@trylimbo/sdk-verifier-wasm 0.1.0-canary.100

package/gen/wasm/worker.d.ts

@@ -0,0 +1,624 @@
+//#region ../../../../node_modules/comlink/dist/umd/comlink.d.ts
+declare const proxyMarker: unique symbol;
+declare const createEndpoint: unique symbol;
+declare const releaseProxy: unique symbol;
+declare const finalizer: unique symbol;
+/**
+ * Interface of values that were marked to be proxied with `comlink.proxy()`.
+ * Can also be implemented by classes.
+ */
+interface ProxyMarked {
+  [proxyMarker]: true;
+}
+/**
+ * Takes a type and wraps it in a Promise, if it not already is one.
+ * This is to avoid `Promise<Promise<T>>`.
+ *
+ * This is the inverse of `Unpromisify<T>`.
+ */
+type Promisify<T> = T extends Promise<unknown> ? T : Promise<T>;
+/**
+ * Takes a type that may be Promise and unwraps the Promise type.
+ * If `P` is not a Promise, it returns `P`.
+ *
+ * This is the inverse of `Promisify<T>`.
+ */
+type Unpromisify<P> = P extends Promise<infer T> ? T : P;
+/**
+ * Takes the raw type of a remote property and returns the type that is visible to the local thread on the proxy.
+ *
+ * Note: This needs to be its own type alias, otherwise it will not distribute over unions.
+ * See https://www.typescriptlang.org/docs/handbook/advanced-types.html#distributive-conditional-types
+ */
+type RemoteProperty<T> = T extends Function | ProxyMarked ? Remote<T> : Promisify<T>;
+/**
+ * Takes the raw type of a property as a remote thread would see it through a proxy (e.g. when passed in as a function
+ * argument) and returns the type that the local thread has to supply.
+ *
+ * This is the inverse of `RemoteProperty<T>`.
+ *
+ * Note: This needs to be its own type alias, otherwise it will not distribute over unions. See
+ * https://www.typescriptlang.org/docs/handbook/advanced-types.html#distributive-conditional-types
+ */
+type LocalProperty<T> = T extends Function | ProxyMarked ? Local<T> : Unpromisify<T>;
+/**
+ * Proxies `T` if it is a `ProxyMarked`, clones it otherwise (as handled by structured cloning and transfer handlers).
+ */
+type ProxyOrClone<T> = T extends ProxyMarked ? Remote<T> : T;
+/**
+ * Inverse of `ProxyOrClone<T>`.
+ */
+type UnproxyOrClone<T> = T extends RemoteObject<ProxyMarked> ? Local<T> : T;
+/**
+ * Takes the raw type of a remote object in the other thread and returns the type as it is visible to the local thread
+ * when proxied with `Comlink.proxy()`.
+ *
+ * This does not handle call signatures, which is handled by the more general `Remote<T>` type.
+ *
+ * @template T The raw type of a remote object as seen in the other thread.
+ */
+type RemoteObject<T> = { [P in keyof T]: RemoteProperty<T[P]>; };
+/**
+ * Takes the type of an object as a remote thread would see it through a proxy (e.g. when passed in as a function
+ * argument) and returns the type that the local thread has to supply.
+ *
+ * This does not handle call signatures, which is handled by the more general `Local<T>` type.
+ *
+ * This is the inverse of `RemoteObject<T>`.
+ *
+ * @template T The type of a proxied object.
+ */
+type LocalObject<T> = { [P in keyof T]: LocalProperty<T[P]>; };
+/**
+ * Additional special comlink methods available on each proxy returned by `Comlink.wrap()`.
+ */
+interface ProxyMethods {
+  [createEndpoint]: () => Promise<MessagePort>;
+  [releaseProxy]: () => void;
+}
+/**
+ * Takes the raw type of a remote object, function or class in the other thread and returns the type as it is visible to
+ * the local thread from the proxy return value of `Comlink.wrap()` or `Comlink.proxy()`.
