveable
+- License: MIT
+- Copyright (c) 2019 Daybrush (Younkue Choi)
+- Project: https://github.com/daybrush/moveable
+- Use: on-canvas element manipulation (drag / resize / rotate handles). Pulls in
+  the author's supporting modules (`@daybrush/*`, `@scena/*`, `@egjs/*`,
+  `@cfcs/*`), all MIT, © Daybrush.
+
+### Selecto
+- License: MIT
+- Copyright (c) 2020 Daybrush (Younkue Choi)
+- Project: https://github.com/daybrush/selecto
+- Use: marquee / rubber-band selection on the editing canvas.
+
+## Bundled fonts (embedded as document assets in decks that use them)
+
+### Fraunces
+- License: SIL Open Font License 1.1
+- Copyright 2020 The Fraunces Project Authors
+- Project: https://github.com/undercasetype/Fraunces
+
+### Instrument Sans
+- License: SIL Open Font License 1.1
+- Copyright 2022 The Instrument Sans Project Authors
+- Project: https://github.com/Instrument/instrument-sans
+
+---
+
+Full MIT license text is reproduced in the shell's `NOTICE` comment and in the
+`LICENSE` file. The SIL Open Font License 1.1 text is available at
+https://openfontlicense.org.
+
+Dev-only tooling (Vite, TypeScript, `vite-plugin-singlefile`, `qrcode`,
+`@types/*`) is used to build Bento but is **not** bundled into the shipped shell
+and is therefore not listed here.