@trylimbo/sdk-verifier-wasm 0.2.25-canary.37 → 0.2.25

package/gen/wasm/worker.d.ts

@@ -163,61 +163,141 @@ interface RangeSource {
   readAt: (offset: number, length: number) => Uint8Array;
 }
 /**
- * A `soft-binding-block-map`. No scope is the whole content.
+ * A C2PA soft binding: an algorithm id (from the C2PA soft-binding algorithm
+ * list, e.g. `io.iscc.v0`) plus its algorithm-specific value (the `ISCC:…` code,
+ * a watermark token, …). The signer embeds it as a `c2pa.soft-binding` assertion
+ * and indexes it, so a transcoded copy whose exact content hash no longer
+ * matches still recovers the manifest from the repository.
  */
-interface Block {
-  value: Uint8Array;
-  scope?: Scope;
-}
-/**
- * A `soft-binding-scope-map`.
- */
-interface Scope {
-  timespan?: Timespan;
+interface SoftBinding {
+  /**
+   * C2PA soft-binding algorithm id, e.g. `io.iscc.v0`.
+   */
+  alg: string;
+  /**
+   * Algorithm-specific binding value: the canonical string the algorithm
+   * produces (an `ISCC:…` code, a watermark token). Its UTF-8 bytes are what
+   * the repository lookup base64-encodes.
+   */
+  value: string;
 }
 /**
- * A `soft-binding-timespan-map`: where the range starts in the media and how long it lasts, in
- * milliseconds.
+ * A binder spelled as data, so it crosses into a worker as well as the direct import: the
+ * SDK\'s own two. A browser has no host binder: a detector runs repository-side.
  */
-interface Timespan {
-  start: number;
-  duration: number;
-}
+type BinderSpec = {
+  kind: "iscc";
+} | {
+  kind: "held";
+  binding: SoftBinding;
+};
 /**
  * A session signing key from the init manifest\'s roster (spec §19.4.4).
  */
-interface SessionKey {
+interface SessionKeySummary {
   /**
    * Identifier of the session signing key.
    */
-  kid: Uint8Array;
+  keyId: Uint8Array;
   /**
    * The session key\'s public half (SEC1-encoded bytes).
    */
   publicKey: Uint8Array;
 }
 /**
- * An asset a repository downloads, as the `byReference` request body names it.
+ * C2PA validation state of a manifest (spec §14.3).
+ */
+type ValidationState = "Invalid" | "Valid" | "Trusted";
+/**
+ * Construction options for [`AssetVerifier::new`] (and the `AssetVerifier.create` JS
+ * binding). Every field is stated: nothing here is chosen on the caller\'s behalf.
+ *
+ * One definition, all lanes: `#[binding]` derives the shapes directly here:
+ * tsify (camelCase) on wasm, a `uniffi::Record` on the native `ffi` build, so there is no
+ * per-lane DTO copy. Off both lanes it is a plain struct.
  */
-interface Reference {
+interface AssetVerifierOptions {
   /**
-   * A short-lived https URL without credentials.
+   * The C2PA manifest repositories recovery asks, each a Soft Binding Resolution API declared
+   * for exactly the algorithms it may be asked for. Results merge by manifest, and a match\'s
+   * `endpoint` is fetched from only when it names one of these. Empty: no recovery can be
+   * asked of this verifier.
    */
-  url: string;
+  repositories: Repository[];
   /**
-   * The asset\'s size in bytes.
+   * PEM trust anchors for the manifest signers the caller trusts.
    */
-  length: number;
+  trustAnchors: string[];
+  /**
+   * PEM trust anchors for the time-stamping authorities the caller trusts.
+   */
+  tsaTrustAnchors: string[];
   /**
-   * The asset\'s media type.
+   * Also trust the bundled official C2PA anchors, manifest and TSA lists, beside the
+   * caller\'s. `false` trusts the caller\'s lists alone.
    */
-  format?: string;
-  ranges?: import('@contentauth/c2pa-types').Range[];
+  trustC2paAnchors: boolean;
+  /**
+   * Issuer DIDs whose CAWG identity (ICA) credentials count as validated, matched
+   * exactly against the credential issuer. Empty trusts no issuer: every identity assertion
+   * then reports `cawg.ica.untrusted_issuer` and withholds `cawg.ica.credential_valid`,
+   * which leaves the manifest\'s own validity untouched.
