@trylimbo/sdk-verifier 0.2.12-canary.26 → 0.2.12-canary.29

package/gen/ffi/index.d.ts

@@ -181,7 +181,7 @@ declare const pointerLiteralSymbol: unique symbol;
  */
 declare const uniffiTypeNameSymbol: unique symbol;
 declare namespace trylimbo_verifier_d_exports {
-  export { Actor, AssertionMetadata, AssetType, AssetVerification, AssetVerifier, AssetVerifierInterface, AssetVerifierLike, AssetVerifierOptions, Binder, BinderInterface, BinderLike, BinderPlugin, ByContent, ByReference, ClaimGeneratorInfo, Code, ContentBindingClass, ContentTrigger, Coordinate, CredentialOrigin, CredentialOrigin_Tags, DataSource, DeriveOptions, Detectors, Detectors_Tags, EndInclusivity, FieldViolation, FileSource, FileSourceInterface, FileSourceLike, FingerprintCheck, FingerprintCheck_Tags, FoundCredential, Frame, GoldenComparison, GoldenComparison_Tags, HardBinding, HashedUri, Ingredient, IngredientDeltaValidationResult, InitValidation, Item, Lineage, Manifest, ManifestAssertion, ManifestAssertionKind, ManifestStore, MediaValidation, MemorySource, MemorySourceInterface, MemorySourceLike, PluginRead, PluginRegistry, PluginRegistryInterface, PluginRegistryLike, Range, RangeSource, RangeSourceImpl, RangeType, Recovery, RecoveryDiscovery, RecoveryDiscovery_Tags, RecoveryIssue, RecoveryIssue_Tags, RecoveryPolicy, RecoveryStatus, RecoverySummary, Region, RegionOfInterest, RegistryOptions, Relationship, ResourceRef, ReviewRating, Role, SdkError, SdkError_Tags, SegmentTiming, SegmentValidation, SegmentValidation_Tags, SessionKeySummary, Shape, ShapeType, SignatureInfo, SigningAlgSchema, SimilarityScore, SoftBinding, StatusCodes, StreamValidation, StreamValidationInterface, StreamValidationLike, StreamVerifier, StreamVerifierInterface, StreamVerifierLike, StreamVerifierOptions, Text, TextSelector, TextSelectorRange, Time, TimeType, UnitType, UriOrResource, UriOrResource_Tags, ValidationCode, ValidationCodeKind, ValidationResults, ValidationState, ValidationStatus, Value, Verdict, VerdictRule, Verdict_Tags, VerifyOptions, c2paTrustList, c2paTsaTrustList, _default$1 as default, devCa, parse, resource, thumbnails };
+  export { Actor, AssertionMetadata, AssetFormat, AssetFormat_Tags, AssetType, AssetVerification, AssetVerifier, AssetVerifierInterface, AssetVerifierLike, AssetVerifierOptions, Binder, BinderImpl, ByContent, ByReference, ClaimGeneratorInfo, Code, ContentBindingClass, ContentTrigger, Coordinate, Credential, CredentialOrigin, CredentialOrigin_Tags, DataSource, DeriveOptions, EndInclusivity, FieldViolation, FileSource, FileSourceInterface, FileSourceLike, FingerprintCheck, FingerprintCheck_Tags, Frame, GoldenComparison, GoldenComparison_Tags, HardBinding, HashedUri, HeldBinder, HeldBinderInterface, HeldBinderLike, Ingredient, IngredientDeltaValidationResult, InitValidation, IsccBinder, IsccBinderInterface, IsccBinderLike, Item, JsonValue, Lineage, Manifest, ManifestAssertion, ManifestAssertionKind, ManifestStore, MediaValidation, MemorySource, MemorySourceInterface, MemorySourceLike, PluginReader, Range, RangeSource, RangeSourceImpl, RangeType, Recovery, RecoveryDiscovery, RecoveryDiscovery_Tags, RecoveryIssue, RecoveryIssue_Tags, RecoveryStatus, RecoverySummary, RecoveryTrigger, Region, RegionOfInterest, Relationship, Repository, Repository_Tags, ResourceRef, ReviewRating, Role, SdkError, SdkError_Tags, SegmentTiming, SegmentValidation, SegmentValidation_Tags, SessionKeySummary, Shape, ShapeType, SignatureInfo, SigningAlgSchema, SimilarityScore, SoftBinding, StatusCodes, StreamSession, StreamSessionInterface, StreamSessionLike, StreamVerifier, StreamVerifierInterface, StreamVerifierLike, StreamVerifierOptions, Text, TextSelector, TextSelectorRange, Time, TimeType, UnitType, UriOrResource, UriOrResource_Tags, ValidationCode, ValidationCodeKind, ValidationResults, ValidationState, ValidationStatus, Verdict, VerdictRule, Verdict_Tags, c2paTrustList, c2paTsaTrustList, _default$1 as default, devCa, parse, resource, thumbnails };
 }
 /**
  * Official C2PA Conformance Program signing-CA trust anchors (a compile-time
@@ -198,7 +198,7 @@ export declare function c2paTsaTrustList(): string;
  */
 export declare function devCa(): string;
 /**
- * Parse a detached C2PA manifest store: a `.c2pa` sidecar, or the bytes a registry serves for a
+ * Parse a detached C2PA manifest store: a `.c2pa` sidecar, or the bytes a repository serves for a
  * manifest id.
  *
  * Contents, not a verdict. A hard binding is a hash of the asset, so a store read without one
@@ -322,7 +322,7 @@ export declare const DataSource: Readonly<{
  * Typealias from the type name used in the UDL file to the builtin type.  This
  * is needed because the UDL type name is used in function/method signatures.
  */
-export type Value = string;
+export type JsonValue = string;
 /**
  * A frame range representing starting and ending frames or pages.
  *
@@ -711,7 +711,7 @@ export type RegionOfInterest = {
   /**
    * Nested metadata, as JSON: the reader's one recursive edge.
    */
-  metadata?: Value;
+  metadata?: JsonValue;
   /**
    * A free-text string representing a human-readable name for the region which might be used in a user interface.
    */
@@ -806,7 +806,7 @@ export declare const SoftBinding: Readonly<{
   defaults: () => Partial<SoftBinding>;
 }>;
 /**
- * The class of binding a registry derived from an uploaded asset.
+ * The class of binding a repository derived from an uploaded asset.
