izWorzi HEIC decoder: source, notices and independent rebuild ============================================================ This directory provides the source of the isolated HEIC decoder integration and the exact upstream sources needed to rebuild or replace its library. It exposes no account data, application credentials, backend code or unrelated app source. The supplied integration files are under INTEGRATION-LICENSE.txt (MIT). libheif-js uses LGPL-3.0; libheif and libde265 use LGPL-3.0-or-later. License texts, including the incorporated GPLv3 terms, are supplied alongside this file. Library sources are unmodified. Vite bundles the decoder for delivery; it does not add a codec. Independent worker rebuild -------------------------- Prerequisite: Node.js 20.19+ or 22.12+ and npm. Node 24 is also supported. Download these files into a new empty working directory: heicDecoder.js.txt heicDecoder.worker.js.txt heicDecodeCore.js.txt package.json.txt rebuild.mjs.txt INTEGRATION-LICENSE.txt Rename package.json.txt to package.json and rebuild.mjs.txt to rebuild.mjs. Leave the three decoder source filenames ending in .js.txt. Run: npm install --ignore-scripts --no-audit --no-fund npm run build The script copies the three .js.txt files to source/, then builds an independent dist/heicDecoder.worker.js with embedded WASM. Modify the .js.txt files before rebuilding; source/ is regenerated. This recipe uses libheif-js 1.23.5 and Vite 6.4.1. It produces an interface-compatible worker, not a byte-for-byte promise about the original application's hashed asset name or unrelated build settings. To replace the compiled library, rebuild libheif and the libheif-js package using the corresponding source below, install that local package in place of the npm dependency, then rerun this worker build. Both the library and these integration sources may be modified. Reverse engineering needed to debug modifications to the library is permitted. Worker interface and local replacement -------------------------------------- The client creates a same-origin module Worker. Send exactly one job: worker.postMessage({ buffer, profile }, [buffer]) buffer is an ArrayBuffer containing HEIC data. profile contains maxDimension, quality, maxSizeBytes and optional maxPixels. The worker replies with { blob } where blob is an image/jpeg Blob, or { error } containing a HEIC_ error code. The client terminates it on completion/error/45-second timeout. The supplied heicDecoder.js client queues jobs one at a time and preserves this interface. To use a rebuilt worker with a local copy of the application, replace its emitted assets/heicDecoder.worker-.js contents with dist/heicDecoder.worker.js, retaining the asset URL requested by the client. No signing key or integrity check prevents this substitution. Browser developer tools' local response overrides can also substitute the rebuilt worker during local debugging. For a new consumer, use new Worker('/path/heicDecoder.worker.js', {type:'module'}) and the same message interface. Serve via HTTP(S), not a file:// URL. The runtime needs same-origin workers, createImageBitmap, ImageData, OffscreenCanvas/JPEG encoding, and WebAssembly. A restrictive Content Security Policy must permit WebAssembly, for example script-src 'self' 'wasm-unsafe-eval'; worker-src 'self'. It needs neither JavaScript unsafe-eval nor blob: workers nor a third-party network download. Do not disable a site's security policy to test. Exact corresponding upstream source and build dependencies ---------------------------------------------------------- libheif-js 1.23.5 (Kiril Vatev; npm release gitHead): https://github.com/catdad-experiments/libheif-js/tree/d8ec4bc3bc5bf8055975577bccbbc7e1d7313c2d Source archive: https://github.com/catdad-experiments/libheif-js/archive/d8ec4bc3bc5bf8055975577bccbbc7e1d7313c2d.tar.gz The scripts/install.js and scripts/bundle.js files describe packaging. The package build obtains the v1.23.5 libheif-emscripten release, embeds libheif.wasm, and creates libheif-wasm/libheif-bundle.mjs. npm's prebuilt package is sufficient for the independent integration build above; it is not a replacement for the preferred library source linked here. Upstream WASM build and release recipe: https://github.com/catdad-experiments/libheif-emscripten/tree/v1.23.5 https://github.com/catdad-experiments/libheif-emscripten/blob/v1.23.5/.github/workflows/emscripten.yml https://github.com/catdad-experiments/libheif-emscripten/blob/v1.23.5/dist-prep.sh Clone this repository at v1.23.5 with its recursive libheif submodule to retain the exact source reference. The recipe uses Ubuntu 22.04, Emscripten 3.1.61, Node 24, TypeScript 5, and the libheif scripts/install-ci-linux.sh, scripts/prepare-ci.sh and scripts/run-ci.sh scripts. For its WASM build it sets USE_WASM=1, USE_UNSAFE_EVAL=0 and USE_TYPESCRIPT=1. The libheif build uses libde265 1.0.15; AOM and optional additional codecs are disabled by default. libheif 1.23.5 (Dirk Farin and other copyright holders): https://github.com/strukturag/libheif/tree/v1.23.5 https://github.com/strukturag/libheif/archive/refs/tags/v1.23.5.tar.gz https://github.com/strukturag/libheif/blob/v1.23.5/build-emscripten.sh libde265 1.0.15 (struktur AG, Dirk Farin and other copyright holders): https://github.com/strukturag/libde265/tree/v1.0.15 https://github.com/strukturag/libde265/releases/download/v1.0.15/libde265-1.0.15.tar.gz Emscripten 3.1.61 compiler/runtime and its license notices: https://github.com/emscripten-core/emscripten/tree/3.1.61 https://github.com/emscripten-core/emscripten/blob/3.1.61/LICENSE The bundled musl, libc++ and libc++ ABI license notices are also copied into this directory, from Emscripten 3.1.61 system/lib/libc/musl/COPYRIGHT, system/lib/libcxx/LICENSE.TXT and system/lib/libcxxabi/LICENSE.TXT respectively. Vite 6.4.1 integration bundler (build tool, MIT): https://github.com/vitejs/vite/tree/v6.4.1 No warranty is provided for the libraries or supplied integration sources.