HEIC decoder: source, rebuilding and replacement
Piksel w formie - 13 October 2026

Components and license texts
---------------------------
heic2any 0.0.4: LICENSE-heic2any-MIT.txt (Alex Corvi, MIT).
gifshot included by heic2any: NOTICE-Yahoo-gifshot-MIT.txt (Yahoo 2017, MIT).
libheif 1.10.0: NOTICE-libheif-1.10.0.txt and COPYING-libheif-1.10.0.txt.
libde265 1.0.2: NOTICE-libde265-1.0.2.txt and COPYING-libde265-1.0.2.txt.
The native libraries are covered by LGPL version 3 or later; their COPYING
files include LGPL3 and GPL3. Keep those notices and texts with redistributed
copies. The package imposes no restriction on modification of the LGPL
components or reverse engineering needed to debug those modifications.

What is supplied
----------------
The three source ZIPs are original archives from the public upstream repos:
heic2any commit 3428539e643e112323a5b8a2c77c6402cb1372f6;
libheif tag v1.10.0; libde265 tag v1.0.2.
UPSTREAM-SOURCE.txt records their URLs, sizes, SHA256 values and the exact
installed/upstream wrapper comparison. The wrapper archive contains its
TypeScript, build scripts, package lock, GIF component and compiled native
libheif.js. Native C/C++ sources and build scripts are in the native archives.
heic2any.js is the exact, unmodified upstream dist/heic2any.js; it is provided
separately for replacement and inspection. The application continues to use
its existing, separately imported decoder module.

Replacement interface (does not require private application source)
------------------------------------------------------------------
The application dynamically imports a separate heic2any-*.mjs file. This file
must have a default function export. The function receives an options object;
the application's call is:

    convert({blob: file, toType: 'image/png'})

It returns a Promise resolving to a browser Blob, or to an array of Blobs.
The application selects the first Blob and decodes that PNG in the browser.
Errors reject the Promise. Calls may overlap, and the application guards late
results. Keep the converter's behavior and supported formats explicit.

To replace the decoder in a local copy of the site's static files:
1. Keep the complete static package, including application object code.
2. Put your rebuilt, compatible browser UMD converter at
   licensed-source/heic2any.js. It must expose globalThis.heic2any.
3. Keep licensed-source/relink-adapter.mjs next to it. That adapter imports
   the UMD converter and exports its function as the ESM default export.
4. Locate the heic2any-*.mjs file referenced by app.mjs. Replace only that
   module's contents with this forwarding export (keep its filename):

    export {default} from './licensed-source/relink-adapter.mjs';

5. Serve the files over local HTTP, reload the browser and verify conversion
   on your own non-sensitive HEIC test files. The main interface is unchanged.
   Retain notices/licenses and make the corresponding changed sources and
   build instructions available with a redistributed modified package.

Source build directions
-----------------------
Wrapper only: extract the heic2any archive into a separate working directory.
Its package.json and lock record the upstream build dependencies. Run npm ci,
make your source changes, and run npm run build. Upstream build/build.ts reads
src/libheif.js and src/gifshot.js, compiles the TypeScript, embeds the decoder
in a worker and writes dist/heic2any.js. Copy that result as described above.
These are upstream commands, not a claim of a tested rebuild here.

Native decoder changes: extract libheif-1.10.0-source.zip and the libde265
archive. libheif/build-emscripten.sh is the versioned upstream build recipe.
It pins libde265 1.0.2, runs emconfigure/emmake, and invokes emcc with --bind,
-lde265, pre.js and post.js to produce libheif.js. Supply libde265-1.0.2 in the
libheif build directory. To use the supplied source without downloading the
script's original release archive, create the tarball it expects there:

    tar -czf libde265-1.0.2.tar.gz libde265-1.0.2

Activate a compatible Emscripten environment, run ./autogen.sh in libheif if
configure is absent, then run ./build-emscripten.sh. Place the resulting
libheif.js in the wrapper's src/libheif.js, run the wrapper build, and follow
the replacement steps. Review the original scripts and preserve your exact
toolchain version, source changes and build commands for the changed build.

Original compiler scope
-----------------------
The original Emscripten SDK/compiler version is not recorded in heic2any's
source. The native script uses legacy asm.js settings; compatibility with a
current SDK must not be assumed. We have not rebuilt the native decoder or
verified bit-identical native output. The archives, exact wrapper file and
separate replacement interface are supplied; this record is not a blanket
legal certification or a promise that every current compiler runs the old
native build unchanged.