ChessExpert.io Stockfish distributions ================================= Stockfish and these engine distributions are licensed under GNU GPL version 3. The complete license texts and upstream AUTHORS files are alongside this file. Commercial use and redistribution are permitted subject to those terms. Nothing in ChessExpert.io's general terms restricts rights granted by these licenses. Stockfish SF_classical (multi-threaded WASM; legacy ID: heavy) ----------------------------------------------------------- Engine version: SF_classical UCI name: Stockfish SF_classical 64 POPCNT Build: WASM 64 POPCNT Package: stockfish.wasm 0.10.0 Repository: https://github.com/niklasf/stockfish.wasm Commit: a3675c0c24e031581d6e7b43bf38aeb01cf4a112 Download: heavy-source.tar.gz (same server, no login or payment required) This is the upstream SF_classical branch with classical evaluation, superseded by NNUE. It is not identified as a numbered Stockfish 13 release. The bundled source src/misc.cpp declares Version = "SF_classical"; Readme.md identifies the SF_classical upstream tag. The distributed binary confirms that identity over UCI. The distributed stockfish.js, stockfish.wasm and stockfish.worker.js exactly match the published npm package stockfish.wasm@0.10.0. The corresponding source archive is the complete repository at that package's published gitHead and includes C++ source, Makefile, pre/post-JS, package.json and compilation scripts. Upstream build instructions: install an Emscripten toolchain providing em++ ^2.0.13, then run `npm run-script prepare` in the extracted source directory. See Readme.md and package.json in the archive for the actual build command. The exact historical compiler installation is not recorded by the upstream release; this is source provenance, not a claim of a verified byte-for-byte rebuild. No engine C++ or distributed vendor files are changed by ChessExpert.io. Stockfish 11 (single-threaded WASM; legacy ID: sf11) ------------------------------------------------- Engine version: 11 Build: WASM Package: stockfish 11.0.0 Repository: https://github.com/nmrugg/stockfish.js Commit: 2b87d5d16a613f3ce05b1dd0bbb58465501ed30a Download: sf11-source.tar.gz (same server, no login or payment required) The distributed stockfish.js and stockfish.wasm exactly match both the published npm stockfish@11.0.0 package and src/ files in this complete repository archive. The archive includes C++ source, src/Makefile, build.js, preamble.js, other build inputs and upstream license/authorship files. Upstream build instructions: install Node.js and Emscripten on PATH, then run `./build.js --arch wasm`. See `./build.js --help` and Readme.md in the archive. The upstream release does not pin an exact compiler version; no reproducible byte-for-byte rebuild is claimed here. ChessExpert.io SF11 bootstrap ------------------------- /js/vendor/sf11/stockfish.worker.js is a small ChessExpert.io bootstrap, not the upstream worker. It loads the unmodified vendor script from the same directory and reports startup errors through the existing ChessExpert.io control envelope. Its complete preferred source is that readable JavaScript file, also copied as sf11-bootstrap-source.js alongside these archives. This bootstrap is distributed under GPL version 3 or (at your option) any later version; copyright 2026 ChessExpert.io contributors. No minification or compilation is needed: copy the source as stockfish.worker.js beside the upstream stockfish.js and WASM. This notice applies to that bootstrap file and does not purport to relicense unrelated ChessExpert.io application code. Verification ------------ provenance.json records upstream source URLs, immutable commits, archive and runtime SHA-256 hashes. engineVersion identifies the chess engine, packageVersion identifies its npm distribution, build/threading describe the compiled variant, and uciName records the exact response to UCI. The existing version field remains a compatibility alias for packageVersion; it is not the chess engine version. The legacy heavy/sf11 IDs, download names and worker paths remain unchanged. The npm release tarballs used to confirm vendor bytes: https://registry.npmjs.org/stockfish.wasm/-/stockfish.wasm-0.10.0.tgz https://registry.npmjs.org/stockfish/-/stockfish-11.0.0.tgz The upstream source archives are provided unmodified. The local bootstrap source and this document describe the additional ChessExpert.io engine distribution file. Standalone heavy UCI worker (ChessExpert.io modification, 2026) --------------------------------------------------------- Runtime: /js/vendor/stockfish.wasm/uci/stockfish.worker.js Complete identical preferred source: heavy-bootstrap-source.js Copyright2026 ChessExpert.io contributors. GNU GPL version3 only (GPL-3.0-only). The feature probe is adapted from the pinned stockfish.wasm Readme under GPL3; its clone test now uses a worker-owned MessageChannel, never the parent window. Full grant/attribution/change notes are in the readable source header, with full license in heavy-COPYING.txt and upstream AUTHORS in heavy-AUTHORS.txt. There is no separate compilation/minification step for this component: copy heavy-bootstrap-source.js