Module formats 

Format handlers.

Organised by file format, not by dependency: someone looking for how WebP is handled opens webp.rs. If the crate underneath a handler is ever swapped, the change stops at that module boundary and nothing else in the tree moves. A module must never be named after the crate it wraps.

Why handlers take a slice and return a buffer

docs/ARCHITECTURE.md §3 sketched this trait over a ReadSeek. Phase 1 refines it to &[u8] in and Vec<u8> out, recorded as ADR-0017. Two reasons:

• Output must be verified before it can reach the disk. The verification pass (docs/ARCHITECTURE.md §1) re-inspects what the handler produced and fails if metadata survived. Streaming straight to the destination would mean unverified — possibly partially-sanitised — bytes had already been written by the time the check ran, which is exactly the outcome the fail-closed rule exists to prevent.
• A slice makes the panic-freedom lints enforceable. Seek-driven parsing spreads bounds checking across every read; a slice concentrates it in [crate::bytes::Reader], where indexing_slicing and arithmetic_side_effects can be denied and actually mean something (ADR-0006).

The cost is that a file is held in memory, which is why ingest is bounded before a handler ever sees it (crate::io::Limits).

Modules

jpeg

JPEG.

pdf

PDF.

png

PNG.

webp

WebP.

Structs

ParseLimits

Ceilings a handler applies while parsing.

StripOptions

What a caller wants from a strip.

Stripped

Sanitised bytes and an account of what was done to produce them.

Traits

MetadataHandler

Detection, reporting, and removal for one file format.