@trylimbo/sdk-verifier-wasm 0.2.10 → 0.2.11-canary.13

package/gen/wasm/trylimbo_sdk_verifier.d.ts

@@ -81,6 +81,11 @@ export interface SessionKeySummary {
     publicKey: Uint8Array;
 }
 
+/**
+ * A single C2PA Soft Binding Resolution API lookup.
+ */
+export type RecoveryQuery = { byBinding: { binderIndex: number } } | { byContent: { algorithm: ContentAlgorithm; hintBinderIndex?: number } };
+
 /**
  * A status with no structured detail (`kind: \"status\"`).
  */
@@ -159,12 +164,9 @@ export interface StreamVerifierOptions {
 }
 
 /**
- * How far a recovery may go, which decides what leaves the caller.
- *
- * Separate from [`RecoveryPolicy`], which decides *when* a recovery runs: one names the trigger
- * and the other the reach, and crossing them is what the two enums exist to keep legible.
+ * How a `byContent` query selects the registry\'s detector algorithms.
  */
-export type RegistryQueries = "derived" | "derivedThenContent";
+export type ContentAlgorithm = "fingerprint" | "watermark" | "all" | { named: { algorithm: string } };
 
 /**
  * One C2PA validation status entry (spec §15.3).
@@ -187,8 +189,8 @@ export interface FieldViolation {
 }
 
 /**
- * One `verify` credential: the c2pa `ManifestStore`, where it came from, and whether the
- * asset\'s own fingerprint backs it up.
+ * One `verify` credential: the c2pa `ManifestStore`, where it came from, whether the asset\'s
+ * own fingerprint backs it up, and whether its hard binding holds over the bytes read.
  */
 export interface FoundCredential {
     /**
@@ -206,6 +208,28 @@ export interface FoundCredential {
      * Whether the asset\'s own fingerprint backs up a mark that led here (C2PA 2.4 1.2.2.3).
      */
     fingerprintCheck: FingerprintCheck;
+    /**
+     * Whether the manifest\'s hard binding holds over the bytes this verify read.
+     */
+    hardBinding: HardBinding;
+}
+
+/**
+ * One ordered group of registry queries.
+ */
+export interface RecoveryStage {
+    /**
+     * Queries in declaration order. Their order is also the deterministic result priority.
+     */
+    queries: RecoveryQuery[];
+    /**
+     * Whether queries start one at a time or together.
+     */
+    execution: RecoveryExecution;
+    /**
+     * Whether this stage stops at its first successful query or retains every result.
+     */
+    completion: RecoveryCompletion;
 }
 
 /**
@@ -234,6 +258,16 @@ export interface InitValidation {
  */
 export type SegmentValidation = ({ kind: "init" } & InitValidation) | ({ kind: "media" } & MediaValidation) | { kind: "unknown" };
 
+/**
+ * Scheduling within a recovery stage.
+ */
+export type RecoveryExecution = "sequential" | "parallel";
+
+/**
+ * The condition that completes a recovery stage.
+ */
+export type RecoveryCompletion = "firstResult" | "allResults";
+
 /**
  * The error every SDK call throws: a decoded `google.rpc.Status`, discriminated
  * by `kind`. A consumer switches on `err.kind` (`\"reason\" | \"invalid\" | \"status\"`)
@@ -242,6 +276,11 @@ export type SegmentValidation = ({ kind: "init" } & InitValidation) | ({ kind: "
  */
 export type SdkError = ({ kind: "status" } & StatusError) | ({ kind: "reason" } & ReasonError) | ({ kind: "invalid" } & InvalidError);
 
+/**
+ * The registry work a verification call is allowed to perform.
+ */
+export type RecoveryPlan = { custom: { stages: RecoveryStage[] } };
+
 /**
  * Timing facts carried by a media segment\'s container.
  */
@@ -266,8 +305,7 @@ export interface SegmentTiming {
 export type RecoveryPolicy = "whenMissing" | "always";
 
 /**
- * Where the registry is, when to query it, and how far. One value rather than an endpoint beside
- * loose flags, so a policy cannot be configured on a verifier that has nowhere to apply it.
+ * Where the registry is and when to query it. Query reach and scheduling are selected per verify.
  */
 export interface RegistryOptions {
     /**
@@ -278,10 +316,6 @@ export interface RegistryOptions {
      * Defaults to [`RecoveryPolicy::WhenMissing`].
      */
     recovery?: RecoveryPolicy;
-    /**
-     * Defaults to [`RegistryQueries::DerivedThenContent`].
-     */
-    queries?: RegistryQueries;
 }
 
 /**
@@ -294,7 +328,7 @@ export type ValidationCodeKind = "success" | "informational" | "failure";
  * credential carries different evidence. Lane-local for the same reason [`FingerprintCheck`] is: a
  * tag layout is what `#[binding(wasm)]` declines to express.
  */
-export type CredentialOrigin = { kind: "embedded" } | { kind: "recoveredByFingerprint"; binding: SoftBinding; registryScore: number | undefined } | { kind: "recoveredByWatermark"; binding: SoftBinding; registryScore: number | undefined } | { kind: "recoveredByContent"; discoveries: ContentBindingEvidence[] };
+export type CredentialOrigin = { kind: "embedded" } | { kind: "recovered"; discoveries: RecoveryDiscovery[] };
 
 /**
  * [`crate::asset::FingerprintCheck`] as JS sees it: a tagged union, since `compared` carries a
@@ -303,19 +337,17 @@ export type CredentialOrigin = { kind: "embedded" } | { kind: "recoveredByFinger
  */
 export type FingerprintCheck = { kind: "notNeeded" } | { kind: "nothingToCompare" } | { kind: "unsupported"; algorithm: string } | { kind: "indeterminate" } | { kind: "compared"; score: number };
 
