# License notice — HEIC/HEIF decoder assets in `public/libheif/`

## Provenance

The files in this directory (`libheif.js`, `libheif.wasm`) are copied,
mostly unmodified, from the npm package `libheif-js@1.23.2`
(<https://www.npmjs.com/package/libheif-js>,
<https://github.com/catdad-experiments/libheif-js>) by
`scripts/build-libheif-assets.ts`, which reads the installed version from
`node_modules/libheif-js/package.json` so this notice can be checked
against it rather than drift silently on a dependency bump.

`libheif-js` is an Emscripten (WebAssembly) build of two upstream C/C++
libraries — not something it wrote itself:

- **libheif** — <https://github.com/strukturag/libheif> — the HEIF/HEIC
  container and codec-plugin framework. `libheif-js`'s own install script
  fetches a prebuilt tarball of it from
  `catdad-experiments/libheif-emscripten`'s GitHub releases, pinned to tag
  `v1.23.2`
  (<https://github.com/catdad-experiments/libheif-emscripten/releases/tag/v1.23.2>).
  That release's own notes state it was built from libheif commit
  `ac1cb05c39008f01525c991ff8b88f84ddf70fd2`, tagged
  `v1.23.2` (<https://github.com/strukturag/libheif/releases/tag/v1.23.2>) —
  i.e. `libheif-js@1.23.2` bundles libheif `v1.23.2` itself, not merely a
  same-numbered wrapper.
- **libde265** — <https://github.com/strukturag/libde265> — the HEVC video
  decoder libheif calls into to decode the actual image data inside a HEIC
  file. It is statically linked into `libheif.wasm` and, before this
  notice, was named nowhere in this codebase outside an internal,
  explicitly-unverified planning note. Confirmed present by inspecting the
  shipped binary directly:
  `strings public/libheif/libheif.wasm | grep -i de265` returns
  `libde265`, `libde265 HEVC decoder`, and the version string `1.0.15`,
  sitting immediately next to those identifying strings in the binary's
  string table — matching libde265's own tagged release
  `v1.0.15` (<https://github.com/strukturag/libde265/releases/tag/v1.0.15>).

## Licence

Both **libheif** and **libde265** are licensed **GNU Lesser General Public
License v3.0 (LGPL-3.0)**:

- `libheif-js`'s own `package.json` declares `"license": "LGPL-3.0"`.
- `node_modules/libheif-js/libheif-wasm/LICENSE` (copied verbatim into
  `LICENSE` beside this file) states libheif itself is LGPL-3.0, and its
  sample applications/language wrappers are MIT — none of that
  sample/wrapper code ships here, only the compiled library.
- libde265's own `COPYING` file, at the tag above, states the identical
  terms: libde265 itself is LGPL-3.0, its sample applications are MIT.

`LICENSE` in this same directory carries the LGPL-3.0 text that governs
both libheif and libde265 — libde265's own licence file states the same
version of the same licence, so no second copy is needed here.

## Modification made in this codebase

`libheif.js` is UMD (`module.exports = libheif`), which has no binding in
a module worker (`lib/wasm/image-tools.worker.ts` loads it via a dynamic
`import()`). `scripts/build-libheif-assets.ts` appends `export default
libheif;` to the end of the file, plus a one-line banner recording the
source version, so it can be imported as an ES module. `libheif.wasm`
itself is copied byte-for-byte, unmodified.

## When this loads

`libheif.js`/`libheif.wasm` (1.4 MB combined) are fetched only when a
dropped file needs the HEIF decode route — `lib/image/decodeRoute.ts`
picks that route by reading the file's ISOBMFF *major brand*, which for
essentially every real-world file means an actual HEIC/HEIF photo.
Converting any other format (PNG, JPEG, WebP, TIFF, AVIF, etc.) fetches
none of this. Caveat, for completeness: that routing keys on the major
brand alone, so a spec-legal AVIF file that declares the generic HEIF
major brand (`mif1`) instead of `avif` would also route here — an edge
case, not the common case, but real.