@trylimbo/sdk-verifier-wasm 0.2.11-canary.16 → 0.2.11-canary.19

package/gen/wasm/trylimbo_sdk_verifier.d.ts

@@ -81,11 +81,6 @@ export interface SessionKeySummary {
     publicKey: Uint8Array;
 }
 
-/**
- * A single C2PA Soft Binding Resolution API lookup.
- */
-export type RecoveryQuery = { byBinding: { binderIndex: number } } | { byContent: { algorithm: ContentAlgorithm; hintBinderIndex?: number } };
-
 /**
  * A status with no structured detail (`kind: \"status\"`).
  */
@@ -163,11 +158,6 @@ export interface StreamVerifierOptions {
     segmentSkewToleranceSecs?: number;
 }
 
-/**
- * How a `byContent` query selects the registry\'s detector algorithms.
- */
-export type ContentAlgorithm = "fingerprint" | "watermark" | "all" | { named: { algorithm: string } };
-
 /**
  * One C2PA validation status entry (spec §15.3).
  */
@@ -188,6 +178,32 @@ export interface FieldViolation {
     reason: string;
 }
 
+/**
+ * One `matches/byContent` upload per selected detector.
+ */
+export interface ByContent {
+    after: ContentTrigger;
+    detectors: Detectors;
+}
+
+/**
+ * One `matches/byReference` query per selected detector. The registry downloads the asset
+ * from `url`, so the client reads no bytes for it.
+ */
+export interface ByReference {
+    after: ContentTrigger;
+    detectors: Detectors;
+    /**
+     * A short-lived https URL without credentials.
+     */
+    url: string;
+    /**
+     * The asset\'s size in bytes, which caps the registry\'s download.
+     */
+    length: number;
+    mediaType?: string;
+}
+
 /**
  * One `verify` credential: the c2pa `ManifestStore`, where it came from, whether the asset\'s
  * own fingerprint backs it up, and whether its hard binding holds over the bytes read.
@@ -212,24 +228,10 @@ export interface FoundCredential {
      * Whether the manifest\'s hard binding holds over the bytes this verify read.
      */
     hardBinding: HardBinding;
-}
-
-/**
- * One ordered group of registry queries.
- */
-export interface RecoveryStage {
-    /**
-     * Queries in declaration order. Their order is also the deterministic result priority.
-     */
-    queries: RecoveryQuery[];
-    /**
-     * Whether queries start one at a time or together.
-     */
-    execution: RecoveryExecution;
     /**
-     * Whether this stage stops at its first successful query or retains every result.
+     * Where this credential sits among the others returned. See [`crate::asset::Lineage`].
      */
-    completion: RecoveryCompletion;
+    lineage: Lineage;
 }
 
 /**
@@ -258,16 +260,6 @@ export interface InitValidation {
  */
 export type SegmentValidation = ({ kind: "init" } & InitValidation) | ({ kind: "media" } & MediaValidation) | { kind: "unknown" };
 
-/**
- * Scheduling within a recovery stage.
- */
-export type RecoveryExecution = "sequential" | "parallel";
-
-/**
- * The condition that completes a recovery stage.
- */
-export type RecoveryCompletion = "firstResult" | "allResults";
-
 /**
  * The error every SDK call throws: a decoded `google.rpc.Status`, discriminated
  * by `kind`. A consumer switches on `err.kind` (`\"reason\" | \"invalid\" | \"status\"`)
@@ -276,11 +268,6 @@ export type RecoveryCompletion = "firstResult" | "allResults";
  */
 export type SdkError = ({ kind: "status" } & StatusError) | ({ kind: "reason" } & ReasonError) | ({ kind: "invalid" } & InvalidError);
 
-/**
- * The registry work a verification call is allowed to perform.
- */
-export type RecoveryPlan = { custom: { stages: RecoveryStage[] } };
-
 /**
  * Timing facts carried by a media segment\'s container.
  */
@@ -299,13 +286,38 @@ export interface SegmentTiming {
     eventDurationSecs?: number;
 }
 
+/**
+ * What one verify may do with the registry. Required whenever a registry is configured.
+ *
+ * One field per Soft Binding Resolution API operation, and an absent one is not called.
+ * `matches/byBinding` is decided by the binders handed to the verify: each is derived and looked
+ * up, all together, and every result is kept. The content forms run after that, each for the
+ * detectors it names, hinted with the first fingerprint the binders derived. Results merge by
+ * manifest; nothing is ranked or dropped.
+ */
+export interface Recovery {
+    /**
+     * When the registry is consulted at all.
+     */
+    when: RecoveryPolicy;
+    /**
+     * `matches/byContent`: the bounded asset bytes travel in the request.
+     */
+    byContent?: ByContent;
+    /**
+     * `matches/byReference`: the registry fetches the asset from the caller\'s URL instead, for
+     * an asset above the upload cap.
+     */
+    byReference?: ByReference;
+}
+
 /**
  * When [`AssetVerifier::verify_asset`] queries the registry.
  */
 export type RecoveryPolicy = "whenMissing" | "always";
 
