@svta/cml-c2pa 1.3.0 → 1.4.0

package/dist/index.js

@@ -1,7 +1,225 @@
-import { decode, decodeMultiple } from "cbor-x/decode";
-import { encode } from "cbor-x/encode";
 import { findIsoBox, readEmsg, readIsoBoxes } from "@svta/cml-iso-bmff";
 
+//#region src/cbor/readCborItem.ts
+const TEXT_DECODER$4 = /* @__PURE__ */ new TextDecoder("utf-8", { ignoreBOM: true });
+const MAJOR_UINT = 0;
+const MAJOR_NEGINT = 1;
+const MAJOR_BYTES = 2;
+const MAJOR_TEXT = 3;
+const MAJOR_ARRAY = 4;
+const MAJOR_MAP = 5;
+const MAJOR_SIMPLE = 7;
+const INFO_INDEFINITE = 31;
+const INDEFINITE_COUNT = -1;
+const BREAK = 255;
+const SIMPLE_FALSE = 20;
+const SIMPLE_TRUE = 21;
+const SIMPLE_NULL = 22;
+const SIMPLE_UNDEFINED = 23;
+const INFO_HALF_FLOAT = 25;
+const INFO_SINGLE_FLOAT = 26;
+const INFO_DOUBLE_FLOAT = 27;
+const MAX_NESTING_DEPTH = 128;
+const ASCII_FAST_PATH_MAX_LENGTH = 32;
+const MAX_SAFE_HIGH_WORD = 2097152;
+const TWO_POW_32 = 4294967296;
+/**
+* A CBOR tag (RFC 8949 section 3.4) with the bytes of the whole tagged item.
+*
+* A class keeps a tag distinct from a CBOR map with `tag` and `value` keys.
+*
+* @internal
+*/
+var CborTag = class {
+	constructor(tag, value, bytes) {
+		this.tag = tag;
+		this.value = value;
+		this.bytes = bytes;
+	}
+};
+function malformed() {
+	return /* @__PURE__ */ new RangeError("Malformed CBOR data item");
+}
+function incomplete() {
+	return /* @__PURE__ */ new RangeError("Incomplete CBOR data item");
+}
+function readUint32(bytes, offset) {
+	return (bytes[offset] << 24 >>> 0) + (bytes[offset + 1] << 16 | bytes[offset + 2] << 8 | bytes[offset + 3]);
+}
+function readArgument(reader, info) {
+	if (info < 24) return info;
+	if (info > INFO_DOUBLE_FLOAT) throw malformed();
+	const size = 1 << info - 24;
+	const { bytes } = reader;
+	const start = reader.offset;
+	if (start + size > bytes.length) throw incomplete();
+	reader.offset = start + size;
+	if (size === 1) return bytes[start];
+	if (size === 2) return bytes[start] << 8 | bytes[start + 1];
+	if (size === 4) return readUint32(bytes, start);
+	const high = readUint32(bytes, start);
+	const low = readUint32(bytes, start + 4);
+	if (high < MAX_SAFE_HIGH_WORD) return high * TWO_POW_32 + low;
+	return BigInt(high) * BigInt(TWO_POW_32) + BigInt(low);
+}
+function halfFloatToNumber(half) {
+	const sign = half & 32768 ? -1 : 1;
+	const exponent = half >> 10 & 31;
+	const fraction = half & 1023;
+	if (exponent === 0) return sign * fraction * 2 ** -24;
+	if (exponent === 31) return fraction ? NaN : sign * Infinity;
+	return sign * (1 + fraction / 1024) * 2 ** (exponent - 15);
+}
+function readSimple(reader, info) {
+	if (info < 24) {
+		if (info === SIMPLE_FALSE) return false;
+		if (info === SIMPLE_TRUE) return true;
+		if (info === SIMPLE_NULL) return null;
+		if (info === SIMPLE_UNDEFINED) return void 0;
+		throw malformed();
+	}
+	if (info < INFO_HALF_FLOAT || info > INFO_DOUBLE_FLOAT) throw malformed();
+	const size = 1 << info - 24;
+	const { bytes } = reader;
+	const start = reader.offset;
+	if (start + size > bytes.length) throw incomplete();
+	reader.offset = start + size;
+	if (info === INFO_HALF_FLOAT) return halfFloatToNumber(bytes[start] << 8 | bytes[start + 1]);
+	const view = new DataView(bytes.buffer, bytes.byteOffset + start, size);
+	return info === INFO_SINGLE_FLOAT ? view.getFloat32(0) : view.getFloat64(0);
+}
+function readBytes(reader, length) {
+	const { bytes } = reader;
+	const start = reader.offset;
+	if (typeof length !== "number" || length > bytes.length - start) throw incomplete();
+	reader.offset = start + length;
+	return bytes.subarray(start, reader.offset);
+}
+function readText(view) {
+	if (view.length > ASCII_FAST_PATH_MAX_LENGTH) return TEXT_DECODER$4.decode(view);
+	let text = "";
+	for (const byte of view) {
+		if (byte > 127) return TEXT_DECODER$4.decode(view);
+		text += String.fromCharCode(byte);
+	}
+	return text;
+}
+function enter(reader) {
+	if (++reader.depth > MAX_NESTING_DEPTH) throw new RangeError("CBOR nesting deeper than 128 levels");
+}
+function atBreak(reader) {
+	if (reader.offset >= reader.bytes.length) throw incomplete();
+	if (reader.bytes[reader.offset] !== BREAK) return false;
+	reader.offset++;
+	return true;
+}
+function readArray(reader, count) {
+	enter(reader);
+	const items = [];
+	if (count === INDEFINITE_COUNT) while (!atBreak(reader)) items.push(readItem(reader));
+	else {
+		if (typeof count !== "number" || count > reader.bytes.length - reader.offset) throw incomplete();
+		for (let i = 0; i < count; i++) items.push(readItem(reader));
+	}
+	reader.depth--;
+	return items;
+}
+function setEntry(map, key, value) {
+	if (key !== null && typeof key === "object") throw new RangeError("Unsupported CBOR map key");
+	const name = String(key);
+	if (name === "__proto__") Object.defineProperty(map, name, {
+		value,
+		enumerable: true,
+		writable: true,
+		configurable: true
+	});
+	else map[name] = value;
+}
+function readMap(reader, count) {
+	enter(reader);
+	const map = {};
+	if (count === INDEFINITE_COUNT) while (!atBreak(reader)) setEntry(map, readItem(reader), readItem(reader));
+	else {
+		if (typeof count !== "number" || count * 2 > reader.bytes.length - reader.offset) throw incomplete();
+		for (let i = 0; i < count; i++) setEntry(map, readItem(reader), readItem(reader));
+	}
+	reader.depth--;
+	return map;
+}
+function readTag(reader, tag, start) {
+	if (typeof tag !== "number") throw malformed();
+	enter(reader);
+	const value = readItem(reader);
+	reader.depth--;
+	return new CborTag(tag, value, reader.bytes.subarray(start, reader.offset));
+}
+function readItem(reader) {
+	const { bytes } = reader;
+	const start = reader.offset;
+	if (start >= bytes.length) throw incomplete();
+	const initialByte = bytes[start];
+	reader.offset = start + 1;
+	const majorType = initialByte >> 5;
+	const info = initialByte & 31;
+	if (majorType === MAJOR_SIMPLE) return readSimple(reader, info);
+	if (info === INFO_INDEFINITE) {
+		if (majorType === MAJOR_ARRAY) return readArray(reader, INDEFINITE_COUNT);
+		if (majorType === MAJOR_MAP) return readMap(reader, INDEFINITE_COUNT);
+		throw malformed();
+	}
+	const argument = readArgument(reader, info);
+	switch (majorType) {
+		case MAJOR_UINT: return argument;
+		case MAJOR_NEGINT: return typeof argument === "number" && argument < Number.MAX_SAFE_INTEGER ? -1 - argument : BigInt(-1) - BigInt(argument);
+		case MAJOR_BYTES: return readBytes(reader, argument);
+		case MAJOR_TEXT: return readText(readBytes(reader, argument));
+		case MAJOR_ARRAY: return readArray(reader, argument);
+		case MAJOR_MAP: return readMap(reader, argument);
+		default: return readTag(reader, argument, start);
+	}
+}
+/**
+* Reads the CBOR data item that starts at `offset` (RFC 8949 section 3).
+*
+* Integers with a magnitude up to `Number.MAX_SAFE_INTEGER` are numbers, larger ones are BigInts.
+* Byte strings are views of the input. Maps are plain objects with string keys. Every tag is a
+* {@link CborTag}. The work and the memory are bounded by the length of the input: no container is
+* allocated from a declared length, and the nesting of arrays, maps, and tags stops at 128 levels.
+*
+* @param bytes - CBOR bytes
+* @param offset - Offset of the first byte of the data item
+* @returns The decoded value and the offset after the last byte of the data item
+* @throws RangeError If the data item is malformed, incomplete, or nested too deep
+*
+* @internal
+*/
+function readCborItem(bytes, offset = 0) {
+	const reader = {
+		bytes,
+		offset,
+		depth: 0
+	};
+	return {
+		value: readItem(reader),
+		end: reader.offset
+	};
+}
+/**
+* Decodes CBOR bytes that hold exactly one data item.
+*
+* @param bytes - CBOR bytes of one data item
+* @returns The decoded value, see {@link readCborItem}
+* @throws RangeError If the data item is malformed, incomplete, nested too deep, or followed by trailing bytes
+*
+* @internal
+*/
+function decodeCbor(bytes) {
+	const item = readCborItem(bytes);
+	if (item.end !== bytes.length) throw new RangeError("Trailing bytes after CBOR data item");
+	return item.value;
+}
+
+//#endregion
 //#region src/LiveVideoStatusCode.ts
 /**
 * Standard C2PA failure status codes for live video validation,
@@ -23,36 +241,100 @@ const LiveVideoStatusCode = {
 	SESSIONKEY_INVALID: "livevideo.sessionkey.invalid"
 };
 
