# HEIC and PDF distribution materials Checked 2026-09-14 against the installed packages. These files are prepared for copying into a public licenses/source directory; the website checkout was not modified. ## Components actually inspected - heic-to 1.5.2: npm metadata says LGPL-3.0; its LICENSE explicitly permits version 3 or any later version. Author: Hopper Gee. The npm archive includes src/, esbuild.mjs, package.json, README.md, license and shipped builds. Registry gitHead: f37af866f9aa6212ddc84b67a279c9f2386aba4f. - libheif 1.22.2: heic-to's README identifies this exact decoder version. Library under LGPLv3; examples/wrappers have their own notices. The original COPYING file contains both the complete LGPLv3 and complete GPLv3 texts. - libde265 1.0.16: heic-to's documented build command explicitly pins this version. Its source and original COPYING file are included. Library under LGPLv3. - jsPDF 4.2.1: MIT. The exact installed LICENSE is included. Its distributed ES module also has third-party license blocks; all 22 copyright/license comment blocks have been preserved in jspdf-4.2.1-bundled-notices.txt. - The jsPDF ES module directly imports @babel/runtime 7.29.7, its nested fflate 0.8.3, and fast-png 6.4.0. fast-png resolves iobuffer 5.4.0 and its nested pako 2.2.0. Their license notices are included. pako is MIT AND Zlib; its Zlib source notice is included separately. ## Concrete integration steps 1. Publish these original license/notice files and source archives with the deployment. Put a visible Open-source licenses link in the footer or About page. Identify heic-to/libheif/libde265 and the LGPL clearly; show where the LGPL and GPL copies and matching sources can be downloaded. 2. Preserve upstream copyright and license comments in distributed JavaScript. A retained, accessible notice file is also useful when a minifier extracts comments. The jsPDF MIT notice must accompany copies/substantial portions; MIT itself does not require publishing the application's source. 3. For the HEIC integration, implement one LGPLv3 section 4(d) route. The straightforward bundler route, 4(d)(0), is to provide the matching library sources AND corresponding application code in a form allowing the recipient to rebuild/relink with a modified library. Include the final release's application build source (or suitable recombinable application object code), dependency lockfile, build configuration, and practical instructions. Permit modification of the LGPL portions and reverse engineering needed to debug those modifications. Do not assume a normal webpack dynamic import by itself proves the alternative shared-library route in 4(d)(1). 4. The application does not automatically have to be licensed wholesale under LGPL. The provided corresponding application code does need terms permitting recombination/relinking with a changed LGPL library. Make the deployment's Terms consistent with those rights. 5. Rebuilding/relinking instructions should name the actual import in lib/images.ts, explain replacing heic-to with a compatible locally rebuilt package, then reinstalling and running the application's documented build. Use the final checked release, not a stale application source snapshot. 6. If you change heic-to, libheif or libde265, provide those changes and dated modification notices with the corresponding sources. Updating a dependency version means updating the matching sources and notices too. GPLv3 section 6(d) permits matching sources on a different server with clear directions next to the distributed object code and equivalent free access. The distributor remains responsible for availability. Locally serving the supplied archives avoids depending solely on changing repository branches. ## Rebuilding the library The heic-to npm source archive includes its upstream README and esbuild.mjs. Node.js 22.19.0 is recorded in its .tool-versions. Install its documented development dependencies and run npm run build to rebuild the JS wrappers from the supplied sources. For a changed native decoder, use the supplied libheif and libde265 sources and libheif-1.22.2-build-emscripten.sh. heic-to's upstream README documents a Mac llvm-nm path change and these commands: mkdir buildjs cd buildjs LIBDE265_VERSION=1.0.16 USE_WASM=0 ../build-emscripten.sh .. For the CSP variant it documents: LIBDE265_VERSION=1.0.16 USE_UNSAFE_EVAL=0 USE_WASM=0 ../build-emscripten.sh .. Copy the rebuilt decoder into the corresponding heic-to src/lib file and run the wrapper build. These are the upstream's documented reconstruction inputs/instructions; no byte-for-byte reproduction or unspecified Emscripten version was invented or verified in this inspection. The supplied libheif build script defaults ENABLE_LIBDE265=1; ENABLE_AOM=0, ENABLE_OPENJPEG=0, and ENABLE_WEBCODECS=0. Do not infer that every codec mentioned on libheif's general homepage is embedded in this heic-to build. If build options are changed, check the additional codecs' notices and matching source requirements. ## Official source locations heic-to repository: https://github.com/hoppergee/heic-to Matching heic-to npm package and registry metadata: https://registry.npmjs.org/heic-to/-/heic-to-1.5.2.tgz https://registry.npmjs.org/heic-to/1.5.2 Matching repository commit: https://github.com/hoppergee/heic-to/tree/f37af866f9aa6212ddc84b67a279c9f2386aba4f libheif original source, license and build script: https://github.com/strukturag/libheif/releases/download/v1.22.2/libheif-1.22.2.tar.gz https://raw.githubusercontent.com/strukturag/libheif/v1.22.2/COPYING https://raw.githubusercontent.com/strukturag/libheif/v1.22.2/build-emscripten.sh libde265 original source and license: https://github.com/strukturag/libde265/releases/download/v1.0.16/libde265-1.0.16.tar.gz https://raw.githubusercontent.com/strukturag/libde265/v1.0.16/COPYING jsPDF versioned original license: https://github.com/parallax/jsPDF/blob/v4.2.1/LICENSE This is a bounded inventory of the requested HEIC/PDF components, not a claim that every other site dependency or optional jsPDF feature has been audited.