# Known rebuild and replacement path

This is a documentation-only reconstruction of the upstream build chain. It was
not executed during this work.

## 1. Pin inputs

Use only the included source archives and verify `PUBLIC-SOURCE-MANIFEST.sha256` first:

- heic-to commit `78345a3fcdb4a1d70d513fce2646aeff0127f7ba`
- libheif commit `12a259a5882dd99d45ec5fc77e296a3b620d1e2e`
- libde265 commit `7ba65889d3d6d8a0d99b5360b028243ba843be3a`
- libde265 v1.0.16 release archive used by libheif's Emscripten script

The heic-to repository records Node.js 22.19.0 in `.tool-versions`.
Its package-lock is lockfile v3 and currently resolves esbuild 0.25.12, but the
lockfile root still says package version 1.3.0 while package.json says 1.6.7.
Preserve this discrepancy in evidence; do not silently rewrite the lockfile.

## 2. Recreate the generated libheif JavaScript

The official libheif v1.23.7 `build-emscripten.sh` accepts one source-directory
argument and downloads/builds libde265. The heic-to v1.6.7 README records this
CSP-oriented invocation:

```text
LIBDE265_VERSION=1.0.16 USE_UNSAFE_EVAL=0 USE_WASM=0 ../build-emscripten.sh ..
```

The README also records a local change to the `EXPORTED_FUNCTIONS` discovery
line, using Homebrew LLVM's `llvm-nm`. The exact patch file and exact LLVM /
Emscripten / CMake / make / pkg-config versions used for the published file are
not preserved upstream.

The expected generated source is placed at:

`src/lib/libheif-without-unsafe-eval.js`

The published copy in the npm package has SHA-256:

`75AAF03816C22F8CF40DBCAEB22BEE83F2E1C5DA4B7417577A7883B296348734`

Do not treat a different hash as an equivalent verified rebuild without
reviewing the toolchain and byte differences.

## 3. Build heic-to's CSP entry

Upstream `esbuild.mjs` copies the worker template, points it at
`libheif-without-unsafe-eval.js`, bundles the worker, embeds that worker string
into `src/index.js`, and emits:

`dist/csp/heic-to.js`

The exact currently distributed output must hash to:

`E0A515585872C319C601C33551925C9D5FEE31746CAF0311291ED7E6364C592C`

The package build command is `node esbuild.mjs`. Do not run it for release
until the missing toolchain pins and patch evidence below are supplied.

## 4. Replace safely in the application

The application imports one isolated file path:

`./vendor/heic-to-1.6.7-csp.js`

A future reviewed replacement can keep that path or update
`application-integration/candidate-entry.mjs`. Before replacing:

1. Verify source/archive/license hashes.
2. Record component versions, source commits, toolchain and patch hashes.
3. Run static CSP checks: no `eval`, no global `Function` construction, and
   retain the required `worker-src 'self' blob:` policy.
4. Run decoder-free adapter mocks first.
5. Only under separate authorization, run a bounded non-sensitive HEIC
   compatibility test.
6. Preserve the previous working bundle for rollback.
7. Update provenance, notices, release manifest and affected tests.

Do not overwrite the working binary merely because a rebuild completes; require
the expected output hash or a reviewed, documented version change.