@trylimbo/sdk-verifier-wasm 0.2.23 → 0.2.25-canary.37

package/gen/wasm/trylimbo_sdk_verifier.d.ts

@@ -16,37 +16,31 @@ export interface RangeSource {
 
 
 /**
- * A C2PA soft binding: an algorithm id (from the C2PA soft-binding algorithm
- * list, e.g. `io.iscc.v0`) plus its algorithm-specific value (the `ISCC:…` code,
- * a watermark token, …). The signer embeds it as a `c2pa.soft-binding` assertion
- * and indexes it, so a transcoded copy whose exact content hash no longer
- * matches still recovers the manifest from the repository.
+ * A `soft-binding-block-map`. No scope is the whole content.
  */
-export interface SoftBinding {
-    /**
-     * C2PA soft-binding algorithm id, e.g. `io.iscc.v0`.
-     */
-    alg: string;
-    /**
-     * Algorithm-specific binding value: the canonical string the algorithm
-     * produces (an `ISCC:…` code, a watermark token). Its UTF-8 bytes are what
-     * the repository lookup base64-encodes.
-     */
-    value: string;
+export interface Block {
+    value: Uint8Array;
+    scope?: Scope;
 }
 
 /**
- * A binder spelled as data, so it crosses into a worker as well as the direct import: the
- * SDK\'s own two. A browser has no host binder: a detector runs repository-side.
+ * A `soft-binding-scope-map`.
  */
-export type BinderSpec = { kind: "iscc" } | { kind: "held"; binding: SoftBinding };
+export interface Scope {
+    timespan?: Timespan;
+}
+
+/**
+ * A `soft-binding-timespan-map`: where the range starts in the media and how long it lasts, in
+ * milliseconds.
+ */
+export interface Timespan {
+    start: number;
+    duration: number;
+}
 
 /**
  * A canonical gRPC/Connect status code: the coarse, closed failure class.
- *
- * The wasm lane projects this as a camelCase string like every other tagged value
- * there, so a consumer narrows on `err.code === \"resourceExhausted\"`; the native lane
- * projects an enum.
  */
 export type Code = "canceled" | "unknown" | "invalidArgument" | "deadlineExceeded" | "notFound" | "alreadyExists" | "permissionDenied" | "resourceExhausted" | "failedPrecondition" | "aborted" | "outOfRange" | "unimplemented" | "internal" | "unavailable" | "dataLoss" | "unauthenticated";
 
@@ -77,11 +71,11 @@ export interface ReasonError {
 /**
  * A session signing key from the init manifest\'s roster (spec §19.4.4).
  */
-export interface SessionKeySummary {
+export interface SessionKey {
     /**
      * Identifier of the session signing key.
      */
-    keyId: Uint8Array;
+    kid: Uint8Array;
     /**
      * The session key\'s public half (SEC1-encoded bytes).
      */
@@ -97,103 +91,33 @@ export interface StatusError {
 }
 
 /**
- * C2PA validation state of a manifest (spec §14.3).
- */
-export type ValidationState = "Invalid" | "Valid" | "Trusted";
-
-/**
- * Construction options for [`AssetVerifier::new`] (and the `AssetVerifier.create` JS
- * binding). Every field is stated: nothing here is chosen on the caller\'s behalf.
- *
- * One definition, all lanes: `#[binding]` derives the shapes directly here:
- * tsify (camelCase) on wasm, a `uniffi::Record` on the native `ffi` build, so there is no
- * per-lane DTO copy. Off both lanes it is a plain struct.
- */
-export interface AssetVerifierOptions {
-    /**
-     * The C2PA manifest repositories recovery asks, each a Soft Binding Resolution API declared
-     * for exactly the algorithms it may be asked for. Results merge by manifest, and a match\'s
-     * `endpoint` is fetched from only when it names one of these. Empty: no recovery can be
-     * asked of this verifier.
-     */
-    repositories: Repository[];
-    /**
-     * PEM trust anchors for the manifest signers the caller trusts.
-     */
-    trustAnchors: string[];
-    /**
-     * PEM trust anchors for the time-stamping authorities the caller trusts.
-     */
-    tsaTrustAnchors: string[];
-    /**
-     * Also trust the bundled official C2PA anchors, manifest and TSA lists, beside the
-     * caller\'s. `false` trusts the caller\'s lists alone.
-     */
-    trustC2paAnchors: boolean;
-    /**
-     * Issuer DIDs whose CAWG identity (ICA) credentials count as validated, matched
-     * exactly against the credential issuer. Empty trusts no issuer: every identity assertion
-     * then reports `cawg.ica.untrusted_issuer` and withholds `cawg.ica.credential_valid`,
-     * which leaves the manifest\'s own validity untouched.
-     */
-    trustedIcaIssuers: string[];
-}
-
-/**
- * Construction options for [`StreamVerifier::new`] (and the `StreamVerifier.create`
- * JS binding). Every field is stated: nothing here is chosen on the caller\'s behalf.
- *
- * `#[binding]` derives the wasm shape (`trustC2paAnchors` camelCase) and,
- * with `ffi`, a `uniffi::Record` for the native `StreamVerifier.create` binding, so there
- * is no per-lane DTO copy. Off both lanes it is a plain struct.
+ * An asset a repository downloads, as the `byReference` request body names it.
  */
-export interface StreamVerifierOptions {
-    /**
-     * PEM trust anchors for the manifest signers the caller trusts.
-     */
-    trustAnchors: string[];
+export interface Reference {
     /**
-     * PEM trust anchors for the time-stamping authorities the caller trusts.
+     * A short-lived https URL without credentials.
      */
-    tsaTrustAnchors: string[];
-    /**
-     * Also trust the bundled official C2PA anchors, manifest and TSA lists, beside the
-     * caller\'s. `false` trusts the caller\'s lists alone.
-     */
-    trustC2paAnchors: boolean;
+    url: string;
     /**
-     * Issuer DIDs whose CAWG identity (ICA) credentials count as validated, matched
-     * exactly against the credential issuer. Empty trusts no issuer: an identity assertion
-     * on the init segment\'s manifest then reports `cawg.ica.untrusted_issuer` and withholds
-     * `cawg.ica.credential_valid`.
+     * The asset\'s size in bytes.
      */
-    trustedIcaIssuers: string[];
+    length: number;
     /**
-     * How far a segment\'s timestamp may sit from wall-clock before it is rejected as
-     * skewed, in seconds: the deployment\'s own encoder-clock allowance, stated rather than
-     * assumed.
+     * The asset\'s media type.
      */
-    segmentSkewToleranceSecs: number;
+    format?: string;
+    ranges?: import('@contentauth/c2pa-types').Range[];
 }
 