+/**
+ * [`crate::asset::HardBinding`] as JS sees it.
+ */
+export type HardBinding = "holds" | "mismatch";
+
 export interface AssetVerification {
     credentials: FoundCredential[];
     recovery: RecoverySummary;
     goldenComparison: GoldenComparison;
 }
 
-export interface ContentBindingEvidence {
-    algorithm: string;
-    class: ContentBindingClass;
-    hint: SoftBinding | undefined;
-    registryScore: number | undefined;
-}
-
 export interface RecoveryIssue {
     kind: RecoveryIssueKind;
     manifestId: string | undefined;
@@ -332,6 +364,8 @@ export type ContentBindingClass = "fingerprint" | "watermark";
 
 export type GoldenComparison = { kind: "notRequested" } | { kind: "noEmbeddedManifest" } | { kind: "noRecoveredManifest" } | { kind: "matches"; recoveredIndex: number } | { kind: "differs"; recoveredIndex: number } | { kind: "indeterminate"; recoveredIndex: number | undefined };
 
+export type RecoveryDiscovery = { method: "byBinding"; class: ContentBindingClass; binding: SoftBinding; binderIndex: number; registryScore: number | undefined } | { method: "byContent"; hint: SoftBinding | undefined; class: ContentBindingClass; algorithm: string; registryScore: number | undefined };
+
 export type RecoveryIssueKind = "binder" | "bindingQuery" | "queryRefused" | "contentQuery" | "capabilities" | "contentTooLarge" | "candidateFetch" | "candidateValidation" | "resourceLimit";
 
 export type RecoveryStatus = "notRequested" | "notFound" | "recovered" | "incomplete";
@@ -348,9 +382,7 @@ export class AssetVerifier {
      */
     static create(options: AssetVerifierOptions): AssetVerifier;
     /**
-     * Verify an asset against the configured trust anchors. `binders` compose
-     * soft-binding recovery after the embedded pass, tried in order,
-     * first hit wins; pass `[]` to proceed directly to registry `byContent` recovery.
+     * Verify an asset against the configured trust anchors and per-call recovery plan.
      *
      * Reads the C2PA-native formats. A container format (MXF) is plugin-backed, and plugins
      * are native, so a master is verified through the native SDK.
@@ -360,7 +392,7 @@ export class AssetVerifier {
      * Throws on a malformed `input`, a registry (or binder) failure, or a validation
      * failure.
      */
-    verify(input: RangeSource, binders: Binder[]): Promise<AssetVerification>;
+    verify(input: RangeSource, options: VerifyOptions): Promise<AssetVerification>;
 }
 
 /**
@@ -568,6 +600,15 @@ export class StreamVerifier {
     resume(stream_id: string, state: Uint8Array): StreamValidation;
 }
 
+/**
+ * Per-call soft-binding inputs. A plan is required when the verifier has a registry.
+ */
+export class VerifyOptions {
+    free(): void;
+    [Symbol.dispose](): void;
+    constructor(binders: Binder[], recovery_plan?: RecoveryPlan | null);
+}
+
 export function init_panic_hook(): void;
 
 /**
@@ -620,27 +661,16 @@ export type InitInput = RequestInfo | URL | Response | BufferSource | WebAssembl
 
 export interface InitOutput {
     readonly memory: WebAssembly.Memory;
-    readonly __wbg_streamvalidation_free: (a: number, b: number) => void;
-    readonly __wbg_streamverifier_free: (a: number, b: number) => void;
-    readonly parse: (a: number, b: number) => [number, number, number];
-    readonly resource: (a: number, b: number, c: number, d: number) => [number, number, number, number];
-    readonly streamvalidation_export: (a: number) => [number, number, number, number];
-    readonly streamvalidation_validate: (a: number, b: any) => any;
-    readonly streamverifier_create: (a: any) => [number, number, number];
-    readonly streamverifier_open: (a: number, b: number, c: number) => number;
-    readonly streamverifier_resume: (a: number, b: number, c: number, d: number, e: number) => [number, number, number];
-    readonly thumbnails: (a: number, b: number) => [number, number, number];
-    readonly C2PA_TRUST_LIST: () => [number, number];
-    readonly C2PA_TSA_TRUST_LIST: () => [number, number];
-    readonly DEV_CA: () => [number, number];
-    readonly init_panic_hook: () => void;
     readonly __wbg_assetverifier_free: (a: number, b: number) => void;
     readonly __wbg_binder_free: (a: number, b: number) => void;
     readonly __wbg_blobsource_free: (a: number, b: number) => void;
     readonly __wbg_bytessource_free: (a: number, b: number) => void;
     readonly __wbg_memorysource_free: (a: number, b: number) => void;
+    readonly __wbg_streamvalidation_free: (a: number, b: number) => void;
+    readonly __wbg_streamverifier_free: (a: number, b: number) => void;
+    readonly __wbg_verifyoptions_free: (a: number, b: number) => void;
     readonly assetverifier_create: (a: any) => [number, number, number];
-    readonly assetverifier_verify: (a: number, b: any, c: number, d: number) => any;
+    readonly assetverifier_verify: (a: number, b: any, c: number) => any;
     readonly binder_derive: (a: number, b: any, c: number, d: number) => any;
     readonly binder_held: (a: any) => [number, number, number];
     readonly binder_iscc: () => number;
@@ -653,6 +683,19 @@ export interface InitOutput {
     readonly memorysource_length: (a: number) => number;
     readonly memorysource_new: (a: number, b: number) => number;
     readonly memorysource_readAt: (a: number, b: number, c: number) => any;
+    readonly streamvalidation_export: (a: number) => [number, number, number, number];
+    readonly streamvalidation_validate: (a: number, b: any) => any;
+    readonly streamverifier_create: (a: any) => [number, number, number];
+    readonly streamverifier_open: (a: number, b: number, c: number) => number;
+    readonly streamverifier_resume: (a: number, b: number, c: number, d: number, e: number) => [number, number, number];
+    readonly verifyoptions_new: (a: number, b: number, c: number) => number;
+    readonly C2PA_TRUST_LIST: () => [number, number];
+    readonly C2PA_TSA_TRUST_LIST: () => [number, number];
+    readonly DEV_CA: () => [number, number];
+    readonly init_panic_hook: () => void;
+    readonly parse: (a: number, b: number) => [number, number, number];
+    readonly resource: (a: number, b: number, c: number, d: number) => [number, number, number, number];
+    readonly thumbnails: (a: number, b: number) => [number, number, number];
     readonly __wbg_intounderlyingbytesource_free: (a: number, b: number) => void;
     readonly intounderlyingbytesource_autoAllocateChunkSize: (a: number) => number;
     readonly intounderlyingbytesource_cancel: (a: number) => void;
@@ -666,10 +709,10 @@ export interface InitOutput {
     readonly intounderlyingsink_abort: (a: number, b: any) => any;
     readonly intounderlyingsink_close: (a: number) => any;
     readonly intounderlyingsink_write: (a: number, b: any) => any;
-    readonly wasm_bindgen__convert__closures_____invoke__h87666057de2caf05: (a: number, b: number, c: any) => [number, number];
-    readonly wasm_bindgen__convert__closures_____invoke__h427ac36a6c93c398: (a: number, b: number, c: any, d: any) => void;
-    readonly wasm_bindgen__convert__closures_____invoke__h57ac022b707ce0a7: (a: number, b: number, c: any) => void;
-    readonly wasm_bindgen__convert__closures_____invoke__hfcd26b19c01d430a: (a: number, b: number) => void;
+    readonly wasm_bindgen__convert__closures_____invoke__hfa954cb356c7e7e1: (a: number, b: number, c: any) => [number, number];
+    readonly wasm_bindgen__convert__closures_____invoke__h32a4f2e7671466cf: (a: number, b: number, c: any, d: any) => void;
+    readonly wasm_bindgen__convert__closures_____invoke__hedf60f9cb8ab20c3: (a: number, b: number, c: any) => void;
+    readonly wasm_bindgen__convert__closures_____invoke__hcc9f2329e90526d5: (a: number, b: number) => void;
     readonly __wbindgen_malloc: (a: number, b: number) => number;
     readonly __wbindgen_realloc: (a: number, b: number, c: number, d: number) => number;
     readonly __wbindgen_exn_store: (a: number) => void;

