@trylimbo/sdk-verifier-wasm 0.2.24 → 0.2.25-canary.37

package/gen/wasm/worker.d.ts

@@ -163,141 +163,61 @@ interface RangeSource {
   readAt: (offset: number, length: number) => Uint8Array;
 }
 /**
- * A C2PA soft binding: an algorithm id (from the C2PA soft-binding algorithm
- * list, e.g. `io.iscc.v0`) plus its algorithm-specific value (the `ISCC:…` code,
- * a watermark token, …). The signer embeds it as a `c2pa.soft-binding` assertion
- * and indexes it, so a transcoded copy whose exact content hash no longer
- * matches still recovers the manifest from the repository.
+ * A `soft-binding-block-map`. No scope is the whole content.
  */
-interface SoftBinding {
-  /**
-   * C2PA soft-binding algorithm id, e.g. `io.iscc.v0`.
-   */
-  alg: string;
-  /**
-   * Algorithm-specific binding value: the canonical string the algorithm
-   * produces (an `ISCC:…` code, a watermark token). Its UTF-8 bytes are what
-   * the repository lookup base64-encodes.
-   */
-  value: string;
+interface Block {
+  value: Uint8Array;
+  scope?: Scope;
 }
 /**
- * A binder spelled as data, so it crosses into a worker as well as the direct import: the
- * SDK\'s own two. A browser has no host binder: a detector runs repository-side.
+ * A `soft-binding-scope-map`.
  */
-type BinderSpec = {
-  kind: "iscc";
-} | {
-  kind: "held";
-  binding: SoftBinding;
-};
+interface Scope {
+  timespan?: Timespan;
+}
+/**
+ * A `soft-binding-timespan-map`: where the range starts in the media and how long it lasts, in
+ * milliseconds.
+ */
+interface Timespan {
+  start: number;
+  duration: number;
+}
 /**
  * A session signing key from the init manifest\'s roster (spec §19.4.4).
  */
-interface SessionKeySummary {
+interface SessionKey {
   /**
    * Identifier of the session signing key.
    */
-  keyId: Uint8Array;
+  kid: Uint8Array;
   /**
    * The session key\'s public half (SEC1-encoded bytes).
    */
   publicKey: Uint8Array;
 }
 /**
- * C2PA validation state of a manifest (spec §14.3).
- */
-type ValidationState = "Invalid" | "Valid" | "Trusted";
-/**
- * Construction options for [`AssetVerifier::new`] (and the `AssetVerifier.create` JS
- * binding). Every field is stated: nothing here is chosen on the caller\'s behalf.
- *
- * One definition, all lanes: `#[binding]` derives the shapes directly here:
- * tsify (camelCase) on wasm, a `uniffi::Record` on the native `ffi` build, so there is no
- * per-lane DTO copy. Off both lanes it is a plain struct.
+ * An asset a repository downloads, as the `byReference` request body names it.
  */
-interface AssetVerifierOptions {
-  /**
-   * The C2PA manifest repositories recovery asks, each a Soft Binding Resolution API declared
-   * for exactly the algorithms it may be asked for. Results merge by manifest, and a match\'s
-   * `endpoint` is fetched from only when it names one of these. Empty: no recovery can be
-   * asked of this verifier.
-   */
-  repositories: Repository[];
-  /**
-   * PEM trust anchors for the manifest signers the caller trusts.
-   */
-  trustAnchors: string[];
+interface Reference {
   /**
-   * PEM trust anchors for the time-stamping authorities the caller trusts.
+   * A short-lived https URL without credentials.
    */
-  tsaTrustAnchors: string[];
-  /**
-   * Also trust the bundled official C2PA anchors, manifest and TSA lists, beside the
-   * caller\'s. `false` trusts the caller\'s lists alone.
-   */
-  trustC2paAnchors: boolean;
-  /**
-   * Issuer DIDs whose CAWG identity (ICA) credentials count as validated, matched
-   * exactly against the credential issuer. Empty trusts no issuer: every identity assertion
-   * then reports `cawg.ica.untrusted_issuer` and withholds `cawg.ica.credential_valid`,
-   * which leaves the manifest\'s own validity untouched.
-   */
-  trustedIcaIssuers: string[];
-}
-/**
- * Construction options for [`StreamVerifier::new`] (and the `StreamVerifier.create`
- * JS binding). Every field is stated: nothing here is chosen on the caller\'s behalf.