+//#endregion
+//#region src/cbor/projectCborTags.ts
+const TAG_DATE_TIME_STRING = 0;
+const TAG_EPOCH_DATE_TIME = 1;
+const MILLISECONDS_PER_SECOND$1 = 1e3;
+function setKey(map, key, value) {
+	if (key === "__proto__") Object.defineProperty(map, key, {
+		value,
+		enumerable: true,
+		writable: true,
+		configurable: true
+	});
+	else map[key] = value;
+}
+/**
+* Projects a tree from {@link readCborItem} to its public shape.
+*
+* Tag 0 with a text string and tag 1 with a number become a `Date` (RFC 8949 sections 3.4.1 and 3.4.2).
+* Every other {@link CborTag} becomes a plain `{ tag, value }` object. Arrays and maps are copied.
+* Byte strings and primitive values are returned as they are.
+*
+* @param value - A value from {@link readCborItem}
+* @returns The projected value
+*
+* @example
+* {@includeCode ../../test/cbor/cborEquivalence.test.ts#example}
+*
+* @internal
+*/
+function projectCborTags(value) {
+	if (value instanceof CborTag) {
+		const content = value.value;
+		if (value.tag === TAG_DATE_TIME_STRING && typeof content === "string") return new Date(content);
+		if (value.tag === TAG_EPOCH_DATE_TIME && typeof content === "number") return new Date(Math.round(content * MILLISECONDS_PER_SECOND$1));
+		return {
+			tag: value.tag,
+			value: projectCborTags(content)
+		};
+	}
+	if (Array.isArray(value)) return value.map(projectCborTags);
+	if (value !== null && typeof value === "object" && !(value instanceof Uint8Array)) {
+		const map = {};
+		for (const key of Object.keys(value)) setKey(map, key, projectCborTags(value[key]));
+		return map;
+	}
+	return value;
+}
+
+//#endregion
+//#region src/C2paStatusCode.ts
+/**
+* Standard C2PA validation status codes for manifest integrity checks,
+* as defined in the C2PA specification chapters 15 and 18.
+*
+* @see {@link https://c2pa.org/specifications/specifications/2.3/specs/C2PA_Specification.html#_claim_validation | C2PA Spec §15.10.3}
+*
+* @enum
+*
+* @public
+*/
+const C2paStatusCode = {
+	ASSERTION_HASHEDURI_MISMATCH: "assertion.hashedURI.mismatch",
+	ASSERTION_MISSING: "assertion.missing",
+	ASSERTION_MULTIPLE_HARD_BINDINGS: "assertion.multipleHardBindings",
+	ASSERTION_UNDECLARED: "assertion.undeclared",
+	ASSERTION_ACTION_INGREDIENT_MISMATCH: "assertion.action.ingredientMismatch",
+	CLAIM_SIGNATURE_MISMATCH: "claimSignature.mismatch",
+	CLAIM_SIGNATURE_MISSING: "claimSignature.missing",
+	CLAIM_MISSING: "claim.missing",
+	CLAIM_CBOR_INVALID: "claim.cbor.invalid",
+	CLAIM_MALFORMED: "claim.malformed",
+	CLAIM_MULTIPLE: "claim.multiple",
+	ASSERTION_BMFFHASH_MALFORMED: "assertion.bmffHash.malformed",
+	ASSERTION_BMFFHASH_MISMATCH: "assertion.bmffHash.mismatch"
+};
+
 //#endregion
 //#region src/cose/decodeCoseSign1.ts
-const COSE_SIGN1_TAG_SINGLE_BYTE = 210;
-const COSE_SIGN1_TAG_TWO_BYTE_FIRST = 216;
-const COSE_SIGN1_TAG_TWO_BYTE_SECOND = 18;
+const COSE_SIGN1_TAG = 18;
 const COSE_SIGN1_ARRAY_LENGTH = 4;
 const COSE_KEY_KID = 4;
 const COSE_KEY_ALG = 1;
-function coseGet$1(header, key) {
-	if (header instanceof Map) return header.get(key);
-	return header[key];
-}
-function stripCoseTag(bytes) {
-	if (bytes[0] === COSE_SIGN1_TAG_SINGLE_BYTE) return bytes.subarray(1);
-	if (bytes[0] === COSE_SIGN1_TAG_TWO_BYTE_FIRST && bytes[1] === COSE_SIGN1_TAG_TWO_BYTE_SECOND) return bytes.subarray(2);
-	return bytes;
-}
 function toUint8Array$1(value) {
 	if (value instanceof Uint8Array) return value;
-	if (Array.isArray(value)) return new Uint8Array(value);
-	throw new Error(`Expected Uint8Array or number[], got ${typeof value}`);
+	throw new Error(`Expected a byte string, got ${typeof value}`);
 }
 /**
-* Decodes a `COSE_Sign1` structure from raw bytes (RFC 9052).
+* Decodes a `COSE_Sign1_Tagged` structure from raw bytes (RFC 9052 section 4.2).
 *
-* Handles CBOR tag 18 in both single-byte (0xD2) and two-byte (0xD8 0x12) form.
+* The bytes must carry CBOR tag 18 in any encoding length (C2PA section 14).
 *
-* @param coseBytes - Raw COSE_Sign1 bytes, optionally prefixed with CBOR tag 18
+* @param coseBytes - Raw `COSE_Sign1_Tagged` bytes
 * @returns The decoded COSE_Sign1 structure
-* @throws If the bytes do not represent a valid COSE_Sign1 structure
+* @throws If the bytes do not represent a `COSE_Sign1` structure with CBOR tag 18
 *
 * @example
 * {@includeCode ../../test/cose/decodeCoseSign1.test.ts#example}
@@ -61,16 +343,18 @@ function toUint8Array$1(value) {
 */
 function decodeCoseSign1(coseBytes) {
 	try {
-		const coseArray = decode(stripCoseTag(coseBytes));
+		const tagged = decodeCbor(coseBytes);
+		if (!(tagged instanceof CborTag) || tagged.tag !== COSE_SIGN1_TAG) throw new Error("Invalid COSE_Sign1 structure: expected CBOR tag 18");
+		const coseArray = tagged.value;
 		if (!Array.isArray(coseArray) || coseArray.length !== COSE_SIGN1_ARRAY_LENGTH) throw new Error("Invalid COSE_Sign1 structure: expected array with 4 elements");
 		const [protectedRaw, unprotectedRaw, payloadRaw, signatureRaw] = coseArray;
 		const protectedBytes = toUint8Array$1(protectedRaw);
 		let protectedHeader = {};
-		if (protectedBytes.length > 0) protectedHeader = decode(protectedBytes);
+		if (protectedBytes.length > 0) protectedHeader = decodeCbor(protectedBytes);
 		const unprotectedHeader = unprotectedRaw ?? {};
-		const kidRaw = coseGet$1(protectedHeader, COSE_KEY_KID) ?? coseGet$1(unprotectedHeader, COSE_KEY_KID) ?? null;
+		const kidRaw = protectedHeader[COSE_KEY_KID] ?? unprotectedHeader[COSE_KEY_KID] ?? null;
 		const kid = kidRaw != null ? toUint8Array$1(kidRaw) : null;
-		const alg = coseGet$1(protectedHeader, COSE_KEY_ALG) ?? coseGet$1(unprotectedHeader, COSE_KEY_ALG) ?? null;
+		const alg = protectedHeader[COSE_KEY_ALG] ?? unprotectedHeader[COSE_KEY_ALG] ?? null;
 		return {
 			protectedBytes,
 			protectedHeader,
@@ -234,14 +518,16 @@ function matchesUuid(usertype, expected) {
 }
 /** @internal */
 function toUint8Array(value) {
-	if (value instanceof Uint8Array) return value;
-	if (Array.isArray(value)) return new Uint8Array(value);
-	return null;
+	return value instanceof Uint8Array ? value : null;
 }
 /** @internal */
 function asInteger(value) {
 	return typeof value === "number" && Number.isInteger(value) ? value : null;
 }
+/** @internal */
+function asUnsignedInteger(value) {
+	return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : null;
+}
 function isC2paUuid(usertype) {
 	return matchesUuid(usertype, C2PA_MANIFEST_UUID) || matchesUuid(usertype, JUMBF_UUID);
 }
@@ -258,7 +544,7 @@ function findC2paUuidBox(boxes) {
 }
 const FULLBOX_HEADER_SIZE = 4;
 const AUX_UUID_OFFSET_SIZE = 8;
-const TEXT_DECODER$2 = new TextDecoder();
+const TEXT_DECODER$2 = /* @__PURE__ */ new TextDecoder();
 /** @internal */
 function readUuidBoxPurpose(payload) {
 	if (payload.length < FULLBOX_HEADER_SIZE) return null;
@@ -348,12 +634,12 @@ function readElementRaw(bytes, offset) {
 //#endregion
 //#region src/x509/extractCertificateInfo.ts
 const TEXT_DECODER$1 = /* @__PURE__ */ new TextDecoder();
-const OID_COMMON_NAME = new Uint8Array([
+const OID_COMMON_NAME = /* @__PURE__ */ new Uint8Array([
 	85,
 	4,
 	3
 ]);
-const OID_ORG_NAME = new Uint8Array([
+const OID_ORG_NAME = /* @__PURE__ */ new Uint8Array([
 	85,
 	4,
 	10
@@ -487,8 +773,10 @@ function parseAssertionsInternal(assertionStoreBoxes) {
 		if (!label) continue;
 		const contentBox = inner.find((b) => b.type === "cbor" || b.type === "json" || b.type === "jumc" || b.type === "jp2c" || b.type === "bidb");
 		let data = null;
+		let taggedData;
 		if (contentBox) if (contentBox.type === "cbor") try {
-			data = decode(contentBox.data);
+			taggedData = decodeCbor(contentBox.data);
+			data = projectCborTags(taggedData);
 		} catch {
 			data = contentBox.data;
 		}
@@ -501,7 +789,8 @@ function parseAssertionsInternal(assertionStoreBoxes) {
 		assertions.push({
 			label,
 			data,
-			rawBoxPayload: box.data
+			rawBoxPayload: box.data,
+			taggedData
 		});
 	}
 	return assertions;
@@ -535,6 +824,25 @@ function parseSignatureInfo(signatureBytes) {
 		};
 	}
 }
+function readClaim(bytes) {
+	let value;
+	try {
+		value = decodeCbor(bytes);
+	} catch {
+		return {
+			data: null,
+			code: C2paStatusCode.CLAIM_CBOR_INVALID
+		};
+	}
+	if (value === null || typeof value !== "object" || Object.getPrototypeOf(value) !== Object.prototype) return {
+		data: null,
+		code: C2paStatusCode.CLAIM_MALFORMED
+	};
+	return {
+		data: projectCborTags(value),
+		code: null
+	};
+}
 function extractClaimAssertionRefs(claimData) {
 	const created = claimData["created_assertions"];
 	const gathered = claimData["gathered_assertions"];
@@ -550,10 +858,10 @@ function extractClaimAssertionRefs(claimData) {
 		const e = entry;
 		const url = e["url"];
 		const hash = e["hash"];
-		if (!url || !hash) continue;
+		if (!url || hash == null) continue;
 		refs.push({
 			url,
-			hash: hash instanceof Uint8Array ? hash : new Uint8Array(hash),
+			hash: hash instanceof Uint8Array ? hash : new Uint8Array(0),
 			alg: e["alg"] ?? null
 		});
 	}
@@ -590,8 +898,12 @@ function readC2paManifest(bytes, preParsedBoxes) {
 	const manifestBoxes = resolveManifestBoxes(jumbfBoxes);
 	let claimData = null;
 	let claimCborBytes = null;
+	let claimCode = null;
 	let internalAssertions = [];
 	let signatureBytes = null;
+	let claimBoxes = 0;
+	let assertionStores = 0;
+	let signatureBoxes = 0;
 	for (const box of manifestBoxes) {
 		if (box.type !== "jumb") continue;
 		const inner = parseJumbfBoxes(box.data);
@@ -600,19 +912,30 @@ function readC2paManifest(bytes, preParsedBoxes) {
 		const label = parseJumbfLabel(jumd.data);
 		if (!label) continue;
 		if (label === "c2pa.claim" || label === "c2pa.claim.v2") {
+			claimBoxes++;
 			const contentBox = inner.find((b) => b.type === "cbor");
 			if (contentBox) {
 				claimCborBytes = contentBox.data;
-				try {
-					claimData = decode(contentBox.data);
-				} catch {}
+				const claim = readClaim(contentBox.data);
+				claimData = claim.data;
+				claimCode = claim.code;
 			}
-		} else if (label === "c2pa.assertions") internalAssertions = parseAssertionsInternal(inner);
-		else if (label === "c2pa.signature") {
+		} else if (label === "c2pa.assertions") {
+			assertionStores++;
+			internalAssertions = parseAssertionsInternal(inner);
+		} else if (label === "c2pa.signature") {
+			signatureBoxes++;
 			const contentBox = inner.find((b) => b.type === "cbor" || b.type === "jumc");
 			if (contentBox) signatureBytes = contentBox.data;
 		}
 	}
+	if (claimBoxes > 1) {
+		claimData = null;
+		claimCborBytes = null;
+		claimCode = C2paStatusCode.CLAIM_MULTIPLE;
+	}
+	if (assertionStores > 1) internalAssertions = [];
+	if (signatureBoxes > 1) signatureBytes = null;
 	const { issuer, certNotBefore } = parseSignatureInfo(signatureBytes);
 	const instanceId = claimData?.["instanceID"] ?? claimData?.["instance_id"] ?? null;
 	const claimGenerator = claimData?.["claim_generator"] ?? claimData?.["claimGenerator"] ?? null;
@@ -635,6 +958,7 @@ function readC2paManifest(bytes, preParsedBoxes) {
 		},
 		claimAssertionRefs,
 		claimCborBytes,
+		claimCode,
 		signatureBytes,
 		assertions: internalAssertions
 	};
@@ -746,27 +1070,53 @@ async function computeBmffHash(segmentBytes, options) {
 }
 
