@trylimbo/sdk-verifier-wasm 0.2.12-canary.26 → 0.2.12-canary.28

package/gen/wasm/trylimbo_sdk_verifier.d.ts

@@ -20,7 +20,7 @@ export interface RangeSource {
  * list, e.g. `io.iscc.v0`) plus its algorithm-specific value (the `ISCC:…` code,
  * a watermark token, …). The signer embeds it as a `c2pa.soft-binding` assertion
  * and indexes it, so a transcoded copy whose exact content hash no longer
- * matches still recovers the manifest from the registry.
+ * matches still recovers the manifest from the repository.
  */
 export interface SoftBinding {
     /**
@@ -30,11 +30,17 @@ export interface SoftBinding {
     /**
      * Algorithm-specific binding value: the canonical string the algorithm
      * produces (an `ISCC:…` code, a watermark token). Its UTF-8 bytes are what
-     * the registry lookup base64-encodes.
+     * the repository lookup base64-encodes.
      */
     value: string;
 }
 
+/**
+ * A binder spelled as data, so it crosses into a worker as well as the direct import: the
+ * SDK\'s own two. A browser has no host binder: a detector runs repository-side.
+ */
+export type BinderSpec = { kind: "iscc" } | { kind: "held"; binding: SoftBinding };
+
 /**
  * A canonical gRPC/Connect status code: the coarse, closed failure class.
  *
@@ -96,70 +102,101 @@ export type ValidationState = "Invalid" | "Valid" | "Trusted";
 
 /**
  * Construction options for [`AssetVerifier::new`] (and the `AssetVerifier.create` JS
- * binding). `trust_c2pa_anchors` defaults to `true` when omitted.
+ * binding). Every field is stated: nothing here is chosen on the caller\'s behalf.
  *
  * One definition, all lanes: `#[binding]` derives the shapes directly here:
- * tsify (camelCase, optional fields) on wasm, a `uniffi::Record` on the native
- * `ffi` build, so there is no per-lane DTO copy. Off both lanes it is a plain struct.
+ * tsify (camelCase) on wasm, a `uniffi::Record` on the native `ffi` build, so there is no
+ * per-lane DTO copy. Off both lanes it is a plain struct.
  */
 export interface AssetVerifierOptions {
     /**
-     * The registry to recover from. Omit for a verifier that only checks embedded manifests.
+     * The C2PA manifest repositories recovery asks, each a Soft Binding Resolution API declared
+     * for exactly the algorithms it may be asked for. Results merge by manifest, and a match\'s
+     * `endpoint` is fetched from only when it names one of these. Empty: no recovery can be
+     * asked of this verifier.
      */
-    registry?: RegistryOptions;
+    repositories: Repository[];
     /**
-     * PEM trust anchors for the caller\'s own issuers.
+     * PEM trust anchors for the manifest signers the caller trusts.
      */
     trustAnchors: string[];
     /**
-     * Also trust the bundled official C2PA anchors on top of `trust_anchors`.
-     * Defaults to `true`; set `false` to trust only `trust_anchors`.
+     * PEM trust anchors for the time-stamping authorities the caller trusts.
+     */
+    tsaTrustAnchors: string[];
+    /**
+     * Also trust the bundled official C2PA anchors, manifest and TSA lists, beside the
+     * caller\'s. `false` trusts the caller\'s lists alone.
      */
-    trustC2paAnchors?: boolean;
+    trustC2paAnchors: boolean;
     /**
      * Issuer DIDs whose CAWG identity (ICA) credentials count as validated, matched
-     * exactly against the credential issuer. Omitted or empty trusts no issuer: every
-     * identity assertion then reports `cawg.ica.untrusted_issuer` and withholds
-     * `cawg.ica.credential_valid`, which leaves the manifest\'s own validity untouched.
+     * exactly against the credential issuer. Empty trusts no issuer: every identity assertion
+     * then reports `cawg.ica.untrusted_issuer` and withholds `cawg.ica.credential_valid`,
+     * which leaves the manifest\'s own validity untouched.
      */
-    trustedIcaIssuers?: string[];
+    trustedIcaIssuers: string[];
 }
 
