@trylimbo/sdk-verifier-wasm 0.2.12-canary.28 → 0.2.12

package/gen/wasm/trylimbo_sdk_verifier.d.ts

@@ -44,10 +44,11 @@ export type BinderSpec = { kind: "iscc" } | { kind: "held"; binding: SoftBinding
 /**
  * A canonical gRPC/Connect status code: the coarse, closed failure class.
  *
- * The wasm lane projects this as the Connect `snake_case` string, so a consumer
- * narrows on `err.code === \"resource_exhausted\"`; the native lane projects an enum.
+ * The wasm lane projects this as a camelCase string like every other tagged value
+ * there, so a consumer narrows on `err.code === \"resourceExhausted\"`; the native lane
+ * projects an enum.
  */
-export type Code = "canceled" | "unknown" | "invalid_argument" | "deadline_exceeded" | "not_found" | "already_exists" | "permission_denied" | "resource_exhausted" | "failed_precondition" | "aborted" | "out_of_range" | "unimplemented" | "internal" | "unavailable" | "data_loss" | "unauthenticated";
+export type Code = "canceled" | "unknown" | "invalidArgument" | "deadlineExceeded" | "notFound" | "alreadyExists" | "permissionDenied" | "resourceExhausted" | "failedPrecondition" | "aborted" | "outOfRange" | "unimplemented" | "internal" | "unavailable" | "dataLoss" | "unauthenticated";
 
 /**
  * A request-validation fault, `google.rpc.BadRequest` (`kind: \"invalid\"`).
@@ -224,7 +225,7 @@ export interface FieldViolation {
  * One `verify` credential: the c2pa `ManifestStore`, where it came from, whether the asset\'s
  * own fingerprint backs it up, and whether its hard binding holds over the bytes read.
  */
-export interface FoundCredential {
+export interface Credential {
     /**
      * The bytes behind every thumbnail the manifests reference, by that reference\'s
      * `identifier`: each manifest\'s claim thumbnail and each ingredient\'s. The manifests state
@@ -268,7 +269,7 @@ export interface InitValidation {
 }
 
 /**
- * Result of `StreamValidation.validate`, discriminated by `kind`.
+ * Result of `StreamSession.validate`, discriminated by `kind`.
  */
 export type SegmentValidation = ({ kind: "init" } & InitValidation) | ({ kind: "media" } & MediaValidation) | { kind: "unknown" };
 
@@ -304,7 +305,7 @@ export interface SegmentTiming {
  * not to be called. It needs a configured repository and at least one query.
  */
 export interface Recovery {
-    when: RecoveryPolicy;
+    when: RecoveryTrigger;
     binders: BinderSpec[];
     byContent?: ByContent;
     byReference?: ByReference;
@@ -313,7 +314,7 @@ export interface Recovery {
 /**
  * When [`AssetVerifier::verify_asset`] queries the repository.
  */
-export type RecoveryPolicy = "whenMissing" | "always";
+export type RecoveryTrigger = "manifestMissing" | "always";
 
 /**
  * Whether a code is a success, an informational note, or a failure.
@@ -325,6 +326,18 @@ export type ValidationCodeKind = "success" | "informational" | "failure";
  */
 export type ContentTrigger = "byBindingMisses" | "always";
 
+/**
+ * [`crate::asset::ByReference`] as JS states it: the region is the `Range` of
+ * `@contentauth/c2pa-types`, the shape a credential\'s actions carry.
+ */
+export interface ByReference {
+    after: ContentTrigger;
+    url: string;
+    length: number;
+    mediaType?: string;
+    region: import('@contentauth/c2pa-types').Range[];
+}
+
 /**
  * [`crate::asset::CredentialOrigin`] as JS sees it: a tagged union, since each way of finding a
  * credential carries different evidence. Lane-local for the same reason [`FingerprintCheck`] is: a
@@ -342,7 +355,7 @@ export type FingerprintCheck = { kind: "notNeeded" } | { kind: "nothingToCompare
 /**
  * [`crate::asset::HardBinding`] as JS sees it.
  */
-export type HardBinding = "holds" | "mismatch";
+export type HardBinding = "match" | "mismatch";
 
