@trylimbo/sdk-verifier 0.2.10 → 0.2.11-canary.13

package/gen/ffi/index.d.ts

@@ -181,7 +181,7 @@ declare const pointerLiteralSymbol: unique symbol;
  */
 declare const uniffiTypeNameSymbol: unique symbol;
 declare namespace trylimbo_verifier_d_exports {
-  export { Actor, AssertionMetadata, AssetType, AssetVerification, AssetVerifier, AssetVerifierInterface, AssetVerifierLike, AssetVerifierOptions, Binder, BinderInterface, BinderLike, ClaimGeneratorInfo, Code, ContentBindingClass, ContentBindingEvidence, Coordinate, CredentialOrigin, CredentialOrigin_Tags, DataSource, DeriveOptions, EndInclusivity, FieldViolation, FileSource, FileSourceInterface, FileSourceLike, FingerprintCheck, FingerprintCheck_Tags, FoundCredential, Frame, GoldenComparison, GoldenComparison_Tags, HashedUri, Ingredient, IngredientDeltaValidationResult, InitValidation, Item, Manifest, ManifestAssertion, ManifestAssertionKind, ManifestStore, MediaValidation, MemorySource, MemorySourceInterface, MemorySourceLike, PluginRead, PluginRegistry, PluginRegistryInterface, PluginRegistryLike, Range, RangeSource, RangeSourceImpl, RangeType, RecoveryIssue, RecoveryIssueKind, RecoveryPolicy, RecoveryStatus, RecoverySummary, Region, RegionOfInterest, RegistryOptions, RegistryQueries, Relationship, ResourceRef, ReviewRating, Role, SdkError, SdkError_Tags, SegmentTiming, SegmentValidation, SegmentValidation_Tags, SessionKeySummary, Shape, ShapeType, SignatureInfo, SigningAlgSchema, SimilarityScore, SoftBinding, StatusCodes, StreamValidation, StreamValidationInterface, StreamValidationLike, StreamVerifier, StreamVerifierInterface, StreamVerifierLike, StreamVerifierOptions, Text, TextSelector, TextSelectorRange, Time, TimeType, UnitType, UriOrResource, UriOrResource_Tags, ValidationCode, ValidationCodeKind, ValidationResults, ValidationState, ValidationStatus, Value, VerifyOptions, c2paTrustList, c2paTsaTrustList, _default$1 as default, devCa, parse, resource, thumbnails };
+  export { Actor, AssertionMetadata, AssetType, AssetVerification, AssetVerifier, AssetVerifierInterface, AssetVerifierLike, AssetVerifierOptions, Binder, BinderInterface, BinderLike, BinderPlugin, ClaimGeneratorInfo, Code, ContentAlgorithm, ContentAlgorithm_Tags, ContentBindingClass, Coordinate, CredentialOrigin, CredentialOrigin_Tags, DataSource, DeriveOptions, EndInclusivity, FieldViolation, FileSource, FileSourceInterface, FileSourceLike, FingerprintCheck, FingerprintCheck_Tags, FoundCredential, Frame, GoldenComparison, GoldenComparison_Tags, HardBinding, HashedUri, Ingredient, IngredientDeltaValidationResult, InitValidation, Item, Manifest, ManifestAssertion, ManifestAssertionKind, ManifestStore, MediaValidation, MemorySource, MemorySourceInterface, MemorySourceLike, PluginRead, PluginRegistry, PluginRegistryInterface, PluginRegistryLike, Range, RangeSource, RangeSourceImpl, RangeType, RecoveryCompletion, RecoveryDiscovery, RecoveryDiscovery_Tags, RecoveryExecution, RecoveryIssue, RecoveryIssueKind, RecoveryPlan, RecoveryPlan_Tags, RecoveryPolicy, RecoveryQuery, RecoveryQuery_Tags, RecoveryStage, RecoveryStatus, RecoverySummary, Region, RegionOfInterest, RegistryOptions, Relationship, ResourceRef, ReviewRating, Role, SdkError, SdkError_Tags, SegmentTiming, SegmentValidation, SegmentValidation_Tags, SessionKeySummary, Shape, ShapeType, SignatureInfo, SigningAlgSchema, SimilarityScore, SoftBinding, StatusCodes, StreamValidation, StreamValidationInterface, StreamValidationLike, StreamVerifier, StreamVerifierInterface, StreamVerifierLike, StreamVerifierOptions, Text, TextSelector, TextSelectorRange, Time, TimeType, UnitType, UriOrResource, UriOrResource_Tags, ValidationCode, ValidationCodeKind, ValidationResults, ValidationState, ValidationStatus, Value, VerifyOptions, c2paTrustList, c2paTsaTrustList, _default$1 as default, devCa, parse, resource, thumbnails };
 }
 /**
  * Official C2PA Conformance Program signing-CA trust anchors (a compile-time
@@ -805,16 +805,11 @@ export declare const SoftBinding: Readonly<{
   new: (partial: Partial<SoftBinding> & Required<Omit<SoftBinding, never>>) => SoftBinding;
   defaults: () => Partial<SoftBinding>;
 }>;
-/**
- * Typealias from the type name used in the UDL file to the builtin type.  This
- * is needed because the UDL type name is used in function/method signatures.
- */
-export type SimilarityScore = number;
 /**
  * The class of binding a registry derived from an uploaded asset.
