@uuaid/provenance

Media provenance for AI-generated content — IAASO-0004. Bind an image, a video, or a PDF to the UUAID of the agent that produced it, with a signature that travels inside the file.

import { contentHashForImage, createManifest, sealManifest, embedProvenance, verifyImage } from "@uuaid/provenance";

const manifest = createManifest({ subject: "uuaid:foundation:agent:…", generator: "text-to-image", … });
const sealed   = sealManifest(manifest, [{ key: signer, keyId: "agent-1" }]);
const withProof = await embedProvenance(pngBytes, sealed);   // PNG iTXt / JPEG APP11

const r = await verifyImage(withProof);
r.level   // "L2-bound" once the signing key resolves to the claimed subject

• Formats: PNG (iTXt), JPEG (APP11), and PDF (signature dictionaries + the ESigPQSeal hybrid seal). C2PA manifests are detected and reported.
• Hybrid signatures: Ed25519 + ML-DSA-65 over one JCS-canonical manifest.
• Sidecars for formats that cannot carry embedded metadata.

The same caveat as every other signature in this stack applies: a valid signature proves the manifest was not altered and identifies the key that signed it. Binding that key to a subject (L2) is a separate check, and it is the one that matters.

CLI: uuaid sign-media, uuaid verify-media, uuaid verify-pdf (see @uuaid/cli).

Apache-2.0 · uuaid.org