@trylimbo/sdk-verifier-wasm 0.2.25-canary.37 → 0.2.25

package/gen/wasm/trylimbo_sdk_verifier.d.ts

@@ -16,31 +16,37 @@ export interface RangeSource {
 
 
 /**
- * A `soft-binding-block-map`. No scope is the whole content.
+ * A C2PA soft binding: an algorithm id (from the C2PA soft-binding algorithm
+ * list, e.g. `io.iscc.v0`) plus its algorithm-specific value (the `ISCC:…` code,
+ * a watermark token, …). The signer embeds it as a `c2pa.soft-binding` assertion
+ * and indexes it, so a transcoded copy whose exact content hash no longer
+ * matches still recovers the manifest from the repository.
  */
-export interface Block {
-    value: Uint8Array;
-    scope?: Scope;
-}
-
-/**
- * A `soft-binding-scope-map`.
- */
-export interface Scope {
-    timespan?: Timespan;
+export interface SoftBinding {
+    /**
+     * C2PA soft-binding algorithm id, e.g. `io.iscc.v0`.
+     */
+    alg: string;
+    /**
+     * Algorithm-specific binding value: the canonical string the algorithm
+     * produces (an `ISCC:…` code, a watermark token). Its UTF-8 bytes are what
+     * the repository lookup base64-encodes.
+     */
+    value: string;
 }
 
 /**
- * A `soft-binding-timespan-map`: where the range starts in the media and how long it lasts, in
- * milliseconds.
+ * A binder spelled as data, so it crosses into a worker as well as the direct import: the
+ * SDK\'s own two. A browser has no host binder: a detector runs repository-side.
  */
-export interface Timespan {
-    start: number;
-    duration: number;
-}
+export type BinderSpec = { kind: "iscc" } | { kind: "held"; binding: SoftBinding };
 
 /**
  * A canonical gRPC/Connect status code: the coarse, closed failure class.
+ *
+ * The wasm lane projects this as a camelCase string like every other tagged value
+ * there, so a consumer narrows on `err.code === \"resourceExhausted\"`; the native lane
+ * projects an enum.
  */
 export type Code = "canceled" | "unknown" | "invalidArgument" | "deadlineExceeded" | "notFound" | "alreadyExists" | "permissionDenied" | "resourceExhausted" | "failedPrecondition" | "aborted" | "outOfRange" | "unimplemented" | "internal" | "unavailable" | "dataLoss" | "unauthenticated";
 
@@ -71,11 +77,11 @@ export interface ReasonError {
 /**
  * A session signing key from the init manifest\'s roster (spec §19.4.4).
  */
-export interface SessionKey {
+export interface SessionKeySummary {
     /**
      * Identifier of the session signing key.
      */
-    kid: Uint8Array;
+    keyId: Uint8Array;
     /**
      * The session key\'s public half (SEC1-encoded bytes).
      */
@@ -91,33 +97,103 @@ export interface StatusError {
 }
 
 /**
- * An asset a repository downloads, as the `byReference` request body names it.
+ * C2PA validation state of a manifest (spec §14.3).
  */
-export interface Reference {
+export type ValidationState = "Invalid" | "Valid" | "Trusted";
+
+/**
+ * Construction options for [`AssetVerifier::new`] (and the `AssetVerifier.create` JS
+ * binding). Every field is stated: nothing here is chosen on the caller\'s behalf.
+ *
+ * One definition, all lanes: `#[binding]` derives the shapes directly here:
+ * tsify (camelCase) on wasm, a `uniffi::Record` on the native `ffi` build, so there is no
+ * per-lane DTO copy. Off both lanes it is a plain struct.
+ */
+export interface AssetVerifierOptions {
+    /**
+     * The C2PA manifest repositories recovery asks, each a Soft Binding Resolution API declared
+     * for exactly the algorithms it may be asked for. Results merge by manifest, and a match\'s
+     * `endpoint` is fetched from only when it names one of these. Empty: no recovery can be
+     * asked of this verifier.
+     */
+    repositories: Repository[];
     /**
-     * A short-lived https URL without credentials.
+     * PEM trust anchors for the manifest signers the caller trusts.
      */
-    url: string;
+    trustAnchors: string[];
     /**
-     * The asset\'s size in bytes.
+     * PEM trust anchors for the time-stamping authorities the caller trusts.
      */
-    length: number;
+    tsaTrustAnchors: string[];
     /**
-     * The asset\'s media type.
+     * Also trust the bundled official C2PA anchors, manifest and TSA lists, beside the
+     * caller\'s. `false` trusts the caller\'s lists alone.
      */
-    format?: string;
-    ranges?: import('@contentauth/c2pa-types').Range[];
+    trustC2paAnchors: boolean;
+    /**
+     * Issuer DIDs whose CAWG identity (ICA) credentials count as validated, matched
+     * exactly against the credential issuer. Empty trusts no issuer: every identity assertion
+     * then reports `cawg.ica.untrusted_issuer` and withholds `cawg.ica.credential_valid`,
+     * which leaves the manifest\'s own validity untouched.
+     */
+    trustedIcaIssuers: string[];
 }
 
