@trylimbo/sdk-verifier 0.2.12-canary.25 → 0.2.12-canary.28

package/gen/ffi/index.d.ts

@@ -181,7 +181,7 @@ declare const pointerLiteralSymbol: unique symbol;
  */
 declare const uniffiTypeNameSymbol: unique symbol;
 declare namespace trylimbo_verifier_d_exports {
-  export { Actor, AssertionMetadata, AssetType, AssetVerification, AssetVerifier, AssetVerifierInterface, AssetVerifierLike, AssetVerifierOptions, Binder, BinderInterface, BinderLike, BinderPlugin, ByContent, ByReference, ClaimGeneratorInfo, Code, ContentBindingClass, ContentTrigger, Coordinate, CredentialOrigin, CredentialOrigin_Tags, DataSource, DeriveOptions, Detectors, Detectors_Tags, EndInclusivity, FieldViolation, FileSource, FileSourceInterface, FileSourceLike, FingerprintCheck, FingerprintCheck_Tags, FoundCredential, Frame, GoldenComparison, GoldenComparison_Tags, HardBinding, HashedUri, Ingredient, IngredientDeltaValidationResult, InitValidation, Item, Lineage, Manifest, ManifestAssertion, ManifestAssertionKind, ManifestStore, MediaValidation, MemorySource, MemorySourceInterface, MemorySourceLike, PluginRead, PluginRegistry, PluginRegistryInterface, PluginRegistryLike, Range, RangeSource, RangeSourceImpl, RangeType, Recovery, RecoveryDiscovery, RecoveryDiscovery_Tags, RecoveryIssue, RecoveryIssue_Tags, RecoveryPolicy, RecoveryStatus, RecoverySummary, Region, RegionOfInterest, RegistryOptions, Relationship, ResourceRef, ReviewRating, Role, SdkError, SdkError_Tags, SegmentTiming, SegmentValidation, SegmentValidation_Tags, SessionKeySummary, Shape, ShapeType, SignatureInfo, SigningAlgSchema, SimilarityScore, SoftBinding, StatusCodes, StreamValidation, StreamValidationInterface, StreamValidationLike, StreamVerifier, StreamVerifierInterface, StreamVerifierLike, StreamVerifierOptions, Text, TextSelector, TextSelectorRange, Time, TimeType, UnitType, UriOrResource, UriOrResource_Tags, ValidationCode, ValidationCodeKind, ValidationResults, ValidationState, ValidationStatus, Value, Verdict, VerdictRule, Verdict_Tags, VerifyOptions, c2paTrustList, c2paTsaTrustList, _default$1 as default, devCa, parse, resource, thumbnails };
+  export { Actor, AssertionMetadata, AssetFormat, AssetFormat_Tags, AssetType, AssetVerification, AssetVerifier, AssetVerifierInterface, AssetVerifierLike, AssetVerifierOptions, Binder, BinderImpl, ByContent, ByReference, ClaimGeneratorInfo, Code, ContentBindingClass, ContentTrigger, Coordinate, CredentialOrigin, CredentialOrigin_Tags, DataSource, DeriveOptions, EndInclusivity, FieldViolation, FileSource, FileSourceInterface, FileSourceLike, FingerprintCheck, FingerprintCheck_Tags, FoundCredential, Frame, GoldenComparison, GoldenComparison_Tags, HardBinding, HashedUri, HeldBinder, HeldBinderInterface, HeldBinderLike, Ingredient, IngredientDeltaValidationResult, InitValidation, IsccBinder, IsccBinderInterface, IsccBinderLike, Item, Lineage, Manifest, ManifestAssertion, ManifestAssertionKind, ManifestStore, MediaValidation, MemorySource, MemorySourceInterface, MemorySourceLike, PluginRead, Range, RangeSource, RangeSourceImpl, RangeType, Recovery, RecoveryDiscovery, RecoveryDiscovery_Tags, RecoveryIssue, RecoveryIssue_Tags, RecoveryPolicy, RecoveryStatus, RecoverySummary, Region, RegionOfInterest, Relationship, Repository, Repository_Tags, ResourceRef, ReviewRating, Role, SdkError, SdkError_Tags, SegmentTiming, SegmentValidation, SegmentValidation_Tags, SessionKeySummary, Shape, ShapeType, SignatureInfo, SigningAlgSchema, SimilarityScore, SoftBinding, StatusCodes, StreamValidation, StreamValidationInterface, StreamValidationLike, StreamVerifier, StreamVerifierInterface, StreamVerifierLike, StreamVerifierOptions, Text, TextSelector, TextSelectorRange, Time, TimeType, UnitType, UriOrResource, UriOrResource_Tags, ValidationCode, ValidationCodeKind, ValidationResults, ValidationState, ValidationStatus, Value, Verdict, VerdictRule, Verdict_Tags, c2paTrustList, c2paTsaTrustList, _default$1 as default, devCa, parse, resource, thumbnails };
 }
 /**
  * Official C2PA Conformance Program signing-CA trust anchors (a compile-time
@@ -198,7 +198,7 @@ export declare function c2paTsaTrustList(): string;
  */
 export declare function devCa(): string;
 /**
- * Parse a detached C2PA manifest store: a `.c2pa` sidecar, or the bytes a registry serves for a
+ * Parse a detached C2PA manifest store: a `.c2pa` sidecar, or the bytes a repository serves for a
  * manifest id.
  *
  * Contents, not a verdict. A hard binding is a hash of the asset, so a store read without one
@@ -806,7 +806,7 @@ export declare const SoftBinding: Readonly<{
   defaults: () => Partial<SoftBinding>;
 }>;
 /**
- * The class of binding a registry derived from an uploaded asset.
+ * The class of binding a repository derived from an uploaded asset.
  *
  * Unlike [`SoftBinding`], this carries no value: the C2PA `byContent` response does not return
  * one. The algorithm and class are still evidence because every request selects exactly one
@@ -833,8 +833,9 @@ export declare const RecoveryDiscovery: Readonly<{
       binderIndex: number;
       binding: SoftBinding;
       class: ContentBindingClass;
-      registryScore?: SimilarityScore;
-      endpoint?: string;
+      repositoryScore?: SimilarityScore;
+      repository: string;
+      fetchedFrom: string;
     }): {
       /**
        * @private
@@ -846,16 +847,18 @@ export declare const RecoveryDiscovery: Readonly<{
         binderIndex: number;
         binding: SoftBinding;
         class: ContentBindingClass;
-        registryScore?: SimilarityScore;
-        endpoint?: string;
+        repositoryScore?: SimilarityScore;
+        repository: string;
+        fetchedFrom: string;
       }>;
     };
     "new"(inner: {
       binderIndex: number;
       binding: SoftBinding;
       class: ContentBindingClass;
-      registryScore?: SimilarityScore;
-      endpoint?: string;
+      repositoryScore?: SimilarityScore;
+      repository: string;
+      fetchedFrom: string;
     }): {
       /**
        * @private
@@ -867,8 +870,9 @@ export declare const RecoveryDiscovery: Readonly<{
         binderIndex: number;
         binding: SoftBinding;
         class: ContentBindingClass;
-        registryScore?: SimilarityScore;
-        endpoint?: string;
+        repositoryScore?: SimilarityScore;
+        repository: string;
+        fetchedFrom: string;
       }>;
     };
     instanceOf(obj: any): obj is {
@@ -882,8 +886,9 @@ export declare const RecoveryDiscovery: Readonly<{
         binderIndex: number;
         binding: SoftBinding;
         class: ContentBindingClass;
-        registryScore?: SimilarityScore;
-        endpoint?: string;
+        repositoryScore?: SimilarityScore;
+        repository: string;
+        fetchedFrom: string;
       }>;
     };
   };
@@ -892,8 +897,9 @@ export declare const RecoveryDiscovery: Readonly<{
       algorithm: string;
       class: ContentBindingClass;
       hint?: SoftBinding;
-      registryScore?: SimilarityScore;
-      endpoint?: string;
+      repositoryScore?: SimilarityScore;
+      repository: string;
+      fetchedFrom: string;
     }): {
       /**
        * @private
@@ -905,16 +911,18 @@ export declare const RecoveryDiscovery: Readonly<{
         algorithm: string;
         class: ContentBindingClass;
         hint?: SoftBinding;
-        registryScore?: SimilarityScore;
-        endpoint?: string;
+        repositoryScore?: SimilarityScore;
+        repository: string;
+        fetchedFrom: string;
       }>;
     };
     "new"(inner: {
       algorithm: string;
       class: ContentBindingClass;
       hint?: SoftBinding;
-      registryScore?: SimilarityScore;
-      endpoint?: string;
+      repositoryScore?: SimilarityScore;
+      repository: string;
+      fetchedFrom: string;
     }): {
       /**
        * @private
@@ -926,8 +934,9 @@ export declare const RecoveryDiscovery: Readonly<{
         algorithm: string;
         class: ContentBindingClass;
         hint?: SoftBinding;
-        registryScore?: SimilarityScore;
-        endpoint?: string;
+        repositoryScore?: SimilarityScore;
+        repository: string;
+        fetchedFrom: string;
       }>;
     };
     instanceOf(obj: any): obj is {
@@ -941,8 +950,9 @@ export declare const RecoveryDiscovery: Readonly<{
         algorithm: string;
         class: ContentBindingClass;
         hint?: SoftBinding;
-        registryScore?: SimilarityScore;
-        endpoint?: string;
+        repositoryScore?: SimilarityScore;
+        repository: string;
+        fetchedFrom: string;
       }>;
     };
   };
@@ -951,8 +961,9 @@ export declare const RecoveryDiscovery: Readonly<{
       algorithm: string;
       class: ContentBindingClass;
       hint?: SoftBinding;
-      registryScore?: SimilarityScore;
-      endpoint?: string;
+      repositoryScore?: SimilarityScore;
+      repository: string;
+      fetchedFrom: string;
     }): {
       /**
        * @private
@@ -964,16 +975,18 @@ export declare const RecoveryDiscovery: Readonly<{
         algorithm: string;
         class: ContentBindingClass;
         hint?: SoftBinding;
-        registryScore?: SimilarityScore;
-        endpoint?: string;
+        repositoryScore?: SimilarityScore;
+        repository: string;
+        fetchedFrom: string;
       }>;
     };
     "new"(inner: {
       algorithm: string;
       class: ContentBindingClass;
       hint?: SoftBinding;
-      registryScore?: SimilarityScore;
-      endpoint?: string;
+      repositoryScore?: SimilarityScore;
+      repository: string;
+      fetchedFrom: string;
     }): {
       /**
        * @private
@@ -985,8 +998,9 @@ export declare const RecoveryDiscovery: Readonly<{
         algorithm: string;
         class: ContentBindingClass;
         hint?: SoftBinding;
-        registryScore?: SimilarityScore;
-        endpoint?: string;
+        repositoryScore?: SimilarityScore;
+        repository: string;
+        fetchedFrom: string;
       }>;
     };
     instanceOf(obj: any): obj is {
@@ -1000,13 +1014,203 @@ export declare const RecoveryDiscovery: Readonly<{
         algorithm: string;
         class: ContentBindingClass;
         hint?: SoftBinding;
-        registryScore?: SimilarityScore;
-        endpoint?: string;
+        repositoryScore?: SimilarityScore;
+        repository: string;
+        fetchedFrom: string;
       }>;
     };
   };
 }>;
 export type RecoveryDiscovery = InstanceType<typeof RecoveryDiscovery['ByBinding' | 'ByContent' | 'ByReference']>;
+export declare enum FingerprintCheck_Tags {
+  NotNeeded = "NotNeeded",
+  NothingToCompare = "NothingToCompare",
+  Unsupported = "Unsupported",
+  Indeterminate = "Indeterminate",
+  Compared = "Compared"
+}
+/**
+ * Whether the asset's own fingerprint backs up a manifest that a watermark led to.