package/gen/wasm/trylimbo_sdk_verifier.js

@@ -32,9 +32,7 @@ export class AssetVerifier {
         return AssetVerifier.__wrap(ret[0]);
     }
     /**
-     * Verify an asset against the configured trust anchors. `binders` compose
-     * soft-binding recovery after the embedded pass, tried in order,
-     * first hit wins; pass `[]` to proceed directly to registry `byContent` recovery.
+     * Verify an asset against the configured trust anchors and per-call recovery plan.
      *
      * Reads the C2PA-native formats. A container format (MXF) is plugin-backed, and plugins
      * are native, so a master is verified through the native SDK.
@@ -44,13 +42,13 @@ export class AssetVerifier {
      * Throws on a malformed `input`, a registry (or binder) failure, or a validation
      * failure.
      * @param {RangeSource} input
-     * @param {Binder[]} binders
+     * @param {VerifyOptions} options
      * @returns {Promise<AssetVerification>}
      */
-    verify(input, binders) {
-        const ptr0 = passArrayJsValueToWasm0(binders, wasm.__wbindgen_malloc);
-        const len0 = WASM_VECTOR_LEN;
-        const ret = wasm.assetverifier_verify(this.__wbg_ptr, input, ptr0, len0);
+    verify(input, options) {
+        _assertClass(options, VerifyOptions);
+        var ptr0 = options.__destroy_into_raw();
+        const ret = wasm.assetverifier_verify(this.__wbg_ptr, input, ptr0);
         return ret;
     }
 }
@@ -591,6 +589,35 @@ export class StreamVerifier {
 }
 if (Symbol.dispose) StreamVerifier.prototype[Symbol.dispose] = StreamVerifier.prototype.free;
 
