# Selected source and library replacement materials

This package accompanies the local WebToolsForAll review copy. Third-party code retains its own supplied notices and licenses. No claim of a new blanket license or endorsement is made. The application's hosting, operator, contact and launch policies remain unconfirmed; this package does not authorize publication.

The runtime-source ZIP contains the selected NPM packages as originally distributed, their complete supplied license and notice files, the actual selected application and shared-engine sources, Rust sources for the two calculation engines, the original private-worker source and EFF array, and the frozen image codec wrappers/source/build instructions. It excludes credentials, account state, user input, production deployment state, unrelated site pages and build histories. The upstream codec C/C++ archives are provided separately at their recorded revisions. Download hashes, input hashes and archive member audit are recorded alongside the local source package.

For the HEIC fallback, the separate libheif-js 1.23.5 module contains libheif at commit 413e2a87e6a70b3eccc3a3adc5801179dd2d9e00 and libde265 1.0.15. Its wrapper source is pinned to d8ec4bc3bc5bf8055975577bccbbc7e1d7313c2d, with build wrapper tag v1.23.5. All four source archives, GPL/LGPL texts and the original installation/workflow/build scripts are included. The original build uses Emscripten 3.1.61. The copied workflow selects USE_WASM=1 and USE_UNSAFE_EVAL=0. Preserve the original single-threaded configuration and library security limits when reproducing the supplied compatible build. Other optional codecs are disabled in that build. The standard compiler/toolchain is a separate prerequisite; these materials were inspected, not rebuilt here, and bit-identical native recompilation is not certified.

To reconstruct the source layout, unpack each archive into a new working directory using a normal archive tool. Place the pinned libheif source as the libheif-emscripten wrapper's `libheif` subdirectory; GitHub archives omit git submodule contents, which is why its separately pinned archive is supplied. The libheif build script can use the supplied libde265 1.0.15 archive in place of its existing download step. Follow the included upstream workflow/build/install scripts with the stated toolchain. The wrapper installation supports a local rebuilt libheif archive argument. It produces the same module interface used by `image-tools/heic-service.mjs`.

For AVIF encoding, only the single-threaded encoder is selected: @jsquash/avif 2.1.1 at b7fa9ac9ec02f224847ad23d19d115f9e296a368, libavif 1.0.1, libaom 3.7.0 and libsharpyuv from libwebp e2c85878f6a33f29948b43d3492d9cdaf801aa54. The exact encoder C++ file, JS wrapper, Makefile/helper, notices and all three C/C++ source archives are included. The Makefile's single-thread target disables multithreading. No threaded module or extra server headers are required by this review copy. UTIF 3.1.0/Pako 1.0.11 and pdf-lib 1.17.1 retain their supplied source/distribution, provenance and notices, including the PDF package's bundled third-party notices.

The LGPL library remains a separate import at `assets/image-heic-lib.mjs`. A compatible replacement exports a default module factory/object providing `HeifDecoder`, its image methods and the existing free/context APIs used by the supplied service. This review copy adds no restriction on replacing/modifying that library or reverse engineering necessary to debug those modifications. Root HTML SRI protects the application entry modules; it does not lock the separately loaded library to a particular hash.

`REPLACE-HEIC.mjs` creates a separate mutable public copy and replaces only that leaf. It refuses an existing destination and never edits the supplied/frozen candidate. Run it with the existing public directory, a compatible replacement ESM file and a new output directory. The helper emits a replacement receipt and manifest outside the copied public folder, verifies that every other public file is byte-identical, and changes no CSP or root-entry SRI. Inspect and retest the resulting copy; the helper does not execute the module, install software, start a server or publish anything. An altered library can change compatibility/resource behavior, so test actual HEIC decoding, dimensions, limits and cleanup before distribution.

EFF Large Wordlist (2016): Electronic Frontier Foundation, https://www.eff.org/dice and the numbered source https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt. The retrieved source is byte-identical to the frozen hash addd35536511597a02fa0a9ff1e5284677b8883b83e986e43f15a3db996b903e. The application converts its numbered lines into an array while retaining all 7,776 words. The EFF copyright policy inspected for this package states CC BY 4.0 International for original materials unless otherwise noted: https://www.eff.org/copyright. Its full CC BY 4.0 text is included. Historical frozen metadata said CC BY 3.0 US without retaining independent grant evidence; that record is preserved as historical evidence, not silently changed or treated as proof of the earlier grant. No EFF endorsement is implied.

The HTML minifier's original parser comment credits John Resig, Juriy Zaytsev and Erik Arvidsson and mentions the Mozilla Public License without a version. The complete unmodified parser source, package MIT license, original comment and historical MPL 1.1 text are all supplied rather than erasing the embedded attribution. Prettier's full third-party notices and MDN data's CC0 text are also included. Review the original terms for the code you redistribute; this package records technical provenance and supplied materials rather than certifying legal compliance.