Add existing XMP namespace policy for portable XMP

Introduce XmpExistingNamespacePolicy (KnownPortableOnly, PreserveCustom) to control whether generated portable XMP drops or preserves safe custom namespaces. Wire the policy through public APIs, CLI, Python bindings and internal options (headers, sidecar/portable options, prepare/dump paths). Implement collection/emission of deterministic omnsN prefixes for preserved custom namespaces and namespace-safety checks, and update dump logic to include custom declarations when PreserveCustom is requested. Add tests exercising default-drop and preserve behaviors and update README/docs to document the new option.

Author: ssh4net

README.md

@@ -149,6 +149,9 @@ In practice:
 - Generated portable XMP also has an explicit conflict policy for existing
   decoded XMP versus generated EXIF/IPTC mappings:
   current behavior, `existing_wins`, or `generated_wins`.
+- Generated portable XMP now also has an explicit existing-namespace policy:
+  keep only OpenMeta's known portable namespaces, or preserve safe custom
+  existing namespaces with deterministic generated prefixes.
 - Transfer preparation can also fold an existing sibling `.xmp` sidecar from
   the destination path into generated portable XMP when that bounded mode is
   requested, with explicit `sidecar_wins` or `source_wins` precedence against
@@ -180,7 +183,8 @@ In practice:
 - Prepared bundles record resolved policy decisions for MakerNote, JUMBF,
   C2PA, EXIF-to-XMP projection, and IPTC-to-XMP projection.
 - This is still not a full MWG-style sync engine. OpenMeta does not yet try to
-  solve all EXIF/IPTC/XMP conflict resolution or canonical writeback policy.
+  solve all EXIF/IPTC/XMP conflict resolution or full canonical writeback
+  policy.
 
 For transfer details, see
 [docs/metadata_transfer_plan.md](docs/metadata_transfer_plan.md).

docs/metadata_transfer_plan.md

@@ -310,6 +310,9 @@ OpenMeta now has a bounded public sync-policy layer for generated XMP.
 Current controls:
 - `xmp_project_exif`
 - `xmp_project_iptc`
+- `xmp_existing_namespace_policy`
+  - `KnownPortableOnly`
+  - `PreserveCustom`
 - `xmp_conflict_policy`
 - `xmp_existing_sidecar_mode` on the file-read/prepare path:
   - `Ignore`
@@ -432,7 +435,8 @@ Missing pieces include:
 - conflict resolution rules
 - broader sidecar vs embedded policy beyond the current bounded writeback mode
 - canonical writeback policy
-- broader namespace reconciliation behavior
+- broader namespace reconciliation behavior beyond the current bounded
+  custom-namespace preservation control
 
 ### 3. MakerNote-safe rewrite expectations
 

src/include/openmeta/metadata_transfer.h

@@ -427,6 +427,8 @@ struct PrepareTransferRequest final {
     bool xmp_project_exif               = true;
     bool xmp_project_iptc               = true;
     bool xmp_include_existing           = true;
+    XmpExistingNamespacePolicy xmp_existing_namespace_policy
+        = XmpExistingNamespacePolicy::KnownPortableOnly;
     XmpConflictPolicy xmp_conflict_policy
         = XmpConflictPolicy::CurrentBehavior;
     bool xmp_exiftool_gpsdatetime_alias = false;

src/include/openmeta/xmp_dump.h

@@ -30,6 +30,14 @@ enum class XmpConflictPolicy : uint8_t {
     GeneratedWins,
 };
 
+/// Existing XMP namespace policy for portable XMP generation.
+enum class XmpExistingNamespacePolicy : uint8_t {
+    /// Keep only the standard portable namespaces known to OpenMeta.
+    KnownPortableOnly,
+    /// Also preserve safe simple/indexed properties from custom namespaces.
+    PreserveCustom,
+};
+
 /// XMP dump result status.
 enum class XmpDumpStatus : uint8_t {
     Ok,
@@ -68,6 +76,9 @@ struct XmpPortableOptions final {
     ///
     /// \note Currently only simple `property_path` values are emitted (no `/` nesting).
     bool include_existing_xmp = false;
+    /// Existing XMP namespace writeback policy for portable output.
+    XmpExistingNamespacePolicy existing_namespace_policy
+        = XmpExistingNamespacePolicy::KnownPortableOnly;
     /// Conflict policy between existing decoded XMP and generated portable
     /// EXIF/IPTC mappings.
     XmpConflictPolicy conflict_policy = XmpConflictPolicy::CurrentBehavior;
@@ -105,6 +116,8 @@ struct XmpSidecarRequest final {
     bool include_exif                        = true;
     bool include_iptc                        = true;
     bool include_existing_xmp                = false;
+    XmpExistingNamespacePolicy portable_existing_namespace_policy
+        = XmpExistingNamespacePolicy::KnownPortableOnly;
     XmpConflictPolicy portable_conflict_policy
         = XmpConflictPolicy::CurrentBehavior;
     bool portable_exiftool_gpsdatetime_alias = false;

