@trylimbo/sdk-verifier 0.2.11-canary.16 → 0.2.11-canary.18

package/gen/ffi/index.d.ts

@@ -181,7 +181,7 @@ declare const pointerLiteralSymbol: unique symbol;
  */
 declare const uniffiTypeNameSymbol: unique symbol;
 declare namespace trylimbo_verifier_d_exports {
-  export { Actor, AssertionMetadata, AssetType, AssetVerification, AssetVerifier, AssetVerifierInterface, AssetVerifierLike, AssetVerifierOptions, Binder, BinderInterface, BinderLike, BinderPlugin, ClaimGeneratorInfo, Code, ContentAlgorithm, ContentAlgorithm_Tags, ContentBindingClass, Coordinate, CredentialOrigin, CredentialOrigin_Tags, DataSource, DeriveOptions, EndInclusivity, FieldViolation, FileSource, FileSourceInterface, FileSourceLike, FingerprintCheck, FingerprintCheck_Tags, FoundCredential, Frame, GoldenComparison, GoldenComparison_Tags, HardBinding, HashedUri, Ingredient, IngredientDeltaValidationResult, InitValidation, Item, Manifest, ManifestAssertion, ManifestAssertionKind, ManifestStore, MediaValidation, MemorySource, MemorySourceInterface, MemorySourceLike, PluginRead, PluginRegistry, PluginRegistryInterface, PluginRegistryLike, Range, RangeSource, RangeSourceImpl, RangeType, RecoveryCompletion, RecoveryDiscovery, RecoveryDiscovery_Tags, RecoveryExecution, RecoveryIssue, RecoveryIssueKind, RecoveryPlan, RecoveryPlan_Tags, RecoveryPolicy, RecoveryQuery, RecoveryQuery_Tags, RecoveryStage, RecoveryStatus, RecoverySummary, Region, RegionOfInterest, RegistryOptions, Relationship, ResourceRef, ReviewRating, Role, SdkError, SdkError_Tags, SegmentTiming, SegmentValidation, SegmentValidation_Tags, SessionKeySummary, Shape, ShapeType, SignatureInfo, SigningAlgSchema, SimilarityScore, SoftBinding, StatusCodes, StreamValidation, StreamValidationInterface, StreamValidationLike, StreamVerifier, StreamVerifierInterface, StreamVerifierLike, StreamVerifierOptions, Text, TextSelector, TextSelectorRange, Time, TimeType, UnitType, UriOrResource, UriOrResource_Tags, ValidationCode, ValidationCodeKind, ValidationResults, ValidationState, ValidationStatus, Value, VerifyOptions, c2paTrustList, c2paTsaTrustList, _default$1 as default, devCa, parse, resource, thumbnails };
+  export { Actor, AssertionMetadata, AssetType, AssetVerification, AssetVerifier, AssetVerifierInterface, AssetVerifierLike, AssetVerifierOptions, Binder, BinderInterface, BinderLike, BinderPlugin, ByContent, ByReference, ClaimGeneratorInfo, Code, ContentBindingClass, ContentTrigger, Coordinate, CredentialOrigin, CredentialOrigin_Tags, DataSource, DeriveOptions, Detectors, Detectors_Tags, EndInclusivity, FieldViolation, FileSource, FileSourceInterface, FileSourceLike, FingerprintCheck, FingerprintCheck_Tags, FoundCredential, Frame, GoldenComparison, GoldenComparison_Tags, HardBinding, HashedUri, Ingredient, IngredientDeltaValidationResult, InitValidation, Item, Lineage, Manifest, ManifestAssertion, ManifestAssertionKind, ManifestStore, MediaValidation, MemorySource, MemorySourceInterface, MemorySourceLike, PluginRead, PluginRegistry, PluginRegistryInterface, PluginRegistryLike, Range, RangeSource, RangeSourceImpl, RangeType, Recovery, RecoveryDiscovery, RecoveryDiscovery_Tags, RecoveryIssue, RecoveryIssueKind, RecoveryPolicy, RecoveryStatus, RecoverySummary, Region, RegionOfInterest, RegistryOptions, Relationship, ResourceRef, ReviewRating, Role, SdkError, SdkError_Tags, SegmentTiming, SegmentValidation, SegmentValidation_Tags, SessionKeySummary, Shape, ShapeType, SignatureInfo, SigningAlgSchema, SimilarityScore, SoftBinding, StatusCodes, StreamValidation, StreamValidationInterface, StreamValidationLike, StreamVerifier, StreamVerifierInterface, StreamVerifierLike, StreamVerifierOptions, Text, TextSelector, TextSelectorRange, Time, TimeType, UnitType, UriOrResource, UriOrResource_Tags, ValidationCode, ValidationCodeKind, ValidationResults, ValidationState, ValidationStatus, Value, VerifyOptions, c2paTrustList, c2paTsaTrustList, _default$1 as default, devCa, parse, resource, thumbnails };
 }
 /**
  * Official C2PA Conformance Program signing-CA trust anchors (a compile-time
@@ -823,7 +823,8 @@ export declare enum ContentBindingClass {
 export type SimilarityScore = number;
 export declare enum RecoveryDiscovery_Tags {
   ByBinding = "ByBinding",
-  ByContent = "ByContent"
+  ByContent = "ByContent",
+  ByReference = "ByReference"
 }
 export declare const RecoveryDiscovery: Readonly<{
   instanceOf: (obj: any) => obj is RecoveryDiscovery;
@@ -833,6 +834,7 @@ export declare const RecoveryDiscovery: Readonly<{
       binding: SoftBinding;
       class: ContentBindingClass;
       registryScore?: SimilarityScore;
+      endpoint?: string;
     }): {
       /**
        * @private
@@ -845,6 +847,7 @@ export declare const RecoveryDiscovery: Readonly<{