 //#endregion
-//#region src/C2paStatusCode.ts
+//#region src/bmff/parseExclusions.ts
+function isMap(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function parseConstraints(rawConstraints) {
+	if (!Array.isArray(rawConstraints)) return null;
+	const constraints = [];
+	for (const rawConstraint of rawConstraints) {
+		if (!isMap(rawConstraint)) return null;
+		const offset = asUnsignedInteger(rawConstraint["offset"]);
+		const value = toUint8Array(rawConstraint["value"]);
+		if (offset === null || !value) return null;
+		constraints.push({
+			offset,
+			value
+		});
+	}
+	return constraints;
+}
 /**
-* Standard C2PA validation status codes for manifest integrity checks,
-* as defined in the C2PA specification chapters 15 and 18.
-*
-* @see {@link https://c2pa.org/specifications/specifications/2.3/specs/C2PA_Specification.html#_claim_validation | C2PA Spec §15.10.3}
+* Parses the `exclusions` array of a `c2pa.hash.bmff.v3` assertion (C2PA section 18.6).
 *
-* @enum
+* @param rawExclusions - The decoded `exclusions` field
+* @returns The exclusions, an empty array for an absent field, or `null` if the field does not conform
 *
-* @public
+* @internal
 */
-const C2paStatusCode = {
-	ASSERTION_HASHEDURI_MISMATCH: "assertion.hashedURI.mismatch",
-	ASSERTION_MISSING: "assertion.missing",
-	ASSERTION_ACTION_INGREDIENT_MISMATCH: "assertion.action.ingredientMismatch",
-	CLAIM_SIGNATURE_MISMATCH: "claimSignature.mismatch",
-	CLAIM_SIGNATURE_MISSING: "claimSignature.missing",
-	CLAIM_MISSING: "claim.missing",
-	ASSERTION_BMFFHASH_MALFORMED: "assertion.bmffHash.malformed",
-	ASSERTION_BMFFHASH_MISMATCH: "assertion.bmffHash.mismatch"
-};
+function parseExclusions(rawExclusions) {
+	if (rawExclusions == null) return [];
+	if (!Array.isArray(rawExclusions)) return null;
+	const exclusions = [];
+	for (const rawExclusion of rawExclusions) {
+		if (!isMap(rawExclusion) || typeof rawExclusion["xpath"] !== "string") return null;
+		const xpath = rawExclusion["xpath"];
+		if (rawExclusion["data"] == null) {
+			exclusions.push({ xpath });
+			continue;
+		}
+		const constraints = parseConstraints(rawExclusion["data"]);
+		if (!constraints) return null;
+		exclusions.push(constraints.length > 0 ? {
+			xpath,
+			data: constraints
+		} : { xpath });
+	}
+	return exclusions;
+}
 