 /**
- * Everything one `derive` needs beyond the asset: how its format is known. The same record
- * the native lane\'s `DeriveOptions` is, spelled as data.
- */
-export interface DeriveOptions {
-    format: AssetFormat;
-}
-
-/**
- * How a call knows the asset\'s format: stated by the caller, or read from the leading bytes.
- * Stated, never defaulted: sniffing is a choice made by name.
+ * C2PA validation state of a manifest (spec §14.3).
  */
-export type AssetFormat = { kind: "sniff" } | { kind: "declared"; mediaType: string };
+export type ValidationState = "Invalid" | "Valid" | "Trusted";
 
 /**
  * One C2PA manifest repository, as the Soft Binding Resolution API spec lets a client find it.
  */
-export type Repository = { kind: "named"; url: string; algorithms: string[] } | { kind: "listed"; algorithm: string };
+export type Repository = { kind: "named"; url: string; algorithms: string[] } | { kind: "registered"; alg: string };
 
 /**
  * One C2PA validation status entry (spec §15.3): the registered code, its kind, and the
@@ -227,13 +151,7 @@ export interface FieldViolation {
  */
 export interface Credential {
     /**
-     * The bytes behind every thumbnail the manifests reference, by that reference\'s
-     * `identifier`: each manifest\'s claim thumbnail and each ingredient\'s. The manifests state
-     * identifiers and no images, so this is what a chain draws from.
-     */
-    thumbnails: Record<string, Uint8Array>;
-    /**
-     * Where this credential came from. See [`CredentialOrigin`].
+     * Where this credential came from.
      */
     origin: CredentialOrigin;
     manifest: import('@contentauth/c2pa-types').ManifestStore;
@@ -242,18 +160,40 @@ export interface Credential {
      */
     hardBinding: HardBinding;
     /**
-     * Where this credential sits among the others returned. See [`crate::asset::Lineage`].
+     * Where this credential sits among the others returned.
      */
     lineage: Lineage;
 }
 
+/**
+ * One query that located a recovered credential: how it was asked, under which algorithm, and
+ * where the manifest came from.
+ */
+export interface Discovery {
+    via: DiscoveryVia;
+    alg: string;
+    type: SoftBindingType;
+    /**
+     * 0-100, the repository\'s `similarityScore`.
+     */
+    score?: number;
+    repository: string;
+    /**
+     * The resolution API the manifest was fetched from, when not `repository`.
+     */
+    endpoint?: string;
+}
+
 /**
  * Outcome of validating a media segment against its stream\'s init.
  */
 export interface MediaValidation {
-    valid: boolean;
+    /**
+     * `invalid` on any failure, else the state of the init manifest the segment\'s key came from.
+     */
+    state: ValidationState;
     codes: ValidationCode[];
-    keyId: Uint8Array;
+    kid: Uint8Array;
     timing: SegmentTiming;
     manifestId: string;
 }
@@ -265,7 +205,7 @@ export interface InitValidation {
     state: ValidationState;
     codes: ValidationCode[];
     manifest: import('@contentauth/c2pa-types').ManifestStore;
-    sessionKeys: SessionKeySummary[];
+    sessionKeys: SessionKey[];
 }
 
