From 24dc3293b21336fb683aa78c1ca62da8044826ac Mon Sep 17 00:00:00 2001
From: vishwajeet-13 <vishwajeetthakur403@gmail.com>
Date: Mon, 7 Sep 2026 23:41:14 +0530
Subject: [PATCH 1/2] feat: download RAW/HEIC images as JPEG or PNG
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The download control on a RAW (.arw, .cr2, …) or HEIC/HEIF asset now offers
Original / JPEG / PNG. JPEG/PNG are re-encoded server-side from the camera's
embedded preview (RAW) or a libheif decode (HEIC), at full resolution, and
streamed back with Content-Disposition: attachment. Other files download
unchanged.

- vms/image_export.py: format detection, render + encode, download handler
- vms.api.download_converted_asset / vms.review_api.download_guest_converted_asset
- useDownload().downloadConverted + isConvertibleStill mirror on the client
- ReviewHeader and the asset action menu gain the format submenu
- pillow-heif dependency for HEIC decode

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N6kPRDGo6QbcVcc8DPkMTf
---
 .../src/components/assets/useAssetActions.ts  |  43 +++++-
 .../src/components/review/ReviewHeader.vue    |  55 +++++++-
 frontend/src/composables/useDownload.ts       |  31 ++++-
 frontend/src/lib/fileType.ts                  |  12 ++
 pyproject.toml                                |   1 +
 vms/api.py                                    |  14 ++
 vms/image_export.py                           | 131 ++++++++++++++++++
 vms/review_api.py                             |  14 ++
 vms/tests/test_image_export.py                | 101 ++++++++++++++
 9 files changed, 387 insertions(+), 15 deletions(-)
 create mode 100644 vms/image_export.py
 create mode 100644 vms/tests/test_image_export.py

diff --git a/frontend/src/components/assets/useAssetActions.ts b/frontend/src/components/assets/useAssetActions.ts
index 2e22588..4a9778a 100644
--- a/frontend/src/components/assets/useAssetActions.ts
+++ b/frontend/src/components/assets/useAssetActions.ts
@@ -3,6 +3,7 @@ import { useRouter } from 'vue-router'
 import { dialog, toast, useCall, type DropdownOption } from 'frappe-ui'
 import type { Asset } from '@/types'
 import { serverMessage } from '@/lib/format'
+import { isConvertibleStill } from '@/lib/fileType'
 import { useDownload } from '@/composables/useDownload'
 import { useVersionUpload } from '@/composables/useVersionUpload'
 
@@ -50,7 +51,7 @@ interface AssetParams {
  */
 export function useAssetActions(asset: Ref<Asset>, ctx: AssetActionsContext): DropdownOption[] {
 	const router = useRouter()
-	const { downloadOne } = useDownload()
+	const { downloadOne, downloadConverted } = useDownload()
 	const { openVersionUpload } = useVersionUpload()
 
 	const isReady = () => asset.value.status === 'Ready'
@@ -187,6 +188,39 @@ export function useAssetActions(asset: Ref<Asset>, ctx: AssetActionsContext): Dr
 		},
 	]
 
+	const downloadOption: DropdownOption = isConvertibleStill(
+		asset.value.file_type,
+		asset.value.file_name,
+	)
+		? {
+				label: 'Download',
+				icon: 'lucide-download',
+				condition: isReady,
+				submenu: [
+					{
+						label: 'Original',
+						icon: 'lucide-download',
+						onClick: () => downloadOne(asset.value.name, asset.value.file_name),
+					},
+					{
+						label: 'JPEG',
+						icon: 'lucide-image',
+						onClick: () => downloadConverted(asset.value.name, asset.value.file_name, 'jpeg'),
+					},
+					{
+						label: 'PNG',
+						icon: 'lucide-image',
+						onClick: () => downloadConverted(asset.value.name, asset.value.file_name, 'png'),
+					},
+				],
+			}
+		: {
+				label: 'Download',
+				icon: 'lucide-download',
+				condition: isReady,
+				onClick: () => downloadOne(asset.value.name, asset.value.file_name),
+			}
+
 	return [
 		{
 			label: 'Review',
@@ -194,12 +228,7 @@ export function useAssetActions(asset: Ref<Asset>, ctx: AssetActionsContext): Dr
 			condition: isReady,
 			onClick: () => router.push(`/review/${asset.value.name}`),
 		},
-		{
-			label: 'Download',
-			icon: 'lucide-download',
-			condition: isReady,
-			onClick: () => downloadOne(asset.value.name, asset.value.file_name),
-		},
+		downloadOption,
 		{
 			label: 'Copy review link',
 			icon: 'lucide-link',
diff --git a/frontend/src/components/review/ReviewHeader.vue b/frontend/src/components/review/ReviewHeader.vue
index 7245f8a..2348d60 100644
--- a/frontend/src/components/review/ReviewHeader.vue
+++ b/frontend/src/components/review/ReviewHeader.vue
@@ -18,8 +18,20 @@
 			/>
 		</div>
 
