# Release notice supplement — provenance and bounded classification

Not a complete distribution notice or legal clearance. Scope: 22 deployed package-manifest occurrences whose own directory lacked a recognized notice. Original-text or exact release project-level license evidence is available for 16 occurrences: the nine in ../THIRD_PARTY_NOTICES-supplement.md plus @next/env and two @next/swc 16.4.2, two @oxlint/binding 1.89.0, and two @rolldown/binding 1.2.14. Project license identified does not resolve bundled native components or source obligations.

Six occurrences still lack a confidently matched complete package notice: @img/sharp-libvips-linux-x64 and linuxmusl-x64 1.3.4 (LGPL binary/source and dependent notices), client-only 0.0.1 (two copies), server-only 0.0.1, and @npmcli/agent 4.0.2. Their exact npm tarballs lacked recognized license files. For client/server-only determine the actual original copyright/notice; for agent obtain authoritative version-specific ISC copyright text. LGPL redistribution-source obligations remain open. In addition Next/SWC, oxlint and rolldown native bundled notices are NOT established solely by the retrieved top-level project licenses.

Actual deployed .next output inspection: 68 static JS/JSON files and 171 server JS/JSON files contained none of the literal package strings @next/env, @next/swc, @oxlint/binding, @rolldown/binding, sharp-libvips, client-only, server-only or @npmcli/agent. Minification and bundling make string absence inconclusive. Lockfile marks oxlint/rolldown platform bindings dev optional; npmcli/agent is in bundled npm, not application dependency. Those are image/build distribution priorities, not evidence of browser delivery. sharp/libvips and Next/SWC are server/build components, though image optimization and browser bundles must be traced; client-only and server-only markers can be compile-time artifacts, actual shipped content is unproven. Browser release needs emitted JS/CSS asset component/notice attribution and food data permission, attribution and freshness assessed; native image/ZIP redistribution requires its own source-offer/notice review. Hosted and downloadable-image obligations must not be conflated.

Exact sources for added project licenses:
- next-16.4.2-LICENSE: https://raw.githubusercontent.com/vercel/next.js/2864b1772c37242a9b40ab4d366eb7d368c2a070/license.md (tag v16.4.2).
- oxlint-1.89.0-LICENSE: https://raw.githubusercontent.com/oxc-project/oxc/07ed78f4abde4020ca7919381ffea4da8616b78a/LICENSE (tag oxlint_v1.89.0).
- rolldown-1.2.14-LICENSE: https://raw.githubusercontent.com/rolldown/rolldown/c9a8cda42bc0fdd84c7b4b4e6d7f95ae83e8b5f7/LICENSE (tag v1.2.14).
Other source URLs and package mappings: ../THIRD_PARTY_NOTICES-supplement.md. Raw texts are byte-preserved in texts/. No license grant is inferred from metadata alone.

SHA-256 manifest for texts:
- cc-by-3.txt: e6bc9e9c474700b708f568bac9e5a8a9bcb2b1dad53442f5ba449fcb848b8e76
- cc0-1.txt: a2010f343487d3f7618affe54f789f5487602331c0a8d03f49e9a7c547cf0499
- edge-runtime-cookies-6.0.0-LICENSE.md: e4f76a7a19ef2989dd79339bd3abf8afcf1d6f065e5a10c76c19415ffd727eb3
- edge-runtime-ponyfill-4.0.0-LICENSE.md: e4f76a7a19ef2989dd79339bd3abf8afcf1d6f065e5a10c76c19415ffd727eb3
- edge-runtime-primitives-6.0.0-LICENSE.md: e4f76a7a19ef2989dd79339bd3abf8afcf1d6f065e5a10c76c19415ffd727eb3
- esbuild-upstream.md: b40ec5baec7bb34fa5b1c09521fa3cd52d5fad7adafed74932a2010d3612a681
- murmur-README.md: a6df412756139a6706db058a33f8aa39b9e280facf7f1587e86f6680f9e5cbb6
- next-16.4.2-LICENSE: ee765244e2d59f5234d474f62e0766fa0c8b99af967fdd4c0cb8dcb0c76ea224
- oxlint-1.89.0-LICENSE: 95ced5ecf1133fbf41d409b5555c86c344f83f3b019926057ddbc07cfdcc27b3
- postgres-3.4.9-UNLICENSE: d770ea4f8155fc1cc3792960eee1d3da30c91f51423fe2666a6cd810499f25a1
- rolldown-1.2.14-LICENSE: 23ecfff35a5a2e80d92142f75228912c3b1abc4b5a8337a821ff4397e2f9f734
- sigstore-upstream: 364a130d2ca340bd56eb1e6d045fc6929bb0f9d0aa018f2c1949b29517e1cdd0
- spdx-exceptions-README.md: 554b19eee11d2964e9f7b244e47944c08d52ca75539260a04f3227e6c0144513
- spdx-ids-README.md: b4807793db6058c819f76c023362b7d522b3d19c9b41563fcc01c2b2c5b1ccd3