 /**
- * C2PA validation state of a manifest (spec §14.3).
+ * Construction options for [`StreamVerifier::new`] (and the `StreamVerifier.create`
+ * JS binding). Every field is stated: nothing here is chosen on the caller\'s behalf.
+ *
+ * `#[binding]` derives the wasm shape (`trustC2paAnchors` camelCase) and,
+ * with `ffi`, a `uniffi::Record` for the native `StreamVerifier.create` binding, so there
+ * is no per-lane DTO copy. Off both lanes it is a plain struct.
  */
-export type ValidationState = "Invalid" | "Valid" | "Trusted";
+export interface StreamVerifierOptions {
+    /**
+     * PEM trust anchors for the manifest signers the caller trusts.
+     */
+    trustAnchors: string[];
+    /**
+     * PEM trust anchors for the time-stamping authorities the caller trusts.
+     */
+    tsaTrustAnchors: string[];
+    /**
+     * Also trust the bundled official C2PA anchors, manifest and TSA lists, beside the
+     * caller\'s. `false` trusts the caller\'s lists alone.
+     */
+    trustC2paAnchors: boolean;
+    /**
+     * Issuer DIDs whose CAWG identity (ICA) credentials count as validated, matched
+     * exactly against the credential issuer. Empty trusts no issuer: an identity assertion
+     * on the init segment\'s manifest then reports `cawg.ica.untrusted_issuer` and withholds
+     * `cawg.ica.credential_valid`.
+     */
+    trustedIcaIssuers: string[];
+    /**
+     * How far a segment\'s timestamp may sit from wall-clock before it is rejected as
+     * skewed, in seconds: the deployment\'s own encoder-clock allowance, stated rather than
+     * assumed.
+     */
+    segmentSkewToleranceSecs: number;
+}
+
+/**
+ * Everything one `derive` needs beyond the asset: how its format is known. The same record
+ * the native lane\'s `DeriveOptions` is, spelled as data.
+ */
+export interface DeriveOptions {
+    format: AssetFormat;
+}
+
+/**
+ * How a call knows the asset\'s format: stated by the caller, or read from the leading bytes.
+ * Stated, never defaulted: sniffing is a choice made by name.
+ */
+export type AssetFormat = { kind: "sniff" } | { kind: "declared"; mediaType: string };
 
 /**
  * One C2PA manifest repository, as the Soft Binding Resolution API spec lets a client find it.
  */
-export type Repository = { kind: "named"; url: string; algorithms: string[] } | { kind: "registered"; alg: string };
+export type Repository = { kind: "named"; url: string; algorithms: string[] } | { kind: "listed"; algorithm: string };
 
 /**
  * One C2PA validation status entry (spec §15.3): the registered code, its kind, and the
@@ -151,7 +227,13 @@ export interface FieldViolation {
  */
 export interface Credential {
     /**
-     * Where this credential came from.
+     * The bytes behind every thumbnail the manifests reference, by that reference\'s
+     * `identifier`: each manifest\'s claim thumbnail and each ingredient\'s. The manifests state
+     * identifiers and no images, so this is what a chain draws from.
+     */
+    thumbnails: Record<string, Uint8Array>;
+    /**
+     * Where this credential came from. See [`CredentialOrigin`].
      */
     origin: CredentialOrigin;
     manifest: import('@contentauth/c2pa-types').ManifestStore;
@@ -160,40 +242,18 @@ export interface Credential {
      */
     hardBinding: HardBinding;
     /**
-     * Where this credential sits among the others returned.
+     * Where this credential sits among the others returned. See [`crate::asset::Lineage`].
      */
     lineage: Lineage;
 }
 
-/**
- * One query that located a recovered credential: how it was asked, under which algorithm, and
- * where the manifest came from.
- */
-export interface Discovery {
-    via: DiscoveryVia;
-    alg: string;
-    type: SoftBindingType;
-    /**
-     * 0-100, the repository\'s `similarityScore`.
-     */
-    score?: number;
-    repository: string;
-    /**
-     * The resolution API the manifest was fetched from, when not `repository`.
-     */
-    endpoint?: string;
-}
-
 /**
  * Outcome of validating a media segment against its stream\'s init.
  */
 export interface MediaValidation {
-    /**
-     * `invalid` on any failure, else the state of the init manifest the segment\'s key came from.
-     */
-    state: ValidationState;
+    valid: boolean;
     codes: ValidationCode[];
-    kid: Uint8Array;
+    keyId: Uint8Array;
     timing: SegmentTiming;
     manifestId: string;
 }
@@ -205,7 +265,7 @@ export interface InitValidation {
     state: ValidationState;
     codes: ValidationCode[];
     manifest: import('@contentauth/c2pa-types').ManifestStore;
-    sessionKeys: SessionKey[];
+    sessionKeys: SessionKeySummary[];
 }
 