+ *
+ * C2PA 2.4 1.2.2.3: a watermark can be lifted from one asset onto another, so a mark alone does
+ * not establish that the manifest it resolves to describes THIS asset. The mitigation the spec
+ * gives is to compare a fingerprint computed from the asset against the one the recovered
+ * manifest records, and `watermark-and-fingerprint` ends on exactly that comparison.
+ *
+ * Reported rather than enforced: a transcode legitimately shifts a fingerprint, so where the line
+ * falls is the relying party's policy, not this SDK's. What the SDK owes them is the measurement.
+ */
+export declare const FingerprintCheck: Readonly<{
+  instanceOf: (obj: any) => obj is FingerprintCheck;
+  NotNeeded: {
+    new (): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "FingerprintCheck";
+      readonly tag: FingerprintCheck_Tags.NotNeeded;
+    };
+    "new"(): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "FingerprintCheck";
+      readonly tag: FingerprintCheck_Tags.NotNeeded;
+    };
+    instanceOf(obj: any): obj is {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "FingerprintCheck";
+      readonly tag: FingerprintCheck_Tags.NotNeeded;
+    };
+  };
+  NothingToCompare: {
+    new (): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "FingerprintCheck";
+      readonly tag: FingerprintCheck_Tags.NothingToCompare;
+    };
+    "new"(): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "FingerprintCheck";
+      readonly tag: FingerprintCheck_Tags.NothingToCompare;
+    };
+    instanceOf(obj: any): obj is {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "FingerprintCheck";
+      readonly tag: FingerprintCheck_Tags.NothingToCompare;
+    };
+  };
+  Unsupported: {
+    new (inner: {
+      algorithm: string;
+    }): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "FingerprintCheck";
+      readonly tag: FingerprintCheck_Tags.Unsupported;
+      readonly inner: Readonly<{
+        algorithm: string;
+      }>;
+    };
+    "new"(inner: {
+      algorithm: string;
+    }): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "FingerprintCheck";
+      readonly tag: FingerprintCheck_Tags.Unsupported;
+      readonly inner: Readonly<{
+        algorithm: string;
+      }>;
+    };
+    instanceOf(obj: any): obj is {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "FingerprintCheck";
+      readonly tag: FingerprintCheck_Tags.Unsupported;
+      readonly inner: Readonly<{
+        algorithm: string;
+      }>;
+    };
+  };
+  Indeterminate: {
+    new (): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "FingerprintCheck";
+      readonly tag: FingerprintCheck_Tags.Indeterminate;
+    };
+    "new"(): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "FingerprintCheck";
+      readonly tag: FingerprintCheck_Tags.Indeterminate;
+    };
+    instanceOf(obj: any): obj is {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "FingerprintCheck";
+      readonly tag: FingerprintCheck_Tags.Indeterminate;
+    };
+  };
+  Compared: {
+    new (inner: {
+      score: SimilarityScore;
+    }): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "FingerprintCheck";
+      readonly tag: FingerprintCheck_Tags.Compared;
+      readonly inner: Readonly<{
+        score: SimilarityScore;
+      }>;
+    };
+    "new"(inner: {
+      score: SimilarityScore;
+    }): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "FingerprintCheck";
+      readonly tag: FingerprintCheck_Tags.Compared;
+      readonly inner: Readonly<{
+        score: SimilarityScore;
+      }>;
+    };
+    instanceOf(obj: any): obj is {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "FingerprintCheck";
+      readonly tag: FingerprintCheck_Tags.Compared;
+      readonly inner: Readonly<{
+        score: SimilarityScore;
+      }>;
+    };
+  };
+}>;
+/**
+ * Whether the asset's own fingerprint backs up a manifest that a watermark led to.
+ *
+ * C2PA 2.4 1.2.2.3: a watermark can be lifted from one asset onto another, so a mark alone does
+ * not establish that the manifest it resolves to describes THIS asset. The mitigation the spec
+ * gives is to compare a fingerprint computed from the asset against the one the recovered
+ * manifest records, and `watermark-and-fingerprint` ends on exactly that comparison.
+ *
+ * Reported rather than enforced: a transcode legitimately shifts a fingerprint, so where the line
+ * falls is the relying party's policy, not this SDK's. What the SDK owes them is the measurement.
+ */
+export type FingerprintCheck = InstanceType<typeof FingerprintCheck['NotNeeded' | 'NothingToCompare' | 'Unsupported' | 'Indeterminate' | 'Compared']>;
 export declare enum CredentialOrigin_Tags {
   Embedded = "Embedded",
   Recovered = "Recovered"
@@ -1046,6 +1250,7 @@ export declare const CredentialOrigin: Readonly<{
   Recovered: {
     new (inner: {
       discoveries: Array<RecoveryDiscovery>;
+      fingerprintCheck: FingerprintCheck;
     }): {
       /**
        * @private
@@ -1055,10 +1260,12 @@ export declare const CredentialOrigin: Readonly<{
       readonly tag: CredentialOrigin_Tags.Recovered;
       readonly inner: Readonly<{
         discoveries: Array<RecoveryDiscovery>;
+        fingerprintCheck: FingerprintCheck;
       }>;
     };
     "new"(inner: {
       discoveries: Array<RecoveryDiscovery>;
+      fingerprintCheck: FingerprintCheck;
     }): {
       /**
        * @private
@@ -1068,6 +1275,7 @@ export declare const CredentialOrigin: Readonly<{
       readonly tag: CredentialOrigin_Tags.Recovered;
       readonly inner: Readonly<{
         discoveries: Array<RecoveryDiscovery>;
+        fingerprintCheck: FingerprintCheck;
       }>;
     };
     instanceOf(obj: any): obj is {
@@ -1079,6 +1287,7 @@ export declare const CredentialOrigin: Readonly<{
       readonly tag: CredentialOrigin_Tags.Recovered;
       readonly inner: Readonly<{
         discoveries: Array<RecoveryDiscovery>;
+        fingerprintCheck: FingerprintCheck;
       }>;
     };
   };
@@ -1701,195 +1910,6 @@ export declare const ManifestStore: Readonly<{
   new: (partial: Partial<ManifestStore> & Required<Omit<ManifestStore, "activeManifest" | "validationResults" | "validationState" | "validationStatus">>) => ManifestStore;
   defaults: () => Partial<ManifestStore>;
 }>;
-export declare enum FingerprintCheck_Tags {
-  NotNeeded = "NotNeeded",
-  NothingToCompare = "NothingToCompare",
-  Unsupported = "Unsupported",
-  Indeterminate = "Indeterminate",
-  Compared = "Compared"
-}
-/**
- * Whether the asset's own fingerprint backs up a manifest that a watermark led to.
- *
- * C2PA 2.4 1.2.2.3: a watermark can be lifted from one asset onto another, so a mark alone does
- * not establish that the manifest it resolves to describes THIS asset. The mitigation the spec
- * gives is to compare a fingerprint computed from the asset against the one the recovered
- * manifest records, and `watermark-and-fingerprint` ends on exactly that comparison.
- *
- * Reported rather than enforced: a transcode legitimately shifts a fingerprint, so where the line
- * falls is the relying party's policy, not this SDK's. What the SDK owes them is the measurement.
- */
-export declare const FingerprintCheck: Readonly<{
-  instanceOf: (obj: any) => obj is FingerprintCheck;
-  NotNeeded: {
-    new (): {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "FingerprintCheck";
-      readonly tag: FingerprintCheck_Tags.NotNeeded;
-    };
-    "new"(): {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "FingerprintCheck";
-      readonly tag: FingerprintCheck_Tags.NotNeeded;
-    };
-    instanceOf(obj: any): obj is {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "FingerprintCheck";
-      readonly tag: FingerprintCheck_Tags.NotNeeded;
-    };
-  };
-  NothingToCompare: {
-    new (): {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "FingerprintCheck";
-      readonly tag: FingerprintCheck_Tags.NothingToCompare;
-    };
-    "new"(): {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "FingerprintCheck";
-      readonly tag: FingerprintCheck_Tags.NothingToCompare;
-    };
-    instanceOf(obj: any): obj is {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "FingerprintCheck";
-      readonly tag: FingerprintCheck_Tags.NothingToCompare;
-    };
-  };
-  Unsupported: {
-    new (inner: {
-      algorithm: string;
-    }): {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "FingerprintCheck";
-      readonly tag: FingerprintCheck_Tags.Unsupported;
-      readonly inner: Readonly<{
-        algorithm: string;
-      }>;
-    };
-    "new"(inner: {
-      algorithm: string;
-    }): {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "FingerprintCheck";
-      readonly tag: FingerprintCheck_Tags.Unsupported;
-      readonly inner: Readonly<{
-        algorithm: string;
-      }>;
-    };
-    instanceOf(obj: any): obj is {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "FingerprintCheck";
-      readonly tag: FingerprintCheck_Tags.Unsupported;
-      readonly inner: Readonly<{
-        algorithm: string;
-      }>;
-    };
-  };
-  Indeterminate: {
-    new (): {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "FingerprintCheck";
-      readonly tag: FingerprintCheck_Tags.Indeterminate;
-    };
-    "new"(): {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "FingerprintCheck";
-      readonly tag: FingerprintCheck_Tags.Indeterminate;
-    };
-    instanceOf(obj: any): obj is {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "FingerprintCheck";
-      readonly tag: FingerprintCheck_Tags.Indeterminate;
-    };
-  };
-  Compared: {
-    new (inner: {
-      score: SimilarityScore;
-    }): {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "FingerprintCheck";
-      readonly tag: FingerprintCheck_Tags.Compared;
-      readonly inner: Readonly<{
-        score: SimilarityScore;
-      }>;
-    };
-    "new"(inner: {
-      score: SimilarityScore;
-    }): {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "FingerprintCheck";
-      readonly tag: FingerprintCheck_Tags.Compared;
-      readonly inner: Readonly<{
-        score: SimilarityScore;
-      }>;
-    };
-    instanceOf(obj: any): obj is {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "FingerprintCheck";
-      readonly tag: FingerprintCheck_Tags.Compared;
-      readonly inner: Readonly<{
-        score: SimilarityScore;
-      }>;
-    };
-  };
-}>;
-/**
- * Whether the asset's own fingerprint backs up a manifest that a watermark led to.
- *
- * C2PA 2.4 1.2.2.3: a watermark can be lifted from one asset onto another, so a mark alone does
- * not establish that the manifest it resolves to describes THIS asset. The mitigation the spec
- * gives is to compare a fingerprint computed from the asset against the one the recovered
- * manifest records, and `watermark-and-fingerprint` ends on exactly that comparison.
- *
- * Reported rather than enforced: a transcode legitimately shifts a fingerprint, so where the line
- * falls is the relying party's policy, not this SDK's. What the SDK owes them is the measurement.
- */
-export type FingerprintCheck = InstanceType<typeof FingerprintCheck['NotNeeded' | 'NothingToCompare' | 'Unsupported' | 'Indeterminate' | 'Compared']>;
 /**
  * Whether the manifest's hard binding holds over the bytes this verify read.
