Function main

scripts/backfill-c2pa-static.ts:54–119

()

}

async function main(): Promise<void> {
  const dryRun = process.argv.includes("--dry-run");

  if (!isC2PASigningEnabled()) {
    console.error(
      "C2PA_SIGNING_ENABLED + C2PA_CERT_PEM_B64 + C2PA_PRIVATE_KEY_PEM_B64 must all be set.",
    );
    process.exit(1);
  }

  const files: string[] = [];
  for (const root of ROOTS) await walk(root, files);
  files.sort();

  console.log(`Found ${files.length} PNGs under ${ROOTS.join(", ")}.`);
  if (dryRun) console.log("(dry run — no files will be modified)");

  const stats: BackfillStats = { signed: 0, skippedAlreadySigned: 0, failed: 0 };

  for (const file of files) {
    const buffer = await fs.promises.readFile(file);

    // Detect actual MIME type from magic bytes — some committed .png files
    // are really JPEGs with the wrong extension. c2pa-rs rejects a MIME/buffer
    // mismatch, so we feed it the truth.
    const detected = await fileTypeFromBuffer(buffer);
    const mimeType = detected?.mime ?? "image/png";
    if (!SIGNABLE_MIME_TYPES.has(mimeType)) {
      console.warn(`  ⚠ ${file}: unsupported type ${mimeType}, skipping`);
      continue;
    }

    if (await hasEmbeddedManifest(buffer, mimeType)) {
      stats.skippedAlreadySigned++;
      continue;
    }
    try {
      const signed = signC2PA(buffer, {
        claimGenerator: "AAO Docs Storyboard Generator",
        title: path.basename(file),
        softwareAgent: { name: "gemini-3.1-flash-image-preview", version: "preview" },
        mimeType,
        attributes: {
          relative_path: path.relative(process.cwd(), file),
          // Backfilled rows hash the file bytes since the original prompt is
          // no longer available. The hash still serves as tamper evidence.
          source_sha256: createHash("sha256").update(buffer).digest("hex"),
          backfilled: true,
        },
      });
      if (!dryRun) await fs.promises.writeFile(file, signed.signedBuffer);
      stats.signed++;
      if (stats.signed % 10 === 0 || stats.signed === files.length) {
        console.log(`  [${stats.signed}/${files.length}] ${file}`);
      }
    } catch (err) {
      console.error(`  ✗ ${file}: ${(err as Error).message}`);
      stats.failed++;