 //#endregion
 //#region src/extractManifestCertificate.ts
@@ -836,6 +1186,8 @@ function validateActionIngredients(assertions) {
 *
 * Handles both absolute (`self#jumbf=/c2pa/<manifest>/c2pa.assertions/<label>`)
 * and relative URI forms by returning the last path segment.
+*
+* @internal
 */
 function extractLabelFromUrl(url) {
 	const fragmentIndex = url.indexOf("#jumbf=");
@@ -844,35 +1196,64 @@ function extractLabelFromUrl(url) {
 	return lastSlash >= 0 ? path.substring(lastSlash + 1) : path;
 }
 /**
-* Validates assertion hashes and presence per C2PA §15.10.3.1.
+* Validates assertion hashes and presence per C2PA §8.4.1 and §15.10.3.1.
 *
 * For each assertion referenced in the claim's hashed URI list:
-* - Checks that the assertion exists in the assertion store (`assertion.missing`)
+* - Resolves the label to a box in the assertion store. If the store holds no box
+*   with that label, or more than one, the reference is unresolved (`assertion.missing`, §8.4.1).
 * - Recomputes the hash of the raw JUMBF box payload and compares it to the
-*   expected hash from the claim (`assertion.hashedURI.mismatch`)
+*   expected hash from the claim (`assertion.hashedURI.mismatch`).
+*
+* The `verified` list holds only the assertions that resolved to one box with a matching
+* hash. A caller that consumes an assertion by label must read it from `verified`, so that
+* an unverified or ambiguous box is never used.
 *
 * @param claimRefs - Hashed URI references from the claim
 * @param assertions - Parsed assertions with preserved raw box payloads
-* @returns Array of C2PA status codes for any failures found
+* @returns The status codes for any failures found, and the verified assertions
 *
 * @internal
 */
 async function validateAssertionHashes(claimRefs, assertions) {
-	if (claimRefs.length === 0) return [];
-	const assertionsByLabel = /* @__PURE__ */ new Map();
-	for (const assertion of assertions) assertionsByLabel.set(assertion.label, assertion);
-	const codes = [];
+	if (claimRefs.length === 0) return {
+		codes: [],
+		verified: []
+	};
+	const boxesByLabel = /* @__PURE__ */ new Map();
+	for (const assertion of assertions) {
+		const existing = boxesByLabel.get(assertion.label);
+		if (existing) existing.push(assertion);
+		else boxesByLabel.set(assertion.label, [assertion]);
+	}
 	const hashChecks = claimRefs.map(async (ref) => {
 		const label = extractLabelFromUrl(ref.url);
-		const assertion = assertionsByLabel.get(label);
-		if (!assertion) return C2paStatusCode.ASSERTION_MISSING;
+		const boxes = boxesByLabel.get(label);
+		if (!boxes || boxes.length !== 1) return {
+			code: C2paStatusCode.ASSERTION_MISSING,
+			verified: null
+		};
+		const assertion = boxes[0];
 		const alg = ref.alg ? normalizeAlgorithmName(ref.alg) : "SHA-256";
-		if (!hashesEqual(new Uint8Array(await crypto.subtle.digest(alg, assertion.rawBoxPayload)), ref.hash)) return C2paStatusCode.ASSERTION_HASHEDURI_MISMATCH;
-		return null;
+		if (!hashesEqual(new Uint8Array(await crypto.subtle.digest(alg, assertion.rawBoxPayload)), ref.hash)) return {
+			code: C2paStatusCode.ASSERTION_HASHEDURI_MISMATCH,
+			verified: null
+		};
+		return {
+			code: null,
+			verified: assertion
+		};
 	});
 	const results = await Promise.all(hashChecks);
-	for (const result of results) if (result) codes.push(result);
-	return codes;
+	const codes = [];
+	const verified = [];
+	for (const result of results) {
+		if (result.code) codes.push(result.code);
+		if (result.verified) verified.push(result.verified);
+	}
+	return {
+		codes,
+		verified
+	};
 }
 
 //#endregion
@@ -1001,20 +1382,33 @@ function buildSigStructure(protectedBytes, payload, externalAad = new Uint8Array
 	result.set(payload, offset);
 	return result;
 }
+/**
+* Encodes bytes as a CBOR byte string (RFC 8949 §3.1, major type 2), without a tag.
+*
+* @param bytes - Bytes to encode
+* @returns The byte string header, followed by `bytes`
+*
+* @internal
+*/
+function encodeCborByteString(bytes) {
+	const result = new Uint8Array(byteStringHeaderSize(bytes.length) + bytes.length);
+	result.set(bytes, writeByteStringHeader(result, 0, bytes.length));
+	return result;
+}
 
 //#endregion
 //#region src/cose/verifyCoseSign1.ts
 const DER_SEQUENCE_TAG = 48;
 const DER_INTEGER_TAG = 2;
 const CURVE_COMPONENT_BYTES = {
-	[CURVE_P256]: 32,
-	[CURVE_P384]: 48,
-	[CURVE_P521]: 66
+	"P-256": 32,
+	"P-384": 48,
+	"P-521": 66
 };
 const RSA_PSS_SALT_LENGTH = {
-	[HASH_SHA256]: 32,
-	[HASH_SHA384]: 48,
-	[HASH_SHA512]: 64
+	"SHA-256": 32,
+	"SHA-384": 48,
+	"SHA-512": 64
 };
 function getComponentSize(publicKey) {
 	const curve = publicKey.algorithm.namedCurve;
@@ -1168,7 +1562,7 @@ function extractCertificateSpki(certDER) {
 
 //#endregion
 //#region src/x509/normalizeRsaPssSpki.ts
-const OID_RSASSA_PSS = new Uint8Array([
+const OID_RSASSA_PSS = /* @__PURE__ */ new Uint8Array([
 	6,
 	9,
 	42,
@@ -1181,7 +1575,7 @@ const OID_RSASSA_PSS = new Uint8Array([
 	1,
 	10
 ]);
-const RSA_ENCRYPTION_ALGORITHM_ID = new Uint8Array([
+const RSA_ENCRYPTION_ALGORITHM_ID = /* @__PURE__ */ new Uint8Array([
 	48,
 	13,
 	6,
@@ -1286,13 +1680,26 @@ async function verifyClaimSignature(signatureBytes, claimCborBytes, certificateD
 
