@risacakep/risayap 0.0.0-stage → 7.0.0-rc25.7

package/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,49 @@
+# Third-Party Notices
+
+This file records the declared license metadata for the **direct runtime dependencies** of `@risacakep/risayap` as inspected for package version `7.0.0-rc25.4` on 2026-10-30.
+
+Clarissa Baileys declares its own project license as MIT. The repository `LICENSE` file contains the upstream MIT notice and copyright attribution to Rajeh Taher/WhiskeySockets. This notice does not replace that `LICENSE` file.
+
+## Direct runtime dependency inventory
+
+| Dependency | Inspected version | Declared license metadata |
+|:--|:--:|:--|
+| `@cacheable/node-cache` | `1.6.0` | MIT |
+| `@hapi/boom` | `9.1.4` | BSD-3-Clause |
+| `async-mutex` | `0.5.0` | MIT |
+| `axios` | `1.20.0` | MIT |
+| `fluent-ffmpeg` | `2.1.3` | MIT |
+| `libsignal` | `6.0.0` | GPL-3.0 |
+| `long` | `5.3.2` | Apache-2.0 |
+| `lru-cache` | `11.2.1` | ISC |
+| `music-metadata` | `11.12.3` | MIT |
+| `p-queue` | `9.0.0` | MIT |
+| `pino` | `9.7.0` | MIT |
+| `protobufjs` | `7.5.6` | BSD-3-Clause |
+| `whatsapp-rust-bridge` | `0.5.4` | MIT |
+| `ws` | `8.18.3` | MIT |
+
+The values above were read from the installed dependency package metadata through the project Yarn Plug'n'Play environment. They are metadata labels, not a substitute for reviewing the full license files and notices distributed by each dependency.
+
+## Important license review item: libsignal
+
+The installed metadata for `libsignal@6.0.0` declares `GPL-3.0`. This is materially different from the MIT labels shown for most of the other direct dependencies.
+
+Before redistributing or publishing a release, the project maintainer should review the exact `libsignal` package license, its source and distribution model, how the package is used, and the obligations that apply to the combined distribution and downstream applications. Do not describe this dependency as MIT, do not remove its license notices, and do not assume that the package-level `license: MIT` field resolves third-party obligations. This notice is informational and is not legal advice.
+
+## Scope and limitations
+
+- This table covers the 14 direct runtime dependencies listed in the inspected `package.json` only.
+- It does not claim to be a complete software bill of materials (SBOM).
+- It does not enumerate transitive dependencies, development dependencies, optional platform packages, or tools installed outside npm/Yarn.
+- Dependency versions and license metadata can change. Re-run the inventory whenever the lockfile or dependency set changes.
+- Review each dependency's full license text, copyright notices, attribution requirements, and any bundled third-party notices before redistribution.
+- Where a dependency is distributed separately by the package manager, its own license and notices continue to apply to that dependency.
+
+## Upstream project attribution
+
+Clarissa Baileys is derived from [WhiskeySockets/Baileys](https://github.com/WhiskeySockets/Baileys). The root `LICENSE` file must be preserved with its existing copyright and permission notice. Do not remove or replace upstream attribution when preparing source or package distributions.
+
+## Trademarks and affiliation
+
+WhatsApp and Meta are trademarks of their respective owners. Clarissa Baileys is an unofficial project and is not endorsed by, affiliated with, or sponsored by WhatsApp or Meta.

package/WAProto/GenerateStatics.sh

@@ -0,0 +1,3 @@
+yarn pbjs -t static-module --no-beautify -w es6 --no-bundle --no-delimited --no-verify --no-comments -o ./index.js ./WAProto.proto;
+yarn pbjs -t static-module --no-beautify -w es6 --no-bundle --no-delimited --no-verify ./WAProto.proto | yarn pbts --no-comments -o ./index.d.ts -;
+node ./fix-imports.js