  *
  * Unlike [`SoftBinding`], this carries no value: the C2PA `byContent` response does not return
  * one. The algorithm and class are still evidence because every request selects exactly one
@@ -833,8 +833,9 @@ export declare const RecoveryDiscovery: Readonly<{
       binderIndex: number;
       binding: SoftBinding;
       class: ContentBindingClass;
-      registryScore?: SimilarityScore;
-      endpoint?: string;
+      repositoryScore?: SimilarityScore;
+      repository: string;
+      fetchedFrom: string;
     }): {
       /**
        * @private
@@ -846,16 +847,18 @@ export declare const RecoveryDiscovery: Readonly<{
         binderIndex: number;
         binding: SoftBinding;
         class: ContentBindingClass;
-        registryScore?: SimilarityScore;
-        endpoint?: string;
+        repositoryScore?: SimilarityScore;
+        repository: string;
+        fetchedFrom: string;
       }>;
     };
     "new"(inner: {
       binderIndex: number;
       binding: SoftBinding;
       class: ContentBindingClass;
-      registryScore?: SimilarityScore;
-      endpoint?: string;
+      repositoryScore?: SimilarityScore;
+      repository: string;
+      fetchedFrom: string;
     }): {
       /**
        * @private
@@ -867,8 +870,9 @@ export declare const RecoveryDiscovery: Readonly<{
         binderIndex: number;
         binding: SoftBinding;
         class: ContentBindingClass;
-        registryScore?: SimilarityScore;
-        endpoint?: string;
+        repositoryScore?: SimilarityScore;
+        repository: string;
+        fetchedFrom: string;
       }>;
     };
     instanceOf(obj: any): obj is {
@@ -882,8 +886,9 @@ export declare const RecoveryDiscovery: Readonly<{
         binderIndex: number;
         binding: SoftBinding;
         class: ContentBindingClass;
-        registryScore?: SimilarityScore;
-        endpoint?: string;
+        repositoryScore?: SimilarityScore;
+        repository: string;
+        fetchedFrom: string;
       }>;
     };
   };
@@ -892,8 +897,9 @@ export declare const RecoveryDiscovery: Readonly<{
       algorithm: string;
       class: ContentBindingClass;
       hint?: SoftBinding;
-      registryScore?: SimilarityScore;
-      endpoint?: string;
+      repositoryScore?: SimilarityScore;
+      repository: string;
+      fetchedFrom: string;
     }): {
       /**
        * @private
@@ -905,16 +911,18 @@ export declare const RecoveryDiscovery: Readonly<{
         algorithm: string;
         class: ContentBindingClass;
         hint?: SoftBinding;
-        registryScore?: SimilarityScore;
-        endpoint?: string;
+        repositoryScore?: SimilarityScore;
+        repository: string;
+        fetchedFrom: string;
       }>;
     };
     "new"(inner: {
       algorithm: string;
       class: ContentBindingClass;
       hint?: SoftBinding;
-      registryScore?: SimilarityScore;
-      endpoint?: string;
+      repositoryScore?: SimilarityScore;
+      repository: string;
+      fetchedFrom: string;
     }): {
       /**
        * @private
@@ -926,8 +934,9 @@ export declare const RecoveryDiscovery: Readonly<{
         algorithm: string;
         class: ContentBindingClass;
         hint?: SoftBinding;
-        registryScore?: SimilarityScore;
-        endpoint?: string;
+        repositoryScore?: SimilarityScore;
+        repository: string;
+        fetchedFrom: string;
       }>;
     };
     instanceOf(obj: any): obj is {
@@ -941,8 +950,9 @@ export declare const RecoveryDiscovery: Readonly<{
         algorithm: string;
         class: ContentBindingClass;
         hint?: SoftBinding;
-        registryScore?: SimilarityScore;
-        endpoint?: string;
+        repositoryScore?: SimilarityScore;
+        repository: string;
+        fetchedFrom: string;
       }>;
     };
   };
@@ -951,8 +961,9 @@ export declare const RecoveryDiscovery: Readonly<{
       algorithm: string;
       class: ContentBindingClass;
       hint?: SoftBinding;
-      registryScore?: SimilarityScore;
-      endpoint?: string;
+      repositoryScore?: SimilarityScore;
+      repository: string;
+      fetchedFrom: string;
     }): {
       /**
        * @private
@@ -964,16 +975,18 @@ export declare const RecoveryDiscovery: Readonly<{
         algorithm: string;
         class: ContentBindingClass;
         hint?: SoftBinding;
-        registryScore?: SimilarityScore;
-        endpoint?: string;
+        repositoryScore?: SimilarityScore;
+        repository: string;
+        fetchedFrom: string;
       }>;
     };
     "new"(inner: {
       algorithm: string;
       class: ContentBindingClass;
       hint?: SoftBinding;
-      registryScore?: SimilarityScore;
-      endpoint?: string;
+      repositoryScore?: SimilarityScore;
+      repository: string;
+      fetchedFrom: string;
     }): {
       /**
        * @private
@@ -985,8 +998,9 @@ export declare const RecoveryDiscovery: Readonly<{
         algorithm: string;
         class: ContentBindingClass;
         hint?: SoftBinding;
-        registryScore?: SimilarityScore;
-        endpoint?: string;
+        repositoryScore?: SimilarityScore;
+        repository: string;
+        fetchedFrom: string;
       }>;
     };
     instanceOf(obj: any): obj is {
@@ -1000,13 +1014,203 @@ export declare const RecoveryDiscovery: Readonly<{
         algorithm: string;
         class: ContentBindingClass;
         hint?: SoftBinding;
-        registryScore?: SimilarityScore;
-        endpoint?: string;
+        repositoryScore?: SimilarityScore;
+        repository: string;
+        fetchedFrom: string;
       }>;
     };
   };
 }>;
 export type RecoveryDiscovery = InstanceType<typeof RecoveryDiscovery['ByBinding' | 'ByContent' | 'ByReference']>;
+export declare enum FingerprintCheck_Tags {
+  NotNeeded = "NotNeeded",
+  NothingToCompare = "NothingToCompare",
+  Unsupported = "Unsupported",
+  Indeterminate = "Indeterminate",
+  Compared = "Compared"
+}
+/**
+ * Whether the asset's own fingerprint backs up a manifest that a watermark led to.
+ *
+ * C2PA 2.4 1.2.2.3: a watermark can be lifted from one asset onto another, so a mark alone does
+ * not establish that the manifest it resolves to describes THIS asset. The mitigation the spec
+ * gives is to compare a fingerprint computed from the asset against the one the recovered
+ * manifest records, and `watermark-and-fingerprint` ends on exactly that comparison.
+ *
+ * Reported rather than enforced: a transcode legitimately shifts a fingerprint, so where the line
+ * falls is the relying party's policy, not this SDK's. What the SDK owes them is the measurement.
+ */
+export declare const FingerprintCheck: Readonly<{
+  instanceOf: (obj: any) => obj is FingerprintCheck;
+  NotNeeded: {
+    new (): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "FingerprintCheck";
+      readonly tag: FingerprintCheck_Tags.NotNeeded;
+    };
+    "new"(): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "FingerprintCheck";
+      readonly tag: FingerprintCheck_Tags.NotNeeded;
+    };
+    instanceOf(obj: any): obj is {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "FingerprintCheck";
+      readonly tag: FingerprintCheck_Tags.NotNeeded;
+    };
+  };
+  NothingToCompare: {
+    new (): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "FingerprintCheck";
+      readonly tag: FingerprintCheck_Tags.NothingToCompare;
+    };
+    "new"(): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "FingerprintCheck";
+      readonly tag: FingerprintCheck_Tags.NothingToCompare;
+    };
+    instanceOf(obj: any): obj is {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "FingerprintCheck";
+      readonly tag: FingerprintCheck_Tags.NothingToCompare;
+    };
+  };
+  Unsupported: {
+    new (inner: {
+      algorithm: string;
+    }): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "FingerprintCheck";
+      readonly tag: FingerprintCheck_Tags.Unsupported;
+      readonly inner: Readonly<{
+        algorithm: string;
+      }>;
+    };
+    "new"(inner: {
+      algorithm: string;
+    }): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "FingerprintCheck";
+      readonly tag: FingerprintCheck_Tags.Unsupported;
+      readonly inner: Readonly<{
+        algorithm: string;
+      }>;
+    };
+    instanceOf(obj: any): obj is {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "FingerprintCheck";
+      readonly tag: FingerprintCheck_Tags.Unsupported;
+      readonly inner: Readonly<{
+        algorithm: string;
+      }>;
+    };
+  };
+  Indeterminate: {
+    new (): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "FingerprintCheck";
+      readonly tag: FingerprintCheck_Tags.Indeterminate;
+    };
+    "new"(): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "FingerprintCheck";
+      readonly tag: FingerprintCheck_Tags.Indeterminate;
+    };
+    instanceOf(obj: any): obj is {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "FingerprintCheck";
+      readonly tag: FingerprintCheck_Tags.Indeterminate;
+    };
+  };
+  Compared: {
+    new (inner: {
+      score: SimilarityScore;
+    }): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "FingerprintCheck";
+      readonly tag: FingerprintCheck_Tags.Compared;
+      readonly inner: Readonly<{
+        score: SimilarityScore;
+      }>;
+    };
+    "new"(inner: {
+      score: SimilarityScore;
+    }): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "FingerprintCheck";
+      readonly tag: FingerprintCheck_Tags.Compared;
+      readonly inner: Readonly<{
+        score: SimilarityScore;
+      }>;
+    };
+    instanceOf(obj: any): obj is {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "FingerprintCheck";
+      readonly tag: FingerprintCheck_Tags.Compared;
+      readonly inner: Readonly<{
+        score: SimilarityScore;
+      }>;
+    };
+  };
+}>;
+/**
+ * Whether the asset's own fingerprint backs up a manifest that a watermark led to.
+ *
+ * C2PA 2.4 1.2.2.3: a watermark can be lifted from one asset onto another, so a mark alone does
+ * not establish that the manifest it resolves to describes THIS asset. The mitigation the spec
+ * gives is to compare a fingerprint computed from the asset against the one the recovered
+ * manifest records, and `watermark-and-fingerprint` ends on exactly that comparison.
+ *
+ * Reported rather than enforced: a transcode legitimately shifts a fingerprint, so where the line
+ * falls is the relying party's policy, not this SDK's. What the SDK owes them is the measurement.
