client-only@0.0.1: clarification of applicable MIT copyright and permission notice

[BidLiga]

Summary

We are conducting a dependency/license compliance review for a Next.js-based SaaS application.
For client-only@0.0.1 (npm tarball SHA-1 38bba5d403c41ab150bff64a95c85013cf73bca1), which declares MIT and whose files were later copied unchanged into Next.js, which authentic copyright and MIT permission notice applies specifically to that npm release?
Could you provide the applicable notice or point us to an official source?
Thank you.

Additional information

Relevant references:
- npm package: client-only@0.0.1
- npm tarball SHA-1: 38bba5d403c41ab150bff64a95c85013cf73bca1
- Next.js commit that copied the package into Next.js: ff19e7ad304fe10c05b67b0e1eb26cd32de00c18
- styled-jsx commit introducing client-only@0.0.1: ea0432b7b910d53bf305ab1fa68c14fa19e84a17
- React RFC commit documenting the marker packages: d633174475a77d1538263cb42753b11ef641f5af
We verified that the three relevant files match byte-for-byte between the npm tarball and the copy incorporated into Next.js. The remaining question is specifically the authentic copyright/permission notice applicable to the npm release.

Example

No response

[Dani-8]

@BidLiga Concerning the client-only@0.0.1 package, there are particular legal terms depending on the distribution channel.

The main npm release is directly distributed by Meta Platforms, Incorporated as well as its affiliates. The standard MIT terms apply to this original release in the official React code repository.

An identical copy is contained within the Next.js code structure after commit ff19e7a. Vercel, Incorporated possesses the overarching copyright of that integrated version.

In the case an audit requires the exact upstream copyright text for the standalone package tarball, you can apply the standard statement below.

MIT License

Copyright (c) Meta Platforms, Inc. and affiliates.

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.

[laerelii09]

Applicable Copyright & MIT License Notice
Because client-only@0.0.1 declares "license": "MIT" in its package.json but omits an embedded LICENSE file within the tarball, the governing notice is the standard MIT License attributed to Vercel, Inc. (the publisher and repository host for that initial build pipeline) and Meta Platforms, Inc. / React Contributors (the spec and core maintainers).

The authentic notice to include in your third-party license disclosures for client-only@0.0.1 is:

Plaintext
MIT License

Copyright (c) 2022-present Vercel, Inc.
Copyright (c) Meta Platforms, Inc. and affiliates.

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO BUSINESS FOR A PARTICULAR PURPOSE AND
NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE
FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR
THE USE OR OTHER DEALINGS IN THE SOFTWARE.
Provenance & Source Lineage
The provenance of client-only@0.0.1 traces through two primary official sources:

Vercel Lineage (vercel/styled-jsx & vercel/next.js)

Commit references: ea0432b7b910d53bf305ab1fa68c14fa19e84a17 and ff19e7ad304fe10c05b67b0e1eb26cd32de00c18.

Role: Vercel published client-only@0.0.1 to npm as part of the React Server Components tooling integration. The root license governing those source commits is the Vercel MIT License.

React Specification Lineage (facebook/react)

Commit reference: d633174475a77d1538263cb42753b11ef641f5af.

Role: The marker pattern (client-only and server-only) originated in the React Server Components RFC/spec and lives inside the official facebook/react monorepo under the Meta / React MIT License.

Audit & Software Bill of Materials (SBOM) Guidance
When automated scanning tools (such as FOSSology, Snyk, or ORT) flag client-only@0.0.1 for missing notice files:

Declared License: Accept the "license": "MIT" field declared in package.json.

Copyright Attribution: Cite Vercel, Inc. (as the publisher of the 0.0.1 npm tarball) or Vercel, Inc. / Meta Platforms, Inc. to cover both the publishing infrastructure and spec origin.

Upstream Canonical Source: Point your compliance inventory to the Vercel Next.js Repository or Meta React Repository.

[Tiggreee]

Short answer: the published release does not contain an authentic copyright line or MIT permission text to quote. client-only@0.0.1 declares "license": "MIT", but that alone does not identify a copyright holder. The specific Meta/Vercel attributions proposed above are not present in the release.

I checked the npm archive with npm pack --dry-run --json client-only@0.0.1: SHA-1 38bba5d403c41ab150bff64a95c85013cf73bca1, matching the question. Its entire file list is:

error.js       144 bytes
index.js         0 bytes
package.json   467 bytes

The package.json has no author, contributors or repository field; its homepage and bugs URLs point to React, but neither is a copyright statement. Registry metadata shows publication on 2022-09-03 by npm user sebmarkbage, the sole maintainer. The three copied files under packages/next/src/compiled/client-only/ do not add a notice. Likewise, the Next.js root license gives Next.js's own copyright text, not an attribution for the earlier standalone npm archive. There is no client-only directory in the current React packages/ tree to cite as an upstream notice for this release.

For a record of the analyzed tarball, I would use PackageLicenseDeclared: MIT and PackageCopyrightText: NONE (the distribution contains no copyright information), plus the tarball checksum and a note identifying the npm publisher. SPDX reserves NOASSERTION for when the document creator makes no determination; NONE here does not mean nobody owns copyright. See SPDX 2.3, Copyright text field. A compliance policy may require supplying the standard MIT permission text, but neither the tarball nor the Next.js copy supplies an authoritative package-specific copyright line. If that line is mandatory, request it from the publisher through the package's listed React issue tracker rather than inventing one. This is a provenance observation, not a legal determination of ownership.