         binding: SoftBinding;
         class: ContentBindingClass;
         registryScore?: SimilarityScore;
+        endpoint?: string;
       }>;
     };
     "new"(inner: {
@@ -852,6 +855,7 @@ export declare const RecoveryDiscovery: Readonly<{
       binding: SoftBinding;
       class: ContentBindingClass;
       registryScore?: SimilarityScore;
+      endpoint?: string;
     }): {
       /**
        * @private
@@ -864,6 +868,7 @@ export declare const RecoveryDiscovery: Readonly<{
         binding: SoftBinding;
         class: ContentBindingClass;
         registryScore?: SimilarityScore;
+        endpoint?: string;
       }>;
     };
     instanceOf(obj: any): obj is {
@@ -878,6 +883,7 @@ export declare const RecoveryDiscovery: Readonly<{
         binding: SoftBinding;
         class: ContentBindingClass;
         registryScore?: SimilarityScore;
+        endpoint?: string;
       }>;
     };
   };
@@ -887,6 +893,7 @@ export declare const RecoveryDiscovery: Readonly<{
       class: ContentBindingClass;
       hint?: SoftBinding;
       registryScore?: SimilarityScore;
+      endpoint?: string;
     }): {
       /**
        * @private
@@ -899,6 +906,7 @@ export declare const RecoveryDiscovery: Readonly<{
         class: ContentBindingClass;
         hint?: SoftBinding;
         registryScore?: SimilarityScore;
+        endpoint?: string;
       }>;
     };
     "new"(inner: {
@@ -906,6 +914,7 @@ export declare const RecoveryDiscovery: Readonly<{
       class: ContentBindingClass;
       hint?: SoftBinding;
       registryScore?: SimilarityScore;
+      endpoint?: string;
     }): {
       /**
        * @private
@@ -918,6 +927,7 @@ export declare const RecoveryDiscovery: Readonly<{
         class: ContentBindingClass;
         hint?: SoftBinding;
         registryScore?: SimilarityScore;
+        endpoint?: string;
       }>;
     };
     instanceOf(obj: any): obj is {
@@ -932,11 +942,71 @@ export declare const RecoveryDiscovery: Readonly<{
         class: ContentBindingClass;
         hint?: SoftBinding;
         registryScore?: SimilarityScore;
+        endpoint?: string;
+      }>;
+    };
+  };
+  ByReference: {
+    new (inner: {
+      algorithm: string;
+      class: ContentBindingClass;
+      hint?: SoftBinding;
+      registryScore?: SimilarityScore;
+      endpoint?: string;
+    }): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "RecoveryDiscovery";
+      readonly tag: RecoveryDiscovery_Tags.ByReference;
+      readonly inner: Readonly<{
+        algorithm: string;
+        class: ContentBindingClass;
+        hint?: SoftBinding;
+        registryScore?: SimilarityScore;
+        endpoint?: string;
+      }>;
+    };
+    "new"(inner: {
+      algorithm: string;
+      class: ContentBindingClass;
+      hint?: SoftBinding;
+      registryScore?: SimilarityScore;
+      endpoint?: string;
+    }): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "RecoveryDiscovery";
+      readonly tag: RecoveryDiscovery_Tags.ByReference;
+      readonly inner: Readonly<{
+        algorithm: string;
+        class: ContentBindingClass;
+        hint?: SoftBinding;
+        registryScore?: SimilarityScore;
+        endpoint?: string;
+      }>;
+    };
+    instanceOf(obj: any): obj is {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "RecoveryDiscovery";
+      readonly tag: RecoveryDiscovery_Tags.ByReference;
+      readonly inner: Readonly<{
+        algorithm: string;
+        class: ContentBindingClass;
+        hint?: SoftBinding;
+        registryScore?: SimilarityScore;
+        endpoint?: string;
       }>;
     };
   };
 }>;
-export type RecoveryDiscovery = InstanceType<typeof RecoveryDiscovery['ByBinding' | 'ByContent']>;
+export type RecoveryDiscovery = InstanceType<typeof RecoveryDiscovery['ByBinding' | 'ByContent' | 'ByReference']>;
 export declare enum CredentialOrigin_Tags {
   Embedded = "Embedded",
   Recovered = "Recovered"
@@ -1839,6 +1909,31 @@ export declare enum HardBinding {
    */
   Mismatch = 1
 }
+/**
+ * The re-sign chain, read from the validated stores themselves: C2PA 2.4 18.16.11 copies a
+ * `parentOf` ingredient's manifest into its successor's store, so a link here was signed by the
+ * successor. A registry's ordering is a hint; this is the evidence.
+ */
+export type Lineage = {
+  /**
+   * Active manifest labels this credential's active manifest opened as a `parentOf`
+   * ingredient, whether or not they were returned by this verify.
+   */
+  supersedes: Array<string>;
+  /**
+   * Active manifest labels of the other credentials in this result that name this one in
+   * their `supersedes`.
+   */
+  supersededBy: Array<string>;
+};
+/**
+ * Generated factory for {@link Lineage} record objects.
