Provenance — C2PA, SynthID, Watermarking

# Using c2pa-python (Adobe's reference implementation)
from c2pa import Builder, create_signer, SigningAlg

# Create a signer from your cert + key (issued by a C2PA-trusted CA)
signer = create_signer(
    certs_path="./my-certificate-chain.pem",
    private_key_path="./my-private.key",
    alg=SigningAlg.PS256,
)

# Build a manifest
manifest_json = {
    "claim_generator": "tendril-creative-studio/1.0",
    "format": "image/png",
    "assertions": [
        {
            "label": "c2pa.actions",
            "data": {"actions": [
                {"action": "c2pa.created", "softwareAgent": "Flux 1.1 Pro"},
                {"action": "c2pa.edited", "softwareAgent": "Photoshop 2026"},
            ]},
        },
        {
            "label": "c2pa.training-mining",
            "data": {"entries": {
                "c2pa.ai_generative_training": {"use": "notAllowed"},
            }},
        },
    ],
}

builder = Builder(manifest_json)
builder.sign_file(
    signer=signer,
    source_path="./ai_generated.png",
    dest_path="./ai_generated_signed.png",
)

# Anyone with the C2PA Reader can verify this file
# and see it was AI-generated, edited in Photoshop, and
# the creator opted out of training.

// Browser-side: verify C2PA badge using @contentauth/sdk
import { createC2pa } from "@contentauth/sdk";

const c2pa = await createC2pa({
  wasmSrc: "/c2pa-wasm.wasm",
  workerSrc: "/c2pa.worker.js",
});

const { manifestStore } = await c2pa.read(imageBlob);
if (!manifestStore) {
  // No Content Credentials — unknown provenance
  return { verified: false, reason: "no_manifest" };
}

const active = manifestStore.activeManifest;
const aiActions = active.assertions.data.find((a) => a.label === "c2pa.actions");
const aiGenerated = aiActions?.data.actions.some(
  (a) => a.action === "c2pa.created" && a.softwareAgent
);

return {
  verified: true,
  aiGenerated,
  signer: active.signatureInfo?.issuer,
  editHistory: aiActions?.data.actions,
};