+/**
+ * Per-call soft-binding inputs. A plan is required when the verifier has a registry.
+ */
+export class VerifyOptions {
+    __destroy_into_raw() {
+        const ptr = this.__wbg_ptr;
+        this.__wbg_ptr = 0;
+        VerifyOptionsFinalization.unregister(this);
+        return ptr;
+    }
+    free() {
+        const ptr = this.__destroy_into_raw();
+        wasm.__wbg_verifyoptions_free(ptr, 0);
+    }
+    /**
+     * @param {Binder[]} binders
+     * @param {RecoveryPlan | null} [recovery_plan]
+     */
+    constructor(binders, recovery_plan) {
+        const ptr0 = passArrayJsValueToWasm0(binders, wasm.__wbindgen_malloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ret = wasm.verifyoptions_new(ptr0, len0, isLikeNone(recovery_plan) ? 0 : addToExternrefTable0(recovery_plan));
+        this.__wbg_ptr = ret;
+        VerifyOptionsFinalization.register(this, this.__wbg_ptr, this);
+        return this;
+    }
+}
+if (Symbol.dispose) VerifyOptions.prototype[Symbol.dispose] = VerifyOptions.prototype.free;
+
 export function init_panic_hook() {
     wasm.init_panic_hook();
 }
@@ -1051,7 +1078,7 @@ function __wbg_get_imports() {
                     const a = state0.a;
                     state0.a = 0;
                     try {
-                        return wasm_bindgen__convert__closures_____invoke__h427ac36a6c93c398(a, state0.b, arg0, arg1);
+                        return wasm_bindgen__convert__closures_____invoke__h32a4f2e7671466cf(a, state0.b, arg0, arg1);
                     } finally {
                         state0.a = a;
                     }
@@ -1242,18 +1269,18 @@ function __wbg_get_imports() {
             return isLikeNone(ret) ? 0 : addToExternrefTable0(ret);
         },
         __wbindgen_cast_0000000000000001: function(arg0, arg1) {
-            // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [Externref], shim_idx: 2053, ret: Result(Unit), inner_ret: Some(Result(Unit)) }, mutable: true }) -> Externref`.
-            const ret = makeMutClosure(arg0, arg1, wasm_bindgen__convert__closures_____invoke__h87666057de2caf05);
+            // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [Externref], shim_idx: 2054, ret: Result(Unit), inner_ret: Some(Result(Unit)) }, mutable: true }) -> Externref`.
+            const ret = makeMutClosure(arg0, arg1, wasm_bindgen__convert__closures_____invoke__hfa954cb356c7e7e1);
             return ret;
         },
         __wbindgen_cast_0000000000000002: function(arg0, arg1) {
-            // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [Externref], shim_idx: 3850, ret: Unit, inner_ret: Some(Unit) }, mutable: true }) -> Externref`.
-            const ret = makeMutClosure(arg0, arg1, wasm_bindgen__convert__closures_____invoke__h57ac022b707ce0a7);
+            // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [Externref], shim_idx: 3958, ret: Unit, inner_ret: Some(Unit) }, mutable: true }) -> Externref`.
+            const ret = makeMutClosure(arg0, arg1, wasm_bindgen__convert__closures_____invoke__hedf60f9cb8ab20c3);
             return ret;
         },
         __wbindgen_cast_0000000000000003: function(arg0, arg1) {
-            // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [], shim_idx: 2735, ret: Unit, inner_ret: Some(Unit) }, mutable: true }) -> Externref`.
-            const ret = makeMutClosure(arg0, arg1, wasm_bindgen__convert__closures_____invoke__hfcd26b19c01d430a);
+            // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [], shim_idx: 2728, ret: Unit, inner_ret: Some(Unit) }, mutable: true }) -> Externref`.
+            const ret = makeMutClosure(arg0, arg1, wasm_bindgen__convert__closures_____invoke__hcc9f2329e90526d5);
             return ret;
         },
         __wbindgen_cast_0000000000000004: function(arg0) {
@@ -1297,23 +1324,23 @@ function __wbg_get_imports() {
     };
 }
 
-function wasm_bindgen__convert__closures_____invoke__hfcd26b19c01d430a(arg0, arg1) {
-    wasm.wasm_bindgen__convert__closures_____invoke__hfcd26b19c01d430a(arg0, arg1);
+function wasm_bindgen__convert__closures_____invoke__hcc9f2329e90526d5(arg0, arg1) {
+    wasm.wasm_bindgen__convert__closures_____invoke__hcc9f2329e90526d5(arg0, arg1);
 }
 
-function wasm_bindgen__convert__closures_____invoke__h57ac022b707ce0a7(arg0, arg1, arg2) {
-    wasm.wasm_bindgen__convert__closures_____invoke__h57ac022b707ce0a7(arg0, arg1, arg2);
+function wasm_bindgen__convert__closures_____invoke__hedf60f9cb8ab20c3(arg0, arg1, arg2) {
+    wasm.wasm_bindgen__convert__closures_____invoke__hedf60f9cb8ab20c3(arg0, arg1, arg2);
 }
 
-function wasm_bindgen__convert__closures_____invoke__h87666057de2caf05(arg0, arg1, arg2) {
-    const ret = wasm.wasm_bindgen__convert__closures_____invoke__h87666057de2caf05(arg0, arg1, arg2);
+function wasm_bindgen__convert__closures_____invoke__hfa954cb356c7e7e1(arg0, arg1, arg2) {
+    const ret = wasm.wasm_bindgen__convert__closures_____invoke__hfa954cb356c7e7e1(arg0, arg1, arg2);
     if (ret[1]) {
         throw takeFromExternrefTable0(ret[0]);
     }
 }
 
-function wasm_bindgen__convert__closures_____invoke__h427ac36a6c93c398(arg0, arg1, arg2, arg3) {
-    wasm.wasm_bindgen__convert__closures_____invoke__h427ac36a6c93c398(arg0, arg1, arg2, arg3);
+function wasm_bindgen__convert__closures_____invoke__h32a4f2e7671466cf(arg0, arg1, arg2, arg3) {
+    wasm.wasm_bindgen__convert__closures_____invoke__h32a4f2e7671466cf(arg0, arg1, arg2, arg3);
 }
 
 
@@ -1357,6 +1384,9 @@ const StreamValidationFinalization = (typeof FinalizationRegistry === 'undefined
 const StreamVerifierFinalization = (typeof FinalizationRegistry === 'undefined')
     ? { register: () => {}, unregister: () => {} }
     : new FinalizationRegistry(ptr => wasm.__wbg_streamverifier_free(ptr, 1));
+const VerifyOptionsFinalization = (typeof FinalizationRegistry === 'undefined')
+    ? { register: () => {}, unregister: () => {} }
+    : new FinalizationRegistry(ptr => wasm.__wbg_verifyoptions_free(ptr, 1));
 
 function addToExternrefTable0(obj) {
     const idx = wasm.__externref_table_alloc();
@@ -1364,6 +1394,12 @@ function addToExternrefTable0(obj) {
     return idx;
 }
 