+   */
+  trustedIcaIssuers: string[];
 }
 /**
- * C2PA validation state of a manifest (spec §14.3).
+ * Construction options for [`StreamVerifier::new`] (and the `StreamVerifier.create`
+ * JS binding). Every field is stated: nothing here is chosen on the caller\'s behalf.
+ *
+ * `#[binding]` derives the wasm shape (`trustC2paAnchors` camelCase) and,
+ * with `ffi`, a `uniffi::Record` for the native `StreamVerifier.create` binding, so there
+ * is no per-lane DTO copy. Off both lanes it is a plain struct.
  */
-type ValidationState = "Invalid" | "Valid" | "Trusted";
+interface StreamVerifierOptions {
+  /**
+   * PEM trust anchors for the manifest signers the caller trusts.
+   */
+  trustAnchors: string[];
+  /**
+   * PEM trust anchors for the time-stamping authorities the caller trusts.
+   */
+  tsaTrustAnchors: string[];
+  /**
+   * Also trust the bundled official C2PA anchors, manifest and TSA lists, beside the
+   * caller\'s. `false` trusts the caller\'s lists alone.
+   */
+  trustC2paAnchors: boolean;
+  /**
+   * Issuer DIDs whose CAWG identity (ICA) credentials count as validated, matched
+   * exactly against the credential issuer. Empty trusts no issuer: an identity assertion
+   * on the init segment\'s manifest then reports `cawg.ica.untrusted_issuer` and withholds
+   * `cawg.ica.credential_valid`.
+   */
+  trustedIcaIssuers: string[];
+  /**
+   * How far a segment\'s timestamp may sit from wall-clock before it is rejected as
+   * skewed, in seconds: the deployment\'s own encoder-clock allowance, stated rather than
+   * assumed.
+   */
+  segmentSkewToleranceSecs: number;
+}
+/**
+ * Everything one `derive` needs beyond the asset: how its format is known. The same record
+ * the native lane\'s `DeriveOptions` is, spelled as data.
+ */
+interface DeriveOptions {
+  format: AssetFormat;
+}
+/**
+ * How a call knows the asset\'s format: stated by the caller, or read from the leading bytes.
+ * Stated, never defaulted: sniffing is a choice made by name.
+ */
+type AssetFormat = {
+  kind: "sniff";
+} | {
+  kind: "declared";
+  mediaType: string;
+};
 /**
  * One C2PA manifest repository, as the Soft Binding Resolution API spec lets a client find it.
  */
@@ -226,8 +306,8 @@ type Repository = {
   url: string;
   algorithms: string[];
 } | {
-  kind: "registered";
-  alg: string;
+  kind: "listed";
+  algorithm: string;
 };
 /**
  * One C2PA validation status entry (spec §15.3): the registered code, its kind, and the
@@ -251,7 +331,13 @@ interface ValidationCode {
  */
 interface Credential {
   /**
-   * Where this credential came from.
+   * The bytes behind every thumbnail the manifests reference, by that reference\'s
+   * `identifier`: each manifest\'s claim thumbnail and each ingredient\'s. The manifests state
+   * identifiers and no images, so this is what a chain draws from.
+   */
+  thumbnails: Record<string, Uint8Array>;
+  /**
+   * Where this credential came from. See [`CredentialOrigin`].
    */
   origin: CredentialOrigin;
   manifest: import('@contentauth/c2pa-types').ManifestStore;
@@ -260,38 +346,17 @@ interface Credential {
    */
   hardBinding: HardBinding;
   /**
-   * Where this credential sits among the others returned.
+   * Where this credential sits among the others returned. See [`crate::asset::Lineage`].
    */
   lineage: Lineage;
 }
-/**
- * One query that located a recovered credential: how it was asked, under which algorithm, and
- * where the manifest came from.
- */
-interface Discovery {
-  via: DiscoveryVia;
-  alg: string;
-  type: SoftBindingType;
-  /**
-   * 0-100, the repository\'s `similarityScore`.
-   */
-  score?: number;
-  repository: string;
-  /**
-   * The resolution API the manifest was fetched from, when not `repository`.
-   */
-  endpoint?: string;
-}
 /**
  * Outcome of validating a media segment against its stream\'s init.
  */
 interface MediaValidation {
-  /**
-   * `invalid` on any failure, else the state of the init manifest the segment\'s key came from.
