Licences
AO ships third-party code to your browser. Everything it sends you is listed here with its licence and its source, because a site that asks you to trust what runs on your machine owes you the ability to check.
| Component | Version | Licence | Files |
|---|---|---|---|
| libheif-js (libheif) | 1.23.2 | LGPL-3.0 | source · licence text |
| @cantoo/pdf-lib | 2.11.0 | MIT (with an Apache-2.0 portion) | source · licence text |
| onnxruntime-web | 1.29.0 | MIT | source · licence text |
| MODNet (Xenova ONNX export) | fp16 | Apache-2.0 | source · licence text |
| qrcode-generator | 2.0.4 | MIT | source · licence text |
| @jsquash/avif (libavif) | 2.1.1 | Apache-2.0 | source · licence text |
libheif (LGPL-3.0) — required notice
AO's image tools can decode HEIC/HEIF images using libheif, compiled to WebAssembly and distributed as libheif-js version 1.23.2. libheif is licensed under the
GNU Lesser General Public License version 3, which incorporates the
GNU General Public License version 3 by reference. Both texts are reproduced in full at those links, along with the
upstream notices.
The bundle we serve is unmodified, obtained from the published libheif-js package (sources at catdad-experiments/libheif-js, upstream at strukturag/libheif). It is a decode-only build: it exposes a decoder and no encoder, so no GPL-licensed encoder is linked into it.
As permitted by LGPL-3.0 §4(d)(1), the library is conveyed as a separately loadable file —
/vendor/libheif/libheif-bundle.js — which you may replace with your own build of libheif; the tool loads it by that fixed path at runtime and nothing else in AO is linked against it.
Our own code
The GIF and BMP encoders, the knowledge engine, the tool runtime and the site build are written by AO and depend on nothing. Where a well-known library existed but carried a licence we could not honestly stand behind, we wrote our own instead — the GIF encoder in engine/gif.mjs exists for exactly that reason.
How we vendor
Every third-party component is pinned to an exact version, downloaded once, and served from our own origin — never from a CDN at runtime. Its real LICENSE file is read from the published package, not inferred from package metadata, and stored beside it. The build refuses to produce a site if any vendored component is missing its licence text.