 /**
- * Where the registry is and when to query it. Query reach and scheduling are selected per verify.
+ * Where the registry is. What a verify may do with it is per call, in [`Recovery`].
  */
 export interface RegistryOptions {
     /**
@@ -313,9 +325,12 @@ export interface RegistryOptions {
      */
     url: string;
     /**
-     * Defaults to [`RecoveryPolicy::WhenMissing`].
+     * Federated resolution APIs a match may name as holding its manifest, beside the ones the
+     * C2PA algorithm list publishes, which are always allowed. C2PA 2.4 lets a match carry an
+     * `endpoint`; one allowed is fetched from, any other is reported as refused. Checked like
+     * `url`: https, or http on loopback only.
      */
-    recovery?: RecoveryPolicy;
+    endpoints?: string[];
 }
 
 /**
@@ -323,6 +338,17 @@ export interface RegistryOptions {
  */
 export type ValidationCodeKind = "success" | "informational" | "failure";
 
+/**
+ * Whether a content form runs on this verify. Judged against the byBinding results alone.
+ */
+export type ContentTrigger = "byBindingMisses" | "always";
+
+/**
+ * Which advertised server-side detectors a content form runs. Every selected detector runs,
+ * including one a local binder already queried by binding.
+ */
+export type Detectors = { kind: "fingerprint" } | { kind: "watermark" } | { kind: "all" } | { kind: "named"; algorithms: string[] };
+
 /**
  * [`crate::asset::CredentialOrigin`] as JS sees it: a tagged union, since each way of finding a
  * credential carries different evidence. Lane-local for the same reason [`FingerprintCheck`] is: a
@@ -342,31 +368,46 @@ export type FingerprintCheck = { kind: "notNeeded" } | { kind: "nothingToCompare
  */
 export type HardBinding = "holds" | "mismatch";
 
+/**
+ * [`crate::asset::Lineage`] as JS sees it.
+ */
+export interface Lineage {
+    supersedes: string[];
+    supersededBy: string[];
+}
+
+/**
+ * [`crate::asset::RecoveryIssue`] as JS sees it: a tagged union, each kind with its own data.
+ */
+export type RecoveryIssue = { kind: "binder"; binderIndex: number; message: string } | { kind: "deprecatedAlgorithm"; algorithm: string } | { kind: "bindingQuery"; binderIndex: number; algorithm: string; message: string } | { kind: "queryRefused"; algorithm: string; message: string } | { kind: "contentForm"; message: string } | { kind: "contentQuery"; algorithm: string; message: string } | { kind: "capabilities"; message: string } | { kind: "contentTooLarge"; capBytes: number } | { kind: "candidateFetch"; manifestId: string; message: string } | { kind: "candidateValidation"; manifestId: string; reason: string } | { kind: "endpointRefused"; manifestId: string; endpoint: string } | { kind: "resourceLimit"; message: string };
+
+/**
+ * [`crate::asset::VerdictRule`] as JS sees it.
+ */
+export type VerdictRule = "onlyCandidate" | "notSuperseded" | "hardBinding";
+
+/**
+ * [`crate::asset::Verdict`] as JS sees it.
+ */
+export type Verdict = { kind: "unsigned" } | { kind: "inconclusive" } | { kind: "embedded" } | { kind: "recovered"; index: number; decidedBy: VerdictRule } | { kind: "recoveredDerivative"; index: number; decidedBy: VerdictRule } | { kind: "ambiguous"; candidates: number[] };
+
 export interface AssetVerification {
     credentials: FoundCredential[];
     recovery: RecoverySummary;
     goldenComparison: GoldenComparison;
-}
-
-export interface RecoveryIssue {
-    kind: RecoveryIssueKind;
-    manifestId: string | undefined;
-    message: string;
+    verdict: Verdict;
 }
 
 export interface RecoverySummary {
     status: RecoveryStatus;
-    bestCredentialIndex: number | undefined;
     issues: RecoveryIssue[];
 }
 
 export type ContentBindingClass = "fingerprint" | "watermark";
 
