C2PA Manifest Detector

Detects whether a media file carries an embedded C2PA (Content Credentials) manifest by parsing the JUMBF box structure directly. Zero dependencies, no native toolchain, no model download.

Useful where the question is presence rather than full validation, such as an upload pipeline deciding whether provenance exists before deciding what to do about it.

States plainly what it does not do: it detects and locates a manifest, it does not verify the signature chain. A listing that blurred that line would be selling the wrong assurance.

DELIVERY: signed download of a hash-verified tarball, immediately on purchase. Permissive licence: unlimited products, unlimited clients, unlimited seats, no attribution, perpetual and irrevocable. One restriction, do not republish the source as source.

Interface

What you call, and what comes back. Types and signatures only — the implementation ships with the source.

  export function bytesEqualAt(buf: Buffer, offset: number, expected: readonly number[]): boolean;
  export function asciiAt(buf: Buffer, offset: number, text: string): boolean;
  export function detectC2paManifest(buffer: Buffer): C2paDetectionResult;
  export async function detectC2paManifestForFile(filePath: string): Promise<C2paFileDetectionResult>;

  export type C2paManifestStatus = (typeof C2paManifestStatusValues)[number];
  export type C2paManifestSource = (typeof C2paManifestSourceValues)[number];
  export type C2paContainerFormat = (typeof C2paContainerFormatValues)[number];
  export type ScanCoverage = (typeof ScanCoverageValues)[number];