 /**
  * [`crate::asset::Lineage`] as JS sees it.
@@ -355,7 +368,7 @@ export interface Lineage {
 /**
  * [`crate::asset::RecoveryIssue`] as JS sees it: a tagged union, each kind with its own data.
  */
-export type RecoveryIssue = { kind: "binder"; binderIndex: number; message: string } | { kind: "deprecatedAlgorithm"; algorithm: string } | { kind: "bindingUndeclared"; binderIndex: number; algorithm: string } | { kind: "bindingQuery"; repository: string; binderIndex: number; algorithm: string; message: string } | { kind: "queryRefused"; repository: string; algorithm: string; message: string } | { kind: "contentForm"; repository: string; message: string } | { kind: "contentQuery"; repository: string; algorithm: string; message: string } | { kind: "capabilities"; repository: string; message: string } | { kind: "contentTooLarge"; capBytes: number } | { kind: "candidateFetch"; repository: string; manifestId: string; message: string } | { kind: "candidateValidation"; manifestId: string; reason: string } | { kind: "endpointRefused"; repository: string; manifestId: string; endpoint: string } | { kind: "resourceLimit"; message: string };
+export type RecoveryIssue = { kind: "binderFailed"; binderIndex: number; message: string } | { kind: "algorithmDeprecated"; algorithm: string } | { kind: "bindingUndeclared"; binderIndex: number; algorithm: string } | { kind: "bindingQueryFailed"; repository: string; binderIndex: number; algorithm: string; message: string } | { kind: "queryRefused"; repository: string; algorithm: string; message: string } | { kind: "contentFormUnsupported"; repository: string; message: string } | { kind: "contentQueryFailed"; repository: string; algorithm: string; message: string } | { kind: "capabilitiesUnavailable"; repository: string; message: string } | { kind: "contentTooLarge"; capBytes: number } | { kind: "candidateFetchFailed"; repository: string; manifestId: string; message: string } | { kind: "candidateInvalid"; manifestId: string; reason: string } | { kind: "endpointRefused"; repository: string; manifestId: string; endpoint: string } | { kind: "resourceLimitReached"; message: string };
 
 /**
  * [`crate::asset::VerdictRule`] as JS sees it.
@@ -375,25 +388,8 @@ export interface ByContent {
     after: ContentTrigger;
 }
 
-/**
- * `matches/byReference`: each repository downloads the asset from `url`, one request per
- * algorithm it is declared for, so the client reads no bytes for it.
- */
-export interface ByReference {
-    after: ContentTrigger;
-    /**
-     * A short-lived https URL without credentials.
-     */
-    url: string;
-    /**
-     * The asset\'s size in bytes, which caps the repository\'s download.
-     */
-    length: number;
-    mediaType?: string;
-}
-
 export interface AssetVerification {
-    credentials: FoundCredential[];
+    credentials: Credential[];
     recovery: RecoverySummary;
     goldenComparison: GoldenComparison;
     verdict: Verdict;
@@ -595,7 +591,7 @@ export class MemorySource {
  * One stream being validated. It owns the session keys and manifest ids its init segments
  * advertised, so releasing the stream is dropping this object.
  */
-export class StreamValidation {
+export class StreamSession {
     private constructor();
     free(): void;
     [Symbol.dispose](): void;
@@ -638,14 +634,14 @@ export class StreamVerifier {
      */
     static create(options: StreamVerifierOptions): StreamVerifier;
     /**
-     * Open `stream_id` for validation, handing back a `StreamValidation` to feed segments to.
+     * Open `stream_id` for validation, handing back a `StreamSession` to feed segments to.
      *
      * No I/O: the handle carries the id so it cannot be mistyped or confused with another
      * stream's, and classification still happens per segment. Opening one id twice hands
      * back the same live session, so a component that remounts keeps the state its earlier
      * handle accumulated.
      */
-    open(stream_id: string): StreamValidation;
+    open(stream_id: string): StreamSession;
     /**
      * Open `stream_id` on the state another node exported, merged into whatever this one
      * holds for that id already.
@@ -653,9 +649,9 @@ export class StreamVerifier {
      * # Errors
      *
      * Throws an `SdkError` (`STREAM_INVALID`) when `state` is not a value
-     * `StreamValidation.export` produced, or carries a version this SDK no longer reads.
+     * `StreamSession.export` produced, or carries a version this SDK no longer reads.
      */
-    resume(stream_id: string, state: Uint8Array): StreamValidation;
+    resume(stream_id: string, state: Uint8Array): StreamSession;
 }
 
