HEIC image support — third-party notices and replacement instructions

This application uses a separately loaded, replaceable libheif decoder.
The ASP.NET application and business logic do not become LGPL-licensed by
using this independent library. The obligations below apply to the library
and modifications to it. They are not a claim that LGPL has no obligations.

Runtime components:
- libheif 1.22.2, LGPL-3.0-or-later. See libheif-COPYING.txt.
  Struktur AG and contributors (individual copyright notices
  retained in the complete source archive).
- libde265 1.0.16, LGPL-3.0-or-later. See libde265-COPYING.txt.
  Struktur AG and contributors; see exact per-file copyright notices in source.
- Emscripten runtime, MIT / University of Illinois NCSA, and musl libc
  under its permissive notices. See EMSCRIPTEN-LICENSE.txt and MUSL-COPYRIGHT.txt.
- The prebuilt decoder is the unchanged src/lib/libheif-without-unsafe-eval.js
  from heic-to 1.5.2 by hoppergee, LGPL-3.0-or-later (LGPL-3.0.txt).
  We do not load heic-to's blob-worker wrapper. Our adapter is readable MIT
  code (convert-worker.js); the application-side caller is /js/photo-format.js.

No x265, FFmpeg, AOM or other GPL/AGPL codec is loaded by this decoder.
Its codec-descriptor API reports libde265 for HEVC decoding and a libheif
mask encoder only; HEVC encoding is disabled. This statement applies only
to the exact supplied libheif.js, not to arbitrary builds of these projects.

Corresponding library sources, notices and build scripts are supplied here
alongside the executable module, not only as links to external services:
  heic-to-1.5.2.tar.gz
  libheif-1.22.2.tar.gz
  libde265-1.0.16.tar.gz
  build-emscripten.sh
  sources.json (official download locations and SHA-256 hashes)
The two COPYING.txt files contain the complete GPLv3 and LGPLv3 texts.
Including GPL text required by LGPL does not license the application as GPL.

You may replace libheif.js with a modified, API-compatible build. We do not
prohibit reverse engineering required to debug changes to this LGPL library.
The front-end caller and adapter are supplied as readable JavaScript and are
not inseparably linked with proprietary server code. No signature or integrity
lock prevents replacement. Redistribution must retain the notices and provide
the corresponding library sources, including any changes you make to them.

Rebuild/replacement:
1. Extract the source archives to a development folder. Install an Emscripten
   SDK, CMake, make, autoconf/automake and libtool (build tools only).
2. In a separate build folder, make the bundled libde265 source archive
   available under libde265-1.0.16.tar.gz. Run the bundled libheif script with
   LIBDE265_VERSION=1.0.16 ENABLE_LIBDE265=1 ENABLE_AOM=0 ENABLE_OPENJPEG=0
   ENABLE_WEBCODECS=0 ENABLE_UNCOMPRESSED=0 USE_UNSAFE_EVAL=0 USE_WASM=0
   USE_ES6=1 USE_TYPESCRIPT=0, passing the libheif source directory.
3. Replace this directory's libheif.js with the generated ES module. Retain
   the HeifDecoder / HeifImage API used by convert-worker.js. Supply changes
   to library sources and scripts along with the replacement.
4. Test conversion, primary-image selection, orientation, size limits and CSP.
   Do not enable GPL/AGPL codecs when rebuilding for this deployment policy.
The upstream prebuilt file identifies library/codec versions and CSP options
but does not pin the Emscripten compiler version. These are replacement-build
instructions, not a promise of byte-for-byte reproducible output.

The browser converts only the primary image to JPEG locally, at most 40 million
source pixels, with a 30-second timeout and a 1600-pixel output long edge.
No image is sent to an external conversion service. The server independently
validates and re-encodes the JPEG. Unsupported HEIF codecs are rejected.

MIT notice for convert-worker.js:
Copyright (c) 2026 CFW Management contributors.
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
of the Software, and to permit persons to whom the Software is furnished to
do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
THE SOFTWARE.