 /**
  * Construction options for [`StreamVerifier::new`] (and the `StreamVerifier.create`
- * JS binding). `trust_c2pa_anchors` defaults to `true` when omitted.
+ * JS binding). Every field is stated: nothing here is chosen on the caller\'s behalf.
  *
- * `#[binding]` derives the wasm shape (`trustC2paAnchors` camelCase, optional) and,
+ * `#[binding]` derives the wasm shape (`trustC2paAnchors` camelCase) and,
  * with `ffi`, a `uniffi::Record` for the native `StreamVerifier.create` binding, so there
  * is no per-lane DTO copy. Off both lanes it is a plain struct.
  */
 export interface StreamVerifierOptions {
     /**
-     * PEM trust anchors for the caller\'s own issuers.
+     * PEM trust anchors for the manifest signers the caller trusts.
      */
     trustAnchors: string[];
     /**
-     * Also trust the bundled official C2PA anchors on top of `trust_anchors`.
-     * Defaults to `true`; set `false` to trust only `trust_anchors`.
+     * PEM trust anchors for the time-stamping authorities the caller trusts.
      */
-    trustC2paAnchors?: boolean;
+    tsaTrustAnchors: string[];
+    /**
+     * Also trust the bundled official C2PA anchors, manifest and TSA lists, beside the
+     * caller\'s. `false` trusts the caller\'s lists alone.
+     */
+    trustC2paAnchors: boolean;
     /**
      * Issuer DIDs whose CAWG identity (ICA) credentials count as validated, matched
-     * exactly against the credential issuer. Omitted or empty trusts no issuer: an
-     * identity assertion on the init segment\'s manifest then reports
-     * `cawg.ica.untrusted_issuer` and withholds `cawg.ica.credential_valid`.
+     * exactly against the credential issuer. Empty trusts no issuer: an identity assertion
+     * on the init segment\'s manifest then reports `cawg.ica.untrusted_issuer` and withholds
+     * `cawg.ica.credential_valid`.
      */
-    trustedIcaIssuers?: string[];
+    trustedIcaIssuers: string[];
     /**
      * How far a segment\'s timestamp may sit from wall-clock before it is rejected as
-     * skewed. Defaults to [`DEFAULT_SEGMENT_SKEW_TOLERANCE_SECS`]. A deployment whose
-     * encoder clock drifts further than that needs this rather than a fork.
+     * skewed, in seconds: the deployment\'s own encoder-clock allowance, stated rather than
+     * assumed.
      */
-    segmentSkewToleranceSecs?: number;
+    segmentSkewToleranceSecs: number;
+}
+
+/**
+ * Everything one `derive` needs beyond the asset: how its format is known. The same record
+ * the native lane\'s `DeriveOptions` is, spelled as data.
+ */
+export interface DeriveOptions {
+    format: AssetFormat;
 }
 
 /**
- * One C2PA validation status entry (spec §15.3).
+ * How a call knows the asset\'s format: stated by the caller, or read from the leading bytes.
+ * Stated, never defaulted: sniffing is a choice made by name.
+ */
+export type AssetFormat = { kind: "sniff" } | { kind: "declared"; mediaType: string };
+
+/**
+ * One C2PA manifest repository, as the Soft Binding Resolution API spec lets a client find it.
+ */
+export type Repository = { kind: "named"; url: string; algorithms: string[] } | { kind: "listed"; algorithm: string };
+
+/**
+ * One C2PA validation status entry (spec §15.3): the registered code, its kind, and the
+ * spec\'s own free-text `explanation`, which is where anything finer than the code lives.
  */
 export interface ValidationCode {
     /**
@@ -167,6 +204,11 @@ export interface ValidationCode {
      */
     code: string;
     kind: ValidationCodeKind;
+    /**
+     * Prose for a reader, never a value to branch on: a stream failure names which of the
+     * registered code\'s listed causes it hit here.
+     */
+    explanation?: string;
 }
 
 /**
@@ -178,32 +220,6 @@ export interface FieldViolation {
     reason: string;
 }
 