 /**
@@ -213,202 +273,125 @@ export interface InitValidation {
  */
 export type SegmentValidation = ({ kind: "init" } & InitValidation) | ({ kind: "media" } & MediaValidation) | { kind: "unknown" };
 
-/**
- * The C2PA 2.4 golden-flow comparison of the embedded manifest against what the repository holds.
- */
-export type Golden = { kind: "matches"; index: number } | { kind: "differs"; index: number } | { kind: "noneMatches"; candidates: number[] } | { kind: "unreadable"; index: number };
-
-/**
- * The C2PA list\'s `type` of a soft binding algorithm.
- */
-export type SoftBindingType = "fingerprint" | "watermark";
-
-/**
- * The Soft Binding Resolution API route a discovery came through.
- */
-export type DiscoveryVia = { kind: "byBinding"; value: Uint8Array } | { kind: "byContent"; hint?: Hint } | { kind: "byReference"; hint?: Hint };
-
 /**
  * The error every SDK call throws: a decoded `google.rpc.Status`, discriminated
  * by `kind`. A consumer switches on `err.kind` (`\"reason\" | \"invalid\" | \"status\"`)
  * and reads the shape-specific fields; `code` and `message` are common to every
- * shape.
+ * shape. Thrown as a plain object across the wasm boundary (tsify).
  */
 export type SdkError = ({ kind: "status" } & StatusError) | ({ kind: "reason" } & ReasonError) | ({ kind: "invalid" } & InvalidError);
 
 /**
- * The evidence that singled a recovered verdict out.
+ * Timing facts carried by a media segment\'s container.
  */
-export type VerdictRule = "onlyCandidate" | "notSuperseded" | "hardBinding";
-
-/**
- * The query a repository answers from the content: `matches/byReference` when `reference` is
- * stated, so nothing is uploaded, else `matches/byContent` with the asset in the request.
- */
-export interface Content {
-    when: ContentWhen;
+export interface SegmentTiming {
     /**
-     * Where each repository downloads the asset from.
+     * Media segment sequence number (exact below 2^53).
      */
-    reference?: Reference;
+    sequenceNumber: number;
     /**
-     * The largest asset an upload sends, in bytes; a larger one is reported `tooLarge`. Absent,
-     * 64 MiB.
+     * MP4 timescale (ticks per second) for this segment\'s timing, if present.
      */
-    maxUploadBytes?: number;
-}
-
-/**
- * The re-sign chain between the returned credentials, by manifest label.
- */
-export interface Lineage {
-    supersedes: string[];
-    supersededBy: string[];
-}
-
-/**
- * The value a content query was hinted with, under its own algorithm.
- */
-export interface Hint {
-    alg: string;
-    value: Uint8Array;
-}
-
-/**
- * Timing a media segment\'s container carries.
- */
-export interface SegmentTiming {
-    /**
-     * The segment\'s `sequenceNumber` (exact below 2^53).
-     */
-    sequence: number;
+    timescale?: number;
     /**
-     * The span its C2PA `emsg` covers, in milliseconds.
+     * Segment duration in seconds, if the container reports it.
      */
-    duration?: number;
+    eventDurationSecs?: number;
 }
 
 /**
- * What a stream verifier trusts, and how far a segment\'s clock may drift.
+ * What one verify may do to recover a manifest, as data: the binders this client derives for
+ * itself, decided into `matches/byBinding`, and one field per content operation, absent when
+ * not to be called. It needs a configured repository and at least one query.
  */
-export interface StreamVerifierOptions {
-    trust: Trust;
-    /**
-     * How far a segment\'s presentation time may sit outside its session key\'s validity period,
-     * in milliseconds. Absent, 5 minutes.
-     */
-    skewTolerance?: number;
+export interface Recovery {
+    when: RecoveryTrigger;
+    binders: BinderSpec[];
+    byContent?: ByContent;
+    byReference?: ByReference;
 }
 
 /**
- * What a verifier trusts. An omitted list trusts nothing.
+ * When [`AssetVerifier::verify_asset`] queries the repository.
  */
-export interface Trust {
-    /**
-     * PEM anchors for the manifest signers the caller trusts.
-     */
-    anchors?: string[];
-    /**
-     * PEM anchors for the time-stamping authorities the caller trusts.
-     */
-    tsaAnchors?: string[];
-    /**
-     * Also trust the bundled official C2PA manifest and TSA lists, beside the caller\'s.
-     */
-    c2pa: boolean;
-    /**
-     * Issuer DIDs whose CAWG identity (ICA) credentials count as validated, matched exactly
-     * against the credential issuer. Empty trusts no issuer: every identity assertion then
-     * reports `cawg.ica.untrusted_issuer` and withholds `cawg.ica.credential_valid`, which leaves
-     * the manifest\'s own validity untouched.
-     */
-    icaIssuers?: string[];
-}
+export type RecoveryTrigger = "manifestMissing" | "always";
 
