# HEIF decoder: free software notices and corresponding source

libheif-js 1.23.5 is used unmodified under LGPL-3.0. libheif and libde265 are
LGPL-3.0-or-later. LGPL-3.0.txt and GPL-3.0.txt contain the licenses.

Sources distributed alongside the application:

- wrapper-source.tar.gz: libheif-js d8ec4bc3bc5bf8055975577bccbbc7e1d7313c2d
- build-source.tar.gz: libheif-emscripten v1.23.5, build workflow and packaging
- libheif-source.tar.gz: libheif 413e2a87e6a70b3eccc3a3adc5801179dd2d9e00
- libde265-source.tar.gz: libde265 1.0.15 release, including copyright notices
- libheif-js-1.23.5.tgz: exact npm artifact (unmodified decoder module)

Rebuild: unpack build-source, populate its libheif submodule directory from
libheif-source, use the Emscripten version/flags in .github/workflows/emscripten.yml,
and run libheif/build-emscripten.sh as specified there. That script downloads
libde265 1.0.15; the same source is included here. Run dist-prep.sh wasm; then
use wrapper-source/scripts/install.js and scripts/bundle.js to produce the ES
module. The wrapper README describes all variants. Application `npm ci` followed
by `npm run build` emits this ES module as an independent `_astro` asset; replace
the pinned module or its URL to use a modified compatible library. The application
uses the stable libheif API through src/core/heif.ts. Reverse engineering for
debugging modifications to this library is permitted.

Upstreams:
https://github.com/catdad-experiments/libheif-js
https://github.com/catdad-experiments/libheif-emscripten
https://github.com/strukturag/libheif
https://github.com/strukturag/libde265

## Replace the library in a distributed site (no private repository required)

1. Save the site's HTML, `_astro` directory and public assets in a local directory
   you control, or use a copy of the released static artifact from its operator.
2. Find `_astro/libheif-bundle.*.mjs` (the decoder is an independent ES module).
   Replace its contents at the **same URL** with your compatible modified ES module.
   Keep the default factory export and the libheif API used by the wrapper.
   No application sources or application rebuild are required for this method.
3. Serve your copy from localhost using `python3 -m http.server 8080`.
   Use a fresh browser profile, or unregister the old service worker and clear
   Cache Storage **on this local copy only**, before importing a HEIC photo.
   This prevents the old worker's cached decoder from masking your replacement.
4. For an operator release, rebuild the SW fingerprint after replacing the module
   and keep the old hashed URL available for existing tabs. Do not overwrite
   immutable assets on a production origin. Follow `ops/RELEASE.md` instead.

`tests/e2e/p81.spec.ts` demonstrates an interface-compatible modified distributed
module (adds a trace), without importing private application source, and verifies
HEIC conversion and independent metadata absence in the resulting download.
Full copyright notices are in each source archive; keep these archives, licenses,
and this notice together when updating any decoder version.