| licenses: nothing GPL is installed by default; the WhatsApp client is an opt-in install, and the GeoIP notices name the data licenses (S3) What and why npm ci installed Baileys and its GPL-3.0 dependency libsignal for everyone. Now no package of the default install needs a GPL license: - Baileys is declared by no workspace (not regular, dev, optional or peer) and is out of the root package-lock.json (49 packages fewer: libsignal, curve25519-js, whatsapp-rust-bridge and what only the client needed). - It lives in optional/whatsapp/: its own package.json (Baileys 7.0.0-rc14, one exact version) and package-lock.json (integrity hash of every package), outside the workspaces. One command installs it: npm run whatsapp:install (npm ci --prefix optional/whatsapp --ignore-scripts). - packages/channels/src/whatsapp-baileys/client.ts is the one file that names the library. It looks for it in that folder when a connection opens, loads it by path only if it is there, and otherwise throws WhatsAppClientMissingError, whose message is the command and INVISIBLE_DOTS_WHATSAPP=1. That text is the channel status, is logged at server start when the variable is set without the client, and is what linking answers when WhatsApp is off (WHATSAPP_ENABLE_HELP). - Nothing imports the library by name, not even as types: the adapter writes down what it uses of it (WhatsAppClient) and compiles without it. A typecheck with the client installed (npm run typecheck:whatsapp, tsconfig.whatsapp.json, test-optin/ shape.ts) proves the real module has that shape and that the key groups are the library's own, which the old compile-time check did. The tests that need the real library moved to packages/channels/test-optin and run with npm run test:whatsapp (vitest.whatsapp.config.ts); a new CI job, whatsapp-client, installs the client the way a person does and runs both, with PostgreSQL. The command bundle no longer lists baileys as external: it has no import of it. - tests/repo/default-install-licenses.test.ts scans the root lock for licenses: no GPL or AGPL (SPDX expressions read with OR/AND), a license stated for every package, LGPL only among @img/sharp-* (Next.js's optional image binaries, named in the notices), and the same scan flags libsignal in the opt-in lock. tests/repo/whatsapp-optin.test.ts now proves the opt-in shape: no workspace declares it, it is outside the workspaces, pinned with integrity, one documented command, one loader, no static import, not in the bundle. GeoIP notices The first entry said the merged file is GPL-3.0, which is the license GitHub shows on daijro/geoip-all-in-one: the license of its scripts. Read at the pinned release (2026.09.30): its README states no license for the merged data and only credits IP2Location LITE, GeoLite2 and DB-IP. geoip-notices.ts now lists the actual data licenses of the sources (CC BY-SA 4.0 for IP2Location LITE, IPinfo and IPLocate.io; the GeoLite2 EULA; CC BY 4.0 for DB-IP Lite; CC0 1.0 for the tdulcet GeoFeed + Whois + ASN database, which sapics lists as PDDL 1.0; ODbL 1.0 for the OpenStreetMap-derived time zone boundaries), with GEOIP_STATEMENT: the image is built by the person on their own machine, invisible_dots does not publish or redistribute it, and whoever shares it meets those terms. Every golden manifest records it as notices_statement beside notices. THIRD_PARTY_NOTICES.md, the README, the image builder README and the architecture document say the same; the third-party notices test pins the source list and license of each source and keeps the notices, the statement and the manifest equal. Tests removed or moved (none of a feature that went away) - packages/channels/test/whatsapp-auth.test.ts (9 tests) moved to packages/channels/test-optin/auth-state.test.ts, unchanged in what it asserts: it needs the real BufferJSON, initAuthCreds and protobuf, which are not in the default install. It runs in the whatsapp suite on PGlite and PostgreSQL. - packages/channels/test/baileys.test.ts: "reading a Baileys message" (5 tests) and "the connector on a socket that cannot connect" (1) moved to test-optin/reading.test.ts for the same reason; endOf and the addresses (4 tests) stay in the default suite. - hub-whatsapp.test.ts "goes with the Dot" used the real library only to give the hub a session whose writes must not come back; it now uses a JSON stand-in for the library's three helpers (the real ones are in test-optin/auth-state.test.ts). - tests/repo/whatsapp-optin.test.ts: the five old checks are replaced by checks of the new shape; "pinned to one exact version in the channels package and the lock file", "declared by no other package" and "imported by the glue file alone" no longer apply because the dependency is not in the channels package or the root lock and no source imports it. Floors - vitest: linux 1187 -> 1196, win32 1190 -> 1199 (measured 1199 on win32). - postgres: min_passed 675 -> 659 and pg 273 -> 264, LOWERED: the 9 pg runs and 9 PGlite runs of the auth-state tests moved to the whatsapp suite, and the 6 moved glue tests (measured 659 passed, 264 pg, against a real PostgreSQL 18.4). - whatsapp (new): linux 24 with 9 pg (CI, PostgreSQL), win32 15 (no PostgreSQL). Suites: typecheck, typecheck:whatsapp, vitest 1199 passed (win32), postgres subset 659 passed with 264 pg, whatsapp suite 24 passed with PostgreSQL and 15 without, go test, engine 2778 passed, web build, english and claims gates clean. | 15 天前 |