+function _assertClass(instance, klass) {
+    if (!(instance instanceof klass)) {
+        throw new Error(`expected instance of ${klass.name}`);
+    }
+}
+
 const CLOSURE_DTORS = (typeof FinalizationRegistry === 'undefined')
     ? { register: () => {}, unregister: () => {} }
     : new FinalizationRegistry(state => wasm.__wbindgen_destroy_closure(state.a, state.b));

package/gen/wasm/trylimbo_sdk_verifier_bg.wasm.d.ts

@@ -1,27 +1,16 @@
 /* tslint:disable */
 /* eslint-disable */
 export const memory: WebAssembly.Memory;
-export const __wbg_streamvalidation_free: (a: number, b: number) => void;
-export const __wbg_streamverifier_free: (a: number, b: number) => void;
-export const parse: (a: number, b: number) => [number, number, number];
-export const resource: (a: number, b: number, c: number, d: number) => [number, number, number, number];
-export const streamvalidation_export: (a: number) => [number, number, number, number];
-export const streamvalidation_validate: (a: number, b: any) => any;
-export const streamverifier_create: (a: any) => [number, number, number];
-export const streamverifier_open: (a: number, b: number, c: number) => number;
-export const streamverifier_resume: (a: number, b: number, c: number, d: number, e: number) => [number, number, number];
-export const thumbnails: (a: number, b: number) => [number, number, number];
-export const C2PA_TRUST_LIST: () => [number, number];
-export const C2PA_TSA_TRUST_LIST: () => [number, number];
-export const DEV_CA: () => [number, number];
-export const init_panic_hook: () => void;
 export const __wbg_assetverifier_free: (a: number, b: number) => void;
 export const __wbg_binder_free: (a: number, b: number) => void;
 export const __wbg_blobsource_free: (a: number, b: number) => void;
 export const __wbg_bytessource_free: (a: number, b: number) => void;
 export const __wbg_memorysource_free: (a: number, b: number) => void;
+export const __wbg_streamvalidation_free: (a: number, b: number) => void;
+export const __wbg_streamverifier_free: (a: number, b: number) => void;
+export const __wbg_verifyoptions_free: (a: number, b: number) => void;
 export const assetverifier_create: (a: any) => [number, number, number];
-export const assetverifier_verify: (a: number, b: any, c: number, d: number) => any;
+export const assetverifier_verify: (a: number, b: any, c: number) => any;
 export const binder_derive: (a: number, b: any, c: number, d: number) => any;
 export const binder_held: (a: any) => [number, number, number];
 export const binder_iscc: () => number;
@@ -34,6 +23,19 @@ export const bytessource_readAt: (a: number, b: number, c: number) => any;
 export const memorysource_length: (a: number) => number;
 export const memorysource_new: (a: number, b: number) => number;
 export const memorysource_readAt: (a: number, b: number, c: number) => any;
+export const streamvalidation_export: (a: number) => [number, number, number, number];
+export const streamvalidation_validate: (a: number, b: any) => any;
+export const streamverifier_create: (a: any) => [number, number, number];
+export const streamverifier_open: (a: number, b: number, c: number) => number;
+export const streamverifier_resume: (a: number, b: number, c: number, d: number, e: number) => [number, number, number];
+export const verifyoptions_new: (a: number, b: number, c: number) => number;
+export const C2PA_TRUST_LIST: () => [number, number];
+export const C2PA_TSA_TRUST_LIST: () => [number, number];
+export const DEV_CA: () => [number, number];
+export const init_panic_hook: () => void;
+export const parse: (a: number, b: number) => [number, number, number];
+export const resource: (a: number, b: number, c: number, d: number) => [number, number, number, number];
+export const thumbnails: (a: number, b: number) => [number, number, number];
 export const __wbg_intounderlyingbytesource_free: (a: number, b: number) => void;
 export const intounderlyingbytesource_autoAllocateChunkSize: (a: number) => number;
 export const intounderlyingbytesource_cancel: (a: number) => void;
@@ -47,10 +49,10 @@ export const __wbg_intounderlyingsink_free: (a: number, b: number) => void;
 export const intounderlyingsink_abort: (a: number, b: any) => any;
 export const intounderlyingsink_close: (a: number) => any;
 export const intounderlyingsink_write: (a: number, b: any) => any;
-export const wasm_bindgen__convert__closures_____invoke__h87666057de2caf05: (a: number, b: number, c: any) => [number, number];
-export const wasm_bindgen__convert__closures_____invoke__h427ac36a6c93c398: (a: number, b: number, c: any, d: any) => void;
-export const wasm_bindgen__convert__closures_____invoke__h57ac022b707ce0a7: (a: number, b: number, c: any) => void;
-export const wasm_bindgen__convert__closures_____invoke__hfcd26b19c01d430a: (a: number, b: number) => void;
+export const wasm_bindgen__convert__closures_____invoke__hfa954cb356c7e7e1: (a: number, b: number, c: any) => [number, number];
+export const wasm_bindgen__convert__closures_____invoke__h32a4f2e7671466cf: (a: number, b: number, c: any, d: any) => void;
+export const wasm_bindgen__convert__closures_____invoke__hedf60f9cb8ab20c3: (a: number, b: number, c: any) => void;
+export const wasm_bindgen__convert__closures_____invoke__hcc9f2329e90526d5: (a: number, b: number) => void;
 export const __wbindgen_malloc: (a: number, b: number) => number;
 export const __wbindgen_realloc: (a: number, b: number, c: number, d: number) => number;
 export const __wbindgen_exn_store: (a: number) => void;