 /**
@@ -273,125 +213,202 @@ export interface InitValidation {
  */
 export type SegmentValidation = ({ kind: "init" } & InitValidation) | ({ kind: "media" } & MediaValidation) | { kind: "unknown" };
 
+/**
+ * The C2PA 2.4 golden-flow comparison of the embedded manifest against what the repository holds.
+ */
+export type Golden = { kind: "matches"; index: number } | { kind: "differs"; index: number } | { kind: "noneMatches"; candidates: number[] } | { kind: "unreadable"; index: number };
+
+/**
+ * The C2PA list\'s `type` of a soft binding algorithm.
+ */
+export type SoftBindingType = "fingerprint" | "watermark";
+
+/**
+ * The Soft Binding Resolution API route a discovery came through.
+ */
+export type DiscoveryVia = { kind: "byBinding"; value: Uint8Array } | { kind: "byContent"; hint?: Hint } | { kind: "byReference"; hint?: Hint };
+
 /**
  * The error every SDK call throws: a decoded `google.rpc.Status`, discriminated
  * by `kind`. A consumer switches on `err.kind` (`\"reason\" | \"invalid\" | \"status\"`)
  * and reads the shape-specific fields; `code` and `message` are common to every
- * shape. Thrown as a plain object across the wasm boundary (tsify).
+ * shape.
  */
 export type SdkError = ({ kind: "status" } & StatusError) | ({ kind: "reason" } & ReasonError) | ({ kind: "invalid" } & InvalidError);
 
 /**
- * Timing facts carried by a media segment\'s container.
+ * The evidence that singled a recovered verdict out.
  */
-export interface SegmentTiming {
+export type VerdictRule = "onlyCandidate" | "notSuperseded" | "hardBinding";
+
+/**
+ * The query a repository answers from the content: `matches/byReference` when `reference` is
+ * stated, so nothing is uploaded, else `matches/byContent` with the asset in the request.
+ */
+export interface Content {
+    when: ContentWhen;
     /**
-     * Media segment sequence number (exact below 2^53).
+     * Where each repository downloads the asset from.
      */
-    sequenceNumber: number;
+    reference?: Reference;
     /**
-     * MP4 timescale (ticks per second) for this segment\'s timing, if present.
+     * The largest asset an upload sends, in bytes; a larger one is reported `tooLarge`. Absent,
+     * 64 MiB.
      */
-    timescale?: number;
+    maxUploadBytes?: number;
+}
+
+/**
+ * The re-sign chain between the returned credentials, by manifest label.
+ */
+export interface Lineage {
+    supersedes: string[];
+    supersededBy: string[];
+}
+
+/**
+ * The value a content query was hinted with, under its own algorithm.
+ */
+export interface Hint {
+    alg: string;
+    value: Uint8Array;
+}
+
+/**
+ * Timing a media segment\'s container carries.
+ */
+export interface SegmentTiming {
+    /**
+     * The segment\'s `sequenceNumber` (exact below 2^53).
+     */
+    sequence: number;
     /**
-     * Segment duration in seconds, if the container reports it.
+     * The span its C2PA `emsg` covers, in milliseconds.
      */
-    eventDurationSecs?: number;
+    duration?: number;
 }
 
 /**
- * What one verify may do to recover a manifest, as data: the binders this client derives for
- * itself, decided into `matches/byBinding`, and one field per content operation, absent when
- * not to be called. It needs a configured repository and at least one query.
+ * What a stream verifier trusts, and how far a segment\'s clock may drift.
  */
-export interface Recovery {
-    when: RecoveryTrigger;
-    binders: BinderSpec[];
-    byContent?: ByContent;
-    byReference?: ByReference;
+export interface StreamVerifierOptions {
+    trust: Trust;
+    /**
+     * How far a segment\'s presentation time may sit outside its session key\'s validity period,
+     * in milliseconds. Absent, 5 minutes.
+     */
+    skewTolerance?: number;
 }
 
 /**
- * When [`AssetVerifier::verify_asset`] queries the repository.
+ * What a verifier trusts. An omitted list trusts nothing.
  */
-export type RecoveryTrigger = "manifestMissing" | "always";
+export interface Trust {
+    /**
+     * PEM anchors for the manifest signers the caller trusts.
+     */
+    anchors?: string[];
+    /**
+     * PEM anchors for the time-stamping authorities the caller trusts.
+     */
+    tsaAnchors?: string[];
+    /**
+     * Also trust the bundled official C2PA manifest and TSA lists, beside the caller\'s.
+     */
+    c2pa: boolean;
+    /**
+     * Issuer DIDs whose CAWG identity (ICA) credentials count as validated, matched exactly
+     * against the credential issuer. Empty trusts no issuer: every identity assertion then
+     * reports `cawg.ica.untrusted_issuer` and withholds `cawg.ica.credential_valid`, which leaves
+     * the manifest\'s own validity untouched.
+     */
+    icaIssuers?: string[];
+}
 
