drizzle-kit 0.31.10 license scope and bundled notice clarification

[micro-glia]

We are reviewing a private metadata-only repack of the published drizzle-kit@0.31.10 artifact. Executable/type files remain unchanged; the metadata removes the declared @esbuild-kit/esm-loader dependency and labels the result as a private, unofficial local repack. We have prepared only a local review candidate; this repack has not been adopted or published.

At source commit 4aa6ecfee4b4728dadf6f77f071a149878a3c6c0, drizzle-kit/package.json declares MIT, while the repository root LICENSE contains Apache 2.0. The published npm archive contains neither a standalone LICENSE nor NOTICE, and we could not find a package-local license file at this source commit. We understand current docs distinguish open-source Kit from non-open-source Studio; we are not treating the historical 2023 source-availability discussion as current licensing guidance.

Could you clarify:

1. Which license grant covers Drizzle-owned code in this exact published release: intentional package-specific MIT, repository-root Apache 2.0, or another explicitly documented arrangement?
2. Which authoritative copyright/license text should accompany copies of this release or a clearly labeled metadata-only repack?
3. Is there a release-specific third-party license/notice inventory for the bundled dependencies, including MIT components and the PSF-attributed portion in gel/dist/datatypes/dateutil.js?

We have retained the original declarations and bundled comments rather than silently changing the license field. Links to authoritative release-specific notices or a clarification in the repository would be appreciated. Thank you.

Public references:

• Exact source commit / Kit directory
• Exact package manifest
• Exact source-root license
• Original published npm artifact

[VictorPimentaDev]

Not a maintainer, but I went through the same check for drizzle-kit, so here is what the artifacts themselves say.

1. For the published drizzle-kit package the grant that ships with it is the "license": "MIT" field in drizzle-kit/package.json. It is still MIT on current main, while drizzle-orm/package.json says Apache-2.0 and the repo root LICENSE is Apache 2.0. That split looks deliberate (each package declares its own license and npm consumers only ever see the package manifest), not a leftover. The root file covers the repo as a whole. Only the maintainers can state that officially though, so if you need it on paper I would open an issue asking them to add a drizzle-kit/LICENSE file. That fixes the "no license text in the tarball" problem for everyone.

2. Until then, for a copy or repack I would ship the standard MIT text with a copyright line naming Drizzle Team, plus a note that the license is declared in package.json of drizzle-kit@0.31.10. That is the usual reading of MIT when a package declares it but ships no file.

3. I did not find a published third party notice inventory for the bundled dependencies. The practical route is to generate one from the bundle yourself. The build keeps the license comments from bundled code (that is where the PSF attribution in dateutil.js comes from), so grepping the dist for @license / Copyright and cross checking against drizzle-kit/package.json devDependencies gets you most of the list:

npm pack drizzle-kit@0.31.10
tar -xzf drizzle-kit-0.31.10.tgz
grep -rhoE '@license [^*]+|Copyright \(c\)[^*\n]+' package | sort -u

Keep the original declarations as you are doing, that is the safe call.