-export type GoldenComparison = { kind: "notRequested" } | { kind: "noEmbeddedManifest" } | { kind: "noRecoveredManifest" } | { kind: "matches"; recoveredIndex: number } | { kind: "differs"; recoveredIndex: number } | { kind: "indeterminate"; recoveredIndex: number | undefined };
-
-export type RecoveryDiscovery = { method: "byBinding"; class: ContentBindingClass; binding: SoftBinding; binderIndex: number; registryScore: number | undefined } | { method: "byContent"; hint: SoftBinding | undefined; class: ContentBindingClass; algorithm: string; registryScore: number | undefined };
+export type GoldenComparison = { kind: "notRequested" } | { kind: "noEmbeddedManifest" } | { kind: "noRecoveredManifest" } | { kind: "recoveryIncomplete" } | { kind: "matches"; recoveredIndex: number } | { kind: "differs"; recoveredIndex: number } | { kind: "noneMatches"; candidates: number[] } | { kind: "unreadable"; recoveredIndex: number };
 
-export type RecoveryIssueKind = "binder" | "bindingQuery" | "queryRefused" | "contentQuery" | "capabilities" | "contentTooLarge" | "candidateFetch" | "candidateValidation" | "resourceLimit";
+export type RecoveryDiscovery = { method: "byBinding"; class: ContentBindingClass; binding: SoftBinding; binderIndex: number; registryScore: number | undefined; endpoint: string | undefined } | { method: "byContent"; hint: SoftBinding | undefined; class: ContentBindingClass; algorithm: string; registryScore: number | undefined; endpoint: string | undefined } | { method: "byReference"; hint: SoftBinding | undefined; class: ContentBindingClass; algorithm: string; registryScore: number | undefined; endpoint: string | undefined };
 
 export type RecoveryStatus = "notRequested" | "notFound" | "recovered" | "incomplete";
 
@@ -382,7 +423,7 @@ export class AssetVerifier {
      */
     static create(options: AssetVerifierOptions): AssetVerifier;
     /**
-     * Verify an asset against the configured trust anchors and per-call recovery plan.
+     * Verify an asset against the configured trust anchors and per-call recovery options.
      *
      * Reads the C2PA-native formats. A container format (MXF) is plugin-backed, and plugins
      * are native, so a master is verified through the native SDK.
@@ -601,12 +642,12 @@ export class StreamVerifier {
 }
 
 /**
- * Per-call soft-binding inputs. A plan is required when the verifier has a registry.
+ * Per-call soft-binding inputs. `recovery` is required when the verifier has a registry.
  */
 export class VerifyOptions {
     free(): void;
     [Symbol.dispose](): void;
-    constructor(binders: Binder[], recovery_plan?: RecoveryPlan | null);
+    constructor(binders: Binder[], recovery?: Recovery | null);
 }
 
 export function init_panic_hook(): void;
@@ -662,18 +703,12 @@ export type InitInput = RequestInfo | URL | Response | BufferSource | WebAssembl
 export interface InitOutput {
     readonly memory: WebAssembly.Memory;
     readonly __wbg_assetverifier_free: (a: number, b: number) => void;
-    readonly __wbg_binder_free: (a: number, b: number) => void;
     readonly __wbg_blobsource_free: (a: number, b: number) => void;
     readonly __wbg_bytessource_free: (a: number, b: number) => void;
     readonly __wbg_memorysource_free: (a: number, b: number) => void;
-    readonly __wbg_streamvalidation_free: (a: number, b: number) => void;
-    readonly __wbg_streamverifier_free: (a: number, b: number) => void;
     readonly __wbg_verifyoptions_free: (a: number, b: number) => void;
     readonly assetverifier_create: (a: any) => [number, number, number];
     readonly assetverifier_verify: (a: number, b: any, c: number) => any;
-    readonly binder_derive: (a: number, b: any, c: number, d: number) => any;
-    readonly binder_held: (a: any) => [number, number, number];
-    readonly binder_iscc: () => number;
     readonly blobsource_length: (a: number) => number;
     readonly blobsource_new: (a: any) => [number, number, number];
     readonly blobsource_readAt: (a: number, b: number, c: number) => [number, number, number];
@@ -683,19 +718,25 @@ export interface InitOutput {
     readonly memorysource_length: (a: number) => number;
     readonly memorysource_new: (a: number, b: number) => number;
     readonly memorysource_readAt: (a: number, b: number, c: number) => any;
-    readonly streamvalidation_export: (a: number) => [number, number, number, number];
-    readonly streamvalidation_validate: (a: number, b: any) => any;
-    readonly streamverifier_create: (a: any) => [number, number, number];
-    readonly streamverifier_open: (a: number, b: number, c: number) => number;
-    readonly streamverifier_resume: (a: number, b: number, c: number, d: number, e: number) => [number, number, number];
+    readonly parse: (a: number, b: number) => [number, number, number];
+    readonly resource: (a: number, b: number, c: number, d: number) => [number, number, number, number];
+    readonly thumbnails: (a: number, b: number) => [number, number, number];
     readonly verifyoptions_new: (a: number, b: number, c: number) => number;
+    readonly __wbg_binder_free: (a: number, b: number) => void;
+    readonly binder_derive: (a: number, b: any, c: number, d: number) => any;
+    readonly binder_held: (a: any) => [number, number, number];
+    readonly binder_iscc: () => number;
     readonly C2PA_TRUST_LIST: () => [number, number];
     readonly C2PA_TSA_TRUST_LIST: () => [number, number];
     readonly DEV_CA: () => [number, number];
     readonly init_panic_hook: () => void;
-    readonly parse: (a: number, b: number) => [number, number, number];
-    readonly resource: (a: number, b: number, c: number, d: number) => [number, number, number, number];
-    readonly thumbnails: (a: number, b: number) => [number, number, number];
+    readonly __wbg_streamvalidation_free: (a: number, b: number) => void;
+    readonly __wbg_streamverifier_free: (a: number, b: number) => void;
+    readonly streamvalidation_export: (a: number) => [number, number, number, number];
+    readonly streamvalidation_validate: (a: number, b: any) => any;
+    readonly streamverifier_create: (a: any) => [number, number, number];
+    readonly streamverifier_open: (a: number, b: number, c: number) => number;
+    readonly streamverifier_resume: (a: number, b: number, c: number, d: number, e: number) => [number, number, number];
     readonly __wbg_intounderlyingbytesource_free: (a: number, b: number) => void;
     readonly intounderlyingbytesource_autoAllocateChunkSize: (a: number) => number;
     readonly intounderlyingbytesource_cancel: (a: number) => void;