  *
  * Unlike [`SoftBinding`], this carries no value: the C2PA `byContent` response does not return
- * one. The algorithm and class are still evidence because the request selects exactly that
+ * one. The algorithm and class are still evidence because every request selects exactly one
  * advertised algorithm.
  */
 export declare enum ContentBindingClass {
@@ -822,88 +817,52 @@ export declare enum ContentBindingClass {
   Watermark = 1
 }
 /**
- * One algorithm-specific piece of evidence returned by a content lookup.
- */
-export type ContentBindingEvidence = {
-  algorithm: string;
-  class: ContentBindingClass;
-  hint?: SoftBinding;
-  registryScore?: SimilarityScore;
-};
-/**
- * Generated factory for {@link ContentBindingEvidence} record objects.
+ * Typealias from the type name used in the UDL file to the builtin type.  This
+ * is needed because the UDL type name is used in function/method signatures.
  */
-export declare const ContentBindingEvidence: Readonly<{
-  create: (partial: Partial<ContentBindingEvidence> & Required<Omit<ContentBindingEvidence, "hint" | "registryScore">>) => ContentBindingEvidence;
-  new: (partial: Partial<ContentBindingEvidence> & Required<Omit<ContentBindingEvidence, "hint" | "registryScore">>) => ContentBindingEvidence;
-  defaults: () => Partial<ContentBindingEvidence>;
-}>;
-export declare enum CredentialOrigin_Tags {
-  Embedded = "Embedded",
-  RecoveredByFingerprint = "RecoveredByFingerprint",
-  RecoveredByWatermark = "RecoveredByWatermark",
-  RecoveredByContent = "RecoveredByContent"
+export type SimilarityScore = number;
+export declare enum RecoveryDiscovery_Tags {
+  ByBinding = "ByBinding",
+  ByContent = "ByContent"
 }
-/**
- * FFI projection of the domain origin. The soft-binding DTO remains public and wire-shaped,
- * while the domain value keeps its constructor invariant private.
- */
-export declare const CredentialOrigin: Readonly<{
-  instanceOf: (obj: any) => obj is CredentialOrigin;
-  Embedded: {
-    new (): {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "CredentialOrigin";
-      readonly tag: CredentialOrigin_Tags.Embedded;
-    };
-    "new"(): {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "CredentialOrigin";
-      readonly tag: CredentialOrigin_Tags.Embedded;
-    };
-    instanceOf(obj: any): obj is {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "CredentialOrigin";
-      readonly tag: CredentialOrigin_Tags.Embedded;
-    };
-  };
-  RecoveredByFingerprint: {
+export declare const RecoveryDiscovery: Readonly<{
+  instanceOf: (obj: any) => obj is RecoveryDiscovery;
+  ByBinding: {
     new (inner: {
+      binderIndex: number;
       binding: SoftBinding;
+      class: ContentBindingClass;
       registryScore?: SimilarityScore;
     }): {
       /**
        * @private
        * This field is private and should not be used, use `tag` instead.
        */
-      readonly [uniffiTypeNameSymbol]: "CredentialOrigin";
-      readonly tag: CredentialOrigin_Tags.RecoveredByFingerprint;
+      readonly [uniffiTypeNameSymbol]: "RecoveryDiscovery";
+      readonly tag: RecoveryDiscovery_Tags.ByBinding;
       readonly inner: Readonly<{
+        binderIndex: number;
         binding: SoftBinding;
+        class: ContentBindingClass;
         registryScore?: SimilarityScore;
       }>;
     };
     "new"(inner: {
+      binderIndex: number;
       binding: SoftBinding;
+      class: ContentBindingClass;
       registryScore?: SimilarityScore;
     }): {
       /**
        * @private
        * This field is private and should not be used, use `tag` instead.
        */
-      readonly [uniffiTypeNameSymbol]: "CredentialOrigin";
-      readonly tag: CredentialOrigin_Tags.RecoveredByFingerprint;
+      readonly [uniffiTypeNameSymbol]: "RecoveryDiscovery";
+      readonly tag: RecoveryDiscovery_Tags.ByBinding;
       readonly inner: Readonly<{
+        binderIndex: number;
         binding: SoftBinding;
+        class: ContentBindingClass;
         registryScore?: SimilarityScore;
       }>;
     };
@@ -912,42 +871,52 @@ export declare const CredentialOrigin: Readonly<{
        * @private
        * This field is private and should not be used, use `tag` instead.
        */
-      readonly [uniffiTypeNameSymbol]: "CredentialOrigin";
-      readonly tag: CredentialOrigin_Tags.RecoveredByFingerprint;
+      readonly [uniffiTypeNameSymbol]: "RecoveryDiscovery";
+      readonly tag: RecoveryDiscovery_Tags.ByBinding;
       readonly inner: Readonly<{
+        binderIndex: number;
         binding: SoftBinding;
+        class: ContentBindingClass;
         registryScore?: SimilarityScore;
       }>;
     };
   };
-  RecoveredByWatermark: {
+  ByContent: {
     new (inner: {
-      binding: SoftBinding;
+      algorithm: string;
+      class: ContentBindingClass;
+      hint?: SoftBinding;
       registryScore?: SimilarityScore;
     }): {
       /**
        * @private
        * This field is private and should not be used, use `tag` instead.