+ */
+type Remote<T> = RemoteObject<T> & (T extends ((...args: infer TArguments) => infer TReturn) ? (...args: { [I in keyof TArguments]: UnproxyOrClone<TArguments[I]>; }) => Promisify<ProxyOrClone<Unpromisify<TReturn>>> : unknown) & (T extends {
+  new (...args: infer TArguments): infer TInstance;
+} ? {
+  new (...args: { [I in keyof TArguments]: UnproxyOrClone<TArguments[I]>; }): Promisify<Remote<TInstance>>;
+} : unknown) & ProxyMethods;
+/**
+ * Expresses that a type can be either a sync or async.
+ */
+type MaybePromise<T> = Promise<T> | T;
+/**
+ * Takes the raw type of a remote object, function or class as a remote thread would see it through a proxy (e.g. when
+ * passed in as a function argument) and returns the type the local thread has to supply.
+ *
+ * This is the inverse of `Remote<T>`. It takes a `Remote<T>` and returns its original input `T`.
+ */
+type Local<T> = Omit<LocalObject<T>, keyof ProxyMethods> & (T extends ((...args: infer TArguments) => infer TReturn) ? (...args: { [I in keyof TArguments]: ProxyOrClone<TArguments[I]>; }) => MaybePromise<UnproxyOrClone<Unpromisify<TReturn>>> : unknown) & (T extends {
+  new (...args: infer TArguments): infer TInstance;
+} ? {
+  new (...args: { [I in keyof TArguments]: ProxyOrClone<TArguments[I]>; }): MaybePromise<Local<Unpromisify<TInstance>>>;
+} : unknown);
+//#endregion
+//#region gen/wasm/trylimbo_sdk_verifier.d.ts
+/** Sync ranged reader for Node.js (backed by `fs.readSync`). */
+interface RangeSource {
+  length: number;
+  readAt: (offset: number, length: number) => Uint8Array;
+}
+/**
+ * A C2PA soft binding: an algorithm id (from the C2PA soft-binding algorithm
+ * list, e.g. `io.iscc.v0`) plus its algorithm-specific value (the `ISCC:…` code,
+ * a watermark token, …). The signer embeds it as a `c2pa.soft-binding` assertion
+ * and indexes it, so a transcoded copy whose exact content hash no longer
+ * matches still recovers the manifest from the registry.
+ */
+interface SoftBinding {
+  /**
+   * C2PA soft-binding algorithm id, e.g. `io.iscc.v0`.
+   */
+  alg: string;
+  /**
+   * Algorithm-specific binding value: the canonical string the algorithm
+   * produces (an `ISCC:…` code, a watermark token). Its UTF-8 bytes are what
+   * the registry lookup base64-encodes.
+   */
+  value: string;
+}
+/**
+ * A session signing key from the init manifest\'s roster (spec §19.4.4).
+ */
+interface SessionKeySummary {
+  /**
+   * Identifier of the session signing key.
+   */
+  keyId: Uint8Array;
+  /**
+   * The session key\'s public half (SEC1-encoded bytes).
+   */
+  publicKey: Uint8Array;
+}
+/**
+ * C2PA validation state of a manifest (spec §14.3).
+ */
+type ValidationState = "Invalid" | "Valid" | "Trusted";
+/**
+ * Construction options for [`AssetVerifier::new`] (and the `AssetVerifier.create` JS
+ * binding). `trust_c2pa_anchors` defaults to `true` when omitted.
+ *
+ * One definition, all lanes: `#[binding]` derives the shapes directly here:
+ * tsify (camelCase, optional fields) on wasm, a `uniffi::Record` on the native
+ * `ffi` build, so there is no per-lane DTO copy. Off both lanes it is a plain struct.
+ */
+interface AssetVerifierOptions {
+  /**
+   * The registry to recover from. Omit for a verifier that only checks embedded manifests.
+   */
+  registry?: RegistryOptions;
+  /**
+   * PEM trust anchors for the caller\'s own issuers.
+   */
+  trustAnchors: string[];
+  /**
+   * Also trust the bundled official C2PA anchors on top of `trust_anchors`.
+   * Defaults to `true`; set `false` to trust only `trust_anchors`.
