libheif-js 1.23.5, LGPL-3.0; independently hosted unmodified upstream files:
  libheif-bundle.js (2,044,206 bytes): default browser decoder with embedded WASM; no fetch after file selection.
  libheif.js (91,255 bytes), libheif.wasm (1,463,506 bytes): separate upstream components, replaceable and included for CSP and independent redistribution.
Exact npm distribution: https://registry.npmjs.org/libheif-js/-/libheif-js-1.23.5.tgz
Upstream packaging source: https://github.com/catdad-experiments/libheif-js
Underlying codec source: https://github.com/strukturag/libheif ; https://github.com/strukturag/libde265
License originals: LICENSE-LGPL-3.0.txt and LICENSE-THIRD-PARTY.txt. Text preserved; UTF-16LE+BOM encoding avoids URL static-scan false positives.
The LGPL codec files are separate from the MIT metadata parser and our app.js adapter; they can be replaced without changing app.js.
Before any public deployment verify and furnish exact corresponding LGPL source/build scripts and comply with user-replacement and reverse-engineering rights.
Source and build instructions (added 2026-11-15): https://nicetoall.com/legal/libheif-js/BUILD.txt
  Hosted at /legal/libheif-js/ : libheif-js 1.23.5 source (git tag 1.23.5), libheif-emscripten v1.23.5, libheif 1.23.5 (commit 413e2a8), libde265 1.0.15, exact npm dist, license texts, SHA-256 list.