FLOW local HEIC decoder

This build includes unmodified libheif-js 1.23.2, an Emscripten distribution
of libheif 1.23.2, licensed under LGPL-3.0. Its HEVC decoder is libde265
1.0.15. Retain libheif-LICENSE.txt and libde265-LICENSE.txt with these files.

Package and source:
https://www.npmjs.com/package/libheif-js/v/1.23.2
https://github.com/catdad-experiments/libheif-js
https://github.com/strukturag/libheif
https://github.com/strukturag/libde265

The decoder is loaded in a separate same-origin Photo worker, not from a CDN.
It runs locally; installing this dependency does not activate Photo or upload
images. FLOW's application code is separately licensed.

Exact source and replacement files supplied with this release:
/third-party/heic-source-manifest.json
/third-party/source/libheif-js-1.23.2-source.tar.gz
/third-party/source/libheif-emscripten-1.23.2-source.tar.gz
/third-party/source/libheif-1.23.2-source.tar.gz
/third-party/source/libde265-1.0.15-source.tar.gz
/third-party/source/flow-heic-relink-kit.tar.gz

The manifest records each archive's SHA-256, exact upstream revisions, npm
integrity and compiled-module identity. The replacement kit contains the
FLOW worker and its three pure helper files, library licenses, a build helper
and a working replacement test. It needs no FLOW account or provider key.
Follow its README to build a worker with a compatible modified decoder and
serve it at the existing worker URL in a local copy of the distributed site.

Engineering verification on 2026-10-04 matched all 15 installed npm-package
files to the published package and matched its WASM bytes to the upstream
compiled release. A modified factory decoded both upstream example frames
with identical pixel hashes, then ran inside the rebuilt actual FLOW worker.
The worker retained its multi-image and malformed-input refusals and made no
network requests. No dependency or Photo upload/save behavior was changed.

The pinned upstream workflow uses Emscripten 3.1.61. A fresh native C/C++
compiler build was not run here. This is source, identity and replacement
engineering evidence; it is not a legal compliance certification.