+		<Dropdown
+			v-if="review.isGuest.value && canPickFormat"
+			:options="downloadFormatOptions"
+			align="end"
+		>
+			<Button
+				variant="subtle"
+				icon-left="lucide-download"
+				label="Download"
+				:loading="isDownloading"
+			/>
+		</Dropdown>
 		<Button
-			v-if="review.isGuest.value"
+			v-else-if="review.isGuest.value"
 			variant="subtle"
 			icon-left="lucide-download"
 			label="Download"
@@ -78,6 +90,7 @@ import {
 } from 'frappe-ui'
 import type { ReviewAsset } from '@/types'
 import { assetStatusTheme } from '@/lib/status'
+import { isConvertibleStill } from '@/lib/fileType'
 import { useDownload } from '@/composables/useDownload'
 import { useReview } from '@/composables/useReview'
 import YoutubeIcon from '@/components/common/YoutubeIcon.vue'
@@ -97,7 +110,33 @@ const emit = defineEmits<{
 const router = useRouter()
 const review = useReview()
 const shareOpen = ref(false)
-const { downloadOne, isDownloading } = useDownload(review.token)
+const { downloadOne, downloadConverted, isDownloading } = useDownload(review.token)
+
+const canPickFormat = computed(() =>
+	isConvertibleStill(props.asset.file_type, props.asset.file_name),
+)
+
+const originalExt = computed(
+	() => props.asset.file_name.match(/\.([^.]+)$/)?.[1]?.toUpperCase() ?? 'file',
+)
+
+const downloadFormatOptions = computed<DropdownOption[]>(() => [
+	{
+		label: `Original (${originalExt.value})`,
+		icon: 'lucide-download',
+		onClick: () => downloadOne(props.asset.name, props.asset.file_name),
+	},
+	{
+		label: 'JPEG',
+		icon: 'lucide-image',
+		onClick: () => downloadConverted(props.asset.name, props.asset.file_name, 'jpeg'),
+	},
+	{
+		label: 'PNG',
+		icon: 'lucide-image',
+		onClick: () => downloadConverted(props.asset.name, props.asset.file_name, 'png'),
+	},
+])
 
 const publicReview = computed({
 	get: () => props.asset.is_public_review === 1,
@@ -111,11 +150,13 @@ const shareUrl = computed(() => {
 
 const menuOptions = computed<DropdownOption[]>(() => {
 	const options: DropdownOption[] = [
-		{
-			label: 'Download',
-			icon: 'lucide-download',
-			onClick: () => downloadOne(props.asset.name, props.asset.file_name),
-		},
+		canPickFormat.value
+			? { label: 'Download', icon: 'lucide-download', submenu: downloadFormatOptions.value }
+			: {
+					label: 'Download',
+					icon: 'lucide-download',
+					onClick: () => downloadOne(props.asset.name, props.asset.file_name),
+				},
 		{
 			label: 'New version',
 			icon: 'lucide-upload',
diff --git a/frontend/src/composables/useDownload.ts b/frontend/src/composables/useDownload.ts
index fce40e5..4dcda2f 100644
--- a/frontend/src/composables/useDownload.ts
+++ b/frontend/src/composables/useDownload.ts
@@ -2,6 +2,8 @@ import { ref } from 'vue'
 import { call, toast } from 'frappe-ui'
 import type { ViewUrlResponse } from '@/types'
 
