Here's [1] the actual JS file which Substack is loading, pulled directly from the network tab on the page linked in the thread.

Notably, the first line is "For license information please see sodo-search.min.js.LICENSE.txt". But if you go to that file [2], it's not the license _for this file_; it's the licenses _for the OSS code it includes_. I suspect that Substack thought that link pointed to the actual license; I did too before I started writing this comment. Possibly that confusion has lead to some talking past each other.

The actual license is at [3], which is obvious if you know how npm packages work, and probably not obvious otherwise. I don't see a link to that file anywhere.

[1] https://cdn.jsdelivr.net/npm/@tryghost/sodo-search@1.1/umd/s...

[2] https://cdn.jsdelivr.net/npm/@tryghost/sodo-search@1.1/umd/s...

[3] https://cdn.jsdelivr.net/npm/@tryghost/sodo-search@1.1/LICEN...