package/gen/wasm/trylimbo_sdk_verifier.js

@@ -32,7 +32,7 @@ export class AssetVerifier {
         return AssetVerifier.__wrap(ret[0]);
     }
     /**
-     * Verify an asset against the configured trust anchors and per-call recovery plan.
+     * Verify an asset against the configured trust anchors and per-call recovery options.
      *
      * Reads the C2PA-native formats. A container format (MXF) is plugin-backed, and plugins
      * are native, so a master is verified through the native SDK.
@@ -590,7 +590,7 @@ export class StreamVerifier {
 if (Symbol.dispose) StreamVerifier.prototype[Symbol.dispose] = StreamVerifier.prototype.free;
 
 /**
- * Per-call soft-binding inputs. A plan is required when the verifier has a registry.
+ * Per-call soft-binding inputs. `recovery` is required when the verifier has a registry.
  */
 export class VerifyOptions {
     __destroy_into_raw() {
@@ -605,12 +605,12 @@ export class VerifyOptions {
     }
     /**
      * @param {Binder[]} binders
-     * @param {RecoveryPlan | null} [recovery_plan]
+     * @param {Recovery | null} [recovery]
      */
-    constructor(binders, recovery_plan) {
+    constructor(binders, recovery) {
         const ptr0 = passArrayJsValueToWasm0(binders, wasm.__wbindgen_malloc);
         const len0 = WASM_VECTOR_LEN;
-        const ret = wasm.verifyoptions_new(ptr0, len0, isLikeNone(recovery_plan) ? 0 : addToExternrefTable0(recovery_plan));
+        const ret = wasm.verifyoptions_new(ptr0, len0, isLikeNone(recovery) ? 0 : addToExternrefTable0(recovery));
         this.__wbg_ptr = ret;
         VerifyOptionsFinalization.register(this, this.__wbg_ptr, this);
         return this;
@@ -967,6 +967,16 @@ function __wbg_get_imports() {
             const ret = result;
             return ret;
         },
+        __wbg_instanceof_Map_e5b5e3db98422fcc: function(arg0) {
+            let result;
+            try {
+                result = arg0 instanceof Map;
+            } catch (_) {
+                result = false;
+            }
+            const ret = result;
+            return ret;
+        },
         __wbg_instanceof_Promise_4cb210c0b8f8c959: function(arg0) {
             let result;
             try {
@@ -1274,7 +1284,7 @@ function __wbg_get_imports() {
             return ret;
         },
         __wbindgen_cast_0000000000000002: function(arg0, arg1) {
-            // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [Externref], shim_idx: 3958, ret: Unit, inner_ret: Some(Unit) }, mutable: true }) -> Externref`.
+            // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [Externref], shim_idx: 3946, ret: Unit, inner_ret: Some(Unit) }, mutable: true }) -> Externref`.
             const ret = makeMutClosure(arg0, arg1, wasm_bindgen__convert__closures_____invoke__hedf60f9cb8ab20c3);
             return ret;
         },