-/**
- * One `matches/byContent` upload per selected detector.
- */
-export interface ByContent {
-    after: ContentTrigger;
-    detectors: Detectors;
-}
-
-/**
- * One `matches/byReference` query per selected detector. The registry downloads the asset
- * from `url`, so the client reads no bytes for it.
- */
-export interface ByReference {
-    after: ContentTrigger;
-    detectors: Detectors;
-    /**
-     * A short-lived https URL without credentials.
-     */
-    url: string;
-    /**
-     * The asset\'s size in bytes, which caps the registry\'s download.
-     */
-    length: number;
-    mediaType?: string;
-}
-
 /**
  * One `verify` credential: the c2pa `ManifestStore`, where it came from, whether the asset\'s
  * own fingerprint backs it up, and whether its hard binding holds over the bytes read.
@@ -220,10 +236,6 @@ export interface FoundCredential {
      */
     origin: CredentialOrigin;
     manifest: import('@contentauth/c2pa-types').ManifestStore;
-    /**
-     * Whether the asset\'s own fingerprint backs up a mark that led here (C2PA 2.4 1.2.2.3).
-     */
-    fingerprintCheck: FingerprintCheck;
     /**
      * Whether the manifest\'s hard binding holds over the bytes this verify read.
      */
@@ -287,52 +299,22 @@ export interface SegmentTiming {
 }
 
 /**
- * What one verify may do with the registry. Required whenever a registry is configured.
- *
- * One field per Soft Binding Resolution API operation, and an absent one is not called.
- * `matches/byBinding` is decided by the binders handed to the verify: each is derived and looked
- * up, all together, and every result is kept. The content forms run after that, each for the
- * detectors it names, hinted with the first fingerprint the binders derived. Results merge by
- * manifest; nothing is ranked or dropped.
+ * What one verify may do to recover a manifest, as data: the binders this client derives for
+ * itself, decided into `matches/byBinding`, and one field per content operation, absent when
+ * not to be called. It needs a configured repository and at least one query.
  */
 export interface Recovery {
-    /**
-     * When the registry is consulted at all.
-     */
     when: RecoveryPolicy;
-    /**
-     * `matches/byContent`: the bounded asset bytes travel in the request.
-     */
+    binders: BinderSpec[];
     byContent?: ByContent;
-    /**
-     * `matches/byReference`: the registry fetches the asset from the caller\'s URL instead, for
-     * an asset above the upload cap.
-     */
     byReference?: ByReference;
 }
 
 /**
- * When [`AssetVerifier::verify_asset`] queries the registry.
+ * When [`AssetVerifier::verify_asset`] queries the repository.
  */
 export type RecoveryPolicy = "whenMissing" | "always";
 
-/**
- * Where the registry is. What a verify may do with it is per call, in [`Recovery`].
- */
-export interface RegistryOptions {
-    /**
-     * Soft Binding Resolution API base URL (`https://registry.trylimbo.com`).
-     */
-    url: string;
-    /**
-     * Federated resolution APIs a match may name as holding its manifest, beside the ones the
-     * C2PA algorithm list publishes, which are always allowed. C2PA 2.4 lets a match carry an
-     * `endpoint`; one allowed is fetched from, any other is reported as refused. Checked like
-     * `url`: https, or http on loopback only.
-     */
-    endpoints?: string[];
-}
-
 /**
  * Whether a code is a success, an informational note, or a failure.
  */
@@ -343,18 +325,12 @@ export type ValidationCodeKind = "success" | "informational" | "failure";
  */
 export type ContentTrigger = "byBindingMisses" | "always";
 
-/**
- * Which advertised server-side detectors a content form runs. Every selected detector runs,
- * including one a local binder already queried by binding.
- */
-export type Detectors = { kind: "fingerprint" } | { kind: "watermark" } | { kind: "all" } | { kind: "named"; algorithms: string[] };
-
 /**
  * [`crate::asset::CredentialOrigin`] as JS sees it: a tagged union, since each way of finding a
  * credential carries different evidence. Lane-local for the same reason [`FingerprintCheck`] is: a
  * tag layout is what `#[binding(wasm)]` declines to express.
  */
-export type CredentialOrigin = { kind: "embedded" } | { kind: "recovered"; discoveries: RecoveryDiscovery[] };
+export type CredentialOrigin = { kind: "embedded" } | { kind: "recovered"; discoveries: RecoveryDiscovery[]; fingerprintCheck: FingerprintCheck };
 