-   */
-  state: ValidationState;
+  valid: boolean;
   codes: ValidationCode[];
-  kid: Uint8Array;
+  keyId: Uint8Array;
   timing: SegmentTiming;
   manifestId: string;
 }
@@ -302,7 +367,7 @@ interface InitValidation {
   state: ValidationState;
   codes: ValidationCode[];
   manifest: import('@contentauth/c2pa-types').ManifestStore;
-  sessionKeys: SessionKey[];
+  sessionKeys: SessionKeySummary[];
 }
 /**
  * Result of `StreamSession.validate`, discriminated by `kind`.
@@ -315,214 +380,80 @@ type SegmentValidation = ({
   kind: "unknown";
 };
 /**
- * The C2PA 2.4 golden-flow comparison of the embedded manifest against what the repository holds.
- */
-type Golden = {
-  kind: "matches";
-  index: number;
-} | {
-  kind: "differs";
-  index: number;
-} | {
-  kind: "noneMatches";
-  candidates: number[];
-} | {
-  kind: "unreadable";
-  index: number;
-};
-/**
- * The C2PA list\'s `type` of a soft binding algorithm.
- */
-type SoftBindingType = "fingerprint" | "watermark";
-/**
- * The Soft Binding Resolution API route a discovery came through.
- */
-type DiscoveryVia = {
-  kind: "byBinding";
-  value: Uint8Array;
-} | {
-  kind: "byContent";
-  hint?: Hint;
-} | {
-  kind: "byReference";
-  hint?: Hint;
-};
-/**
- * The evidence that singled a recovered verdict out.
- */
-type VerdictRule = "onlyCandidate" | "notSuperseded" | "hardBinding";
-/**
- * The query a repository answers from the content: `matches/byReference` when `reference` is
- * stated, so nothing is uploaded, else `matches/byContent` with the asset in the request.
- */
-interface Content {
-  when: ContentWhen;
-  /**
-   * Where each repository downloads the asset from.
-   */
-  reference?: Reference;
-  /**
-   * The largest asset an upload sends, in bytes; a larger one is reported `tooLarge`. Absent,
-   * 64 MiB.
-   */
-  maxUploadBytes?: number;
-}
-/**
- * The re-sign chain between the returned credentials, by manifest label.
- */
-interface Lineage {
-  supersedes: string[];
-  supersededBy: string[];
-}
-/**
- * The value a content query was hinted with, under its own algorithm.
- */
-interface Hint {
-  alg: string;
-  value: Uint8Array;
-}
-/**
- * Timing a media segment\'s container carries.
+ * Timing facts carried by a media segment\'s container.
  */
 interface SegmentTiming {
   /**
-   * The segment\'s `sequenceNumber` (exact below 2^53).
+   * Media segment sequence number (exact below 2^53).
    */
-  sequence: number;
+  sequenceNumber: number;
   /**
-   * The span its C2PA `emsg` covers, in milliseconds.
+   * MP4 timescale (ticks per second) for this segment\'s timing, if present.
    */
-  duration?: number;
-}
-/**
- * What a stream verifier trusts, and how far a segment\'s clock may drift.
- */
-interface StreamVerifierOptions {
-  trust: Trust;
+  timescale?: number;
   /**
-   * How far a segment\'s presentation time may sit outside its session key\'s validity period,
-   * in milliseconds. Absent, 5 minutes.
+   * Segment duration in seconds, if the container reports it.
    */
-  skewTolerance?: number;
+  eventDurationSecs?: number;
 }
 /**
- * What a verifier trusts. An omitted list trusts nothing.
+ * What one verify may do to recover a manifest, as data: the binders this client derives for
+ * itself, decided into `matches/byBinding`, and one field per content operation, absent when
+ * not to be called. It needs a configured repository and at least one query.
  */
-interface Trust {
-  /**
-   * PEM anchors for the manifest signers the caller trusts.
-   */
-  anchors?: string[];
-  /**
-   * PEM anchors for the time-stamping authorities the caller trusts.
-   */
-  tsaAnchors?: string[];
-  /**
-   * Also trust the bundled official C2PA manifest and TSA lists, beside the caller\'s.
-   */
-  c2pa: boolean;
-  /**
-   * Issuer DIDs whose CAWG identity (ICA) credentials count as validated, matched exactly
-   * against the credential issuer. Empty trusts no issuer: every identity assertion then
-   * reports `cawg.ica.untrusted_issuer` and withholds `cawg.ica.credential_valid`, which leaves
-   * the manifest\'s own validity untouched.