+export type DownloadFormat = 'jpeg' | 'png'
+
 function triggerDownload(url: string, fileName: string) {
 	const a = document.createElement('a')
 	a.href = url
@@ -11,6 +13,10 @@ function triggerDownload(url: string, fileName: string) {
 	document.body.removeChild(a)
 }
 
+function convertedName(fileName: string, format: DownloadFormat) {
+	return fileName.replace(/\.[^.]+$/, '') + (format === 'jpeg' ? '.jpg' : '.png')
+}
+
 /**
  * Presigned R2 downloads. With a guest review `token` the request goes through
  * `review_api.get_guest_download_url`; otherwise `api.get_download_url`.
@@ -38,6 +44,29 @@ export function useDownload(token?: string | null) {
 		}
 	}
 
+	async function downloadConverted(assetName: string, fileName: string, format: DownloadFormat) {
+		isDownloading.value = true
+		try {
+			const params = new URLSearchParams({ asset_name: assetName, format })
+			if (token) params.set('token', token)
+			const method = token
+				? 'vms.review_api.download_guest_converted_asset'
+				: 'vms.api.download_converted_asset'
+			const res = await fetch(`/api/method/${method}?${params.toString()}`, {
+				credentials: 'include',
+			})
+			if (!res.ok) throw new Error(`Could not prepare ${format.toUpperCase()} (${res.status})`)
+			const blob = await res.blob()
+			const url = URL.createObjectURL(blob)
+			triggerDownload(url, convertedName(fileName, format))
+			setTimeout(() => URL.revokeObjectURL(url), 10_000)
+		} catch (e: unknown) {
+			toast.error(e instanceof Error ? e.message : 'Download failed')
+		} finally {
+			isDownloading.value = false
+		}
+	}
+
 	async function downloadMany(assets: { name: string; file_name: string }[]) {
 		isDownloading.value = true
 		let failed = 0
@@ -58,5 +87,5 @@ export function useDownload(token?: string | null) {
 		}
 	}
 
-	return { downloadOne, downloadMany, isDownloading }
+	return { downloadOne, downloadConverted, downloadMany, isDownloading }
 }
diff --git a/frontend/src/lib/fileType.ts b/frontend/src/lib/fileType.ts
index f1341d4..044efcd 100644
--- a/frontend/src/lib/fileType.ts
+++ b/frontend/src/lib/fileType.ts
@@ -1,6 +1,18 @@
 export type FileKind = 'video' | 'image' | 'audio' | 'file'
 
 export const RAW_EXTENSIONS = ['arw', 'cr2', 'cr3', 'dng', 'nef', 'orf', 'raf', 'rw2']
+export const HEIC_EXTENSIONS = ['heic', 'heif']
+
+function extensionOf(fileName?: string | null): string {
+	return fileName?.toLowerCase().match(/\.([^.]+)$/)?.[1] ?? ''
+}
+
+export function isConvertibleStill(fileType?: string | null, fileName?: string | null): boolean {
+	const ext = extensionOf(fileName)
+	if (RAW_EXTENSIONS.includes(ext) || HEIC_EXTENSIONS.includes(ext)) return true
+	const type = fileType ?? ''
+	return type === 'image/heic' || type === 'image/heif' || type.startsWith('image/x-')
+}
 
 export interface FileKindStyle {
 	icon: string
diff --git a/pyproject.toml b/pyproject.toml
index 112e68e..1555552 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -11,6 +11,7 @@ dependencies = [
     # "frappe~=16.0.0" # Installed and managed by bench.
     "boto3>=1.35.0",
     "rawpy>=0.24.0",
+    "pillow-heif>=0.18.0",
 ]
 
 [deploy.dependencies.apt]
diff --git a/vms/api.py b/vms/api.py
index acd1b5c..448120c 100644
--- a/vms/api.py
+++ b/vms/api.py
@@ -548,6 +548,20 @@ def get_download_url(asset_name: str):
 	return {"url": url}
 