 export function init_panic_hook(): void;
@@ -713,9 +709,9 @@ export interface InitOutput {
     readonly __wbg_assetverifier_free: (a: number, b: number) => void;
     readonly __wbg_blobsource_free: (a: number, b: number) => void;
     readonly __wbg_bytessource_free: (a: number, b: number) => void;
-    readonly __wbg_heldbinder_free: (a: number, b: number) => void;
-    readonly __wbg_isccbinder_free: (a: number, b: number) => void;
     readonly __wbg_memorysource_free: (a: number, b: number) => void;
+    readonly __wbg_streamsession_free: (a: number, b: number) => void;
+    readonly __wbg_streamverifier_free: (a: number, b: number) => void;
     readonly assetverifier_create: (a: any) => [number, number, number];
     readonly assetverifier_verify: (a: number, b: any, c: number) => any;
     readonly blobsource_length: (a: number) => number;
@@ -724,27 +720,27 @@ export interface InitOutput {
     readonly bytessource_length: (a: number) => number;
     readonly bytessource_new: (a: any) => number;
     readonly bytessource_readAt: (a: number, b: number, c: number) => any;
-    readonly heldbinder_derive: (a: number, b: any, c: any) => any;
-    readonly heldbinder_new: (a: any) => [number, number, number];
-    readonly isccbinder_derive: (a: number, b: any, c: any) => any;
-    readonly isccbinder_new: () => number;
     readonly memorysource_length: (a: number) => number;
     readonly memorysource_new: (a: number, b: number) => number;
     readonly memorysource_readAt: (a: number, b: number, c: number) => any;
-    readonly C2PA_TRUST_LIST: () => [number, number];
-    readonly C2PA_TSA_TRUST_LIST: () => [number, number];
-    readonly DEV_CA: () => [number, number];
-    readonly init_panic_hook: () => void;
-    readonly __wbg_streamvalidation_free: (a: number, b: number) => void;
-    readonly __wbg_streamverifier_free: (a: number, b: number) => void;
     readonly parse: (a: number, b: number) => [number, number, number];
     readonly resource: (a: number, b: number, c: number, d: number) => [number, number, number, number];
-    readonly streamvalidation_export: (a: number) => [number, number, number, number];
-    readonly streamvalidation_validate: (a: number, b: any) => any;
+    readonly streamsession_export: (a: number) => [number, number, number, number];
+    readonly streamsession_validate: (a: number, b: any) => any;
     readonly streamverifier_create: (a: any) => [number, number, number];
     readonly streamverifier_open: (a: number, b: number, c: number) => number;
     readonly streamverifier_resume: (a: number, b: number, c: number, d: number, e: number) => [number, number, number];
     readonly thumbnails: (a: number, b: number) => [number, number, number];
+    readonly C2PA_TRUST_LIST: () => [number, number];
+    readonly C2PA_TSA_TRUST_LIST: () => [number, number];
+    readonly DEV_CA: () => [number, number];
+    readonly init_panic_hook: () => void;
+    readonly __wbg_heldbinder_free: (a: number, b: number) => void;
+    readonly __wbg_isccbinder_free: (a: number, b: number) => void;
+    readonly heldbinder_derive: (a: number, b: any, c: any) => any;
+    readonly heldbinder_new: (a: any) => [number, number, number];
+    readonly isccbinder_derive: (a: number, b: any, c: any) => any;
+    readonly isccbinder_new: () => number;
     readonly __wbg_intounderlyingbytesource_free: (a: number, b: number) => void;
     readonly intounderlyingbytesource_autoAllocateChunkSize: (a: number) => number;
     readonly intounderlyingbytesource_cancel: (a: number) => void;

package/gen/wasm/trylimbo_sdk_verifier.js

@@ -474,22 +474,22 @@ if (Symbol.dispose) MemorySource.prototype[Symbol.dispose] = MemorySource.protot
  * One stream being validated. It owns the session keys and manifest ids its init segments
  * advertised, so releasing the stream is dropping this object.
  */
-export class StreamValidation {
+export class StreamSession {
     static __wrap(ptr) {
-        const obj = Object.create(StreamValidation.prototype);
+        const obj = Object.create(StreamSession.prototype);
         obj.__wbg_ptr = ptr;
-        StreamValidationFinalization.register(obj, obj.__wbg_ptr, obj);
+        StreamSessionFinalization.register(obj, obj.__wbg_ptr, obj);
         return obj;
     }
     __destroy_into_raw() {
         const ptr = this.__wbg_ptr;
         this.__wbg_ptr = 0;
-        StreamValidationFinalization.unregister(this);
+        StreamSessionFinalization.unregister(this);
         return ptr;
     }
     free() {
         const ptr = this.__destroy_into_raw();
-        wasm.__wbg_streamvalidation_free(ptr, 0);
+        wasm.__wbg_streamsession_free(ptr, 0);
     }
     /**
      * Everything this stream's init segments have registered, as CBOR for another node to
@@ -507,7 +507,7 @@ export class StreamValidation {
      * @returns {Uint8Array}
      */
     export() {
-        const ret = wasm.streamvalidation_export(this.__wbg_ptr);
+        const ret = wasm.streamsession_export(this.__wbg_ptr);
         if (ret[3]) {
             throw takeFromExternrefTable0(ret[2]);
         }
@@ -526,11 +526,11 @@ export class StreamValidation {
      * @returns {Promise<SegmentValidation>}
      */
     validate(data) {
-        const ret = wasm.streamvalidation_validate(this.__wbg_ptr, data);
+        const ret = wasm.streamsession_validate(this.__wbg_ptr, data);
         return ret;
     }
 }
-if (Symbol.dispose) StreamValidation.prototype[Symbol.dispose] = StreamValidation.prototype.free;
+if (Symbol.dispose) StreamSession.prototype[Symbol.dispose] = StreamSession.prototype.free;
 