  *
@@ -1912,7 +1932,7 @@ export declare enum HardBinding {
 /**
  * The re-sign chain, read from the validated stores themselves: C2PA 2.4 18.16.11 copies a
  * `parentOf` ingredient's manifest into its successor's store, so a link here was signed by the
- * successor. A registry's ordering is a hint; this is the evidence.
+ * successor. A repository's ordering is a hint; this is the evidence.
  */
 export type Lineage = {
   /**
@@ -1935,10 +1955,9 @@ export declare const Lineage: Readonly<{
   defaults: () => Partial<Lineage>;
 }>;
 /**
- * One `verify` result: the c2pa manifest store, where it came from, whether the asset's own
- * fingerprint backs it up, and whether its hard binding holds over the bytes read. The recovered
- * origin carries the same `SoftBinding` record `Binder.derive` returns, so a derived binding and
- * a recovering one are one type.
+ * One `verify` result: the c2pa manifest store, where it came from, and whether its hard
+ * binding holds over the bytes read. The recovered origin carries the same `SoftBinding` record
+ * `Binder.derive` returns, so a derived binding and a recovering one are one type.
  */
 export type FoundCredential = {
   /**
@@ -1956,10 +1975,6 @@ export type FoundCredential = {
    * validation state and results.
    */
   manifest: ManifestStore;
-  /**
-   * Whether the asset's own fingerprint backs up a mark that led here (C2PA 2.4 1.2.2.3).
-   */
-  fingerprintCheck: FingerprintCheck;
   /**
    * Whether the manifest's hard binding holds over the bytes this verify read.
    */
@@ -1992,6 +2007,7 @@ export declare enum RecoveryStatus {
 export declare enum RecoveryIssue_Tags {
   Binder = "Binder",
   DeprecatedAlgorithm = "DeprecatedAlgorithm",
+  BindingUndeclared = "BindingUndeclared",
   BindingQuery = "BindingQuery",
   QueryRefused = "QueryRefused",
   ContentForm = "ContentForm",
@@ -2004,7 +2020,7 @@ export declare enum RecoveryIssue_Tags {
   ResourceLimit = "ResourceLimit"
 }
 /**
- * Why registry recovery did not complete cleanly, or why one candidate was omitted while another
+ * Why repository recovery did not complete cleanly, or why one candidate was omitted while another
  * succeeded. Kept as data so a partial recovery never loses the rest of the lookup outcome, and
  * each kind carries exactly what it is about.
  */
@@ -2093,8 +2109,53 @@ export declare const RecoveryIssue: Readonly<{
       }>;
     };
   };
+  BindingUndeclared: {
+    new (inner: {
+      binderIndex: number;
+      algorithm: string;
+    }): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "RecoveryIssue";
+      readonly tag: RecoveryIssue_Tags.BindingUndeclared;
+      readonly inner: Readonly<{
+        binderIndex: number;
+        algorithm: string;
+      }>;
+    };
+    "new"(inner: {
+      binderIndex: number;
+      algorithm: string;
+    }): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "RecoveryIssue";
+      readonly tag: RecoveryIssue_Tags.BindingUndeclared;
+      readonly inner: Readonly<{
+        binderIndex: number;
+        algorithm: string;
+      }>;
+    };
+    instanceOf(obj: any): obj is {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "RecoveryIssue";
+      readonly tag: RecoveryIssue_Tags.BindingUndeclared;
+      readonly inner: Readonly<{
+        binderIndex: number;
+        algorithm: string;
+      }>;
+    };
+  };
   BindingQuery: {
     new (inner: {
+      repository: string;
       binderIndex: number;
       algorithm: string;
       message: string;
@@ -2106,12 +2167,14 @@ export declare const RecoveryIssue: Readonly<{
       readonly [uniffiTypeNameSymbol]: "RecoveryIssue";
       readonly tag: RecoveryIssue_Tags.BindingQuery;
       readonly inner: Readonly<{
+        repository: string;
         binderIndex: number;
         algorithm: string;
         message: string;
       }>;
     };
     "new"(inner: {
+      repository: string;
       binderIndex: number;
       algorithm: string;
       message: string;
@@ -2123,6 +2186,7 @@ export declare const RecoveryIssue: Readonly<{
       readonly [uniffiTypeNameSymbol]: "RecoveryIssue";
       readonly tag: RecoveryIssue_Tags.BindingQuery;
       readonly inner: Readonly<{
+        repository: string;
         binderIndex: number;
         algorithm: string;
         message: string;
@@ -2136,6 +2200,7 @@ export declare const RecoveryIssue: Readonly<{
       readonly [uniffiTypeNameSymbol]: "RecoveryIssue";
       readonly tag: RecoveryIssue_Tags.BindingQuery;
       readonly inner: Readonly<{
+        repository: string;
         binderIndex: number;
         algorithm: string;
         message: string;
@@ -2144,6 +2209,7 @@ export declare const RecoveryIssue: Readonly<{
   };
   QueryRefused: {
     new (inner: {
+      repository: string;
       algorithm: string;
       message: string;
     }): {
@@ -2154,11 +2220,13 @@ export declare const RecoveryIssue: Readonly<{
       readonly [uniffiTypeNameSymbol]: "RecoveryIssue";
       readonly tag: RecoveryIssue_Tags.QueryRefused;
       readonly inner: Readonly<{
+        repository: string;
         algorithm: string;
         message: string;
       }>;
     };
     "new"(inner: {
+      repository: string;
       algorithm: string;
       message: string;
     }): {
@@ -2169,6 +2237,7 @@ export declare const RecoveryIssue: Readonly<{
       readonly [uniffiTypeNameSymbol]: "RecoveryIssue";
       readonly tag: RecoveryIssue_Tags.QueryRefused;
       readonly inner: Readonly<{
+        repository: string;
         algorithm: string;
         message: string;
       }>;
@@ -2181,6 +2250,7 @@ export declare const RecoveryIssue: Readonly<{
       readonly [uniffiTypeNameSymbol]: "RecoveryIssue";
       readonly tag: RecoveryIssue_Tags.QueryRefused;
       readonly inner: Readonly<{
+        repository: string;
         algorithm: string;
         message: string;
       }>;
@@ -2188,6 +2258,7 @@ export declare const RecoveryIssue: Readonly<{
   };
   ContentForm: {
     new (inner: {
+      repository: string;
       message: string;
     }): {
       /**
@@ -2197,10 +2268,12 @@ export declare const RecoveryIssue: Readonly<{
       readonly [uniffiTypeNameSymbol]: "RecoveryIssue";
       readonly tag: RecoveryIssue_Tags.ContentForm;
       readonly inner: Readonly<{
+        repository: string;
         message: string;
       }>;
     };
     "new"(inner: {
+      repository: string;
       message: string;
     }): {
       /**
@@ -2210,6 +2283,7 @@ export declare const RecoveryIssue: Readonly<{
       readonly [uniffiTypeNameSymbol]: "RecoveryIssue";
       readonly tag: RecoveryIssue_Tags.ContentForm;
       readonly inner: Readonly<{
+        repository: string;
         message: string;
       }>;
     };
@@ -2221,12 +2295,14 @@ export declare const RecoveryIssue: Readonly<{
       readonly [uniffiTypeNameSymbol]: "RecoveryIssue";
       readonly tag: RecoveryIssue_Tags.ContentForm;
       readonly inner: Readonly<{
+        repository: string;
         message: string;
       }>;
     };
   };
   ContentQuery: {
     new (inner: {
+      repository: string;
       algorithm: string;
       message: string;
     }): {
@@ -2237,11 +2313,13 @@ export declare const RecoveryIssue: Readonly<{
       readonly [uniffiTypeNameSymbol]: "RecoveryIssue";
       readonly tag: RecoveryIssue_Tags.ContentQuery;
       readonly inner: Readonly<{
+        repository: string;
         algorithm: string;
         message: string;
       }>;
     };
     "new"(inner: {
+      repository: string;
       algorithm: string;
       message: string;
     }): {
@@ -2252,6 +2330,7 @@ export declare const RecoveryIssue: Readonly<{
       readonly [uniffiTypeNameSymbol]: "RecoveryIssue";
       readonly tag: RecoveryIssue_Tags.ContentQuery;
       readonly inner: Readonly<{
+        repository: string;
         algorithm: string;
         message: string;
       }>;
@@ -2264,6 +2343,7 @@ export declare const RecoveryIssue: Readonly<{
       readonly [uniffiTypeNameSymbol]: "RecoveryIssue";
       readonly tag: RecoveryIssue_Tags.ContentQuery;
       readonly inner: Readonly<{
+        repository: string;
         algorithm: string;
         message: string;
       }>;
@@ -2271,6 +2351,7 @@ export declare const RecoveryIssue: Readonly<{
   };
   Capabilities: {
     new (inner: {
+      repository: string;
       message: string;
     }): {
       /**
@@ -2280,10 +2361,12 @@ export declare const RecoveryIssue: Readonly<{
       readonly [uniffiTypeNameSymbol]: "RecoveryIssue";
       readonly tag: RecoveryIssue_Tags.Capabilities;
       readonly inner: Readonly<{
+        repository: string;
         message: string;
       }>;
     };
     "new"(inner: {
+      repository: string;
       message: string;
     }): {
       /**
@@ -2293,6 +2376,7 @@ export declare const RecoveryIssue: Readonly<{
       readonly [uniffiTypeNameSymbol]: "RecoveryIssue";
       readonly tag: RecoveryIssue_Tags.Capabilities;
       readonly inner: Readonly<{
+        repository: string;
         message: string;
       }>;
     };
@@ -2304,6 +2388,7 @@ export declare const RecoveryIssue: Readonly<{
       readonly [uniffiTypeNameSymbol]: "RecoveryIssue";
       readonly tag: RecoveryIssue_Tags.Capabilities;
       readonly inner: Readonly<{
+        repository: string;
         message: string;
       }>;
     };
@@ -2349,6 +2434,7 @@ export declare const RecoveryIssue: Readonly<{
   };
   CandidateFetch: {
     new (inner: {
+      repository: string;
       manifestId: string;
       message: string;
     }): {
@@ -2359,11 +2445,13 @@ export declare const RecoveryIssue: Readonly<{
       readonly [uniffiTypeNameSymbol]: "RecoveryIssue";
       readonly tag: RecoveryIssue_Tags.CandidateFetch;
       readonly inner: Readonly<{
+        repository: string;
         manifestId: string;
         message: string;
       }>;
     };
     "new"(inner: {
+      repository: string;
       manifestId: string;
       message: string;
     }): {
@@ -2374,6 +2462,7 @@ export declare const RecoveryIssue: Readonly<{
       readonly [uniffiTypeNameSymbol]: "RecoveryIssue";
       readonly tag: RecoveryIssue_Tags.CandidateFetch;
       readonly inner: Readonly<{
+        repository: string;
         manifestId: string;
         message: string;
       }>;
@@ -2386,6 +2475,7 @@ export declare const RecoveryIssue: Readonly<{
       readonly [uniffiTypeNameSymbol]: "RecoveryIssue";
       readonly tag: RecoveryIssue_Tags.CandidateFetch;
       readonly inner: Readonly<{
+        repository: string;
         manifestId: string;
         message: string;
       }>;
@@ -2437,6 +2527,7 @@ export declare const RecoveryIssue: Readonly<{
   };
   EndpointRefused: {
     new (inner: {
+      repository: string;
       manifestId: string;
       endpoint: string;
     }): {
@@ -2447,11 +2538,13 @@ export declare const RecoveryIssue: Readonly<{
       readonly [uniffiTypeNameSymbol]: "RecoveryIssue";
       readonly tag: RecoveryIssue_Tags.EndpointRefused;
       readonly inner: Readonly<{
+        repository: string;
         manifestId: string;
         endpoint: string;
       }>;
     };
     "new"(inner: {
+      repository: string;
       manifestId: string;
       endpoint: string;
     }): {
@@ -2462,6 +2555,7 @@ export declare const RecoveryIssue: Readonly<{
       readonly [uniffiTypeNameSymbol]: "RecoveryIssue";
       readonly tag: RecoveryIssue_Tags.EndpointRefused;
       readonly inner: Readonly<{
+        repository: string;
         manifestId: string;
         endpoint: string;
       }>;
@@ -2474,6 +2568,7 @@ export declare const RecoveryIssue: Readonly<{
       readonly [uniffiTypeNameSymbol]: "RecoveryIssue";
       readonly tag: RecoveryIssue_Tags.EndpointRefused;
       readonly inner: Readonly<{
+        repository: string;
         manifestId: string;
         endpoint: string;
       }>;
@@ -2520,13 +2615,13 @@ export declare const RecoveryIssue: Readonly<{
   };
 }>;
 /**
- * Why registry recovery did not complete cleanly, or why one candidate was omitted while another
+ * Why repository recovery did not complete cleanly, or why one candidate was omitted while another
  * succeeded. Kept as data so a partial recovery never loses the rest of the lookup outcome, and
  * each kind carries exactly what it is about.