        */
-      readonly [uniffiTypeNameSymbol]: "CredentialOrigin";
-      readonly tag: CredentialOrigin_Tags.RecoveredByWatermark;
+      readonly [uniffiTypeNameSymbol]: "RecoveryDiscovery";
+      readonly tag: RecoveryDiscovery_Tags.ByContent;
       readonly inner: Readonly<{
-        binding: SoftBinding;
+        algorithm: string;
+        class: ContentBindingClass;
+        hint?: SoftBinding;
         registryScore?: SimilarityScore;
       }>;
     };
     "new"(inner: {
-      binding: SoftBinding;
+      algorithm: string;
+      class: ContentBindingClass;
+      hint?: SoftBinding;
       registryScore?: SimilarityScore;
     }): {
       /**
        * @private
        * This field is private and should not be used, use `tag` instead.
        */
-      readonly [uniffiTypeNameSymbol]: "CredentialOrigin";
-      readonly tag: CredentialOrigin_Tags.RecoveredByWatermark;
+      readonly [uniffiTypeNameSymbol]: "RecoveryDiscovery";
+      readonly tag: RecoveryDiscovery_Tags.ByContent;
       readonly inner: Readonly<{
-        binding: SoftBinding;
+        algorithm: string;
+        class: ContentBindingClass;
+        hint?: SoftBinding;
         registryScore?: SimilarityScore;
       }>;
     };
@@ -956,39 +925,79 @@ export declare const CredentialOrigin: Readonly<{
        * @private
        * This field is private and should not be used, use `tag` instead.
        */
-      readonly [uniffiTypeNameSymbol]: "CredentialOrigin";
-      readonly tag: CredentialOrigin_Tags.RecoveredByWatermark;
+      readonly [uniffiTypeNameSymbol]: "RecoveryDiscovery";
+      readonly tag: RecoveryDiscovery_Tags.ByContent;
       readonly inner: Readonly<{
-        binding: SoftBinding;
+        algorithm: string;
+        class: ContentBindingClass;
+        hint?: SoftBinding;
         registryScore?: SimilarityScore;
       }>;
     };
   };
-  RecoveredByContent: {
+}>;
+export type RecoveryDiscovery = InstanceType<typeof RecoveryDiscovery['ByBinding' | 'ByContent']>;
+export declare enum CredentialOrigin_Tags {
+  Embedded = "Embedded",
+  Recovered = "Recovered"
+}
+/**
+ * FFI projection of the domain origin. The soft-binding DTO remains public and wire-shaped,
+ * while the domain value keeps its constructor invariant private.
+ */
+export declare const CredentialOrigin: Readonly<{
+  instanceOf: (obj: any) => obj is CredentialOrigin;
+  Embedded: {
+    new (): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "CredentialOrigin";
+      readonly tag: CredentialOrigin_Tags.Embedded;
+    };
+    "new"(): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "CredentialOrigin";
+      readonly tag: CredentialOrigin_Tags.Embedded;
+    };
+    instanceOf(obj: any): obj is {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "CredentialOrigin";
+      readonly tag: CredentialOrigin_Tags.Embedded;
+    };
+  };
+  Recovered: {
     new (inner: {
-      discoveries: Array<ContentBindingEvidence>;
+      discoveries: Array<RecoveryDiscovery>;
     }): {
       /**
        * @private
        * This field is private and should not be used, use `tag` instead.
        */
       readonly [uniffiTypeNameSymbol]: "CredentialOrigin";
-      readonly tag: CredentialOrigin_Tags.RecoveredByContent;
+      readonly tag: CredentialOrigin_Tags.Recovered;
       readonly inner: Readonly<{
-        discoveries: Array<ContentBindingEvidence>;
+        discoveries: Array<RecoveryDiscovery>;
       }>;
     };
     "new"(inner: {
-      discoveries: Array<ContentBindingEvidence>;
+      discoveries: Array<RecoveryDiscovery>;
     }): {
       /**
        * @private
        * This field is private and should not be used, use `tag` instead.
        */
       readonly [uniffiTypeNameSymbol]: "CredentialOrigin";
-      readonly tag: CredentialOrigin_Tags.RecoveredByContent;
+      readonly tag: CredentialOrigin_Tags.Recovered;
       readonly inner: Readonly<{
-        discoveries: Array<ContentBindingEvidence>;
+        discoveries: Array<RecoveryDiscovery>;
       }>;
     };
     instanceOf(obj: any): obj is {
@@ -997,9 +1006,9 @@ export declare const CredentialOrigin: Readonly<{
        * This field is private and should not be used, use `tag` instead.
        */
       readonly [uniffiTypeNameSymbol]: "CredentialOrigin";
-      readonly tag: CredentialOrigin_Tags.RecoveredByContent;
+      readonly tag: CredentialOrigin_Tags.Recovered;
       readonly inner: Readonly<{
-        discoveries: Array<ContentBindingEvidence>;
+        discoveries: Array<RecoveryDiscovery>;
       }>;
     };
   };
@@ -1008,7 +1017,7 @@ export declare const CredentialOrigin: Readonly<{
  * FFI projection of the domain origin. The soft-binding DTO remains public and wire-shaped,
  * while the domain value keeps its constructor invariant private.