+ */
+export declare const Lineage: Readonly<{
+  create: (partial: Partial<Lineage> & Required<Omit<Lineage, never>>) => Lineage;
+  new: (partial: Partial<Lineage> & Required<Omit<Lineage, never>>) => Lineage;
+  defaults: () => Partial<Lineage>;
+}>;
 /**
  * One `verify` result: the c2pa manifest store, where it came from, whether the asset's own
  * fingerprint backs it up, and whether its hard binding holds over the bytes read. The recovered
@@ -1869,6 +1964,10 @@ export type FoundCredential = {
    * Whether the manifest's hard binding holds over the bytes this verify read.
    */
   hardBinding: HardBinding;
+  /**
+   * Where this credential sits among the others returned. See [`asset::Lineage`].
+   */
+  lineage: Lineage;
 };
 /**
  * Generated factory for {@link FoundCredential} record objects.
@@ -1903,7 +2002,11 @@ export declare enum RecoveryIssueKind {
   ContentTooLarge = 5,
   CandidateFetch = 6,
   CandidateValidation = 7,
-  ResourceLimit = 8
+  ResourceLimit = 8,
+  /**
+   * A match named a resolution API this verifier was not configured to fetch from.
+   */
+  EndpointRefused = 9
 }
 /**
  * One non-fatal recovery problem. `manifest_id` is present only for a returned candidate.
@@ -2178,33 +2281,7 @@ export declare const AssetVerification: Readonly<{
   defaults: () => Partial<AssetVerification>;
 }>;
 /**
- * When [`AssetVerifier::verify_asset`] queries the registry.
- */
-export declare enum RecoveryPolicy {
-  /**
-   * When the asset has no embedded manifest or its active manifest is invalid. This includes
-   * stripped assets and invalid manifests, for which C2PA 2.4 permits soft-binding discovery.
-   * A valid embedded manifest costs no registry round trip, which is why this is the default.
-   */
-  WhenMissing = 0,
-  /**
-   * On every verify, alongside the embedded manifest, so the two can be compared.
-   *
-   * C2PA 2.4's `watermark-golden` and `fingerprint-golden` flows end on exactly that
-   * comparison, and it is the only thing that catches a manifest SUBSTITUTED under an
-   * untouched mark (use case UC3 in the spec's list, UC2 in ours): the replacement verifies
-   * perfectly on its own, and only disagrees with what the mark actually resolves to.
-   *
-   * It queries the registry on every verify, without making it load-bearing on the asset's own
-   * credential: the flow provides information about a substitution rather than gating the local
-   * manifest, so a registry that cannot be reached leaves [`RecoveryStatus::Incomplete`], the
-   * reason as a [`RecoveryIssue`], and [`GoldenComparison::Indeterminate`]. A caller for whom a
-   * cross-check that never ran must not pass for agreement branches on that status.
-   */
-  Always = 1
-}
-/**
- * Where the registry is and when to query it. Query reach and scheduling are selected per verify.
+ * Where the registry is. What a verify may do with it is per call, in [`Recovery`].
  */
 export type RegistryOptions = {
   /**
@@ -2212,16 +2289,18 @@ export type RegistryOptions = {
    */
   url: string;
   /**
-   * Defaults to [`RecoveryPolicy::WhenMissing`].
+   * Federated resolution APIs a match may name as holding its manifest. C2PA 2.4 lets a
+   * match carry an `endpoint`; one listed here is fetched from, any other is reported as
+   * refused. Checked like `url`: https, or http on loopback only.
    */
-  recovery?: RecoveryPolicy;
+  endpoints?: Array<string>;
 };
 /**
  * Generated factory for {@link RegistryOptions} record objects.
  */
 export declare const RegistryOptions: Readonly<{
-  create: (partial: Partial<RegistryOptions> & Required<Omit<RegistryOptions, "recovery">>) => RegistryOptions;
-  new: (partial: Partial<RegistryOptions> & Required<Omit<RegistryOptions, "recovery">>) => RegistryOptions;
+  create: (partial: Partial<RegistryOptions> & Required<Omit<RegistryOptions, "endpoints">>) => RegistryOptions;
+  new: (partial: Partial<RegistryOptions> & Required<Omit<RegistryOptions, "endpoints">>) => RegistryOptions;
   defaults: () => Partial<RegistryOptions>;
 }>;
 /**
@@ -2262,6 +2341,194 @@ export declare const AssetVerifierOptions: Readonly<{
   new: (partial: Partial<AssetVerifierOptions> & Required<Omit<AssetVerifierOptions, "registry" | "trustC2paAnchors" | "trustedIcaIssuers">>) => AssetVerifierOptions;
   defaults: () => Partial<AssetVerifierOptions>;
 }>;
+/**
+ * Whether a content form runs on this verify. Judged against the byBinding results alone.
+ */
+export declare enum ContentTrigger {
+  /**
+   * Only when no binder's lookup resolved a manifest.
+   */
+  ByBindingMisses = 0,
+  /**
+   * On every verify, beside the byBinding results: corroboration, and the golden flows.
+   */
+  Always = 1
+}
+export declare enum Detectors_Tags {
+  Fingerprint = "Fingerprint",
+  Watermark = "Watermark",
+  All = "All",
+  Named = "Named"
+}
+/**
+ * Which advertised server-side detectors a content form runs. Every selected detector runs,
+ * including one a local binder already queried by binding.