  */
-export type RecoveryIssue = InstanceType<typeof RecoveryIssue['Binder' | 'DeprecatedAlgorithm' | 'BindingQuery' | 'QueryRefused' | 'ContentForm' | 'ContentQuery' | 'Capabilities' | 'ContentTooLarge' | 'CandidateFetch' | 'CandidateValidation' | 'EndpointRefused' | 'ResourceLimit']>;
+export type RecoveryIssue = InstanceType<typeof RecoveryIssue['Binder' | 'DeprecatedAlgorithm' | 'BindingUndeclared' | 'BindingQuery' | 'QueryRefused' | 'ContentForm' | 'ContentQuery' | 'Capabilities' | 'ContentTooLarge' | 'CandidateFetch' | 'CandidateValidation' | 'EndpointRefused' | 'ResourceLimit']>;
 /**
- * Registry recovery outcome and every non-fatal issue encountered on the way.
+ * Repository recovery outcome and every non-fatal issue encountered on the way.
  */
 export type RecoverySummary = {
   status: RecoveryStatus;
@@ -2552,7 +2647,7 @@ export declare enum GoldenComparison_Tags {
 }
 /**
  * Typed completion of C2PA 2.4's `watermark-golden` / `fingerprint-golden` final comparison:
- * the local active manifest against what the registry holds. Every outcome is its own variant.
+ * the local active manifest against what the repository holds. Every outcome is its own variant.
  */
 export declare const GoldenComparison: Readonly<{
   instanceOf: (obj: any) => obj is GoldenComparison;
@@ -2819,7 +2914,7 @@ export declare const GoldenComparison: Readonly<{
 }>;
 /**
  * Typed completion of C2PA 2.4's `watermark-golden` / `fingerprint-golden` final comparison:
- * the local active manifest against what the registry holds. Every outcome is its own variant.
+ * the local active manifest against what the repository holds. Every outcome is its own variant.
  */
 export type GoldenComparison = InstanceType<typeof GoldenComparison['NotRequested' | 'NoEmbeddedManifest' | 'NoRecoveredManifest' | 'RecoveryIncomplete' | 'Matches' | 'Differs' | 'NoneMatches' | 'Unreadable']>;
 /**
@@ -2850,13 +2945,13 @@ export declare enum Verdict_Tags {
  * and the list stays whole beside it.
  *
  * The embedded manifest is the verdict whenever the asset carries one that is not `Invalid`
- * and the golden comparison does not contradict it. When it `differs` from what the registry
+ * and the golden comparison does not contradict it. When it `differs` from what the repository
  * holds, or several recovered candidates leave the comparison indeterminate, the embedded and
  * the recovered manifests are reported as ambiguous: C2PA 2.4's substitution use case leaves
  * that trust decision to the client. Otherwise a recovered candidate is named only when
  * evidence singles it out: it is the only one, or the only one no other credential in this
  * report supersedes (the successor's signed `parentOf` link), or the only one of those whose
- * hard binding holds over these bytes. A registry score, a signature time or a position in the
+ * hard binding holds over these bytes. A repository score, a signature time or a position in the
  * list is not evidence of which manifest belongs to these bytes, so candidates those alone would
  * separate are reported as ambiguous.
  */
@@ -3074,13 +3169,13 @@ export declare const Verdict: Readonly<{
  * and the list stays whole beside it.
  *
  * The embedded manifest is the verdict whenever the asset carries one that is not `Invalid`
- * and the golden comparison does not contradict it. When it `differs` from what the registry
+ * and the golden comparison does not contradict it. When it `differs` from what the repository
  * holds, or several recovered candidates leave the comparison indeterminate, the embedded and
  * the recovered manifests are reported as ambiguous: C2PA 2.4's substitution use case leaves
  * that trust decision to the client. Otherwise a recovered candidate is named only when
  * evidence singles it out: it is the only one, or the only one no other credential in this
  * report supersedes (the successor's signed `parentOf` link), or the only one of those whose
- * hard binding holds over these bytes. A registry score, a signature time or a position in the
+ * hard binding holds over these bytes. A repository score, a signature time or a position in the
  * list is not evidence of which manifest belongs to these bytes, so candidates those alone would
  * separate are reported as ambiguous.
  */
@@ -3103,66 +3198,146 @@ export declare const AssetVerification: Readonly<{
   new: (partial: Partial<AssetVerification> & Required<Omit<AssetVerification, never>>) => AssetVerification;
   defaults: () => Partial<AssetVerification>;
 }>;
+export declare enum Repository_Tags {
+  Named = "Named",
+  Listed = "Listed"
+}
 /**
- * Where the registry is. What a verify may do with it is per call, in [`Recovery`].
+ * One C2PA manifest repository, as the Soft Binding Resolution API spec lets a client find it.
  */
-export type RegistryOptions = {
-  /**
-   * Soft Binding Resolution API base URL (`https://registry.trylimbo.com`).
-   */
-  url: string;
-  /**
-   * Federated resolution APIs a match may name as holding its manifest, beside the ones the
-   * C2PA algorithm list publishes, which are always allowed. C2PA 2.4 lets a match carry an
-   * `endpoint`; one allowed is fetched from, any other is reported as refused. Checked like
-   * `url`: https, or http on loopback only.
-   */
-  endpoints: Array<string>;
-};
+export declare const Repository: Readonly<{
+  instanceOf: (obj: any) => obj is Repository;
+  Named: {
+    new (inner: {
+      url: string;
+      algorithms: Array<string>;
+    }): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "Repository";
+      readonly tag: Repository_Tags.Named;
+      readonly inner: Readonly<{
+        url: string;
+        algorithms: Array<string>;
+      }>;
+    };
+    "new"(inner: {
+      url: string;
+      algorithms: Array<string>;
+    }): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "Repository";
+      readonly tag: Repository_Tags.Named;
+      readonly inner: Readonly<{
+        url: string;
+        algorithms: Array<string>;
+      }>;
+    };
+    instanceOf(obj: any): obj is {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "Repository";
+      readonly tag: Repository_Tags.Named;
+      readonly inner: Readonly<{
+        url: string;
+        algorithms: Array<string>;
+      }>;
+    };
+  };
+  Listed: {
+    new (inner: {
+      algorithm: string;
+    }): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "Repository";
+      readonly tag: Repository_Tags.Listed;
+      readonly inner: Readonly<{
+        algorithm: string;
+      }>;
+    };
+    "new"(inner: {
+      algorithm: string;
+    }): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "Repository";
+      readonly tag: Repository_Tags.Listed;
+      readonly inner: Readonly<{
+        algorithm: string;
+      }>;
+    };
+    instanceOf(obj: any): obj is {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "Repository";
+      readonly tag: Repository_Tags.Listed;
+      readonly inner: Readonly<{
+        algorithm: string;
+      }>;
+    };
+  };
+}>;
 /**
- * Generated factory for {@link RegistryOptions} record objects.
+ * One C2PA manifest repository, as the Soft Binding Resolution API spec lets a client find it.
  */
-export declare const RegistryOptions: Readonly<{
-  create: (partial: Partial<RegistryOptions> & Required<Omit<RegistryOptions, "endpoints">>) => RegistryOptions;
-  new: (partial: Partial<RegistryOptions> & Required<Omit<RegistryOptions, "endpoints">>) => RegistryOptions;
-  defaults: () => Partial<RegistryOptions>;
-}>;
+export type Repository = InstanceType<typeof Repository['Named' | 'Listed']>;
 /**
  * Construction options for [`AssetVerifier::new`] (and the `AssetVerifier.create` JS
- * binding). `trust_c2pa_anchors` defaults to `true` when omitted.
+ * binding). Every field is stated: nothing here is chosen on the caller's behalf.
  *
  * One definition, all lanes: `#[binding]` derives the shapes directly here:
- * tsify (camelCase, optional fields) on wasm, a `uniffi::Record` on the native
- * `ffi` build, so there is no per-lane DTO copy. Off both lanes it is a plain struct.
+ * tsify (camelCase) on wasm, a `uniffi::Record` on the native `ffi` build, so there is no
+ * per-lane DTO copy. Off both lanes it is a plain struct.
  */
 export type AssetVerifierOptions = {
   /**
-   * The registry to recover from. Omit for a verifier that only checks embedded manifests.
+   * The C2PA manifest repositories recovery asks, each a Soft Binding Resolution API declared
+   * for exactly the algorithms it may be asked for. Results merge by manifest, and a match's
+   * `endpoint` is fetched from only when it names one of these. Empty: no recovery can be
+   * asked of this verifier.
    */
-  registry?: RegistryOptions;
+  repositories: Array<Repository>;
   /**
-   * PEM trust anchors for the caller's own issuers.
+   * PEM trust anchors for the manifest signers the caller trusts.
    */
   trustAnchors: Array<string>;
   /**
-   * Also trust the bundled official C2PA anchors on top of `trust_anchors`.
-   * Defaults to `true`; set `false` to trust only `trust_anchors`.
+   * PEM trust anchors for the time-stamping authorities the caller trusts.
+   */
+  tsaTrustAnchors: Array<string>;
+  /**
+   * Also trust the bundled official C2PA anchors, manifest and TSA lists, beside the
+   * caller's. `false` trusts the caller's lists alone.
    */
-  trustC2paAnchors?: boolean;
+  trustC2paAnchors: boolean;
   /**
    * Issuer DIDs whose CAWG identity (ICA) credentials count as validated, matched
-   * exactly against the credential issuer. Omitted or empty trusts no issuer: every
-   * identity assertion then reports `cawg.ica.untrusted_issuer` and withholds
-   * `cawg.ica.credential_valid`, which leaves the manifest's own validity untouched.
+   * exactly against the credential issuer. Empty trusts no issuer: every identity assertion
+   * then reports `cawg.ica.untrusted_issuer` and withholds `cawg.ica.credential_valid`,
+   * which leaves the manifest's own validity untouched.
