# Bundled codec sources and replacement

All runtime libraries are local files. They are loaded only when required. Input image data is never sent to their authors or a conversion service.

- ImageTracer.js 1.2.6, András Jankovics: Unlicense. Original source is `imagetracer.js`; license is `imagetracer.LICENSE`.
- UTIF.js 3.1.0 and UPNG.js 2.1.0, Photopea: MIT. Original source files are `utif.js` and `upng.js`; licenses are adjacent.
- pako 1.0.11, Vitaly Puzrin and Andrey Tupitsin: MIT/Zlib. Source: https://github.com/nodeca/pako/tree/1.0.11 . Distributed minified source is `pako.min.js`; original copyright/license retained in `pako.LICENSE`.
- gifenc 1.0.3, Matt DesLauriers: MIT. Source: https://github.com/mattdesl/gifenc/tree/1.0.3 . Distributed unminified bundle is `gifenc.js`, with `gifenc.LICENSE`.
- libheif-js 1.23.2, Kiril Vatev, and libheif/libde265 contributors: LGPL-3.0 (and upstream component notices). Browser bundle is `libheif.js`. `libheif.LICENSE` contains LGPLv3 and `GPL-3.0.txt` contains its incorporated GPLv3 terms. Corresponding source and build materials are provided under `sources/` on this same host:
  - `libheif-js-1.23.2.tar.gz`: wrapper/bundling source commit `6ca00b818c0ff51cb2a5c75b9ce97d708083335a`.
  - `libheif-emscripten-1.23.2.tar.gz`: exact v1.23.2 build repository, CI workflow and build instructions.
  - `libheif-source.tar.gz`: exact libheif submodule commit `ac1cb05c39008f01525c991ff8b88f84ddf70fd2`, including native source, JS bindings and `build-emscripten.sh`.
  - `libde265-1.0.15.tar.gz`: HEVC decoder source selected by that build script.

The upstream build uses Emscripten 3.1.61, `USE_WASM=1 USE_UNSAFE_EVAL=0 USE_TYPESCRIPT=1`, then the wrapper's `scripts/install.js`/esbuild bundling. The upstream source archives retain copyright notices and further build instructions. No modifications were made to the bundled HEIC library.

The application loads libheif through the `libheif()` factory in a separate worker. You may modify/rebuild and replace `vendor/libheif.js` with a compatible implementation without changing application code. The application does not restrict replacing or debugging the library. Retain source/license availability when redistributing the tool.

Background color removal, TGA/Netpbm/QOI codecs, BMP/TIFF/ICO writers and ZIP construction in `core.js`/`pixel-tools.js` are application code. QOI follows the public format specification at https://qoiformat.org/ .