package/gen/wasm/worker-thread.js

@@ -30,9 +30,7 @@ var AssetVerifier = class AssetVerifier {
 		return AssetVerifier.__wrap(ret[0]);
 	}
 	/**
-	* Verify an asset against the configured trust anchors. `binders` compose
-	* soft-binding recovery after the embedded pass, tried in order,
-	* first hit wins; pass `[]` to proceed directly to registry `byContent` recovery.
+	* Verify an asset against the configured trust anchors and per-call recovery plan.
 	*
 	* Reads the C2PA-native formats. A container format (MXF) is plugin-backed, and plugins
 	* are native, so a master is verified through the native SDK.
@@ -42,13 +40,13 @@ var AssetVerifier = class AssetVerifier {
 	* Throws on a malformed `input`, a registry (or binder) failure, or a validation
 	* failure.
 	* @param {RangeSource} input
-	* @param {Binder[]} binders
+	* @param {VerifyOptions} options
 	* @returns {Promise<AssetVerification>}
 	*/
-	verify(input, binders) {
-		const ptr0 = passArrayJsValueToWasm0(binders, wasm.__wbindgen_malloc);
-		const len0 = WASM_VECTOR_LEN;
-		return wasm.assetverifier_verify(this.__wbg_ptr, input, ptr0, len0);
+	verify(input, options) {
+		_assertClass(options, VerifyOptions);
+		var ptr0 = options.__destroy_into_raw();
+		return wasm.assetverifier_verify(this.__wbg_ptr, input, ptr0);
 	}
 };
 if (Symbol.dispose) AssetVerifier.prototype[Symbol.dispose] = AssetVerifier.prototype.free;
@@ -549,6 +547,34 @@ var StreamVerifier = class StreamVerifier {
 };
 if (Symbol.dispose) StreamVerifier.prototype[Symbol.dispose] = StreamVerifier.prototype.free;
 /**
+* Per-call soft-binding inputs. A plan is required when the verifier has a registry.
+*/
+var VerifyOptions = class {
+	__destroy_into_raw() {
+		const ptr = this.__wbg_ptr;
+		this.__wbg_ptr = 0;
+		VerifyOptionsFinalization.unregister(this);
+		return ptr;
+	}
+	free() {
+		const ptr = this.__destroy_into_raw();
+		wasm.__wbg_verifyoptions_free(ptr, 0);
+	}
+	/**
+	* @param {Binder[]} binders
+	* @param {RecoveryPlan | null} [recovery_plan]
+	*/
+	constructor(binders, recovery_plan) {
+		const ptr0 = passArrayJsValueToWasm0(binders, wasm.__wbindgen_malloc);
+		const len0 = WASM_VECTOR_LEN;
+		const ret = wasm.verifyoptions_new(ptr0, len0, isLikeNone(recovery_plan) ? 0 : addToExternrefTable0(recovery_plan));
+		this.__wbg_ptr = ret;
+		VerifyOptionsFinalization.register(this, this.__wbg_ptr, this);
+		return this;
+	}
+};
+if (Symbol.dispose) VerifyOptions.prototype[Symbol.dispose] = VerifyOptions.prototype.free;
+/**
 * Parse a detached C2PA manifest store: a `.c2pa` sidecar, or the bytes a registry serves for a
 * manifest id.
 *
@@ -974,7 +1000,7 @@ function __wbg_get_imports() {
 						const a = state0.a;
 						state0.a = 0;
 						try {
-							return wasm_bindgen__convert__closures_____invoke__h427ac36a6c93c398(a, state0.b, arg0, arg1);
+							return wasm_bindgen__convert__closures_____invoke__h32a4f2e7671466cf(a, state0.b, arg0, arg1);
 						} finally {
 							state0.a = a;
 						}
@@ -1157,13 +1183,13 @@ function __wbg_get_imports() {
 				return isLikeNone(ret) ? 0 : addToExternrefTable0(ret);
 			},
 			__wbindgen_cast_0000000000000001: function(arg0, arg1) {
-				return makeMutClosure(arg0, arg1, wasm_bindgen__convert__closures_____invoke__h87666057de2caf05);
+				return makeMutClosure(arg0, arg1, wasm_bindgen__convert__closures_____invoke__hfa954cb356c7e7e1);
 			},
 			__wbindgen_cast_0000000000000002: function(arg0, arg1) {
-				return makeMutClosure(arg0, arg1, wasm_bindgen__convert__closures_____invoke__h57ac022b707ce0a7);
+				return makeMutClosure(arg0, arg1, wasm_bindgen__convert__closures_____invoke__hedf60f9cb8ab20c3);
 			},
 			__wbindgen_cast_0000000000000003: function(arg0, arg1) {
-				return makeMutClosure(arg0, arg1, wasm_bindgen__convert__closures_____invoke__hfcd26b19c01d430a);
+				return makeMutClosure(arg0, arg1, wasm_bindgen__convert__closures_____invoke__hcc9f2329e90526d5);
 			},
 			__wbindgen_cast_0000000000000004: function(arg0) {
 				return arg0;
@@ -1192,18 +1218,18 @@ function __wbg_get_imports() {
 		}
 	};
 }
-function wasm_bindgen__convert__closures_____invoke__hfcd26b19c01d430a(arg0, arg1) {
-	wasm.wasm_bindgen__convert__closures_____invoke__hfcd26b19c01d430a(arg0, arg1);
+function wasm_bindgen__convert__closures_____invoke__hcc9f2329e90526d5(arg0, arg1) {
+	wasm.wasm_bindgen__convert__closures_____invoke__hcc9f2329e90526d5(arg0, arg1);
 }
-function wasm_bindgen__convert__closures_____invoke__h57ac022b707ce0a7(arg0, arg1, arg2) {
-	wasm.wasm_bindgen__convert__closures_____invoke__h57ac022b707ce0a7(arg0, arg1, arg2);
+function wasm_bindgen__convert__closures_____invoke__hedf60f9cb8ab20c3(arg0, arg1, arg2) {
+	wasm.wasm_bindgen__convert__closures_____invoke__hedf60f9cb8ab20c3(arg0, arg1, arg2);
 }
-function wasm_bindgen__convert__closures_____invoke__h87666057de2caf05(arg0, arg1, arg2) {
-	const ret = wasm.wasm_bindgen__convert__closures_____invoke__h87666057de2caf05(arg0, arg1, arg2);
+function wasm_bindgen__convert__closures_____invoke__hfa954cb356c7e7e1(arg0, arg1, arg2) {
+	const ret = wasm.wasm_bindgen__convert__closures_____invoke__hfa954cb356c7e7e1(arg0, arg1, arg2);
 	if (ret[1]) throw takeFromExternrefTable0(ret[0]);
 }
-function wasm_bindgen__convert__closures_____invoke__h427ac36a6c93c398(arg0, arg1, arg2, arg3) {
-	wasm.wasm_bindgen__convert__closures_____invoke__h427ac36a6c93c398(arg0, arg1, arg2, arg3);
+function wasm_bindgen__convert__closures_____invoke__h32a4f2e7671466cf(arg0, arg1, arg2, arg3) {
+	wasm.wasm_bindgen__convert__closures_____invoke__h32a4f2e7671466cf(arg0, arg1, arg2, arg3);
 }
 const __wbindgen_enum_ReadableStreamType = ["bytes"];
 const __wbindgen_enum_RequestCache = [
@@ -1265,11 +1291,18 @@ const StreamVerifierFinalization = typeof FinalizationRegistry === "undefined" ?
 	register: () => {},
 	unregister: () => {}
 } : new FinalizationRegistry((ptr) => wasm.__wbg_streamverifier_free(ptr, 1));
+const VerifyOptionsFinalization = typeof FinalizationRegistry === "undefined" ? {
+	register: () => {},
+	unregister: () => {}
+} : new FinalizationRegistry((ptr) => wasm.__wbg_verifyoptions_free(ptr, 1));
 function addToExternrefTable0(obj) {
 	const idx = wasm.__externref_table_alloc();
 	wasm.__wbindgen_externrefs.set(idx, obj);
 	return idx;
 }
+function _assertClass(instance, klass) {
+	if (!(instance instanceof klass)) throw new Error(`expected instance of ${klass.name}`);
+}
 const CLOSURE_DTORS = typeof FinalizationRegistry === "undefined" ? {
 	register: () => {},
 	unregister: () => {}
@@ -1533,8 +1566,8 @@ var Handle = class {
 	}
 };
 var AssetVerifierHandle = class extends Handle {
-	verify(asset, binders = []) {
-		return this.inner.verify(source(asset), binders.map(binder));
+	verify(asset, options = {}) {
+		return this.inner.verify(source(asset), new VerifyOptions((options.binders ?? []).map(binder), options.recoveryPlan));
 	}
 };
 /** One stream being validated. Dropping the handle releases the session it accumulated. */

