QuickKit HEIC decoder distribution notice
=========================================

This browser decoder is distributed as separately loadable JavaScript and
WebAssembly files. It contains code built from the following upstream releases.

libheif 1.23.3
- Project: https://github.com/strukturag/libheif
- Source archive: https://github.com/strukturag/libheif/releases/download/v1.23.3/libheif-1.23.3.tar.gz
- Source archive SHA-256: 11c1179e0e4bec33624b87f22ec42c1e993a40d946d44d26f9c431cf1456a863
- Upstream license notice: GNU Lesser General Public License version 3 or later
- Complete upstream notice and license texts: COPYING.libheif.txt

libde265 1.1.1
- Project: https://github.com/strukturag/libde265
- Source archive: https://github.com/strukturag/libde265/releases/download/v1.1.1/libde265-1.1.1.tar.gz
- Source archive SHA-256: fd48a927e94ed74fc7ce8829d222b9d8599fcbfe8b6448ba66705babc56ab219
- Upstream license notice: GNU Lesser General Public License version 3 or later
- Complete upstream notice and license texts: COPYING.libde265.txt

The two bundled COPYING files include the complete GNU Lesser General Public
License version 3 text and the GNU General Public License version 3 text that it
incorporates.

Emscripten 4.0.12 generated-code notices
-----------------------------------------

The separately loadable JavaScript and WebAssembly artifacts are generated by
the pinned Emscripten 4.0.12 toolchain image. The following official notices
are distributed with the decoder:

- Emscripten LICENSE
  - Official source: https://raw.githubusercontent.com/emscripten-core/emscripten/4.0.12/LICENSE
  - SHA-256: 620a78084fc7ca97c0b5dea9abf891f3ffcadfdbf305276f099c9c4e12fc1d86
  - Distributed copy: /vendor/heic-decoder/LICENSE.emscripten-4.0.12.txt
- bundled musl COPYRIGHT
  - Official source: https://raw.githubusercontent.com/emscripten-core/emscripten/4.0.12/system/lib/libc/musl/COPYRIGHT
  - SHA-256: f9bc4423732350eb0b3f7ed7e91d530298476f8fec0c6c427a1c04ade22655af
  - Distributed copy: /vendor/heic-decoder/COPYRIGHT.musl-emscripten-4.0.12.txt

QuickKit integration source license
-----------------------------------

QuickKit distributes only the following integration source files under
LGPL-3.0-or-later. Each repository file maps to a directly retrievable
same-origin plain-text source copy:

- vendor/heic-decoder/build.sh
  - /vendor/heic-decoder/source/build.sh.txt
- vendor/heic-decoder/decoder-wrapper.cc
  - /vendor/heic-decoder/source/decoder-wrapper.cc.txt
- public/vendor/heic-decoder/decoder.worker.js
  - /vendor/heic-decoder/source/decoder.worker.js.txt
- src/components/tools/image-converter/heic-decoder.ts
  - /vendor/heic-decoder/source/heic-decoder.ts.txt

The explicit file-scoped license mapping is distributed at
/vendor/heic-decoder/LICENSE.quickkit-integration.txt. The complete LGPLv3 and
incorporated GPLv3 texts are in COPYING.libheif.txt. This grant is limited to
the listed decoder integration files and does not license the QuickKit
application as a whole.

Build, relink, and replacement instructions
-------------------------------------------

Run `vendor/heic-decoder/build.sh` from a checkout with Docker and curl. The
script verifies both upstream archives, uses the pinned Emscripten container
image, builds static libraries, and emits:

- public/vendor/heic-decoder/quickkit-heic-decoder.js
- public/vendor/heic-decoder/quickkit-heic-decoder.wasm

The exact build recipe, integration wrapper, and concise instructions can be
retrieved directly from the deployed origin without repository access:

- /vendor/heic-decoder/source/build.sh.txt
- /vendor/heic-decoder/source/decoder.worker.js.txt
- /vendor/heic-decoder/source/decoder-wrapper.cc.txt
- /vendor/heic-decoder/source/heic-decoder.ts.txt
- /vendor/heic-decoder/source/README.txt

Published source copy SHA-256 values:
- build.sh.txt: 8f507d06a6ffd713132d2997dc3a7d4ad73ebce949eaf01866fa63c2fa9b8058
- decoder.worker.js.txt: d780d4a425df3f3ec9f0d984e1d20261cc412732460697e128ce735ecafbdde0
- decoder-wrapper.cc.txt: 4329f82afdd15c96607e24dee8cc0f29668dba4bfc4b524dec42b2047a1bd1b4
- heic-decoder.ts.txt: 8e25efbd7cdce590adc677fc6c462a41c340097b55f97efef9f41a746c4187bb
- README.txt: 2b127eda351990f38a1bae222606506cbdc425e17fb0b4b3a27eade43e6c7b3f
- LICENSE.quickkit-integration.txt: 1f5d3ae225e823b296433d5b2967301868cbc819b0860b50bffc30b9fbea3db7

These source downloads use `.txt` paths and are served with the site's global
`X-Content-Type-Options: nosniff` response header. They are source material,
not browser-executable runtime assets.

The WebAssembly file remains a separate runtime asset. A recipient can rebuild
or modify the linked libraries and replace the WASM with an interface-compatible
build that exports the functions listed in the build script. Rebuild the paired
JavaScript loader as well when changing Emscripten or its module interface.

Pinned build environment:
- emscripten/emsdk:4.0.12
- image digest: sha256:744fb6a68941970951bacf9d6632041a0398260492232691ef22bbf54b0585c6

Distributed artifact SHA-256 values:
- quickkit-heic-decoder.js: d873bc828834b306b9ca7a7897c113e969fec2c7aad913754516081e3105eed1
- quickkit-heic-decoder.wasm: f4c0b9ddbd7dca644cd153e50a03df18cd561dd6dea6aa0630610fb85674028f

This notice records sources, versions, license materials, and rebuild paths. It
does not provide a legal conclusion or replace review of the applicable terms.