+   */
+  trustC2paAnchors?: boolean;
+  /**
+   * Issuer DIDs whose CAWG identity (ICA) credentials count as validated, matched
+   * exactly against the credential issuer. Omitted or empty trusts no issuer: every
+   * identity assertion then reports `cawg.ica.untrusted_issuer` and withholds
+   * `cawg.ica.credential_valid`, which leaves the manifest\'s own validity untouched.
+   */
+  trustedIcaIssuers?: string[];
+}
+/**
+ * Construction options for [`StreamVerifier::new`] (and the `StreamVerifier.create`
+ * JS binding). `trust_c2pa_anchors` defaults to `true` when omitted.
+ *
+ * `#[binding]` derives the wasm shape (`trustC2paAnchors` camelCase, optional) and,
+ * with `ffi`, a `uniffi::Record` for the native `StreamVerifier.create` binding, so there
+ * is no per-lane DTO copy. Off both lanes it is a plain struct.
+ */
+interface StreamVerifierOptions {
+  /**
+   * PEM trust anchors for the caller\'s own issuers.
+   */
+  trustAnchors: string[];
+  /**
+   * Also trust the bundled official C2PA anchors on top of `trust_anchors`.
+   * Defaults to `true`; set `false` to trust only `trust_anchors`.
+   */
+  trustC2paAnchors?: boolean;
+  /**
+   * Issuer DIDs whose CAWG identity (ICA) credentials count as validated, matched
+   * exactly against the credential issuer. Omitted or empty trusts no issuer: an
+   * identity assertion on the init segment\'s manifest then reports
+   * `cawg.ica.untrusted_issuer` and withholds `cawg.ica.credential_valid`.
+   */
+  trustedIcaIssuers?: string[];
+  /**
+   * How far a segment\'s timestamp may sit from wall-clock before it is rejected as
+   * skewed. Defaults to [`DEFAULT_SEGMENT_SKEW_TOLERANCE_SECS`]. A deployment whose
+   * encoder clock drifts further than that needs this rather than a fork.
+   */
+  segmentSkewToleranceSecs?: number;
+}
+/**
+ * How far a recovery may go, which decides what leaves the caller.
+ *
+ * Separate from [`RecoveryPolicy`], which decides *when* a recovery runs: one names the trigger
+ * and the other the reach, and crossing them is what the two enums exist to keep legible.
+ */
+type RegistryQueries = "derived" | "derivedThenContent";
+/**
+ * One C2PA validation status entry (spec §15.3).
+ */
+interface ValidationCode {
+  /**
+   * C2PA validation status string (e.g. `signingCredential.trusted`).
+   */
+  code: string;
+  kind: ValidationCodeKind;
+}
+/**
+ * One `verify` credential: the c2pa `ManifestStore`, where it came from, and whether the
+ * asset\'s own fingerprint backs it up.
+ */
+interface FoundCredential {
+  /**
+   * The bytes behind every thumbnail the manifests reference, by that reference\'s
+   * `identifier`: each manifest\'s claim thumbnail and each ingredient\'s. The manifests state
+   * identifiers and no images, so this is what a chain draws from.
+   */
+  thumbnails: Record<string, Uint8Array>;
+  /**
+   * Where this credential came from. See [`CredentialOrigin`].
+   */
+  origin: CredentialOrigin;
+  manifest: import('@contentauth/c2pa-types').ManifestStore;
+  /**
+   * Whether the asset\'s own fingerprint backs up a mark that led here (C2PA 2.4 1.2.2.3).
+   */
+  fingerprintCheck: FingerprintCheck;
+}
+/**
+ * Outcome of validating a media segment against its stream\'s init.
+ */
+interface MediaValidation {
+  valid: boolean;
+  codes: ValidationCode[];
+  keyId: Uint8Array;
+  timing: SegmentTiming;
+  manifestId: string;
+}
+/**
+ * Outcome of validating a stream\'s init segment.
+ */
+interface InitValidation {
+  state: ValidationState;
+  codes: ValidationCode[];
+  manifest: import('@contentauth/c2pa-types').ManifestStore;
+  sessionKeys: SessionKeySummary[];
+}
+/**
+ * Result of `StreamValidation.validate`, discriminated by `kind`.
