HIK SDK

Real-time C2PA 2.3 stream integrity enforcement at the CDN edge.

Sign every fragment. Verify at the edge. Cut the signal if it's been touched.

What it does

HIK SDK extends C2PA 2.3 from a forensic standard into a runtime enforcement layer. Instead of verifying content after it's been seen, it gates every media fragment before it reaches the viewer — at the CDN edge, in under 1ms.

If a fragment carries a C2PA manifest signed by trusted hardware and shows no prohibited actions (filters, face swaps, voice distortion), it passes. If not — the CMCD v2 ethical score header drops to zero and the CDN cuts the stream. HTTP 403.

Container support

| Format | Protocol | Works? | |---|---|---| | fMP4 / CMAF | DASH, modern HLS (LL-HLS), direct fMP4 | ✅ Full support | | MPEG-TS | Legacy HLS .ts, audio-only HLS | ✅ Full support (v2.5) | | Audio-only fMP4 | HLS AAC in CMAF | ✅ Full support | | MPEG-TS audio-only | HLS AAC in MPEG-TS | ✅ Full support (v2.5) |

Use parseC2PAFromSegment() — auto-detects container, calls the right parser.

Device compatibility

| Device / Platform | Trust Anchor | C2PA Assurance Level | |---|---|---| | Google Pixel 9 / 10 (Titan M2) | Google | Level 2 (hardware-backed) | | Samsung Galaxy S25 (Knox Vault) | HIK custom | Level 1 | | Apple iPhone 16+ (Secure Enclave) | HIK custom | Level 1 | | OBS / streaming software | HIK custom | Level 1 | | Any fMP4 broadcaster | HIK custom | Level 1 |

Install

npm install human-is-kind-sdk

Usage

1. Universal segment parser — auto-detects fMP4 or MPEG-TS

import { parseC2PAFromSegment, C2PAManifestVerifier } from 'human-is-kind-sdk';

const verifier = new C2PAManifestVerifier({
  googleCertPem: process.env.GOOGLE_C2PA_ROOT_PEM,
  hikCertPem:    process.env.HIK_TRUST_ANCHOR_PEM,
});

// Works for fMP4 (DASH/HLS CMAF) AND MPEG-TS (legacy HLS) — same call
const jumbf = parseC2PAFromSegment(segmentBuffer);
if (!jumbf) return new Response(null, { status: 403 });

const result = verifier.verifyManifest(jumbf);
if (!result.valid) return new Response(null, { status: 403 });

console.log(`Trust: ${result.trustAnchor} | Level: ${result.assuranceLevel}`);

2. KMIR gate — detect prohibited C2PA actions

import { KMIRValidator } from 'human-is-kind-sdk';

const kmir = new KMIRValidator();

// Blocks: c2pa.filtered, c2pa.face_replaced, c2pa.voice_modified,
//         com.voicemod.modified, com.snapchat.lens, com.obs.filter,
//         com.tiktok.effect, com.instagram.filter
if (!kmir.isStreamClean(c2paActions)) {
  return new Response(null, { status: 403 });
}

3. CMCD v2 telemetry — broadcaster side

import { CMCDTelemetryHandler } from 'human-is-kind-sdk';

const telemetry = new CMCDTelemetryHandler({ signingKey: myECDSAKey });

const headers = telemetry.generateHeaders({
  kmirCompliancePercentage: 100,
  chainDepth: fragment.sequenceNumber,
  aiDetection: {
    videoFilterConfidence: 0.12,
    voiceDistortionConfidence: 0.04,
    maxConfidence: 0.12,
  },
});
// → { 'CMCD-Custom-hik-es': '100', 'CMCD-Custom-hik-ps': '42', ... }

4. Ad breaks & announcements

The telemetry layer has built-in ad break support. During an authorized ad break the chain goes into chain sleep — unverified ad fragments are allowed through without triggering a cut.

// Broadcaster: signal start of ad break
const headers = telemetry.generateHeaders({
  kmirCompliancePercentage: 100,
  chainDepth: fragment.sequenceNumber,
  isAdBreakActive: true,   // → sends CMCD-Custom-hik-ab: 1
});

// Edge worker: hik-ab=1 → chain sleep → allow ad fragment through
// Signature is still verified — spoofed ad-break signals are cut
const allowed = edge.evaluateEdgeRequest(request.headers);

The ad break header (hik-ab) is signed alongside the ethical score. A broadcaster cannot fake an ad break without the private key — the edge will reject unsigned hik-ab: 1 as tampered telemetry.

Works for mid-roll, pre-roll, and post-roll insertions. Signal from the VSI emsg box also tags the fragment with stream_status: "ad_break_start" / "ad_break_end".