- *
- * `#[binding]` derives the wasm shape (`trustC2paAnchors` camelCase) and,
- * with `ffi`, a `uniffi::Record` for the native `StreamVerifier.create` binding, so there
- * is no per-lane DTO copy. Off both lanes it is a plain struct.
- */
-interface StreamVerifierOptions {
-  /**
-   * PEM trust anchors for the manifest signers the caller trusts.
-   */
-  trustAnchors: string[];
-  /**
-   * PEM trust anchors for the time-stamping authorities the caller trusts.
-   */
-  tsaTrustAnchors: string[];
-  /**
-   * Also trust the bundled official C2PA anchors, manifest and TSA lists, beside the
-   * caller\'s. `false` trusts the caller\'s lists alone.
-   */
-  trustC2paAnchors: boolean;
+  url: string;
   /**
-   * Issuer DIDs whose CAWG identity (ICA) credentials count as validated, matched
-   * exactly against the credential issuer. Empty trusts no issuer: an identity assertion
-   * on the init segment\'s manifest then reports `cawg.ica.untrusted_issuer` and withholds
-   * `cawg.ica.credential_valid`.
+   * The asset\'s size in bytes.
    */
-  trustedIcaIssuers: string[];
+  length: number;
   /**
-   * How far a segment\'s timestamp may sit from wall-clock before it is rejected as
-   * skewed, in seconds: the deployment\'s own encoder-clock allowance, stated rather than
-   * assumed.
+   * The asset\'s media type.
    */
-  segmentSkewToleranceSecs: number;
+  format?: string;
+  ranges?: import('@contentauth/c2pa-types').Range[];
 }
 /**
- * Everything one `derive` needs beyond the asset: how its format is known. The same record
- * the native lane\'s `DeriveOptions` is, spelled as data.
- */
-interface DeriveOptions {
-  format: AssetFormat;
-}
-/**
- * How a call knows the asset\'s format: stated by the caller, or read from the leading bytes.
- * Stated, never defaulted: sniffing is a choice made by name.
+ * C2PA validation state of a manifest (spec §14.3).
  */
-type AssetFormat = {
-  kind: "sniff";
-} | {
-  kind: "declared";
-  mediaType: string;
-};
+type ValidationState = "Invalid" | "Valid" | "Trusted";
 /**
  * One C2PA manifest repository, as the Soft Binding Resolution API spec lets a client find it.
  */
@@ -306,8 +226,8 @@ type Repository = {
   url: string;
   algorithms: string[];
 } | {
-  kind: "listed";
-  algorithm: string;
+  kind: "registered";
+  alg: string;
 };
 /**
  * One C2PA validation status entry (spec §15.3): the registered code, its kind, and the
@@ -331,13 +251,7 @@ interface ValidationCode {
  */
 interface Credential {
   /**
-   * The bytes behind every thumbnail the manifests reference, by that reference\'s
-   * `identifier`: each manifest\'s claim thumbnail and each ingredient\'s. The manifests state
-   * identifiers and no images, so this is what a chain draws from.
-   */
-  thumbnails: Record<string, Uint8Array>;
-  /**
-   * Where this credential came from. See [`CredentialOrigin`].
+   * Where this credential came from.
    */
   origin: CredentialOrigin;
   manifest: import('@contentauth/c2pa-types').ManifestStore;
@@ -346,17 +260,38 @@ interface Credential {
    */
   hardBinding: HardBinding;
   /**
-   * Where this credential sits among the others returned. See [`crate::asset::Lineage`].
+   * Where this credential sits among the others returned.
    */
   lineage: Lineage;
 }
+/**
+ * One query that located a recovered credential: how it was asked, under which algorithm, and
+ * where the manifest came from.
+ */
+interface Discovery {
+  via: DiscoveryVia;
+  alg: string;
+  type: SoftBindingType;
+  /**
+   * 0-100, the repository\'s `similarityScore`.
+   */
+  score?: number;
+  repository: string;
+  /**
+   * The resolution API the manifest was fetched from, when not `repository`.
+   */
+  endpoint?: string;
+}
 /**
  * Outcome of validating a media segment against its stream\'s init.
  */
 interface MediaValidation {
-  valid: boolean;
+  /**
+   * `invalid` on any failure, else the state of the init manifest the segment\'s key came from.