  */
-export type CredentialOrigin = InstanceType<typeof CredentialOrigin['Embedded' | 'RecoveredByFingerprint' | 'RecoveredByWatermark' | 'RecoveredByContent']>;
+export type CredentialOrigin = InstanceType<typeof CredentialOrigin['Embedded' | 'Recovered']>;
 /**
  * Assertions in C2PA can be stored in several formats
  */
@@ -1812,9 +1821,29 @@ export declare const FingerprintCheck: Readonly<{
  */
 export type FingerprintCheck = InstanceType<typeof FingerprintCheck['NotNeeded' | 'NothingToCompare' | 'Unsupported' | 'Indeterminate' | 'Compared']>;
 /**
- * One `verify` result: the c2pa manifest store, plus where it came from: see [`asset::CredentialOrigin`],
- * whose recovered variants carry the same `SoftBinding` record `Binder.derive` returns, so a
- * derived binding and a recovering one are one type.
+ * Whether the manifest's hard binding holds over the bytes this verify read.
+ *
+ * c2pa folds a hash mismatch into `validation_state == Invalid` with every other failure. A
+ * manifest recovered through a soft binding is validated against a transcode or a later edit,
+ * so a mismatch is the one failure it is expected to carry; naming it lets a caller tell "for
+ * other bytes" from "broken" without reading status codes.
+ */
+export declare enum HardBinding {
+  /**
+   * No data, box, BMFF or collection hash failed against these bytes.
+   */
+  Holds = 0,
+  /**
+   * A hash mismatch is among the active manifest's failures: the manifest describes other
+   * bytes. Whether it is otherwise authentic is its remaining statuses.
+   */
+  Mismatch = 1
+}
+/**
+ * One `verify` result: the c2pa manifest store, where it came from, whether the asset's own
+ * fingerprint backs it up, and whether its hard binding holds over the bytes read. The recovered
+ * origin carries the same `SoftBinding` record `Binder.derive` returns, so a derived binding and
+ * a recovering one are one type.
  */
 export type FoundCredential = {
   /**
@@ -1836,6 +1865,10 @@ export type FoundCredential = {
    * Whether the asset's own fingerprint backs up a mark that led here (C2PA 2.4 1.2.2.3).
    */
   fingerprintCheck: FingerprintCheck;
+  /**
+   * Whether the manifest's hard binding holds over the bytes this verify read.
+   */
+  hardBinding: HardBinding;
 };
 /**
  * Generated factory for {@link FoundCredential} record objects.
@@ -2171,32 +2204,7 @@ export declare enum RecoveryPolicy {
   Always = 1
 }
 /**
- * How far a recovery may go, which decides what leaves the caller.
- *
- * Separate from [`RecoveryPolicy`], which decides *when* a recovery runs: one names the trigger
- * and the other the reach, and crossing them is what the two enums exist to keep legible.
- */
-export declare enum RegistryQueries {
-  /**
-   * Bindings this client derived, looked up by value. The asset never leaves the caller, which
-   * is what a verifier embedded in someone else's page needs: it can ask whether a code it
-   * computed is known without handing over what it computed the code from.
-   *
-   * A binding nobody local can derive is therefore unreachable, watermarks included, because
-   * detecting those is the registry's job and needs the asset.
-   */
-  Derived = 0,
-  /**
-   * Also `POST /matches/byContent` when no derived binding hits, which uploads the asset so the
-   * registry can derive the bindings its own deployment supports, detector-backed watermarks
-   * among them. The upload happens only on that miss, and only for an asset small enough to
-   * send.
-   */
-  DerivedThenContent = 1
-}
-/**
- * Where the registry is, when to query it, and how far. One value rather than an endpoint beside
- * loose flags, so a policy cannot be configured on a verifier that has nowhere to apply it.
+ * Where the registry is and when to query it. Query reach and scheduling are selected per verify.
  */
 export type RegistryOptions = {
   /**
@@ -2207,17 +2215,13 @@ export type RegistryOptions = {
    * Defaults to [`RecoveryPolicy::WhenMissing`].
    */
   recovery?: RecoveryPolicy;
-  /**
-   * Defaults to [`RegistryQueries::DerivedThenContent`].
-   */
-  queries?: RegistryQueries;
 };
 /**
  * Generated factory for {@link RegistryOptions} record objects.
  */
 export declare const RegistryOptions: Readonly<{
-  create: (partial: Partial<RegistryOptions> & Required<Omit<RegistryOptions, "queries" | "recovery">>) => RegistryOptions;
-  new: (partial: Partial<RegistryOptions> & Required<Omit<RegistryOptions, "queries" | "recovery">>) => RegistryOptions;
+  create: (partial: Partial<RegistryOptions> & Required<Omit<RegistryOptions, "recovery">>) => RegistryOptions;
+  new: (partial: Partial<RegistryOptions> & Required<Omit<RegistryOptions, "recovery">>) => RegistryOptions;
   defaults: () => Partial<RegistryOptions>;
 }>;
 /**
@@ -2413,6 +2417,293 @@ export declare const MediaValidation: Readonly<{
   new: (partial: Partial<MediaValidation> & Required<Omit<MediaValidation, never>>) => MediaValidation;
   defaults: () => Partial<MediaValidation>;
 }>;
+export declare enum ContentAlgorithm_Tags {
+  Fingerprint = "Fingerprint",
+  Watermark = "Watermark",
+  All = "All",
+  Named = "Named"
+}
+/**
+ * How a `byContent` query selects the registry's detector algorithms.
