@svta/cml-c2pa 1.3.0 → 1.4.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +5 -1
- package/dist/index.d.ts +35 -9
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +659 -272
- package/dist/index.js.map +1 -1
- package/package.json +5 -3
package/README.md
CHANGED
|
@@ -15,7 +15,7 @@ Supported C2PA segment validation methods:
|
|
|
15
15
|
npm i @svta/cml-c2pa
|
|
16
16
|
```
|
|
17
17
|
|
|
18
|
-
> **Note:** `@svta/cml-iso-bmff
|
|
18
|
+
> **Note:** `@svta/cml-iso-bmff` and `@svta/cml-utils` are peer dependencies. Most package managers install them automatically, but you may need to add them explicitly.
|
|
19
19
|
|
|
20
20
|
> **Note:** This library uses the [Web Crypto API](https://developer.mozilla.org/en-US/docs/Web/API/Web_Crypto_API) (`crypto.subtle`) to verify COSE signatures and compute BMFF hashes. In Node.js 20+, `crypto.subtle` is available globally. In browsers, it requires a [secure context](https://developer.mozilla.org/en-US/docs/Web/Security/Secure_Contexts) (HTTPS or `localhost`).
|
|
21
21
|
|
|
@@ -55,6 +55,10 @@ import { validateC2paInitSegment, validateC2paSegment } from '@svta/cml-c2pa'
|
|
|
55
55
|
async function validateVsiSegment(initUrl: string, segmentUrl: string): Promise<void> {
|
|
56
56
|
const initResponse = await fetch(initUrl)
|
|
57
57
|
const init = await validateC2paInitSegment(new Uint8Array(await initResponse.arrayBuffer()))
|
|
58
|
+
if (!init.isValid) {
|
|
59
|
+
console.error(init.errorCodes)
|
|
60
|
+
return
|
|
61
|
+
}
|
|
58
62
|
|
|
59
63
|
const segmentResponse = await fetch(segmentUrl)
|
|
60
64
|
const segmentBytes = new Uint8Array(await segmentResponse.arrayBuffer())
|
package/dist/index.d.ts
CHANGED
|
@@ -51,8 +51,12 @@ type C2paManifest = {
|
|
|
51
51
|
declare const C2paStatusCode: {
|
|
52
52
|
/** Assertion hash does not match the hashed URI in the claim (§15.10.3.1) */
|
|
53
53
|
readonly ASSERTION_HASHEDURI_MISMATCH: "assertion.hashedURI.mismatch";
|
|
54
|
-
/**
|
|
54
|
+
/** The assertion store has no box for a claim reference, or more than one box for its label (§8.4.1, §15.10.3.1) */
|
|
55
55
|
readonly ASSERTION_MISSING: "assertion.missing";
|
|
56
|
+
/** The manifest has more than one hard binding assertion (§9.1, §15.10.1.2) */
|
|
57
|
+
readonly ASSERTION_MULTIPLE_HARD_BINDINGS: "assertion.multipleHardBindings";
|
|
58
|
+
/** The assertion store holds an assertion that the claim does not reference (§15.10.3.1) */
|
|
59
|
+
readonly ASSERTION_UNDECLARED: "assertion.undeclared";
|
|
56
60
|
/** An action requiring an ingredient reference does not have one (§18.15.4.7) */
|
|
57
61
|
readonly ASSERTION_ACTION_INGREDIENT_MISMATCH: "assertion.action.ingredientMismatch";
|
|
58
62
|
/** Claim signature verification failed, or the signature carries no certificate (§15.7) */
|
|
@@ -61,6 +65,12 @@ declare const C2paStatusCode: {
|
|
|
61
65
|
readonly CLAIM_SIGNATURE_MISSING: "claimSignature.missing";
|
|
62
66
|
/** The manifest has no claim box (§15.6.1) */
|
|
63
67
|
readonly CLAIM_MISSING: "claim.missing";
|
|
68
|
+
/** The claim box holds CBOR that does not decode (§15.6.2) */
|
|
69
|
+
readonly CLAIM_CBOR_INVALID: "claim.cbor.invalid";
|
|
70
|
+
/** The claim box holds CBOR that is not a map (§15.6.2). The library does not check the fields of the claim. */
|
|
71
|
+
readonly CLAIM_MALFORMED: "claim.malformed";
|
|
72
|
+
/** The manifest has more than one claim box (§15.6.1) */
|
|
73
|
+
readonly CLAIM_MULTIPLE: "claim.multiple";
|
|
64
74
|
/** BMFF hash assertion or Merkle structure is malformed (§15.2.2.3) */
|
|
65
75
|
readonly ASSERTION_BMFFHASH_MALFORMED: "assertion.bmffHash.malformed";