 /**
- * Whether a code is a success, an informational note, or a failure.
+ * What an asset verifier trusts and which repositories it may ask. An omitted list trusts or
+ * asks nothing.
  */
-export type ValidationCodeKind = "success" | "informational" | "failure";
+export interface AssetVerifierOptions {
+    /**
+     * The C2PA manifest repositories recovery asks, each a Soft Binding Resolution API declared
+     * for exactly the algorithms it may be asked for. Results merge by manifest, and a match\'s
+     * `endpoint` is fetched from only when it names one of these. Empty: no recovery can be
+     * asked of this verifier.
+     */
+    repositories?: Repository[];
+    trust: Trust;
+}
 
 /**
- * Whether a content form runs on this verify. Judged against the byBinding results alone.
+ * What one verify may do to recover a manifest, as data: the soft bindings this client looks up
+ * itself through `matches/byBinding`, and the content query, absent when not to be asked. It
+ * needs a configured repository and at least one query.
  */
-export type ContentTrigger = "byBindingMisses" | "always";
+export interface Recovery {
+    when: RecoveryTrigger;
+    softBindings?: SoftBindingSource[];
+    content?: Content;
+    /**
+     * The whole recovery\'s budget in milliseconds, every repository together, each request
+     * bounded by what remains. Absent, 10 minutes; at most 2147483647.
+     */
+    timeout?: number;
+}
 
 /**
- * [`crate::asset::ByReference`] as JS states it: the region is the `Range` of
- * `@contentauth/c2pa-types`, the shape a credential\'s actions carry.
+ * What this verify concludes about the asset, from signed evidence alone.
  */
-export interface ByReference {
-    after: ContentTrigger;
-    url: string;
-    length: number;
-    mediaType?: string;
-    region: import('@contentauth/c2pa-types').Range[];
-}
+export type Verdict = { kind: "unsigned" } | { kind: "inconclusive" } | { kind: "embedded" } | { kind: "recovered"; index: number; decidedBy: VerdictRule } | { kind: "recoveredDerivative"; index: number; decidedBy: VerdictRule } | { kind: "ambiguous"; candidates: number[] };
 
 /**
- * [`crate::asset::CredentialOrigin`] as JS sees it: a tagged union, since each way of finding a
- * credential carries different evidence. Lane-local for the same reason [`FingerprintCheck`] is: a
- * tag layout is what `#[binding(wasm)]` declines to express.
+ * When a verify asks the repositories.
  */
-export type CredentialOrigin = { kind: "embedded" } | { kind: "recovered"; discoveries: RecoveryDiscovery[]; fingerprintCheck: FingerprintCheck };
+export type RecoveryTrigger = "manifestMissing" | "always";
 
 /**
- * [`crate::asset::FingerprintCheck`] as JS sees it: a tagged union, since `compared` carries a
- * measurement the other two do not. Lane-local rather than `#[binding(wasm)]` on the core,
- * because a tag layout is exactly what that macro declines to express.
+ * Where a credential came from: embedded in the asset, or recovered from a repository.
  */
-export type FingerprintCheck = { kind: "notNeeded" } | { kind: "nothingToCompare" } | { kind: "unsupported"; algorithm: string } | { kind: "indeterminate" } | { kind: "compared"; score: number };
+export type CredentialOrigin = { kind: "embedded" } | { kind: "recovered"; discoveries: Discovery[]; fingerprintCheck: FingerprintCheck };
 
 /**
- * [`crate::asset::HardBinding`] as JS sees it.
+ * Where one byBinding query\'s value comes from. A browser has no host engine: a vendor\'s
+ * detector runs repository-side, through `byContent`.
  */
-export type HardBinding = "match" | "mismatch";
+export type SoftBindingSource = { kind: "builtin"; alg: string } | { kind: "held"; alg: string; value: Uint8Array };
 
 /**
- * [`crate::asset::Lineage`] as JS sees it.
+ * Whether a code is a success, an informational note, or a failure.
  */
-export interface Lineage {
-    supersedes: string[];
-    supersededBy: string[];
-}
+export type ValidationCodeKind = "success" | "informational" | "failure";
 
 /**
- * [`crate::asset::RecoveryIssue`] as JS sees it: a tagged union, each kind with its own data.
+ * Whether a content form runs on this verify. Judged against the byBinding results alone.
  */
-export type RecoveryIssue = { kind: "binderFailed"; binderIndex: number; message: string } | { kind: "algorithmDeprecated"; algorithm: string } | { kind: "bindingUndeclared"; binderIndex: number; algorithm: string } | { kind: "bindingQueryFailed"; repository: string; binderIndex: number; algorithm: string; message: string } | { kind: "queryRefused"; repository: string; algorithm: string; message: string } | { kind: "contentFormUnsupported"; repository: string; message: string } | { kind: "contentQueryFailed"; repository: string; algorithm: string; message: string } | { kind: "capabilitiesUnavailable"; repository: string; message: string } | { kind: "contentTooLarge"; capBytes: number } | { kind: "candidateFetchFailed"; repository: string; manifestId: string; message: string } | { kind: "candidateInvalid"; manifestId: string; reason: string } | { kind: "endpointRefused"; repository: string; manifestId: string; endpoint: string } | { kind: "resourceLimitReached"; message: string };
+export type ContentWhen = "bindingMisses" | "always";
 