package/gen/wasm/trylimbo_sdk_verifier_bg.wasm.d.ts

@@ -2,18 +2,12 @@
 /* eslint-disable */
 export const memory: WebAssembly.Memory;
 export const __wbg_assetverifier_free: (a: number, b: number) => void;
-export const __wbg_binder_free: (a: number, b: number) => void;
 export const __wbg_blobsource_free: (a: number, b: number) => void;
 export const __wbg_bytessource_free: (a: number, b: number) => void;
 export const __wbg_memorysource_free: (a: number, b: number) => void;
-export const __wbg_streamvalidation_free: (a: number, b: number) => void;
-export const __wbg_streamverifier_free: (a: number, b: number) => void;
 export const __wbg_verifyoptions_free: (a: number, b: number) => void;
 export const assetverifier_create: (a: any) => [number, number, number];
 export const assetverifier_verify: (a: number, b: any, c: number) => any;
-export const binder_derive: (a: number, b: any, c: number, d: number) => any;
-export const binder_held: (a: any) => [number, number, number];
-export const binder_iscc: () => number;
 export const blobsource_length: (a: number) => number;
 export const blobsource_new: (a: any) => [number, number, number];
 export const blobsource_readAt: (a: number, b: number, c: number) => [number, number, number];
@@ -23,19 +17,25 @@ export const bytessource_readAt: (a: number, b: number, c: number) => any;
 export const memorysource_length: (a: number) => number;
 export const memorysource_new: (a: number, b: number) => number;
 export const memorysource_readAt: (a: number, b: number, c: number) => any;
-export const streamvalidation_export: (a: number) => [number, number, number, number];
-export const streamvalidation_validate: (a: number, b: any) => any;
-export const streamverifier_create: (a: any) => [number, number, number];
-export const streamverifier_open: (a: number, b: number, c: number) => number;
-export const streamverifier_resume: (a: number, b: number, c: number, d: number, e: number) => [number, number, number];
+export const parse: (a: number, b: number) => [number, number, number];
+export const resource: (a: number, b: number, c: number, d: number) => [number, number, number, number];
+export const thumbnails: (a: number, b: number) => [number, number, number];
 export const verifyoptions_new: (a: number, b: number, c: number) => number;
+export const __wbg_binder_free: (a: number, b: number) => void;
+export const binder_derive: (a: number, b: any, c: number, d: number) => any;
+export const binder_held: (a: any) => [number, number, number];
+export const binder_iscc: () => number;
 export const C2PA_TRUST_LIST: () => [number, number];
 export const C2PA_TSA_TRUST_LIST: () => [number, number];
 export const DEV_CA: () => [number, number];
 export const init_panic_hook: () => void;
-export const parse: (a: number, b: number) => [number, number, number];
-export const resource: (a: number, b: number, c: number, d: number) => [number, number, number, number];
-export const thumbnails: (a: number, b: number) => [number, number, number];
+export const __wbg_streamvalidation_free: (a: number, b: number) => void;
+export const __wbg_streamverifier_free: (a: number, b: number) => void;
+export const streamvalidation_export: (a: number) => [number, number, number, number];
+export const streamvalidation_validate: (a: number, b: any) => any;
+export const streamverifier_create: (a: any) => [number, number, number];
+export const streamverifier_open: (a: number, b: number, c: number) => number;
+export const streamverifier_resume: (a: number, b: number, c: number, d: number, e: number) => [number, number, number];
 export const __wbg_intounderlyingbytesource_free: (a: number, b: number) => void;
 export const intounderlyingbytesource_autoAllocateChunkSize: (a: number) => number;
 export const intounderlyingbytesource_cancel: (a: number) => void;