+   */
+  state: ValidationState;
   codes: ValidationCode[];
-  keyId: Uint8Array;
+  kid: Uint8Array;
   timing: SegmentTiming;
   manifestId: string;
 }
@@ -367,7 +302,7 @@ interface InitValidation {
   state: ValidationState;
   codes: ValidationCode[];
   manifest: import('@contentauth/c2pa-types').ManifestStore;
-  sessionKeys: SessionKeySummary[];
+  sessionKeys: SessionKey[];
 }
 /**
  * Result of `StreamSession.validate`, discriminated by `kind`.
@@ -380,80 +315,214 @@ type SegmentValidation = ({
   kind: "unknown";
 };
 /**
- * Timing facts carried by a media segment\'s container.
+ * The C2PA 2.4 golden-flow comparison of the embedded manifest against what the repository holds.
+ */
+type Golden = {
+  kind: "matches";
+  index: number;
+} | {
+  kind: "differs";
+  index: number;
+} | {
+  kind: "noneMatches";
+  candidates: number[];
+} | {
+  kind: "unreadable";
+  index: number;
+};
+/**
+ * The C2PA list\'s `type` of a soft binding algorithm.
+ */
+type SoftBindingType = "fingerprint" | "watermark";
+/**
+ * The Soft Binding Resolution API route a discovery came through.
+ */
+type DiscoveryVia = {
+  kind: "byBinding";
+  value: Uint8Array;
+} | {
+  kind: "byContent";
+  hint?: Hint;
+} | {
+  kind: "byReference";
+  hint?: Hint;
+};
+/**
+ * The evidence that singled a recovered verdict out.
+ */
+type VerdictRule = "onlyCandidate" | "notSuperseded" | "hardBinding";
+/**
+ * The query a repository answers from the content: `matches/byReference` when `reference` is
+ * stated, so nothing is uploaded, else `matches/byContent` with the asset in the request.
+ */
+interface Content {
+  when: ContentWhen;
+  /**
+   * Where each repository downloads the asset from.
+   */
+  reference?: Reference;
+  /**
+   * The largest asset an upload sends, in bytes; a larger one is reported `tooLarge`. Absent,
+   * 64 MiB.
+   */
+  maxUploadBytes?: number;
+}
+/**
+ * The re-sign chain between the returned credentials, by manifest label.
+ */
+interface Lineage {
+  supersedes: string[];
+  supersededBy: string[];
+}
+/**
+ * The value a content query was hinted with, under its own algorithm.
+ */
+interface Hint {
+  alg: string;
+  value: Uint8Array;
+}
+/**
+ * Timing a media segment\'s container carries.
  */
 interface SegmentTiming {
   /**
-   * Media segment sequence number (exact below 2^53).
+   * The segment\'s `sequenceNumber` (exact below 2^53).
    */
-  sequenceNumber: number;
+  sequence: number;
   /**
-   * MP4 timescale (ticks per second) for this segment\'s timing, if present.
+   * The span its C2PA `emsg` covers, in milliseconds.
    */
-  timescale?: number;
+  duration?: number;
+}
+/**
+ * What a stream verifier trusts, and how far a segment\'s clock may drift.
+ */
+interface StreamVerifierOptions {
+  trust: Trust;
   /**
-   * Segment duration in seconds, if the container reports it.
+   * How far a segment\'s presentation time may sit outside its session key\'s validity period,
+   * in milliseconds. Absent, 5 minutes.
    */
-  eventDurationSecs?: number;
+  skewTolerance?: number;
 }
 /**
- * What one verify may do to recover a manifest, as data: the binders this client derives for
- * itself, decided into `matches/byBinding`, and one field per content operation, absent when
- * not to be called. It needs a configured repository and at least one query.
+ * What a verifier trusts. An omitted list trusts nothing.
  */
-interface Recovery {
-  when: RecoveryTrigger;
-  binders: BinderSpec[];
-  byContent?: ByContent;
-  byReference?: ByReference;
+interface Trust {
+  /**
+   * PEM anchors for the manifest signers the caller trusts.
+   */
+  anchors?: string[];
+  /**
+   * PEM anchors for the time-stamping authorities the caller trusts.
+   */
+  tsaAnchors?: string[];
+  /**
+   * Also trust the bundled official C2PA manifest and TSA lists, beside the caller\'s.