5. Edge evaluation — Cloudflare Worker / CDN

import { CMCDTelemetryHandler } from 'human-is-kind-sdk';

const edge = new CMCDTelemetryHandler({
  verificationKeyPem: process.env.HIK_PUBLIC_KEY_PEM,
});

// hik-es=0 → cut | tampered sig → cut | hik-ab=1 → pass (chain sleep)
if (!edge.evaluateEdgeRequest(request.headers)) {
  return new Response(null, { status: 403 });
}

6. Sign outgoing fragments

import { StreamSigner } from 'human-is-kind-sdk';

const signer = new StreamSigner('0x' + merkleAnchorHash, mySigningKey);

const emsgBox = signer.generateEmsgBox({
  sequenceNumber: fragment.seq,
  payloadBuffer: fragment.data,
  timestamp: new Date().toISOString(),
  adBreakAction: 'start',  // optional: 'start' | 'end'
});

// Key rotation mid-stream (recommended every 3600 fragments / ~1 hour)
signer.rotateKey(newSigningKey);

7. MPEG-TS — legacy HLS

import { buildC2PATsPackets, parseC2PAFromMpegTs } from 'human-is-kind-sdk';

// Broadcaster: prepend C2PA TS packets to each .ts segment
const c2paPackets = buildC2PATsPackets(jumbfManifest);
const outputSegment = Buffer.concat([c2paPackets, existingTsSegment]);

// Verifier: extract manifest from .ts segment
const jumbf = parseC2PAFromMpegTs(tsBuffer);

8. Static file signing + blockchain anchoring

import { signAndAnchor } from 'human-is-kind-sdk';

const cert = await signAndAnchor('./video.mp4', {
  signingKey: myKey,
  blockchain: { privateKey: process.env.ETH_PRIVATE_KEY },
  useMockIPFS: true,
});

C2PA 2.3 specification compliance

| Requirement | Spec reference | Status | |---|---|---| | COSE_Sign1 with ES256 | RFC 9052 §2 | ✅ | | ECDSA signature in IEEE P1363 format (r∥s, 64 bytes) | RFC 9052 §2 | ✅ | | x5c certificate chain in unprotected COSE header (key 33) | C2PA 2.3 §8.3 | ✅ | | RFC 3161 TSA timestamp token (sigTst) | C2PA 2.3 §C.1 | ✅ | | OCSP revocation response (rVal) | C2PA 2.3 §C.2 | ✅ | | c2pa.actions.v2 assertion label | C2PA 2.3 §14 | ✅ | | c2pa.hash.data with base64url hash field | C2PA 2.3 §12.2 | ✅ | | c2pa.hash.data exclusions array (prevents circular hash) | C2PA 2.3 §12.2 | ✅ | | @context: https://c2pa.org/manifest/v2 JSON-LD | C2PA 2.3 §7 | ✅ | | claim_generator format <product>/<version> | C2PA 2.3 §8.1 | ✅ | | fMP4 uuid box UUID: D8FEC3D6-1B0E-483C-9297-5828877EC481 | C2PA 2.3 §10.2 | ✅ | | fMP4 uuid box after ftyp, before moov | C2PA 2.3 §10.2 | ✅ | | MPEG-TS ID3 PRIV frame owner: https://c2pa.org/manifest | C2PA 2.3 §10.3 | ✅ | | emsg box version 0, event_duration = 0xFFFFFFFF for live | ISO 23009-1 §5.10.3.3 | ✅ | | emsg id unique per scheme (prevents player deduplication) | ISO 23009-1 §5.10.3.3 | ✅ | | CMCD v2 custom headers | IETF draft-ietf-mops-cmcd-01 | ✅ | | Adobe Content Credentials validator compatible | contentcredentials.org | ✅ |

Architecture

Device (any C2PA-capable hardware or software encoder)
  ↓  fMP4 init segment → uuid box  (UUID: D8FEC3D6-1B0E-483C-9297-5828877EC481)
  ↓  OR MPEG-TS → ID3 PRIV frame   (owner: https://c2pa.org/manifest)
  ↓  fMP4 media segment → emsg box  (urn:c2pa:vsi-hashmap, ES256 signed chain)
  ↓  CMCD v2 request headers        (hik-es / hik-ps / hik-ab / hik-sig)

Edge Worker (Cloudflare / Fastly / Akamai)
  ↓  parseC2PAFromSegment()          auto-detects fMP4 or MPEG-TS
  ↓  C2PAManifestVerifier            trust anchor + assurance level
  ↓  KMIRValidator.isStreamClean()   c2pa.actions.v2 gate
  ↓  CMCDTelemetryHandler            evaluate hik-es / hik-ab / hik-sig
  → 200 pass  |  403 cut  |  chain sleep during authorized ad break

Modules

| Module | Description | |---|---| | vsi.ts | C2PA 2.3 fMP4 parser + StreamSigner (emsg, chain, key rotation) | | mpeg-ts.ts | MPEG-TS: PAT/PMT parser, ID3 PRIV frame, PES writer, TS packetizer | | signer.ts | COSE_Sign1 ES256 (P1363), DER↔P1363 converters, RFC 3161 TSA | | telemetry.ts | CMCD v2 ethical pulse, AI cut, ad break (hik-ab) | | kmir.ts | KMIR v2.3 policy validator + streaming action gate | | go-bridge.ts | Go sidecar client with fail-close fallback | | blockchain.ts | Ethereum smart contract anchoring | | storage.ts | IPFS + mock storage |

License

MIT

Acknowledgements

Architecture reference: Pablo Flores, Qualabs — SMPTE C2PA work on fMP4 JUMBF manifest embedding. Pipeline reference: Kirk Haller — Head of YouTube Live Engineering — Pixel device C2PA Assurance Level 2.