-   */
-  icaIssuers?: string[];
+interface Recovery {
+  when: RecoveryTrigger;
+  binders: BinderSpec[];
+  byContent?: ByContent;
+  byReference?: ByReference;
 }
 /**
- * What an asset verifier trusts and which repositories it may ask. An omitted list trusts or
- * asks nothing.
+ * When [`AssetVerifier::verify_asset`] queries the repository.
  */
-interface AssetVerifierOptions {
-  /**
-   * The C2PA manifest repositories recovery asks, each a Soft Binding Resolution API declared
-   * for exactly the algorithms it may be asked for. Results merge by manifest, and a match\'s
-   * `endpoint` is fetched from only when it names one of these. Empty: no recovery can be
-   * asked of this verifier.
-   */
-  repositories?: Repository[];
-  trust: Trust;
-}
+type RecoveryTrigger = "manifestMissing" | "always";
 /**
- * What one verify may do to recover a manifest, as data: the soft bindings this client looks up
- * itself through `matches/byBinding`, and the content query, absent when not to be asked. It
- * needs a configured repository and at least one query.
+ * Whether a code is a success, an informational note, or a failure.
  */
-interface Recovery {
-  when: RecoveryTrigger;
-  softBindings?: SoftBindingSource[];
-  content?: Content;
-  /**
-   * The whole recovery\'s budget in milliseconds, every repository together, each request
-   * bounded by what remains. Absent, 10 minutes; at most 2147483647.
-   */
-  timeout?: number;
-}
+type ValidationCodeKind = "success" | "informational" | "failure";
 /**
- * What this verify concludes about the asset, from signed evidence alone.
+ * Whether a content form runs on this verify. Judged against the byBinding results alone.
  */
-type Verdict = {
-  kind: "unsigned";
-} | {
-  kind: "inconclusive";
-} | {
-  kind: "embedded";
-} | {
-  kind: "recovered";
-  index: number;
-  decidedBy: VerdictRule;
-} | {
-  kind: "recoveredDerivative";
-  index: number;
-  decidedBy: VerdictRule;
-} | {
-  kind: "ambiguous";
-  candidates: number[];
-};
+type ContentTrigger = "byBindingMisses" | "always";
 /**
- * When a verify asks the repositories.
+ * [`crate::asset::ByReference`] as JS states it: the region is the `Range` of
+ * `@contentauth/c2pa-types`, the shape a credential\'s actions carry.
  */
-type RecoveryTrigger = "manifestMissing" | "always";
+interface ByReference {
+  after: ContentTrigger;
+  url: string;
+  length: number;
+  mediaType?: string;
+  region: import('@contentauth/c2pa-types').Range[];
+}
 /**
- * Where a credential came from: embedded in the asset, or recovered from a repository.
+ * [`crate::asset::CredentialOrigin`] as JS sees it: a tagged union, since each way of finding a
+ * credential carries different evidence. Lane-local for the same reason [`FingerprintCheck`] is: a
+ * tag layout is what `#[binding(wasm)]` declines to express.
  */
 type CredentialOrigin = {
   kind: "embedded";
 } | {
   kind: "recovered";
-  discoveries: Discovery[];
+  discoveries: RecoveryDiscovery[];
   fingerprintCheck: FingerprintCheck;
 };
 /**
- * Where one byBinding query\'s value comes from. A browser has no host engine: a vendor\'s
- * detector runs repository-side, through `byContent`.
- */
-type SoftBindingSource = {
-  kind: "builtin";
-  alg: string;
-} | {
-  kind: "held";
-  alg: string;
-  value: Uint8Array;
-};
-/**
- * Whether a code is a success, an informational note, or a failure.
- */
-type ValidationCodeKind = "success" | "informational" | "failure";
-/**
- * Whether a content form runs on this verify. Judged against the byBinding results alone.
- */
-type ContentWhen = "bindingMisses" | "always";
-/**
- * Whether the asset\'s own fingerprint backs up a manifest that a watermark led to.
+ * [`crate::asset::FingerprintCheck`] as JS sees it: a tagged union, since `compared` carries a
+ * measurement the other two do not. Lane-local rather than `#[binding(wasm)]` on the core,
+ * because a tag layout is exactly what that macro declines to express.
