Function signC2PA

server/src/services/c2pa.ts:130–211

(imageBuffer: Buffer, assertions: C2PAAssertions)

 * already take seconds, so the added latency is in the noise.
 */
export function signC2PA(imageBuffer: Buffer, assertions: C2PAAssertions): SignC2PAResult {
  const signer = getSigner();
  const mimeType = assertions.mimeType || 'image/png';

  const builder = Builder.withJson(
    {
      claim_generator: assertions.claimGenerator,
      claim_generator_info: [
        {
          name: assertions.claimGenerator,
          version: AAO_TOOL_VERSION,
        },
      ],
      title: assertions.title,
      format: mimeType,
      instance_id: `urn:uuid:${randomUUID()}`,
      ingredients: [],
      assertions: [],
      resources: { resources: {} },
    },
    BUILDER_SETTINGS,
  );

  // Declare this asset as AI-generated. The library auto-adds a c2pa.created
  // action; we additionally emit an explicit actions assertion carrying the
  // software agent so the generator + model version is visible to verifiers.
  builder.setIntent({ create: AI_DIGITAL_SOURCE_TYPE });

  // JSON-kind assertions are passed as pre-serialized strings; CBOR-kind
  // assertions accept JS objects. We use JSON here for readability in verifier UIs.
  builder.addAssertion(
    'c2pa.actions',
    JSON.stringify({
      actions: [
        {
          action: 'c2pa.created',
          softwareAgent: assertions.softwareAgent,
          digitalSourceType: AI_DIGITAL_SOURCE_TYPE,
        },
      ],
    }),
    'Json',
  );

  if (assertions.attributes && Object.keys(assertions.attributes).length > 0) {
    builder.addAssertion(
      AAO_ASSERTION_LABEL,
      JSON.stringify({ generator_attributes: assertions.attributes }),
      'Json',
    );
  }

  const dest: { buffer: Buffer | null } = { buffer: null };
  const manifestBytes = builder.sign(
    signer,
    { buffer: imageBuffer, mimeType },
    dest,
  );