+ */
+export type FingerprintCheck = InstanceType<typeof FingerprintCheck['NotNeeded' | 'NothingToCompare' | 'Unsupported' | 'Indeterminate' | 'Compared']>;
 export declare enum CredentialOrigin_Tags {
   Embedded = "Embedded",
   Recovered = "Recovered"
@@ -1046,6 +1250,7 @@ export declare const CredentialOrigin: Readonly<{
   Recovered: {
     new (inner: {
       discoveries: Array<RecoveryDiscovery>;
+      fingerprintCheck: FingerprintCheck;
     }): {
       /**
        * @private
@@ -1055,10 +1260,12 @@ export declare const CredentialOrigin: Readonly<{
       readonly tag: CredentialOrigin_Tags.Recovered;
       readonly inner: Readonly<{
         discoveries: Array<RecoveryDiscovery>;
+        fingerprintCheck: FingerprintCheck;
       }>;
     };
     "new"(inner: {
       discoveries: Array<RecoveryDiscovery>;
+      fingerprintCheck: FingerprintCheck;
     }): {
       /**
        * @private
@@ -1068,6 +1275,7 @@ export declare const CredentialOrigin: Readonly<{
       readonly tag: CredentialOrigin_Tags.Recovered;
       readonly inner: Readonly<{
         discoveries: Array<RecoveryDiscovery>;
+        fingerprintCheck: FingerprintCheck;
       }>;
     };
     instanceOf(obj: any): obj is {
@@ -1079,6 +1287,7 @@ export declare const CredentialOrigin: Readonly<{
       readonly tag: CredentialOrigin_Tags.Recovered;
       readonly inner: Readonly<{
         discoveries: Array<RecoveryDiscovery>;
+        fingerprintCheck: FingerprintCheck;
       }>;
     };
   };
@@ -1109,7 +1318,7 @@ export type ManifestAssertion = {
   /**
    * The data of the assertion as Value
    */
-  data: Value;
+  data: JsonValue;
   /**
    * There can be more than one assertion for any label
    */
@@ -1590,7 +1799,7 @@ export type Manifest = {
   /**
    * A List of verified credentials
    */
-  credentials?: Array<Value>;
+  credentials?: Array<JsonValue>;
   /**
    * The format of the source file as a MIME type.
    */
@@ -1701,195 +1910,6 @@ export declare const ManifestStore: Readonly<{
   new: (partial: Partial<ManifestStore> & Required<Omit<ManifestStore, "activeManifest" | "validationResults" | "validationState" | "validationStatus">>) => ManifestStore;
   defaults: () => Partial<ManifestStore>;
 }>;
-export declare enum FingerprintCheck_Tags {
-  NotNeeded = "NotNeeded",
-  NothingToCompare = "NothingToCompare",
-  Unsupported = "Unsupported",
-  Indeterminate = "Indeterminate",
-  Compared = "Compared"
-}
-/**
- * Whether the asset's own fingerprint backs up a manifest that a watermark led to.
- *
- * C2PA 2.4 1.2.2.3: a watermark can be lifted from one asset onto another, so a mark alone does
- * not establish that the manifest it resolves to describes THIS asset. The mitigation the spec
- * gives is to compare a fingerprint computed from the asset against the one the recovered
- * manifest records, and `watermark-and-fingerprint` ends on exactly that comparison.
- *
- * Reported rather than enforced: a transcode legitimately shifts a fingerprint, so where the line
- * falls is the relying party's policy, not this SDK's. What the SDK owes them is the measurement.
- */
-export declare const FingerprintCheck: Readonly<{
-  instanceOf: (obj: any) => obj is FingerprintCheck;
-  NotNeeded: {
-    new (): {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "FingerprintCheck";
-      readonly tag: FingerprintCheck_Tags.NotNeeded;
-    };
-    "new"(): {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "FingerprintCheck";
-      readonly tag: FingerprintCheck_Tags.NotNeeded;
-    };
-    instanceOf(obj: any): obj is {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "FingerprintCheck";
-      readonly tag: FingerprintCheck_Tags.NotNeeded;
-    };
-  };
-  NothingToCompare: {
-    new (): {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "FingerprintCheck";
-      readonly tag: FingerprintCheck_Tags.NothingToCompare;
-    };
-    "new"(): {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "FingerprintCheck";
-      readonly tag: FingerprintCheck_Tags.NothingToCompare;
-    };
-    instanceOf(obj: any): obj is {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "FingerprintCheck";
-      readonly tag: FingerprintCheck_Tags.NothingToCompare;
-    };
-  };
-  Unsupported: {
-    new (inner: {
-      algorithm: string;
-    }): {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "FingerprintCheck";
-      readonly tag: FingerprintCheck_Tags.Unsupported;
-      readonly inner: Readonly<{
-        algorithm: string;
-      }>;
-    };
-    "new"(inner: {
-      algorithm: string;
-    }): {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "FingerprintCheck";
-      readonly tag: FingerprintCheck_Tags.Unsupported;
-      readonly inner: Readonly<{
-        algorithm: string;
-      }>;
-    };
-    instanceOf(obj: any): obj is {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "FingerprintCheck";
-      readonly tag: FingerprintCheck_Tags.Unsupported;
-      readonly inner: Readonly<{
-        algorithm: string;
-      }>;
-    };
-  };
-  Indeterminate: {
-    new (): {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "FingerprintCheck";
-      readonly tag: FingerprintCheck_Tags.Indeterminate;
-    };
-    "new"(): {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "FingerprintCheck";
-      readonly tag: FingerprintCheck_Tags.Indeterminate;
-    };
-    instanceOf(obj: any): obj is {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "FingerprintCheck";
-      readonly tag: FingerprintCheck_Tags.Indeterminate;
-    };
-  };
-  Compared: {
-    new (inner: {
-      score: SimilarityScore;
-    }): {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "FingerprintCheck";
-      readonly tag: FingerprintCheck_Tags.Compared;
-      readonly inner: Readonly<{
-        score: SimilarityScore;
-      }>;
-    };
-    "new"(inner: {
-      score: SimilarityScore;
-    }): {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "FingerprintCheck";
-      readonly tag: FingerprintCheck_Tags.Compared;
-      readonly inner: Readonly<{
-        score: SimilarityScore;
-      }>;
-    };
-    instanceOf(obj: any): obj is {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "FingerprintCheck";
-      readonly tag: FingerprintCheck_Tags.Compared;
-      readonly inner: Readonly<{
-        score: SimilarityScore;
-      }>;
-    };
-  };
-}>;
-/**
- * Whether the asset's own fingerprint backs up a manifest that a watermark led to.
- *
- * C2PA 2.4 1.2.2.3: a watermark can be lifted from one asset onto another, so a mark alone does
- * not establish that the manifest it resolves to describes THIS asset. The mitigation the spec
- * gives is to compare a fingerprint computed from the asset against the one the recovered
- * manifest records, and `watermark-and-fingerprint` ends on exactly that comparison.
- *
- * Reported rather than enforced: a transcode legitimately shifts a fingerprint, so where the line
- * falls is the relying party's policy, not this SDK's. What the SDK owes them is the measurement.
- */
-export type FingerprintCheck = InstanceType<typeof FingerprintCheck['NotNeeded' | 'NothingToCompare' | 'Unsupported' | 'Indeterminate' | 'Compared']>;
 /**
  * Whether the manifest's hard binding holds over the bytes this verify read.
  *
@@ -1902,7 +1922,7 @@ export declare enum HardBinding {
   /**
    * No data, box, BMFF or collection hash failed against these bytes.
    */
-  Holds = 0,
+  Match = 0,
   /**
    * A hash mismatch is among the active manifest's failures: the manifest describes other
    * bytes. Whether it is otherwise authentic is its remaining statuses.
@@ -1912,7 +1932,7 @@ export declare enum HardBinding {
 /**
  * The re-sign chain, read from the validated stores themselves: C2PA 2.4 18.16.11 copies a
  * `parentOf` ingredient's manifest into its successor's store, so a link here was signed by the
- * successor. A registry's ordering is a hint; this is the evidence.
+ * successor. A repository's ordering is a hint; this is the evidence.
  */
 export type Lineage = {
   /**
@@ -1935,12 +1955,11 @@ export declare const Lineage: Readonly<{
   defaults: () => Partial<Lineage>;
 }>;
 /**
- * One `verify` result: the c2pa manifest store, where it came from, whether the asset's own
- * fingerprint backs it up, and whether its hard binding holds over the bytes read. The recovered
- * origin carries the same `SoftBinding` record `Binder.derive` returns, so a derived binding and
- * a recovering one are one type.
+ * One `verify` result: the c2pa manifest store, where it came from, and whether its hard
+ * binding holds over the bytes read. The recovered origin carries the same `SoftBinding` record
+ * `Binder.derive` returns, so a derived binding and a recovering one are one type.
  */
-export type FoundCredential = {
+export type Credential = {
   /**
    * The bytes behind every thumbnail the manifests reference, by that reference's
    * `identifier`: each manifest's claim thumbnail and each ingredient's. The manifests state
@@ -1956,10 +1975,6 @@ export type FoundCredential = {
    * validation state and results.