 /**
- * What an asset verifier trusts and which repositories it may ask. An omitted list trusts or
- * asks nothing.
+ * Whether a code is a success, an informational note, or a failure.
  */
-export interface AssetVerifierOptions {
-    /**
-     * The C2PA manifest repositories recovery asks, each a Soft Binding Resolution API declared
-     * for exactly the algorithms it may be asked for. Results merge by manifest, and a match\'s
-     * `endpoint` is fetched from only when it names one of these. Empty: no recovery can be
-     * asked of this verifier.
-     */
-    repositories?: Repository[];
-    trust: Trust;
-}
+export type ValidationCodeKind = "success" | "informational" | "failure";
 
 /**
- * What one verify may do to recover a manifest, as data: the soft bindings this client looks up
- * itself through `matches/byBinding`, and the content query, absent when not to be asked. It
- * needs a configured repository and at least one query.
+ * Whether a content form runs on this verify. Judged against the byBinding results alone.
  */
-export interface Recovery {
-    when: RecoveryTrigger;
-    softBindings?: SoftBindingSource[];
-    content?: Content;
-    /**
-     * The whole recovery\'s budget in milliseconds, every repository together, each request
-     * bounded by what remains. Absent, 10 minutes; at most 2147483647.
-     */
-    timeout?: number;
-}
+export type ContentTrigger = "byBindingMisses" | "always";
 
 /**
- * What this verify concludes about the asset, from signed evidence alone.
+ * [`crate::asset::ByReference`] as JS states it: the region is the `Range` of
+ * `@contentauth/c2pa-types`, the shape a credential\'s actions carry.
  */
-export type Verdict = { kind: "unsigned" } | { kind: "inconclusive" } | { kind: "embedded" } | { kind: "recovered"; index: number; decidedBy: VerdictRule } | { kind: "recoveredDerivative"; index: number; decidedBy: VerdictRule } | { kind: "ambiguous"; candidates: number[] };
+export interface ByReference {
+    after: ContentTrigger;
+    url: string;
+    length: number;
+    mediaType?: string;
+    region: import('@contentauth/c2pa-types').Range[];
+}
 
 /**
- * When a verify asks the repositories.
+ * [`crate::asset::CredentialOrigin`] as JS sees it: a tagged union, since each way of finding a
+ * credential carries different evidence. Lane-local for the same reason [`FingerprintCheck`] is: a
+ * tag layout is what `#[binding(wasm)]` declines to express.
  */
-export type RecoveryTrigger = "manifestMissing" | "always";
+export type CredentialOrigin = { kind: "embedded" } | { kind: "recovered"; discoveries: RecoveryDiscovery[]; fingerprintCheck: FingerprintCheck };
 
 /**
- * Where a credential came from: embedded in the asset, or recovered from a repository.
+ * [`crate::asset::FingerprintCheck`] as JS sees it: a tagged union, since `compared` carries a
+ * measurement the other two do not. Lane-local rather than `#[binding(wasm)]` on the core,
+ * because a tag layout is exactly what that macro declines to express.
  */
-export type CredentialOrigin = { kind: "embedded" } | { kind: "recovered"; discoveries: Discovery[]; fingerprintCheck: FingerprintCheck };
+export type FingerprintCheck = { kind: "notNeeded" } | { kind: "nothingToCompare" } | { kind: "unsupported"; algorithm: string } | { kind: "indeterminate" } | { kind: "compared"; score: number };
 
 /**
- * Where one byBinding query\'s value comes from. A browser has no host engine: a vendor\'s
- * detector runs repository-side, through `byContent`.
+ * [`crate::asset::HardBinding`] as JS sees it.
  */
-export type SoftBindingSource = { kind: "builtin"; alg: string } | { kind: "held"; alg: string; value: Uint8Array };
+export type HardBinding = "match" | "mismatch";
 
 /**
- * Whether a code is a success, an informational note, or a failure.
+ * [`crate::asset::Lineage`] as JS sees it.
  */
-export type ValidationCodeKind = "success" | "informational" | "failure";
+export interface Lineage {
+    supersedes: string[];
+    supersededBy: string[];
+}
 
 /**
- * Whether a content form runs on this verify. Judged against the byBinding results alone.
+ * [`crate::asset::RecoveryIssue`] as JS sees it: a tagged union, each kind with its own data.
  */
-export type ContentWhen = "bindingMisses" | "always";
+export type RecoveryIssue = { kind: "binderFailed"; binderIndex: number; message: string } | { kind: "algorithmDeprecated"; algorithm: string } | { kind: "bindingUndeclared"; binderIndex: number; algorithm: string } | { kind: "bindingQueryFailed"; repository: string; binderIndex: number; algorithm: string; message: string } | { kind: "queryRefused"; repository: string; algorithm: string; message: string } | { kind: "contentFormUnsupported"; repository: string; message: string } | { kind: "contentQueryFailed"; repository: string; algorithm: string; message: string } | { kind: "capabilitiesUnavailable"; repository: string; message: string } | { kind: "contentTooLarge"; capBytes: number } | { kind: "candidateFetchFailed"; repository: string; manifestId: string; message: string } | { kind: "candidateInvalid"; manifestId: string; reason: string } | { kind: "endpointRefused"; repository: string; manifestId: string; endpoint: string } | { kind: "resourceLimitReached"; message: string };
 
