fix(image): decode real iPhone HEIC files instead of rejecting them at validation (#631)

validateImageBuffer() never listed heif in CLI_DECODED_FORMATS, so real iPhone HEIC uploads hit Sharp's own metadata probe (its bundled libheif only supports AV1/AVIF) and got rejected before reaching the working heif-convert/heif-dec decode path already wired up downstream. Adds heif to that set, same as raw/psd/tga/bmp/etc.

Also fixes the same gap on erase-object's mask input, which validates through the same function but had no matching decode step, so a HEIC mask reached an unguarded sharp() call and came back as a misclassified server error instead of a clean 422.

Fixes #622

apps/api/src/lib/file-validation.ts

@@ -175,6 +175,7 @@ const CLI_DECODED_FORMATS = new Set([
   "ppm",
   "pgm",
   "pbm",
+  "heif",
 ]);
 
 /**

apps/api/src/routes/tools/erase-object.ts

@@ -172,6 +172,17 @@ export function registerEraseObject(app: FastifyInstance) {
           imageBuffer = await decodeToSharpCompat(imageBuffer, imageValidation.format);
         }
         imageBuffer = await autoOrient(imageBuffer);
+
+        // The mask goes through the same CLI-decoded formats the main image
+        // does. Without this, a HEIC/RAW/etc. mask reaches the unguarded
+        // sharp() calls inside inpaint() and fails with a generic, misclassified
+        // error instead of the clear message the image gets right above.
+        if (maskValidation.format === "heif") {
+          maskBuffer = await decodeHeic(maskBuffer);
+        }
+        if (needsCliDecode(maskValidation.format)) {
+          maskBuffer = await decodeToSharpCompat(maskBuffer, maskValidation.format);
+        }
       } catch (err) {
         request.log.error({ err, toolId: "erase-object" }, "Input decoding failed");
         return reply.status(422).send({
@@ -188,6 +199,7 @@ export function registerEraseObject(app: FastifyInstance) {
       } else {
         await putObject(imageKey, imageBuffer);
       }
+      await putObject(maskKey, maskBuffer);
 
       // Enqueue with both image and mask as inputRefs; the worker handler
       // reads them via getObjectBuffer.