package/gen/wasm/worker.d.ts

@@ -194,6 +194,19 @@ interface SessionKeySummary {
    */
   publicKey: Uint8Array;
 }
+/**
+ * A single C2PA Soft Binding Resolution API lookup.
+ */
+type RecoveryQuery = {
+  byBinding: {
+    binderIndex: number;
+  };
+} | {
+  byContent: {
+    algorithm: ContentAlgorithm;
+    hintBinderIndex?: number;
+  };
+};
 /**
  * C2PA validation state of a manifest (spec §14.3).
  */
@@ -261,12 +274,13 @@ interface StreamVerifierOptions {
   segmentSkewToleranceSecs?: number;
 }
 /**
- * How far a recovery may go, which decides what leaves the caller.
- *
- * Separate from [`RecoveryPolicy`], which decides *when* a recovery runs: one names the trigger
- * and the other the reach, and crossing them is what the two enums exist to keep legible.
+ * How a `byContent` query selects the registry\'s detector algorithms.
  */
-type RegistryQueries = "derived" | "derivedThenContent";
+type ContentAlgorithm = "fingerprint" | "watermark" | "all" | {
+  named: {
+    algorithm: string;
+  };
+};
 /**
  * One C2PA validation status entry (spec §15.3).
  */
@@ -278,8 +292,8 @@ interface ValidationCode {
   kind: ValidationCodeKind;
 }
 /**
- * One `verify` credential: the c2pa `ManifestStore`, where it came from, and whether the
- * asset\'s own fingerprint backs it up.
+ * One `verify` credential: the c2pa `ManifestStore`, where it came from, whether the asset\'s
+ * own fingerprint backs it up, and whether its hard binding holds over the bytes read.
  */
 interface FoundCredential {
   /**
@@ -297,6 +311,27 @@ interface FoundCredential {
    * Whether the asset\'s own fingerprint backs up a mark that led here (C2PA 2.4 1.2.2.3).
    */
   fingerprintCheck: FingerprintCheck;
+  /**
+   * Whether the manifest\'s hard binding holds over the bytes this verify read.
+   */
+  hardBinding: HardBinding;
+}
+/**
+ * One ordered group of registry queries.
+ */
+interface RecoveryStage {
+  /**
+   * Queries in declaration order. Their order is also the deterministic result priority.
+   */
+  queries: RecoveryQuery[];
+  /**
+   * Whether queries start one at a time or together.
+   */
+  execution: RecoveryExecution;
+  /**
+   * Whether this stage stops at its first successful query or retains every result.
+   */
+  completion: RecoveryCompletion;
 }
 /**
  * Outcome of validating a media segment against its stream\'s init.
@@ -327,6 +362,22 @@ type SegmentValidation = ({
 } & MediaValidation) | {
   kind: "unknown";
 };
+/**
+ * Scheduling within a recovery stage.
+ */
+type RecoveryExecution = "sequential" | "parallel";
+/**
+ * The condition that completes a recovery stage.
+ */
+type RecoveryCompletion = "firstResult" | "allResults";
+/**
+ * The registry work a verification call is allowed to perform.
+ */
+type RecoveryPlan = {
+  custom: {
+    stages: RecoveryStage[];
+  };
+};
 /**
  * Timing facts carried by a media segment\'s container.
  */
@@ -349,8 +400,7 @@ interface SegmentTiming {
  */
 type RecoveryPolicy = "whenMissing" | "always";
 /**
- * Where the registry is, when to query it, and how far. One value rather than an endpoint beside
- * loose flags, so a policy cannot be configured on a verifier that has nowhere to apply it.
+ * Where the registry is and when to query it. Query reach and scheduling are selected per verify.
  */
 interface RegistryOptions {
   /**
@@ -361,10 +411,6 @@ interface RegistryOptions {
    * Defaults to [`RecoveryPolicy::WhenMissing`].
    */
   recovery?: RecoveryPolicy;
-  /**
-   * Defaults to [`RegistryQueries::DerivedThenContent`].
-   */
-  queries?: RegistryQueries;
 }
 /**
  * Whether a code is a success, an informational note, or a failure.
@@ -378,16 +424,8 @@ type ValidationCodeKind = "success" | "informational" | "failure";
 type CredentialOrigin = {
   kind: "embedded";
 } | {
-  kind: "recoveredByFingerprint";
-  binding: SoftBinding;
-  registryScore: number | undefined;
-} | {
-  kind: "recoveredByWatermark";
-  binding: SoftBinding;
-  registryScore: number | undefined;
-} | {
-  kind: "recoveredByContent";
-  discoveries: ContentBindingEvidence[];