    */
   manifest: ManifestStore;
-  /**
-   * Whether the asset's own fingerprint backs up a mark that led here (C2PA 2.4 1.2.2.3).
-   */
-  fingerprintCheck: FingerprintCheck;
   /**
    * Whether the manifest's hard binding holds over the bytes this verify read.
    */
@@ -1970,12 +1985,12 @@ export type FoundCredential = {
   lineage: Lineage;
 };
 /**
- * Generated factory for {@link FoundCredential} record objects.
+ * Generated factory for {@link Credential} record objects.
  */
-export declare const FoundCredential: Readonly<{
-  create: (partial: Partial<FoundCredential> & Required<Omit<FoundCredential, never>>) => FoundCredential;
-  new: (partial: Partial<FoundCredential> & Required<Omit<FoundCredential, never>>) => FoundCredential;
-  defaults: () => Partial<FoundCredential>;
+export declare const Credential: Readonly<{
+  create: (partial: Partial<Credential> & Required<Omit<Credential, never>>) => Credential;
+  new: (partial: Partial<Credential> & Required<Omit<Credential, never>>) => Credential;
+  defaults: () => Partial<Credential>;
 }>;
 /**
  * Whether the configured recovery sequence ran to a conclusive answer.
@@ -1990,27 +2005,28 @@ export declare enum RecoveryStatus {
   Incomplete = 3
 }
 export declare enum RecoveryIssue_Tags {
-  Binder = "Binder",
-  DeprecatedAlgorithm = "DeprecatedAlgorithm",
-  BindingQuery = "BindingQuery",
+  BinderFailed = "BinderFailed",
+  AlgorithmDeprecated = "AlgorithmDeprecated",
+  BindingUndeclared = "BindingUndeclared",
+  BindingQueryFailed = "BindingQueryFailed",
   QueryRefused = "QueryRefused",
-  ContentForm = "ContentForm",
-  ContentQuery = "ContentQuery",
-  Capabilities = "Capabilities",
+  ContentFormUnsupported = "ContentFormUnsupported",
+  ContentQueryFailed = "ContentQueryFailed",
+  CapabilitiesUnavailable = "CapabilitiesUnavailable",
   ContentTooLarge = "ContentTooLarge",
-  CandidateFetch = "CandidateFetch",
-  CandidateValidation = "CandidateValidation",
+  CandidateFetchFailed = "CandidateFetchFailed",
+  CandidateInvalid = "CandidateInvalid",
   EndpointRefused = "EndpointRefused",
-  ResourceLimit = "ResourceLimit"
+  ResourceLimitReached = "ResourceLimitReached"
 }
 /**
- * Why registry recovery did not complete cleanly, or why one candidate was omitted while another
+ * Why repository recovery did not complete cleanly, or why one candidate was omitted while another
  * succeeded. Kept as data so a partial recovery never loses the rest of the lookup outcome, and
  * each kind carries exactly what it is about.
  */
 export declare const RecoveryIssue: Readonly<{
   instanceOf: (obj: any) => obj is RecoveryIssue;
-  Binder: {
+  BinderFailed: {
     new (inner: {
       binderIndex: number;
       message: string;
@@ -2020,7 +2036,7 @@ export declare const RecoveryIssue: Readonly<{
        * This field is private and should not be used, use `tag` instead.
        */
       readonly [uniffiTypeNameSymbol]: "RecoveryIssue";
-      readonly tag: RecoveryIssue_Tags.Binder;
+      readonly tag: RecoveryIssue_Tags.BinderFailed;
       readonly inner: Readonly<{
         binderIndex: number;
         message: string;
@@ -2035,27 +2051,67 @@ export declare const RecoveryIssue: Readonly<{
        * This field is private and should not be used, use `tag` instead.
        */
       readonly [uniffiTypeNameSymbol]: "RecoveryIssue";
-      readonly tag: RecoveryIssue_Tags.Binder;
+      readonly tag: RecoveryIssue_Tags.BinderFailed;
+      readonly inner: Readonly<{
+        binderIndex: number;
+        message: string;
+      }>;
+    };
+    instanceOf(obj: any): obj is {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "RecoveryIssue";
+      readonly tag: RecoveryIssue_Tags.BinderFailed;
       readonly inner: Readonly<{
         binderIndex: number;
         message: string;
       }>;
     };
+  };
+  AlgorithmDeprecated: {
+    new (inner: {
+      algorithm: string;
+    }): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "RecoveryIssue";
+      readonly tag: RecoveryIssue_Tags.AlgorithmDeprecated;
+      readonly inner: Readonly<{
+        algorithm: string;
+      }>;
+    };
+    "new"(inner: {
+      algorithm: string;
+    }): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "RecoveryIssue";
+      readonly tag: RecoveryIssue_Tags.AlgorithmDeprecated;
+      readonly inner: Readonly<{
+        algorithm: string;
+      }>;
+    };
     instanceOf(obj: any): obj is {
       /**
        * @private
        * This field is private and should not be used, use `tag` instead.
        */
       readonly [uniffiTypeNameSymbol]: "RecoveryIssue";
-      readonly tag: RecoveryIssue_Tags.Binder;
+      readonly tag: RecoveryIssue_Tags.AlgorithmDeprecated;
       readonly inner: Readonly<{
-        binderIndex: number;
-        message: string;
+        algorithm: string;
       }>;
     };
   };
-  DeprecatedAlgorithm: {
+  BindingUndeclared: {
     new (inner: {
+      binderIndex: number;
       algorithm: string;
     }): {
       /**
@@ -2063,12 +2119,14 @@ export declare const RecoveryIssue: Readonly<{
        * This field is private and should not be used, use `tag` instead.
        */
       readonly [uniffiTypeNameSymbol]: "RecoveryIssue";
-      readonly tag: RecoveryIssue_Tags.DeprecatedAlgorithm;
+      readonly tag: RecoveryIssue_Tags.BindingUndeclared;
       readonly inner: Readonly<{
+        binderIndex: number;
         algorithm: string;
       }>;
     };
     "new"(inner: {
+      binderIndex: number;
       algorithm: string;
     }): {
       /**
@@ -2076,8 +2134,9 @@ export declare const RecoveryIssue: Readonly<{
        * This field is private and should not be used, use `tag` instead.
        */
       readonly [uniffiTypeNameSymbol]: "RecoveryIssue";
-      readonly tag: RecoveryIssue_Tags.DeprecatedAlgorithm;
+      readonly tag: RecoveryIssue_Tags.BindingUndeclared;
       readonly inner: Readonly<{
+        binderIndex: number;
         algorithm: string;
       }>;
     };
@@ -2087,14 +2146,16 @@ export declare const RecoveryIssue: Readonly<{
        * This field is private and should not be used, use `tag` instead.
        */
       readonly [uniffiTypeNameSymbol]: "RecoveryIssue";
-      readonly tag: RecoveryIssue_Tags.DeprecatedAlgorithm;
+      readonly tag: RecoveryIssue_Tags.BindingUndeclared;
       readonly inner: Readonly<{
+        binderIndex: number;
         algorithm: string;
       }>;
     };
   };
-  BindingQuery: {
+  BindingQueryFailed: {
     new (inner: {
+      repository: string;
       binderIndex: number;
       algorithm: string;
       message: string;
@@ -2104,14 +2165,16 @@ export declare const RecoveryIssue: Readonly<{
        * This field is private and should not be used, use `tag` instead.
        */
       readonly [uniffiTypeNameSymbol]: "RecoveryIssue";
-      readonly tag: RecoveryIssue_Tags.BindingQuery;
+      readonly tag: RecoveryIssue_Tags.BindingQueryFailed;
       readonly inner: Readonly<{
+        repository: string;
         binderIndex: number;
         algorithm: string;
         message: string;
       }>;
     };
     "new"(inner: {
+      repository: string;
       binderIndex: number;
       algorithm: string;
       message: string;
@@ -2121,8 +2184,9 @@ export declare const RecoveryIssue: Readonly<{
        * This field is private and should not be used, use `tag` instead.
        */
       readonly [uniffiTypeNameSymbol]: "RecoveryIssue";
-      readonly tag: RecoveryIssue_Tags.BindingQuery;
+      readonly tag: RecoveryIssue_Tags.BindingQueryFailed;
       readonly inner: Readonly<{
+        repository: string;
         binderIndex: number;
         algorithm: string;
         message: string;
@@ -2134,8 +2198,9 @@ export declare const RecoveryIssue: Readonly<{
        * This field is private and should not be used, use `tag` instead.