+ */
+export declare const ContentAlgorithm: Readonly<{
+  instanceOf: (obj: any) => obj is ContentAlgorithm;
+  Fingerprint: {
+    new (): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "ContentAlgorithm";
+      readonly tag: ContentAlgorithm_Tags.Fingerprint;
+    };
+    "new"(): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "ContentAlgorithm";
+      readonly tag: ContentAlgorithm_Tags.Fingerprint;
+    };
+    instanceOf(obj: any): obj is {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "ContentAlgorithm";
+      readonly tag: ContentAlgorithm_Tags.Fingerprint;
+    };
+  };
+  Watermark: {
+    new (): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "ContentAlgorithm";
+      readonly tag: ContentAlgorithm_Tags.Watermark;
+    };
+    "new"(): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "ContentAlgorithm";
+      readonly tag: ContentAlgorithm_Tags.Watermark;
+    };
+    instanceOf(obj: any): obj is {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "ContentAlgorithm";
+      readonly tag: ContentAlgorithm_Tags.Watermark;
+    };
+  };
+  All: {
+    new (): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "ContentAlgorithm";
+      readonly tag: ContentAlgorithm_Tags.All;
+    };
+    "new"(): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "ContentAlgorithm";
+      readonly tag: ContentAlgorithm_Tags.All;
+    };
+    instanceOf(obj: any): obj is {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "ContentAlgorithm";
+      readonly tag: ContentAlgorithm_Tags.All;
+    };
+  };
+  Named: {
+    new (inner: {
+      algorithm: string;
+    }): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "ContentAlgorithm";
+      readonly tag: ContentAlgorithm_Tags.Named;
+      readonly inner: Readonly<{
+        algorithm: string;
+      }>;
+    };
+    "new"(inner: {
+      algorithm: string;
+    }): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "ContentAlgorithm";
+      readonly tag: ContentAlgorithm_Tags.Named;
+      readonly inner: Readonly<{
+        algorithm: string;
+      }>;
+    };
+    instanceOf(obj: any): obj is {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "ContentAlgorithm";
+      readonly tag: ContentAlgorithm_Tags.Named;
+      readonly inner: Readonly<{
+        algorithm: string;
+      }>;
+    };
+  };
+}>;
+/**
+ * How a `byContent` query selects the registry's detector algorithms.
+ */
+export type ContentAlgorithm = InstanceType<typeof ContentAlgorithm['Fingerprint' | 'Watermark' | 'All' | 'Named']>;
+export declare enum RecoveryQuery_Tags {
+  ByBinding = "ByBinding",
+  ByContent = "ByContent"
+}
+/**
+ * A single C2PA Soft Binding Resolution API lookup.
+ */
+export declare const RecoveryQuery: Readonly<{
+  instanceOf: (obj: any) => obj is RecoveryQuery;
+  ByBinding: {
+    new (inner: {
+      binderIndex: number;
+    }): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "RecoveryQuery";
+      readonly tag: RecoveryQuery_Tags.ByBinding;
+      readonly inner: Readonly<{
+        binderIndex: number;
+      }>;
+    };
+    "new"(inner: {
+      binderIndex: number;
+    }): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "RecoveryQuery";
+      readonly tag: RecoveryQuery_Tags.ByBinding;
+      readonly inner: Readonly<{
+        binderIndex: number;
+      }>;
+    };
+    instanceOf(obj: any): obj is {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "RecoveryQuery";
+      readonly tag: RecoveryQuery_Tags.ByBinding;
+      readonly inner: Readonly<{
+        binderIndex: number;
+      }>;
+    };
+  };
+  ByContent: {
+    new (inner: {
+      algorithm: ContentAlgorithm;
+      hintBinderIndex?: number;
+    }): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "RecoveryQuery";
+      readonly tag: RecoveryQuery_Tags.ByContent;
+      readonly inner: Readonly<{
+        algorithm: ContentAlgorithm;
+        hintBinderIndex?: number;
+      }>;
+    };
+    new: (partial: Parameters<(partial: Partial<{
+      algorithm: ContentAlgorithm;
+      hintBinderIndex?: number;
+    }> & Required<Omit<{
+      algorithm: ContentAlgorithm;
+      hintBinderIndex?: number;
+    }, "hintBinderIndex">>) => {
+      algorithm: ContentAlgorithm;
+      hintBinderIndex?: number;
+    }>[0]) => {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "RecoveryQuery";
+      readonly tag: RecoveryQuery_Tags.ByContent;
+      readonly inner: Readonly<{
+        algorithm: ContentAlgorithm;
+        hintBinderIndex?: number;
+      }>;
+    };
+    instanceOf(obj: any): obj is {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "RecoveryQuery";
+      readonly tag: RecoveryQuery_Tags.ByContent;
+      readonly inner: Readonly<{
+        algorithm: ContentAlgorithm;
+        hintBinderIndex?: number;
+      }>;
+    };
+  };
+}>;
+/**
+ * A single C2PA Soft Binding Resolution API lookup.
+ */
+export type RecoveryQuery = InstanceType<typeof RecoveryQuery['ByBinding' | 'ByContent']>;
+/**
+ * Scheduling within a recovery stage.
+ */
+export declare enum RecoveryExecution {
+  /**
+   * Finish one query before starting the next.
+   */
+  Sequential = 0,
+  /**
+   * Start all queries together and merge their results in declaration order.
+   */
+  Parallel = 1
+}
+/**
+ * The condition that completes a recovery stage.
+ */
+export declare enum RecoveryCompletion {
+  /**
+   * Stop after the first declared query that returns a credential.
+   */
+  FirstResult = 0,
+  /**
+   * Run every query and retain the union of their credentials and evidence.
+   */
+  AllResults = 1
+}
+/**
+ * One ordered group of registry queries.