 export class StreamVerifier {
     static __wrap(ptr) {
@@ -566,20 +566,20 @@ export class StreamVerifier {
         return StreamVerifier.__wrap(ret[0]);
     }
     /**
-     * Open `stream_id` for validation, handing back a `StreamValidation` to feed segments to.
+     * Open `stream_id` for validation, handing back a `StreamSession` to feed segments to.
      *
      * No I/O: the handle carries the id so it cannot be mistyped or confused with another
      * stream's, and classification still happens per segment. Opening one id twice hands
      * back the same live session, so a component that remounts keeps the state its earlier
      * handle accumulated.
      * @param {string} stream_id
-     * @returns {StreamValidation}
+     * @returns {StreamSession}
      */
     open(stream_id) {
         const ptr0 = passStringToWasm0(stream_id, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
         const len0 = WASM_VECTOR_LEN;
         const ret = wasm.streamverifier_open(this.__wbg_ptr, ptr0, len0);
-        return StreamValidation.__wrap(ret);
+        return StreamSession.__wrap(ret);
     }
     /**
      * Open `stream_id` on the state another node exported, merged into whatever this one
@@ -588,10 +588,10 @@ export class StreamVerifier {
      * # Errors
      *
      * Throws an `SdkError` (`STREAM_INVALID`) when `state` is not a value
-     * `StreamValidation.export` produced, or carries a version this SDK no longer reads.
+     * `StreamSession.export` produced, or carries a version this SDK no longer reads.
      * @param {string} stream_id
      * @param {Uint8Array} state
-     * @returns {StreamValidation}
+     * @returns {StreamSession}
      */
     resume(stream_id, state) {
         const ptr0 = passStringToWasm0(stream_id, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
@@ -602,7 +602,7 @@ export class StreamVerifier {
         if (ret[2]) {
             throw takeFromExternrefTable0(ret[1]);
         }
-        return StreamValidation.__wrap(ret[0]);
+        return StreamSession.__wrap(ret[0]);
     }
 }
 if (Symbol.dispose) StreamVerifier.prototype[Symbol.dispose] = StreamVerifier.prototype.free;
@@ -1269,7 +1269,7 @@ function __wbg_get_imports() {
             return ret;
         },
         __wbindgen_cast_0000000000000002: function(arg0, arg1) {
-            // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [Externref], shim_idx: 3937, ret: Unit, inner_ret: Some(Unit) }, mutable: true }) -> Externref`.
+            // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [Externref], shim_idx: 3951, ret: Unit, inner_ret: Some(Unit) }, mutable: true }) -> Externref`.
             const ret = makeMutClosure(arg0, arg1, wasm_bindgen__convert__closures_____invoke__hedf60f9cb8ab20c3);
             return ret;
         },
@@ -1376,9 +1376,9 @@ const IsccBinderFinalization = (typeof FinalizationRegistry === 'undefined')
 const MemorySourceFinalization = (typeof FinalizationRegistry === 'undefined')
     ? { register: () => {}, unregister: () => {} }
     : new FinalizationRegistry(ptr => wasm.__wbg_memorysource_free(ptr, 1));
-const StreamValidationFinalization = (typeof FinalizationRegistry === 'undefined')
+const StreamSessionFinalization = (typeof FinalizationRegistry === 'undefined')
     ? { register: () => {}, unregister: () => {} }
-    : new FinalizationRegistry(ptr => wasm.__wbg_streamvalidation_free(ptr, 1));
+    : new FinalizationRegistry(ptr => wasm.__wbg_streamsession_free(ptr, 1));
 const StreamVerifierFinalization = (typeof FinalizationRegistry === 'undefined')
     ? { register: () => {}, unregister: () => {} }
     : new FinalizationRegistry(ptr => wasm.__wbg_streamverifier_free(ptr, 1));