src/openmeta/metadata_transfer.cc

@@ -9998,6 +9998,8 @@ prepare_metadata_for_target_impl(const MetaStore& store,
         xmp_req.include_exif = request.xmp_project_exif;
         xmp_req.include_iptc = request.xmp_project_iptc;
         xmp_req.include_existing_xmp = request.xmp_include_existing;
+        xmp_req.portable_existing_namespace_policy
+            = request.xmp_existing_namespace_policy;
         xmp_req.portable_conflict_policy = request.xmp_conflict_policy;
         xmp_req.portable_exiftool_gpsdatetime_alias
             = request.xmp_exiftool_gpsdatetime_alias;
@@ -10369,6 +10371,8 @@ prepare_metadata_for_target_impl(const MetaStore& store,
                 xmp_req.include_exif         = false;
                 xmp_req.include_iptc         = true;
                 xmp_req.include_existing_xmp = false;
+                xmp_req.portable_existing_namespace_policy
+                    = request.xmp_existing_namespace_policy;
                 xmp_req.portable_conflict_policy
                     = request.xmp_conflict_policy;
 

src/openmeta/xmp_dump.cc

@@ -127,6 +127,11 @@ namespace {
         std::string_view uri;
     };
 
+    struct PortableCustomNsDecl final {
+        std::string prefix;
+        std::string uri;
+    };
+
     static void emit_xmp_packet_begin(SpanWriter* w,
                                       std::span<const XmpNsDecl> decls) noexcept
     {
@@ -1316,6 +1321,48 @@ namespace {
         return false;
     }
 
+    static bool xmp_namespace_uri_is_xml_attr_safe(std::string_view uri) noexcept
+    {
+        if (uri.empty()) {
+            return false;
+        }
+        for (size_t i = 0; i < uri.size(); ++i) {
+            const unsigned char c = static_cast<unsigned char>(uri[i]);
+            if (c < 0x20U || c > 0x7EU || c == '"' || c == '&' || c == '<'
+                || c == '>') {
+                return false;
+            }
+        }
+        return true;
+    }
+
+    static bool portable_custom_ns_prefix_for_uri(
+        std::string_view ns, std::span<const PortableCustomNsDecl> decls,
+        std::string_view* out_prefix) noexcept
+    {
+        if (!out_prefix) {
+            return false;
+        }
+        *out_prefix = {};
+        for (size_t i = 0; i < decls.size(); ++i) {
+            if (decls[i].uri == ns) {
+                *out_prefix = decls[i].prefix;
+                return true;
+            }
+        }
+        return false;
+    }
+
+    static bool portable_ns_to_prefix(
+        std::string_view ns, std::span<const PortableCustomNsDecl> decls,
+        std::string_view* out_prefix) noexcept
+    {
+        if (xmp_ns_to_portable_prefix(ns, out_prefix)) {
+            return true;
+        }
+        return portable_custom_ns_prefix_for_uri(ns, decls, out_prefix);
+    }
+
     static std::string_view
     portable_property_name_for_existing_xmp(std::string_view prefix,
                                             std::string_view name) noexcept
@@ -3174,7 +3221,8 @@ namespace {
     }
 
     static bool process_portable_existing_xmp_entry(
-        const ByteArena& arena, const Entry& e, uint32_t order, SpanWriter* w,
+        const ByteArena& arena, std::span<const PortableCustomNsDecl> decls,
+        const Entry& e, uint32_t order, SpanWriter* w,
         PortablePropertyOwnerMap* claims,
         std::vector<PortableIndexedProperty>* indexed) noexcept
     {
@@ -3188,7 +3236,7 @@ namespace {
         const std::string_view name
             = arena_string(arena, e.key.data.xmp_property.property_path);
         std::string_view prefix;
-        if (!xmp_ns_to_portable_prefix(ns, &prefix)) {
+        if (!portable_ns_to_prefix(ns, decls, &prefix)) {
             return false;
         }
 