        */
       readonly [uniffiTypeNameSymbol]: "RecoveryIssue";
-      readonly tag: RecoveryIssue_Tags.BindingQuery;
+      readonly tag: RecoveryIssue_Tags.BindingQueryFailed;
       readonly inner: Readonly<{
+        repository: string;
         binderIndex: number;
         algorithm: string;
         message: string;
@@ -2144,6 +2209,7 @@ export declare const RecoveryIssue: Readonly<{
   };
   QueryRefused: {
     new (inner: {
+      repository: string;
       algorithm: string;
       message: string;
     }): {
@@ -2154,11 +2220,13 @@ export declare const RecoveryIssue: Readonly<{
       readonly [uniffiTypeNameSymbol]: "RecoveryIssue";
       readonly tag: RecoveryIssue_Tags.QueryRefused;
       readonly inner: Readonly<{
+        repository: string;
         algorithm: string;
         message: string;
       }>;
     };
     "new"(inner: {
+      repository: string;
       algorithm: string;
       message: string;
     }): {
@@ -2169,6 +2237,7 @@ export declare const RecoveryIssue: Readonly<{
       readonly [uniffiTypeNameSymbol]: "RecoveryIssue";
       readonly tag: RecoveryIssue_Tags.QueryRefused;
       readonly inner: Readonly<{
+        repository: string;
         algorithm: string;
         message: string;
       }>;
@@ -2181,13 +2250,15 @@ export declare const RecoveryIssue: Readonly<{
       readonly [uniffiTypeNameSymbol]: "RecoveryIssue";
       readonly tag: RecoveryIssue_Tags.QueryRefused;
       readonly inner: Readonly<{
+        repository: string;
         algorithm: string;
         message: string;
       }>;
     };
   };
-  ContentForm: {
+  ContentFormUnsupported: {
     new (inner: {
+      repository: string;
       message: string;
     }): {
       /**
@@ -2195,12 +2266,14 @@ export declare const RecoveryIssue: Readonly<{
        * This field is private and should not be used, use `tag` instead.
        */
       readonly [uniffiTypeNameSymbol]: "RecoveryIssue";
-      readonly tag: RecoveryIssue_Tags.ContentForm;
+      readonly tag: RecoveryIssue_Tags.ContentFormUnsupported;
       readonly inner: Readonly<{
+        repository: string;
         message: string;
       }>;
     };
     "new"(inner: {
+      repository: string;
       message: string;
     }): {
       /**
@@ -2208,8 +2281,9 @@ export declare const RecoveryIssue: Readonly<{
        * This field is private and should not be used, use `tag` instead.
        */
       readonly [uniffiTypeNameSymbol]: "RecoveryIssue";
-      readonly tag: RecoveryIssue_Tags.ContentForm;
+      readonly tag: RecoveryIssue_Tags.ContentFormUnsupported;
       readonly inner: Readonly<{
+        repository: string;
         message: string;
       }>;
     };
@@ -2219,14 +2293,16 @@ export declare const RecoveryIssue: Readonly<{
        * This field is private and should not be used, use `tag` instead.
        */
       readonly [uniffiTypeNameSymbol]: "RecoveryIssue";
-      readonly tag: RecoveryIssue_Tags.ContentForm;
+      readonly tag: RecoveryIssue_Tags.ContentFormUnsupported;
       readonly inner: Readonly<{
+        repository: string;
         message: string;
       }>;
     };
   };
-  ContentQuery: {
+  ContentQueryFailed: {
     new (inner: {
+      repository: string;
       algorithm: string;
       message: string;
     }): {
@@ -2235,13 +2311,15 @@ export declare const RecoveryIssue: Readonly<{
        * This field is private and should not be used, use `tag` instead.
        */
       readonly [uniffiTypeNameSymbol]: "RecoveryIssue";
-      readonly tag: RecoveryIssue_Tags.ContentQuery;
+      readonly tag: RecoveryIssue_Tags.ContentQueryFailed;
       readonly inner: Readonly<{
+        repository: string;
         algorithm: string;
         message: string;
       }>;
     };
     "new"(inner: {
+      repository: string;
       algorithm: string;
       message: string;
     }): {
@@ -2250,8 +2328,9 @@ export declare const RecoveryIssue: Readonly<{
        * This field is private and should not be used, use `tag` instead.
        */
       readonly [uniffiTypeNameSymbol]: "RecoveryIssue";
-      readonly tag: RecoveryIssue_Tags.ContentQuery;
+      readonly tag: RecoveryIssue_Tags.ContentQueryFailed;
       readonly inner: Readonly<{
+        repository: string;
         algorithm: string;
         message: string;
       }>;
@@ -2262,15 +2341,17 @@ export declare const RecoveryIssue: Readonly<{
        * This field is private and should not be used, use `tag` instead.
        */
       readonly [uniffiTypeNameSymbol]: "RecoveryIssue";
-      readonly tag: RecoveryIssue_Tags.ContentQuery;
+      readonly tag: RecoveryIssue_Tags.ContentQueryFailed;
       readonly inner: Readonly<{
+        repository: string;
         algorithm: string;
         message: string;
       }>;
     };
   };
-  Capabilities: {
+  CapabilitiesUnavailable: {
     new (inner: {
+      repository: string;
       message: string;
     }): {
       /**
@@ -2278,12 +2359,14 @@ export declare const RecoveryIssue: Readonly<{
        * This field is private and should not be used, use `tag` instead.
        */
       readonly [uniffiTypeNameSymbol]: "RecoveryIssue";
-      readonly tag: RecoveryIssue_Tags.Capabilities;
+      readonly tag: RecoveryIssue_Tags.CapabilitiesUnavailable;
       readonly inner: Readonly<{
+        repository: string;
         message: string;
       }>;
     };
     "new"(inner: {
+      repository: string;
       message: string;
     }): {
       /**
@@ -2291,8 +2374,9 @@ export declare const RecoveryIssue: Readonly<{
        * This field is private and should not be used, use `tag` instead.
        */
       readonly [uniffiTypeNameSymbol]: "RecoveryIssue";
-      readonly tag: RecoveryIssue_Tags.Capabilities;
+      readonly tag: RecoveryIssue_Tags.CapabilitiesUnavailable;
       readonly inner: Readonly<{
+        repository: string;
         message: string;
       }>;
     };
@@ -2302,8 +2386,9 @@ export declare const RecoveryIssue: Readonly<{
        * This field is private and should not be used, use `tag` instead.
        */
       readonly [uniffiTypeNameSymbol]: "RecoveryIssue";
-      readonly tag: RecoveryIssue_Tags.Capabilities;
+      readonly tag: RecoveryIssue_Tags.CapabilitiesUnavailable;
       readonly inner: Readonly<{
+        repository: string;
         message: string;
       }>;
     };
@@ -2347,8 +2432,9 @@ export declare const RecoveryIssue: Readonly<{
       }>;
     };
   };
-  CandidateFetch: {
+  CandidateFetchFailed: {
     new (inner: {
+      repository: string;
       manifestId: string;
       message: string;
     }): {
@@ -2357,13 +2443,15 @@ export declare const RecoveryIssue: Readonly<{
        * This field is private and should not be used, use `tag` instead.
        */
       readonly [uniffiTypeNameSymbol]: "RecoveryIssue";
-      readonly tag: RecoveryIssue_Tags.CandidateFetch;
+      readonly tag: RecoveryIssue_Tags.CandidateFetchFailed;
       readonly inner: Readonly<{
+        repository: string;
         manifestId: string;
         message: string;
       }>;
     };
     "new"(inner: {
+      repository: string;
       manifestId: string;
       message: string;
     }): {
@@ -2372,8 +2460,9 @@ export declare const RecoveryIssue: Readonly<{
        * This field is private and should not be used, use `tag` instead.
        */
       readonly [uniffiTypeNameSymbol]: "RecoveryIssue";
-      readonly tag: RecoveryIssue_Tags.CandidateFetch;
+      readonly tag: RecoveryIssue_Tags.CandidateFetchFailed;
       readonly inner: Readonly<{
+        repository: string;
         manifestId: string;
         message: string;
       }>;
@@ -2384,14 +2473,15 @@ export declare const RecoveryIssue: Readonly<{
        * This field is private and should not be used, use `tag` instead.