|
|
66
76
|
/** BMFF content hash does not match the committed value (§15.2.2.3) */
|
|
@@ -103,7 +113,7 @@ declare const LiveVideoStatusCode: {
|
|
|
103
113
|
readonly INIT_INVALID: "livevideo.init.invalid";
|
|
104
114
|
/** C2PA Manifest Box failed standard validation (§19.7.1) */
|
|
105
115
|
readonly MANIFEST_INVALID: "livevideo.manifest.invalid";
|
|
106
|
-
/** Segment
|
|
116
|
+
/** Segment invalid: missing Manifest Box/emsg, signature/hash/key failure, or session key outside its validity period (§19.7) */
|
|
107
117
|
readonly SEGMENT_INVALID: "livevideo.segment.invalid";
|
|
108
118
|
/**
|
|
109
119
|
* Live video assertion field invalid: sequenceNumber or streamId mismatch
|
|
@@ -230,11 +240,19 @@ type InitSegmentValidation = {
|
|
|
230
240
|
* Validates a C2PA init segment: parses the manifest, extracts and verifies
|
|
231
241
|
* the certificate, validates the BMFF hard binding hash, verifies all
|
|
232
242
|
* session keys from the `c2pa.session-keys` assertion, and performs
|
|
233
|
-
* manifest integrity checks (assertion hashes,
|
|
234
|
-
*
|
|
243
|
+
* manifest integrity checks (assertion references and hashes, undeclared
|
|
244
|
+
* assertions, the hard binding count, duplicate manifest boxes, action
|
|
245
|
+
* ingredients, and claim signature verification).
|
|
235
246
|
*
|
|
236
247
|
* Only session keys with a valid signer binding and an unexpired validity period
|
|
237
|
-
* are included in the result.
|
|
248
|
+
* are included in the result. The result holds `sessionKeys` and `merkleMaps` only when
|
|
249
|
+
* every manifest integrity check passes, so check `isValid` before you use either list.
|
|
250
|
+
*
|
|
251
|
+
* The result includes `LiveVideoStatusCode.SESSIONKEY_INVALID` if the function finds an invalid
|
|
252
|
+
* session key (C2PA section 19.7.3). A session key is invalid if it does not conform to section 18.25.2,
|
|
253
|
+
* or if its signer binding fails verification. The function does not check every rule of section 18.25.2.
|
|
254
|
+
* An expired session key does not count as invalid. A `c2pa.session-keys` assertion without a session key,
|
|
255
|
+
* or with CBOR that does not decode, also causes `SESSIONKEY_INVALID`.
|
|
238
256
|
*
|
|
239
257
|
* @param bytes - Raw init segment bytes
|
|
240
258
|
* @returns Structured validation result (with `INIT_INVALID` error code if `mdat` box is present)
|
|
@@ -341,10 +359,13 @@ type SegmentValidationResult = {
|
|
|
341
359
|
*
|
|
342
360
|
* Returns `null` if the segment does not contain a C2PA EMSG box.
|
|
343
361
|
*
|
|
362
|
+
* A segment whose signature, content hash, or key validity does not verify
|
|
363
|
+
* returns the received `sequenceState` unchanged.
|
|
364
|
+
*
|
|
344
365
|
* @param segmentBytes - Raw segment bytes
|
|
345
366
|
* @param sessionKeys - Available session keys from the init segment
|
|
346
367
|
* @param sequenceState - Current sequence state for this stream
|
|
347
|
-
* @returns Validation result and
|
|
368
|
+
* @returns Validation result and the sequence state for the next call, or `null` if no C2PA EMSG box
|
|
348
369
|
*
|
|
349
370
|
* @example
|
|
350
371
|
* {@includeCode ../../test/segment/validateC2paSegment.test.ts#example}
|
|
@@ -415,16 +436,21 @@ type ManifestBoxValidationState = {
|
|
|
415
436
|
* Recomputes the `c2pa.hash.bmff.v3` content hash from the raw segment bytes and compares
|
|
416
437
|
* it against the expected hash in the manifest assertion. Checks live-video assertions
|
|
417
438
|
* (sequenceNumber, streamId, continuityMethod) and manifest-ID chain continuity.