 /**
- * [`crate::asset::VerdictRule`] as JS sees it.
+ * Whether the asset\'s own fingerprint backs up a manifest that a watermark led to.
  */
-export type VerdictRule = "onlyCandidate" | "notSuperseded" | "hardBinding";
+export type FingerprintCheck = { kind: "notNeeded" } | { kind: "missing" } | { kind: "unsupported"; alg: string } | { kind: "indeterminate" } | { kind: "compared"; score: number };
 
 /**
- * [`crate::asset::Verdict`] as JS sees it.
+ * Whether the manifest\'s hard binding holds over the bytes this verify read.
  */
-export type Verdict = { kind: "unsigned" } | { kind: "inconclusive" } | { kind: "embedded" } | { kind: "recovered"; index: number; decidedBy: VerdictRule } | { kind: "recoveredDerivative"; index: number; decidedBy: VerdictRule } | { kind: "ambiguous"; candidates: number[] };
+export type HardBinding = "match" | "mismatch";
 
 /**
- * `matches/byContent`: the asset is uploaded to each repository, one request per algorithm that
- * repository is declared for.
+ * Why repository recovery did not complete cleanly, or why one candidate was omitted.
  */
-export interface ByContent {
-    after: ContentTrigger;
-}
+export type RecoveryIssue = { kind: "computeFailed"; alg: string; message: string } | { kind: "bindingFailed"; repository: string; alg: string; message: string } | { kind: "queryRefused"; repository: string; alg: string; message: string } | { kind: "contentFailed"; repository: string; alg: string; message: string } | { kind: "capabilitiesUnavailable"; repository: string; message: string } | { kind: "tooLarge"; maxUploadBytes: number } | { kind: "fetchFailed"; repository: string; manifestId: string; message: string } | { kind: "candidateInvalid"; manifestId: string; reason: string } | { kind: "endpointRefused"; repository: string; manifestId: string; endpoint: string } | { kind: "limitReached"; message: string };
 
 export interface AssetVerification {
     credentials: Credential[];
     recovery: RecoverySummary;
-    goldenComparison: GoldenComparison;
+    /**
+     * Absent when there was nothing to compare.
+     */
+    golden?: Golden;
     verdict: Verdict;
 }
 
@@ -400,12 +417,6 @@ export interface RecoverySummary {
     issues: RecoveryIssue[];
 }
 
-export type ContentBindingClass = "fingerprint" | "watermark";
-
-export type GoldenComparison = { kind: "notRequested" } | { kind: "noEmbeddedManifest" } | { kind: "noRecoveredManifest" } | { kind: "recoveryIncomplete" } | { kind: "matches"; recoveredIndex: number } | { kind: "differs"; recoveredIndex: number } | { kind: "noneMatches"; candidates: number[] } | { kind: "unreadable"; recoveredIndex: number };
-
-export type RecoveryDiscovery = { kind: "byBinding"; class: ContentBindingClass; binding: SoftBinding; binderIndex: number; repositoryScore: number | undefined; repository: string; fetchedFrom: string } | { kind: "byContent"; hint: SoftBinding | undefined; class: ContentBindingClass; algorithm: string; repositoryScore: number | undefined; repository: string; fetchedFrom: string } | { kind: "byReference"; hint: SoftBinding | undefined; class: ContentBindingClass; algorithm: string; repositoryScore: number | undefined; repository: string; fetchedFrom: string };
-
 export type RecoveryStatus = "notRequested" | "notFound" | "recovered" | "incomplete";
 
 
@@ -427,19 +438,18 @@ export class AssetVerifier {
      *
      * # Errors
      *
-     * Throws on a malformed `input`, a repository (or binder) failure, or a validation
+     * Throws on a malformed `source`, a repository (or engine) failure, or a validation
      * failure.
      */
-    verify(input: RangeSource, recovery?: Recovery | null): Promise<AssetVerification>;
+    verify(source: RangeSource, recovery?: Recovery | null): Promise<Verification>;
 }
 
 /**
- * A [`RangeSource`](crate::wasm::RangeInput) over a `Blob`: a `File` off an `<input>`, a
+ * A `RangeSource` over a `Blob`: a `File` off an `<input>`, a
  * `Response.blob()`, a handle from the file system access API.
  *
- * The only source here that holds nothing. The SDK reads one slice at a time, so an asset larger
- * than the tab's memory verifies at the disk's speed rather than the heap's, and neither ceiling
- * the other two carry applies.
+ * It holds no bytes at all. The SDK reads one slice at a time, so an asset larger than the tab's
+ * memory verifies at the disk's speed rather than the heap's.
  *
  * # Worker only
  *
@@ -473,51 +483,6 @@ export class BlobSource {
     readonly length: number;
 }
 
