Licences & notices
SmartPress 3.0.0-beta.1 is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License, version 3 or later, as published by the Free Software Foundation. It is distributed in the hope that it will be useful, but without any warranty; without even the implied warranty of merchantability or fitness for a particular purpose.
The GPL gives you the right to the complete corresponding source code for this application, including the vendored WebAssembly codecs it serves to your browser. It is published at the link above.
Third-party notices — SmartPress
SmartPress is licensed under the GNU General Public License v3.0 or later. See LICENSE for the full text.
SmartPress is licensed under the GPL because it vendors libimagequant, which is GPL-3.0-or-later for open-source use. That is a deliberate choice, recorded in AI-Logs.md: palette quantization is where the PNG savings live (measured at −87% to −93%, against ~20% for lossless-only), and no permissively licensed quantizer matched it. See the Sprint 1.2 entry for the alternatives considered.
Vendored WebAssembly binaries
These binaries are redistributed under /public/wasm/ and are served to the browser at runtime, which is a distribution of the work. Their terms follow.
pngquant_bg.wasm — PNG quantization and optimisation
Extracted from `icodec` v0.6.0 (dist/pngquant_bg.wasm), whose own wrapper code is MIT (Copyright (c) 2024 Kaciras).
Note: icodec's versions.json does not list the PNG upstreams and its LICENSE carries no third-party notices, so the contents below were determined by reading the crate paths embedded in the binary itself rather than by trusting the package metadata. Verified crate versions:
| Crate | Version | Licence |
|---|---|---|
| imagequant | 4.3.3 | GPL-3.0-or-later |
| oxipng | 9.1.2 | MIT |
| png | 0.17.14 | MIT OR Apache-2.0 |
| libdeflater | 1.22.0 | Apache-2.0 |
| arrayvec, bitvec, bytemuck, crc32fast, fdeflate, hashbrown, indexmap, once_cell, serde-wasm-bindgen, wyz | see crates.io | MIT / Apache-2.0 |
imagequant is dual-licensed: GPL-3.0-or-later for open-source use, or a separate paid commercial licence from the copyright holder. SmartPress relies on the GPL arm. Apache-2.0 components are compatible with GPLv3 (though not GPLv2).
Upstream: https://github.com/ImageOptim/libimagequant
Regenerating: these bytes come from a published icodec release. To rebuild from source instead, compile imagequant + oxipng to wasm via wasm-bindgen (icodec's build scripts show the configuration). Rebuilding from upstream is preferable to trusting a binary whose own package under-declares its contents.
mozjpeg.wasm — JPEG encoding
MozJPEG v4.1.5 — https://github.com/mozilla/mozjpeg BSD-3-Clause and IJG licence terms.
webp-enc.wasm — WebP encoding
libwebp v1.4.0 — https://github.com/webmproject/libwebp BSD-3-Clause (Google Inc.).
npm dependencies
Codec packages from the jSquash project are Apache-2.0, repackaged from Google's Squoosh (Apache-2.0).
Remaining runtime and build dependencies are MIT or Apache-2.0; see package-lock.json for the resolved set.
Vendored WebAssembly binaries
Served from /wasm/ at runtime and loaded by raw bytes — see lib/codecs/loader.ts. The vendored pngquant.js glue in lib/codecs/vendor/ is modified from upstream -- see its header comment. Nothing here is fetched from a CDN, and no bundler resolves these paths: the worker fetches the file and hands the bytes to the codec's initialiser.
Licence terms for everything here are in the repo-root NOTICE.
| File | SHA-256 | Bytes | Source | Upstream | Licence |
|---|---|---|---|---|---|
mozjpeg_enc.wasm | 24d4177f…9326 | 251,524 | @jsquash/jpeg@1.6.0 | MozJPEG | BSD-3-Clause + IJG |
webp_enc.wasm | b6085bb6…6ab7 | 281,261 | @jsquash/webp@1.5.0 | libwebp | BSD-3-Clause |
webp_enc_simd.wasm | 39c27926…a305 | 345,584 | @jsquash/webp@1.5.0 | libwebp (SIMD) | BSD-3-Clause |
pngquant_bg.wasm | 3a6b3c7e…b40f | 349,781 | icodec@0.6.0 | imagequant 4.3.3 + oxipng 9.1.2 | GPL-3.0-or-later |
Full SHA-256 values are produced by shasum -a 256 public/wasm/*.wasm.
Regenerating
From `@jsquash` (mozjpeg, webp, avif) — these are copies of files already in node_modules, so a version bump means re-copying:
cp node_modules/@jsquash/jpeg/codec/enc/mozjpeg_enc.wasm public/wasm/
cp node_modules/@jsquash/webp/codec/enc/webp_enc.wasm public/wasm/
cp node_modules/@jsquash/webp/codec/enc/webp_enc_simd.wasm public/wasm/AVIF is not vendored: @jsquash/avif stalls the Turbopack production build (Sprint 1.2 bisect), so the codec layer marks the format unavailable and nothing can load it. Restore avif_enc.wasm only alongside a build that completes.
Both WebP variants are required: @jsquash/webp picks the SIMD build at runtime via wasm-feature-detect, so the vendored module must match what detection chose. AVIF's avif_enc_mt.wasm is deliberately not vendored — it needs cross-origin isolation, which we do not have and which Phase 3's static export cannot emit.
pngquant — not an npm dependency. Extracted from a published icodec release:
npm pack icodec@0.6.0 && tar xzf icodec-0.6.0.tgz
cp package/dist/pngquant_bg.wasm public/wasm/
cp package/dist/pngquant.js lib/codecs/vendor/pngquant.jsVerify against the SHA-256 above before trusting a re-extraction.
Building from upstream source is preferable to trusting this binary: icodec's versions.json does not list its PNG upstreams and its LICENSE carries no third-party notices, so the package under-declares what it ships. The contents recorded above were determined by reading crate paths embedded in the binary. To rebuild, compile imagequant + oxipng to wasm with wasm-bindgen.