Giant Tiny HEIC — third-party notice and corresponding source

Decoder: libheif-js 1.23.5, maintained by Kiril Vatev / catdad-experiments.
The unmodified libheif-bundle.mjs incorporates WebAssembly built from:
- libheif 1.23.5, struktur AG / Dirk Farin and contributors, LGPL-3.0-or-later.
- libde265 1.0.15, struktur AG / Dirk Farin and contributors, LGPL-3.0-or-later.
The JS distribution is LGPL-3.0. License terms permit commercial use subject
 to their redistribution requirements. No HEVC encoder is included.
No warranty is given. Review the accompanying complete license texts.

LIBHEIF-LICENSE.txt contains the LGPL-3.0 and GPL-3.0 texts and MIT sample terms.
LIBDE265-LICENSE.txt contains the upstream LGPL/GPL texts.
LGPL-3.0.txt is the JS package license. These libraries are independent of the
application's own source. Their authors do not endorse this product.

Exact provenance (downloaded 2026-10-11):
Package: https://registry.npmjs.org/libheif-js/-/libheif-js-1.23.5.tgz
Package integrity (SHA-512 base64):
umXZPthnWZtF3iG/5mQG+AZ2V6i0UeYpo3z2CkggTEgL8dKmIIwJT6TDuAMuabXa1yTW8uJ1ZAgR+CxNTklYYw==
Wrapper source: https://github.com/catdad-experiments/libheif-js
commit d8ec4bc3bc5bf8055975577bccbbc7e1d7313c2d
Build source: https://github.com/catdad-experiments/libheif-emscripten
commit 5c8968a44e9c68ae677e24790d77d001ed7fe7cc (release v1.23.5)
libheif: https://github.com/strukturag/libheif
commit 413e2a87e6a70b3eccc3a3adc5801179dd2d9e00
libde265: https://github.com/strukturag/libde265/releases/tag/v1.0.15

Corresponding source is provided alongside this notice, at no additional cost:
libheif-source.tar.gz
libde265-1.0.15-source.tar.gz
libheif-js-source.tar.gz
libheif-emscripten-source.tar.gz
SHA256SUMS.txt records archive and original runtime identity.
The exact build workflow lives in libheif-emscripten-source.tar.gz at
.github/workflows/emscripten.yml. It pins Emscripten 3.1.61 and uses the included
libheif build-emscripten.sh with USE_WASM=1 and USE_UNSAFE_EVAL=0. libheif's
build script defaults to libde265 1.0.15, with other codecs disabled. The JS
wrapper source includes the final packaging script, scripts/install.js.
Rebuild the Emscripten artifacts using that workflow, then run the wrapper's
install script against your resulting libheif.tar.gz. Keep notices intact.

Replacing / relinking the decoder:
The library is loaded as a separate ES module by ../decode-worker.mjs. Replace
../vendor/libheif-bundle.mjs with an interface-compatible modified build that
exports the async module factory (default), HeifDecoder, and heif_context_free.
No application code is statically merged into this library. The application
ships in readable, unminified source: ../workbench.mjs, ../heic-engine.mjs,
../decode-worker.mjs, ../bundle.mjs and its two CSS files. Keep these files and
their relative paths; serve locally over HTTP. Import bundle and
mountWorkbench, load skin.css and workbench.css, and call
mountWorkbench(document.getElementById('app'), bundle).
An HTTP localhost server and an HTML page containing <div id="app"></div> are
sufficient. A hosted release may add a cache query to imports; remove it or
replace that local file. You may also use your browser's local response
Overrides to replace this separate module for debugging. There is no integrity
lock or signature preventing replacement.

Permission is granted to use, reproduce and modify the supplied application
source solely as needed to recombine it with a modified version of these LGPL
libraries, and to reverse engineer the combined work for debugging those
modifications. Nothing in the application's terms restricts those LGPL rights.
Keep third-party notices with redistributed copies and modified versions.