+ */
+export declare const Detectors: Readonly<{
+  instanceOf: (obj: any) => obj is Detectors;
+  Fingerprint: {
+    new (): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "Detectors";
+      readonly tag: Detectors_Tags.Fingerprint;
+    };
+    "new"(): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "Detectors";
+      readonly tag: Detectors_Tags.Fingerprint;
+    };
+    instanceOf(obj: any): obj is {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "Detectors";
+      readonly tag: Detectors_Tags.Fingerprint;
+    };
+  };
+  Watermark: {
+    new (): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "Detectors";
+      readonly tag: Detectors_Tags.Watermark;
+    };
+    "new"(): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "Detectors";
+      readonly tag: Detectors_Tags.Watermark;
+    };
+    instanceOf(obj: any): obj is {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "Detectors";
+      readonly tag: Detectors_Tags.Watermark;
+    };
+  };
+  All: {
+    new (): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "Detectors";
+      readonly tag: Detectors_Tags.All;
+    };
+    "new"(): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "Detectors";
+      readonly tag: Detectors_Tags.All;
+    };
+    instanceOf(obj: any): obj is {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "Detectors";
+      readonly tag: Detectors_Tags.All;
+    };
+  };
+  Named: {
+    new (inner: {
+      algorithms: Array<string>;
+    }): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "Detectors";
+      readonly tag: Detectors_Tags.Named;
+      readonly inner: Readonly<{
+        algorithms: Array<string>;
+      }>;
+    };
+    "new"(inner: {
+      algorithms: Array<string>;
+    }): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "Detectors";
+      readonly tag: Detectors_Tags.Named;
+      readonly inner: Readonly<{
+        algorithms: Array<string>;
+      }>;
+    };
+    instanceOf(obj: any): obj is {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "Detectors";
+      readonly tag: Detectors_Tags.Named;
+      readonly inner: Readonly<{
+        algorithms: Array<string>;
+      }>;
+    };
+  };
+}>;
+/**
+ * Which advertised server-side detectors a content form runs. Every selected detector runs,
+ * including one a local binder already queried by binding.
+ */
+export type Detectors = InstanceType<typeof Detectors['Fingerprint' | 'Watermark' | 'All' | 'Named']>;
+/**
+ * One `matches/byContent` upload per selected detector.
+ */
+export type ByContent = {
+  after: ContentTrigger;
+  detectors: Detectors;
+};
+/**
+ * Generated factory for {@link ByContent} record objects.
+ */
+export declare const ByContent: Readonly<{
+  create: (partial: Partial<ByContent> & Required<Omit<ByContent, never>>) => ByContent;
+  new: (partial: Partial<ByContent> & Required<Omit<ByContent, never>>) => ByContent;
+  defaults: () => Partial<ByContent>;
+}>;
+/**
+ * One `matches/byReference` query per selected detector. The registry downloads the asset
+ * from `url`, so the client reads no bytes for it.
+ */
+export type ByReference = {
+  after: ContentTrigger;
+  detectors: Detectors;
+  /**
+   * A short-lived https URL without credentials.
+   */
+  url: string;
+  /**
+   * The asset's size in bytes, which caps the registry's download.
+   */
+  length: bigint;
+  mediaType?: string;
+};
+/**
+ * Generated factory for {@link ByReference} record objects.
+ */
+export declare const ByReference: Readonly<{
+  create: (partial: Partial<ByReference> & Required<Omit<ByReference, "mediaType">>) => ByReference;
+  new: (partial: Partial<ByReference> & Required<Omit<ByReference, "mediaType">>) => ByReference;
+  defaults: () => Partial<ByReference>;
+}>;
 /**
  * Everything one [`Binder::derive`] needs beyond the asset. `format` overrides the format sniffed
  * from the leading bytes.
@@ -2417,292 +2684,63 @@ export declare const MediaValidation: Readonly<{
   new: (partial: Partial<MediaValidation> & Required<Omit<MediaValidation, never>>) => MediaValidation;
   defaults: () => Partial<MediaValidation>;
 }>;
-export declare enum ContentAlgorithm_Tags {
-  Fingerprint = "Fingerprint",
-  Watermark = "Watermark",
-  All = "All",
-  Named = "Named"
-}
-/**
- * How a `byContent` query selects the registry's detector algorithms.
- */
-export declare const ContentAlgorithm: Readonly<{
-  instanceOf: (obj: any) => obj is ContentAlgorithm;
-  Fingerprint: {
-    new (): {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "ContentAlgorithm";
-      readonly tag: ContentAlgorithm_Tags.Fingerprint;
-    };
-    "new"(): {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "ContentAlgorithm";
-      readonly tag: ContentAlgorithm_Tags.Fingerprint;
-    };
-    instanceOf(obj: any): obj is {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "ContentAlgorithm";
-      readonly tag: ContentAlgorithm_Tags.Fingerprint;
-    };
-  };
-  Watermark: {
-    new (): {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "ContentAlgorithm";
-      readonly tag: ContentAlgorithm_Tags.Watermark;
-    };
-    "new"(): {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "ContentAlgorithm";
-      readonly tag: ContentAlgorithm_Tags.Watermark;
-    };
-    instanceOf(obj: any): obj is {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "ContentAlgorithm";
-      readonly tag: ContentAlgorithm_Tags.Watermark;
-    };
-  };
-  All: {
-    new (): {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "ContentAlgorithm";
-      readonly tag: ContentAlgorithm_Tags.All;
-    };
-    "new"(): {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "ContentAlgorithm";
-      readonly tag: ContentAlgorithm_Tags.All;
-    };
-    instanceOf(obj: any): obj is {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "ContentAlgorithm";
-      readonly tag: ContentAlgorithm_Tags.All;
-    };
-  };
-  Named: {
-    new (inner: {
-      algorithm: string;
-    }): {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "ContentAlgorithm";
-      readonly tag: ContentAlgorithm_Tags.Named;
-      readonly inner: Readonly<{
-        algorithm: string;
-      }>;
-    };
-    "new"(inner: {
-      algorithm: string;
-    }): {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "ContentAlgorithm";
-      readonly tag: ContentAlgorithm_Tags.Named;
-      readonly inner: Readonly<{
-        algorithm: string;
-      }>;
-    };
-    instanceOf(obj: any): obj is {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "ContentAlgorithm";
-      readonly tag: ContentAlgorithm_Tags.Named;
-      readonly inner: Readonly<{
-        algorithm: string;
-      }>;
-    };
-  };
-}>;
-/**
- * How a `byContent` query selects the registry's detector algorithms.
