YTSave HEIC decoder corresponding source bundle
================================================

The browser module heic-to-1.5.2-libheif-csp.mjs is the unmodified
src/lib/libheif-without-unsafe-eval.js file from heic-to 1.5.2. Its first-line
build marker identifies libheif 1.22.2, libde265 1.0.16, USE_WASM=0 and
USE_UNSAFE_EVAL=0.

The downloadable ZIP contains:

* heic-to-1.5.2-upstream.tar.gz — complete upstream tag source, including the
  JavaScript wrapper, generated module, package lock files and build script.
* libheif-1.22.2.tar.gz — complete libheif source and Emscripten build tree.
* libde265-1.0.16.tar.gz — complete libde265 decoder source.
* local-heic-worker.mjs — YTSave's replaceable application-side worker.
* LGPL-3.0.txt and GPL-3.0.txt — applicable license texts.
* SHA256SUMS.txt — checksums for every supplied source component.

Official upstream sources
-------------------------

https://github.com/hoppergee/heic-to/tree/v1.5.2
https://github.com/strukturag/libheif/tree/v1.22.2
https://github.com/strukturag/libde265/tree/v1.0.16

Rebuild and relink
------------------

1. Extract all three source archives.
2. Follow heic-to-1.5.2/README.md, section "How to build libheif.js". The
   matching command is:

     LIBDE265_VERSION=1.0.16 USE_UNSAFE_EVAL=0 USE_WASM=0 \
       ../build-emscripten.sh ..

3. Replace src/lib/libheif-without-unsafe-eval.js in the heic-to source with
   the rebuilt output and run `npm ci && npm run build`.
4. Copy the replacement module to the public static path named
   heic-to-1.5.2-libheif-csp.mjs, or change both ENGINE_ASSET constants in
   local-heic-worker.mjs and local-file-tools.js to a new same-origin module.
   The worker imports the decoder as a separate ES module, so it can be
   replaced and relinked without modifying the rest of the application.

No source file selected by a visitor is uploaded to YTSave. Decoding runs in a
disposable browser worker and the main page encodes the returned pixels.