+ */
+type SegmentValidation = ({
+  kind: "init";
+} & InitValidation) | ({
+  kind: "media";
+} & MediaValidation) | {
+  kind: "unknown";
+};
+/**
+ * Timing facts carried by a media segment\'s container.
+ */
+interface SegmentTiming {
+  /**
+   * Media segment sequence number (exact below 2^53).
+   */
+  sequenceNumber: number;
+  /**
+   * MP4 timescale (ticks per second) for this segment\'s timing, if present.
+   */
+  timescale?: number;
+  /**
+   * Segment duration in seconds, if the container reports it.
+   */
+  eventDurationSecs?: number;
+}
+/**
+ * When [`AssetVerifier::verify_asset`] queries the registry.
+ */
+type RecoveryPolicy = "whenMissing" | "always";
+/**
+ * Where the registry is, when to query it, and how far. One value rather than an endpoint beside
+ * loose flags, so a policy cannot be configured on a verifier that has nowhere to apply it.
+ */
+interface RegistryOptions {
+  /**
+   * Soft Binding Resolution API base URL (`https://registry.trylimbo.com`).
+   */
+  url: string;
+  /**
+   * Defaults to [`RecoveryPolicy::WhenMissing`].
+   */
+  recovery?: RecoveryPolicy;
+  /**
+   * Defaults to [`RegistryQueries::DerivedThenContent`].
+   */
+  queries?: RegistryQueries;
+}
+/**
+ * Whether a code is a success, an informational note, or a failure.
+ */
+type ValidationCodeKind = "success" | "informational" | "failure";
+/**
+ * [`crate::asset::CredentialOrigin`] as JS sees it: a tagged union, since each way of finding a
+ * credential carries different evidence. Lane-local for the same reason [`FingerprintCheck`] is: a
+ * tag layout is what `#[binding(wasm)]` declines to express.
+ */
+type CredentialOrigin = {
+  kind: "embedded";
+} | {
+  kind: "recoveredByFingerprint";
+  binding: SoftBinding;
+  registryScore: number | undefined;
+} | {
+  kind: "recoveredByWatermark";
+  binding: SoftBinding;
+  registryScore: number | undefined;
+} | {
+  kind: "recoveredByContent";
+  discoveries: ContentBindingEvidence[];
+};
+/**
+ * [`crate::asset::FingerprintCheck`] as JS sees it: a tagged union, since `compared` carries a
+ * measurement the other two do not. Lane-local rather than `#[binding(wasm)]` on the core,
+ * because a tag layout is exactly what that macro declines to express.
+ */
+type FingerprintCheck = {
+  kind: "notNeeded";
+} | {
+  kind: "nothingToCompare";
+} | {
+  kind: "unsupported";
+  algorithm: string;
+} | {
+  kind: "indeterminate";
+} | {
+  kind: "compared";
+  score: number;
+};
+interface AssetVerification {
+  credentials: FoundCredential[];
+  recovery: RecoverySummary;
+  goldenComparison: GoldenComparison;
+}
+interface ContentBindingEvidence {
+  algorithm: string;
+  class: ContentBindingClass;
+  hint: SoftBinding | undefined;
+  registryScore: number | undefined;
+}
+interface RecoveryIssue {
+  kind: RecoveryIssueKind;
+  manifestId: string | undefined;
+  message: string;
+}
+interface RecoverySummary {
+  status: RecoveryStatus;
+  bestCredentialIndex: number | undefined;
+  issues: RecoveryIssue[];
+}
+type ContentBindingClass = "fingerprint" | "watermark";
+type GoldenComparison = {
+  kind: "notRequested";
+} | {
+  kind: "noEmbeddedManifest";
+} | {
+  kind: "noRecoveredManifest";
+} | {
+  kind: "matches";
+  recoveredIndex: number;
+} | {
+  kind: "differs";
+  recoveredIndex: number;
+} | {
+  kind: "indeterminate";
+  recoveredIndex: number | undefined;
+};
+type RecoveryIssueKind = "binder" | "bindingQuery" | "queryRefused" | "contentQuery" | "capabilities" | "contentTooLarge" | "candidateFetch" | "candidateValidation" | "resourceLimit";
+type RecoveryStatus = "notRequested" | "notFound" | "recovered" | "incomplete";
+declare class AssetVerifier {
+  private constructor();
+  free(): void;
+  [Symbol.dispose](): void;
+  /**
+   * # Errors
+   *
+   * Throws `TRUST_CONFIG_INVALID` when the trust anchors are invalid.