  */
 type FingerprintCheck = {
   kind: "notNeeded";
 } | {
-  kind: "missing";
+  kind: "nothingToCompare";
 } | {
   kind: "unsupported";
-  alg: string;
+  algorithm: string;
 } | {
   kind: "indeterminate";
 } | {
@@ -530,40 +461,59 @@ type FingerprintCheck = {
   score: number;
 };
 /**
- * Whether the manifest\'s hard binding holds over the bytes this verify read.
+ * [`crate::asset::HardBinding`] as JS sees it.
  */
 type HardBinding = "match" | "mismatch";
 /**
- * Why repository recovery did not complete cleanly, or why one candidate was omitted.
+ * [`crate::asset::Lineage`] as JS sees it.
+ */
+interface Lineage {
+  supersedes: string[];
+  supersededBy: string[];
+}
+/**
+ * [`crate::asset::RecoveryIssue`] as JS sees it: a tagged union, each kind with its own data.
  */
 type RecoveryIssue = {
-  kind: "computeFailed";
-  alg: string;
+  kind: "binderFailed";
+  binderIndex: number;
   message: string;
 } | {
-  kind: "bindingFailed";
+  kind: "algorithmDeprecated";
+  algorithm: string;
+} | {
+  kind: "bindingUndeclared";
+  binderIndex: number;
+  algorithm: string;
+} | {
+  kind: "bindingQueryFailed";
   repository: string;
-  alg: string;
+  binderIndex: number;
+  algorithm: string;
   message: string;
 } | {
   kind: "queryRefused";
   repository: string;
-  alg: string;
+  algorithm: string;
   message: string;
 } | {
-  kind: "contentFailed";
+  kind: "contentFormUnsupported";
   repository: string;
-  alg: string;
+  message: string;
+} | {
+  kind: "contentQueryFailed";
+  repository: string;
+  algorithm: string;
   message: string;
 } | {
   kind: "capabilitiesUnavailable";
   repository: string;
   message: string;
 } | {
-  kind: "tooLarge";
-  maxUploadBytes: number;
+  kind: "contentTooLarge";
+  capBytes: number;
 } | {
-  kind: "fetchFailed";
+  kind: "candidateFetchFailed";
   repository: string;
   manifestId: string;
   message: string;
@@ -577,22 +527,98 @@ type RecoveryIssue = {
   manifestId: string;
   endpoint: string;
 } | {
-  kind: "limitReached";
+  kind: "resourceLimitReached";
   message: string;
 };
+/**
+ * [`crate::asset::VerdictRule`] as JS sees it.
+ */
+type VerdictRule = "onlyCandidate" | "notSuperseded" | "hardBinding";
+/**
+ * [`crate::asset::Verdict`] as JS sees it.
+ */
+type Verdict = {
+  kind: "unsigned";
+} | {
+  kind: "inconclusive";
+} | {
+  kind: "embedded";
+} | {
+  kind: "recovered";
+  index: number;
+  decidedBy: VerdictRule;
+} | {
+  kind: "recoveredDerivative";
+  index: number;
+  decidedBy: VerdictRule;
+} | {
+  kind: "ambiguous";
+  candidates: number[];
+};
+/**
+ * `matches/byContent`: the asset is uploaded to each repository, one request per algorithm that
+ * repository is declared for.
+ */
+interface ByContent {
+  after: ContentTrigger;
+}
 interface AssetVerification {
   credentials: Credential[];
   recovery: RecoverySummary;
-  /**
-   * Absent when there was nothing to compare.