 /**
  * [`crate::asset::FingerprintCheck`] as JS sees it: a tagged union, since `compared` carries a
@@ -379,7 +355,7 @@ export interface Lineage {
 /**
  * [`crate::asset::RecoveryIssue`] as JS sees it: a tagged union, each kind with its own data.
  */
-export type RecoveryIssue = { kind: "binder"; binderIndex: number; message: string } | { kind: "deprecatedAlgorithm"; algorithm: string } | { kind: "bindingQuery"; binderIndex: number; algorithm: string; message: string } | { kind: "queryRefused"; algorithm: string; message: string } | { kind: "contentForm"; message: string } | { kind: "contentQuery"; algorithm: string; message: string } | { kind: "capabilities"; message: string } | { kind: "contentTooLarge"; capBytes: number } | { kind: "candidateFetch"; manifestId: string; message: string } | { kind: "candidateValidation"; manifestId: string; reason: string } | { kind: "endpointRefused"; manifestId: string; endpoint: string } | { kind: "resourceLimit"; message: string };
+export type RecoveryIssue = { kind: "binder"; binderIndex: number; message: string } | { kind: "deprecatedAlgorithm"; algorithm: string } | { kind: "bindingUndeclared"; binderIndex: number; algorithm: string } | { kind: "bindingQuery"; repository: string; binderIndex: number; algorithm: string; message: string } | { kind: "queryRefused"; repository: string; algorithm: string; message: string } | { kind: "contentForm"; repository: string; message: string } | { kind: "contentQuery"; repository: string; algorithm: string; message: string } | { kind: "capabilities"; repository: string; message: string } | { kind: "contentTooLarge"; capBytes: number } | { kind: "candidateFetch"; repository: string; manifestId: string; message: string } | { kind: "candidateValidation"; manifestId: string; reason: string } | { kind: "endpointRefused"; repository: string; manifestId: string; endpoint: string } | { kind: "resourceLimit"; message: string };
 
 /**
  * [`crate::asset::VerdictRule`] as JS sees it.
@@ -391,6 +367,31 @@ export type VerdictRule = "onlyCandidate" | "notSuperseded" | "hardBinding";
  */
 export type Verdict = { kind: "unsigned" } | { kind: "inconclusive" } | { kind: "embedded" } | { kind: "recovered"; index: number; decidedBy: VerdictRule } | { kind: "recoveredDerivative"; index: number; decidedBy: VerdictRule } | { kind: "ambiguous"; candidates: number[] };
 
+/**
+ * `matches/byContent`: the asset is uploaded to each repository, one request per algorithm that
+ * repository is declared for.
+ */
+export interface ByContent {
+    after: ContentTrigger;
+}
+
+/**
+ * `matches/byReference`: each repository downloads the asset from `url`, one request per
+ * algorithm it is declared for, so the client reads no bytes for it.
+ */
+export interface ByReference {
+    after: ContentTrigger;
+    /**
+     * A short-lived https URL without credentials.
+     */
+    url: string;
+    /**
+     * The asset\'s size in bytes, which caps the repository\'s download.
+     */
+    length: number;
+    mediaType?: string;
+}
+
 export interface AssetVerification {
     credentials: FoundCredential[];
     recovery: RecoverySummary;
@@ -407,7 +408,7 @@ export type ContentBindingClass = "fingerprint" | "watermark";
 
 export type GoldenComparison = { kind: "notRequested" } | { kind: "noEmbeddedManifest" } | { kind: "noRecoveredManifest" } | { kind: "recoveryIncomplete" } | { kind: "matches"; recoveredIndex: number } | { kind: "differs"; recoveredIndex: number } | { kind: "noneMatches"; candidates: number[] } | { kind: "unreadable"; recoveredIndex: number };
 