    */
-  trustedIcaIssuers?: Array<string>;
+  trustedIcaIssuers: Array<string>;
 };
 /**
  * Generated factory for {@link AssetVerifierOptions} record objects.
  */
 export declare const AssetVerifierOptions: Readonly<{
-  create: (partial: Partial<AssetVerifierOptions> & Required<Omit<AssetVerifierOptions, "registry" | "trustC2paAnchors" | "trustedIcaIssuers">>) => AssetVerifierOptions;
-  new: (partial: Partial<AssetVerifierOptions> & Required<Omit<AssetVerifierOptions, "registry" | "trustC2paAnchors" | "trustedIcaIssuers">>) => AssetVerifierOptions;
+  create: (partial: Partial<AssetVerifierOptions> & Required<Omit<AssetVerifierOptions, never>>) => AssetVerifierOptions;
+  new: (partial: Partial<AssetVerifierOptions> & Required<Omit<AssetVerifierOptions, never>>) => AssetVerifierOptions;
   defaults: () => Partial<AssetVerifierOptions>;
 }>;
 /**
@@ -3178,121 +3353,106 @@ export declare enum ContentTrigger {
    */
   Always = 1
 }
-export declare enum Detectors_Tags {
-  Fingerprint = "Fingerprint",
-  Watermark = "Watermark",
-  All = "All",
-  Named = "Named"
+/**
+ * `matches/byContent`: the asset is uploaded to each repository, one request per algorithm that
+ * repository is declared for.
+ */
+export type ByContent = {
+  after: ContentTrigger;
+};
+/**
+ * Generated factory for {@link ByContent} record objects.
+ */
+export declare const ByContent: Readonly<{
+  create: (partial: Partial<ByContent> & Required<Omit<ByContent, never>>) => ByContent;
+  new: (partial: Partial<ByContent> & Required<Omit<ByContent, never>>) => ByContent;
+  defaults: () => Partial<ByContent>;
+}>;
+/**
+ * `matches/byReference`: each repository downloads the asset from `url`, one request per
+ * algorithm it is declared for, so the client reads no bytes for it.
+ */
+export type ByReference = {
+  after: ContentTrigger;
+  /**
+   * A short-lived https URL without credentials.
+   */
+  url: string;
+  /**
+   * The asset's size in bytes, which caps the repository's download.
+   */
+  length: bigint;
+  mediaType?: string;
+};
+/**
+ * Generated factory for {@link ByReference} record objects.
+ */
+export declare const ByReference: Readonly<{
+  create: (partial: Partial<ByReference> & Required<Omit<ByReference, "mediaType">>) => ByReference;
+  new: (partial: Partial<ByReference> & Required<Omit<ByReference, "mediaType">>) => ByReference;
+  defaults: () => Partial<ByReference>;
+}>;
+export declare enum AssetFormat_Tags {
+  Sniff = "Sniff",
+  Declared = "Declared"
 }
 /**
- * Which advertised server-side detectors a content form runs. Every selected detector runs,
- * including one a local binder already queried by binding.
+ * The format of the asset a call is handed. Stated, never defaulted: sniffing is a choice the
+ * caller makes by name, not what happens when they say nothing.
  */
-export declare const Detectors: Readonly<{
-  instanceOf: (obj: any) => obj is Detectors;
-  Fingerprint: {
-    new (): {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "Detectors";
-      readonly tag: Detectors_Tags.Fingerprint;
-    };
-    "new"(): {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "Detectors";
-      readonly tag: Detectors_Tags.Fingerprint;
-    };
-    instanceOf(obj: any): obj is {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "Detectors";
-      readonly tag: Detectors_Tags.Fingerprint;
-    };
-  };
-  Watermark: {
-    new (): {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "Detectors";
-      readonly tag: Detectors_Tags.Watermark;
-    };
-    "new"(): {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "Detectors";
-      readonly tag: Detectors_Tags.Watermark;
-    };
-    instanceOf(obj: any): obj is {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "Detectors";
-      readonly tag: Detectors_Tags.Watermark;
-    };
-  };
-  All: {
+export declare const AssetFormat: Readonly<{
+  instanceOf: (obj: any) => obj is AssetFormat;
+  Sniff: {
     new (): {
       /**
        * @private
        * This field is private and should not be used, use `tag` instead.
        */
-      readonly [uniffiTypeNameSymbol]: "Detectors";
-      readonly tag: Detectors_Tags.All;
+      readonly [uniffiTypeNameSymbol]: "AssetFormat";
+      readonly tag: AssetFormat_Tags.Sniff;
     };
     "new"(): {
       /**
        * @private
        * This field is private and should not be used, use `tag` instead.
        */
-      readonly [uniffiTypeNameSymbol]: "Detectors";
-      readonly tag: Detectors_Tags.All;
+      readonly [uniffiTypeNameSymbol]: "AssetFormat";
+      readonly tag: AssetFormat_Tags.Sniff;
     };
     instanceOf(obj: any): obj is {
       /**
        * @private
        * This field is private and should not be used, use `tag` instead.
        */
-      readonly [uniffiTypeNameSymbol]: "Detectors";
-      readonly tag: Detectors_Tags.All;
+      readonly [uniffiTypeNameSymbol]: "AssetFormat";
+      readonly tag: AssetFormat_Tags.Sniff;
     };
   };
-  Named: {
+  Declared: {
     new (inner: {
-      algorithms: Array<string>;
+      mediaType: string;
     }): {
       /**
        * @private
        * This field is private and should not be used, use `tag` instead.
        */
-      readonly [uniffiTypeNameSymbol]: "Detectors";
-      readonly tag: Detectors_Tags.Named;
+      readonly [uniffiTypeNameSymbol]: "AssetFormat";
+      readonly tag: AssetFormat_Tags.Declared;
       readonly inner: Readonly<{
-        algorithms: Array<string>;
+        mediaType: string;
       }>;
     };
     "new"(inner: {
-      algorithms: Array<string>;
+      mediaType: string;
     }): {
       /**
        * @private
        * This field is private and should not be used, use `tag` instead.
        */
-      readonly [uniffiTypeNameSymbol]: "Detectors";
-      readonly tag: Detectors_Tags.Named;
+      readonly [uniffiTypeNameSymbol]: "AssetFormat";
+      readonly tag: AssetFormat_Tags.Declared;
       readonly inner: Readonly<{
-        algorithms: Array<string>;
+        mediaType: string;
       }>;
     };
     instanceOf(obj: any): obj is {
@@ -3300,72 +3460,31 @@ export declare const Detectors: Readonly<{
        * @private
        * This field is private and should not be used, use `tag` instead.
        */
-      readonly [uniffiTypeNameSymbol]: "Detectors";
-      readonly tag: Detectors_Tags.Named;
+      readonly [uniffiTypeNameSymbol]: "AssetFormat";
+      readonly tag: AssetFormat_Tags.Declared;
       readonly inner: Readonly<{
-        algorithms: Array<string>;
+        mediaType: string;
       }>;
     };
   };
 }>;
 /**
- * Which advertised server-side detectors a content form runs. Every selected detector runs,
- * including one a local binder already queried by binding.
- */
-export type Detectors = InstanceType<typeof Detectors['Fingerprint' | 'Watermark' | 'All' | 'Named']>;
-/**
- * One `matches/byContent` upload per selected detector.
- */
-export type ByContent = {
-  after: ContentTrigger;
-  detectors: Detectors;
-};
-/**
- * Generated factory for {@link ByContent} record objects.
- */
-export declare const ByContent: Readonly<{
-  create: (partial: Partial<ByContent> & Required<Omit<ByContent, never>>) => ByContent;
-  new: (partial: Partial<ByContent> & Required<Omit<ByContent, never>>) => ByContent;
-  defaults: () => Partial<ByContent>;
-}>;
-/**
- * One `matches/byReference` query per selected detector. The registry downloads the asset
- * from `url`, so the client reads no bytes for it.
- */
-export type ByReference = {
-  after: ContentTrigger;
-  detectors: Detectors;
-  /**
-   * A short-lived https URL without credentials.
-   */
-  url: string;
-  /**
-   * The asset's size in bytes, which caps the registry's download.
-   */
-  length: bigint;
-  mediaType?: string;
-};
-/**
- * Generated factory for {@link ByReference} record objects.
+ * The format of the asset a call is handed. Stated, never defaulted: sniffing is a choice the
+ * caller makes by name, not what happens when they say nothing.
  */
-export declare const ByReference: Readonly<{
-  create: (partial: Partial<ByReference> & Required<Omit<ByReference, "mediaType">>) => ByReference;
-  new: (partial: Partial<ByReference> & Required<Omit<ByReference, "mediaType">>) => ByReference;
-  defaults: () => Partial<ByReference>;
-}>;
+export type AssetFormat = InstanceType<typeof AssetFormat['Sniff' | 'Declared']>;
 /**
- * Everything one [`Binder::derive`] needs beyond the asset. `format` overrides the format sniffed
- * from the leading bytes.
+ * Everything one [`Binder::derive`] needs beyond the asset.
  */
 export type DeriveOptions = {
-  format?: string;
+  format: AssetFormat;
 };
 /**
  * Generated factory for {@link DeriveOptions} record objects.
  */
 export declare const DeriveOptions: Readonly<{
-  create: (partial: Partial<DeriveOptions> & Required<Omit<DeriveOptions, "format">>) => DeriveOptions;
-  new: (partial: Partial<DeriveOptions> & Required<Omit<DeriveOptions, "format">>) => DeriveOptions;
+  create: (partial: Partial<DeriveOptions> & Required<Omit<DeriveOptions, never>>) => DeriveOptions;
+  new: (partial: Partial<DeriveOptions> & Required<Omit<DeriveOptions, never>>) => DeriveOptions;
   defaults: () => Partial<DeriveOptions>;
 }>;
 /**
@@ -3402,7 +3521,8 @@ export declare enum ValidationCodeKind {
   Failure = 2
 }
 /**
- * One C2PA validation status entry (spec §15.3).
+ * One C2PA validation status entry (spec §15.3): the registered code, its kind, and the
+ * spec's own free-text `explanation`, which is where anything finer than the code lives.
  */
 export type ValidationCode = {
   /**
@@ -3410,13 +3530,18 @@ export type ValidationCode = {
    */
   code: string;
   kind: ValidationCodeKind;
+  /**
+   * Prose for a reader, never a value to branch on: a stream failure names which of the
+   * registered code's listed causes it hit here.
+   */
+  explanation?: string;
 };
 /**
  * Generated factory for {@link ValidationCode} record objects.
  */
 export declare const ValidationCode: Readonly<{
-  create: (partial: Partial<ValidationCode> & Required<Omit<ValidationCode, never>>) => ValidationCode;
-  new: (partial: Partial<ValidationCode> & Required<Omit<ValidationCode, never>>) => ValidationCode;
+  create: (partial: Partial<ValidationCode> & Required<Omit<ValidationCode, "explanation">>) => ValidationCode;
+  new: (partial: Partial<ValidationCode> & Required<Omit<ValidationCode, "explanation">>) => ValidationCode;
   defaults: () => Partial<ValidationCode>;
 }>;
 /**
@@ -3488,141 +3613,52 @@ export type SegmentTiming = {
 export declare const SegmentTiming: Readonly<{
   create: (partial: Partial<SegmentTiming> & Required<Omit<SegmentTiming, "eventDurationSecs" | "timescale">>) => SegmentTiming;
   new: (partial: Partial<SegmentTiming> & Required<Omit<SegmentTiming, "eventDurationSecs" | "timescale">>) => SegmentTiming;
-  defaults: () => Partial<SegmentTiming>;
-}>;
-/**
- * Outcome of validating a media segment against its stream's init.