- */
-export type ContentAlgorithm = InstanceType<typeof ContentAlgorithm['Fingerprint' | 'Watermark' | 'All' | 'Named']>;
-export declare enum RecoveryQuery_Tags {
-  ByBinding = "ByBinding",
-  ByContent = "ByContent"
-}
-/**
- * A single C2PA Soft Binding Resolution API lookup.
- */
-export declare const RecoveryQuery: Readonly<{
-  instanceOf: (obj: any) => obj is RecoveryQuery;
-  ByBinding: {
-    new (inner: {
-      binderIndex: number;
-    }): {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "RecoveryQuery";
-      readonly tag: RecoveryQuery_Tags.ByBinding;
-      readonly inner: Readonly<{
-        binderIndex: number;
-      }>;
-    };
-    "new"(inner: {
-      binderIndex: number;
-    }): {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "RecoveryQuery";
-      readonly tag: RecoveryQuery_Tags.ByBinding;
-      readonly inner: Readonly<{
-        binderIndex: number;
-      }>;
-    };
-    instanceOf(obj: any): obj is {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "RecoveryQuery";
-      readonly tag: RecoveryQuery_Tags.ByBinding;
-      readonly inner: Readonly<{
-        binderIndex: number;
-      }>;
-    };
-  };
-  ByContent: {
-    new (inner: {
-      algorithm: ContentAlgorithm;
-      hintBinderIndex?: number;
-    }): {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "RecoveryQuery";
-      readonly tag: RecoveryQuery_Tags.ByContent;
-      readonly inner: Readonly<{
-        algorithm: ContentAlgorithm;
-        hintBinderIndex?: number;
-      }>;
-    };
-    new: (partial: Parameters<(partial: Partial<{
-      algorithm: ContentAlgorithm;
-      hintBinderIndex?: number;
-    }> & Required<Omit<{
-      algorithm: ContentAlgorithm;
-      hintBinderIndex?: number;
-    }, "hintBinderIndex">>) => {
-      algorithm: ContentAlgorithm;
-      hintBinderIndex?: number;
-    }>[0]) => {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "RecoveryQuery";
-      readonly tag: RecoveryQuery_Tags.ByContent;
-      readonly inner: Readonly<{
-        algorithm: ContentAlgorithm;
-        hintBinderIndex?: number;
-      }>;
-    };
-    instanceOf(obj: any): obj is {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "RecoveryQuery";
-      readonly tag: RecoveryQuery_Tags.ByContent;
-      readonly inner: Readonly<{
-        algorithm: ContentAlgorithm;
-        hintBinderIndex?: number;
-      }>;
-    };
-  };
-}>;
-/**
- * A single C2PA Soft Binding Resolution API lookup.
- */
-export type RecoveryQuery = InstanceType<typeof RecoveryQuery['ByBinding' | 'ByContent']>;
-/**
- * Scheduling within a recovery stage.
- */
-export declare enum RecoveryExecution {
-  /**
-   * Finish one query before starting the next.
-   */
-  Sequential = 0,
-  /**
-   * Start all queries together and merge their results in declaration order.
-   */
-  Parallel = 1
-}
 /**
- * The condition that completes a recovery stage.
+ * When [`AssetVerifier::verify_asset`] queries the registry.
  */
-export declare enum RecoveryCompletion {
+export declare enum RecoveryPolicy {
   /**
-   * Stop after the first declared query that returns a credential.
+   * When the asset has no embedded manifest or its active manifest is invalid. This includes
+   * stripped assets and invalid manifests, for which C2PA 2.4 permits soft-binding discovery.
+   * A valid embedded manifest costs no registry round trip.
    */
-  FirstResult = 0,
+  WhenMissing = 0,
   /**
-   * Run every query and retain the union of their credentials and evidence.
+   * On every verify, alongside the embedded manifest, so the two can be compared.
+   *
+   * C2PA 2.4's `watermark-golden` and `fingerprint-golden` flows end on exactly that
+   * comparison, and it is the only thing that catches a manifest SUBSTITUTED under an
+   * untouched mark (use case UC3 in the spec's list, UC2 in ours): the replacement verifies
+   * perfectly on its own, and only disagrees with what the mark actually resolves to.