        */
       readonly [uniffiTypeNameSymbol]: "RecoveryIssue";
-      readonly tag: RecoveryIssue_Tags.CandidateFetch;
+      readonly tag: RecoveryIssue_Tags.CandidateFetchFailed;
       readonly inner: Readonly<{
+        repository: string;
         manifestId: string;
         message: string;
       }>;
     };
   };
-  CandidateValidation: {
+  CandidateInvalid: {
     new (inner: {
       manifestId: string;
       reason: string;
@@ -2401,7 +2491,7 @@ export declare const RecoveryIssue: Readonly<{
        * This field is private and should not be used, use `tag` instead.
        */
       readonly [uniffiTypeNameSymbol]: "RecoveryIssue";
-      readonly tag: RecoveryIssue_Tags.CandidateValidation;
+      readonly tag: RecoveryIssue_Tags.CandidateInvalid;
       readonly inner: Readonly<{
         manifestId: string;
         reason: string;
@@ -2416,7 +2506,7 @@ export declare const RecoveryIssue: Readonly<{
        * This field is private and should not be used, use `tag` instead.
        */
       readonly [uniffiTypeNameSymbol]: "RecoveryIssue";
-      readonly tag: RecoveryIssue_Tags.CandidateValidation;
+      readonly tag: RecoveryIssue_Tags.CandidateInvalid;
       readonly inner: Readonly<{
         manifestId: string;
         reason: string;
@@ -2428,7 +2518,7 @@ export declare const RecoveryIssue: Readonly<{
        * This field is private and should not be used, use `tag` instead.
        */
       readonly [uniffiTypeNameSymbol]: "RecoveryIssue";
-      readonly tag: RecoveryIssue_Tags.CandidateValidation;
+      readonly tag: RecoveryIssue_Tags.CandidateInvalid;
       readonly inner: Readonly<{
         manifestId: string;
         reason: string;
@@ -2437,6 +2527,7 @@ export declare const RecoveryIssue: Readonly<{
   };
   EndpointRefused: {
     new (inner: {
+      repository: string;
       manifestId: string;
       endpoint: string;
     }): {
@@ -2447,11 +2538,13 @@ export declare const RecoveryIssue: Readonly<{
       readonly [uniffiTypeNameSymbol]: "RecoveryIssue";
       readonly tag: RecoveryIssue_Tags.EndpointRefused;
       readonly inner: Readonly<{
+        repository: string;
         manifestId: string;
         endpoint: string;
       }>;
     };
     "new"(inner: {
+      repository: string;
       manifestId: string;
       endpoint: string;
     }): {
@@ -2462,6 +2555,7 @@ export declare const RecoveryIssue: Readonly<{
       readonly [uniffiTypeNameSymbol]: "RecoveryIssue";
       readonly tag: RecoveryIssue_Tags.EndpointRefused;
       readonly inner: Readonly<{
+        repository: string;
         manifestId: string;
         endpoint: string;
       }>;
@@ -2474,12 +2568,13 @@ export declare const RecoveryIssue: Readonly<{
       readonly [uniffiTypeNameSymbol]: "RecoveryIssue";
       readonly tag: RecoveryIssue_Tags.EndpointRefused;
       readonly inner: Readonly<{
+        repository: string;
         manifestId: string;
         endpoint: string;
       }>;
     };
   };
-  ResourceLimit: {
+  ResourceLimitReached: {
     new (inner: {
       message: string;
     }): {
@@ -2488,7 +2583,7 @@ export declare const RecoveryIssue: Readonly<{
        * This field is private and should not be used, use `tag` instead.
        */
       readonly [uniffiTypeNameSymbol]: "RecoveryIssue";
-      readonly tag: RecoveryIssue_Tags.ResourceLimit;
+      readonly tag: RecoveryIssue_Tags.ResourceLimitReached;
       readonly inner: Readonly<{
         message: string;
       }>;
@@ -2501,7 +2596,7 @@ export declare const RecoveryIssue: Readonly<{
        * This field is private and should not be used, use `tag` instead.
        */
       readonly [uniffiTypeNameSymbol]: "RecoveryIssue";
-      readonly tag: RecoveryIssue_Tags.ResourceLimit;
+      readonly tag: RecoveryIssue_Tags.ResourceLimitReached;
       readonly inner: Readonly<{
         message: string;
       }>;
@@ -2512,7 +2607,7 @@ export declare const RecoveryIssue: Readonly<{
        * This field is private and should not be used, use `tag` instead.
        */
       readonly [uniffiTypeNameSymbol]: "RecoveryIssue";
-      readonly tag: RecoveryIssue_Tags.ResourceLimit;
+      readonly tag: RecoveryIssue_Tags.ResourceLimitReached;
       readonly inner: Readonly<{
         message: string;
       }>;
@@ -2520,13 +2615,13 @@ export declare const RecoveryIssue: Readonly<{
   };
 }>;
 /**
- * Why registry recovery did not complete cleanly, or why one candidate was omitted while another
+ * Why repository recovery did not complete cleanly, or why one candidate was omitted while another
  * succeeded. Kept as data so a partial recovery never loses the rest of the lookup outcome, and
  * each kind carries exactly what it is about.
  */
-export type RecoveryIssue = InstanceType<typeof RecoveryIssue['Binder' | 'DeprecatedAlgorithm' | 'BindingQuery' | 'QueryRefused' | 'ContentForm' | 'ContentQuery' | 'Capabilities' | 'ContentTooLarge' | 'CandidateFetch' | 'CandidateValidation' | 'EndpointRefused' | 'ResourceLimit']>;
+export type RecoveryIssue = InstanceType<typeof RecoveryIssue['BinderFailed' | 'AlgorithmDeprecated' | 'BindingUndeclared' | 'BindingQueryFailed' | 'QueryRefused' | 'ContentFormUnsupported' | 'ContentQueryFailed' | 'CapabilitiesUnavailable' | 'ContentTooLarge' | 'CandidateFetchFailed' | 'CandidateInvalid' | 'EndpointRefused' | 'ResourceLimitReached']>;
 /**
- * Registry recovery outcome and every non-fatal issue encountered on the way.
+ * Repository recovery outcome and every non-fatal issue encountered on the way.
  */
 export type RecoverySummary = {
   status: RecoveryStatus;
@@ -2552,7 +2647,7 @@ export declare enum GoldenComparison_Tags {
 }
 /**
  * Typed completion of C2PA 2.4's `watermark-golden` / `fingerprint-golden` final comparison:
- * the local active manifest against what the registry holds. Every outcome is its own variant.
+ * the local active manifest against what the repository holds. Every outcome is its own variant.
  */
 export declare const GoldenComparison: Readonly<{
   instanceOf: (obj: any) => obj is GoldenComparison;
@@ -2819,7 +2914,7 @@ export declare const GoldenComparison: Readonly<{
 }>;
 /**
  * Typed completion of C2PA 2.4's `watermark-golden` / `fingerprint-golden` final comparison:
- * the local active manifest against what the registry holds. Every outcome is its own variant.
+ * the local active manifest against what the repository holds. Every outcome is its own variant.
  */
 export type GoldenComparison = InstanceType<typeof GoldenComparison['NotRequested' | 'NoEmbeddedManifest' | 'NoRecoveredManifest' | 'RecoveryIncomplete' | 'Matches' | 'Differs' | 'NoneMatches' | 'Unreadable']>;
 /**
@@ -2850,13 +2945,13 @@ export declare enum Verdict_Tags {
  * and the list stays whole beside it.
  *
  * The embedded manifest is the verdict whenever the asset carries one that is not `Invalid`
- * and the golden comparison does not contradict it. When it `differs` from what the registry
+ * and the golden comparison does not contradict it. When it `differs` from what the repository
  * holds, or several recovered candidates leave the comparison indeterminate, the embedded and
  * the recovered manifests are reported as ambiguous: C2PA 2.4's substitution use case leaves
  * that trust decision to the client. Otherwise a recovered candidate is named only when
  * evidence singles it out: it is the only one, or the only one no other credential in this
  * report supersedes (the successor's signed `parentOf` link), or the only one of those whose
- * hard binding holds over these bytes. A registry score, a signature time or a position in the
+ * hard binding holds over these bytes. A repository score, a signature time or a position in the
  * list is not evidence of which manifest belongs to these bytes, so candidates those alone would
  * separate are reported as ambiguous.
  */
@@ -3074,13 +3169,13 @@ export declare const Verdict: Readonly<{
  * and the list stays whole beside it.