 //#endregion
 //#region src/claim/validateManifestIntegrity.ts
+const HARD_BINDING_LABELS = /* @__PURE__ */ new Set([
+	"c2pa.hash.data",
+	"c2pa.hash.boxes",
+	"c2pa.hash.collection.data",
+	"c2pa.hash.bmff.v2",
+	"c2pa.hash.bmff.v3"
+]);
+const ASSERTION_INSTANCE_SUFFIX = /__\d+$/;
 /**
 * Checks the claim signature per §15.7 and fails closed: a manifest without a claim box,
 * without a `c2pa.signature` box, or with a signature that carries no certificate or does
-* not verify over the claim bytes, is reported as a failure.
+* not verify over the claim bytes, is reported as a failure. A manifest with more than one
+* claim box reports `CLAIM_MULTIPLE` through `claimCode` (§15.6.1), so no signature check runs.
 */
-async function validateClaimSignature({ claimCborBytes, signatureBytes }) {
+async function validateClaimSignature({ claimCborBytes, claimCode, signatureBytes }) {
 	const certificate = signatureBytes ? extractCertificateFromSignatureBytes(signatureBytes) : null;
+	if (claimCode === C2paStatusCode.CLAIM_MULTIPLE) return {
+		code: null,
+		certificate
+	};
 	if (!claimCborBytes) return {
 		code: C2paStatusCode.CLAIM_MISSING,
 		certificate
@@ -1313,27 +1720,37 @@ async function validateClaimSignature({ claimCborBytes, signatureBytes }) {
 /**
 * Validates the integrity of a C2PA manifest per Chapter 15 and Chapter 18.
 *
-* Runs four validation checks in parallel where possible:
-* 1. Assertion hash verification (§15.10.3.1)
-* 2. Missing assertion detection (§15.10.3.1)
-* 3. Action ingredient validation (§18.15.4.7)
-* 4. Claim signature verification (§15.7)
+* Runs these checks, in parallel where possible:
+* 1. Assertion reference resolution and hash verification (§8.4.1, §15.10.3.1)
+* 2. Undeclared assertion detection (§15.10.3.1)
+* 3. Hard binding count (§9.1, §15.10.1.2)
+* 4. Action ingredient validation (§18.15.4.7)
+* 5. Claim signature verification (§15.7)
 *
 * The claim signature is verified with the end-entity certificate from the `x5chain`
 * header of the signature. The certificate is not checked against a trust list.
 *
 * @param internal - Enriched manifest data with raw assertion bytes and claim references
-* @returns The status codes for any failures found, and the certificate of the claim signature
+* @returns The status codes for any failures found, the certificate of the claim signature, and the claim-verified assertions
 *
 * @internal
 */
 async function validateManifestIntegrity(internal) {
-	const [assertionHashCodes, signature] = await Promise.all([validateAssertionHashes(internal.claimAssertionRefs, internal.assertions), validateClaimSignature(internal)]);
-	const codes = [...assertionHashCodes, ...validateActionIngredients(internal.assertions)];
+	const [assertionHashes, signature] = await Promise.all([validateAssertionHashes(internal.claimAssertionRefs, internal.assertions), validateClaimSignature(internal)]);
+	const codes = [...assertionHashes.codes, ...validateActionIngredients(internal.assertions)];
+	let hardBindingCount = 0;
+	for (const assertion of internal.assertions) if (HARD_BINDING_LABELS.has(assertion.label.replace(ASSERTION_INSTANCE_SUFFIX, ""))) hardBindingCount++;
+	if (hardBindingCount > 1) codes.push(C2paStatusCode.ASSERTION_MULTIPLE_HARD_BINDINGS);
+	if (internal.claimCborBytes && !internal.claimCode) {
+		const referencedLabels = new Set(internal.claimAssertionRefs.map((ref) => extractLabelFromUrl(ref.url)));
+		if (internal.assertions.some((assertion) => !referencedLabels.has(assertion.label))) codes.push(C2paStatusCode.ASSERTION_UNDECLARED);
+	}
 	if (signature.code) codes.push(signature.code);
+	if (internal.claimCode) codes.push(internal.claimCode);
 	return {
-		codes,
-		certificate: signature.certificate
+		codes: [...new Set(codes)],
+		certificate: signature.certificate,
+		verifiedAssertions: assertionHashes.verified
 	};
 }
 
@@ -1352,12 +1769,7 @@ const OKP_CURVE_NAMES = {
 	6: "Ed25519",
 	7: "Ed448"
 };
-function coseGet(key, intKey) {
-	if (key instanceof Map) return key.get(intKey);
-	return key[intKey];
-}
-function toBase64Url(value) {
-	const bytes = value instanceof Uint8Array ? value : new Uint8Array(value);
+function toBase64Url(bytes) {
 	let binary = "";
 	for (const byte of bytes) binary += String.fromCharCode(byte);
 	return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
@@ -1366,8 +1778,7 @@ function toBase64Url(value) {
 * Converts a COSE public key (RFC 9052 / IANA COSE Key registry) to JWK format.
 *
 * Supports EC2 keys (P-256, P-384, P-521) and OKP keys (Ed25519, Ed448, X25519, X448).
-* Input may be a `Map\<number, unknown\>` (from CBOR decoders like cbor-x) or a plain
-* object with integer keys.
+* The input is a plain object whose keys are the integer labels of the COSE key, as the CBOR reader decodes a map.
 *
 * @param coseKey - COSE key structure as decoded from a C2PA `c2pa.session-keys` assertion
 * @returns JWK representation of the public key
@@ -1380,13 +1791,13 @@ function toBase64Url(value) {
 */
 function convertCoseKeyToJwk(coseKey) {
 	const key = coseKey;
-	const kty = coseGet(key, 1);
-	const crv = coseGet(key, -1);
-	const x = coseGet(key, -2);
+	const kty = key[1];
+	const crv = key[-1];
+	const x = key[-2];
 	if (kty === EC2_KEY_TYPE) {
 		const curveName = EC_CURVE_NAMES[crv];
 		if (!curveName) throw new Error(`Unsupported EC curve: ${crv}`);
-		const y = coseGet(key, -3);
+		const y = key[-3];
 		if (!(x instanceof Uint8Array)) throw new Error("EC2 key missing or invalid x coordinate");
 		if (!(y instanceof Uint8Array)) throw new Error("EC2 key missing or invalid y coordinate");
 		return {
@@ -1399,6 +1810,7 @@ function convertCoseKeyToJwk(coseKey) {
 	if (kty === OKP_KEY_TYPE) {
 		const curveName = OKP_CURVE_NAMES[crv];
 		if (!curveName) throw new Error(`Unsupported OKP curve: ${crv}`);
+		if (!(x instanceof Uint8Array)) throw new Error("OKP key missing or invalid x coordinate");
 		return {
 			kty: "OKP",
 			crv: curveName,
@@ -1420,17 +1832,24 @@ function resolveImportAlgorithm(jwk) {
 
 //#endregion
 //#region src/cose/verifySignerBinding.ts
+async function verifyPayload(coseSign1, payload, publicKey) {
+	const embeddedPayload = coseSign1.payload;
+	return (!embeddedPayload?.length || hashesEqual(embeddedPayload, payload)) && verifyCoseSign1(coseSign1, payload, publicKey);
+}
 /**
-* Verifies a C2PA signer binding — a `COSE_Sign1` structure that proves
-* a session key was authorized by the content signer (C2PA spec §18.25.2).
+* Verifies a C2PA signer binding (C2PA spec §18.25.2). A signer binding is a
+* `COSE_Sign1` structure that proves the content signer authorized a session key.
 *
-* The `Sig_Structure` payload is `CBOR(bstr(signerCertBytes))` per the C2PA spec.
+* The `Sig_Structure` payload is the end-entity certificate. The function also accepts
+* a payload that encodes the certificate as a CBOR byte string.
+* The payload field of the `COSE_Sign1` structure must be nil, empty, or equal to
+* the `Sig_Structure` payload that verifies.
 * DER-encoded ECDSA signatures are automatically normalized to raw format.
 *
 * @param signerBindingBytes - Raw `COSE_Sign1` bytes of the signer binding
 * @param sessionCoseKey - COSE public key from the `c2pa.session-keys` assertion
 * @param signerCertBytes - DER-encoded end-entity certificate (from `x5chain`)
-* @returns `true` if the signer binding signature is valid
+* @returns `true` if the signature and the payload field of the signer binding are valid
 * @throws If the COSE key type is not supported or decoding fails
 *
 * @example
@@ -1442,45 +1861,8 @@ async function verifySignerBinding(signerBindingBytes, sessionCoseKey, signerCer
 	const coseSign1 = decodeCoseSign1(signerBindingBytes);
 	const jwk = convertCoseKeyToJwk(sessionCoseKey);
 	const publicKey = await crypto.subtle.importKey("jwk", jwk, resolveImportAlgorithm(jwk), false, ["verify"]);
-	return verifyCoseSign1(coseSign1, encode(signerCertBytes), publicKey);
-}
-
-//#endregion
-//#region src/bmff/parseExclusions.ts
-function parseConstraints(rawConstraints) {
-	if (!Array.isArray(rawConstraints)) return [];
-	const constraints = [];
-	for (const c of rawConstraints) {
-		if (!c || typeof c !== "object") continue;
-		const record = c;
-		if (typeof record["offset"] !== "number") continue;
-		const value = toUint8Array(record["value"]);
-		if (value) constraints.push({
-			offset: record["offset"],
-			value
-		});
-	}
-	return constraints;
-}
-/**
-* Parses the `exclusions` array of a `c2pa.hash.bmff.v3` assertion.
-*
-* @internal
-*/
-function parseExclusions(rawExclusions) {
-	if (!Array.isArray(rawExclusions)) return [];
-	const exclusions = [];
-	for (const exc of rawExclusions) {
-		if (!exc || typeof exc !== "object") continue;
-		const record = exc;
-		if (typeof record["xpath"] !== "string") continue;
-		const constraints = parseConstraints(record["data"]);
-		exclusions.push(constraints.length > 0 ? {
-			xpath: record["xpath"],
-			data: constraints
-		} : { xpath: record["xpath"] });
-	}
-	return exclusions;
+	if (await verifyPayload(coseSign1, signerCertBytes, publicKey)) return true;
+	return verifyPayload(coseSign1, encodeCborByteString(signerCertBytes), publicKey);
 }
 
