# Third-party notices and source access

The browser app bundles the following unmodified runtime libraries. Bundling/minification changes their distribution form, not their functional source. The exact dependency graph is recorded in package-lock.json.

| Library | Version | License | Upstream |
| --- | --- | --- | --- |
| Mediabunny | 1.64.0 | MPL-2.0 | https://github.com/Vanilagy/mediabunny |
| heic-to | 1.6.7 | LGPL-3.0 | https://github.com/hoppergee/heic-to |
| UTIF.js / utif2 | 4.1.0 | MIT | https://github.com/photopea/UTIF.js |
| pako | 1.0.11 | MIT AND Zlib | https://github.com/nodeca/pako |

Full license texts are in public/licenses and are served by the deployed site. The npm-distributed source files (including heic-to's libheif JavaScript build and build script, Mediabunny TypeScript sources, UTIF and pako sources) are supplied in public/third-party/javascript-library-sources.zip. Recreate it with `node scripts/package.mjs --third-party` after installing the locked dependencies.

heic-to 1.6.7 identifies libheif 1.23.7 and documents building its decoder with libde265 1.0.16. The corresponding upstream source releases, including their own notices and build files, are also supplied:

- public/third-party/libheif-1.23.7-source.tar.gz — https://github.com/strukturag/libheif/tree/v1.23.7
- public/third-party/libde265-1.0.16-source.tar.gz — https://github.com/strukturag/libde265/tree/v1.0.16

Build and replacement: extract the Pensoul source archive, run `npm ci`, replace or modify the applicable dependency source/module, then `npm run build`. For heic-to itself, its source archive contains `esbuild.mjs`, `src/worker.js`, and the upstream README with the Emscripten/libheif build procedure. The optional HEIC decoder is emitted as its own dynamically imported module in dist/assets; a compatible replacement preserving its exports may be served at that same module URL. Retain the dependency license texts and source access when redistributing. Reverse engineering for debugging modifications to these library components is not prohibited by this project.

Build-only tools: Vite (MIT), Playwright (Apache-2.0), fflate 0.8.3 (MIT), and their dependencies are installed via the lockfile; they do not run in the deployed app. Type declaration packages from DefinitelyTyped are MIT and contribute no runtime code.

## Sample artwork

- Cat: Colleen O'Dell / StarGlade; uploaded by hund. https://openclipart.org/detail/330214/cute-cat-line-art — Openclipart CC0 / public domain policy. Resized and composited on white.
- Botanical drawing: uploaded by liftarn; source page cites PublicDomainPictures image 463844. https://openclipart.org/detail/338568/line-art-flower — Openclipart CC0 / public domain policy. Resized and composited on white.
- 道教符: Mkckim. https://commons.wikimedia.org/wiki/File:道教符.jpg — CC BY-SA 4.0, https://creativecommons.org/licenses/by-sa/4.0/. Resized and converted to JPEG; the modified image retains CC BY-SA 4.0. Derivative demonstration videos based on it should retain attribution and applicable share-alike licensing.

The external HEIC test fixture comes from libheif/examples/example.heic. It is used only for local decoding QA and is excluded from both distributable archives. Browser test exports and local project credentials are also excluded.