 /**
- * Whether the asset\'s own fingerprint backs up a manifest that a watermark led to.
+ * [`crate::asset::VerdictRule`] as JS sees it.
  */
-export type FingerprintCheck = { kind: "notNeeded" } | { kind: "missing" } | { kind: "unsupported"; alg: string } | { kind: "indeterminate" } | { kind: "compared"; score: number };
+export type VerdictRule = "onlyCandidate" | "notSuperseded" | "hardBinding";
 
 /**
- * Whether the manifest\'s hard binding holds over the bytes this verify read.
+ * [`crate::asset::Verdict`] as JS sees it.
  */
-export type HardBinding = "match" | "mismatch";
+export type Verdict = { kind: "unsigned" } | { kind: "inconclusive" } | { kind: "embedded" } | { kind: "recovered"; index: number; decidedBy: VerdictRule } | { kind: "recoveredDerivative"; index: number; decidedBy: VerdictRule } | { kind: "ambiguous"; candidates: number[] };
 
 /**
- * Why repository recovery did not complete cleanly, or why one candidate was omitted.
+ * `matches/byContent`: the asset is uploaded to each repository, one request per algorithm that
+ * repository is declared for.
  */
-export type RecoveryIssue = { kind: "computeFailed"; alg: string; message: string } | { kind: "bindingFailed"; repository: string; alg: string; message: string } | { kind: "queryRefused"; repository: string; alg: string; message: string } | { kind: "contentFailed"; repository: string; alg: string; message: string } | { kind: "capabilitiesUnavailable"; repository: string; message: string } | { kind: "tooLarge"; maxUploadBytes: number } | { kind: "fetchFailed"; repository: string; manifestId: string; message: string } | { kind: "candidateInvalid"; manifestId: string; reason: string } | { kind: "endpointRefused"; repository: string; manifestId: string; endpoint: string } | { kind: "limitReached"; message: string };
+export interface ByContent {
+    after: ContentTrigger;
+}
 
 export interface AssetVerification {
     credentials: Credential[];
     recovery: RecoverySummary;
-    /**
-     * Absent when there was nothing to compare.
-     */
-    golden?: Golden;
+    goldenComparison: GoldenComparison;
     verdict: Verdict;
 }
 
@@ -417,6 +400,12 @@ export interface RecoverySummary {
     issues: RecoveryIssue[];
 }
 
+export type ContentBindingClass = "fingerprint" | "watermark";
+
+export type GoldenComparison = { kind: "notRequested" } | { kind: "noEmbeddedManifest" } | { kind: "noRecoveredManifest" } | { kind: "recoveryIncomplete" } | { kind: "matches"; recoveredIndex: number } | { kind: "differs"; recoveredIndex: number } | { kind: "noneMatches"; candidates: number[] } | { kind: "unreadable"; recoveredIndex: number };
+
+export type RecoveryDiscovery = { kind: "byBinding"; class: ContentBindingClass; binding: SoftBinding; binderIndex: number; repositoryScore: number | undefined; repository: string; fetchedFrom: string } | { kind: "byContent"; hint: SoftBinding | undefined; class: ContentBindingClass; algorithm: string; repositoryScore: number | undefined; repository: string; fetchedFrom: string } | { kind: "byReference"; hint: SoftBinding | undefined; class: ContentBindingClass; algorithm: string; repositoryScore: number | undefined; repository: string; fetchedFrom: string };
+
 export type RecoveryStatus = "notRequested" | "notFound" | "recovered" | "incomplete";
 
 
@@ -438,18 +427,19 @@ export class AssetVerifier {
      *
      * # Errors
      *
-     * Throws on a malformed `source`, a repository (or engine) failure, or a validation
+     * Throws on a malformed `input`, a repository (or binder) failure, or a validation
      * failure.
      */
-    verify(source: RangeSource, recovery?: Recovery | null): Promise<Verification>;
+    verify(input: RangeSource, recovery?: Recovery | null): Promise<AssetVerification>;
 }
 
 /**
- * A `RangeSource` over a `Blob`: a `File` off an `<input>`, a
+ * A [`RangeSource`](crate::wasm::RangeInput) over a `Blob`: a `File` off an `<input>`, a
  * `Response.blob()`, a handle from the file system access API.
  *
- * It holds no bytes at all. The SDK reads one slice at a time, so an asset larger than the tab's
- * memory verifies at the disk's speed rather than the heap's.
+ * The only source here that holds nothing. The SDK reads one slice at a time, so an asset larger
+ * than the tab's memory verifies at the disk's speed rather than the heap's, and neither ceiling
+ * the other two carry applies.
  *
  * # Worker only
  *
@@ -483,6 +473,51 @@ export class BlobSource {
     readonly length: number;
 }
 