+   *
+   * It queries the registry on every verify, without making it load-bearing on the asset's own
+   * credential: the flow provides information about a substitution rather than gating the local
+   * manifest, so a registry that cannot be reached leaves [`RecoveryStatus::Incomplete`], the
+   * reason as a [`RecoveryIssue`], and [`GoldenComparison::Indeterminate`]. A caller for whom a
+   * cross-check that never ran must not pass for agreement branches on that status.
    */
-  AllResults = 1
+  Always = 1
 }
 /**
- * One ordered group of registry queries.
+ * What one verify may do with the registry. Required whenever a registry is configured.
+ *
+ * One field per Soft Binding Resolution API operation, and an absent one is not called.
+ * `matches/byBinding` is decided by the binders handed to the verify: each is derived and looked
+ * up, all together, and every result is kept. The content forms run after that, each for the
+ * detectors it names, hinted with the first fingerprint the binders derived. Results merge by
+ * manifest; nothing is ranked or dropped.
  */
-export type RecoveryStage = {
+export type Recovery = {
   /**
-   * Queries in declaration order. Their order is also the deterministic result priority.
+   * When the registry is consulted at all.
    */
-  queries: Array<RecoveryQuery>;
+  when: RecoveryPolicy;
   /**
-   * Whether queries start one at a time or together.
+   * `matches/byContent`: the bounded asset bytes travel in the request.
    */
-  execution: RecoveryExecution;
+  byContent?: ByContent;
   /**
-   * Whether this stage stops at its first successful query or retains every result.
+   * `matches/byReference`: the registry fetches the asset from the caller's URL instead, for
+   * an asset above the upload cap.
    */
-  completion: RecoveryCompletion;
+  byReference?: ByReference;
 };
 /**
- * Generated factory for {@link RecoveryStage} record objects.
+ * Generated factory for {@link Recovery} record objects.
  */
-export declare const RecoveryStage: Readonly<{
-  create: (partial: Partial<RecoveryStage> & Required<Omit<RecoveryStage, never>>) => RecoveryStage;
-  new: (partial: Partial<RecoveryStage> & Required<Omit<RecoveryStage, never>>) => RecoveryStage;
-  defaults: () => Partial<RecoveryStage>;
+export declare const Recovery: Readonly<{
+  create: (partial: Partial<Recovery> & Required<Omit<Recovery, "byContent" | "byReference">>) => Recovery;
+  new: (partial: Partial<Recovery> & Required<Omit<Recovery, "byContent" | "byReference">>) => Recovery;
+  defaults: () => Partial<Recovery>;
 }>;
 /**
  * A byte range holding a bare C2PA manifest store, or reserved for one. A record of
@@ -3248,58 +3286,6 @@ export declare class Binder extends UniffiAbstractObject implements BinderLike {
   uniffiDestroy(): void;
   static instanceOf(obj_: any): obj_ is Binder;
 }
-export declare enum RecoveryPlan_Tags {
-  Custom = "Custom"
-}
-/**
- * The registry work a verification call is allowed to perform.
- */
-export declare const RecoveryPlan: Readonly<{
-  instanceOf: (obj: any) => obj is RecoveryPlan;
-  Custom: {
-    new (inner: {
-      stages: Array<RecoveryStage>;
-    }): {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "RecoveryPlan";
-      readonly tag: RecoveryPlan_Tags.Custom;
-      readonly inner: Readonly<{
-        stages: Array<RecoveryStage>;
-      }>;
-    };
-    "new"(inner: {
-      stages: Array<RecoveryStage>;
-    }): {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "RecoveryPlan";
-      readonly tag: RecoveryPlan_Tags.Custom;
-      readonly inner: Readonly<{
-        stages: Array<RecoveryStage>;
-      }>;
-    };
-    instanceOf(obj: any): obj is {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "RecoveryPlan";
-      readonly tag: RecoveryPlan_Tags.Custom;
-      readonly inner: Readonly<{
-        stages: Array<RecoveryStage>;
-      }>;
-    };
-  };
-}>;
-/**
- * The registry work a verification call is allowed to perform.
- */
-export type RecoveryPlan = InstanceType<typeof RecoveryPlan['Custom']>;
 /**
  * The read surface a plugin implements. Implemented by the CALLER, in Rust
  * behind its own cdylib or directly in the host language, and handed to `verify`.
@@ -3404,21 +3390,21 @@ export declare class PluginRegistry extends UniffiAbstractObject implements Plug
 /**
  * Everything one [`AssetVerifier::verify`] needs beyond the asset.
  *
- * `binders` are addressed by recovery-plan indexes. `recovery_plan` is required when the verifier
- * has a registry and absent for embedded-only verification. `plugins` carries caller plugins for non-c2pa formats
- * (e.g. MXF); a built-in C2PA media format needs none.
+ * `recovery` is required when the verifier has a registry and absent for embedded-only
+ * verification. `plugins` carries caller plugins for non-c2pa formats (e.g. MXF); a built-in
+ * C2PA media format needs none.
  */
 export type VerifyOptions = {
   binders: Array<BinderLike>;
-  recoveryPlan?: RecoveryPlan;
+  recovery?: Recovery;
   plugins?: PluginRegistryLike;
 };
 /**
  * Generated factory for {@link VerifyOptions} record objects.