+   */
+  static create(options: AssetVerifierOptions): AssetVerifier;
+  /**
+   * Verify an asset against the configured trust anchors. `binders` compose
+   * soft-binding recovery after the embedded pass, tried in order,
+   * first hit wins; pass `[]` to proceed directly to registry `byContent` recovery.
+   *
+   * Reads the C2PA-native formats. A container format (MXF) is plugin-backed, and plugins
+   * are native, so a master is verified through the native SDK.
+   *
+   * # Errors
+   *
+   * Throws on a malformed `input`, a registry (or binder) failure, or a validation
+   * failure.
+   */
+  verify(input: RangeSource, binders: Binder[]): Promise<AssetVerification>;
+}
+/**
+ * A soft-binding binder a client runs itself. Build with `Binder.iscc()` or
+ * `Binder.held(binding)`, and pass a list to `verify`.
+ *
+ * Vendor watermark detection is registry-side in this SDK: configured detectors participate in
+ * `verify` through `byContent`, while `Binder.held` covers values already available to the caller.
+ */
+declare class Binder {
+  private constructor();
+  free(): void;
+  [Symbol.dispose](): void;
+  /**
+   * Derive this binder's binding standalone; `undefined` when it finds none.
+   * Input is a `RangeSource` (format inferred from content when omitted).
+   *
+   * # Errors
+   *
+   * Throws on malformed or unreadable input.
+   */
+  derive(content: RangeSource, format?: string | null): Promise<SoftBinding | undefined>;
+  /**
+   * A binder contributing a binding you already hold (e.g. an out-of-band video ISCC).
+   */
+  static held(binding: SoftBinding): Binder;
+  /**
+   * Local ISCC Image-Code for supported image formats.
+   */
+  static iscc(): Binder;
+}
+declare function C2PA_TRUST_LIST(): string;
+declare function C2PA_TSA_TRUST_LIST(): string;
+declare function DEV_CA(): string;
+/**
+ * One stream being validated. It owns the session keys and manifest ids its init segments
+ * advertised, so releasing the stream is dropping this object.
+ */
+declare class StreamValidation {
+  private constructor();
+  free(): void;
+  [Symbol.dispose](): void;
+  /**
+   * Everything this stream's init segments have registered, as CBOR for another node to
+   * `StreamVerifier.resume` from.
+   *
+   * The one piece of stream state that leaves the SDK, and only because a clustered
+   * verifier needs it: the init URL is overwritten on rotation, so a node joining during
+   * the overlap cannot rebuild the previous key by refetching. One value, produced once
+   * and consumed once. Not a store.
+   *
+   * # Errors
+   *
+   * Throws an `SdkError` (`STREAM_INVALID`) when a registered session key cannot be
+   * re-encoded.
+   */
+  export(): Uint8Array;
+  /**
+   * Validate a stream segment.
+   *
+   * # Errors
+   *
+   * Throws an `SdkError` on parse or signature failure, or when a media segment arrives
+   * before any init was processed for the stream.
+   */
+  validate(data: RangeSource): Promise<SegmentValidation>;
+}
+declare class StreamVerifier {
+  private constructor();
+  free(): void;
+  [Symbol.dispose](): void;
+  /**
+   * Create a `StreamVerifier`.
+   *
+   * # Errors
+   *
+   * Throws an `SdkError` (`TRUST_CONFIG_INVALID`) when the trust anchors are invalid.
+   */
+  static create(options: StreamVerifierOptions): StreamVerifier;
+  /**
+   * Open `stream_id` for validation, handing back a `StreamValidation` to feed segments to.