- */
-export type MediaValidation = {
-  valid: boolean;
-  codes: Array<ValidationCode>;
-  keyId: ArrayBuffer;
-  timing: SegmentTiming;
-  manifestId: string;
-};
-/**
- * Generated factory for {@link MediaValidation} record objects.
- */
-export declare const MediaValidation: Readonly<{
-  create: (partial: Partial<MediaValidation> & Required<Omit<MediaValidation, never>>) => MediaValidation;
-  new: (partial: Partial<MediaValidation> & Required<Omit<MediaValidation, never>>) => MediaValidation;
-  defaults: () => Partial<MediaValidation>;
-}>;
-/**
- * When [`AssetVerifier::verify_asset`] queries the registry.
- */
-export declare enum RecoveryPolicy {
-  /**
-   * When the asset has no embedded manifest or its active manifest is invalid. This includes
-   * stripped assets and invalid manifests, for which C2PA 2.4 permits soft-binding discovery.
-   * A valid embedded manifest costs no registry round trip.
-   */
-  WhenMissing = 0,
-  /**
-   * On every verify, alongside the embedded manifest, so the two can be compared.
-   *
-   * C2PA 2.4's `watermark-golden` and `fingerprint-golden` flows end on exactly that
-   * comparison, and it is the only thing that catches a manifest SUBSTITUTED under an
-   * untouched mark (use case UC3 in the spec's list, UC2 in ours): the replacement verifies
-   * perfectly on its own, and only disagrees with what the mark actually resolves to.
-   *
-   * It queries the registry on every verify, without making it load-bearing on the asset's own
-   * credential: the flow provides information about a substitution rather than gating the local
-   * manifest, so a registry that cannot be reached leaves [`RecoveryStatus::Incomplete`], the
-   * reason as a [`RecoveryIssue`], and [`GoldenComparison::RecoveryIncomplete`]. A caller for whom a
-   * cross-check that never ran must not pass for agreement branches on that status.
-   */
-  Always = 1
-}
-/**
- * What one verify may do with the registry. Required whenever a registry is configured.
- *
- * One field per Soft Binding Resolution API operation, and an absent one is not called.
- * `matches/byBinding` is decided by the binders handed to the verify: each is derived and looked
- * up, all together, and every result is kept. The content forms run after that, each for the
- * detectors it names, hinted with the first fingerprint the binders derived. Results merge by
- * manifest; nothing is ranked or dropped.
- */
-export type Recovery = {
-  /**
-   * When the registry is consulted at all.
-   */
-  when: RecoveryPolicy;
-  /**
-   * `matches/byContent`: the bounded asset bytes travel in the request.
-   */
-  byContent?: ByContent;
-  /**
-   * `matches/byReference`: the registry fetches the asset from the caller's URL instead, for
-   * an asset above the upload cap.
-   */
-  byReference?: ByReference;
-};
-/**
- * Generated factory for {@link Recovery} record objects.
- */
-export declare const Recovery: Readonly<{
-  create: (partial: Partial<Recovery> & Required<Omit<Recovery, "byContent" | "byReference">>) => Recovery;
-  new: (partial: Partial<Recovery> & Required<Omit<Recovery, "byContent" | "byReference">>) => Recovery;
-  defaults: () => Partial<Recovery>;
+  defaults: () => Partial<SegmentTiming>;
 }>;
 /**
- * A byte range holding a bare C2PA manifest store, or reserved for one. A record of
- * primitives, so a plugin in its OWN UniFFI namespace declares a structurally identical
- * one and the two cross the boundary without sharing a Rust type.
+ * Outcome of validating a media segment against its stream's init.
  */
-export type Region = {
-  offset: bigint;
-  length: bigint;
+export type MediaValidation = {
+  valid: boolean;
+  codes: Array<ValidationCode>;
+  keyId: ArrayBuffer;
+  timing: SegmentTiming;
+  manifestId: string;
 };
 /**
- * Generated factory for {@link Region} record objects.
+ * Generated factory for {@link MediaValidation} record objects.
  */
-export declare const Region: Readonly<{
-  create: (partial: Partial<Region> & Required<Omit<Region, never>>) => Region;
-  new: (partial: Partial<Region> & Required<Omit<Region, never>>) => Region;
-  defaults: () => Partial<Region>;
+export declare const MediaValidation: Readonly<{
+  create: (partial: Partial<MediaValidation> & Required<Omit<MediaValidation, never>>) => MediaValidation;
+  new: (partial: Partial<MediaValidation> & Required<Omit<MediaValidation, never>>) => MediaValidation;
+  defaults: () => Partial<MediaValidation>;
 }>;
 /**
- * Construction options for [`StreamVerifier::new`] (and the `StreamVerifier.create`
- * JS binding). `trust_c2pa_anchors` defaults to `true` when omitted.
- *
- * `#[binding]` derives the wasm shape (`trustC2paAnchors` camelCase, optional) and,
- * with `ffi`, a `uniffi::Record` for the native `StreamVerifier.create` binding, so there
- * is no per-lane DTO copy. Off both lanes it is a plain struct.
+ * When [`AssetVerifier::verify_asset`] queries the repository.
  */
-export type StreamVerifierOptions = {
-  /**
-   * PEM trust anchors for the caller's own issuers.
-   */
-  trustAnchors: Array<string>;
-  /**
-   * Also trust the bundled official C2PA anchors on top of `trust_anchors`.
-   * Defaults to `true`; set `false` to trust only `trust_anchors`.
-   */
-  trustC2paAnchors?: boolean;
+export declare enum RecoveryPolicy {
   /**
-   * Issuer DIDs whose CAWG identity (ICA) credentials count as validated, matched
-   * exactly against the credential issuer. Omitted or empty trusts no issuer: an
-   * identity assertion on the init segment's manifest then reports
-   * `cawg.ica.untrusted_issuer` and withholds `cawg.ica.credential_valid`.
+   * When the asset has no embedded manifest or its active manifest is invalid. This includes
+   * stripped assets and invalid manifests, for which C2PA 2.4 permits soft-binding discovery.
+   * A valid embedded manifest costs no repository round trip.
    */
-  trustedIcaIssuers?: Array<string>;
+  WhenMissing = 0,
   /**
-   * How far a segment's timestamp may sit from wall-clock before it is rejected as
-   * skewed. Defaults to [`DEFAULT_SEGMENT_SKEW_TOLERANCE_SECS`]. A deployment whose
-   * encoder clock drifts further than that needs this rather than a fork.
+   * On every verify, alongside the embedded manifest, so the two can be compared.
+   *
+   * C2PA 2.4's `watermark-golden` and `fingerprint-golden` flows end on exactly that
+   * comparison, and it is the only thing that catches a manifest SUBSTITUTED under an
+   * untouched mark (use case UC3 in the spec's list, UC2 in ours): the replacement verifies
+   * perfectly on its own, and only disagrees with what the mark actually resolves to.
+   *
+   * It queries the repository on every verify, without making it load-bearing on the asset's own
+   * credential: the flow provides information about a substitution rather than gating the local
+   * manifest, so a repository that cannot be reached leaves [`RecoveryStatus::Incomplete`], the
+   * reason as a [`RecoveryIssue`], and [`GoldenComparison::RecoveryIncomplete`]. A caller for whom a
+   * cross-check that never ran must not pass for agreement branches on that status.
    */
-  segmentSkewToleranceSecs?: bigint;
-};
-/**
- * Generated factory for {@link StreamVerifierOptions} record objects.
- */
-export declare const StreamVerifierOptions: Readonly<{
-  create: (partial: Partial<StreamVerifierOptions> & Required<Omit<StreamVerifierOptions, "segmentSkewToleranceSecs" | "trustC2paAnchors" | "trustedIcaIssuers">>) => StreamVerifierOptions;
-  new: (partial: Partial<StreamVerifierOptions> & Required<Omit<StreamVerifierOptions, "segmentSkewToleranceSecs" | "trustC2paAnchors" | "trustedIcaIssuers">>) => StreamVerifierOptions;
-  defaults: () => Partial<StreamVerifierOptions>;
-}>;
+  Always = 1
+}
 /**
  * A canonical gRPC/Connect status code: the coarse, closed failure class.
  *
@@ -4047,189 +4083,122 @@ export declare class RangeSourceImpl extends UniffiAbstractObject implements Ran
   static instanceOf(obj_: any): obj_ is RangeSourceImpl;
 }
 /**
- * A soft-binding binder: how a recoverable binding is derived from an asset. Put these inside the
- * issuer's manifest mode to sign and index under them, and pass them in verify options to recover.
+ * A soft-binding binder: how a recoverable binding is derived from an asset. Put these inside
+ * the issuer's manifest mode to sign and index under them, and pass them in verify options to
+ * recover. Implement it for an algorithm the SDK does not ship; the SDK's own are
+ * [`IsccBinder`] and [`HeldBinder`].
+ *
+ * `derive` answers this binder's binding for `source`, or `None` when there is none.
+ * `options.format` is how the asset's format is known. `None` and an error
+ * mean different things: `None` is "no binding here", an error is "the question could not be
+ * answered", so a binder that failed never reads as an unmarked asset.
  */
-export interface BinderLike {
-  /**
-   * This binder's binding for `source`, or `None` when there is none. `format` overrides
-   * the format sniffed from the leading bytes.
-   *
-   * `None` and an error mean different things: `None` is "no binding here", an error is
-   * "the question could not be answered", so a binder that failed never reads as an
-   * unmarked asset.
-   *
-   * # Errors
-   *
-   * An unreadable source, or a binder that could not answer.
-   */
+export interface Binder {
   derive(source: RangeSource, options: DeriveOptions, asyncOpts_?: {
     signal: AbortSignal;
   }): Promise<SoftBinding | undefined>;
 }
 /**
- * @deprecated Use `BinderLike` instead.
- */
-export type BinderInterface = BinderLike;
-/**
- * A soft-binding binder: how a recoverable binding is derived from an asset. Put these inside the
- * issuer's manifest mode to sign and index under them, and pass them in verify options to recover.
+ * A soft-binding binder: how a recoverable binding is derived from an asset. Put these inside
+ * the issuer's manifest mode to sign and index under them, and pass them in verify options to
+ * recover. Implement it for an algorithm the SDK does not ship; the SDK's own are
+ * [`IsccBinder`] and [`HeldBinder`].
+ *
+ * `derive` answers this binder's binding for `source`, or `None` when there is none.
+ * `options.format` is how the asset's format is known. `None` and an error
+ * mean different things: `None` is "no binding here", an error is "the question could not be
+ * answered", so a binder that failed never reads as an unmarked asset.
  */
-export declare class Binder extends UniffiAbstractObject implements BinderLike {
-  readonly [uniffiTypeNameSymbol] = "Binder";
+export declare class BinderImpl extends UniffiAbstractObject implements Binder {
+  readonly [uniffiTypeNameSymbol] = "BinderImpl";
   readonly [destructorGuardSymbol]: UniffiGcObject;
   readonly [pointerLiteralSymbol]: UniffiHandle;
   private constructor();
-  /**
-   * A caller-supplied binder for a soft-binding algorithm not built into the SDK.