-   */
-  golden?: Golden;
+  goldenComparison: GoldenComparison;
   verdict: Verdict;
 }
 interface RecoverySummary {
   status: RecoveryStatus;
   issues: RecoveryIssue[];
 }
+type ContentBindingClass = "fingerprint" | "watermark";
+type GoldenComparison = {
+  kind: "notRequested";
+} | {
+  kind: "noEmbeddedManifest";
+} | {
+  kind: "noRecoveredManifest";
+} | {
+  kind: "recoveryIncomplete";
+} | {
+  kind: "matches";
+  recoveredIndex: number;
+} | {
+  kind: "differs";
+  recoveredIndex: number;
+} | {
+  kind: "noneMatches";
+  candidates: number[];
+} | {
+  kind: "unreadable";
+  recoveredIndex: number;
+};
+type RecoveryDiscovery = {
+  kind: "byBinding";
+  class: ContentBindingClass;
+  binding: SoftBinding;
+  binderIndex: number;
+  repositoryScore: number | undefined;
+  repository: string;
+  fetchedFrom: string;
+} | {
+  kind: "byContent";
+  hint: SoftBinding | undefined;
+  class: ContentBindingClass;
+  algorithm: string;
+  repositoryScore: number | undefined;
+  repository: string;
+  fetchedFrom: string;
+} | {
+  kind: "byReference";
+  hint: SoftBinding | undefined;
+  class: ContentBindingClass;
+  algorithm: string;
+  repositoryScore: number | undefined;
+  repository: string;
+  fetchedFrom: string;
+};
 type RecoveryStatus = "notRequested" | "notFound" | "recovered" | "incomplete";
 declare class AssetVerifier {
   private constructor();
@@ -612,11 +638,14 @@ declare class AssetVerifier {
    *
    * # Errors
    *
-   * Throws on a malformed `source`, a repository (or engine) failure, or a validation
+   * Throws on a malformed `input`, a repository (or binder) failure, or a validation
    * failure.
    */
-  verify(source: RangeSource, recovery?: Recovery | null): Promise<Verification>;
+  verify(input: RangeSource, recovery?: Recovery | null): Promise<AssetVerification>;
 }
+declare function C2PA_TRUST_LIST(): string;
+declare function C2PA_TSA_TRUST_LIST(): string;
+declare function DEV_CA(): string;
 /**
  * One stream being validated. It owns the session keys and manifest ids its init segments
  * advertised, so releasing the stream is dropping this object.
@@ -626,8 +655,8 @@ declare class StreamSession {
   free(): void;
   [Symbol.dispose](): void;
   /**
-   * This stream's id and everything its init segments have registered, as CBOR for another
-   * node to `StreamVerifier.resume` from.
+   * Everything this stream's init segments have registered, as CBOR for another node to
+   * `StreamVerifier.resume` from.
    *
    * The one piece of stream state that leaves the SDK, and only because a clustered
    * verifier needs it: the init URL is overwritten on rotation, so a node joining during
@@ -648,7 +677,7 @@ declare class StreamSession {
    * Throws an `SdkError` on parse or signature failure, or when a media segment arrives
    * before any init was processed for the stream.
    */
-  validate(source: RangeSource): Promise<SegmentValidation>;
+  validate(data: RangeSource): Promise<SegmentValidation>;
 }
 declare class StreamVerifier {
   private constructor();
@@ -663,57 +692,25 @@ declare class StreamVerifier {
    */
   static create(options: StreamVerifierOptions): StreamVerifier;
   /**
-   * Open the stream `id` for validation, handing back a `StreamSession` to feed segments to.
+   * Open `stream_id` for validation, handing back a `StreamSession` to feed segments to.
    *
    * No I/O: the handle carries the id so it cannot be mistyped or confused with another
    * stream's, and classification still happens per segment. Opening one id twice hands
    * back the same live session, so a component that remounts keeps the state its earlier
    * handle accumulated.
    */
-  open(id: string): StreamSession;
+  open(stream_id: string): StreamSession;
   /**
-   * Open the stream another node exported, its state merged into whatever this one holds
-   * for that stream already.
+   * Open `stream_id` on the state another node exported, merged into whatever this one
+   * holds for that id already.
    *
    * # Errors
    *
-   * Throws an `SdkError` with a field violation at `state` when it is not a value
-   * `StreamSession.export` produced (`state.malformed`), or one of another export version
-   * (`state.version`).
+   * Throws an `SdkError` (`STREAM_INVALID`) when `state` is not a value
+   * `StreamSession.export` produced, or carries a version this SDK no longer reads.
    */
-  resume(state: Uint8Array): StreamSession;
+  resume(stream_id: string, state: Uint8Array): StreamSession;
 }
-/**
- * One `verify` result held with the stores it read: `report` is the data, and `resource` reads a
- * thumbnail from credential `credential` (its position in `report.credentials`) by the
- * `identifier` of a resource reference in its manifest. A class rather than a field of the
- * report because a store cannot be serialized, and one handle per verify is what a worker can
- * proxy (a class nested in the report cannot cross a thread).