  */
 export declare const VerifyOptions: Readonly<{
-  create: (partial: Partial<VerifyOptions> & Required<Omit<VerifyOptions, "plugins" | "recoveryPlan">>) => VerifyOptions;
-  new: (partial: Partial<VerifyOptions> & Required<Omit<VerifyOptions, "plugins" | "recoveryPlan">>) => VerifyOptions;
+  create: (partial: Partial<VerifyOptions> & Required<Omit<VerifyOptions, "plugins" | "recovery">>) => VerifyOptions;
+  new: (partial: Partial<VerifyOptions> & Required<Omit<VerifyOptions, "plugins" | "recovery">>) => VerifyOptions;
   defaults: () => Partial<VerifyOptions>;
 }>;
 export declare enum SegmentValidation_Tags {
@@ -3925,6 +3911,20 @@ declare const _default$1: Readonly<{
       lower(value: AssetVerifierOptions, alloc: RustBufferAllocator): UniffiByteArray;
     };
     FfiConverterTypeBinder: FfiConverterObject<BinderLike>;
+    FfiConverterTypeByContent: {
+      readFromCursor(c: Cursor): ByContent;
+      writeIntoCursor(value: ByContent, c: Cursor): void;
+      allocationSize(value: ByContent): number;
+      lift(value: UniffiByteArray): ByContent;
+      lower(value: ByContent, alloc: RustBufferAllocator): UniffiByteArray;
+    };
+    FfiConverterTypeByReference: {
+      readFromCursor(c: Cursor): ByReference;
+      writeIntoCursor(value: ByReference, c: Cursor): void;
+      allocationSize(value: ByReference): number;
+      lift(value: UniffiByteArray): ByReference;
+      lower(value: ByReference, alloc: RustBufferAllocator): UniffiByteArray;
+    };
     FfiConverterTypeClaimGeneratorInfo: {
       readFromCursor(c: Cursor): ClaimGeneratorInfo;
       writeIntoCursor(value: ClaimGeneratorInfo, c: Cursor): void;
@@ -3939,13 +3939,6 @@ declare const _default$1: Readonly<{
       lift(value: UniffiByteArray): Code;
       lower(value: Code, alloc: RustBufferAllocator): UniffiByteArray;
     };
-    FfiConverterTypeContentAlgorithm: {
-      readFromCursor(c: Cursor): ContentAlgorithm;
-      writeIntoCursor(value: ContentAlgorithm, c: Cursor): void;
-      allocationSize(value: ContentAlgorithm): number;
-      lift(value: UniffiByteArray): ContentAlgorithm;
-      lower(value: ContentAlgorithm, alloc: RustBufferAllocator): UniffiByteArray;
-    };
     FfiConverterTypeContentBindingClass: {
       readFromCursor(c: Cursor): ContentBindingClass;
       writeIntoCursor(value: ContentBindingClass, c: Cursor): void;
@@ -3953,6 +3946,13 @@ declare const _default$1: Readonly<{
       lift(value: UniffiByteArray): ContentBindingClass;
       lower(value: ContentBindingClass, alloc: RustBufferAllocator): UniffiByteArray;
     };
+    FfiConverterTypeContentTrigger: {
+      readFromCursor(c: Cursor): ContentTrigger;
+      writeIntoCursor(value: ContentTrigger, c: Cursor): void;
+      allocationSize(value: ContentTrigger): number;
+      lift(value: UniffiByteArray): ContentTrigger;
+      lower(value: ContentTrigger, alloc: RustBufferAllocator): UniffiByteArray;
+    };
     FfiConverterTypeCoordinate: {
       readFromCursor(c: Cursor): Coordinate;
       writeIntoCursor(value: Coordinate, c: Cursor): void;
@@ -3981,6 +3981,13 @@ declare const _default$1: Readonly<{
       lift(value: UniffiByteArray): DeriveOptions;
       lower(value: DeriveOptions, alloc: RustBufferAllocator): UniffiByteArray;
     };
+    FfiConverterTypeDetectors: {
+      readFromCursor(c: Cursor): Detectors;
+      writeIntoCursor(value: Detectors, c: Cursor): void;
+      allocationSize(value: Detectors): number;
+      lift(value: UniffiByteArray): Detectors;
+      lower(value: Detectors, alloc: RustBufferAllocator): UniffiByteArray;
+    };
     FfiConverterTypeEndInclusivity: {
       readFromCursor(c: Cursor): EndInclusivity;
       writeIntoCursor(value: EndInclusivity, c: Cursor): void;
@@ -4066,6 +4073,13 @@ declare const _default$1: Readonly<{
       lift(value: UniffiByteArray): Item;
       lower(value: Item, alloc: RustBufferAllocator): UniffiByteArray;
     };
+    FfiConverterTypeLineage: {
+      readFromCursor(c: Cursor): Lineage;
+      writeIntoCursor(value: Lineage, c: Cursor): void;
+      allocationSize(value: Lineage): number;
+      lift(value: UniffiByteArray): Lineage;
+      lower(value: Lineage, alloc: RustBufferAllocator): UniffiByteArray;
+    };
     FfiConverterTypeManifest: {
       readFromCursor(c: Cursor): Manifest;
       writeIntoCursor(value: Manifest, c: Cursor): void;
@@ -4118,12 +4132,12 @@ declare const _default$1: Readonly<{
       lift(value: UniffiByteArray): RangeType;
       lower(value: RangeType, alloc: RustBufferAllocator): UniffiByteArray;
     };
-    FfiConverterTypeRecoveryCompletion: {
-      readFromCursor(c: Cursor): RecoveryCompletion;
-      writeIntoCursor(value: RecoveryCompletion, c: Cursor): void;