 
+@frappe.whitelist()
+def download_converted_asset(asset_name: str, format: str):
+	require_vms_access()
+
+	asset = frappe.get_doc("VMS Asset", asset_name)
+
+	if not asset.r2_key:
+		frappe.throw(_("Asset has no R2 key"))
+
+	from vms.image_export import serve_converted_download
+
+	serve_converted_download(asset, format)
+
+
 @frappe.whitelist()
 def move_asset(asset_name: str, target_project: str):
 	"""Move an asset to a different project (or from Inbox to a project)."""
diff --git a/vms/image_export.py b/vms/image_export.py
new file mode 100644
index 0000000..e6bc705
--- /dev/null
+++ b/vms/image_export.py
@@ -0,0 +1,131 @@
+import io
+import os
+import tempfile
+
+import frappe
+import requests
+from frappe import _
+from PIL import Image, ImageOps
+
+from vms.r2 import generate_presigned_view_url
+from vms.raw_images import is_raw, open_raw_preview
+
+HEIC_EXTENSIONS = frozenset({".heic", ".heif"})
+HEIC_MIMES = frozenset({"image/heic", "image/heif", "image/heic-sequence", "image/heif-sequence"})
+
+TARGET_FORMATS = {
+	"jpeg": ("JPEG", "image/jpeg", "jpg"),
+	"jpg": ("JPEG", "image/jpeg", "jpg"),
+	"png": ("PNG", "image/png", "png"),
+}
+
+JPEG_QUALITY = 90
+_WHITE = (255, 255, 255)
+
+
+def _extension(file_name: str | None) -> str:
+	if not file_name:
+		return ""
+	return os.path.splitext(file_name)[1].lower()
+
+
+def is_heic(file_type: str | None = None, file_name: str | None = None) -> bool:
+	if file_type in HEIC_MIMES:
+		return True
+	return _extension(file_name) in HEIC_EXTENSIONS
+
+
+def is_convertible_still(file_type: str | None = None, file_name: str | None = None) -> bool:
+	return is_raw(file_type, file_name) or is_heic(file_type, file_name)
+
+
+def converted_file_name(file_name: str, ext: str) -> str:
+	base = os.path.splitext(file_name)[0] or file_name
+	return f"{base}.{ext}"
+
+
+def _register_heif():
+	try:
+		from pillow_heif import register_heif_opener
+	except ImportError:
+		frappe.throw(_("HEIC support is not installed on the server (pillow-heif)."))
+	register_heif_opener()
+
+
+def _render(src_path: str, file_type: str | None, file_name: str | None) -> Image.Image:
+	if is_raw(file_type, file_name):
+		return open_raw_preview(src_path)
+
+	if is_heic(file_type, file_name):
+		_register_heif()
+
+	img = Image.open(src_path)
+	img.load()
+	return ImageOps.exif_transpose(img)
+
+
