Crate c2pa_structured_text 

C2PA manifest embedding, hard binding, and validation for structured text.

Implements the Embedding Manifests into Structured Text section of the C2PA Technical Specification, which associates a C2PA Manifest Store with source code, configuration files, markup, and other text formats that support comment syntax or front matter conventions.

The manifest block uses fixed ASCII armour-style delimiters: -----BEGIN C2PA MANIFEST----- and -----END C2PA MANIFEST-----.

Scope

This crate owns three things:

• Embed (embed_manifest, embed_manifest_at_end, embed_front_matter) a reference or an inline manifest as a comment or front matter block.
• Extract (extract_manifest, classify_reference) the block and resolve its reference.
• The hard binding (hardbinding): the exact c2pa.hash.data coverage over the normalized-free raw byte stream, with the manifest block excluded, plus compute and verify.

Signature verification, certificate trust, and assertion validation are not implemented here; the bridge (feature c2pa) delegates them to c2pa-rs.

Examples

The block is embedded using the host format’s comment syntax and located again by its ASCII delimiters, independent of that syntax. One round trip per comment style:

Line comments — # (Python, Ruby, Shell, YAML, TOML), // (JS, Rust, Go, C++), -- (SQL, Lua, Haskell):

use c2pa_structured_text::{embed_manifest, extract_manifest, ManifestRef};

for prefix in ["#", "//", "--"] {
    let signed = embed_manifest("value = 1\n", ManifestRef::Url("https://ex.com/m.c2pa"), prefix, None);
    assert!(signed.starts_with(prefix));
    assert_eq!(extract_manifest(&signed).unwrap().reference, "https://ex.com/m.c2pa");
}

Block comments — /* */ (CSS, C, Java):

use c2pa_structured_text::{embed_manifest, extract_manifest, ManifestRef};

let signed = embed_manifest("body {}\n", ManifestRef::Url("https://ex.com/m.c2pa"), "/*", Some("*/"));
assert!(signed.contains("-----END C2PA MANIFEST----- */"));
assert_eq!(extract_manifest(&signed).unwrap().reference, "https://ex.com/m.c2pa");

Markup comments — <!-- --> (Markdown, non-HTML XML):

use c2pa_structured_text::{embed_manifest, extract_manifest, ManifestRef};

let signed = embed_manifest("# Title\n", ManifestRef::Url("https://ex.com/m.c2pa"), "<!--", Some("-->"));
assert!(signed.starts_with("<!-- -----BEGIN C2PA MANIFEST-----"));
assert_eq!(extract_manifest(&signed).unwrap().reference, "https://ex.com/m.c2pa");

Front matter — multi-line form for YAML (---) / TOML (+++):

use c2pa_structured_text::{embed_front_matter, extract_manifest, ManifestRef};

let signed = embed_front_matter("title: doc\n", ManifestRef::Url("https://ex.com/m.c2pa"), "---");
assert!(signed.starts_with("---\n-----BEGIN C2PA MANIFEST-----\n"));
assert_eq!(extract_manifest(&signed).unwrap().reference, "https://ex.com/m.c2pa");

Features

• hard-binding — concrete SHA2-256/384/512 hardbinding::compute_data_hash and hardbinding::verify_data_hash (pulls sha2). The exclusion-range and covered-byte primitives (hardbinding::manifest_exclusion, hardbinding::hashed_bytes) are always available and dependency-free.
• c2pa — the bridge to c2pa-rs for signature/trust/assertion validation.
• remote — HTTP(S) resolution of URL references in the bridge (pulls ureq).
• wasm — JS/WASM bindings for the npm package (pulls wasm-bindgen).
• python — Python bindings for the PyPI wheel (pulls pyo3, built with maturin).

No feature is enabled by default; the core embed/extract/binding-range API has no dependencies.

Modules

bridge

Validation bridge to c2pa-rs.

codec

Standard (RFC 4648) Base64 encode/decode with no external dependencies.

hardbinding

The hard binding for structured text.

Structs

ExtractionResult

The result of extracting a manifest block: the reference plus the byte offset and length of the block’s line(s) in the source text.

Enums

Error

ManifestRef

A manifest reference to embed: either a URI to an external C2PA Manifest Store (preferred) or the store itself, which is encoded as a data:application/c2pa;base64, URI.

Reference

A classified manifest reference: an external URI or an embedded C2PA Manifest Store decoded from a data:application/c2pa;base64, URI.

Constants

BEGIN

The opening ASCII armour delimiter for a C2PA manifest block.

DATA_URI_PREFIX

The URI prefix marking an inline (embedded) C2PA Manifest Store.

END

The closing ASCII armour delimiter for a C2PA manifest block.

Functions

classify_reference

Classify and resolve a reference string as extracted from a manifest block.

embed_front_matter

Embed a manifest block in multi-line front matter form. fm_delim is the host format’s front matter fence (--- for YAML, +++ for TOML).

embed_manifest

Embed a manifest block as the first line of the file using single-line comment syntax. This is the recommended placement.

embed_manifest_at_end

Embed a manifest block as the last line of the file. Use this when the first line is reserved by the host format (a shebang #!/... or an XML declaration <?xml ...?>), so the -----END C2PA MANIFEST----- delimiter appears on the final line as the specification requires.

extract_manifest

Locate and extract the single manifest block from structured text.

find_delimiter

Locate the first occurrence of needle in haystack by a byte-window search, returning its start offset.