HEIC decoder used by Skarru
==========================

These notices accompany heic-to 1.5.2, imported through heic-to/csp.
The decoder is loaded separately on demand. No changes have been made to
heic-to, libheif or libde265. Browser-native image decoding is tried first.
The corresponding library sources and build scripts are available without
charge at the exact locations below. The license texts are in this directory.

heic-to 1.5.2
Author: Hopper Gee
License: LGPL-3.0-or-later (see HEIC-TO-LICENSE.txt).
Source commit: f37af866f9aa6212ddc84b67a279c9f2386aba4f
Source repository:
https://github.com/hoppergee/heic-to/tree/f37af866f9aa6212ddc84b67a279c9f2386aba4f
Source archive:
https://github.com/hoppergee/heic-to/archive/f37af866f9aa6212ddc84b67a279c9f2386aba4f.tar.gz
Exact npm distribution (includes source, decoder builds and esbuild.mjs):
https://registry.npmjs.org/heic-to/-/heic-to-1.5.2.tgz
Unmodified dist/csp/heic-to.js SHA-256:
c189220a7a1e87559758a48ab4700e55629fb23a4cb57489e1e8970be1b9d018
Build instructions:
https://github.com/hoppergee/heic-to/blob/f37af866f9aa6212ddc84b67a279c9f2386aba4f/README.md
Build script:
https://github.com/hoppergee/heic-to/blob/f37af866f9aa6212ddc84b67a279c9f2386aba4f/esbuild.mjs

libheif 1.22.2
Authors: Struktur AG and contributors
License: LGPL-3.0-or-later; sample applications have separate MIT terms.
Source commit: 763bc8bb87788d64d39ece623ceed988de12dc5b
Source repository:
https://github.com/strukturag/libheif/tree/763bc8bb87788d64d39ece623ceed988de12dc5b
Source archive:
https://github.com/strukturag/libheif/archive/763bc8bb87788d64d39ece623ceed988de12dc5b.tar.gz
Browser build script:
https://github.com/strukturag/libheif/blob/763bc8bb87788d64d39ece623ceed988de12dc5b/build-emscripten.sh
See LIBHEIF-COPYING.txt for the original notice and full license terms.

libde265 1.0.16
Authors: Struktur AG and contributors
License: LGPL-3.0-or-later; sample applications have separate MIT terms.
Source commit: 7ba65889d3d6d8a0d99b5360b028243ba843be3a
Source repository:
https://github.com/strukturag/libde265/tree/7ba65889d3d6d8a0d99b5360b028243ba843be3a
Source archive:
https://github.com/strukturag/libde265/archive/7ba65889d3d6d8a0d99b5360b028243ba843be3a.tar.gz
See LIBDE265-COPYING.txt for the original notice and full license terms.

Rebuilding or replacing the decoder
----------------------------------

The heic-to source archive above contains src/index.js, src/worker.js,
src/lib/libheif-without-unsafe-eval.js and esbuild.mjs. Its README documents
building libheif with Emscripten. The selected decoder build identifies:

  libheif 1.22.2
  LIBDE265_VERSION=1.0.16
  USE_UNSAFE_EVAL=0
  USE_WASM=0

The build script combines the worker with the CSP decoder and exports
heicTo and isHeic from dist/csp/heic-to.js. Running the source package's
documented npm build script produces those modules. A compatible decoder can
replace this module without changing the surrounding image preparation API:

  heicTo({ blob: File, type: 'bitmap' }) -> Promise<ImageBitmap>

The application then resizes/re-encodes the returned bitmap using browser
canvas APIs. It does not require modified library internals or original image
metadata. Rights concerning library modification and debugging are described
in the included LGPL license, including section 4.

Browser behavior
----------------

The /csp build avoids unsafe JavaScript evaluation. It creates a Blob-backed
Web Worker, so a site's Content Security Policy must permit that worker.
This build is JavaScript, not an additional separately fetched WASM binary.
The library has no public cancellation or worker-termination API; cancelling
an upload prevents the application from accepting a late conversion result.