- */
-declare class Verification {
-  private constructor();
-  free(): void;
-  [Symbol.dispose](): void;
-  /**
-   * The bytes of one resource credential `credential` holds, or `undefined`.
-   *
-   * # Errors
-   *
-   * Throws `READER_INVALID` when the store holds the resource but cannot produce it, and
-   * `undefined` for a `credential` out of range.
-   */
-  resource(credential: number, uri: string): Uint8Array | undefined;
-  /**
-   * The report: credentials, recovery, golden flow and verdict.
-   */
-  readonly report: AssetVerification;
-}
-/**
- * PEM trust anchor for the Limbo Integrity development signing environment, **development
- * only**, no security guarantees: put it in `trust.anchors` for a development build, never in a
- * release.
- */
-declare function devCa(): string;
 //#endregion
 //#region src/worker-thread.d.ts
 /**
@@ -740,18 +737,9 @@ declare abstract class Handle<T extends {
   constructor(inner: T);
   [finalizer](): void;
 }
-/**
- * One verify result. A wasm class cannot cross the thread, so the report and the stores behind it
- * stay here and the caller holds this: `report()` is the data, `resource()` reads a thumbnail from
- * a credential by its position in `report().credentials`.
- */
-declare class VerificationHandle extends Handle<Verification> {
-  report(): AssetVerification;
-  resource(credential: number, uri: string): Uint8Array | undefined;
-}
 declare class AssetVerifierHandle extends Handle<AssetVerifier> {
   /** `recovery` is what this verify may do to recover a manifest, as the direct import takes it. */
-  verify(asset: Asset, recovery: Recovery | undefined): Promise<VerificationHandle & ProxyMarked>;
+  verify(asset: Asset, recovery: Recovery | undefined): Promise<AssetVerification>;
 }
 /** One stream being validated. Dropping the handle releases the session it accumulated. */
 declare class StreamSessionHandle extends Handle<StreamSession> {
@@ -759,8 +747,8 @@ declare class StreamSessionHandle extends Handle<StreamSession> {
   export(): Uint8Array;
 }
 declare class StreamVerifierHandle extends Handle<StreamVerifier> {
-  open(id: string): StreamSessionHandle & ProxyMarked;
-  resume(state: Uint8Array): StreamSessionHandle & ProxyMarked;
+  open(streamId: string): StreamSessionHandle & ProxyMarked;
+  resume(streamId: string, state: Uint8Array): StreamSessionHandle & ProxyMarked;
 }
 /** The module's own surface, name for name with the direct import. */
 declare const sdk: {
@@ -775,11 +763,13 @@ declare const sdk: {
   StreamVerifier: {
     create: (options: StreamVerifierOptions) => StreamVerifierHandle & ProxyMarked;
   } & ProxyMarked;
-  /**
-   * The values this SDK computes for `alg` over the asset, `[]` when it finds none. `format` is the
-   * asset's media type; omitted, the bytes name it.
-   */
-  computeSoftBinding(alg: string, asset: Asset, format?: string): Promise<Block[]>;
+  Binder: {
+    /**
+     * Derive one binder's binding standalone. The binder is built, used and dropped here, so there
+     * is no handle to keep: what the caller wants back is the binding.
+     */
+    derive: (spec: BinderSpec, content: Asset, options: DeriveOptions) => Promise<SoftBinding | undefined>;
+  } & ProxyMarked;
   /**
    * Read a detached manifest store. Contents, not a verdict: with no asset there is no hard binding
    * to check, so the store's validation fields state nothing this established.
@@ -790,7 +780,14 @@ declare const sdk: {
    * manifest's claim thumbnail, and any ingredient's.
    */
   resource(manifest: Asset, uri: string): Promise<Uint8Array<ArrayBufferLike> | undefined>;
-  devCa: typeof devCa;
+  /**
+   * Every thumbnail the store references, by the identifier it references them under. One parse
+   * and one thread hop for the whole set, where `resource` pays both per call.
+   */
+  thumbnails(manifest: Asset): Promise<Record<string, Uint8Array<ArrayBufferLike>>>;
+  C2PA_TRUST_LIST: typeof C2PA_TRUST_LIST;
+  C2PA_TSA_TRUST_LIST: typeof C2PA_TSA_TRUST_LIST;
+  DEV_CA: typeof DEV_CA;
   close(): void;
 };
 /** What the caller's thread holds a `Comlink.Remote` of. */