+  kind: "recovered";
+  discoveries: RecoveryDiscovery[];
 };
 /**
  * [`crate::asset::FingerprintCheck`] as JS sees it: a tagged union, since `compared` carries a
@@ -407,17 +445,15 @@ type FingerprintCheck = {
   kind: "compared";
   score: number;
 };
+/**
+ * [`crate::asset::HardBinding`] as JS sees it.
+ */
+type HardBinding = "holds" | "mismatch";
 interface AssetVerification {
   credentials: FoundCredential[];
   recovery: RecoverySummary;
   goldenComparison: GoldenComparison;
 }
-interface ContentBindingEvidence {
-  algorithm: string;
-  class: ContentBindingClass;
-  hint: SoftBinding | undefined;
-  registryScore: number | undefined;
-}
 interface RecoveryIssue {
   kind: RecoveryIssueKind;
   manifestId: string | undefined;
@@ -445,6 +481,19 @@ type GoldenComparison = {
   kind: "indeterminate";
   recoveredIndex: number | undefined;
 };
+type RecoveryDiscovery = {
+  method: "byBinding";
+  class: ContentBindingClass;
+  binding: SoftBinding;
+  binderIndex: number;
+  registryScore: number | undefined;
+} | {
+  method: "byContent";
+  hint: SoftBinding | undefined;
+  class: ContentBindingClass;
+  algorithm: string;
+  registryScore: number | undefined;
+};
 type RecoveryIssueKind = "binder" | "bindingQuery" | "queryRefused" | "contentQuery" | "capabilities" | "contentTooLarge" | "candidateFetch" | "candidateValidation" | "resourceLimit";
 type RecoveryStatus = "notRequested" | "notFound" | "recovered" | "incomplete";
 declare class AssetVerifier {
@@ -458,9 +507,7 @@ declare class AssetVerifier {
    */
   static create(options: AssetVerifierOptions): AssetVerifier;
   /**
-   * Verify an asset against the configured trust anchors. `binders` compose
-   * soft-binding recovery after the embedded pass, tried in order,
-   * first hit wins; pass `[]` to proceed directly to registry `byContent` recovery.
+   * Verify an asset against the configured trust anchors and per-call recovery plan.
    *
    * Reads the C2PA-native formats. A container format (MXF) is plugin-backed, and plugins
    * are native, so a master is verified through the native SDK.
@@ -470,7 +517,7 @@ declare class AssetVerifier {
    * Throws on a malformed `input`, a registry (or binder) failure, or a validation
    * failure.
    */
-  verify(input: RangeSource, binders: Binder[]): Promise<AssetVerification>;
+  verify(input: RangeSource, options: VerifyOptions): Promise<AssetVerification>;
 }
 /**
  * A soft-binding binder a client runs itself. Build with `Binder.iscc()` or
@@ -569,6 +616,14 @@ declare class StreamVerifier {
    */
   resume(stream_id: string, state: Uint8Array): StreamValidation;
 }
+/**
+ * Per-call soft-binding inputs. A plan is required when the verifier has a registry.
+ */
+declare class VerifyOptions {
+  free(): void;
+  [Symbol.dispose](): void;
+  constructor(binders: Binder[], recovery_plan?: RecoveryPlan | null);
+}
 //#endregion
 //#region src/worker-thread.d.ts
 /**
@@ -587,6 +642,10 @@ type BinderSpec = {
   readonly kind: "held";
   readonly binding: SoftBinding;
 };
+interface AssetVerifyOptions {
+  readonly binders?: readonly BinderSpec[];
+  readonly recoveryPlan?: RecoveryPlan;
+}
 /**
  * A wasm object held in this thread on the caller's behalf.
  *
@@ -606,7 +665,7 @@ declare abstract class Handle<T extends {
   [finalizer](): void;
 }
 declare class AssetVerifierHandle extends Handle<AssetVerifier> {
-  verify(asset: Asset, binders?: readonly BinderSpec[]): Promise<AssetVerification>;
+  verify(asset: Asset, options?: AssetVerifyOptions): Promise<AssetVerification>;
 }
 /** One stream being validated. Dropping the handle releases the session it accumulated. */
 declare class StreamValidationHandle extends Handle<StreamValidation> {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trylimbo/sdk-verifier-wasm",
-  "version": "0.2.10",
+  "version": "0.2.11-canary.13",
   "license": "UNLICENSED",
   "repository": {
     "type": "git",
@@ -40,5 +40,6 @@
   "devDependencies": {
     "comlink": "4.4.2",
     "typescript": "^7.0.2"
-  }
+  },
+  "stableVersion": "0.2.10"
 }