build: ship third-party license for bundled code

.changeset/fiery-cats-learn.md

@@ -0,0 +1,6 @@
+---
+"@smoothtml/vite-plugin-sri": patch
+---
+
+Add THIRD-PARTY-NOTICES.txt to the published package, carrying the MIT license
+and copyright for the bundled Vite-derived code.

NOTICE

@@ -3,7 +3,3 @@ Copyright 2026 Rishvic Pushpakaran.
 
 This product includes software developed by
 Rishvic Pushpakaran <rishvic@gmail.com>.
-
-Portions derived from Vite (https://github.com/vitejs/vite),
-copyright (c) 2019-present, VoidZero Inc. and Vite contributors,
-licensed under MIT. See SPDX headers in the affected files.

README.md

@@ -48,8 +48,8 @@ This plugin includes code adapted from [Vite](https://github.com/vitejs/vite) (
 2019-present, VoidZero Inc. and Vite contributors, MIT-licensed). Specifically,
 `src/html.ts` and `src/utils.ts` are derived from
 `packages/vite/src/node/plugins/html.ts` and `packages/vite/src/node/utils.ts`
-respectively. See the SPDX headers in those files and [`NOTICE`](./NOTICE) for
-details.
+respectively. See the SPDX headers in those files and
+[`THIRD-PARTY-NOTICES.txt`](./THIRD-PARTY-NOTICES.txt) for details.
 
 ## License
 

THIRD-PARTY-NOTICES.txt

@@ -0,0 +1,29 @@
+@smoothtml/vite-plugin-sri bundles code derived from Vite
+(https://github.com/vitejs/vite), specifically portions of
+packages/vite/src/node/plugins/html.ts and packages/vite/src/node/utils.ts,
+which are compiled into the published dist/ output. That code is licensed under
+the MIT License, reproduced below.
+
+------------------------------------------------------------------------
+
+MIT License
+
+Copyright (c) 2019-present, VoidZero Inc. and Vite contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

THIRD-PARTY-NOTICES.txt.license

@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2019-present, VoidZero Inc. and Vite contributors
+
+SPDX-License-Identifier: MIT

package.json

@@ -36,7 +36,10 @@
     "./package.json": "./package.json"
   },
   "files": [
-    "dist"
+    "dist",
+    "NOTICE",
+    "CHANGELOG.md",
+    "THIRD-PARTY-NOTICES.txt"
   ],
   "sideEffects": false,
   "scripts": {

tsdown.config.ts

@@ -4,6 +4,8 @@
 
 import { defineConfig } from "tsdown";
 
+// Deps are externalized, not bundled. If you bundle one into dist/, add its
+// attribution to THIRD-PARTY-NOTICES.txt - nothing else enforces this.
 export default defineConfig({
   entry: "src/index.ts",
   format: ["esm", "cjs"],