yt-dlp-ejs 0.8.0: preferred source supplement

The accompanying python_sources/yt_dlp_ejs-0.8.0.tar.gz is an original
PyPI source distribution. It already contains src/**/*.ts preferred sources,
rollup.config.js, hatch_build.py, package.json, and original package-manager
lockfiles. It is not merely a pre-generated or minified JavaScript bundle.

Its two bundled runtime JavaScript libraries are:
  astring 1.9.0 (MIT)
  meriyah 6.1.4 (ISC)

For each, this directory contains the original NPM package, checked against
the EJS package-lock SHA512 integrity, and a preferred-source Git archive at
the exact gitHead published by the official NPM registry for that version.
Each source archive's package.json version was independently checked.
Original license texts are copied under notices/. Full source files and
their notices also remain in the original archives.

See ejs-source-manifest.json for exact versions, commits, download URLs,
SHA256 hashes, and source-file evidence. The original package-lock lists
the unmodified general-purpose Rollup, TypeScript/Sucrase, linting and other
build tools; these can be acquired normally as the upstream build describes.
No NPM commands or downloaded build scripts were executed for this audit.

To build, inspect the source distribution's README.md and hatch_build.py.
The upstream instructions use a PEP518 builder, or python hatch_build.py,
and support Node, Bun, or Deno. Build commands and downloads are not performed
automatically by opening these source materials. A rebuild was not executed
and bit-for-bit reproduction is not claimed by this supplement.