package/gen/wasm/worker-thread.js

@@ -30,7 +30,7 @@ var AssetVerifier = class AssetVerifier {
 		return AssetVerifier.__wrap(ret[0]);
 	}
 	/**
-	* Verify an asset against the configured trust anchors and per-call recovery plan.
+	* Verify an asset against the configured trust anchors and per-call recovery options.
 	*
 	* Reads the C2PA-native formats. A container format (MXF) is plugin-backed, and plugins
 	* are native, so a master is verified through the native SDK.
@@ -547,7 +547,7 @@ var StreamVerifier = class StreamVerifier {
 };
 if (Symbol.dispose) StreamVerifier.prototype[Symbol.dispose] = StreamVerifier.prototype.free;
 /**
-* Per-call soft-binding inputs. A plan is required when the verifier has a registry.
+* Per-call soft-binding inputs. `recovery` is required when the verifier has a registry.
 */
 var VerifyOptions = class {
 	__destroy_into_raw() {
@@ -562,12 +562,12 @@ var VerifyOptions = class {
 	}
 	/**
 	* @param {Binder[]} binders
-	* @param {RecoveryPlan | null} [recovery_plan]
+	* @param {Recovery | null} [recovery]
 	*/
-	constructor(binders, recovery_plan) {
+	constructor(binders, recovery) {
 		const ptr0 = passArrayJsValueToWasm0(binders, wasm.__wbindgen_malloc);
 		const len0 = WASM_VECTOR_LEN;
-		const ret = wasm.verifyoptions_new(ptr0, len0, isLikeNone(recovery_plan) ? 0 : addToExternrefTable0(recovery_plan));
+		const ret = wasm.verifyoptions_new(ptr0, len0, isLikeNone(recovery) ? 0 : addToExternrefTable0(recovery));
 		this.__wbg_ptr = ret;
 		VerifyOptionsFinalization.register(this, this.__wbg_ptr, this);
 		return this;
@@ -900,6 +900,15 @@ function __wbg_get_imports() {
 				}
 				return result;
 			},
+			__wbg_instanceof_Map_e5b5e3db98422fcc: function(arg0) {
+				let result;
+				try {
+					result = arg0 instanceof Map;
+				} catch (_) {
+					result = false;
+				}
+				return result;
+			},
 			__wbg_instanceof_Promise_4cb210c0b8f8c959: function(arg0) {
 				let result;
 				try {
@@ -1567,7 +1576,7 @@ var Handle = class {
 };
 var AssetVerifierHandle = class extends Handle {
 	verify(asset, options = {}) {
-		return this.inner.verify(source(asset), new VerifyOptions((options.binders ?? []).map(binder), options.recoveryPlan));
+		return this.inner.verify(source(asset), new VerifyOptions((options.binders ?? []).map(binder), options.recovery));
 	}
 };
 /** One stream being validated. Dropping the handle releases the session it accumulated. */