 //#endregion
@@ -1499,6 +1881,7 @@ function extractMerkleMaps(bmffHashAssertionData) {
 	const rawMerkle = bmffHashAssertionData["merkle"];
 	if (!Array.isArray(rawMerkle) || rawMerkle.length === 0) return null;
 	const exclusions = parseExclusions(bmffHashAssertionData["exclusions"]);
+	if (!exclusions) return null;
 	const assertionAlg = bmffHashAssertionData["alg"];
 	const offsetPrefixSize = bmffHashAssertionData["hash"] == null ? 8 : 0;
 	const maps = [];
@@ -1561,42 +1944,26 @@ async function validateMerkleMaps(bytes, assertion, codes) {
 const BMFF_HASH_ASSERTION_LABEL$1 = "c2pa.hash.bmff.v3";
 const SESSION_KEYS_ASSERTION_LABEL = "c2pa.session-keys";
 const COSE_KEY_ID_LABEL = 2;
-const CBOR_TAGGED_KEY = "@@TAGGED@@";
-function extractCborTaggedValue(value) {
-	if (typeof value !== "object" || value === null) return null;
-	const obj = value;
-	if (typeof obj["tag"] === "number" && "value" in obj) return obj["value"];
-	const tagged = obj[CBOR_TAGGED_KEY];
-	if (Array.isArray(tagged) && tagged.length === 2) return tagged[1];
-	return null;
-}
 function normalizeToUint8Array(value) {
 	if (value instanceof Uint8Array) return value;
-	if (Array.isArray(value)) return new Uint8Array(value);
-	if (extractCborTaggedValue(value) !== null) return encode(value);
+	if (value instanceof CborTag) return value.bytes;
 	throw new Error("Cannot convert value to Uint8Array");
 }
 function ensureDecodedCbor(value) {
-	if (value instanceof Uint8Array) return decode(value);
-	if (Array.isArray(value) && value.length > 0 && typeof value[0] === "number") return decode(new Uint8Array(value));
-	return value;
+	return value instanceof Uint8Array ? decodeCbor(value) : value;
 }
+const RFC_3339_DATE_TIME = /^\d{4}-(0[1-9]|1[0-2])-(0[1-9]|[12]\d|3[01])T([01]\d|2[0-3])(:[0-5]\d){2}(\.\d+)?(Z|[+-]([01]\d|2[0-3]):[0-5]\d)$/;
+const CBOR_TAG_DATE_TIME = 0;
 function parseCreatedAt(value) {
-	const resolved = extractCborTaggedValue(value) ?? value;
-	if (typeof resolved === "string") return resolved;
-	if (resolved instanceof Date) return resolved.toISOString();
-	return null;
+	if (!(value instanceof CborTag) || value.tag !== CBOR_TAG_DATE_TIME) return null;
+	const text = value.value;
+	if (typeof text !== "string" || !RFC_3339_DATE_TIME.test(text)) return null;
+	if (new Date(text.slice(0, 10)).getUTCDate() !== Number(text.slice(8, 10))) return null;
+	return new Date(text).toISOString();
 }
-function extractKidHex(keyData, coseKey) {
-	const kid = keyData["kid"];
-	if (kid instanceof Uint8Array) return bytesToHex(kid);
-	if (typeof kid === "string") return kid;
-	if (Array.isArray(kid) && kid.length > 0) return bytesToHex(new Uint8Array(kid));
-	const coseKeyLike = coseKey;
-	const coseKid = coseKeyLike instanceof Map ? coseKeyLike.get(COSE_KEY_ID_LABEL) : coseKeyLike[COSE_KEY_ID_LABEL];
-	if (coseKid instanceof Uint8Array) return bytesToHex(coseKid);
-	if (Array.isArray(coseKid) && coseKid.length > 0) return bytesToHex(new Uint8Array(coseKid));
-	return null;
+function extractKidHex(coseKey) {
+	const coseKid = coseKey[COSE_KEY_ID_LABEL];
+	return coseKid instanceof Uint8Array ? bytesToHex(coseKid) : null;
 }
 function extractKeyArray(data) {
 	if (Array.isArray(data)) return data;
@@ -1616,72 +1983,84 @@ async function validateBmffHashAssertion(bytes, assertion) {
 	const data = assertion.data;
 	const rawHash = data["hash"] ?? data["value"];
 	if (!rawHash) return true;
-	const expectedHash = rawHash instanceof Uint8Array ? rawHash : new Uint8Array(rawHash);
+	if (!(rawHash instanceof Uint8Array)) return false;
 	const alg = normalizeAlgorithmName(data["alg"]);
+	const exclusions = parseExclusions(data["exclusions"]);
+	if (!exclusions) return false;
 	return hashesEqual(await computeBmffHash(bytes, {
-		exclusions: data["exclusions"] ?? [],
+		exclusions,
 		alg,
 		offsetPrefixSize: 8
-	}), expectedHash);
+	}), rawHash);
 }
 function extractSessionKeyFields(entry) {
 	const keyData = entry;
-	const minSequenceNumber = keyData["minSequenceNumber"];
-	const validityPeriod = keyData["validityPeriod"];
+	const minSequenceNumber = asUnsignedInteger(keyData["minSequenceNumber"]);
+	const validityPeriod = asUnsignedInteger(keyData["validityPeriod"]);
 	const createdAt = parseCreatedAt(keyData["createdAt"]);
-	if (minSequenceNumber == null || validityPeriod == null || !createdAt) return null;
-	if (/* @__PURE__ */ new Date() < new Date(createdAt) || isKeyExpired(createdAt, Number(validityPeriod))) return null;
+	if (minSequenceNumber === null || validityPeriod === null || !createdAt) return null;
 	const coseKey = ensureDecodedCbor(keyData["key"]);
-	const kid = extractKidHex(keyData, coseKey);
+	const kid = extractKidHex(coseKey);
 	if (!kid) return null;
 	const signerBindingRaw = keyData["signerBinding"];
 	if (!signerBindingRaw) return null;
-	try {
-		return {
-			minSequenceNumber: Number(minSequenceNumber),
-			validityPeriod: Number(validityPeriod),
-			createdAt,
-			kid,
-			coseKey,
-			signerBindingBytes: normalizeToUint8Array(signerBindingRaw)
-		};
-	} catch {
-		return null;
-	}
+	return {
+		minSequenceNumber,
+		validityPeriod,
+		createdAt,
+		kid,
+		coseKey,
+		signerBindingBytes: normalizeToUint8Array(signerBindingRaw)
+	};
 }
 async function verifyAndConvertKey(fields, certificate) {
 	if (!await verifySignerBinding(fields.signerBindingBytes, fields.coseKey, certificate)) return null;
+	return {
+		kid: fields.kid,
+		jwk: convertCoseKeyToJwk(fields.coseKey),
+		minSequenceNumber: fields.minSequenceNumber,
+		validityPeriod: fields.validityPeriod,
+		createdAt: fields.createdAt
+	};
+}
+async function validateSingleSessionKey(entry, certificate) {
 	try {
-		const jwk = convertCoseKeyToJwk(fields.coseKey);
-		return {
-			kid: fields.kid,
-			jwk,
-			minSequenceNumber: fields.minSequenceNumber,
-			validityPeriod: fields.validityPeriod,
-			createdAt: fields.createdAt
-		};
+		const fields = extractSessionKeyFields(entry);
+		if (!fields) return null;
+		return await verifyAndConvertKey(fields, certificate);
 	} catch {
 		return null;
 	}
 }
-async function validateSingleSessionKey(entry, certificate) {
-	const fields = extractSessionKeyFields(entry);
-	if (!fields) return null;
-	return verifyAndConvertKey(fields, certificate);
+function isWithinValidityPeriod(key) {
+	return !isKeyExpired(key.createdAt, key.validityPeriod);
 }
 async function validateSessionKeys(assertion, certificate) {
-	const keyEntries = extractKeyArray(ensureDecodedCbor(assertion.data));
-	return (await Promise.all(keyEntries.map((entry) => validateSingleSessionKey(entry, certificate)))).filter((key) => key !== null);
+	const keyEntries = extractKeyArray(assertion.taggedData);
+	const results = await Promise.all(keyEntries.map((entry) => validateSingleSessionKey(entry, certificate)));
+	const validKeys = results.filter((key) => key !== null);
+	return {
+		sessionKeys: validKeys.filter(isWithinValidityPeriod),
+		hasInvalidSessionKey: keyEntries.length === 0 || validKeys.length < results.length
+	};
 }
 /**
 * Validates a C2PA init segment: parses the manifest, extracts and verifies
 * the certificate, validates the BMFF hard binding hash, verifies all
 * session keys from the `c2pa.session-keys` assertion, and performs
-* manifest integrity checks (assertion hashes, missing assertions,
-* action ingredients, and claim signature verification).
+* manifest integrity checks (assertion references and hashes, undeclared
+* assertions, the hard binding count, duplicate manifest boxes, action
+* ingredients, and claim signature verification).
 *
 * Only session keys with a valid signer binding and an unexpired validity period
-* are included in the result.
+* are included in the result. The result holds `sessionKeys` and `merkleMaps` only when
+* every manifest integrity check passes, so check `isValid` before you use either list.
+*
+* The result includes `LiveVideoStatusCode.SESSIONKEY_INVALID` if the function finds an invalid
+* session key (C2PA section 19.7.3). A session key is invalid if it does not conform to section 18.25.2,
+* or if its signer binding fails verification. The function does not check every rule of section 18.25.2.
+* An expired session key does not count as invalid. A `c2pa.session-keys` assertion without a session key,
+* or with CBOR that does not decode, also causes `SESSIONKEY_INVALID`.
 *
 * @param bytes - Raw init segment bytes
 * @returns Structured validation result (with `INIT_INVALID` error code if `mdat` box is present)
@@ -1705,15 +2084,22 @@ async function validateC2paInitSegment(bytes) {
 	};
 	const internalData = readC2paManifest(bytes, boxes);
 	const { manifest } = internalData;
-	const { codes: integrityCodes, certificate } = await validateManifestIntegrity(internalData);
-	const bmffHashAssertion = manifest.assertions.find((a) => a.label === BMFF_HASH_ASSERTION_LABEL$1) ?? null;
+	const { codes: integrityCodes, certificate, verifiedAssertions } = await validateManifestIntegrity(internalData);
+	const bmffHashAssertion = verifiedAssertions.find((a) => a.label === BMFF_HASH_ASSERTION_LABEL$1) ?? null;
 	const bmffHashValid = await validateBmffHashAssertion(bytes, bmffHashAssertion);
-	const sessionKeysAssertion = manifest.assertions.find((a) => a.label === SESSION_KEYS_ASSERTION_LABEL);
-	const sessionKeys = sessionKeysAssertion && certificate ? await validateSessionKeys(sessionKeysAssertion, certificate) : [];
 	const codes = /* @__PURE__ */ new Set();
 	const merkleMaps = await validateMerkleMaps(bytes, bmffHashAssertion, codes);
+	const sessionKeysAssertion = verifiedAssertions.find((a) => a.label === SESSION_KEYS_ASSERTION_LABEL);
+	const sessionKeysValidation = sessionKeysAssertion && certificate ? await validateSessionKeys(sessionKeysAssertion, certificate) : {
+		sessionKeys: [],
+		hasInvalidSessionKey: false
+	};
+	const integrityPassed = integrityCodes.length === 0;
+	const sessionKeys = integrityPassed ? sessionKeysValidation.sessionKeys : [];
+	const exposedMerkleMaps = integrityPassed ? merkleMaps ?? [] : [];
 	if (!bmffHashValid) codes.add(LiveVideoStatusCode.INIT_INVALID);
-	if (sessionKeys.length === 0 && merkleMaps === null) codes.add(LiveVideoStatusCode.SESSIONKEY_INVALID);
+	if (sessionKeysValidation.hasInvalidSessionKey) codes.add(LiveVideoStatusCode.SESSIONKEY_INVALID);
+	if (sessionKeysValidation.sessionKeys.length === 0 && merkleMaps === null) codes.add(LiveVideoStatusCode.SESSIONKEY_INVALID);
 	for (const code of integrityCodes) codes.add(code);
 	const errorCodes = [...codes];
 	return {
@@ -1721,7 +2107,7 @@ async function validateC2paInitSegment(bytes) {
 		certificate,
 		manifestId: manifest.instanceId,
 		sessionKeys,
-		merkleMaps: merkleMaps ?? [],
+		merkleMaps: exposedMerkleMaps,
 		isValid: errorCodes.length === 0,
 		errorCodes
 	};
@@ -1770,16 +2156,20 @@ function extractVsiEmsgBox(segmentBytes) {
 * @internal
 */
 function decodeVsiMap(vsiCborBytes) {
-	const raw = decode(vsiCborBytes);
+	const raw = decodeCbor(vsiCborBytes);
 	if (typeof raw !== "object" || raw === null) throw new Error("VSI map must be a CBOR map");
-	const sequenceNumber = raw["sequenceNumber"];
-	if (typeof sequenceNumber !== "number") throw new Error("VSI map missing or invalid sequenceNumber");
+	const rawSequenceNumber = raw["sequenceNumber"];
+	const sequenceNumber = asUnsignedInteger(rawSequenceNumber);
+	if (sequenceNumber === null) {
+		const received = typeof rawSequenceNumber === "number" || typeof rawSequenceNumber === "bigint" ? String(rawSequenceNumber) : typeof rawSequenceNumber;
+		throw new Error(`VSI map sequenceNumber must be an unsigned integer up to ${Number.MAX_SAFE_INTEGER}, got ${received}`);
+	}
 	const bmffHashRaw = raw["bmffHash"];
 	if (!bmffHashRaw || typeof bmffHashRaw !== "object") throw new Error("VSI map missing bmffHash");
 	const hash = bmffHashRaw["hash"];
 	if (!(hash instanceof Uint8Array)) throw new Error("VSI map bmffHash.hash must be a Uint8Array");
-	const exclusions = bmffHashRaw["exclusions"];
-	if (exclusions !== void 0 && !Array.isArray(exclusions)) throw new Error("VSI map bmffHash.exclusions must be an array");
+	const exclusions = parseExclusions(bmffHashRaw["exclusions"]);
+	if (!exclusions) throw new Error("VSI map bmffHash.exclusions must be an array of maps with an xpath text string, and data constraints with an unsigned integer offset and a byte string value");
 	const manifestId = raw["manifestId"];
 	if (typeof manifestId !== "string") throw new Error("VSI map missing or invalid manifestId");
 	return {
@@ -1787,7 +2177,7 @@ function decodeVsiMap(vsiCborBytes) {
 		bmffHash: {
 			hash,
 			alg: normalizeAlgorithmName(bmffHashRaw["alg"]),
-			exclusions: exclusions ?? []
+			exclusions
 		},
 		manifestId
 	};
@@ -1965,10 +2355,13 @@ function findSessionKey(sessionKeys, kidHex) {
 *
 * Returns `null` if the segment does not contain a C2PA EMSG box.
 *
+* A segment whose signature, content hash, or key validity does not verify
+* returns the received `sequenceState` unchanged.
+*
 * @param segmentBytes - Raw segment bytes
 * @param sessionKeys - Available session keys from the init segment
 * @param sequenceState - Current sequence state for this stream
-* @returns Validation result and updated sequence state, or `null` if no C2PA EMSG box
+* @returns Validation result and the sequence state for the next call, or `null` if no C2PA EMSG box
 *
 * @example
 * {@includeCode ../../test/segment/validateC2paSegment.test.ts#example}
@@ -2000,7 +2393,7 @@ async function validateC2paSegment(segmentBytes, sessionKeys, sequenceState = cr
 			isValid: false,
 			errorCodes: [LiveVideoStatusCode.SEGMENT_INVALID]
 		},
-		nextSequenceState
+		nextSequenceState: sequenceState
 	};
 	const algorithm = resolveImportAlgorithm(sessionKey.jwk);
 	const publicKey = await crypto.subtle.importKey("jwk", sessionKey.jwk, algorithm, false, ["verify"]);
@@ -2009,11 +2402,12 @@ async function validateC2paSegment(segmentBytes, sessionKeys, sequenceState = cr
 		alg: vsi.bmffHash.alg
 	})]);
 	const sequenceAboveMin = vsi.sequenceNumber >= sessionKey.minSequenceNumber;
+	const keyNotYetActive = /* @__PURE__ */ new Date() < new Date(sessionKey.createdAt);
 	const keyExpired = isKeyExpired(sessionKey.createdAt, sessionKey.validityPeriod);
+	const authentic = signatureValid && hashValid && !keyNotYetActive && !keyExpired;
 	const codes = /* @__PURE__ */ new Set();
-	if (!signatureValid || !hashValid || !sequenceAboveMin) codes.add(LiveVideoStatusCode.SEGMENT_INVALID);
+	if (!authentic || !sequenceAboveMin) codes.add(LiveVideoStatusCode.SEGMENT_INVALID);
 	if (!sequenceResult.isValid) codes.add(LiveVideoStatusCode.ASSERTION_INVALID);
-	if (keyExpired) codes.add(LiveVideoStatusCode.SESSIONKEY_INVALID);
 	const errorCodes = [...codes];
 	return {
 		result: {
@@ -2021,7 +2415,7 @@ async function validateC2paSegment(segmentBytes, sessionKeys, sequenceState = cr
 			isValid: errorCodes.length === 0,
 			errorCodes
 		},
-		nextSequenceState
+		nextSequenceState: authentic ? nextSequenceState : sequenceState
 	};
 }
 