package/gen/wasm/trylimbo_sdk_verifier_bg.wasm.d.ts

@@ -4,9 +4,9 @@ export const memory: WebAssembly.Memory;
 export const __wbg_assetverifier_free: (a: number, b: number) => void;
 export const __wbg_blobsource_free: (a: number, b: number) => void;
 export const __wbg_bytessource_free: (a: number, b: number) => void;
-export const __wbg_heldbinder_free: (a: number, b: number) => void;
-export const __wbg_isccbinder_free: (a: number, b: number) => void;
 export const __wbg_memorysource_free: (a: number, b: number) => void;
+export const __wbg_streamsession_free: (a: number, b: number) => void;
+export const __wbg_streamverifier_free: (a: number, b: number) => void;
 export const assetverifier_create: (a: any) => [number, number, number];
 export const assetverifier_verify: (a: number, b: any, c: number) => any;
 export const blobsource_length: (a: number) => number;
@@ -15,27 +15,27 @@ export const blobsource_readAt: (a: number, b: number, c: number) => [number, nu
 export const bytessource_length: (a: number) => number;
 export const bytessource_new: (a: any) => number;
 export const bytessource_readAt: (a: number, b: number, c: number) => any;
-export const heldbinder_derive: (a: number, b: any, c: any) => any;
-export const heldbinder_new: (a: any) => [number, number, number];
-export const isccbinder_derive: (a: number, b: any, c: any) => any;
-export const isccbinder_new: () => number;
 export const memorysource_length: (a: number) => number;
 export const memorysource_new: (a: number, b: number) => number;
 export const memorysource_readAt: (a: number, b: number, c: number) => any;
-export const C2PA_TRUST_LIST: () => [number, number];
-export const C2PA_TSA_TRUST_LIST: () => [number, number];
-export const DEV_CA: () => [number, number];
-export const init_panic_hook: () => void;
-export const __wbg_streamvalidation_free: (a: number, b: number) => void;
-export const __wbg_streamverifier_free: (a: number, b: number) => void;
 export const parse: (a: number, b: number) => [number, number, number];
 export const resource: (a: number, b: number, c: number, d: number) => [number, number, number, number];
-export const streamvalidation_export: (a: number) => [number, number, number, number];
-export const streamvalidation_validate: (a: number, b: any) => any;
+export const streamsession_export: (a: number) => [number, number, number, number];
+export const streamsession_validate: (a: number, b: any) => any;
 export const streamverifier_create: (a: any) => [number, number, number];
 export const streamverifier_open: (a: number, b: number, c: number) => number;
 export const streamverifier_resume: (a: number, b: number, c: number, d: number, e: number) => [number, number, number];
 export const thumbnails: (a: number, b: number) => [number, number, number];
+export const C2PA_TRUST_LIST: () => [number, number];
+export const C2PA_TSA_TRUST_LIST: () => [number, number];
+export const DEV_CA: () => [number, number];
+export const init_panic_hook: () => void;
+export const __wbg_heldbinder_free: (a: number, b: number) => void;
+export const __wbg_isccbinder_free: (a: number, b: number) => void;
+export const heldbinder_derive: (a: number, b: any, c: any) => any;
+export const heldbinder_new: (a: any) => [number, number, number];
+export const isccbinder_derive: (a: number, b: any, c: any) => any;
+export const isccbinder_new: () => number;
 export const __wbg_intounderlyingbytesource_free: (a: number, b: number) => void;
 export const intounderlyingbytesource_autoAllocateChunkSize: (a: number) => number;
 export const intounderlyingbytesource_cancel: (a: number) => void;