|
|
439
|
+
* The live-video and BMFF hash fields of the result come only from assertions whose
|
|
440
|
+
* hash matches a claim reference. Check `isValid` before you use any field.
|
|
418
441
|
* A validator for an implementer-defined continuity method can be registered
|
|
419
442
|
* via {@link ManifestBoxValidationOptions}.
|
|
420
443
|
*
|
|
421
444
|
* This function is **pure** — it does not access any external state. The
|
|
422
445
|
* caller is responsible for persisting `nextManifestId` and `nextState`
|
|
423
|
-
* between calls.
|
|
446
|
+
* between calls. A segment that fails verification, is on another stream, or
|
|
447
|
+
* does not move the sequence number forward returns the received
|
|
448
|
+
* `lastManifestId` and `state` unchanged. A segment that fails only the
|
|
449
|
+
* continuity check still updates them.
|
|
424
450
|
*
|
|
425
451
|
* @param bytes - Raw segment bytes
|
|
426
|
-
* @param lastManifestId - Manifest ID from the
|
|
427
|
-
* @param state - Optional state from the
|
|
452
|
+
* @param lastManifestId - Manifest ID from the last segment that updated the state, or `null` for the first segment
|
|
453
|
+
* @param state - Optional state from the last segment that updated the state, for the streamId and sequenceNumber checks
|
|
428
454
|
* @param options - Optional custom continuity method validator
|
|
429
455
|
* @returns Validation result, the manifest ID, and state to persist for the next call
|
|
430
456
|
*
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","names":[],"sources":["../src/C2paAssertion.ts","../src/C2paSignatureInfo.ts","../src/C2paManifest.ts","../src/C2paStatusCode.ts","../src/cose/CoseKeyJwk.ts","../src/LiveVideoStatusCode.ts","../src/bmff/BmffHashExclusion.ts","../src/merkle/MerkleSegmentValidation.ts","../src/init/InitSegmentValidation.ts","../src/init/validateC2paInitSegment.ts","../src/vsi/SequenceState.ts","../src/segment/SegmentValidation.ts","../src/segment/validateC2paSegment.ts","../src/manifestbox/ManifestBoxValidation.ts","../src/manifestbox/validateC2paManifestBoxSegment.ts","../src/merkle/validateC2paMerkleSegment.ts"],"sourcesContent":[],"mappings":";;;;;;;AAKA;;KAAY,aAAA;;ECAZ,SAAY,IAAA,EAAA,OAAA;;;;;;;ADAZ;;KCAY,iBAAA;;EAAZ,SAAY,aAAA,EAAA,MAAA,GAAA,IAAA;;;;;ADAZ;;;;ACAY,KCGA,YAAA,GDHA;;;;ECGZ,SAAY,aAAA,EAIa,iBAAA;gCACM;;;;;;AFR/B;;;;ACAA;;;;ACGY,cCIC,cDAY,EAAA;;;;ECAzB,SAAa,iBAAA,EAAA,mBAAA;