-export type RecoveryDiscovery = { method: "byBinding"; class: ContentBindingClass; binding: SoftBinding; binderIndex: number; registryScore: number | undefined; endpoint: string | undefined } | { method: "byContent"; hint: SoftBinding | undefined; class: ContentBindingClass; algorithm: string; registryScore: number | undefined; endpoint: string | undefined } | { method: "byReference"; hint: SoftBinding | undefined; class: ContentBindingClass; algorithm: string; registryScore: number | undefined; endpoint: string | undefined };
+export type RecoveryDiscovery = { kind: "byBinding"; class: ContentBindingClass; binding: SoftBinding; binderIndex: number; repositoryScore: number | undefined; repository: string; fetchedFrom: string } | { kind: "byContent"; hint: SoftBinding | undefined; class: ContentBindingClass; algorithm: string; repositoryScore: number | undefined; repository: string; fetchedFrom: string } | { kind: "byReference"; hint: SoftBinding | undefined; class: ContentBindingClass; algorithm: string; repositoryScore: number | undefined; repository: string; fetchedFrom: string };
 
 export type RecoveryStatus = "notRequested" | "notFound" | "recovered" | "incomplete";
 
@@ -430,40 +431,10 @@ export class AssetVerifier {
      *
      * # Errors
      *
-     * Throws on a malformed `input`, a registry (or binder) failure, or a validation
+     * Throws on a malformed `input`, a repository (or binder) failure, or a validation
      * failure.
      */
-    verify(input: RangeSource, options: VerifyOptions): Promise<AssetVerification>;
-}
-
-/**
- * A soft-binding binder a client runs itself. Build with `Binder.iscc()` or
- * `Binder.held(binding)`, and pass a list to `verify`.
- *
- * Vendor watermark detection is registry-side in this SDK: configured detectors participate in
- * `verify` through `byContent`, while `Binder.held` covers values already available to the caller.
- */
-export class Binder {
-    private constructor();
-    free(): void;
-    [Symbol.dispose](): void;
-    /**
-     * Derive this binder's binding standalone; `undefined` when it finds none.
-     * Input is a `RangeSource` (format inferred from content when omitted).
-     *
-     * # Errors
-     *
-     * Throws on malformed or unreadable input.
-     */
-    derive(content: RangeSource, format?: string | null): Promise<SoftBinding | undefined>;
-    /**
-     * A binder contributing a binding you already hold (e.g. an out-of-band video ISCC).
-     */
-    static held(binding: SoftBinding): Binder;
-    /**
-     * Local ISCC Image-Code for supported image formats.
-     */
-    static iscc(): Binder;
+    verify(input: RangeSource, recovery?: Recovery | null): Promise<AssetVerification>;
 }
 
 /**
@@ -527,6 +498,30 @@ export function C2PA_TSA_TRUST_LIST(): string;
 
 export function DEV_CA(): string;
 
+/**
+ * A binder contributing a binding you already hold (e.g. an out-of-band video ISCC):
+ * `new HeldBinder(binding)`, the spelling the native lane uses. A verify takes it as data,
+ * `{ kind: "held", binding }`, in `recovery.binders`.
+ */
+export class HeldBinder {
+    free(): void;
+    [Symbol.dispose](): void;
+    /**
+     * Hand back the held binding; reads nothing.
+     *
+     * # Errors
+     *
+     * Throws when the source cannot be opened.
+     */
+    derive(content: RangeSource, options: DeriveOptions): Promise<SoftBinding | undefined>;
+    /**
+     * # Errors
+     *
+     * Throws `SdkError.invalid` on a binding with an empty algorithm or value.
+     */
+    constructor(binding: SoftBinding);
+}
+
 export class IntoUnderlyingByteSource {
     private constructor();
     free(): void;
@@ -555,6 +550,28 @@ export class IntoUnderlyingSource {
     pull(controller: ReadableStreamDefaultController): Promise<any>;
 }
 
+/**
+ * The SDK's local ISCC Image-Code binder, for a standalone `derive`: `new IsccBinder()`, the
+ * spelling the native lane uses. A verify takes it as data, `{ kind: "iscc" }`, in
+ * `recovery.binders`, because a class cannot cross into a worker.
+ *
+ * Vendor watermark detection is repository-side in this SDK: configured detectors participate in
+ * `verify` through `byContent`, while a held binder covers values already available to the caller.
+ */
+export class IsccBinder {
+    free(): void;
+    [Symbol.dispose](): void;
+    /**
+     * Derive the asset's ISCC standalone; `undefined` when the format yields none.
+     *
+     * # Errors
+     *
+     * Throws on malformed or unreadable input.
+     */
+    derive(content: RangeSource, options: DeriveOptions): Promise<SoftBinding | undefined>;
+    constructor();
+}
+
 /**
  * An in-memory [`RangeSource`](crate::wasm::RangeInput), for a caller that already holds the whole
  * asset as bytes.
@@ -641,19 +658,10 @@ export class StreamVerifier {
     resume(stream_id: string, state: Uint8Array): StreamValidation;
 }
 