+   */
+  c2pa: boolean;
+  /**
+   * Issuer DIDs whose CAWG identity (ICA) credentials count as validated, matched exactly
+   * against the credential issuer. Empty trusts no issuer: every identity assertion then
+   * reports `cawg.ica.untrusted_issuer` and withholds `cawg.ica.credential_valid`, which leaves
+   * the manifest\'s own validity untouched.
+   */
+  icaIssuers?: string[];
 }
 /**
- * When [`AssetVerifier::verify_asset`] queries the repository.
+ * What an asset verifier trusts and which repositories it may ask. An omitted list trusts or
+ * asks nothing.
  */
-type RecoveryTrigger = "manifestMissing" | "always";
+interface AssetVerifierOptions {
+  /**
+   * The C2PA manifest repositories recovery asks, each a Soft Binding Resolution API declared
+   * for exactly the algorithms it may be asked for. Results merge by manifest, and a match\'s
+   * `endpoint` is fetched from only when it names one of these. Empty: no recovery can be
+   * asked of this verifier.
+   */
+  repositories?: Repository[];
+  trust: Trust;
+}
 /**
- * Whether a code is a success, an informational note, or a failure.
+ * What one verify may do to recover a manifest, as data: the soft bindings this client looks up
+ * itself through `matches/byBinding`, and the content query, absent when not to be asked. It
+ * needs a configured repository and at least one query.
  */
-type ValidationCodeKind = "success" | "informational" | "failure";
+interface Recovery {
+  when: RecoveryTrigger;
+  softBindings?: SoftBindingSource[];
+  content?: Content;
+  /**
+   * The whole recovery\'s budget in milliseconds, every repository together, each request
+   * bounded by what remains. Absent, 10 minutes; at most 2147483647.
+   */
+  timeout?: number;
+}
 /**
- * Whether a content form runs on this verify. Judged against the byBinding results alone.
+ * What this verify concludes about the asset, from signed evidence alone.
  */
-type ContentTrigger = "byBindingMisses" | "always";
+type Verdict = {
+  kind: "unsigned";
+} | {
+  kind: "inconclusive";
+} | {
+  kind: "embedded";
+} | {
+  kind: "recovered";
+  index: number;
+  decidedBy: VerdictRule;
+} | {
+  kind: "recoveredDerivative";
+  index: number;
+  decidedBy: VerdictRule;
+} | {
+  kind: "ambiguous";
+  candidates: number[];
+};
 /**
- * [`crate::asset::ByReference`] as JS states it: the region is the `Range` of
- * `@contentauth/c2pa-types`, the shape a credential\'s actions carry.
+ * When a verify asks the repositories.
  */
-interface ByReference {
-  after: ContentTrigger;
-  url: string;
-  length: number;
-  mediaType?: string;
-  region: import('@contentauth/c2pa-types').Range[];
-}
+type RecoveryTrigger = "manifestMissing" | "always";
 /**
- * [`crate::asset::CredentialOrigin`] as JS sees it: a tagged union, since each way of finding a
- * credential carries different evidence. Lane-local for the same reason [`FingerprintCheck`] is: a
- * tag layout is what `#[binding(wasm)]` declines to express.
+ * Where a credential came from: embedded in the asset, or recovered from a repository.
  */
 type CredentialOrigin = {
   kind: "embedded";
 } | {
   kind: "recovered";
-  discoveries: RecoveryDiscovery[];
+  discoveries: Discovery[];
   fingerprintCheck: FingerprintCheck;
 };
 /**
- * [`crate::asset::FingerprintCheck`] as JS sees it: a tagged union, since `compared` carries a
- * measurement the other two do not. Lane-local rather than `#[binding(wasm)]` on the core,
- * because a tag layout is exactly what that macro declines to express.
+ * Where one byBinding query\'s value comes from. A browser has no host engine: a vendor\'s
+ * detector runs repository-side, through `byContent`.
+ */
+type SoftBindingSource = {
+  kind: "builtin";
+  alg: string;
+} | {
+  kind: "held";
+  alg: string;
+  value: Uint8Array;
+};
+/**
+ * Whether a code is a success, an informational note, or a failure.
+ */
+type ValidationCodeKind = "success" | "informational" | "failure";
+/**
+ * Whether a content form runs on this verify. Judged against the byBinding results alone.
+ */
+type ContentWhen = "bindingMisses" | "always";
+/**
+ * Whether the asset\'s own fingerprint backs up a manifest that a watermark led to.