package/gen/wasm/worker-thread.js

@@ -440,22 +440,22 @@ if (Symbol.dispose) MemorySource.prototype[Symbol.dispose] = MemorySource.protot
 * One stream being validated. It owns the session keys and manifest ids its init segments
 * advertised, so releasing the stream is dropping this object.
 */
-var StreamValidation = class StreamValidation {
+var StreamSession = class StreamSession {
 	static __wrap(ptr) {
-		const obj = Object.create(StreamValidation.prototype);
+		const obj = Object.create(StreamSession.prototype);
 		obj.__wbg_ptr = ptr;
-		StreamValidationFinalization.register(obj, obj.__wbg_ptr, obj);
+		StreamSessionFinalization.register(obj, obj.__wbg_ptr, obj);
 		return obj;
 	}
 	__destroy_into_raw() {
 		const ptr = this.__wbg_ptr;
 		this.__wbg_ptr = 0;
-		StreamValidationFinalization.unregister(this);
+		StreamSessionFinalization.unregister(this);
 		return ptr;
 	}
 	free() {
 		const ptr = this.__destroy_into_raw();
-		wasm.__wbg_streamvalidation_free(ptr, 0);
+		wasm.__wbg_streamsession_free(ptr, 0);
 	}
 	/**
 	* Everything this stream's init segments have registered, as CBOR for another node to
@@ -473,7 +473,7 @@ var StreamValidation = class StreamValidation {
 	* @returns {Uint8Array}
 	*/
 	export() {
-		const ret = wasm.streamvalidation_export(this.__wbg_ptr);
+		const ret = wasm.streamsession_export(this.__wbg_ptr);
 		if (ret[3]) throw takeFromExternrefTable0(ret[2]);
 		var v1 = getArrayU8FromWasm0(ret[0], ret[1]).slice();
 		wasm.__wbindgen_free(ret[0], ret[1] * 1, 1);
@@ -490,10 +490,10 @@ var StreamValidation = class StreamValidation {
 	* @returns {Promise<SegmentValidation>}
 	*/
 	validate(data) {
-		return wasm.streamvalidation_validate(this.__wbg_ptr, data);
+		return wasm.streamsession_validate(this.__wbg_ptr, data);
 	}
 };
-if (Symbol.dispose) StreamValidation.prototype[Symbol.dispose] = StreamValidation.prototype.free;
+if (Symbol.dispose) StreamSession.prototype[Symbol.dispose] = StreamSession.prototype.free;
 var StreamVerifier = class StreamVerifier {
 	static __wrap(ptr) {
 		const obj = Object.create(StreamVerifier.prototype);
@@ -526,20 +526,20 @@ var StreamVerifier = class StreamVerifier {
 		return StreamVerifier.__wrap(ret[0]);
 	}
 	/**
-	* Open `stream_id` for validation, handing back a `StreamValidation` to feed segments to.
+	* Open `stream_id` for validation, handing back a `StreamSession` to feed segments to.
 	*
 	* No I/O: the handle carries the id so it cannot be mistyped or confused with another
 	* stream's, and classification still happens per segment. Opening one id twice hands
 	* back the same live session, so a component that remounts keeps the state its earlier
 	* handle accumulated.
 	* @param {string} stream_id
-	* @returns {StreamValidation}
+	* @returns {StreamSession}
 	*/
 	open(stream_id) {
 		const ptr0 = passStringToWasm0(stream_id, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
 		const len0 = WASM_VECTOR_LEN;
 		const ret = wasm.streamverifier_open(this.__wbg_ptr, ptr0, len0);
-		return StreamValidation.__wrap(ret);
+		return StreamSession.__wrap(ret);
 	}
 	/**
 	* Open `stream_id` on the state another node exported, merged into whatever this one
@@ -548,10 +548,10 @@ var StreamVerifier = class StreamVerifier {
 	* # Errors
 	*
 	* Throws an `SdkError` (`STREAM_INVALID`) when `state` is not a value
-	* `StreamValidation.export` produced, or carries a version this SDK no longer reads.
+	* `StreamSession.export` produced, or carries a version this SDK no longer reads.
 	* @param {string} stream_id
 	* @param {Uint8Array} state
-	* @returns {StreamValidation}
+	* @returns {StreamSession}
 	*/
 	resume(stream_id, state) {
 		const ptr0 = passStringToWasm0(stream_id, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
@@ -560,7 +560,7 @@ var StreamVerifier = class StreamVerifier {
 		const len1 = WASM_VECTOR_LEN;
 		const ret = wasm.streamverifier_resume(this.__wbg_ptr, ptr0, len0, ptr1, len1);
 		if (ret[2]) throw takeFromExternrefTable0(ret[1]);
-		return StreamValidation.__wrap(ret[0]);
+		return StreamSession.__wrap(ret[0]);
 	}
 };
 if (Symbol.dispose) StreamVerifier.prototype[Symbol.dispose] = StreamVerifier.prototype.free;
@@ -1283,10 +1283,10 @@ const MemorySourceFinalization = typeof FinalizationRegistry === "undefined" ? {
 	register: () => {},
 	unregister: () => {}
 } : new FinalizationRegistry((ptr) => wasm.__wbg_memorysource_free(ptr, 1));
-const StreamValidationFinalization = typeof FinalizationRegistry === "undefined" ? {
+const StreamSessionFinalization = typeof FinalizationRegistry === "undefined" ? {
 	register: () => {},
 	unregister: () => {}
-} : new FinalizationRegistry((ptr) => wasm.__wbg_streamvalidation_free(ptr, 1));
+} : new FinalizationRegistry((ptr) => wasm.__wbg_streamsession_free(ptr, 1));
 const StreamVerifierFinalization = typeof FinalizationRegistry === "undefined" ? {
 	register: () => {},
 	unregister: () => {}
@@ -1556,7 +1556,7 @@ var AssetVerifierHandle = class extends Handle {
 	}
 };
 /** One stream being validated. Dropping the handle releases the session it accumulated. */
-var StreamValidationHandle = class extends Handle {
+var StreamSessionHandle = class extends Handle {
 	validate(segment) {
 		return this.inner.validate(source(segment));
 	}
@@ -1566,10 +1566,10 @@ var StreamValidationHandle = class extends Handle {
 };
 var StreamVerifierHandle = class extends Handle {
 	open(streamId) {
-		return proxy(new StreamValidationHandle(this.inner.open(streamId)));
+		return proxy(new StreamSessionHandle(this.inner.open(streamId)));
 	}
 	resume(streamId, state) {
-		return proxy(new StreamValidationHandle(this.inner.resume(streamId, state)));
+		return proxy(new StreamSessionHandle(this.inner.resume(streamId, state)));
 	}
 };
 let ready;
@@ -1621,4 +1621,4 @@ derive: (spec, content, options) => binder(spec).derive(source(content), options
 };
 expose(sdk);
 //#endregion
-export { AssetVerifierHandle, Handle, StreamValidationHandle, StreamVerifierHandle };
+export { AssetVerifierHandle, Handle, StreamSessionHandle, StreamVerifierHandle };