@@ -2048,7 +2442,7 @@ function parseLiveVideoAssertion(assertions) {
 	const rawStreamId = data?.["streamId"];
 	const rawContinuity = data?.["continuityMethod"];
 	return {
-		sequenceNumber: typeof rawSeq === "number" ? rawSeq : null,
+		sequenceNumber: asUnsignedInteger(rawSeq),
 		previousManifestId: typeof rawPrev === "string" ? rawPrev : null,
 		streamId: typeof rawStreamId === "string" ? rawStreamId : null,
 		continuityMethod: typeof rawContinuity === "string" ? rawContinuity : null,
@@ -2059,19 +2453,25 @@ const EMPTY_BMFF_HASH = {
 	hashBytes: null,
 	hashHex: null,
 	exclusions: [],
-	alg: null
+	alg: null,
+	malformed: false
 };
 function parseBmffHashAssertion(assertions) {
 	const assertion = assertions.find((a) => a.label === BMFF_HASH_ASSERTION_LABEL);
 	if (!assertion) return EMPTY_BMFF_HASH;
 	const data = extractAssertionData(assertion.data);
 	if (!data) return EMPTY_BMFF_HASH;
-	const hashBytes = toUint8Array(data["hash"] ?? data["value"]);
+	const rawHash = data["hash"] ?? data["value"];
+	const hashBytes = toUint8Array(rawHash);
+	const hashHex = hashBytes ? bytesToHex(hashBytes) : null;
+	const exclusions = parseExclusions(data["exclusions"]);
+	const alg = typeof data["alg"] === "string" ? normalizeAlgorithmName(data["alg"]) : null;
 	return {
 		hashBytes,
-		hashHex: hashBytes ? bytesToHex(hashBytes) : null,
-		exclusions: parseExclusions(data["exclusions"]),
-		alg: typeof data["alg"] === "string" ? normalizeAlgorithmName(data["alg"]) : null
+		hashHex,
+		exclusions: exclusions ?? [],
+		alg,
+		malformed: rawHash != null && hashBytes === null || exclusions === null
 	};
 }
 function parseManifest(bytes) {
@@ -2081,23 +2481,17 @@ function parseManifest(bytes) {
 		if (!manifest) return {
 			manifest: null,
 			issuer: null,
-			liveVideo: null,
-			bmff: EMPTY_BMFF_HASH,
 			internalData: null
 		};
 		return {
 			manifest,
 			issuer: manifest.signatureInfo?.issuer ?? null,
-			liveVideo: parseLiveVideoAssertion(manifest.assertions),
-			bmff: parseBmffHashAssertion(manifest.assertions),
 			internalData
 		};
 	} catch {
 		return {
 			manifest: null,
 			issuer: null,
-			liveVideo: null,
-			bmff: EMPTY_BMFF_HASH,
 			internalData: null
 		};
 	}
@@ -2111,8 +2505,7 @@ function collectErrorCodes(hasManifest, hasLiveVideo, streamIdValid, sequenceNum
 	if (!bmffHashMatches) codes.add(LiveVideoStatusCode.SEGMENT_INVALID);
 	return [...codes];
 }
-async function validateContinuity(parsed, lastManifestId, options) {
-	const { manifest, liveVideo } = parsed;
+async function validateContinuity(manifest, liveVideo, lastManifestId, options) {
 	const method = liveVideo?.continuityMethod ?? null;
 	if (!method) return [LiveVideoStatusCode.CONTINUITY_METHOD_INVALID];
 	if (method === CONTINUITY_METHOD_MANIFEST_ID) {
@@ -2131,16 +2524,21 @@ async function validateContinuity(parsed, lastManifestId, options) {
 * Recomputes the `c2pa.hash.bmff.v3` content hash from the raw segment bytes and compares
 * it against the expected hash in the manifest assertion. Checks live-video assertions
 * (sequenceNumber, streamId, continuityMethod) and manifest-ID chain continuity.
+* The live-video and BMFF hash fields of the result come only from assertions whose
+* hash matches a claim reference. Check `isValid` before you use any field.
 * A validator for an implementer-defined continuity method can be registered
 * via {@link ManifestBoxValidationOptions}.
 *
 * This function is **pure** — it does not access any external state. The
 * caller is responsible for persisting `nextManifestId` and `nextState`
-* between calls.
+* between calls. A segment that fails verification, is on another stream, or
+* does not move the sequence number forward returns the received
+* `lastManifestId` and `state` unchanged. A segment that fails only the
+* continuity check still updates them.
 *
 * @param bytes - Raw segment bytes
-* @param lastManifestId - Manifest ID from the previous segment, or null for the first segment
-* @param state - Optional state from the previous segment for streamId/sequenceNumber checks
+* @param lastManifestId - Manifest ID from the last segment that updated the state, or `null` for the first segment
+* @param state - Optional state from the last segment that updated the state, for the streamId and sequenceNumber checks
 * @param options - Optional custom continuity method validator
 * @returns Validation result, the manifest ID, and state to persist for the next call
 *
@@ -2150,7 +2548,11 @@ async function validateContinuity(parsed, lastManifestId, options) {
 * @public
 */
 async function validateC2paManifestBoxSegment(bytes, lastManifestId, state, options) {
-	const { manifest, issuer, liveVideo, bmff, internalData } = parseManifest(bytes);
+	const { manifest, issuer, internalData } = parseManifest(bytes);
+	const integrity = internalData ? await validateManifestIntegrity(internalData) : null;
+	const verifiedAssertions = integrity?.verifiedAssertions ?? [];
+	const liveVideo = parseLiveVideoAssertion(verifiedAssertions);
+	const bmff = parseBmffHashAssertion(verifiedAssertions);
 	const sequenceNumber = liveVideo?.sequenceNumber ?? null;
 	const previousManifestId = liveVideo?.previousManifestId ?? null;
 	const streamId = liveVideo?.streamId ?? null;
@@ -2163,17 +2565,12 @@ async function validateC2paManifestBoxSegment(bytes, lastManifestId, state, opti
 		alg: bmff.alg ?? void 0,
 		offsetPrefixSize: 8
 	}), bmff.hashBytes);
-	const continuityCodes = await validateContinuity({
-		manifest,
-		issuer,
-		liveVideo,
-		bmff,
-		internalData
-	}, lastManifestId, options);
+	const continuityCodes = await validateContinuity(manifest, liveVideo, lastManifestId, options);
 	const liveVideoCodes = [...new Set([...collectErrorCodes(manifest !== null, liveVideo !== null, streamIdValid, sequenceNumberValid, bmffHashMatches), ...continuityCodes])];
-	const integrity = internalData ? await validateManifestIntegrity(internalData) : null;
 	const integrityCodes = integrity?.codes ?? [];
 	const errorCodes = [...liveVideoCodes, ...integrityCodes];
+	if (bmff.malformed) errorCodes.push(C2paStatusCode.ASSERTION_BMFFHASH_MALFORMED);
+	const advance = manifest !== null && liveVideo !== null && integrity !== null && integrity.codes.length === 0 && bmffHashMatches && !bmff.malformed && streamIdValid && sequenceNumberValid;
 	const currentManifestId = manifest?.instanceId ?? null;
 	return {
 		result: {
@@ -2188,11 +2585,11 @@ async function validateC2paManifestBoxSegment(bytes, lastManifestId, state, opti
 			isValid: errorCodes.length === 0,
 			errorCodes
 		},
-		nextManifestId: currentManifestId ?? lastManifestId,
-		nextState: {
+		nextManifestId: advance ? currentManifestId ?? lastManifestId : lastManifestId,
+		nextState: advance ? {
 			lastStreamId: streamId ?? state?.lastStreamId,
 			lastSequenceNumber: sequenceNumber ?? state?.lastSequenceNumber
-		}
+		} : state ?? {}
 	};
 }
 