-      allocationSize(value: RecoveryCompletion): number;
-      lift(value: UniffiByteArray): RecoveryCompletion;
-      lower(value: RecoveryCompletion, alloc: RustBufferAllocator): UniffiByteArray;
+    FfiConverterTypeRecovery: {
+      readFromCursor(c: Cursor): Recovery;
+      writeIntoCursor(value: Recovery, c: Cursor): void;
+      allocationSize(value: Recovery): number;
+      lift(value: UniffiByteArray): Recovery;
+      lower(value: Recovery, alloc: RustBufferAllocator): UniffiByteArray;
     };
     FfiConverterTypeRecoveryDiscovery: {
       readFromCursor(c: Cursor): RecoveryDiscovery;
@@ -4132,13 +4146,6 @@ declare const _default$1: Readonly<{
       lift(value: UniffiByteArray): RecoveryDiscovery;
       lower(value: RecoveryDiscovery, alloc: RustBufferAllocator): UniffiByteArray;
     };
-    FfiConverterTypeRecoveryExecution: {
-      readFromCursor(c: Cursor): RecoveryExecution;
-      writeIntoCursor(value: RecoveryExecution, c: Cursor): void;
-      allocationSize(value: RecoveryExecution): number;
-      lift(value: UniffiByteArray): RecoveryExecution;
-      lower(value: RecoveryExecution, alloc: RustBufferAllocator): UniffiByteArray;
-    };
     FfiConverterTypeRecoveryIssue: {
       readFromCursor(c: Cursor): RecoveryIssue;
       writeIntoCursor(value: RecoveryIssue, c: Cursor): void;
@@ -4153,63 +4160,6 @@ declare const _default$1: Readonly<{
       lift(value: UniffiByteArray): RecoveryIssueKind;
       lower(value: RecoveryIssueKind, alloc: RustBufferAllocator): UniffiByteArray;
     };
-    FfiConverterTypeRecoveryPlan: {
-      readFromCursor(c: Cursor): {
-        /**
-         * @private
-         * This field is private and should not be used, use `tag` instead.
-         */
-        readonly [uniffiTypeNameSymbol]: "RecoveryPlan";
-        readonly tag: RecoveryPlan_Tags.Custom;
-        readonly inner: Readonly<{
-          stages: Array<RecoveryStage>;
-        }>;
-      };
-      writeIntoCursor(value: {
-        /**
-         * @private
-         * This field is private and should not be used, use `tag` instead.
-         */
-        readonly [uniffiTypeNameSymbol]: "RecoveryPlan";
-        readonly tag: RecoveryPlan_Tags.Custom;
-        readonly inner: Readonly<{
-          stages: Array<RecoveryStage>;
-        }>;
-      }, c: Cursor): void;
-      allocationSize(value: {
-        /**
-         * @private
-         * This field is private and should not be used, use `tag` instead.
-         */
-        readonly [uniffiTypeNameSymbol]: "RecoveryPlan";
-        readonly tag: RecoveryPlan_Tags.Custom;
-        readonly inner: Readonly<{
-          stages: Array<RecoveryStage>;
-        }>;
-      }): number;
-      lift(value: UniffiByteArray): {
-        /**
-         * @private
-         * This field is private and should not be used, use `tag` instead.
-         */
-        readonly [uniffiTypeNameSymbol]: "RecoveryPlan";
-        readonly tag: RecoveryPlan_Tags.Custom;
-        readonly inner: Readonly<{
-          stages: Array<RecoveryStage>;
-        }>;
-      };
-      lower(value: {
-        /**
-         * @private
-         * This field is private and should not be used, use `tag` instead.
-         */
-        readonly [uniffiTypeNameSymbol]: "RecoveryPlan";
-        readonly tag: RecoveryPlan_Tags.Custom;
-        readonly inner: Readonly<{
-          stages: Array<RecoveryStage>;
-        }>;
-      }, alloc: RustBufferAllocator): UniffiByteArray;
-    };
     FfiConverterTypeRecoveryPolicy: {
       readFromCursor(c: Cursor): RecoveryPolicy;
       writeIntoCursor(value: RecoveryPolicy, c: Cursor): void;
@@ -4217,20 +4167,6 @@ declare const _default$1: Readonly<{
       lift(value: UniffiByteArray): RecoveryPolicy;
       lower(value: RecoveryPolicy, alloc: RustBufferAllocator): UniffiByteArray;
     };
-    FfiConverterTypeRecoveryQuery: {
-      readFromCursor(c: Cursor): RecoveryQuery;
-      writeIntoCursor(value: RecoveryQuery, c: Cursor): void;
-      allocationSize(value: RecoveryQuery): number;
-      lift(value: UniffiByteArray): RecoveryQuery;
-      lower(value: RecoveryQuery, alloc: RustBufferAllocator): UniffiByteArray;
-    };
-    FfiConverterTypeRecoveryStage: {
-      readFromCursor(c: Cursor): RecoveryStage;
-      writeIntoCursor(value: RecoveryStage, c: Cursor): void;
-      allocationSize(value: RecoveryStage): number;
-      lift(value: UniffiByteArray): RecoveryStage;
-      lower(value: RecoveryStage, alloc: RustBufferAllocator): UniffiByteArray;
-    };
     FfiConverterTypeRecoveryStatus: {
       readFromCursor(c: Cursor): RecoveryStatus;
       writeIntoCursor(value: RecoveryStatus, c: Cursor): void;