+ */
+export type RecoveryStage = {
+  /**
+   * Queries in declaration order. Their order is also the deterministic result priority.
+   */
+  queries: Array<RecoveryQuery>;
+  /**
+   * Whether queries start one at a time or together.
+   */
+  execution: RecoveryExecution;
+  /**
+   * Whether this stage stops at its first successful query or retains every result.
+   */
+  completion: RecoveryCompletion;
+};
+/**
+ * Generated factory for {@link RecoveryStage} record objects.
+ */
+export declare const RecoveryStage: Readonly<{
+  create: (partial: Partial<RecoveryStage> & Required<Omit<RecoveryStage, never>>) => RecoveryStage;
+  new: (partial: Partial<RecoveryStage> & Required<Omit<RecoveryStage, never>>) => RecoveryStage;
+  defaults: () => Partial<RecoveryStage>;
+}>;
 /**
  * A byte range holding a bare C2PA manifest store, or reserved for one. A record of
  * primitives, so a plugin in its OWN UniFFI namespace declares a structurally identical
@@ -2927,6 +3218,10 @@ export declare class Binder extends UniffiAbstractObject implements BinderLike {
   readonly [destructorGuardSymbol]: UniffiGcObject;
   readonly [pointerLiteralSymbol]: UniffiHandle;
   private constructor();
+  /**
+   * A caller-supplied binder for a soft-binding algorithm not built into the SDK.
+   */
+  static custom(plugin: BinderPlugin): BinderLike;
   /**
    * A binding you already hold, such as an out-of-band video ISCC. Reads nothing.
    */
@@ -2953,6 +3248,58 @@ export declare class Binder extends UniffiAbstractObject implements BinderLike {
   uniffiDestroy(): void;
   static instanceOf(obj_: any): obj_ is Binder;
 }
+export declare enum RecoveryPlan_Tags {
+  Custom = "Custom"
+}
+/**
+ * The registry work a verification call is allowed to perform.
+ */
+export declare const RecoveryPlan: Readonly<{
+  instanceOf: (obj: any) => obj is RecoveryPlan;
+  Custom: {
+    new (inner: {
+      stages: Array<RecoveryStage>;
+    }): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "RecoveryPlan";
+      readonly tag: RecoveryPlan_Tags.Custom;
+      readonly inner: Readonly<{
+        stages: Array<RecoveryStage>;
+      }>;
+    };
+    "new"(inner: {
+      stages: Array<RecoveryStage>;
+    }): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "RecoveryPlan";
+      readonly tag: RecoveryPlan_Tags.Custom;
+      readonly inner: Readonly<{
+        stages: Array<RecoveryStage>;
+      }>;
+    };
+    instanceOf(obj: any): obj is {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "RecoveryPlan";
+      readonly tag: RecoveryPlan_Tags.Custom;
+      readonly inner: Readonly<{
+        stages: Array<RecoveryStage>;
+      }>;
+    };
+  };
+}>;
+/**
+ * The registry work a verification call is allowed to perform.
+ */
+export type RecoveryPlan = InstanceType<typeof RecoveryPlan['Custom']>;
 /**
  * The read surface a plugin implements. Implemented by the CALLER, in Rust
  * behind its own cdylib or directly in the host language, and handed to `verify`.
@@ -3057,20 +3404,21 @@ export declare class PluginRegistry extends UniffiAbstractObject implements Plug
 /**
  * Everything one [`AssetVerifier::verify`] needs beyond the asset.
  *
- * `binders` composes soft-binding recovery after the embedded pass, tried in order,
- * first hit wins; pass `[]` for none. `plugins` carries the caller's plugins for non-c2pa formats
+ * `binders` are addressed by recovery-plan indexes. `recovery_plan` is required when the verifier
+ * has a registry and absent for embedded-only verification. `plugins` carries caller plugins for non-c2pa formats
  * (e.g. MXF); a built-in C2PA media format needs none.
  */
 export type VerifyOptions = {
   binders: Array<BinderLike>;
+  recoveryPlan?: RecoveryPlan;
   plugins?: PluginRegistryLike;
 };
 /**
  * Generated factory for {@link VerifyOptions} record objects.
  */
 export declare const VerifyOptions: Readonly<{
-  create: (partial: Partial<VerifyOptions> & Required<Omit<VerifyOptions, "plugins">>) => VerifyOptions;
-  new: (partial: Partial<VerifyOptions> & Required<Omit<VerifyOptions, "plugins">>) => VerifyOptions;
+  create: (partial: Partial<VerifyOptions> & Required<Omit<VerifyOptions, "plugins" | "recoveryPlan">>) => VerifyOptions;
+  new: (partial: Partial<VerifyOptions> & Required<Omit<VerifyOptions, "plugins" | "recoveryPlan">>) => VerifyOptions;
   defaults: () => Partial<VerifyOptions>;
 }>;
 export declare enum SegmentValidation_Tags {
@@ -3177,9 +3525,8 @@ export type SegmentValidation = InstanceType<typeof SegmentValidation['Init' | '
  */
 export interface AssetVerifierLike {
   /**
-   * Verify an asset from a [`RangeSource`] (the host's ranged reader). `binders`
-   * compose soft-binding recovery after the embedded pass, tried in order,
-   * first hit wins; pass `[]` for none. `plugins` carries the caller's
+   * Verify an asset from a [`RangeSource`] using the per-call binders and recovery plan.