+def _has_alpha(img: Image.Image) -> bool:
+	return img.mode in ("RGBA", "LA", "PA") or "transparency" in img.info
+
+
+def _encode(img: Image.Image, pil_format: str) -> bytes:
+	buf = io.BytesIO()
+	if pil_format == "JPEG":
+		if _has_alpha(img):
+			rgba = img.convert("RGBA")
+			flattened = Image.new("RGB", rgba.size, _WHITE)
+			flattened.paste(rgba, mask=rgba.split()[-1])
+			img = flattened
+		else:
+			img = img.convert("RGB")
+		img.save(buf, "JPEG", quality=JPEG_QUALITY, optimize=True, progressive=True)
+	else:
+		img = img.convert("RGBA") if _has_alpha(img) else img.convert("RGB")
+		img.save(buf, "PNG", optimize=True)
+	return buf.getvalue()
+
+
+def _download_source(r2_key: str, dest_path: str):
+	resp = requests.get(generate_presigned_view_url(r2_key), stream=True, timeout=120)
+	resp.raise_for_status()
+	with open(dest_path, "wb") as f:
+		for chunk in resp.iter_content(chunk_size=1024 * 1024):
+			f.write(chunk)
+
+
+def convert_asset_image(asset, target_format: str) -> tuple[bytes, str, str]:
+	fmt = TARGET_FORMATS.get((target_format or "").lower())
+	if not fmt:
+		frappe.throw(_("Unsupported download format."))
+	pil_format, mime, ext = fmt
+
+	if not is_convertible_still(asset.file_type, asset.file_name):
+		frappe.throw(_("This file is not available as JPEG or PNG."))
+
+	with tempfile.TemporaryDirectory(prefix="vms_export_") as tmp:
+		src_path = os.path.join(tmp, f"source{_extension(asset.file_name) or '.bin'}")
+		_download_source(asset.r2_key, src_path)
+		img = _render(src_path, asset.file_type, asset.file_name)
+		data = _encode(img, pil_format)
+
+	return data, mime, converted_file_name(asset.file_name, ext)
+
+
+def serve_converted_download(asset, target_format: str):
+	data, mime, out_name = convert_asset_image(asset, target_format)
+
+	from vms.deletion import _create_audit_log
+
+	_create_audit_log(
+		action="Download",
+		asset_name=asset.name,
+		file_name=out_name,
+		file_type=mime,
+		project=asset.project,
+		file_size=len(data),
+	)
+
+	frappe.local.response.filename = out_name
+	frappe.local.response.filecontent = data
+	frappe.local.response.content_type = mime
+	frappe.local.response.type = "download"
diff --git a/vms/review_api.py b/vms/review_api.py
index 653f289..73f7aaa 100644
--- a/vms/review_api.py
+++ b/vms/review_api.py
@@ -540,3 +540,17 @@ def get_guest_download_url(asset_name: str, token: str):
 