+/**
+ * A [`RangeSource`](crate::wasm::RangeInput) over bytes the caller already holds, read in place.
+ *
+ * [`MemorySource`] without the copy: the array stays on the JS side and only the window the SDK
+ * asks for crosses, so nothing is resident here and linear memory's 4 GiB ceiling never applies to
+ * the asset.
+ */
+export class BytesSource {
+    free(): void;
+    [Symbol.dispose](): void;
+    constructor(data: Uint8Array);
+    readAt(offset: number, length: number): Uint8Array;
+    readonly length: number;
+}
+
+export function C2PA_TRUST_LIST(): string;
+
+export function C2PA_TSA_TRUST_LIST(): string;
+
+export function DEV_CA(): string;
+
+/**
+ * A binder contributing a binding you already hold (e.g. an out-of-band video ISCC):
+ * `new HeldBinder(binding)`, the spelling the native lane uses. A verify takes it as data,
+ * `{ kind: "held", binding }`, in `recovery.binders`.
+ */
+export class HeldBinder {
+    free(): void;
+    [Symbol.dispose](): void;
+    /**
+     * Hand back the held binding; reads nothing.
+     *
+     * # Errors
+     *
+     * Throws when the source cannot be opened.
+     */
+    derive(content: RangeSource, options: DeriveOptions): Promise<SoftBinding | undefined>;
+    /**
+     * # Errors
+     *
+     * Throws `SdkError.invalid` on a binding with an empty algorithm or value.
+     */
+    constructor(binding: SoftBinding);
+}
+
 export class IntoUnderlyingByteSource {
     private constructor();
     free(): void;
@@ -512,9 +547,37 @@ export class IntoUnderlyingSource {
 }
 
 /**
- * A `RangeSource` over bytes the caller already holds, read in place: the array stays on the JS
- * side and only the window the SDK asks for crosses, so nothing is resident here and linear
- * memory's 4 GiB ceiling never applies to the asset.
+ * The SDK's local ISCC Image-Code binder, for a standalone `derive`: `new IsccBinder()`, the
+ * spelling the native lane uses. A verify takes it as data, `{ kind: "iscc" }`, in
+ * `recovery.binders`, because a class cannot cross into a worker.
+ *
+ * Vendor watermark detection is repository-side in this SDK: configured detectors participate in
+ * `verify` through `byContent`, while a held binder covers values already available to the caller.
+ */
+export class IsccBinder {
+    free(): void;
+    [Symbol.dispose](): void;
+    /**
+     * Derive the asset's ISCC standalone; `undefined` when the format yields none.
+     *
+     * # Errors
+     *
+     * Throws on malformed or unreadable input.
+     */
+    derive(content: RangeSource, options: DeriveOptions): Promise<SoftBinding | undefined>;
+    constructor();
+}
+
+/**
+ * An in-memory [`RangeSource`](crate::wasm::RangeInput), for a caller that already holds the whole
+ * asset as bytes.
+ *
+ * # Size ceiling
+ *
+ * The constructor copies the bytes into wasm linear memory, which is 32-bit addressed, so the
+ * asset and everything else the module allocates share a 4 GiB ceiling (a browser tab reaches its
+ * own memory limit well before that). [`BytesSource`] takes the same bytes without the copy, and
+ * [`BlobSource`] holds nothing at all.
  */
 export class MemorySource {
     free(): void;
@@ -533,8 +596,8 @@ export class StreamSession {
     free(): void;
     [Symbol.dispose](): void;
     /**
-     * This stream's id and everything its init segments have registered, as CBOR for another
-     * node to `StreamVerifier.resume` from.
+     * Everything this stream's init segments have registered, as CBOR for another node to
+     * `StreamVerifier.resume` from.
      *
      * The one piece of stream state that leaves the SDK, and only because a clustered
      * verifier needs it: the init URL is overwritten on rotation, so a node joining during
@@ -555,7 +618,7 @@ export class StreamSession {
      * Throws an `SdkError` on parse or signature failure, or when a media segment arrives
      * before any init was processed for the stream.
      */
-    validate(source: RangeSource): Promise<SegmentValidation>;
+    validate(data: RangeSource): Promise<SegmentValidation>;
 }
 