@@ -3240,6 +3288,70 @@ namespace {
         return false;
     }
 
+    static void collect_portable_custom_ns_decls(
+        const ByteArena& arena, std::span<const Entry> entries,
+        const XmpPortableOptions& options,
+        std::vector<PortableCustomNsDecl>* out) noexcept
+    {
+        if (!out) {
+            return;
+        }
+        out->clear();
+        if (!options.include_existing_xmp
+            || options.existing_namespace_policy
+                   != XmpExistingNamespacePolicy::PreserveCustom) {
+            return;
+        }
+
+        uint32_t next_index = 1U;
+        for (size_t i = 0; i < entries.size(); ++i) {
+            const Entry& e = entries[i];
+            if (e.key.kind != MetaKeyKind::XmpProperty) {
+                continue;
+            }
+
+            const std::string_view ns
+                = arena_string(arena, e.key.data.xmp_property.schema_ns);
+            std::string_view prefix;
+            if (xmp_ns_to_portable_prefix(ns, &prefix)
+                || !xmp_namespace_uri_is_xml_attr_safe(ns)
+                || portable_custom_ns_prefix_for_uri(
+                    ns, std::span<const PortableCustomNsDecl>(out->data(),
+                                                              out->size()),
+                    &prefix)) {
+                continue;
+            }
+
+            const std::string_view name
+                = arena_string(arena, e.key.data.xmp_property.property_path);
+            std::string_view portable_name;
+            if (is_simple_xmp_property_name(name)) {
+                portable_name = portable_property_name_for_existing_xmp(
+                    "omns", name);
+            } else {
+                std::string_view base_name;
+                uint32_t index = 0U;
+                if (!parse_indexed_xmp_property_name(name, &base_name,
+                                                     &index)) {
+                    continue;
+                }
+                portable_name = portable_property_name_for_existing_xmp(
+                    "omns", base_name);
+            }
+            if (portable_name.empty()
+                || xmp_property_is_nonportable_blob("omns", portable_name)
+                || !portable_scalar_like_value_supported(arena, e.value)) {
+                continue;
+            }
+
+            PortableCustomNsDecl decl;
+            decl.prefix = "omns" + std::to_string(next_index);
+            decl.uri.assign(ns.data(), ns.size());
+            out->push_back(std::move(decl));
+            next_index += 1U;
+        }
+    }
+
     static bool
     process_portable_exif_entry(const ByteArena& arena,
                                 std::span<const Entry> entries, const Entry& e,
@@ -3600,6 +3712,7 @@ namespace {
 
     static void emit_portable_pass(
         PortablePassKind pass, const ByteArena& arena,
+        std::span<const PortableCustomNsDecl> custom_decls,
         std::span<const Entry> entries, const XmpPortableOptions& options,
         SpanWriter* w, PortablePropertyOwnerMap* claims,
         std::vector<PortableIndexedProperty>* indexed, uint32_t* emitted,
@@ -3640,7 +3753,8 @@ namespace {
                     continue;
                 }
                 if (process_portable_existing_xmp_entry(
-                        arena, e, static_cast<uint32_t>(i), w, claims,
+                        arena, custom_decls, e, static_cast<uint32_t>(i), w,
+                        claims,
                         indexed)) {
                     *emitted += 1U;
                 }
@@ -3677,12 +3791,24 @@ dump_xmp_portable(const MetaStore& store, std::span<std::byte> out,
         XmpNsDecl { "photoshop", kXmpNsPhotoshop },
         XmpNsDecl { "Iptc4xmpCore", kXmpNsIptc4xmpCore },
     };
-    emit_xmp_packet_begin(&w, std::span<const XmpNsDecl>(kDecls.data(),
-                                                         kDecls.size()));
-
     const ByteArena& arena          = store.arena();
     const std::span<const Entry> es = store.entries();
 
+    std::vector<PortableCustomNsDecl> custom_decls;
+    collect_portable_custom_ns_decls(arena, es, options, &custom_decls);
+
+    std::vector<XmpNsDecl> decls;
+    decls.reserve(kDecls.size() + custom_decls.size());
+    for (size_t i = 0; i < kDecls.size(); ++i) {
+        decls.push_back(kDecls[i]);
+    }
+    for (size_t i = 0; i < custom_decls.size(); ++i) {
+        decls.push_back(XmpNsDecl { custom_decls[i].prefix,
+                                    custom_decls[i].uri });
+    }
+    emit_xmp_packet_begin(&w, std::span<const XmpNsDecl>(decls.data(),
+                                                         decls.size()));
+
     std::vector<PortableIndexedProperty> indexed;
     indexed.reserve(128);
     PortablePropertyOwnerMap claims;
@@ -3692,26 +3818,53 @@ dump_xmp_portable(const MetaStore& store, std::span<std::byte> out,
     uint32_t iptc_order = 0U;
 