package/gen/wasm/worker.d.ts

@@ -194,19 +194,6 @@ interface SessionKeySummary {
    */
   publicKey: Uint8Array;
 }
-/**
- * A single C2PA Soft Binding Resolution API lookup.
- */
-type RecoveryQuery = {
-  byBinding: {
-    binderIndex: number;
-  };
-} | {
-  byContent: {
-    algorithm: ContentAlgorithm;
-    hintBinderIndex?: number;
-  };
-};
 /**
  * C2PA validation state of a manifest (spec §14.3).
  */
@@ -273,14 +260,6 @@ interface StreamVerifierOptions {
    */
   segmentSkewToleranceSecs?: number;
 }
-/**
- * How a `byContent` query selects the registry\'s detector algorithms.
- */
-type ContentAlgorithm = "fingerprint" | "watermark" | "all" | {
-  named: {
-    algorithm: string;
-  };
-};
 /**
  * One C2PA validation status entry (spec §15.3).
  */
@@ -291,6 +270,30 @@ interface ValidationCode {
   code: string;
   kind: ValidationCodeKind;
 }
+/**
+ * One `matches/byContent` upload per selected detector.
+ */
+interface ByContent {
+  after: ContentTrigger;
+  detectors: Detectors;
+}
+/**
+ * One `matches/byReference` query per selected detector. The registry downloads the asset
+ * from `url`, so the client reads no bytes for it.
+ */
+interface ByReference {
+  after: ContentTrigger;
+  detectors: Detectors;
+  /**
+   * A short-lived https URL without credentials.
+   */
+  url: string;
+  /**
+   * The asset\'s size in bytes, which caps the registry\'s download.
+   */
+  length: number;
+  mediaType?: string;
+}
 /**
  * One `verify` credential: the c2pa `ManifestStore`, where it came from, whether the asset\'s
  * own fingerprint backs it up, and whether its hard binding holds over the bytes read.
@@ -315,23 +318,10 @@ interface FoundCredential {
    * Whether the manifest\'s hard binding holds over the bytes this verify read.
    */
   hardBinding: HardBinding;
-}
-/**
- * One ordered group of registry queries.
- */
-interface RecoveryStage {
-  /**
-   * Queries in declaration order. Their order is also the deterministic result priority.
-   */
-  queries: RecoveryQuery[];
   /**
-   * Whether queries start one at a time or together.
+   * Where this credential sits among the others returned. See [`crate::asset::Lineage`].
    */
-  execution: RecoveryExecution;
-  /**
-   * Whether this stage stops at its first successful query or retains every result.
-   */
-  completion: RecoveryCompletion;
+  lineage: Lineage;
 }
 /**
  * Outcome of validating a media segment against its stream\'s init.
@@ -362,22 +352,6 @@ type SegmentValidation = ({
 } & MediaValidation) | {
   kind: "unknown";
 };
-/**
- * Scheduling within a recovery stage.
- */
-type RecoveryExecution = "sequential" | "parallel";
-/**
- * The condition that completes a recovery stage.
- */
-type RecoveryCompletion = "firstResult" | "allResults";
-/**
- * The registry work a verification call is allowed to perform.
- */
-type RecoveryPlan = {
-  custom: {
-    stages: RecoveryStage[];
-  };
-};
 /**
  * Timing facts carried by a media segment\'s container.
  */
@@ -395,12 +369,36 @@ interface SegmentTiming {
    */
   eventDurationSecs?: number;
 }
+/**
+ * What one verify may do with the registry. Required whenever a registry is configured.
+ *
+ * One field per Soft Binding Resolution API operation, and an absent one is not called.
+ * `matches/byBinding` is decided by the binders handed to the verify: each is derived and looked
+ * up, all together, and every result is kept. The content forms run after that, each for the
+ * detectors it names, hinted with the first fingerprint the binders derived. Results merge by
+ * manifest; nothing is ranked or dropped.
+ */
+interface Recovery {
+  /**
+   * When the registry is consulted at all.
+   */
+  when: RecoveryPolicy;
+  /**
+   * `matches/byContent`: the bounded asset bytes travel in the request.
+   */
+  byContent?: ByContent;
+  /**
+   * `matches/byReference`: the registry fetches the asset from the caller\'s URL instead, for
+   * an asset above the upload cap.
+   */
+  byReference?: ByReference;
+}
 /**
  * When [`AssetVerifier::verify_asset`] queries the registry.
  */
 type RecoveryPolicy = "whenMissing" | "always";
 /**
- * Where the registry is and when to query it. Query reach and scheduling are selected per verify.
+ * Where the registry is. What a verify may do with it is per call, in [`Recovery`].
  */
 interface RegistryOptions {
   /**
@@ -408,14 +406,35 @@ interface RegistryOptions {
    */
   url: string;
   /**
-   * Defaults to [`RecoveryPolicy::WhenMissing`].
+   * Federated resolution APIs a match may name as holding its manifest, beside the ones the
+   * C2PA algorithm list publishes, which are always allowed. C2PA 2.4 lets a match carry an
+   * `endpoint`; one allowed is fetched from, any other is reported as refused. Checked like
+   * `url`: https, or http on loopback only.
    */
-  recovery?: RecoveryPolicy;
+  endpoints?: string[];
 }
 /**
  * Whether a code is a success, an informational note, or a failure.
  */
 type ValidationCodeKind = "success" | "informational" | "failure";
+/**
+ * Whether a content form runs on this verify. Judged against the byBinding results alone.
+ */
+type ContentTrigger = "byBindingMisses" | "always";
+/**
+ * Which advertised server-side detectors a content form runs. Every selected detector runs,
+ * including one a local binder already queried by binding.
+ */
+type Detectors = {
+  kind: "fingerprint";
+} | {
+  kind: "watermark";
+} | {
+  kind: "all";
+} | {