  *
  * The embedded manifest is the verdict whenever the asset carries one that is not `Invalid`
- * and the golden comparison does not contradict it. When it `differs` from what the registry
+ * and the golden comparison does not contradict it. When it `differs` from what the repository
  * holds, or several recovered candidates leave the comparison indeterminate, the embedded and
  * the recovered manifests are reported as ambiguous: C2PA 2.4's substitution use case leaves
  * that trust decision to the client. Otherwise a recovered candidate is named only when
  * evidence singles it out: it is the only one, or the only one no other credential in this
  * report supersedes (the successor's signed `parentOf` link), or the only one of those whose
- * hard binding holds over these bytes. A registry score, a signature time or a position in the
+ * hard binding holds over these bytes. A repository score, a signature time or a position in the
  * list is not evidence of which manifest belongs to these bytes, so candidates those alone would
  * separate are reported as ambiguous.
  */
@@ -3090,7 +3185,7 @@ export type Verdict = InstanceType<typeof Verdict['Unsigned' | 'Inconclusive' |
  * golden-flow comparison, and the verdict the SDK's rules choose. See [`asset::Verdict`].
  */
 export type AssetVerification = {
-  credentials: Array<FoundCredential>;
+  credentials: Array<Credential>;
   recovery: RecoverySummary;
   goldenComparison: GoldenComparison;
   verdict: Verdict;
@@ -3103,66 +3198,146 @@ export declare const AssetVerification: Readonly<{
   new: (partial: Partial<AssetVerification> & Required<Omit<AssetVerification, never>>) => AssetVerification;
   defaults: () => Partial<AssetVerification>;
 }>;
+export declare enum Repository_Tags {
+  Named = "Named",
+  Listed = "Listed"
+}
 /**
- * Where the registry is. What a verify may do with it is per call, in [`Recovery`].
+ * One C2PA manifest repository, as the Soft Binding Resolution API spec lets a client find it.
  */
-export type RegistryOptions = {
-  /**
-   * Soft Binding Resolution API base URL (`https://registry.trylimbo.com`).
-   */
-  url: string;
-  /**
-   * Federated resolution APIs a match may name as holding its manifest, beside the ones the
-   * C2PA algorithm list publishes, which are always allowed. C2PA 2.4 lets a match carry an
-   * `endpoint`; one allowed is fetched from, any other is reported as refused. Checked like
-   * `url`: https, or http on loopback only.
-   */
-  endpoints: Array<string>;
-};
+export declare const Repository: Readonly<{
+  instanceOf: (obj: any) => obj is Repository;
+  Named: {
+    new (inner: {
+      url: string;
+      algorithms: Array<string>;
+    }): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "Repository";
+      readonly tag: Repository_Tags.Named;
+      readonly inner: Readonly<{
+        url: string;
+        algorithms: Array<string>;
+      }>;
+    };
+    "new"(inner: {
+      url: string;
+      algorithms: Array<string>;
+    }): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "Repository";
+      readonly tag: Repository_Tags.Named;
+      readonly inner: Readonly<{
+        url: string;
+        algorithms: Array<string>;
+      }>;
+    };
+    instanceOf(obj: any): obj is {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "Repository";
+      readonly tag: Repository_Tags.Named;
+      readonly inner: Readonly<{
+        url: string;
+        algorithms: Array<string>;
+      }>;
+    };
+  };
+  Listed: {
+    new (inner: {
+      algorithm: string;
+    }): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "Repository";
+      readonly tag: Repository_Tags.Listed;
+      readonly inner: Readonly<{
+        algorithm: string;
+      }>;
+    };
+    "new"(inner: {
+      algorithm: string;
+    }): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "Repository";
+      readonly tag: Repository_Tags.Listed;
+      readonly inner: Readonly<{
+        algorithm: string;
+      }>;
+    };
+    instanceOf(obj: any): obj is {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "Repository";
+      readonly tag: Repository_Tags.Listed;
+      readonly inner: Readonly<{
+        algorithm: string;
+      }>;
+    };
+  };
+}>;
 /**
- * Generated factory for {@link RegistryOptions} record objects.
+ * One C2PA manifest repository, as the Soft Binding Resolution API spec lets a client find it.
  */
-export declare const RegistryOptions: Readonly<{
-  create: (partial: Partial<RegistryOptions> & Required<Omit<RegistryOptions, "endpoints">>) => RegistryOptions;
-  new: (partial: Partial<RegistryOptions> & Required<Omit<RegistryOptions, "endpoints">>) => RegistryOptions;
-  defaults: () => Partial<RegistryOptions>;
-}>;
+export type Repository = InstanceType<typeof Repository['Named' | 'Listed']>;
 /**
  * Construction options for [`AssetVerifier::new`] (and the `AssetVerifier.create` JS
- * binding). `trust_c2pa_anchors` defaults to `true` when omitted.
+ * binding). Every field is stated: nothing here is chosen on the caller's behalf.
  *
  * One definition, all lanes: `#[binding]` derives the shapes directly here:
- * tsify (camelCase, optional fields) on wasm, a `uniffi::Record` on the native
- * `ffi` build, so there is no per-lane DTO copy. Off both lanes it is a plain struct.
+ * tsify (camelCase) on wasm, a `uniffi::Record` on the native `ffi` build, so there is no
+ * per-lane DTO copy. Off both lanes it is a plain struct.
  */
 export type AssetVerifierOptions = {
   /**
-   * The registry to recover from. Omit for a verifier that only checks embedded manifests.
+   * The C2PA manifest repositories recovery asks, each a Soft Binding Resolution API declared
+   * for exactly the algorithms it may be asked for. Results merge by manifest, and a match's
+   * `endpoint` is fetched from only when it names one of these. Empty: no recovery can be
+   * asked of this verifier.
    */
-  registry?: RegistryOptions;
+  repositories: Array<Repository>;
   /**
-   * PEM trust anchors for the caller's own issuers.
+   * PEM trust anchors for the manifest signers the caller trusts.
    */
   trustAnchors: Array<string>;
   /**
-   * Also trust the bundled official C2PA anchors on top of `trust_anchors`.
-   * Defaults to `true`; set `false` to trust only `trust_anchors`.
+   * PEM trust anchors for the time-stamping authorities the caller trusts.
+   */
+  tsaTrustAnchors: Array<string>;
+  /**
+   * Also trust the bundled official C2PA anchors, manifest and TSA lists, beside the
+   * caller's. `false` trusts the caller's lists alone.
    */
-  trustC2paAnchors?: boolean;
+  trustC2paAnchors: boolean;
   /**
    * Issuer DIDs whose CAWG identity (ICA) credentials count as validated, matched
-   * exactly against the credential issuer. Omitted or empty trusts no issuer: every
-   * identity assertion then reports `cawg.ica.untrusted_issuer` and withholds
-   * `cawg.ica.credential_valid`, which leaves the manifest's own validity untouched.
+   * exactly against the credential issuer. Empty trusts no issuer: every identity assertion
+   * then reports `cawg.ica.untrusted_issuer` and withholds `cawg.ica.credential_valid`,
+   * which leaves the manifest's own validity untouched.
    */
-  trustedIcaIssuers?: Array<string>;
+  trustedIcaIssuers: Array<string>;
 };
 /**
  * Generated factory for {@link AssetVerifierOptions} record objects.
  */
 export declare const AssetVerifierOptions: Readonly<{
-  create: (partial: Partial<AssetVerifierOptions> & Required<Omit<AssetVerifierOptions, "registry" | "trustC2paAnchors" | "trustedIcaIssuers">>) => AssetVerifierOptions;
-  new: (partial: Partial<AssetVerifierOptions> & Required<Omit<AssetVerifierOptions, "registry" | "trustC2paAnchors" | "trustedIcaIssuers">>) => AssetVerifierOptions;
+  create: (partial: Partial<AssetVerifierOptions> & Required<Omit<AssetVerifierOptions, never>>) => AssetVerifierOptions;
+  new: (partial: Partial<AssetVerifierOptions> & Required<Omit<AssetVerifierOptions, never>>) => AssetVerifierOptions;
   defaults: () => Partial<AssetVerifierOptions>;
 }>;
 /**
@@ -3178,121 +3353,101 @@ export declare enum ContentTrigger {
    */
   Always = 1
 }
-export declare enum Detectors_Tags {
-  Fingerprint = "Fingerprint",
-  Watermark = "Watermark",
-  All = "All",
-  Named = "Named"
+/**
+ * `matches/byContent`: the asset is uploaded to each repository, one request per algorithm that
+ * repository is declared for.
+ */
+export type ByContent = {
+  after: ContentTrigger;
+};
+/**
+ * Generated factory for {@link ByContent} record objects.
+ */
+export declare const ByContent: Readonly<{
+  create: (partial: Partial<ByContent> & Required<Omit<ByContent, never>>) => ByContent;
+  new: (partial: Partial<ByContent> & Required<Omit<ByContent, never>>) => ByContent;
+  defaults: () => Partial<ByContent>;
+}>;
+/**
+ * [`crate::asset::ByReference`] with the region as the reader's own `Range` record, so a range
+ * read off one credential's actions scopes the query for another.