 export class StreamVerifier {
@@ -571,82 +634,26 @@ export class StreamVerifier {
      */
     static create(options: StreamVerifierOptions): StreamVerifier;
     /**
-     * Open the stream `id` for validation, handing back a `StreamSession` to feed segments to.
+     * Open `stream_id` for validation, handing back a `StreamSession` to feed segments to.
      *
      * No I/O: the handle carries the id so it cannot be mistyped or confused with another
      * stream's, and classification still happens per segment. Opening one id twice hands
      * back the same live session, so a component that remounts keeps the state its earlier
      * handle accumulated.
      */
-    open(id: string): StreamSession;
+    open(stream_id: string): StreamSession;
     /**
-     * Open the stream another node exported, its state merged into whatever this one holds
-     * for that stream already.
+     * Open `stream_id` on the state another node exported, merged into whatever this one
+     * holds for that id already.
      *
      * # Errors
      *
-     * Throws an `SdkError` with a field violation at `state` when it is not a value
-     * `StreamSession.export` produced (`state.malformed`), or one of another export version
-     * (`state.version`).
+     * Throws an `SdkError` (`STREAM_INVALID`) when `state` is not a value
+     * `StreamSession.export` produced, or carries a version this SDK no longer reads.
      */
-    resume(state: Uint8Array): StreamSession;
+    resume(stream_id: string, state: Uint8Array): StreamSession;
 }
 
-/**
- * One `verify` result held with the stores it read: `report` is the data, and `resource` reads a
- * thumbnail from credential `credential` (its position in `report.credentials`) by the
- * `identifier` of a resource reference in its manifest. A class rather than a field of the
- * report because a store cannot be serialized, and one handle per verify is what a worker can
- * proxy (a class nested in the report cannot cross a thread).
- */
-export class Verification {
-    private constructor();
-    free(): void;
-    [Symbol.dispose](): void;
-    /**
-     * The bytes of one resource credential `credential` holds, or `undefined`.
-     *
-     * # Errors
-     *
-     * Throws `READER_INVALID` when the store holds the resource but cannot produce it, and
-     * `undefined` for a `credential` out of range.
-     */
-    resource(credential: number, uri: string): Uint8Array | undefined;
-    /**
-     * The report: credentials, recovery, golden flow and verdict.
-     */
-    readonly report: AssetVerification;
-}
-
-/**
- * The bundled C2PA Conformance Program signing-CA trust list (a release snapshot). Trusted by
- * default with `trust.c2pa`; read it to pin or extend your own list.
- */
-export function c2paTrustList(): string;
-
-/**
- * The bundled C2PA time-stamping-authority trust list (a release snapshot).
- */
-export function c2paTsaTrustList(): string;
-
-/**
- * The values this SDK computes for `alg` over `source`, `[]` when it finds none. `format` is
- * the asset's media type; omitted, the bytes name it.
- *
- * # Errors
- *
- * Throws on an algorithm this SDK computes no value of, a `format` that is no media type or that
- * the bytes contradict, an unreadable source, or no trustworthy answer.
- */
-export function computeSoftBinding(alg: string, source: RangeSource, format?: string | null): Promise<Block[]>;
-
-/**
- * PEM trust anchor for the Limbo Integrity development signing environment, **development
- * only**, no security guarantees: put it in `trust.anchors` for a development build, never in a
- * release.
- */
-export function devCa(): string;
-
 export function init_panic_hook(): void;
 
 /**
@@ -662,51 +669,78 @@ export function init_panic_hook(): void;
  *
  * Throws `READER_INVALID` when the bytes are not a manifest store c2pa can parse.
  */
-export function parse(manifest: Uint8Array): Promise<import('@contentauth/c2pa-types').ManifestStore>;
+export function parse(manifest: Uint8Array): import('@contentauth/c2pa-types').ManifestStore;
 
 /**
  * The bytes of one resource in a detached manifest store, or `undefined` when it holds none
- * under `uri`: the `identifier` on a resource reference the parsed store carries.
+ * under `uri`.
+ *
+ * `uri` is the `identifier` on a resource reference the store carries, so walking the chain in
+ * the parsed store is what produces it: any manifest's claim thumbnail, including a non-active
+ * one, and any ingredient's. Render it with the `format` beside that identifier. A `uri` naming a
+ * manifest rather than a resource answers that manifest's own JUMBF, so pass what a reference
+ * states, never a bare label.
  *
  * # Errors
  *
  * Throws `READER_INVALID` when the bytes are not a manifest store c2pa can parse, or the store
  * holds the resource but cannot produce it.
  */
-export function resource(manifest: Uint8Array, uri: string): Promise<Uint8Array | undefined>;
+export function resource(manifest: Uint8Array, uri: string): Uint8Array | undefined;
+
+/**
+ * Every thumbnail the store references, by the `identifier` it references them under: each
+ * manifest's claim thumbnail and each ingredient's, whichever manifest carries them.
+ *
+ * One parse for the whole set, where `resource` pays one per call, so a chain view asks once
+ * instead of once per tile. Render each one as the `format` beside its identifier. A reference
+ * the store cannot produce is left out rather than failing the set.
+ *
+ * # Errors
+ *
+ * Throws `READER_INVALID` when the bytes are not a manifest store c2pa can parse.
+ */
+export function thumbnails(manifest: Uint8Array): Record<string, Uint8Array>;
 
 export type InitInput = RequestInfo | URL | Response | BufferSource | WebAssembly.Module;
 