  */
 type FingerprintCheck = {
   kind: "notNeeded";
 } | {
-  kind: "nothingToCompare";
+  kind: "missing";
 } | {
   kind: "unsupported";
-  algorithm: string;
+  alg: string;
 } | {
   kind: "indeterminate";
 } | {
@@ -461,59 +530,40 @@ type FingerprintCheck = {
   score: number;
 };
 /**
- * [`crate::asset::HardBinding`] as JS sees it.
+ * Whether the manifest\'s hard binding holds over the bytes this verify read.
  */
 type HardBinding = "match" | "mismatch";
 /**
- * [`crate::asset::Lineage`] as JS sees it.
- */
-interface Lineage {
-  supersedes: string[];
-  supersededBy: string[];
-}
-/**
- * [`crate::asset::RecoveryIssue`] as JS sees it: a tagged union, each kind with its own data.
+ * Why repository recovery did not complete cleanly, or why one candidate was omitted.
  */
 type RecoveryIssue = {
-  kind: "binderFailed";
-  binderIndex: number;
+  kind: "computeFailed";
+  alg: string;
   message: string;
 } | {
-  kind: "algorithmDeprecated";
-  algorithm: string;
-} | {
-  kind: "bindingUndeclared";
-  binderIndex: number;
-  algorithm: string;
-} | {
-  kind: "bindingQueryFailed";
+  kind: "bindingFailed";
   repository: string;
-  binderIndex: number;
-  algorithm: string;
+  alg: string;
   message: string;
 } | {
   kind: "queryRefused";
   repository: string;
-  algorithm: string;
-  message: string;
-} | {
-  kind: "contentFormUnsupported";
-  repository: string;
+  alg: string;
   message: string;
 } | {
-  kind: "contentQueryFailed";
+  kind: "contentFailed";
   repository: string;
-  algorithm: string;
+  alg: string;
   message: string;
 } | {
   kind: "capabilitiesUnavailable";
   repository: string;
   message: string;
 } | {
-  kind: "contentTooLarge";
-  capBytes: number;
+  kind: "tooLarge";
+  maxUploadBytes: number;
 } | {
-  kind: "candidateFetchFailed";
+  kind: "fetchFailed";
   repository: string;
   manifestId: string;
   message: string;
@@ -527,98 +577,22 @@ type RecoveryIssue = {
   manifestId: string;
   endpoint: string;
 } | {
-  kind: "resourceLimitReached";
+  kind: "limitReached";
   message: string;
 };
-/**
- * [`crate::asset::VerdictRule`] as JS sees it.
- */
-type VerdictRule = "onlyCandidate" | "notSuperseded" | "hardBinding";
-/**
- * [`crate::asset::Verdict`] as JS sees it.
- */
-type Verdict = {
-  kind: "unsigned";
-} | {
-  kind: "inconclusive";
-} | {
-  kind: "embedded";
-} | {
-  kind: "recovered";
-  index: number;
-  decidedBy: VerdictRule;
-} | {
-  kind: "recoveredDerivative";
-  index: number;
-  decidedBy: VerdictRule;
-} | {
-  kind: "ambiguous";
-  candidates: number[];
-};
-/**
- * `matches/byContent`: the asset is uploaded to each repository, one request per algorithm that
- * repository is declared for.
- */
-interface ByContent {
-  after: ContentTrigger;
-}
 interface AssetVerification {
   credentials: Credential[];
   recovery: RecoverySummary;
-  goldenComparison: GoldenComparison;
+  /**
+   * Absent when there was nothing to compare.
