# libheif 1.23.5: corresponding source and replacement

The four adjacent archives contain the pinned library sources, HEVC decoder and build scripts. Verify them against SHA256SUMS; SOURCE-ARCHIVES.json identifies upstream commits, licenses and build files. The supplied JavaScript/WASM files are unchanged upstream npm1.23.5 bytes.

## Rebuild

1. Extract each archive in a separate build directory. The libheif-emscripten archive omits its Git submodule: place the separately supplied native libheif413e2a87e6a70b3eccc3a3adc5801179dd2d9e00 tree at its libheif/ path. Put libde265-1.0.15.tar.gz in the working directory used by build-emscripten.sh.
2. Prepare the upstream toolchain: Emscripten3.1.61, Node24, TypeScript5 and the native build tools named by the included workflow. This application does not install them automatically.
3. In the native source directory, run the included build-emscripten.sh with ENABLE_LIBDE265=1 LIBDE265_VERSION=1.0.15 ENABLE_AOM=0 ENABLE_WEBCODECS=0 ENABLE_UNCOMPRESSED=0 ENABLE_OPENJPEG=0 USE_UNSAFE_EVAL=0 USE_TYPESCRIPT=1. Build USE_WASM=0 and USE_WASM=1 separately, saving each output before the next build. Follow dist-prep.sh to assemble libheif/ and libheif-wasm/ in a libheif.tar.gz archive.
4. In the supplied libheif-js wrapper source, restore its declared development tools and run node scripts/install.js /absolute/path/to/libheif.tar.gz. That source has no lockfile; the exact historical esbuild resolution has not been established, so a rebuild may differ byte-for-byte from npm.

## Replace

The application loads /assets/agj-heic-worker.js as an independent classic Worker. It imports /vendor/libheif/1.23.5/libheif.js, which loads the adjacent libheif.wasm through locateFile. Replace those two files together with a compatible implementation exposing HeifDecoder, primary-image selection and display. The unbundled Worker is available at that application path. No runtime integrity check prevents compatible replacements; modification and debugging rights for the open-source components follow their licenses. Preserve the license texts and document modifications and their dates. Update provenance and hashes when the files differ from the supplied upstream bytes.

The sources and build inputs have been collected; an independent byte-identical rebuild and a browser replacement test have not been performed.