+   *
+   * No I/O: the handle carries the id so it cannot be mistyped or confused with another
+   * stream's, and classification still happens per segment. Opening one id twice hands
+   * back the same live session, so a component that remounts keeps the state its earlier
+   * handle accumulated.
+   */
+  open(stream_id: string): StreamValidation;
+  /**
+   * Open `stream_id` on the state another node exported, merged into whatever this one
+   * holds for that id already.
+   *
+   * # Errors
+   *
+   * Throws an `SdkError` (`STREAM_INVALID`) when `state` is not a value
+   * `StreamValidation.export` produced, or carries a version this SDK no longer reads.
+   */
+  resume(stream_id: string, state: Uint8Array): StreamValidation;
+}
+//#endregion
+//#region src/worker-thread.d.ts
+/**
+ * An asset as it crosses a thread. A `Blob` (a `File` from an `<input>`, a `Response.blob()`) is a
+ * handle: nothing is copied to send it and nothing is resident to hold it, so it has no size
+ * ceiling. Bytes are copied once, and are bounded by what the caller already holds in memory.
+ */
+type Asset = Blob | Uint8Array | ArrayBuffer;
+/**
+ * A `Binder`, spelled as data: `Binder.iscc()` and `Binder.held(binding)` in the order the direct
+ * import declares them.
+ */
+type BinderSpec = {
+  readonly kind: "iscc";
+} | {
+  readonly kind: "held";
+  readonly binding: SoftBinding;
+};
+/**
+ * A wasm object held in this thread on the caller's behalf.
+ *
+ * The subclasses exist to convert arguments, which is the one job a transfer handler cannot take
+ * over: a handler rewrites the value on the wire but not its declared type, so `Remote<Sdk>` would
+ * go on telling the caller to pass the `RangeSource` that is the whole reason there is a worker.
+ * A method that takes an `Asset` and converts it says the same thing in the type the caller reads.
+ *
+ * The finalizer is the whole lifetime. Comlink registers every proxy it hands out with a
+ * `FinalizationRegistry`, so dropping the handle over there frees the wasm object here.
+ */
+declare abstract class Handle<T extends {
+  free(): void;
+}> {
+  protected readonly inner: T;
+  constructor(inner: T);
+  [finalizer](): void;
+}
+declare class AssetVerifierHandle extends Handle<AssetVerifier> {
+  verify(asset: Asset, binders?: readonly BinderSpec[]): Promise<AssetVerification>;
+}
+/** One stream being validated. Dropping the handle releases the session it accumulated. */
+declare class StreamValidationHandle extends Handle<StreamValidation> {
+  validate(segment: Asset): Promise<SegmentValidation>;
+  export(): Uint8Array;
+}
+declare class StreamVerifierHandle extends Handle<StreamVerifier> {
+  open(streamId: string): StreamValidationHandle & ProxyMarked;
+  resume(streamId: string, state: Uint8Array): StreamValidationHandle & ProxyMarked;
+}
+/** The module's own surface, name for name with the direct import. */
+declare const sdk: {
+  /**
+   * Compile and instantiate. `connect()` awaits this before handing the caller its proxy, so no
+   * other call can find an uninstantiated module. Compiles once however often it is called.
+   */
+  init(module?: BufferSource | WebAssembly.Module): Promise<void>;
+  AssetVerifier: {
+    create: (options: AssetVerifierOptions) => AssetVerifierHandle & ProxyMarked;
+  } & ProxyMarked;
+  StreamVerifier: {
+    create: (options: StreamVerifierOptions) => StreamVerifierHandle & ProxyMarked;
+  } & ProxyMarked;
+  Binder: {
+    /**
+     * Derive one binder's binding standalone. The binder is built, used and dropped here, so there
+     * is no handle to keep: what the caller wants back is the binding.
+     */
+    derive: (spec: BinderSpec, content: Asset, format?: string) => Promise<SoftBinding | undefined>;
+  } & ProxyMarked;
+  /**
+   * Read a detached manifest store. Contents, not a verdict: with no asset there is no hard binding
+   * to check, so the store's validation fields state nothing this established.
