Module formats 

Format handlers.

Organised by file format, not by dependency: someone looking for how WebP is handled opens webp.rs. If the crate underneath a handler is ever swapped, the change stops at that module boundary and nothing else in the tree moves. A module must never be named after the crate it wraps.

Why handlers take a slice and return a buffer

docs/ARCHITECTURE.md §3 sketched this trait over a ReadSeek. Phase 1 refines it to &[u8] in and Vec<u8> out, recorded as ADR-0017. Two reasons:

• Output must be verified before it can reach the disk. The verification pass (docs/ARCHITECTURE.md §1) re-inspects what the handler produced and fails if metadata survived. Streaming straight to the destination would mean unverified — possibly partially-sanitised — bytes had already been written by the time the check ran, which is exactly the outcome the fail-closed rule exists to prevent.
• A slice makes the panic-freedom lints enforceable. Seek-driven parsing spreads bounds checking across every read; a slice concentrates it in [crate::bytes::Reader], where indexing_slicing and arithmetic_side_effects can be denied and actually mean something (ADR-0006).

The cost is that a file is held in memory, which is why ingest is bounded before a handler ever sees it (crate::io::Limits).

Modules

flac

FLAC.

gif

GIF.

heif

HEIF and AVIF: one ISO-BMFF container, two codecs (HEVC and AV1). One handler for both, which is why ADR-0032 makes them one tranche.

jpeg

JPEG.

jxl

JPEG XL, in both of its spellings: a bare codestream and an ISO-BMFF container.

mp3

MP3.

mp4

MP4 and M4A: the ISO base media file format carrying tracks rather than a picture.

odf

OpenDocument — .odt, .ods, .odp.

ogg

Ogg: Vorbis, Opus, and FLAC-in-Ogg.

ooxml

Office Open XML — .docx, .xlsx, .pptx.

pdf

PDF.

png

PNG.

svg

SVG — the one format in this project where strypt removes less than mat2 and says so.

tiff

TIFF, the format whose metadata is its file structure.

wav

WAV.

webp

WebP.

Structs

ParseLimits

Ceilings a handler applies while parsing.

StripOptions

What a caller wants from a strip.

Stripped

Sanitised bytes and an account of what was done to produce them.

Traits

MetadataHandler

Detection, reporting, and removal for one file format.