+  kind: "named";
+  algorithms: string[];
+};
 /**
  * [`crate::asset::CredentialOrigin`] as JS sees it: a tagged union, since each way of finding a
  * credential carries different evidence. Lane-local for the same reason [`FingerprintCheck`] is: a
@@ -449,19 +468,94 @@ type FingerprintCheck = {
  * [`crate::asset::HardBinding`] as JS sees it.
  */
 type HardBinding = "holds" | "mismatch";
+/**
+ * [`crate::asset::Lineage`] as JS sees it.
+ */
+interface Lineage {
+  supersedes: string[];
+  supersededBy: string[];
+}
+/**
+ * [`crate::asset::RecoveryIssue`] as JS sees it: a tagged union, each kind with its own data.
+ */
+type RecoveryIssue = {
+  kind: "binder";
+  binderIndex: number;
+  message: string;
+} | {
+  kind: "deprecatedAlgorithm";
+  algorithm: string;
+} | {
+  kind: "bindingQuery";
+  binderIndex: number;
+  algorithm: string;
+  message: string;
+} | {
+  kind: "queryRefused";
+  algorithm: string;
+  message: string;
+} | {
+  kind: "contentForm";
+  message: string;
+} | {
+  kind: "contentQuery";
+  algorithm: string;
+  message: string;
+} | {
+  kind: "capabilities";
+  message: string;
+} | {
+  kind: "contentTooLarge";
+  capBytes: number;
+} | {
+  kind: "candidateFetch";
+  manifestId: string;
+  message: string;
+} | {
+  kind: "candidateValidation";
+  manifestId: string;
+  reason: string;
+} | {
+  kind: "endpointRefused";
+  manifestId: string;
+  endpoint: string;
+} | {
+  kind: "resourceLimit";
+  message: string;
+};
+/**
+ * [`crate::asset::VerdictRule`] as JS sees it.
+ */
+type VerdictRule = "onlyCandidate" | "notSuperseded" | "hardBinding";
+/**
+ * [`crate::asset::Verdict`] as JS sees it.
+ */
+type Verdict = {
+  kind: "unsigned";
+} | {
+  kind: "inconclusive";
+} | {
+  kind: "embedded";
+} | {
+  kind: "recovered";
+  index: number;
+  decidedBy: VerdictRule;
+} | {
+  kind: "recoveredDerivative";
+  index: number;
+  decidedBy: VerdictRule;
+} | {
+  kind: "ambiguous";
+  candidates: number[];
+};
 interface AssetVerification {
   credentials: FoundCredential[];
   recovery: RecoverySummary;
   goldenComparison: GoldenComparison;
-}
-interface RecoveryIssue {
-  kind: RecoveryIssueKind;
-  manifestId: string | undefined;
-  message: string;
+  verdict: Verdict;
 }
 interface RecoverySummary {
   status: RecoveryStatus;
-  bestCredentialIndex: number | undefined;
   issues: RecoveryIssue[];
 }
 type ContentBindingClass = "fingerprint" | "watermark";
@@ -471,6 +565,8 @@ type GoldenComparison = {
   kind: "noEmbeddedManifest";
 } | {
   kind: "noRecoveredManifest";
+} | {
+  kind: "recoveryIncomplete";
 } | {
   kind: "matches";
   recoveredIndex: number;
@@ -478,8 +574,11 @@ type GoldenComparison = {
   kind: "differs";
   recoveredIndex: number;
 } | {
-  kind: "indeterminate";
-  recoveredIndex: number | undefined;
+  kind: "noneMatches";
+  candidates: number[];
+} | {
+  kind: "unreadable";
+  recoveredIndex: number;
 };
 type RecoveryDiscovery = {
   method: "byBinding";
@@ -487,14 +586,22 @@ type RecoveryDiscovery = {
   binding: SoftBinding;
   binderIndex: number;
   registryScore: number | undefined;
+  endpoint: string | undefined;
 } | {
   method: "byContent";
   hint: SoftBinding | undefined;
   class: ContentBindingClass;
   algorithm: string;
   registryScore: number | undefined;
+  endpoint: string | undefined;
+} | {
+  method: "byReference";
+  hint: SoftBinding | undefined;
+  class: ContentBindingClass;
+  algorithm: string;
+  registryScore: number | undefined;
+  endpoint: string | undefined;
 };
-type RecoveryIssueKind = "binder" | "bindingQuery" | "queryRefused" | "contentQuery" | "capabilities" | "contentTooLarge" | "candidateFetch" | "candidateValidation" | "resourceLimit";
 type RecoveryStatus = "notRequested" | "notFound" | "recovered" | "incomplete";
 declare class AssetVerifier {
   private constructor();
@@ -507,7 +614,7 @@ declare class AssetVerifier {
    */
   static create(options: AssetVerifierOptions): AssetVerifier;
   /**
-   * Verify an asset against the configured trust anchors and per-call recovery plan.
+   * Verify an asset against the configured trust anchors and per-call recovery options.
    *
    * Reads the C2PA-native formats. A container format (MXF) is plugin-backed, and plugins
    * are native, so a master is verified through the native SDK.
@@ -617,12 +724,12 @@ declare class StreamVerifier {
   resume(stream_id: string, state: Uint8Array): StreamValidation;
 }
 /**
- * Per-call soft-binding inputs. A plan is required when the verifier has a registry.
+ * Per-call soft-binding inputs. `recovery` is required when the verifier has a registry.
  */
 declare class VerifyOptions {
   free(): void;
   [Symbol.dispose](): void;
-  constructor(binders: Binder[], recovery_plan?: RecoveryPlan | null);
+  constructor(binders: Binder[], recovery?: Recovery | null);
 }
 //#endregion
 //#region src/worker-thread.d.ts
@@ -644,7 +751,8 @@ type BinderSpec = {
 };
 interface AssetVerifyOptions {
   readonly binders?: readonly BinderSpec[];
-  readonly recoveryPlan?: RecoveryPlan;
+  /** Required when the verifier has a registry: what this verify may do with it. */
+  readonly recovery?: Recovery;
 }
 /**
  * A wasm object held in this thread on the caller's behalf.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trylimbo/sdk-verifier-wasm",
-  "version": "0.2.11-canary.16",
+  "version": "0.2.11-canary.19",
   "license": "UNLICENSED",
   "repository": {
     "type": "git",