-/**
- * A [`RangeSource`](crate::wasm::RangeInput) over bytes the caller already holds, read in place.
- *
- * [`MemorySource`] without the copy: the array stays on the JS side and only the window the SDK
- * asks for crosses, so nothing is resident here and linear memory's 4 GiB ceiling never applies to
- * the asset.
- */
-export class BytesSource {
-    free(): void;
-    [Symbol.dispose](): void;
-    constructor(data: Uint8Array);
-    readAt(offset: number, length: number): Uint8Array;
-    readonly length: number;
-}
-
-export function C2PA_TRUST_LIST(): string;
-
-export function C2PA_TSA_TRUST_LIST(): string;
-
-export function DEV_CA(): string;
-
-/**
- * A binder contributing a binding you already hold (e.g. an out-of-band video ISCC):
- * `new HeldBinder(binding)`, the spelling the native lane uses. A verify takes it as data,
- * `{ kind: "held", binding }`, in `recovery.binders`.
- */
-export class HeldBinder {
-    free(): void;
-    [Symbol.dispose](): void;
-    /**
-     * Hand back the held binding; reads nothing.
-     *
-     * # Errors
-     *
-     * Throws when the source cannot be opened.
-     */
-    derive(content: RangeSource, options: DeriveOptions): Promise<SoftBinding | undefined>;
-    /**
-     * # Errors
-     *
-     * Throws `SdkError.invalid` on a binding with an empty algorithm or value.
-     */
-    constructor(binding: SoftBinding);
-}
-
 export class IntoUnderlyingByteSource {
     private constructor();
     free(): void;
@@ -547,37 +512,9 @@ export class IntoUnderlyingSource {
 }
 
 /**
- * The SDK's local ISCC Image-Code binder, for a standalone `derive`: `new IsccBinder()`, the
- * spelling the native lane uses. A verify takes it as data, `{ kind: "iscc" }`, in
- * `recovery.binders`, because a class cannot cross into a worker.
- *
- * Vendor watermark detection is repository-side in this SDK: configured detectors participate in
- * `verify` through `byContent`, while a held binder covers values already available to the caller.
- */
-export class IsccBinder {
-    free(): void;
-    [Symbol.dispose](): void;
-    /**
-     * Derive the asset's ISCC standalone; `undefined` when the format yields none.
-     *
-     * # Errors
-     *
-     * Throws on malformed or unreadable input.
-     */
-    derive(content: RangeSource, options: DeriveOptions): Promise<SoftBinding | undefined>;
-    constructor();
-}
-
-/**
- * An in-memory [`RangeSource`](crate::wasm::RangeInput), for a caller that already holds the whole
- * asset as bytes.
- *
- * # Size ceiling
- *
- * The constructor copies the bytes into wasm linear memory, which is 32-bit addressed, so the
- * asset and everything else the module allocates share a 4 GiB ceiling (a browser tab reaches its
- * own memory limit well before that). [`BytesSource`] takes the same bytes without the copy, and
- * [`BlobSource`] holds nothing at all.
+ * A `RangeSource` over bytes the caller already holds, read in place: the array stays on the JS
+ * side and only the window the SDK asks for crosses, so nothing is resident here and linear
+ * memory's 4 GiB ceiling never applies to the asset.
  */
 export class MemorySource {
     free(): void;
@@ -596,8 +533,8 @@ export class StreamSession {
     free(): void;
     [Symbol.dispose](): void;
     /**
-     * Everything this stream's init segments have registered, as CBOR for another node to
-     * `StreamVerifier.resume` from.
+     * This stream's id and everything its init segments have registered, as CBOR for another
+     * node to `StreamVerifier.resume` from.
      *
      * The one piece of stream state that leaves the SDK, and only because a clustered
      * verifier needs it: the init URL is overwritten on rotation, so a node joining during
@@ -618,7 +555,7 @@ export class StreamSession {
      * Throws an `SdkError` on parse or signature failure, or when a media segment arrives
      * before any init was processed for the stream.
      */
-    validate(data: RangeSource): Promise<SegmentValidation>;
+    validate(source: RangeSource): Promise<SegmentValidation>;
 }
 