+   * `plugins` carries the caller's
    * plugins for non-c2pa formats (e.g. MXF); pass an empty `PluginRegistry` for a
    * built-in C2PA media format. The SDK links no plugin itself. Returns embedded/recovered
    * credentials plus typed recovery and golden-comparison outcomes.
@@ -3215,9 +3562,8 @@ export declare class AssetVerifier extends UniffiAbstractObject implements Asset
    */
   static create(options: AssetVerifierOptions): AssetVerifierLike;
   /**
-   * Verify an asset from a [`RangeSource`] (the host's ranged reader). `binders`
-   * compose soft-binding recovery after the embedded pass, tried in order,
-   * first hit wins; pass `[]` for none. `plugins` carries the caller's
+   * Verify an asset from a [`RangeSource`] using the per-call binders and recovery plan.
+   * `plugins` carries the caller's
    * plugins for non-c2pa formats (e.g. MXF); pass an empty `PluginRegistry` for a
    * built-in C2PA media format. The SDK links no plugin itself. Returns embedded/recovered
    * credentials plus typed recovery and golden-comparison outcomes.
@@ -3515,6 +3861,19 @@ export declare class StreamVerifier extends UniffiAbstractObject implements Stre
   uniffiDestroy(): void;
   static instanceOf(obj_: any): obj_ is StreamVerifier;
 }
+/**
+ * A caller-supplied soft-binding implementation.
+ *
+ * This is the extension point for algorithms the SDK does not ship. The callback receives the
+ * same ranged asset source and resolved media type as the built-in binders and may return no
+ * binding when the algorithm does not apply. The returned `alg` identifies the C2PA algorithm
+ * used by the caller's recovery plan and registry index.
+ */
+export interface BinderPlugin {
+  derive(source: RangeSource, format: string, asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<SoftBinding | undefined>;
+}
 /**
  * This should be called before anything else.
  *
@@ -3580,6 +3939,13 @@ declare const _default$1: Readonly<{
       lift(value: UniffiByteArray): Code;
       lower(value: Code, alloc: RustBufferAllocator): UniffiByteArray;
     };
+    FfiConverterTypeContentAlgorithm: {
+      readFromCursor(c: Cursor): ContentAlgorithm;
+      writeIntoCursor(value: ContentAlgorithm, c: Cursor): void;
+      allocationSize(value: ContentAlgorithm): number;
+      lift(value: UniffiByteArray): ContentAlgorithm;
+      lower(value: ContentAlgorithm, alloc: RustBufferAllocator): UniffiByteArray;
+    };
     FfiConverterTypeContentBindingClass: {
       readFromCursor(c: Cursor): ContentBindingClass;
       writeIntoCursor(value: ContentBindingClass, c: Cursor): void;
@@ -3587,13 +3953,6 @@ declare const _default$1: Readonly<{
       lift(value: UniffiByteArray): ContentBindingClass;
       lower(value: ContentBindingClass, alloc: RustBufferAllocator): UniffiByteArray;
     };
-    FfiConverterTypeContentBindingEvidence: {
-      readFromCursor(c: Cursor): ContentBindingEvidence;
-      writeIntoCursor(value: ContentBindingEvidence, c: Cursor): void;
-      allocationSize(value: ContentBindingEvidence): number;
-      lift(value: UniffiByteArray): ContentBindingEvidence;
-      lower(value: ContentBindingEvidence, alloc: RustBufferAllocator): UniffiByteArray;
-    };
     FfiConverterTypeCoordinate: {
       readFromCursor(c: Cursor): Coordinate;
       writeIntoCursor(value: Coordinate, c: Cursor): void;
@@ -3665,6 +4024,13 @@ declare const _default$1: Readonly<{
       lift(value: UniffiByteArray): GoldenComparison;
       lower(value: GoldenComparison, alloc: RustBufferAllocator): UniffiByteArray;
     };
+    FfiConverterTypeHardBinding: {
+      readFromCursor(c: Cursor): HardBinding;
+      writeIntoCursor(value: HardBinding, c: Cursor): void;
+      allocationSize(value: HardBinding): number;
+      lift(value: UniffiByteArray): HardBinding;
+      lower(value: HardBinding, alloc: RustBufferAllocator): UniffiByteArray;
+    };
     FfiConverterTypeHashedUri: {
       readFromCursor(c: Cursor): HashedUri;
       writeIntoCursor(value: HashedUri, c: Cursor): void;
@@ -3752,6 +4118,27 @@ declare const _default$1: Readonly<{
       lift(value: UniffiByteArray): RangeType;
       lower(value: RangeType, alloc: RustBufferAllocator): UniffiByteArray;
     };
+    FfiConverterTypeRecoveryCompletion: {
+      readFromCursor(c: Cursor): RecoveryCompletion;
+      writeIntoCursor(value: RecoveryCompletion, c: Cursor): void;
+      allocationSize(value: RecoveryCompletion): number;
+      lift(value: UniffiByteArray): RecoveryCompletion;
+      lower(value: RecoveryCompletion, alloc: RustBufferAllocator): UniffiByteArray;
+    };
+    FfiConverterTypeRecoveryDiscovery: {
+      readFromCursor(c: Cursor): RecoveryDiscovery;
+      writeIntoCursor(value: RecoveryDiscovery, c: Cursor): void;
+      allocationSize(value: RecoveryDiscovery): number;
+      lift(value: UniffiByteArray): RecoveryDiscovery;
+      lower(value: RecoveryDiscovery, alloc: RustBufferAllocator): UniffiByteArray;
+    };
+    FfiConverterTypeRecoveryExecution: {
+      readFromCursor(c: Cursor): RecoveryExecution;
+      writeIntoCursor(value: RecoveryExecution, c: Cursor): void;
+      allocationSize(value: RecoveryExecution): number;
+      lift(value: UniffiByteArray): RecoveryExecution;
+      lower(value: RecoveryExecution, alloc: RustBufferAllocator): UniffiByteArray;
+    };
     FfiConverterTypeRecoveryIssue: {
       readFromCursor(c: Cursor): RecoveryIssue;
       writeIntoCursor(value: RecoveryIssue, c: Cursor): void;
@@ -3766,6 +4153,63 @@ declare const _default$1: Readonly<{
       lift(value: UniffiByteArray): RecoveryIssueKind;
       lower(value: RecoveryIssueKind, alloc: RustBufferAllocator): UniffiByteArray;
     };
+    FfiConverterTypeRecoveryPlan: {
+      readFromCursor(c: Cursor): {
+        /**
+         * @private
+         * This field is private and should not be used, use `tag` instead.