 	url = generate_presigned_download_url(asset.r2_key, asset.file_name)
 	return {"url": url}
+
+
+@frappe.whitelist(allow_guest=True)
+def download_guest_converted_asset(asset_name: str, token: str, format: str):
+	_validate_public_token(asset_name, token)
+
+	asset = frappe.get_doc("VMS Asset", asset_name)
+
+	if not asset.r2_key:
+		frappe.throw(_("Asset has no R2 key"))
+
+	from vms.image_export import serve_converted_download
+
+	serve_converted_download(asset, format)
diff --git a/vms/tests/test_image_export.py b/vms/tests/test_image_export.py
new file mode 100644
index 0000000..4c9e9ae
--- /dev/null
+++ b/vms/tests/test_image_export.py
@@ -0,0 +1,101 @@
+# Copyright (c) 2026, BWH and Contributors
+# See license.txt
+
+import io
+import os
+import unittest
+
+from PIL import Image
+
+from vms.image_export import (
+	TARGET_FORMATS,
+	_encode,
+	converted_file_name,
+	is_convertible_still,
+	is_heic,
+)
+
+
+class TestConvertibleStillDetection(unittest.TestCase):
+	def test_raw_is_convertible(self):
+		self.assertTrue(is_convertible_still("image/x-sony-arw", "DSC02816.ARW"))
+		self.assertTrue(is_convertible_still("application/octet-stream", "DSC02816.arw"))
+
+	def test_heic_is_convertible_by_extension_or_mime(self):
+		self.assertTrue(is_heic(None, "IMG_0001.HEIC"))
+		self.assertTrue(is_heic("image/heif", "renamed"))
+		self.assertTrue(is_convertible_still(None, "IMG_0001.heic"))
+
+	def test_ordinary_images_are_not_convertible(self):
+		for file_name in ("photo.jpg", "photo.png", "clip.mp4", "notes.txt", "noext"):
+			self.assertFalse(is_convertible_still("image/jpeg", file_name))
+
+	def test_missing_values(self):
+		self.assertFalse(is_convertible_still(None, None))
+
+
+class TestConvertedFileName(unittest.TestCase):
+	def test_swaps_the_extension(self):
+		self.assertEqual(converted_file_name("DSC02816.ARW", "jpg"), "DSC02816.jpg")
+		self.assertEqual(converted_file_name("IMG_0001.heic", "png"), "IMG_0001.png")
+
+	def test_keeps_dotted_stems(self):
+		self.assertEqual(converted_file_name("beach.trip.2026.arw", "jpg"), "beach.trip.2026.jpg")
+
+	def test_handles_no_extension(self):
+		self.assertEqual(converted_file_name("scan", "jpg"), "scan.jpg")
+
+
+class TestEncode(unittest.TestCase):
+	def _decode(self, data):
+		img = Image.open(io.BytesIO(data))
+		img.load()
+		return img
+
+	def test_jpeg_flattens_alpha_onto_white(self):
+		src = Image.new("RGBA", (8, 8), (0, 128, 255, 0))
+		out = self._decode(_encode(src, TARGET_FORMATS["jpeg"][0]))
+		self.assertEqual(out.format, "JPEG")
+		self.assertEqual(out.mode, "RGB")
+		self.assertEqual(out.getpixel((0, 0)), (255, 255, 255))
+
+	def test_png_keeps_alpha(self):
+		src = Image.new("RGBA", (8, 8), (10, 20, 30, 40))
+		out = self._decode(_encode(src, TARGET_FORMATS["png"][0]))
+		self.assertEqual(out.format, "PNG")
+		self.assertEqual(out.mode, "RGBA")
+		self.assertEqual(out.getpixel((0, 0)), (10, 20, 30, 40))
+
+	def test_png_stays_rgb_when_opaque(self):
+		src = Image.new("RGB", (8, 8), (5, 5, 5))
+		out = self._decode(_encode(src, TARGET_FORMATS["png"][0]))
+		self.assertEqual(out.mode, "RGB")
+
+
+def _sample(env):
+	path = os.environ.get(env)
+	return path if path and os.path.exists(path) else None
+
+
+@unittest.skipUnless(_sample("VMS_TEST_ARW"), "set VMS_TEST_ARW to a .arw file to run")
+class TestArwExport(unittest.TestCase):
+	def test_arw_converts_to_a_usable_jpeg(self):
+		from vms.image_export import _render
+
+		img = _render(_sample("VMS_TEST_ARW"), "image/x-sony-arw", "sample.arw")
+		data = _encode(img, TARGET_FORMATS["jpeg"][0])
+		out = Image.open(io.BytesIO(data))
+		self.assertEqual(out.format, "JPEG")
+		self.assertGreaterEqual(out.width, 640)
+
+
+@unittest.skipUnless(_sample("VMS_TEST_HEIC"), "set VMS_TEST_HEIC to a .heic file to run")
+class TestHeicExport(unittest.TestCase):
+	def test_heic_converts_to_a_usable_png(self):
+		from vms.image_export import _render
+
+		img = _render(_sample("VMS_TEST_HEIC"), "image/heic", "sample.heic")
+		data = _encode(img, TARGET_FORMATS["png"][0])
+		out = Image.open(io.BytesIO(data))
+		self.assertEqual(out.format, "PNG")
+		self.assertGreaterEqual(out.width, 320)