|
|
1
|
+
{"version":3,"file":"index.d.ts","names":[],"sources":["../src/C2paAssertion.ts","../src/C2paSignatureInfo.ts","../src/C2paManifest.ts","../src/C2paStatusCode.ts","../src/cose/CoseKeyJwk.ts","../src/LiveVideoStatusCode.ts","../src/bmff/BmffHashExclusion.ts","../src/merkle/MerkleSegmentValidation.ts","../src/init/InitSegmentValidation.ts","../src/init/validateC2paInitSegment.ts","../src/vsi/SequenceState.ts","../src/segment/SegmentValidation.ts","../src/segment/validateC2paSegment.ts","../src/manifestbox/ManifestBoxValidation.ts","../src/manifestbox/validateC2paManifestBoxSegment.ts","../src/merkle/validateC2paMerkleSegment.ts"],"sourcesContent":[],"mappings":";;;;;;;AAKA;;KAAY,aAAA;;ECAZ,SAAY,IAAA,EAAA,OAAA;;;;;;;ADAZ;;KCAY,iBAAA;;EAAZ,SAAY,aAAA,EAAA,MAAA,GAAA,IAAA;;;;;ADAZ;;;;ACAY,KCGA,YAAA,GDHA;;;;ECGZ,SAAY,aAAA,EAIa,iBAAA;gCACM;;;;;;AFR/B;;;;ACAA;;;;ACGY,cCIC,cDAY,EAAA;;;;ECAzB,SAAa,iBAAA,EAAA,mBAAA;EAkCb;;;;ECxCA;;;;ECMA;EA0BA,SAAY,uBAAA,EAAA,wBAAsB;;;;EChClC,SAAY,kBAAA,EAAA,oBAEK;EAYjB;;;;ECXA;EAI2B,SAAA,4BAAA,EAAA,8BAAA;EACP;EAEW,SAAA,2BAAA,EAAA,6BAAA;CAAA;AAe/B;AASA;;;;AC1BY,KLgCA,cAAA,GAAiB,OKhCjB,CAEG,OL8B6B,cK9B7B,CAAA;;;;;;ARXf;;;KICY,UAAA;EHDZ,SAAY,GAAA,EAAA,MAAA;;;;ACGZ,CAAA;;;;;AFHA;;;;ACAA;;;;ACGY,cGIC,mBHAY,EAAA;;;;ECAzB,SAAa,gBAAA,EAAA,4BAAA;EAkCb;;;;ACxCA;;;;ECMA;EA0BA,SAAY,yBAAA,EAAA,oCAAsB;;;;EChClC,SAAY,kBAAA,EAAA,8BAEK;AAYjB,CAAA;;;;ACXA;;AAKoB,KFwBR,mBAAA,GAAsB,OExBd,CAAA,OFwB6B,mBExB7B,CAAA;;;;;;APTpB;;;KMCY,kBAAA;ELDZ,SAAY,MAAA,EAAA,MAAA;kBKGK;;;AJAjB;;;;ACIA;AAkCA;;;KG1BY,iBAAA;EFdZ,SAAY,KAAA,EAAA,MAAA;2BEgBc;;;;ANjB1B;;;;ACAA;KMIY,SAAA;;;ELDZ,SAAY,KAAA,EAAA,MAAA;4BKKe;qBACP;;EJFpB,SAAa,UAAA,EAAA,SIIkB,iBJJlB,EAAA;EAkCb,SAAY,gBAAA,EAAA,MAAgC;;;;ACxC5C;;;;ACMA;AA0BA;;;;AChCY,KCyBA,kBAAA,GDzBA;EAcZ,SAAY,aAAA,ECYa,WDVC,CAAA,MAAA,EAAA,MAAA,CAAA;;;;ACb1B;;;AAO+B,KAwBnB,uBAAA,GAxBmB;EAAA,SAAA,QAAA,EAAA,MAAA,GAAA,IAAA;EAe/B,SAAY,WAAA,EAAA,MAAA,GAAA,IAAA;EASZ,SAAY,OAAA,EAAA,OAAA;iCAIoB,sBAAsB;;;;;;ANvCtD;;;;ACGA;;KMMY,mBAAA;;ELFZ,SAAa,GAAA,EKIE,ULJF;EAkCb,SAAY,iBAAA,EAAA,MAAgC;;;;ACxC5C;;;;ACMA;AA0BA;;KGTY,qBAAA;qBACQ;EFxBpB,SAAY,WAAA,EEyBW,UFzBX,GAAA,IAEK;EAYjB,SAAY,UAAA,EAAA,MAAA,GAAA,IAAA;iCEaoB;gCACD;;EDzB/B,SAAY,UAAA,EAAA,SAAA,CC2BoB,mBD3BpB,GC2B0C,cD3B1C,CAAA,EAAA;CAIe;;;;;APR3B;;;;ACAA;;;;ACGA;;;;ACIA;AAkCA;;;;ACxCA;;;;ACMA;AA0BA;;;iBI+JsB,uBAAA,QAA+B,aAAa,QAAQ;;;;;AThM1E;;;;ACAA;;;;ACGA;;;KQQY,aAAA;EPJZ,SAAa,kBAAA,EAAA,MAAA,GAAA,IAAA;EAkCb,SAAY,aAAA,EO5Ba,WP4BmB,CAAA,MAAA,CAAA;;;;ACxC5C;;;;ACMA;AA0BA;;cKRa;;EJxBb,SAAY,KAAA,EAAA,OAAA;EAcZ;;;;ECXA;EAI2B,SAAA,YAAA,EAAA,cAAA;EACP;EAEW,SAAA,6BAAA,EAAA,+BAAA;CAAA;AAe/B;AASA;;;;AC1BY,KEkCA,wBAAA,GAA2B,OFhCxB,CAAA,OEgCuC,wBFhCvC,CAAA;AAaf;;;;;;;;KE6BY,wBAAA;;0BACyC,wBAAA,CAAyB;AD0I9E,CAAA,GAAsB;EAA+B,SAAA,OAAA,EAAA,KAAA;EAAqB,SAAA,MAAA,EAAA,OCtI7D,wBAAA,CAAyB,6BDsIoC,GAAA,OCrI7D,wBAAA,CAAyB,SDqIoC,GAAA,OCpI7D,wBAAA,CAAyB,YDoIoC;CAAR,GAAA;EAAA,SAAA,OAAA,EAAA,KAAA;0BChIvC,wBAAA,CAAyB;;;AArDpD,CAAA;;;;AVXA;;;;ACAA;;KUKY,uBAAA;;ETFZ,SAAY,UAAA,EAAA,MAAA;;;2BSOc;ERH1B,SAAa,OAAA,EAAA,OAAA;EAkCb,SAAY,UAAA,EAAA,SQ7BmB,mBR6BF,EAAA;;;;AHzC7B;;;;ACAA;;;;ACGA;;;;ACIA;AAkCA;;;;ACxCA;;;;ACMA;AA0BY,iBOGU,mBAAA,CPH2B,YAAA,EOIlC,UPJmB,EAAA,WAAA,EAAA,SOKX,mBPLW,EAAA,EAAA,aAAA,CAAA,EOMlB,aPNkB,CAAA,EOO/B,OPP+B,CAAA;mBOOJ;8BAAqD;;;;AZxCnF;;;;ACAA;;;KYMY,2BAAA;EXHZ,SAAY,QAAA,EWIQ,YXAK,GAAA,IAAA;;;wBWGF;EVHvB,SAAa,cAAA,EAAA,MAAA,GAAA,IAAA;EAkCb,SAAY,kBAAA,EAAA,MAAgC,GAAA,IAAA;;;;ECxC5C,SAAY,OAAA,EAAA,OAAA;iCSgBoB,sBAAsB;;;ARVtD;AA0BA;;;KQRY,8BAAA,wBACS,SAAS,oCACnB,2BACI;AP3Bf;AAcA;;;;ACXY,KM+BA,4BAAA,GN/BA;EAIe,SAAA,mBAAA,CAAA,EAAA;IACP,SAAA,MAAA,EAAA,MAAA;IAEW,SAAA,QAAA,EM2BV,8BN3BU;EAAA,CAAA;AAe/B,CAAA;AASA;;;;AC1BA;AAeA;;;AAIgC,KKsBpB,0BAAA,GLtBoB;EACD,SAAA,YAAA,CAAA,EAAA,MAAA,GAAA,IAAA;EAEC,SAAA,kBAAA,CAAA,EAAA,MAAA,GAAA,IAAA;CAAsB;;;;;AR/BtD;;;;ACAA;;;;ACGA;;;;ACIA;AAkCA;;;;ACxCA;;;;ACMA;AA0BA;;;;AChCA;AAcA;iBQ6KsB,8BAAA,QACd,mDAEC,sCACE,+BACR;mBACe;;EP9LlB,SAAY,SAAA,EOgMS,0BPhMT;CAIe,CAAA;;;;;APR3B;;;;ACAA;;;;ACGA;;;;ACIa,iBYwMS,yBAAA,CZxMT,YAAA,EYyME,UZzMF,EAAA,UAAA,EAAA,SY0MS,SZ1MT,EAAA,EAAA,KAAA,CAAA,EY2MJ,kBZ3MI,CAAA,EY4MV,OZ5MU,CAAA;EAkCb,SAAY,MAAA,EY2KM,uBZ3K0B;sBY4KvB"}
|