+   */
+  golden?: Golden;
   verdict: Verdict;
 }
 interface RecoverySummary {
   status: RecoveryStatus;
   issues: RecoveryIssue[];
 }
-type ContentBindingClass = "fingerprint" | "watermark";
-type GoldenComparison = {
-  kind: "notRequested";
-} | {
-  kind: "noEmbeddedManifest";
-} | {
-  kind: "noRecoveredManifest";
-} | {
-  kind: "recoveryIncomplete";
-} | {
-  kind: "matches";
-  recoveredIndex: number;
-} | {
-  kind: "differs";
-  recoveredIndex: number;
-} | {
-  kind: "noneMatches";
-  candidates: number[];
-} | {
-  kind: "unreadable";
-  recoveredIndex: number;
-};
-type RecoveryDiscovery = {
-  kind: "byBinding";
-  class: ContentBindingClass;
-  binding: SoftBinding;
-  binderIndex: number;
-  repositoryScore: number | undefined;
-  repository: string;
-  fetchedFrom: string;
-} | {
-  kind: "byContent";
-  hint: SoftBinding | undefined;
-  class: ContentBindingClass;
-  algorithm: string;
-  repositoryScore: number | undefined;
-  repository: string;
-  fetchedFrom: string;
-} | {
-  kind: "byReference";
-  hint: SoftBinding | undefined;
-  class: ContentBindingClass;
-  algorithm: string;
-  repositoryScore: number | undefined;
-  repository: string;
-  fetchedFrom: string;
-};
 type RecoveryStatus = "notRequested" | "notFound" | "recovered" | "incomplete";
 declare class AssetVerifier {
   private constructor();
@@ -638,14 +612,11 @@ declare class AssetVerifier {
    *
    * # Errors
    *
-   * Throws on a malformed `input`, a repository (or binder) failure, or a validation
+   * Throws on a malformed `source`, a repository (or engine) failure, or a validation
    * failure.
    */
-  verify(input: RangeSource, recovery?: Recovery | null): Promise<AssetVerification>;
+  verify(source: RangeSource, recovery?: Recovery | null): Promise<Verification>;
 }
-declare function C2PA_TRUST_LIST(): string;
-declare function C2PA_TSA_TRUST_LIST(): string;
-declare function DEV_CA(): string;
 /**
  * One stream being validated. It owns the session keys and manifest ids its init segments
  * advertised, so releasing the stream is dropping this object.
@@ -655,8 +626,8 @@ declare class StreamSession {
   free(): void;
   [Symbol.dispose](): void;
   /**
-   * Everything this stream's init segments have registered, as CBOR for another node to
-   * `StreamVerifier.resume` from.
+   * This stream's id and everything its init segments have registered, as CBOR for another
+   * node to `StreamVerifier.resume` from.
    *
    * The one piece of stream state that leaves the SDK, and only because a clustered
    * verifier needs it: the init URL is overwritten on rotation, so a node joining during
@@ -677,7 +648,7 @@ declare class StreamSession {
    * Throws an `SdkError` on parse or signature failure, or when a media segment arrives
    * before any init was processed for the stream.
    */
-  validate(data: RangeSource): Promise<SegmentValidation>;
+  validate(source: RangeSource): Promise<SegmentValidation>;
 }
 declare class StreamVerifier {
   private constructor();
@@ -692,25 +663,57 @@ declare class StreamVerifier {
    */
   static create(options: StreamVerifierOptions): StreamVerifier;
   /**
-   * Open `stream_id` for validation, handing back a `StreamSession` to feed segments to.
+   * Open the stream `id` for validation, handing back a `StreamSession` to feed segments to.
    *
    * No I/O: the handle carries the id so it cannot be mistyped or confused with another
    * stream's, and classification still happens per segment. Opening one id twice hands
    * back the same live session, so a component that remounts keeps the state its earlier
    * handle accumulated.
    */
-  open(stream_id: string): StreamSession;
+  open(id: string): StreamSession;
   /**
-   * Open `stream_id` on the state another node exported, merged into whatever this one
-   * holds for that id already.
+   * Open the stream another node exported, its state merged into whatever this one holds
+   * for that stream already.
    *
    * # Errors
    *
-   * Throws an `SdkError` (`STREAM_INVALID`) when `state` is not a value
-   * `StreamSession.export` produced, or carries a version this SDK no longer reads.
+   * Throws an `SdkError` with a field violation at `state` when it is not a value
+   * `StreamSession.export` produced (`state.malformed`), or one of another export version
+   * (`state.version`).
    */
-  resume(stream_id: string, state: Uint8Array): StreamSession;
+  resume(state: Uint8Array): StreamSession;
 }
+/**
+ * One `verify` result held with the stores it read: `report` is the data, and `resource` reads a
+ * thumbnail from credential `credential` (its position in `report.credentials`) by the
+ * `identifier` of a resource reference in its manifest. A class rather than a field of the
+ * report because a store cannot be serialized, and one handle per verify is what a worker can
+ * proxy (a class nested in the report cannot cross a thread).
