# Third-party licence notices

Arkero ships third-party open-source code to end users in two places: the web
app's browser bundle, and the packaged desktop app. This file is the notice for
components whose licence requires one.

Permissively licensed dependencies (MIT, Apache-2.0, BSD, ISC) are not listed
here. Their licence text ships inside each package in `node_modules` and is
reproduced by the standard tooling.

---

## heic-to and libheif-js — LGPL-3.0-or-later

**Where it ships**

- Web: a lazily loaded JavaScript chunk, fetched only when a user attaches a
  HEIC/HEIF image to chat.
- Desktop: the same chunk, inside the packaged Electron renderer bundle.

Arkero loads the package's `heic-to/csp` entry point — the build made with
`USE_UNSAFE_EVAL=0`, which runs under a Content-Security-Policy that forbids
`eval`. It is the same library, built differently by its own author.

**What it does**

Decodes HEIC/HEIF images (the default format of iPhone photos) so Arkero can
convert them to JPEG in the browser. Arkero's chat model reads JPEG, PNG, GIF
and WebP only.

**Components**

| Component                                            | Version | Licence            |
| ---------------------------------------------------- | ------- | ------------------ |
| [heic-to](https://github.com/hoppergee/heic-to)      | 1.5.2   | LGPL-3.0           |
| [libheif-js](https://github.com/catdad-experiments/libheif-js) (bundled inside `heic-to`) | as bundled by `heic-to@1.5.2` | LGPL-3.0-or-later |
| [libheif](https://github.com/strukturag/libheif) (compiled into `libheif-js`) | as bundled | LGPL-3.0-or-later |

**Licence text**

- LGPL-3.0: https://www.gnu.org/licenses/lgpl-3.0.txt
- GPL-3.0 (which LGPL-3.0 incorporates by reference):
  https://www.gnu.org/licenses/gpl-3.0.txt

A verbatim copy of each package's `LICENSE` file ships inside that package
directory in `node_modules`.

**Source code**

Arkero does **not** modify these libraries. The exact versions we ship are the
published npm artifacts, and their complete corresponding source is available
from the repositories linked above and from the npm registry:

```
npm pack heic-to@1.5.2
```

**Replacing the library**

The decoder ships as its own JavaScript chunk, separate from Arkero's own code,
and is loaded at runtime. A recipient may replace it with a modified version of
`heic-to`/`libheif-js` that exports the same `heicTo({ blob, type: 'bitmap' })`
interface from `heic-to/csp`: in the web app, serve the replacement chunk from
the same URL; in the desktop app, unpack the application archive (`app.asar`)
and substitute the
chunk before repacking. Arkero applies no integrity pinning that would prevent
this.

Questions about this notice: support@arkero.ai