+   */
+  parse(manifest: Asset): Promise<import("@contentauth/c2pa-types").ManifestStore>;
+  /**
+   * The bytes behind one resource the store references, by the `identifier` on its reference: any
+   * manifest's claim thumbnail, and any ingredient's.
+   */
+  resource(manifest: Asset, uri: string): Promise<Uint8Array<ArrayBufferLike> | undefined>;
+  /**
+   * Every thumbnail the store references, by the identifier it references them under. One parse
+   * and one thread hop for the whole set, where `resource` pays both per call.
+   */
+  thumbnails(manifest: Asset): Promise<Record<string, Uint8Array<ArrayBufferLike>>>;
+  C2PA_TRUST_LIST: typeof C2PA_TRUST_LIST;
+  C2PA_TSA_TRUST_LIST: typeof C2PA_TSA_TRUST_LIST;
+  DEV_CA: typeof DEV_CA;
+  close(): void;
+};
+/** What the caller's thread holds a `Comlink.Remote` of. */
+type Sdk = typeof sdk;
+//#endregion
+//#region src/worker.d.ts
+interface ConnectOptions {
+  /**
+   * Already-fetched `.wasm` bytes, or a compiled module, for where the worker cannot fetch beside
+   * itself: a bundler that rewrites the URL, or a page that has the binary in hand already.
+   */
+  readonly module?: BufferSource | WebAssembly.Module;
+}
+/**
+ * Start the SDK in a Worker and wait for its module to instantiate.
+ *
+ * Handles taken from the returned SDK (a verifier, a stream, a validation) free themselves when they
+ * are collected, so the only lifetime to hold is the SDK's own: `close()` ends the thread.
+ */
+declare function connect({ module }?: ConnectOptions): Promise<Remote<Sdk>>;
+//#endregion
+export { ConnectOptions, connect };

package/gen/wasm/worker.js

@@ -0,0 +1,21 @@
+import { i as wrap } from "./comlink.js";
+//#region src/worker.ts
+/**
+* Start the SDK in a Worker and wait for its module to instantiate.
+*
+* Handles taken from the returned SDK (a verifier, a stream, a validation) free themselves when they
+* are collected, so the only lifetime to hold is the SDK's own: `close()` ends the thread.
+*/
+async function connect({ module } = {}) {
+	const worker = new Worker(new URL("./worker-thread.js", import.meta.url), { type: "module" });
+	const sdk = wrap(worker);
+	try {
+		await sdk.init(module);
+	} catch (error) {
+		worker.terminate();
+		throw error;
+	}
+	return sdk;
+}
+//#endregion
+export { connect };

package/package.json

@@ -0,0 +1,45 @@
+{
+  "name": "@trylimbo/sdk-verifier-wasm",
+  "version": "0.1.0-canary.100",
+  "license": "UNLICENSED",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/limboai/limbo-integrity.git",
+    "directory": "host/verifier/node/wasm"
+  },
+  "type": "module",
+  "types": "./gen/wasm/trylimbo_sdk_verifier.d.ts",
+  "exports": {
+    ".": {
+      "types": "./gen/wasm/trylimbo_sdk_verifier.d.ts",
+      "default": "./gen/wasm/trylimbo_sdk_verifier.js"
+    },
+    "./wasm": "./gen/wasm/trylimbo_sdk_verifier_bg.wasm",
+    "./worker": {
+      "types": "./gen/wasm/worker.d.ts",
+      "default": "./gen/wasm/worker.js"
+    }
+  },
+  "files": [
+    "gen/wasm/**/*"
+  ],
+  "trylimbo": {
+    "lane": "wasm",
+    "role": "sdk",
+    "rust": {
+      "dir": "api/sdk/verifier"
+    },
+    "toolchain": "wasm-bindgen"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "dependencies": {
+    "@contentauth/c2pa-types": "^0.7.4"
+  },
+  "devDependencies": {
+    "comlink": "4.4.2",
+    "typescript": "^7.0.2"
+  },
+  "stableVersion": "0.0.8"
+}