package/gen/wasm/worker.d.ts

@@ -329,7 +329,7 @@ interface ValidationCode {
  * One `verify` credential: the c2pa `ManifestStore`, where it came from, whether the asset\'s
  * own fingerprint backs it up, and whether its hard binding holds over the bytes read.
  */
-interface FoundCredential {
+interface Credential {
   /**
    * The bytes behind every thumbnail the manifests reference, by that reference\'s
    * `identifier`: each manifest\'s claim thumbnail and each ingredient\'s. The manifests state
@@ -370,7 +370,7 @@ interface InitValidation {
   sessionKeys: SessionKeySummary[];
 }
 /**
- * Result of `StreamValidation.validate`, discriminated by `kind`.
+ * Result of `StreamSession.validate`, discriminated by `kind`.
  */
 type SegmentValidation = ({
   kind: "init";
@@ -402,7 +402,7 @@ interface SegmentTiming {
  * not to be called. It needs a configured repository and at least one query.
  */
 interface Recovery {
-  when: RecoveryPolicy;
+  when: RecoveryTrigger;
   binders: BinderSpec[];
   byContent?: ByContent;
   byReference?: ByReference;
@@ -410,7 +410,7 @@ interface Recovery {
 /**
  * When [`AssetVerifier::verify_asset`] queries the repository.
  */
-type RecoveryPolicy = "whenMissing" | "always";
+type RecoveryTrigger = "manifestMissing" | "always";
 /**
  * Whether a code is a success, an informational note, or a failure.
  */
@@ -419,6 +419,17 @@ type ValidationCodeKind = "success" | "informational" | "failure";
  * Whether a content form runs on this verify. Judged against the byBinding results alone.
  */
 type ContentTrigger = "byBindingMisses" | "always";
+/**
+ * [`crate::asset::ByReference`] as JS states it: the region is the `Range` of
+ * `@contentauth/c2pa-types`, the shape a credential\'s actions carry.
+ */
+interface ByReference {
+  after: ContentTrigger;
+  url: string;
+  length: number;
+  mediaType?: string;
+  region: import('@contentauth/c2pa-types').Range[];
+}
 /**
  * [`crate::asset::CredentialOrigin`] as JS sees it: a tagged union, since each way of finding a
  * credential carries different evidence. Lane-local for the same reason [`FingerprintCheck`] is: a
@@ -452,7 +463,7 @@ type FingerprintCheck = {
 /**
  * [`crate::asset::HardBinding`] as JS sees it.
  */
-type HardBinding = "holds" | "mismatch";
+type HardBinding = "match" | "mismatch";
 /**
  * [`crate::asset::Lineage`] as JS sees it.
  */
@@ -464,18 +475,18 @@ interface Lineage {
  * [`crate::asset::RecoveryIssue`] as JS sees it: a tagged union, each kind with its own data.
  */
 type RecoveryIssue = {
-  kind: "binder";
+  kind: "binderFailed";
   binderIndex: number;
   message: string;
 } | {
-  kind: "deprecatedAlgorithm";
+  kind: "algorithmDeprecated";
   algorithm: string;
 } | {
   kind: "bindingUndeclared";
   binderIndex: number;
   algorithm: string;
 } | {
-  kind: "bindingQuery";
+  kind: "bindingQueryFailed";
   repository: string;
   binderIndex: number;
   algorithm: string;
@@ -486,28 +497,28 @@ type RecoveryIssue = {
   algorithm: string;
   message: string;
 } | {
-  kind: "contentForm";
+  kind: "contentFormUnsupported";
   repository: string;
   message: string;
 } | {
-  kind: "contentQuery";
+  kind: "contentQueryFailed";
   repository: string;
   algorithm: string;
   message: string;
 } | {
-  kind: "capabilities";
+  kind: "capabilitiesUnavailable";
   repository: string;
   message: string;
 } | {
   kind: "contentTooLarge";
   capBytes: number;
 } | {
-  kind: "candidateFetch";
+  kind: "candidateFetchFailed";
   repository: string;
   manifestId: string;
   message: string;
 } | {
-  kind: "candidateValidation";
+  kind: "candidateInvalid";
   manifestId: string;
   reason: string;
 } | {
@@ -516,7 +527,7 @@ type RecoveryIssue = {
