HEIC source build kit, 2026-10-17

The original application module remains the accepted heic-to 1.6.6 artifact, not an
undocumented binary replacement. The rebuilt module implements the same exported API.

Fixed compiler image:
emscripten/emsdk@sha256:460fff8f8ac87e11b16447fbd66538a686eafa0e4fb977aa0989ed19fe2079f7
Emscripten 4.0.20, Linux amd64, local Docker daemon. No network, ports, privileged mode,
Docker socket mount, unrelated project mounts or host installs are used for compilation.

1. Copy libde265-1.0.16-source.tar.gz to libde265-1.0.16.tar.gz in this folder.
2. Create a separate empty output directory, OUTPUT.
3. Run the pinned image with this folder mounted read-only at /input and OUTPUT mounted
   writable at /output, --network none --cpus 4 --memory 6g, command bash /input/rebuild.sh.
4. OUTPUT/rebuilt/libheif-csp-1.23.6.js is an interface-compatible ES module.

Recipe changes: CMake replaces the original libde265 autotools step, exports are sorted,
all external codecs other than libde265 are disabled, and an ES default export is appended.
No libheif/libde265 algorithm source was edited. USE_WASM=0 and DYNAMIC_EXECUTION=0.
Historic original compiler identity is unknown; original artifact byte reproduction is
NOT claimed. Known-input RGBA equivalence and original/rebuilt browser workflows are
checked separately. Compiler/runtime permissive notices are in compiler-notices/.

For replacement: in a personal copy replace src/js/vendor/libheif-csp-1.23.6.js with the
new module, run node scripts/build.mjs then node server.mjs --port <free-local-port>.
Refresh browser cache. Keep heic.js / Worker protocol unchanged. There is no integrity
check that rejects modified compatible library modules. Reverse engineering to debug
LGPL library modifications is not restricted by the library/application notice.
Retain LGPL/GPL/COPYING notices and provide corresponding changed source/recipe when
redistributing a modified library. No patent clearance or public deployment is granted.