@@ -2215,32 +2612,22 @@ function extractMerkleAuxBoxes(segmentBytes) {
 	}
 	return payloads;
 }
-function readMapField(map, name) {
-	if (map instanceof Map) return map.get(name);
-	return map[name];
-}
 function decodeFirstCbor(payload) {
-	let first;
-	let found = false;
 	try {
-		decodeMultiple(payload, (value) => {
-			first = value;
-			found = true;
-			return false;
-		});
+		return readCborItem(payload).value;
 	} catch {
 		return;
 	}
-	return found ? first : void 0;
 }
 function parseBmffMerkleMap(payload) {
 	const decoded = decodeFirstCbor(payload);
 	if (decoded === null || decoded === void 0 || typeof decoded !== "object") return null;
-	const uniqueId = asInteger(readMapField(decoded, "uniqueId"));
-	const localId = asInteger(readMapField(decoded, "localId"));
-	const location = asInteger(readMapField(decoded, "location"));
+	const map = decoded;
+	const uniqueId = asInteger(map["uniqueId"]);
+	const localId = asInteger(map["localId"]);
+	const location = asInteger(map["location"]);
 	if (uniqueId === null || localId === null || location === null) return null;
-	const rawHashes = readMapField(decoded, "hashes");
+	const rawHashes = map["hashes"];
 	if (rawHashes == null) return {
 		uniqueId,
 		localId,