to that nested runtime path. Keep the unmodified parent stockfish.js, stockfish.wasm and stockfish.worker.js files in place; the last is the vendor's PThread worker, not this outer UCI worker. Existing vendor file identities and complete corresponding source archive remain unchanged. The standalone component imports no ChessExpert.io application module. Vendor factory, WASM download/binary, shared memory and PThread objects stay inside it. Its mainScriptUrlOrBlob/locateFile explicitly use the parent vendor directory; the nested outer URL must not be used as the PThread's vendor-script location. This component's GPL terms do not purport to assign a license to unrelated ChessExpert.io code. Process/UCI separation is a technical boundary, not a blanket legal certification or an automatic exemption for all application integrations. Independent client (no React, Firebase Auth or ChessExpert.io UI required) ------------------------------------------------------------------- Serve these same public paths over HTTPS or localhost with BOTH headers on the client document and worker assets: Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Serve .wasm as application/wasm, JS as application/javascript. No npm build is needed for the engine component. Use a classic Worker (not type:module): const engine = new Worker('/js/vendor/stockfish.wasm/uci/stockfish.worker.js'); engine.addEventListener('message', ({data}) => { if (typeof data === 'string') console.log(data); // UCI output else if (data?.type === 'chessexpert:engine-control' && data.version === 1) { if (data.event === 'ready') engine.postMessage('uci'); if (data.event === 'failure') engine.terminate(); } }); Wait for real uciok, set Hash (<=ready.hashCapacity), Threads and MultiPV, send isready and wait for readyok before position/go. Send stop and wait for bestmove before replacing an active search or changing options. Terminate the outer Worker when done; browsers also terminate its nested PThreads. Fatal bootstrap cleanup additionally terminates the vendor/PThreads before self.close(). The repeatable local verifier is frontend/scripts/verify-heavy-worker.cjs. It uses only loopback assets/installed browser tooling, never production. Control schema: exactly four keys {type,version,event,}. type: chessexpert:engine-control; version:1 event:phase, phase:memory|script|wasm|factory event:ready, hashCapacity:16|1024 (MiB maximum) event:failure, failure:abort|bootstrap-error|worker-error|message-error| post-message|unhandled-rejection These closed control objects contain no engine state/memory, URLs, FEN or raw errors. They are not UCI strings and ready does not fabricate uciok/readyok. Host startup has a15second factory deadline, then a separate10second heavy UCI deadline. The host computes its old deviceMemory-based Hash within that capacity. Memory stays1024pages initial, maximum32768 when growable, else1088. Asynchronous failure diagnostics identify the last attempted closed command; they do not claim that a delayed abort happened synchronously in that command. Stockfish 19 Lite single-threaded (SF19) -------------------------------------- Package: stockfish 19.0.1; engine: Stockfish 19 Lite WASM; fixed Threads=1. Repository: https://github.com/nmrugg/stockfish.js Commit: 0d5dd7944f88c817c07a26bc4fb1905d5f9c46d6 (release v19.0.1) Download: sf19-source.tar.gz (same server, no login or payment required) Build input: sf19-nn-61e7af4bb97d.nnue (same directory) The JS and WASM are unmodified release assets stockfish-19-lite-single.js and stockfish-19-lite-single.wasm (28,230 + 1,845,971 bytes). The complete immutable upstream archive contains engine C++, build.js, Makefiles and Emscripten glue. The separately supplied exact Lite NNUE file has SHA256 61e7af4bb97d51eeeb25d322916f86513b5cd3a827ce189c98c6e31946f99e5b. It is the EvalFileLiteName declared by the pinned source; upstream net.sh obtains it from https://tests.stockfishchess.org/api/nn/nn-61e7af4bb97d.nnue. To build: extract the source archive, copy sf19-nn-61e7af4bb97d.nnue into its src/ directory as nn-61e7af4bb97d.nnue, install Node.js and Emscripten 6.0.9, then run node build.js --lite --single-threaded --no-split --strict-em-check. See the pinned README.md/build.js for compiler and build options. These are Corresponding Source/build inputs, not a claim of a verified reproducible build. GNU GPLv3 terms, full license and AUTHORS accompany this engine and its network. ChessExpert.io's readable GPL-3.0-or-later sf19-bootstrap-source.js is identical to /js/vendor/sf19/stockfish.worker.js. No compilation is needed: copy it beside the unchanged stockfish-19-lite-single.js and matching WASM. The wrapper installs closed error controls before importing the vendor and never fabricates readiness. Construct the wrapper as /js/vendor/sf19/stockfish.worker.js#stockfish-19-lite-single.wasm; the fragment uses the upstream WASM-location override, otherwise the vendor would derive stockfish.worker.wasm from the outer URL. The vendor files stay unchanged. The single-threaded engine requires no SharedArrayBuffer or COOP/COEP. Its UCI identity is Stockfish 19 Lite WASM; it is not the full-size SF19 NNUE engine.