# Vendored GIF encoder provenance

- **Package:** `gif.js` 0.2.0 (npm) — a JavaScript GIF encoding library by
  Johan Nordberg that renders in a same-origin web worker, using the
  NeuQuant neural-net color quantizer (Anthony Dekker, 1994; JavaScript
  port by Johan Nordberg) and an LZW encoder (Kevin Weiner's Java
  original, ported via Thibault Imbert's AS3 version).
- **Upstream (pinned):** the 0.2.0 publish is tag `v0.2.0`, commit
  `55bdbfea897753787fd2f4efc62f144371351522` of
  https://github.com/jnordberg/gif.js —
  https://github.com/jnordberg/gif.js/tree/55bdbfea897753787fd2f4efc62f144371351522
  — and is immutably archived at
  https://registry.npmjs.org/gif.js/-/gif.js-0.2.0.tgz ·
  https://www.npmjs.com/package/gif.js/v/0.2.0
- **License:** MIT, "Copyright (c) 2013 Johan Nordberg" (the License
  section of the 0.2.0 README; the `LICENSE` file upstream added after
  0.2.0 carries the identical MIT text as "2013-2018" and is reproduced
  verbatim in this directory). The NeuQuant quantizer inside the worker
  bundle carries its own permissive notice (Anthony Dekker, 1994) whose
  single condition is "that this copyright notice remain intact" — see
  the notice statement below. The Kevin Weiner GIF/LZW encoder lineage
  ships with an explicit no-copyright-asserted disclaimer upstream
  (verified in the 2026-08-08 legal review; this library — not gifenc,
  whose quantizer is GPL-derived under a false MIT label — is the one
  the review cleared).

## `gif.js` (main-thread orchestrator)

- **File:** `gif.js` — the upstream dist file, byte-identical, unmodified.
- **SHA-256:** `a8b111071bb3b123c302e6182c01d6b3550f93a4b627398b07c46875d84090bb`
  — asserted by `tests/structure-d3.js` so an unexpected substitution of
  the vendored encoder fails the build.
- Contains no quantizer and no Dekker code — it is the worker-pool
  orchestrator (EventEmitter, frame plumbing, `new Worker(workerScript)`
  with a same-origin URL; it never constructs a `blob:` worker, which the
  site's `worker-src 'self'` CSP would refuse).

## `gif.worker.js` (the encoder, runs in the worker)

- **File:** `gif.worker.js` — the upstream dist file with the NeuQuant
  license header **restored**: upstream's minifier strips comments from
  its dist build, and the NeuQuant notice's one condition is that it
  remain intact, so the header block from the bundle's own source
  (`src/TypedNeuQuant.js`, reproduced verbatim) is prepended ahead of
  the bundle. From the first byte of upstream's own preamble line
  (`// gif.worker.js 0.2.0 - https://github.com/jnordberg/gif.js`) to
  the end of the file, the content is the upstream dist file,
  **byte-identical** — no code byte was changed.
- **SHA-256:** `007a24c19e481230ba26e0dd2adbe13b77c174faaa21bfad555fe2a154e3b8b4`
  (the served file, notice included) — asserted by
  `tests/structure-d3.js`, alongside an assertion that the notice text
  is present and one that the post-preamble bytes still hash to the
  upstream dist below.
- **Upstream dist SHA-256:** `ca9e3048557ec05d619e18b83403cd3669c88939e5fa2d6034ce7625d445970d`
  (`dist/gif.worker.js` exactly as published in the 0.2.0 tarball).

## Notes

- **NeuQuant notice:** intact in the served worker file (the condition is
  notice survival in the shipped artifact, not public credit), and
  `tests/structure-d3.js` asserts the "this copyright notice remain
  intact" wording is present so a future re-vendoring from the bare dist
  cannot silently drop it again.
- **Decode is not here:** this directory encodes GIFs only. Video
  decoding on this site is done by the browser's own `<video>` element
  and canvas; no video codec implementation is vendored here.
- **Why it exists:** browsers can decode video natively but cannot encode
  animated GIF; gif.js is the quantizer-provenance-verified permissive
  choice. One of three vendored third-party components on the site
  (`../libheif/`, the HEIC decoder; `../lamejs/`, the MP3 encoder).
- **Loading:** lazy only (idle prefetch + on-demand injection by
  `../../gif.js`, the site's first-party engine). Never referenced by a
  `<script>` tag in any page's HTML — enforced by
  `tests/structure-d3.js`. Deliberately NOT in the service worker's
  precache SHELL; the runtime cache captures both files on first fetch,
  which the idle prefetch (script injection + worker-pool spawn) makes
  the first page view in practice, so the offline story matches the HEIC
  decoder's and the MP3 encoder's.
- **To update:** bump the `gif.js` devDependency, re-copy `dist/gif.js`
  unmodified, rebuild `gif.worker.js` as the verbatim NeuQuant header
  block plus the new unmodified `dist/gif.worker.js`, verify the notice
  survived, update the version AND all three SHA-256s above
  (`sha256sum`), plus the pinned tag/commit/tarball links, **bump
  `CACHE_VERSION` in `../../sw.js`** so returning users' service workers
  purge the old encoder (cache-first would otherwise serve the stale
  copy forever), and re-run the conversion smoke checks in a real
  browser before pushing.