 export interface InitOutput {
     readonly memory: WebAssembly.Memory;
-    readonly computeSoftBinding: (a: number, b: number, c: any, d: number, e: number) => any;
     readonly __wbg_assetverifier_free: (a: number, b: number) => void;
     readonly __wbg_blobsource_free: (a: number, b: number) => void;
+    readonly __wbg_bytessource_free: (a: number, b: number) => void;
     readonly __wbg_memorysource_free: (a: number, b: number) => void;
     readonly __wbg_streamsession_free: (a: number, b: number) => void;
     readonly __wbg_streamverifier_free: (a: number, b: number) => void;
-    readonly __wbg_verification_free: (a: number, b: number) => void;
     readonly assetverifier_create: (a: any) => [number, number, number];
     readonly assetverifier_verify: (a: number, b: any, c: number) => any;
     readonly blobsource_length: (a: number) => number;
     readonly blobsource_new: (a: any) => [number, number, number];
     readonly blobsource_readAt: (a: number, b: number, c: number) => [number, number, number];
+    readonly bytessource_length: (a: number) => number;
+    readonly bytessource_new: (a: any) => number;
+    readonly bytessource_readAt: (a: number, b: number, c: number) => any;
     readonly memorysource_length: (a: number) => number;
-    readonly memorysource_new: (a: any) => number;
+    readonly memorysource_new: (a: number, b: number) => number;
     readonly memorysource_readAt: (a: number, b: number, c: number) => any;
-    readonly parse: (a: number, b: number) => any;
-    readonly resource: (a: number, b: number, c: number, d: number) => any;
+    readonly parse: (a: number, b: number) => [number, number, number];
+    readonly resource: (a: number, b: number, c: number, d: number) => [number, number, number, number];
     readonly streamsession_export: (a: number) => [number, number, number, number];
     readonly streamsession_validate: (a: number, b: any) => any;
     readonly streamverifier_create: (a: any) => [number, number, number];
     readonly streamverifier_open: (a: number, b: number, c: number) => number;
-    readonly streamverifier_resume: (a: number, b: number, c: number) => [number, number, number];
-    readonly verification_report: (a: number) => any;
-    readonly verification_resource: (a: number, b: number, c: number, d: number) => [number, number, number, number];
-    readonly c2paTrustList: () => [number, number];
-    readonly c2paTsaTrustList: () => [number, number];
-    readonly devCa: () => [number, number];
+    readonly streamverifier_resume: (a: number, b: number, c: number, d: number, e: number) => [number, number, number];
+    readonly thumbnails: (a: number, b: number) => [number, number, number];
+    readonly C2PA_TRUST_LIST: () => [number, number];
+    readonly C2PA_TSA_TRUST_LIST: () => [number, number];
+    readonly DEV_CA: () => [number, number];
     readonly init_panic_hook: () => void;
+    readonly __wbg_heldbinder_free: (a: number, b: number) => void;
+    readonly __wbg_isccbinder_free: (a: number, b: number) => void;
+    readonly heldbinder_derive: (a: number, b: any, c: any) => any;
+    readonly heldbinder_new: (a: any) => [number, number, number];
+    readonly isccbinder_derive: (a: number, b: any, c: any) => any;
+    readonly isccbinder_new: () => number;
     readonly __wbg_intounderlyingbytesource_free: (a: number, b: number) => void;
     readonly intounderlyingbytesource_autoAllocateChunkSize: (a: number) => number;
     readonly intounderlyingbytesource_cancel: (a: number) => void;
@@ -723,7 +757,7 @@ export interface InitOutput {
     readonly wasm_bindgen__convert__closures_____invoke__hfa954cb356c7e7e1: (a: number, b: number, c: any) => [number, number];
     readonly wasm_bindgen__convert__closures_____invoke__h32a4f2e7671466cf: (a: number, b: number, c: any, d: any) => void;
     readonly wasm_bindgen__convert__closures_____invoke__hedf60f9cb8ab20c3: (a: number, b: number, c: any) => void;
-    readonly wasm_bindgen__convert__closures_____invoke__hbf782ef36cea6846: (a: number, b: number) => void;
+    readonly wasm_bindgen__convert__closures_____invoke__hcc9f2329e90526d5: (a: number, b: number) => void;
     readonly __wbindgen_malloc: (a: number, b: number) => number;
     readonly __wbindgen_realloc: (a: number, b: number, c: number, d: number) => number;
     readonly __wbindgen_exn_store: (a: number) => void;
@@ -731,7 +765,6 @@ export interface InitOutput {
     readonly __wbindgen_externrefs: WebAssembly.Table;
     readonly __wbindgen_free: (a: number, b: number, c: number) => void;
     readonly __wbindgen_destroy_closure: (a: number, b: number) => void;
-    readonly __externref_drop_slice: (a: number, b: number) => void;
     readonly __externref_table_dealloc: (a: number) => void;
     readonly __wbindgen_start: () => void;
 }