-/**
- * Per-call soft-binding inputs. `recovery` is required when the verifier has a registry.
- */
-export class VerifyOptions {
-    free(): void;
-    [Symbol.dispose](): void;
-    constructor(binders: Binder[], recovery?: Recovery | null);
-}
-
 export function init_panic_hook(): void;
 
 /**
- * Parse a detached C2PA manifest store: a `.c2pa` sidecar, or the bytes a registry serves for a
+ * Parse a detached C2PA manifest store: a `.c2pa` sidecar, or the bytes a repository serves for a
  * manifest id.
  *
  * Contents, not a verdict. A hard binding is a hash of the asset, so a store read without one
@@ -705,8 +713,9 @@ export interface InitOutput {
     readonly __wbg_assetverifier_free: (a: number, b: number) => void;
     readonly __wbg_blobsource_free: (a: number, b: number) => void;
     readonly __wbg_bytessource_free: (a: number, b: number) => void;
+    readonly __wbg_heldbinder_free: (a: number, b: number) => void;
+    readonly __wbg_isccbinder_free: (a: number, b: number) => void;
     readonly __wbg_memorysource_free: (a: number, b: number) => void;
-    readonly __wbg_verifyoptions_free: (a: number, b: number) => void;
     readonly assetverifier_create: (a: any) => [number, number, number];
     readonly assetverifier_verify: (a: number, b: any, c: number) => any;
     readonly blobsource_length: (a: number) => number;
@@ -715,28 +724,27 @@ export interface InitOutput {
     readonly bytessource_length: (a: number) => number;
     readonly bytessource_new: (a: any) => number;
     readonly bytessource_readAt: (a: number, b: number, c: number) => any;
+    readonly heldbinder_derive: (a: number, b: any, c: any) => any;
+    readonly heldbinder_new: (a: any) => [number, number, number];
+    readonly isccbinder_derive: (a: number, b: any, c: any) => any;
+    readonly isccbinder_new: () => number;
     readonly memorysource_length: (a: number) => number;
     readonly memorysource_new: (a: number, b: number) => number;
     readonly memorysource_readAt: (a: number, b: number, c: number) => any;
-    readonly parse: (a: number, b: number) => [number, number, number];
-    readonly resource: (a: number, b: number, c: number, d: number) => [number, number, number, number];
-    readonly thumbnails: (a: number, b: number) => [number, number, number];
-    readonly verifyoptions_new: (a: number, b: number, c: number) => number;
-    readonly __wbg_binder_free: (a: number, b: number) => void;
-    readonly binder_derive: (a: number, b: any, c: number, d: number) => any;
-    readonly binder_held: (a: any) => [number, number, number];
-    readonly binder_iscc: () => number;
     readonly C2PA_TRUST_LIST: () => [number, number];
     readonly C2PA_TSA_TRUST_LIST: () => [number, number];
     readonly DEV_CA: () => [number, number];
     readonly init_panic_hook: () => void;
     readonly __wbg_streamvalidation_free: (a: number, b: number) => void;
     readonly __wbg_streamverifier_free: (a: number, b: number) => void;
+    readonly parse: (a: number, b: number) => [number, number, number];
+    readonly resource: (a: number, b: number, c: number, d: number) => [number, number, number, number];
     readonly streamvalidation_export: (a: number) => [number, number, number, number];
     readonly streamvalidation_validate: (a: number, b: any) => any;
     readonly streamverifier_create: (a: any) => [number, number, number];
     readonly streamverifier_open: (a: number, b: number, c: number) => number;
     readonly streamverifier_resume: (a: number, b: number, c: number, d: number, e: number) => [number, number, number];
+    readonly thumbnails: (a: number, b: number) => [number, number, number];
     readonly __wbg_intounderlyingbytesource_free: (a: number, b: number) => void;
     readonly intounderlyingbytesource_autoAllocateChunkSize: (a: number) => number;
     readonly intounderlyingbytesource_cancel: (a: number) => void;