 export class StreamVerifier {
@@ -634,26 +571,82 @@ export class StreamVerifier {
      */
     static create(options: StreamVerifierOptions): StreamVerifier;
     /**
-     * Open `stream_id` for validation, handing back a `StreamSession` to feed segments to.
+     * Open the stream `id` for validation, handing back a `StreamSession` to feed segments to.
      *
      * No I/O: the handle carries the id so it cannot be mistyped or confused with another
      * stream's, and classification still happens per segment. Opening one id twice hands
      * back the same live session, so a component that remounts keeps the state its earlier
      * handle accumulated.
      */
-    open(stream_id: string): StreamSession;
+    open(id: string): StreamSession;
     /**
-     * Open `stream_id` on the state another node exported, merged into whatever this one
-     * holds for that id already.
+     * Open the stream another node exported, its state merged into whatever this one holds
+     * for that stream already.
      *
      * # Errors
      *
-     * Throws an `SdkError` (`STREAM_INVALID`) when `state` is not a value
-     * `StreamSession.export` produced, or carries a version this SDK no longer reads.
+     * Throws an `SdkError` with a field violation at `state` when it is not a value
+     * `StreamSession.export` produced (`state.malformed`), or one of another export version
+     * (`state.version`).
      */
-    resume(stream_id: string, state: Uint8Array): StreamSession;
+    resume(state: Uint8Array): StreamSession;
 }
 
+/**
+ * One `verify` result held with the stores it read: `report` is the data, and `resource` reads a
+ * thumbnail from credential `credential` (its position in `report.credentials`) by the
+ * `identifier` of a resource reference in its manifest. A class rather than a field of the
+ * report because a store cannot be serialized, and one handle per verify is what a worker can
+ * proxy (a class nested in the report cannot cross a thread).
+ */
+export class Verification {
+    private constructor();
+    free(): void;
+    [Symbol.dispose](): void;
+    /**
+     * The bytes of one resource credential `credential` holds, or `undefined`.
+     *
+     * # Errors
+     *
+     * Throws `READER_INVALID` when the store holds the resource but cannot produce it, and
+     * `undefined` for a `credential` out of range.
+     */
+    resource(credential: number, uri: string): Uint8Array | undefined;
+    /**
+     * The report: credentials, recovery, golden flow and verdict.
+     */
+    readonly report: AssetVerification;
+}
+
+/**
+ * The bundled C2PA Conformance Program signing-CA trust list (a release snapshot). Trusted by
+ * default with `trust.c2pa`; read it to pin or extend your own list.
+ */
+export function c2paTrustList(): string;
+
+/**
+ * The bundled C2PA time-stamping-authority trust list (a release snapshot).
+ */
+export function c2paTsaTrustList(): string;
+
+/**
+ * The values this SDK computes for `alg` over `source`, `[]` when it finds none. `format` is
+ * the asset's media type; omitted, the bytes name it.
+ *
+ * # Errors
+ *
+ * Throws on an algorithm this SDK computes no value of, a `format` that is no media type or that
+ * the bytes contradict, an unreadable source, or no trustworthy answer.
+ */
+export function computeSoftBinding(alg: string, source: RangeSource, format?: string | null): Promise<Block[]>;
+
+/**
+ * PEM trust anchor for the Limbo Integrity development signing environment, **development
+ * only**, no security guarantees: put it in `trust.anchors` for a development build, never in a
+ * release.
+ */
+export function devCa(): string;
+
 export function init_panic_hook(): void;
 
 /**
@@ -669,78 +662,51 @@ export function init_panic_hook(): void;
  *
  * Throws `READER_INVALID` when the bytes are not a manifest store c2pa can parse.
  */
-export function parse(manifest: Uint8Array): import('@contentauth/c2pa-types').ManifestStore;
+export function parse(manifest: Uint8Array): Promise<import('@contentauth/c2pa-types').ManifestStore>;
 
 /**
  * The bytes of one resource in a detached manifest store, or `undefined` when it holds none
- * under `uri`.
- *
- * `uri` is the `identifier` on a resource reference the store carries, so walking the chain in
- * the parsed store is what produces it: any manifest's claim thumbnail, including a non-active
- * one, and any ingredient's. Render it with the `format` beside that identifier. A `uri` naming a
- * manifest rather than a resource answers that manifest's own JUMBF, so pass what a reference
- * states, never a bare label.
+ * under `uri`: the `identifier` on a resource reference the parsed store carries.
  *
  * # Errors
  *
  * Throws `READER_INVALID` when the bytes are not a manifest store c2pa can parse, or the store
  * holds the resource but cannot produce it.
  */
-export function resource(manifest: Uint8Array, uri: string): Uint8Array | undefined;
-
-/**
- * Every thumbnail the store references, by the `identifier` it references them under: each
- * manifest's claim thumbnail and each ingredient's, whichever manifest carries them.
- *
- * One parse for the whole set, where `resource` pays one per call, so a chain view asks once
- * instead of once per tile. Render each one as the `format` beside its identifier. A reference
- * the store cannot produce is left out rather than failing the set.
- *
- * # Errors
- *
- * Throws `READER_INVALID` when the bytes are not a manifest store c2pa can parse.
- */
-export function thumbnails(manifest: Uint8Array): Record<string, Uint8Array>;
+export function resource(manifest: Uint8Array, uri: string): Promise<Uint8Array | undefined>;
 
 export type InitInput = RequestInfo | URL | Response | BufferSource | WebAssembly.Module;
 