   manifestId: string;
   endpoint: string;
 } | {
-  kind: "resourceLimit";
+  kind: "resourceLimitReached";
   message: string;
 };
 /**
@@ -551,24 +562,8 @@ type Verdict = {
 interface ByContent {
   after: ContentTrigger;
 }
-/**
- * `matches/byReference`: each repository downloads the asset from `url`, one request per
- * algorithm it is declared for, so the client reads no bytes for it.
- */
-interface ByReference {
-  after: ContentTrigger;
-  /**
-   * A short-lived https URL without credentials.
-   */
-  url: string;
-  /**
-   * The asset\'s size in bytes, which caps the repository\'s download.
-   */
-  length: number;
-  mediaType?: string;
-}
 interface AssetVerification {
-  credentials: FoundCredential[];
+  credentials: Credential[];
   recovery: RecoverySummary;
   goldenComparison: GoldenComparison;
   verdict: Verdict;
@@ -655,7 +650,7 @@ declare function DEV_CA(): string;
  * One stream being validated. It owns the session keys and manifest ids its init segments
  * advertised, so releasing the stream is dropping this object.
  */
-declare class StreamValidation {
+declare class StreamSession {
   private constructor();
   free(): void;
   [Symbol.dispose](): void;
@@ -697,14 +692,14 @@ declare class StreamVerifier {
    */
   static create(options: StreamVerifierOptions): StreamVerifier;
   /**
-   * Open `stream_id` for validation, handing back a `StreamValidation` to feed segments to.
+   * Open `stream_id` for validation, handing back a `StreamSession` to feed segments to.
    *
    * No I/O: the handle carries the id so it cannot be mistyped or confused with another
    * stream's, and classification still happens per segment. Opening one id twice hands
    * back the same live session, so a component that remounts keeps the state its earlier
    * handle accumulated.
    */
-  open(stream_id: string): StreamValidation;
+  open(stream_id: string): StreamSession;
   /**
    * Open `stream_id` on the state another node exported, merged into whatever this one
    * holds for that id already.
@@ -712,9 +707,9 @@ declare class StreamVerifier {
    * # Errors
    *
    * Throws an `SdkError` (`STREAM_INVALID`) when `state` is not a value
-   * `StreamValidation.export` produced, or carries a version this SDK no longer reads.
+   * `StreamSession.export` produced, or carries a version this SDK no longer reads.
    */
-  resume(stream_id: string, state: Uint8Array): StreamValidation;
+  resume(stream_id: string, state: Uint8Array): StreamSession;
 }
 //#endregion
 //#region src/worker-thread.d.ts
@@ -747,13 +742,13 @@ declare class AssetVerifierHandle extends Handle<AssetVerifier> {
   verify(asset: Asset, recovery: Recovery | undefined): Promise<AssetVerification>;
 }
 /** One stream being validated. Dropping the handle releases the session it accumulated. */
-declare class StreamValidationHandle extends Handle<StreamValidation> {
+declare class StreamSessionHandle extends Handle<StreamSession> {
   validate(segment: Asset): Promise<SegmentValidation>;
   export(): Uint8Array;
 }
 declare class StreamVerifierHandle extends Handle<StreamVerifier> {
-  open(streamId: string): StreamValidationHandle & ProxyMarked;
-  resume(streamId: string, state: Uint8Array): StreamValidationHandle & ProxyMarked;
+  open(streamId: string): StreamSessionHandle & ProxyMarked;
+  resume(streamId: string, state: Uint8Array): StreamSessionHandle & ProxyMarked;
 }
 /** The module's own surface, name for name with the direct import. */
 declare const sdk: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trylimbo/sdk-verifier-wasm",
-  "version": "0.2.12-canary.28",
+  "version": "0.2.12",
   "license": "UNLICENSED",
   "repository": {
     "type": "git",