     if (options.conflict_policy == XmpConflictPolicy::ExistingWins) {
-        emit_portable_pass(PortablePassKind::ExistingXmp, arena, es, options,
-                           &w, &claims, &indexed, &emitted, &iptc_order);
-        emit_portable_pass(PortablePassKind::Exif, arena, es, options, &w,
-                           &claims, &indexed, &emitted, &iptc_order);
-        emit_portable_pass(PortablePassKind::Iptc, arena, es, options, &w,
-                           &claims, &indexed, &emitted, &iptc_order);
+        emit_portable_pass(PortablePassKind::ExistingXmp, arena,
+                           std::span<const PortableCustomNsDecl>(
+                               custom_decls.data(), custom_decls.size()),
+                           es, options, &w, &claims, &indexed, &emitted,
+                           &iptc_order);
+        emit_portable_pass(PortablePassKind::Exif, arena,
+                           std::span<const PortableCustomNsDecl>(
+                               custom_decls.data(), custom_decls.size()),
+                           es, options, &w, &claims, &indexed, &emitted,
+                           &iptc_order);
+        emit_portable_pass(PortablePassKind::Iptc, arena,
+                           std::span<const PortableCustomNsDecl>(
+                               custom_decls.data(), custom_decls.size()),
+                           es, options, &w, &claims, &indexed, &emitted,
+                           &iptc_order);
     } else if (options.conflict_policy == XmpConflictPolicy::GeneratedWins) {
-        emit_portable_pass(PortablePassKind::Exif, arena, es, options, &w,
-                           &claims, &indexed, &emitted, &iptc_order);
-        emit_portable_pass(PortablePassKind::Iptc, arena, es, options, &w,
-                           &claims, &indexed, &emitted, &iptc_order);
-        emit_portable_pass(PortablePassKind::ExistingXmp, arena, es, options,
-                           &w, &claims, &indexed, &emitted, &iptc_order);
+        emit_portable_pass(PortablePassKind::Exif, arena,
+                           std::span<const PortableCustomNsDecl>(
+                               custom_decls.data(), custom_decls.size()),
+                           es, options, &w, &claims, &indexed, &emitted,
+                           &iptc_order);
+        emit_portable_pass(PortablePassKind::Iptc, arena,
+                           std::span<const PortableCustomNsDecl>(
+                               custom_decls.data(), custom_decls.size()),
+                           es, options, &w, &claims, &indexed, &emitted,
+                           &iptc_order);
+        emit_portable_pass(PortablePassKind::ExistingXmp, arena,
+                           std::span<const PortableCustomNsDecl>(
+                               custom_decls.data(), custom_decls.size()),
+                           es, options, &w, &claims, &indexed, &emitted,
+                           &iptc_order);
     } else {
-        emit_portable_pass(PortablePassKind::Exif, arena, es, options, &w,
-                           &claims, &indexed, &emitted, &iptc_order);
-        emit_portable_pass(PortablePassKind::ExistingXmp, arena, es, options,
-                           &w, &claims, &indexed, &emitted, &iptc_order);
-        emit_portable_pass(PortablePassKind::Iptc, arena, es, options, &w,
-                           &claims, &indexed, &emitted, &iptc_order);
+        emit_portable_pass(PortablePassKind::Exif, arena,
+                           std::span<const PortableCustomNsDecl>(
+                               custom_decls.data(), custom_decls.size()),
+                           es, options, &w, &claims, &indexed, &emitted,
+                           &iptc_order);
+        emit_portable_pass(PortablePassKind::ExistingXmp, arena,
+                           std::span<const PortableCustomNsDecl>(
+                               custom_decls.data(), custom_decls.size()),
+                           es, options, &w, &claims, &indexed, &emitted,
+                           &iptc_order);
+        emit_portable_pass(PortablePassKind::Iptc, arena,
+                           std::span<const PortableCustomNsDecl>(
+                               custom_decls.data(), custom_decls.size()),
+                           es, options, &w, &claims, &indexed, &emitted,
+                           &iptc_order);
     }
 
     emit_portable_indexed_groups(&w, arena, &indexed,
@@ -3805,6 +3958,8 @@ make_xmp_sidecar_options(const XmpSidecarRequest& request) noexcept
     options.portable.include_exif         = request.include_exif;
     options.portable.include_iptc         = request.include_iptc;
     options.portable.include_existing_xmp = request.include_existing_xmp;
+    options.portable.existing_namespace_policy
+        = request.portable_existing_namespace_policy;
     options.portable.conflict_policy      = request.portable_conflict_policy;
     options.portable.exiftool_gpsdatetime_alias
         = request.portable_exiftool_gpsdatetime_alias;