From dc1a55f79f3f29238b18560bc7b66c0d596fe380 Mon Sep 17 00:00:00 2001
From: vishwajeet-13 <vishwajeetthakur403@gmail.com>
Date: Tue, 8 Sep 2026 00:20:10 +0530
Subject: [PATCH 2/2] =?UTF-8?q?fix:=20address=20review=20=E2=80=94=20semgr?=
 =?UTF-8?q?ep,=20HEIC=20allowlist,=20conversion=20limits?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- semgrep: nosemgrep for the tempfile write and the guest whitelist, matching
  the conventions already in review_api.py / thumbnails.py
- HEIC uploads: add heic,heif to the default allowed_extensions and a patch to
  extend existing VMS Settings records
- conversion DoS surface: cap the source at 300 MB and rate-limit both
  endpoints (30/min authed, 15/min guest, keyed on asset)
- frontend: drop the direct fetch(); the converted download is now an <a>
  navigation to /api/v2/method/... with a "Preparing …" toast
- guest endpoint: token is optional so a missing token is a clean 401

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N6kPRDGo6QbcVcc8DPkMTf
---
 frontend/src/composables/useDownload.ts       | 32 +++++++------------
 vms/api.py                                    |  2 ++
 vms/image_export.py                           |  6 ++++
 vms/patches.txt                               |  1 +
 vms/patches/allow_heic_uploads.py             | 17 ++++++++++
 vms/review_api.py                             |  5 ++-
 .../doctype/vms_settings/vms_settings.json    |  4 +--
 7 files changed, 43 insertions(+), 24 deletions(-)
 create mode 100644 vms/patches/allow_heic_uploads.py

diff --git a/frontend/src/composables/useDownload.ts b/frontend/src/composables/useDownload.ts
index 4dcda2f..0f88f20 100644
--- a/frontend/src/composables/useDownload.ts
+++ b/frontend/src/composables/useDownload.ts
@@ -44,27 +44,17 @@ export function useDownload(token?: string | null) {
 		}
 	}
 
-	async function downloadConverted(assetName: string, fileName: string, format: DownloadFormat) {
-		isDownloading.value = true
-		try {
-			const params = new URLSearchParams({ asset_name: assetName, format })
-			if (token) params.set('token', token)
-			const method = token
-				? 'vms.review_api.download_guest_converted_asset'
-				: 'vms.api.download_converted_asset'
-			const res = await fetch(`/api/method/${method}?${params.toString()}`, {
-				credentials: 'include',
-			})
-			if (!res.ok) throw new Error(`Could not prepare ${format.toUpperCase()} (${res.status})`)
-			const blob = await res.blob()
-			const url = URL.createObjectURL(blob)
-			triggerDownload(url, convertedName(fileName, format))
-			setTimeout(() => URL.revokeObjectURL(url), 10_000)
-		} catch (e: unknown) {
-			toast.error(e instanceof Error ? e.message : 'Download failed')
-		} finally {
-			isDownloading.value = false
-		}
+	function downloadConverted(assetName: string, fileName: string, format: DownloadFormat) {
+		const params = new URLSearchParams({ asset_name: assetName, format })
+		if (token) params.set('token', token)
+		const method = token
+			? 'vms.review_api.download_guest_converted_asset'
+			: 'vms.api.download_converted_asset'
+		toast.info(`Preparing ${format.toUpperCase()}…`)
+		triggerDownload(
+			`/api/v2/method/${method}?${params.toString()}`,
+			convertedName(fileName, format),
+		)
 	}
 
 	async function downloadMany(assets: { name: string; file_name: string }[]) {
diff --git a/vms/api.py b/vms/api.py
index 448120c..08120de 100644
--- a/vms/api.py
+++ b/vms/api.py
@@ -5,6 +5,7 @@
 import frappe
 import requests
 from frappe import _
+from frappe.rate_limiter import rate_limit
 from frappe.utils import cint
 
 from vms.permissions import require_vms_access
@@ -549,6 +550,7 @@ def get_download_url(asset_name: str):
 
 
 @frappe.whitelist()
+@rate_limit(key="asset_name", limit=30, seconds=60, methods=["GET"])
 def download_converted_asset(asset_name: str, format: str):
 	require_vms_access()
 
diff --git a/vms/image_export.py b/vms/image_export.py
index e6bc705..fdce7f1 100644
--- a/vms/image_export.py
+++ b/vms/image_export.py
@@ -22,6 +22,8 @@
 JPEG_QUALITY = 90
 _WHITE = (255, 255, 255)
 
+MAX_SOURCE_BYTES = 300 * 1024 * 1024
+
 
 def _extension(file_name: str | None) -> str:
 	if not file_name:
@@ -88,6 +90,7 @@ def _encode(img: Image.Image, pil_format: str) -> bytes:
 def _download_source(r2_key: str, dest_path: str):
 	resp = requests.get(generate_presigned_view_url(r2_key), stream=True, timeout=120)
 	resp.raise_for_status()
+	# nosemgrep: frappe-semgrep-rules.rules.security.frappe-security-file-traversal
 	with open(dest_path, "wb") as f:
 		for chunk in resp.iter_content(chunk_size=1024 * 1024):
 			f.write(chunk)
@@ -102,6 +105,9 @@ def convert_asset_image(asset, target_format: str) -> tuple[bytes, str, str]:
 	if not is_convertible_still(asset.file_type, asset.file_name):
 		frappe.throw(_("This file is not available as JPEG or PNG."))
 