+ */
+declare class Verification {
+  private constructor();
+  free(): void;
+  [Symbol.dispose](): void;
+  /**
+   * The bytes of one resource credential `credential` holds, or `undefined`.
+   *
+   * # Errors
+   *
+   * Throws `READER_INVALID` when the store holds the resource but cannot produce it, and
+   * `undefined` for a `credential` out of range.
+   */
+  resource(credential: number, uri: string): Uint8Array | undefined;
+  /**
+   * The report: credentials, recovery, golden flow and verdict.
+   */
+  readonly report: AssetVerification;
+}
+/**
+ * PEM trust anchor for the Limbo Integrity development signing environment, **development
+ * only**, no security guarantees: put it in `trust.anchors` for a development build, never in a
+ * release.
+ */
+declare function devCa(): string;
 //#endregion
 //#region src/worker-thread.d.ts
 /**
@@ -737,9 +740,18 @@ declare abstract class Handle<T extends {
   constructor(inner: T);
   [finalizer](): void;
 }
+/**
+ * One verify result. A wasm class cannot cross the thread, so the report and the stores behind it
+ * stay here and the caller holds this: `report()` is the data, `resource()` reads a thumbnail from
+ * a credential by its position in `report().credentials`.
+ */
+declare class VerificationHandle extends Handle<Verification> {
+  report(): AssetVerification;
+  resource(credential: number, uri: string): Uint8Array | undefined;
+}
 declare class AssetVerifierHandle extends Handle<AssetVerifier> {
   /** `recovery` is what this verify may do to recover a manifest, as the direct import takes it. */
-  verify(asset: Asset, recovery: Recovery | undefined): Promise<AssetVerification>;
+  verify(asset: Asset, recovery: Recovery | undefined): Promise<VerificationHandle & ProxyMarked>;
 }
 /** One stream being validated. Dropping the handle releases the session it accumulated. */
 declare class StreamSessionHandle extends Handle<StreamSession> {
@@ -747,8 +759,8 @@ declare class StreamSessionHandle extends Handle<StreamSession> {
   export(): Uint8Array;
 }
 declare class StreamVerifierHandle extends Handle<StreamVerifier> {
-  open(streamId: string): StreamSessionHandle & ProxyMarked;
-  resume(streamId: string, state: Uint8Array): StreamSessionHandle & ProxyMarked;
+  open(id: string): StreamSessionHandle & ProxyMarked;
+  resume(state: Uint8Array): StreamSessionHandle & ProxyMarked;
 }
 /** The module's own surface, name for name with the direct import. */
 declare const sdk: {
@@ -763,13 +775,11 @@ declare const sdk: {
   StreamVerifier: {
     create: (options: StreamVerifierOptions) => StreamVerifierHandle & ProxyMarked;
   } & ProxyMarked;
-  Binder: {
-    /**
-     * Derive one binder's binding standalone. The binder is built, used and dropped here, so there
-     * is no handle to keep: what the caller wants back is the binding.
-     */
-    derive: (spec: BinderSpec, content: Asset, options: DeriveOptions) => Promise<SoftBinding | undefined>;
-  } & ProxyMarked;
+  /**
+   * The values this SDK computes for `alg` over the asset, `[]` when it finds none. `format` is the
+   * asset's media type; omitted, the bytes name it.
+   */
+  computeSoftBinding(alg: string, asset: Asset, format?: string): Promise<Block[]>;
   /**
    * Read a detached manifest store. Contents, not a verdict: with no asset there is no hard binding
    * to check, so the store's validation fields state nothing this established.
@@ -780,14 +790,7 @@ declare const sdk: {
    * manifest's claim thumbnail, and any ingredient's.
    */
   resource(manifest: Asset, uri: string): Promise<Uint8Array<ArrayBufferLike> | undefined>;
-  /**
-   * Every thumbnail the store references, by the identifier it references them under. One parse
-   * and one thread hop for the whole set, where `resource` pays both per call.
-   */
-  thumbnails(manifest: Asset): Promise<Record<string, Uint8Array<ArrayBufferLike>>>;
-  C2PA_TRUST_LIST: typeof C2PA_TRUST_LIST;
-  C2PA_TSA_TRUST_LIST: typeof C2PA_TSA_TRUST_LIST;
-  DEV_CA: typeof DEV_CA;
+  devCa: typeof devCa;
   close(): void;
 };
 /** What the caller's thread holds a `Comlink.Remote` of. */