+         */
+        readonly [uniffiTypeNameSymbol]: "RecoveryPlan";
+        readonly tag: RecoveryPlan_Tags.Custom;
+        readonly inner: Readonly<{
+          stages: Array<RecoveryStage>;
+        }>;
+      };
+      writeIntoCursor(value: {
+        /**
+         * @private
+         * This field is private and should not be used, use `tag` instead.
+         */
+        readonly [uniffiTypeNameSymbol]: "RecoveryPlan";
+        readonly tag: RecoveryPlan_Tags.Custom;
+        readonly inner: Readonly<{
+          stages: Array<RecoveryStage>;
+        }>;
+      }, c: Cursor): void;
+      allocationSize(value: {
+        /**
+         * @private
+         * This field is private and should not be used, use `tag` instead.
+         */
+        readonly [uniffiTypeNameSymbol]: "RecoveryPlan";
+        readonly tag: RecoveryPlan_Tags.Custom;
+        readonly inner: Readonly<{
+          stages: Array<RecoveryStage>;
+        }>;
+      }): number;
+      lift(value: UniffiByteArray): {
+        /**
+         * @private
+         * This field is private and should not be used, use `tag` instead.
+         */
+        readonly [uniffiTypeNameSymbol]: "RecoveryPlan";
+        readonly tag: RecoveryPlan_Tags.Custom;
+        readonly inner: Readonly<{
+          stages: Array<RecoveryStage>;
+        }>;
+      };
+      lower(value: {
+        /**
+         * @private
+         * This field is private and should not be used, use `tag` instead.
+         */
+        readonly [uniffiTypeNameSymbol]: "RecoveryPlan";
+        readonly tag: RecoveryPlan_Tags.Custom;
+        readonly inner: Readonly<{
+          stages: Array<RecoveryStage>;
+        }>;
+      }, alloc: RustBufferAllocator): UniffiByteArray;
+    };
     FfiConverterTypeRecoveryPolicy: {
       readFromCursor(c: Cursor): RecoveryPolicy;
       writeIntoCursor(value: RecoveryPolicy, c: Cursor): void;
@@ -3773,6 +4217,20 @@ declare const _default$1: Readonly<{
       lift(value: UniffiByteArray): RecoveryPolicy;
       lower(value: RecoveryPolicy, alloc: RustBufferAllocator): UniffiByteArray;
     };
+    FfiConverterTypeRecoveryQuery: {
+      readFromCursor(c: Cursor): RecoveryQuery;
+      writeIntoCursor(value: RecoveryQuery, c: Cursor): void;
+      allocationSize(value: RecoveryQuery): number;
+      lift(value: UniffiByteArray): RecoveryQuery;
+      lower(value: RecoveryQuery, alloc: RustBufferAllocator): UniffiByteArray;
+    };
+    FfiConverterTypeRecoveryStage: {
+      readFromCursor(c: Cursor): RecoveryStage;
+      writeIntoCursor(value: RecoveryStage, c: Cursor): void;
+      allocationSize(value: RecoveryStage): number;
+      lift(value: UniffiByteArray): RecoveryStage;
+      lower(value: RecoveryStage, alloc: RustBufferAllocator): UniffiByteArray;
+    };
     FfiConverterTypeRecoveryStatus: {
       readFromCursor(c: Cursor): RecoveryStatus;
       writeIntoCursor(value: RecoveryStatus, c: Cursor): void;
@@ -3808,13 +4266,6 @@ declare const _default$1: Readonly<{
       lift(value: UniffiByteArray): RegistryOptions;
       lower(value: RegistryOptions, alloc: RustBufferAllocator): UniffiByteArray;
     };
-    FfiConverterTypeRegistryQueries: {
-      readFromCursor(c: Cursor): RegistryQueries;
-      writeIntoCursor(value: RegistryQueries, c: Cursor): void;
-      allocationSize(value: RegistryQueries): number;
-      lift(value: UniffiByteArray): RegistryQueries;
-      lower(value: RegistryQueries, alloc: RustBufferAllocator): UniffiByteArray;
-    };
     FfiConverterTypeRelationship: {
       readFromCursor(c: Cursor): Relationship;
       writeIntoCursor(value: Relationship, c: Cursor): void;