# Optional HEIC decoder

The independently replaceable ES module is `/js/vendor/libheif-1.23.6-csp.js`.
It is copied byte-for-byte from `heic-to@1.6.6/src/lib/libheif-without-unsafe-eval.js`.
No local patch is applied to the compiled library. The LGPL/GPL notices are supplied next to this document.

## Source distributions

The adjacent `sources/` directory provides the heic-to npm distribution (including its JavaScript sources and build configuration), libheif v1.23.6 and libde265 v1.0.16. See SOURCES.json for upstream URLs and SHA-256 hashes.

## Upstream native build procedure

Use the included libheif `build-emscripten.sh` and `post.js`, with Emscripten, CMake, make, pkg-config and libtool available. From a separate `buildjs` directory run:

```
LIBDE265_VERSION=1.0.16 USE_UNSAFE_EVAL=0 USE_WASM=0 ../build-emscripten.sh ..
```

Follow the heic-to README supplied in the npm archive for the platform-specific llvm-nm path. The browser adapter expects an ES module with default export `buildLibheif`; preserve this module interface when packaging the generated factory. The original distributed JavaScript is included as an interface/reference implementation.

## Site integration / replacement

The unminified integration sources are in `integration/`: the disposable worker, metadata preflight, optional decoder adapter, photo preparation and raster metadata helper. They contain no backend credentials or customer data. Replace the standalone module at the path above with a compatible build; the adapter uses `HeifDecoder`, primary-image identification, image display/free, context free and the native pixel limit. The module is not inlined into the site's main bundle and no integrity restriction prevents local replacement for testing a modified library.

Test ordinary HEIC, tiled images, rotation, primary versus thumbnail, resource limits, cancellation and corrupt input. Keep the output JPEG interface and privacy safeguards when making a replacement. No site terms are intended to restrict reverse engineering necessary to debug modifications to these LGPL components.

## Reproducibility limits

The upstream npm package does not identify the exact Emscripten toolchain revision used for its prebuilt decoder. The supplied Emscripten notice is a pinned upstream license snapshot, not evidence of that compiler revision. The complete native-to-ESM regeneration has not been independently reproduced byte-for-byte here; these instructions are the upstream procedure plus the observed module interface, not a claim of a reproducible native build. Source availability and license notices do not by themselves certify every legal obligation or every device's compatibility.