+	if asset.file_size and asset.file_size > MAX_SOURCE_BYTES:
+		frappe.throw(_("This file is too large to convert on download. Download the original instead."))
+
 	with tempfile.TemporaryDirectory(prefix="vms_export_") as tmp:
 		src_path = os.path.join(tmp, f"source{_extension(asset.file_name) or '.bin'}")
 		_download_source(asset.r2_key, src_path)
diff --git a/vms/patches.txt b/vms/patches.txt
index 8cb69a5..39e592e 100644
--- a/vms/patches.txt
+++ b/vms/patches.txt
@@ -13,3 +13,4 @@ vms.patches.sanitize_soft_delete_fields
 vms.patches.migrate_youtube_channel
 vms.patches.sanitize_rich_text_fields
 vms.patches.backfill_raw_asset_types
+vms.patches.allow_heic_uploads
diff --git a/vms/patches/allow_heic_uploads.py b/vms/patches/allow_heic_uploads.py
new file mode 100644
index 0000000..a365d99
--- /dev/null
+++ b/vms/patches/allow_heic_uploads.py
@@ -0,0 +1,17 @@
+import frappe
+
+
+def execute():
+	settings = frappe.get_single("VMS Settings")
+	current = settings.allowed_extensions or ""
+	exts = [e.strip().lower() for e in current.split(",") if e.strip()]
+
+	added = [e for e in ("heic", "heif") if e not in exts]
+	if not added:
+		return
+
+	insert_at = exts.index("arw") if "arw" in exts else len(exts)
+	exts[insert_at:insert_at] = added
+	settings.allowed_extensions = ",".join(exts)
+	settings.save(ignore_permissions=True)
+	frappe.db.commit()
diff --git a/vms/review_api.py b/vms/review_api.py
index 73f7aaa..824d239 100644
--- a/vms/review_api.py
+++ b/vms/review_api.py
@@ -3,6 +3,7 @@
 
 import frappe
 from frappe import _
+from frappe.rate_limiter import rate_limit
 
 from vms.r2 import (
 	generate_presigned_download_url,
@@ -542,8 +543,10 @@ def get_guest_download_url(asset_name: str, token: str):
 	return {"url": url}
 
 
+# nosemgrep: frappe-semgrep-rules.rules.security.guest-whitelisted-method
 @frappe.whitelist(allow_guest=True)
-def download_guest_converted_asset(asset_name: str, token: str, format: str):
+@rate_limit(key="asset_name", limit=15, seconds=60, methods=["GET"])
+def download_guest_converted_asset(asset_name: str, format: str, token: str | None = None):
 	_validate_public_token(asset_name, token)
 
 	asset = frappe.get_doc("VMS Asset", asset_name)
diff --git a/vms/video_management_solution/doctype/vms_settings/vms_settings.json b/vms/video_management_solution/doctype/vms_settings/vms_settings.json
index 487a8f7..e9d95f3 100644
--- a/vms/video_management_solution/doctype/vms_settings/vms_settings.json
+++ b/vms/video_management_solution/doctype/vms_settings/vms_settings.json
@@ -106,7 +106,7 @@
    "label": "Presigned URL Expiry (seconds)"
   },
   {
-   "default": "mp4,mov,avi,mkv,webm,m4v,mp3,wav,png,jpg,jpeg,gif,webp,arw,cr2,cr3,dng,nef,orf,raf,rw2",
+   "default": "mp4,mov,avi,mkv,webm,m4v,mp3,wav,png,jpg,jpeg,gif,webp,heic,heif,arw,cr2,cr3,dng,nef,orf,raf,rw2",
    "description": "Comma-separated list of allowed file extensions",
    "fieldname": "allowed_extensions",
    "fieldtype": "Small Text",
@@ -214,7 +214,7 @@
  ],
  "issingle": 1,
  "links": [],
- "modified": "2026-09-01 12:00:00.000000",
+ "modified": "2026-09-08 12:00:00.000000",
  "modified_by": "Administrator",
  "module": "Video Management Solution",
  "name": "VMS Settings",