-   */
-  static custom(plugin: BinderPlugin): BinderLike;
-  /**
-   * A binding you already hold, such as an out-of-band video ISCC. Reads nothing.
-   */
-  static held(binding: SoftBinding): BinderLike;
-  /**
-   * Local ISCC Image-Code for supported image formats.
-   */
-  static iscc(): BinderLike;
-  /**
-   * This binder's binding for `source`, or `None` when there is none. `format` overrides
-   * the format sniffed from the leading bytes.
-   *
-   * `None` and an error mean different things: `None` is "no binding here", an error is
-   * "the question could not be answered", so a binder that failed never reads as an
-   * unmarked asset.
-   *
-   * # Errors
-   *
-   * An unreadable source, or a binder that could not answer.
-   */
   derive(source: RangeSource, options: DeriveOptions, asyncOpts_?: {
     signal: AbortSignal;
   }): Promise<SoftBinding | undefined>;
   uniffiDestroy(): void;
-  static instanceOf(obj_: any): obj_ is Binder;
+  static instanceOf(obj_: any): obj_ is BinderImpl;
 }
 /**
- * The read surface a plugin implements. Implemented by the CALLER, in Rust
- * behind its own cdylib or directly in the host language, and handed to `verify`.
- *
- * Every method is given the asset as a [`RangeSource`], so a plugin never opens its own
- * view and the bytes it parses are the bytes the core hashes.
+ * What one [`AssetVerifier::verify`] may do to recover a manifest: the binders this client
+ * derives for itself, decided into `matches/byBinding`, and one field per content operation,
+ * absent when not to be called. It needs a configured repository and at least one query.
  */
-export interface PluginRead {
-  /**
-   * The media types this plugin owns: its dispatch set, declared as data. The core
-   * asserts a [`sniff`](Self::sniff) result is a member of this list.
-   */
-  mediaTypes(): Array<string>;
-  /**
-   * Recognize the format from the real asset, or `None` to decline it.
-   */
-  sniff(src: RangeSource, asyncOpts_?: {
-    signal: AbortSignal;
-  }): Promise<string | undefined>;
-  /**
-   * The manifest window(s), or empty when none is present. MUST be byte-identical
-   * regardless of slot contents (empty at sign, filled after embed, zeroed after strip).
-   */
-  locate(src: RangeSource, asyncOpts_?: {
-    signal: AbortSignal;
-  }): Promise<Array<Region>>;
-}
+export type Recovery = {
+  when: RecoveryPolicy;
+  binders: Array<Binder>;
+  byContent?: ByContent;
+  byReference?: ByReference;
+};
 /**
- * The plugins one `verify` call may dispatch to. Rust-backed on purpose: see
- * the module docs for why a plain sequence of foreign objects cannot cross today.
+ * Generated factory for {@link Recovery} record objects.
  */
-export interface PluginRegistryLike {
-  /**
-   * Whether no plugin is registered, meaning a c2pa-only verify.
-   *
-   * # Errors
-   *
-   * `Internal` when the registry lock was poisoned by a panicking plugin.
-   */
-  isEmpty(): boolean;
-  /**
-   * How many plugins are registered.
-   *
-   * # Errors
-   *
-   * `Internal` when the registry lock was poisoned by a panicking plugin.
-   */
-  len(): number;
-  /**
-   * Add one plugin. The first registered whose `sniff` hits owns the asset; `c2pa`
-   * remains the built-in fallback when none does. Verifying dispatches on content, not on
-   * a declared format: there is no trustworthy declaration at verify time.
-   *
-   * # Errors
-   *
-   * `Internal` when the registry lock was poisoned by a panicking plugin.
-   */
-  register(plugin: PluginRead): void;
-}
+export declare const Recovery: Readonly<{
+  create: (partial: Partial<Recovery> & Required<Omit<Recovery, "byContent" | "byReference">>) => Recovery;
+  new: (partial: Partial<Recovery> & Required<Omit<Recovery, "byContent" | "byReference">>) => Recovery;
+  defaults: () => Partial<Recovery>;
+}>;
 /**
- * @deprecated Use `PluginRegistryLike` instead.
+ * A byte range holding a bare C2PA manifest store, or reserved for one. A record of
+ * primitives, so a plugin in its OWN UniFFI namespace declares a structurally identical
+ * one and the two cross the boundary without sharing a Rust type.
  */
-export type PluginRegistryInterface = PluginRegistryLike;
+export type Region = {
+  offset: bigint;
+  length: bigint;
+};
 /**
- * The plugins one `verify` call may dispatch to. Rust-backed on purpose: see
- * the module docs for why a plain sequence of foreign objects cannot cross today.
+ * Generated factory for {@link Region} record objects.
  */
-export declare class PluginRegistry extends UniffiAbstractObject implements PluginRegistryLike {
-  readonly [uniffiTypeNameSymbol] = "PluginRegistry";
-  readonly [destructorGuardSymbol]: UniffiGcObject;
-  readonly [pointerLiteralSymbol]: UniffiHandle;
-  constructor();
+export declare const Region: Readonly<{
+  create: (partial: Partial<Region> & Required<Omit<Region, never>>) => Region;
+  new: (partial: Partial<Region> & Required<Omit<Region, never>>) => Region;
+  defaults: () => Partial<Region>;
+}>;
+/**
+ * Construction options for [`StreamVerifier::new`] (and the `StreamVerifier.create`
+ * JS binding). Every field is stated: nothing here is chosen on the caller's behalf.
+ *
+ * `#[binding]` derives the wasm shape (`trustC2paAnchors` camelCase) and,
+ * with `ffi`, a `uniffi::Record` for the native `StreamVerifier.create` binding, so there
+ * is no per-lane DTO copy. Off both lanes it is a plain struct.
+ */
+export type StreamVerifierOptions = {
   /**
-   * Whether no plugin is registered, meaning a c2pa-only verify.
-   *
-   * # Errors
-   *
-   * `Internal` when the registry lock was poisoned by a panicking plugin.
+   * PEM trust anchors for the manifest signers the caller trusts.
+   */
+  trustAnchors: Array<string>;
+  /**
+   * PEM trust anchors for the time-stamping authorities the caller trusts.
    */
-  isEmpty(): boolean;
+  tsaTrustAnchors: Array<string>;
   /**
-   * How many plugins are registered.
-   *
-   * # Errors
-   *
-   * `Internal` when the registry lock was poisoned by a panicking plugin.
+   * Also trust the bundled official C2PA anchors, manifest and TSA lists, beside the
+   * caller's. `false` trusts the caller's lists alone.
    */
-  len(): number;
+  trustC2paAnchors: boolean;
   /**
-   * Add one plugin. The first registered whose `sniff` hits owns the asset; `c2pa`
-   * remains the built-in fallback when none does. Verifying dispatches on content, not on
-   * a declared format: there is no trustworthy declaration at verify time.
-   *
-   * # Errors
-   *
-   * `Internal` when the registry lock was poisoned by a panicking plugin.
+   * Issuer DIDs whose CAWG identity (ICA) credentials count as validated, matched
+   * exactly against the credential issuer. Empty trusts no issuer: an identity assertion
+   * on the init segment's manifest then reports `cawg.ica.untrusted_issuer` and withholds
+   * `cawg.ica.credential_valid`.
    */
-  register(plugin: PluginRead): void;
-  uniffiDestroy(): void;
-  static instanceOf(obj_: any): obj_ is PluginRegistry;
-}
-/**
- * Everything one [`AssetVerifier::verify`] needs beyond the asset.
- *
- * `recovery` is required when the verifier has a registry and absent for embedded-only
- * verification. `plugins` carries caller plugins for non-c2pa formats (e.g. MXF); a built-in
- * C2PA media format needs none.
- */
-export type VerifyOptions = {
-  binders: Array<BinderLike>;
-  recovery?: Recovery;
-  plugins?: PluginRegistryLike;
+  trustedIcaIssuers: Array<string>;
+  /**
+   * How far a segment's timestamp may sit from wall-clock before it is rejected as
+   * skewed, in seconds: the deployment's own encoder-clock allowance, stated rather than
+   * assumed.
+   */
+  segmentSkewToleranceSecs: bigint;
 };
 /**
- * Generated factory for {@link VerifyOptions} record objects.
+ * Generated factory for {@link StreamVerifierOptions} record objects.
  */
-export declare const VerifyOptions: Readonly<{
-  create: (partial: Partial<VerifyOptions> & Required<Omit<VerifyOptions, "plugins" | "recovery">>) => VerifyOptions;
-  new: (partial: Partial<VerifyOptions> & Required<Omit<VerifyOptions, "plugins" | "recovery">>) => VerifyOptions;
-  defaults: () => Partial<VerifyOptions>;
+export declare const StreamVerifierOptions: Readonly<{
+  create: (partial: Partial<StreamVerifierOptions> & Required<Omit<StreamVerifierOptions, never>>) => StreamVerifierOptions;
+  new: (partial: Partial<StreamVerifierOptions> & Required<Omit<StreamVerifierOptions, never>>) => StreamVerifierOptions;
+  defaults: () => Partial<StreamVerifierOptions>;
 }>;
 export declare enum SegmentValidation_Tags {
   Init = "Init",
@@ -4330,24 +4299,52 @@ export declare const SegmentValidation: Readonly<{
  * Result of `StreamValidation.validate`.
  */
 export type SegmentValidation = InstanceType<typeof SegmentValidation['Init' | 'Media' | 'Unknown']>;
+/**
+ * The read surface a plugin implements. Implemented by the CALLER, in Rust
+ * behind its own cdylib or directly in the host language, and handed to `verify`.
+ *
+ * Every method is given the asset as a [`RangeSource`], so a plugin never opens its own
+ * view and the bytes it parses are the bytes the core hashes.
+ */
+export interface PluginRead {
+  /**
+   * The media types this plugin owns: its dispatch set, declared as data. The core
+   * asserts a [`sniff`](Self::sniff) result is a member of this list.
+   */
+  mediaTypes(): Array<string>;
+  /**
+   * Recognize the format from the real asset, or `None` to decline it.
+   */
+  sniff(src: RangeSource, asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<string | undefined>;
+  /**
+   * The manifest window(s), or empty when none is present. MUST be byte-identical
+   * regardless of slot contents (empty at sign, filled after embed, zeroed after strip).
+   */
+  locate(src: RangeSource, asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<Array<Region>>;
+}
 /**
  * A C2PA asset verifier bound to a trust configuration. Construct once, verify many.
  */
 export interface AssetVerifierLike {
   /**
-   * Verify an asset from a [`RangeSource`] using the per-call binders and recovery options.
-   * `plugins` carries the caller's
-   * plugins for non-c2pa formats (e.g. MXF); pass an empty `PluginRegistry` for a
-   * built-in C2PA media format. The SDK links no plugin itself. Returns embedded/recovered
-   * credentials plus typed recovery and golden-comparison outcomes.
+   * Verify an asset from a [`RangeSource`]. `recovery` is what this verify may do to recover
+   * a manifest, or nothing: then the asset is read for what it carries and no repository is
+   * asked. `plugins` are the caller's plugins for non-c2pa formats (e.g. MXF), in dispatch
+   * order; an empty list is a built-in C2PA media format. The SDK links no plugin itself.
+   * Returns embedded/recovered credentials plus typed recovery and golden-comparison
+   * outcomes.