 export interface InitOutput {
     readonly memory: WebAssembly.Memory;
+    readonly computeSoftBinding: (a: number, b: number, c: any, d: number, e: number) => any;
     readonly __wbg_assetverifier_free: (a: number, b: number) => void;
     readonly __wbg_blobsource_free: (a: number, b: number) => void;
-    readonly __wbg_bytessource_free: (a: number, b: number) => void;
     readonly __wbg_memorysource_free: (a: number, b: number) => void;
     readonly __wbg_streamsession_free: (a: number, b: number) => void;
     readonly __wbg_streamverifier_free: (a: number, b: number) => void;
+    readonly __wbg_verification_free: (a: number, b: number) => void;
     readonly assetverifier_create: (a: any) => [number, number, number];
     readonly assetverifier_verify: (a: number, b: any, c: number) => any;
     readonly blobsource_length: (a: number) => number;
     readonly blobsource_new: (a: any) => [number, number, number];
     readonly blobsource_readAt: (a: number, b: number, c: number) => [number, number, number];
-    readonly bytessource_length: (a: number) => number;
-    readonly bytessource_new: (a: any) => number;
-    readonly bytessource_readAt: (a: number, b: number, c: number) => any;
     readonly memorysource_length: (a: number) => number;
-    readonly memorysource_new: (a: number, b: number) => number;
+    readonly memorysource_new: (a: any) => number;
     readonly memorysource_readAt: (a: number, b: number, c: number) => any;
-    readonly parse: (a: number, b: number) => [number, number, number];
-    readonly resource: (a: number, b: number, c: number, d: number) => [number, number, number, number];
+    readonly parse: (a: number, b: number) => any;
+    readonly resource: (a: number, b: number, c: number, d: number) => any;
     readonly streamsession_export: (a: number) => [number, number, number, number];
     readonly streamsession_validate: (a: number, b: any) => any;
     readonly streamverifier_create: (a: any) => [number, number, number];
     readonly streamverifier_open: (a: number, b: number, c: number) => number;
-    readonly streamverifier_resume: (a: number, b: number, c: number, d: number, e: number) => [number, number, number];
-    readonly thumbnails: (a: number, b: number) => [number, number, number];
-    readonly C2PA_TRUST_LIST: () => [number, number];
-    readonly C2PA_TSA_TRUST_LIST: () => [number, number];
-    readonly DEV_CA: () => [number, number];
+    readonly streamverifier_resume: (a: number, b: number, c: number) => [number, number, number];
+    readonly verification_report: (a: number) => any;
+    readonly verification_resource: (a: number, b: number, c: number, d: number) => [number, number, number, number];
+    readonly c2paTrustList: () => [number, number];
+    readonly c2paTsaTrustList: () => [number, number];
+    readonly devCa: () => [number, number];
     readonly init_panic_hook: () => void;
-    readonly __wbg_heldbinder_free: (a: number, b: number) => void;
-    readonly __wbg_isccbinder_free: (a: number, b: number) => void;
-    readonly heldbinder_derive: (a: number, b: any, c: any) => any;
-    readonly heldbinder_new: (a: any) => [number, number, number];
-    readonly isccbinder_derive: (a: number, b: any, c: any) => any;
-    readonly isccbinder_new: () => number;
     readonly __wbg_intounderlyingbytesource_free: (a: number, b: number) => void;
     readonly intounderlyingbytesource_autoAllocateChunkSize: (a: number) => number;
     readonly intounderlyingbytesource_cancel: (a: number) => void;
@@ -757,7 +723,7 @@ export interface InitOutput {
     readonly wasm_bindgen__convert__closures_____invoke__hfa954cb356c7e7e1: (a: number, b: number, c: any) => [number, number];
     readonly wasm_bindgen__convert__closures_____invoke__h32a4f2e7671466cf: (a: number, b: number, c: any, d: any) => void;
     readonly wasm_bindgen__convert__closures_____invoke__hedf60f9cb8ab20c3: (a: number, b: number, c: any) => void;
-    readonly wasm_bindgen__convert__closures_____invoke__hcc9f2329e90526d5: (a: number, b: number) => void;
+    readonly wasm_bindgen__convert__closures_____invoke__hbf782ef36cea6846: (a: number, b: number) => void;
     readonly __wbindgen_malloc: (a: number, b: number) => number;
     readonly __wbindgen_realloc: (a: number, b: number, c: number, d: number) => number;
     readonly __wbindgen_exn_store: (a: number) => void;
@@ -765,6 +731,7 @@ export interface InitOutput {
     readonly __wbindgen_externrefs: WebAssembly.Table;
     readonly __wbindgen_free: (a: number, b: number, c: number) => void;
     readonly __wbindgen_destroy_closure: (a: number, b: number) => void;
+    readonly __externref_drop_slice: (a: number, b: number) => void;
     readonly __externref_table_dealloc: (a: number) => void;
     readonly __wbindgen_start: () => void;
 }