Studioless local HEIC decoder — source, notices and replacement

Decoder: libheif 1.23.5, libde265 1.0.16; supplied by heic-to 1.6.5.
The separate libheif-1.23.5.mjs is an unchanged byte copy of heic-to's
src/lib/libheif-without-unsafe-eval.js. Only the filename is different.
Its package integrity and the actual decoder version were checked locally.
No claim of universal format support, security certification or byte-identical
reproducible builds is made. Studioless does not use heic-to's high-level
first-image or persistent worker wrapper.

Copyright and rights
See heic-to-LICENSE.txt, libheif-COPYING.txt, libde265-COPYING.txt,
LGPL-3.0.txt, GPL-3.0.txt and Emscripten-LICENSE.txt. The Emscripten runtime
notice is copied from the official upstream LICENSE; it does not identify
the original compiler version. Copyright holders and upstream notices remain
in these texts and source archives. These library components are supplied
under their respective free-software licenses, without warranty. No
Studioless term removes rights granted by those licenses, including the
right to modify the library or reverse engineer for debugging modifications.

Download corresponding source and package
sources/libheif-v1.23.5-source.tar.gz
sources/libde265-v1.0.16-source.tar.gz
sources/heic-to-1.6.5.tgz
The last archive includes the exact supplied JS module, wrapper source,
README development instructions and esbuild.mjs. Upstream source:
https://github.com/strukturag/libheif/tree/v1.23.5
https://github.com/strukturag/libde265/tree/v1.0.16
https://github.com/hoppergee/heic-to

Build and replace
Extract the libheif source and read its build-emscripten.sh plus the
heic-to package README's Mac build section. Use an official Emscripten
SDK and the documented libheif/libde265 build dependencies. For this
variant the upstream build flags are USE_WASM=0, USE_UNSAFE_EVAL=0,
LIBDE265_VERSION=1.0.16. The heic-to README describes its EXPORTED_FUNCTIONS
adjustment for llvm-nm. Keep the raw module's default buildLibheif export.
The exact original compiler build and byte-identical reproduction have
not been established; a replacement must pass the decoder interface and
format checks before use.

The raw decoder loads as a separate ES module in an owned job Worker.
The bridge and its file preflight are supplied as readable JS under
/workers/heic-conversion.js and /workers/heic-preflight.mjs. They exchange
validated RGBA pixels with the page using postMessage. A modified compatible
library can replace libheif-1.23.5.mjs in a local checkout, or through a
browser's local file overrides; serve the files from one local origin.
This does not authorize uploading photos to a different service.

Checksums and exact sources: manifest.json.