    *
    * # Errors
    *
-   * `READER_INVALID` when the source can't be read/parsed, or a registry failure
-   * involving the asset backend, registry, or a fetched manifest. Local binder faults,
+   * `READER_INVALID` when the source can't be read/parsed, or a repository failure
+   * involving the asset backend, repository, or a fetched manifest. Local binder faults,
    * refused queries, and skipped oversized uploads are retained in the recovery summary.
    */
-  verify(source: RangeSource, options: VerifyOptions, asyncOpts_?: {
+  verify(source: RangeSource, recovery: Recovery | undefined, plugins: Array<PluginRead>, asyncOpts_?: {
     signal: AbortSignal;
   }): Promise<AssetVerification>;
 }
@@ -4372,19 +4369,20 @@ export declare class AssetVerifier extends UniffiAbstractObject implements Asset
    */
   static create(options: AssetVerifierOptions): AssetVerifierLike;
   /**
-   * Verify an asset from a [`RangeSource`] using the per-call binders and recovery options.
-   * `plugins` carries the caller's
-   * plugins for non-c2pa formats (e.g. MXF); pass an empty `PluginRegistry` for a
-   * built-in C2PA media format. The SDK links no plugin itself. Returns embedded/recovered
-   * credentials plus typed recovery and golden-comparison outcomes.
+   * Verify an asset from a [`RangeSource`]. `recovery` is what this verify may do to recover
+   * a manifest, or nothing: then the asset is read for what it carries and no repository is
+   * asked. `plugins` are the caller's plugins for non-c2pa formats (e.g. MXF), in dispatch
+   * order; an empty list is a built-in C2PA media format. The SDK links no plugin itself.
+   * Returns embedded/recovered credentials plus typed recovery and golden-comparison
+   * outcomes.
    *
    * # Errors
    *
-   * `READER_INVALID` when the source can't be read/parsed, or a registry failure
-   * involving the asset backend, registry, or a fetched manifest. Local binder faults,
+   * `READER_INVALID` when the source can't be read/parsed, or a repository failure
+   * involving the asset backend, repository, or a fetched manifest. Local binder faults,
    * refused queries, and skipped oversized uploads are retained in the recovery summary.
    */
-  verify(source: RangeSource, options: VerifyOptions, asyncOpts_?: {
+  verify(source: RangeSource, recovery: Recovery | undefined, plugins: Array<PluginRead>, asyncOpts_?: {
     signal: AbortSignal;
   }): Promise<AssetVerification>;
   uniffiDestroy(): void;
@@ -4456,6 +4454,63 @@ export declare class FileSource extends UniffiAbstractObject implements FileSour
   uniffiDestroy(): void;
   static instanceOf(obj_: any): obj_ is FileSource;
 }
+/**
+ * A binding you already hold, such as an out-of-band video ISCC. Reads nothing.
+ */
+export interface HeldBinderLike {
+  derive(source: RangeSource, options: DeriveOptions, asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<SoftBinding | undefined>;
+}
+/**
+ * @deprecated Use `HeldBinderLike` instead.
+ */
+export type HeldBinderInterface = HeldBinderLike;
+/**
+ * A binding you already hold, such as an out-of-band video ISCC. Reads nothing.
+ */
+export declare class HeldBinder extends UniffiAbstractObject implements HeldBinderLike {
+  readonly [uniffiTypeNameSymbol] = "HeldBinder";
+  readonly [destructorGuardSymbol]: UniffiGcObject;
+  readonly [pointerLiteralSymbol]: UniffiHandle;
+  /**
+   * # Errors
+   *
+   * A binding with an empty algorithm or value.
+   */
+  constructor(binding: SoftBinding);
+  derive(source: RangeSource, options: DeriveOptions, asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<SoftBinding | undefined>;
+  uniffiDestroy(): void;
+  static instanceOf(obj_: any): obj_ is HeldBinder;
+}
+/**
+ * Local ISCC Image-Code for supported image formats.
+ */
+export interface IsccBinderLike {
+  derive(source: RangeSource, options: DeriveOptions, asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<SoftBinding | undefined>;
+}
+/**
+ * @deprecated Use `IsccBinderLike` instead.
+ */
+export type IsccBinderInterface = IsccBinderLike;
+/**
+ * Local ISCC Image-Code for supported image formats.
+ */
+export declare class IsccBinder extends UniffiAbstractObject implements IsccBinderLike {
+  readonly [uniffiTypeNameSymbol] = "IsccBinder";
+  readonly [destructorGuardSymbol]: UniffiGcObject;
+  readonly [pointerLiteralSymbol]: UniffiHandle;
+  constructor();
+  derive(source: RangeSource, options: DeriveOptions, asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<SoftBinding | undefined>;
+  uniffiDestroy(): void;
+  static instanceOf(obj_: any): obj_ is IsccBinder;
+}
 /**
  * An in-memory [`RangeSource`], for a caller that already holds the whole asset as
  * bytes and doesn't want to write a custom source. A **native** implementation of a
@@ -4671,19 +4726,6 @@ export declare class StreamVerifier extends UniffiAbstractObject implements Stre
   uniffiDestroy(): void;
   static instanceOf(obj_: any): obj_ is StreamVerifier;
 }
-/**
- * A caller-supplied soft-binding implementation.
- *
- * This is the extension point for algorithms the SDK does not ship. The callback receives the
- * same ranged asset source and resolved media type as the built-in binders and may return no
- * binding when the algorithm does not apply. The returned `alg` identifies the C2PA algorithm
- * used by the caller's recovery plan and registry index.
- */
-export interface BinderPlugin {
-  derive(source: RangeSource, format: string, asyncOpts_?: {
-    signal: AbortSignal;
-  }): Promise<SoftBinding | undefined>;
-}
 /**
  * This should be called before anything else.
  *
@@ -4712,6 +4754,13 @@ declare const _default$1: Readonly<{
       lift(value: UniffiByteArray): AssertionMetadata;
       lower(value: AssertionMetadata, alloc: RustBufferAllocator): UniffiByteArray;
     };
+    FfiConverterTypeAssetFormat: {
+      readFromCursor(c: Cursor): AssetFormat;
+      writeIntoCursor(value: AssetFormat, c: Cursor): void;
+      allocationSize(value: AssetFormat): number;
+      lift(value: UniffiByteArray): AssetFormat;
+      lower(value: AssetFormat, alloc: RustBufferAllocator): UniffiByteArray;
+    };
     FfiConverterTypeAssetType: {
       readFromCursor(c: Cursor): AssetType;
       writeIntoCursor(value: AssetType, c: Cursor): void;
@@ -4734,7 +4783,7 @@ declare const _default$1: Readonly<{
       lift(value: UniffiByteArray): AssetVerifierOptions;
       lower(value: AssetVerifierOptions, alloc: RustBufferAllocator): UniffiByteArray;
     };
-    FfiConverterTypeBinder: FfiConverterObject<BinderLike>;
+    FfiConverterTypeBinder: FfiConverterObjectWithCallbacks<Binder>;
     FfiConverterTypeByContent: {
       readFromCursor(c: Cursor): ByContent;
       writeIntoCursor(value: ByContent, c: Cursor): void;
@@ -4805,13 +4854,6 @@ declare const _default$1: Readonly<{
       lift(value: UniffiByteArray): DeriveOptions;
       lower(value: DeriveOptions, alloc: RustBufferAllocator): UniffiByteArray;
     };
-    FfiConverterTypeDetectors: {
-      readFromCursor(c: Cursor): Detectors;
-      writeIntoCursor(value: Detectors, c: Cursor): void;
-      allocationSize(value: Detectors): number;
-      lift(value: UniffiByteArray): Detectors;
-      lower(value: Detectors, alloc: RustBufferAllocator): UniffiByteArray;
-    };
     FfiConverterTypeEndInclusivity: {
       readFromCursor(c: Cursor): EndInclusivity;
       writeIntoCursor(value: EndInclusivity, c: Cursor): void;
@@ -4869,6 +4911,7 @@ declare const _default$1: Readonly<{
       lift(value: UniffiByteArray): HashedUri;
       lower(value: HashedUri, alloc: RustBufferAllocator): UniffiByteArray;
     };
+    FfiConverterTypeHeldBinder: FfiConverterObject<HeldBinderLike>;
     FfiConverterTypeIngredient: {
       readFromCursor(c: Cursor): Ingredient;
       writeIntoCursor(value: Ingredient, c: Cursor): void;
@@ -4890,6 +4933,7 @@ declare const _default$1: Readonly<{
       lift(value: UniffiByteArray): InitValidation;
       lower(value: InitValidation, alloc: RustBufferAllocator): UniffiByteArray;
     };
+    FfiConverterTypeIsccBinder: FfiConverterObject<IsccBinderLike>;
     FfiConverterTypeItem: {
       readFromCursor(c: Cursor): Item;
       writeIntoCursor(value: Item, c: Cursor): void;
@@ -4940,7 +4984,6 @@ declare const _default$1: Readonly<{
       lower(value: MediaValidation, alloc: RustBufferAllocator): UniffiByteArray;
     };
     FfiConverterTypeMemorySource: FfiConverterObject<MemorySourceLike>;
-    FfiConverterTypePluginRegistry: FfiConverterObject<PluginRegistryLike>;
     FfiConverterTypeRange: {
       readFromCursor(c: Cursor): Range;
       writeIntoCursor(value: Range, c: Cursor): void;
@@ -5012,13 +5055,6 @@ declare const _default$1: Readonly<{
       lift(value: UniffiByteArray): RegionOfInterest;
       lower(value: RegionOfInterest, alloc: RustBufferAllocator): UniffiByteArray;
     };
-    FfiConverterTypeRegistryOptions: {
-      readFromCursor(c: Cursor): RegistryOptions;
-      writeIntoCursor(value: RegistryOptions, c: Cursor): void;
-      allocationSize(value: RegistryOptions): number;
-      lift(value: UniffiByteArray): RegistryOptions;
-      lower(value: RegistryOptions, alloc: RustBufferAllocator): UniffiByteArray;
-    };
     FfiConverterTypeRelationship: {
       readFromCursor(c: Cursor): Relationship;
       writeIntoCursor(value: Relationship, c: Cursor): void;
@@ -5026,6 +5062,13 @@ declare const _default$1: Readonly<{
       lift(value: UniffiByteArray): Relationship;
       lower(value: Relationship, alloc: RustBufferAllocator): UniffiByteArray;
     };
+    FfiConverterTypeRepository: {
+      readFromCursor(c: Cursor): Repository;
+      writeIntoCursor(value: Repository, c: Cursor): void;
+      allocationSize(value: Repository): number;
+      lift(value: UniffiByteArray): Repository;
+      lower(value: Repository, alloc: RustBufferAllocator): UniffiByteArray;
+    };
     FfiConverterTypeResourceRef: {
       readFromCursor(c: Cursor): ResourceRef;
       writeIntoCursor(value: ResourceRef, c: Cursor): void;
@@ -5226,13 +5269,6 @@ declare const _default$1: Readonly<{
       lift(value: UniffiByteArray): VerdictRule;
       lower(value: VerdictRule, alloc: RustBufferAllocator): UniffiByteArray;
     };
-    FfiConverterTypeVerifyOptions: {
-      readFromCursor(c: Cursor): VerifyOptions;
-      writeIntoCursor(value: VerifyOptions, c: Cursor): void;
-      allocationSize(value: VerifyOptions): number;
-      lift(value: UniffiByteArray): VerifyOptions;
-      lower(value: VerifyOptions, alloc: RustBufferAllocator): UniffiByteArray;
-    };
   };
 }>;
 //#endregion