+ */
+export type ByReference = {
+  after: ContentTrigger;
+  url: string;
+  length: bigint;
+  mediaType?: string;
+  region: Array<Range>;
+};
+/**
+ * Generated factory for {@link ByReference} record objects.
+ */
+export declare const ByReference: Readonly<{
+  create: (partial: Partial<ByReference> & Required<Omit<ByReference, "mediaType">>) => ByReference;
+  new: (partial: Partial<ByReference> & Required<Omit<ByReference, "mediaType">>) => ByReference;
+  defaults: () => Partial<ByReference>;
+}>;
+export declare enum AssetFormat_Tags {
+  Sniff = "Sniff",
+  Declared = "Declared"
 }
 /**
- * Which advertised server-side detectors a content form runs. Every selected detector runs,
- * including one a local binder already queried by binding.
+ * The format of the asset a call is handed. Stated, never defaulted: sniffing is a choice the
+ * caller makes by name, not what happens when they say nothing.
  */
-export declare const Detectors: Readonly<{
-  instanceOf: (obj: any) => obj is Detectors;
-  Fingerprint: {
-    new (): {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "Detectors";
-      readonly tag: Detectors_Tags.Fingerprint;
-    };
-    "new"(): {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "Detectors";
-      readonly tag: Detectors_Tags.Fingerprint;
-    };
-    instanceOf(obj: any): obj is {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "Detectors";
-      readonly tag: Detectors_Tags.Fingerprint;
-    };
-  };
-  Watermark: {
-    new (): {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "Detectors";
-      readonly tag: Detectors_Tags.Watermark;
-    };
-    "new"(): {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "Detectors";
-      readonly tag: Detectors_Tags.Watermark;
-    };
-    instanceOf(obj: any): obj is {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "Detectors";
-      readonly tag: Detectors_Tags.Watermark;
-    };
-  };
-  All: {
+export declare const AssetFormat: Readonly<{
+  instanceOf: (obj: any) => obj is AssetFormat;
+  Sniff: {
     new (): {
       /**
        * @private
        * This field is private and should not be used, use `tag` instead.
        */
-      readonly [uniffiTypeNameSymbol]: "Detectors";
-      readonly tag: Detectors_Tags.All;
+      readonly [uniffiTypeNameSymbol]: "AssetFormat";
+      readonly tag: AssetFormat_Tags.Sniff;
     };
     "new"(): {
       /**
        * @private
        * This field is private and should not be used, use `tag` instead.
        */
-      readonly [uniffiTypeNameSymbol]: "Detectors";
-      readonly tag: Detectors_Tags.All;
+      readonly [uniffiTypeNameSymbol]: "AssetFormat";
+      readonly tag: AssetFormat_Tags.Sniff;
     };
     instanceOf(obj: any): obj is {
       /**
        * @private
        * This field is private and should not be used, use `tag` instead.
        */
-      readonly [uniffiTypeNameSymbol]: "Detectors";
-      readonly tag: Detectors_Tags.All;
+      readonly [uniffiTypeNameSymbol]: "AssetFormat";
+      readonly tag: AssetFormat_Tags.Sniff;
     };
   };
-  Named: {
+  Declared: {
     new (inner: {
-      algorithms: Array<string>;
+      mediaType: string;
     }): {
       /**
        * @private
        * This field is private and should not be used, use `tag` instead.
        */
-      readonly [uniffiTypeNameSymbol]: "Detectors";
-      readonly tag: Detectors_Tags.Named;
+      readonly [uniffiTypeNameSymbol]: "AssetFormat";
+      readonly tag: AssetFormat_Tags.Declared;
       readonly inner: Readonly<{
-        algorithms: Array<string>;
+        mediaType: string;
       }>;
     };
     "new"(inner: {
-      algorithms: Array<string>;
+      mediaType: string;
     }): {
       /**
        * @private
        * This field is private and should not be used, use `tag` instead.
        */
-      readonly [uniffiTypeNameSymbol]: "Detectors";
-      readonly tag: Detectors_Tags.Named;
+      readonly [uniffiTypeNameSymbol]: "AssetFormat";
+      readonly tag: AssetFormat_Tags.Declared;
       readonly inner: Readonly<{
-        algorithms: Array<string>;
+        mediaType: string;
       }>;
     };
     instanceOf(obj: any): obj is {
@@ -3300,72 +3455,31 @@ export declare const Detectors: Readonly<{
        * @private
        * This field is private and should not be used, use `tag` instead.
        */
-      readonly [uniffiTypeNameSymbol]: "Detectors";
-      readonly tag: Detectors_Tags.Named;
+      readonly [uniffiTypeNameSymbol]: "AssetFormat";
+      readonly tag: AssetFormat_Tags.Declared;
       readonly inner: Readonly<{
-        algorithms: Array<string>;
+        mediaType: string;
       }>;
     };
   };
 }>;
 /**
- * Which advertised server-side detectors a content form runs. Every selected detector runs,
- * including one a local binder already queried by binding.
- */
-export type Detectors = InstanceType<typeof Detectors['Fingerprint' | 'Watermark' | 'All' | 'Named']>;
-/**
- * One `matches/byContent` upload per selected detector.
- */
-export type ByContent = {
-  after: ContentTrigger;
-  detectors: Detectors;
-};
-/**
- * Generated factory for {@link ByContent} record objects.
- */
-export declare const ByContent: Readonly<{
-  create: (partial: Partial<ByContent> & Required<Omit<ByContent, never>>) => ByContent;
-  new: (partial: Partial<ByContent> & Required<Omit<ByContent, never>>) => ByContent;
-  defaults: () => Partial<ByContent>;
-}>;
-/**
- * One `matches/byReference` query per selected detector. The registry downloads the asset
- * from `url`, so the client reads no bytes for it.
- */
-export type ByReference = {
-  after: ContentTrigger;
-  detectors: Detectors;
-  /**
-   * A short-lived https URL without credentials.
-   */
-  url: string;
-  /**
-   * The asset's size in bytes, which caps the registry's download.
-   */
-  length: bigint;
-  mediaType?: string;
-};
-/**
- * Generated factory for {@link ByReference} record objects.
+ * The format of the asset a call is handed. Stated, never defaulted: sniffing is a choice the
+ * caller makes by name, not what happens when they say nothing.
  */
-export declare const ByReference: Readonly<{
-  create: (partial: Partial<ByReference> & Required<Omit<ByReference, "mediaType">>) => ByReference;
-  new: (partial: Partial<ByReference> & Required<Omit<ByReference, "mediaType">>) => ByReference;
-  defaults: () => Partial<ByReference>;
-}>;
+export type AssetFormat = InstanceType<typeof AssetFormat['Sniff' | 'Declared']>;
 /**
- * Everything one [`Binder::derive`] needs beyond the asset. `format` overrides the format sniffed
- * from the leading bytes.
+ * Everything one [`Binder::derive`] needs beyond the asset.
  */
 export type DeriveOptions = {
-  format?: string;
+  format: AssetFormat;
 };
 /**
  * Generated factory for {@link DeriveOptions} record objects.
  */
 export declare const DeriveOptions: Readonly<{
-  create: (partial: Partial<DeriveOptions> & Required<Omit<DeriveOptions, "format">>) => DeriveOptions;
-  new: (partial: Partial<DeriveOptions> & Required<Omit<DeriveOptions, "format">>) => DeriveOptions;
+  create: (partial: Partial<DeriveOptions> & Required<Omit<DeriveOptions, never>>) => DeriveOptions;
+  new: (partial: Partial<DeriveOptions> & Required<Omit<DeriveOptions, never>>) => DeriveOptions;
   defaults: () => Partial<DeriveOptions>;
 }>;
 /**
@@ -3402,7 +3516,8 @@ export declare enum ValidationCodeKind {
   Failure = 2
 }
 /**
- * One C2PA validation status entry (spec §15.3).
+ * One C2PA validation status entry (spec §15.3): the registered code, its kind, and the
+ * spec's own free-text `explanation`, which is where anything finer than the code lives.
  */
 export type ValidationCode = {
   /**
@@ -3410,13 +3525,18 @@ export type ValidationCode = {
    */
   code: string;
   kind: ValidationCodeKind;
+  /**
+   * Prose for a reader, never a value to branch on: a stream failure names which of the
+   * registered code's listed causes it hit here.
+   */
+  explanation?: string;
 };
 /**
  * Generated factory for {@link ValidationCode} record objects.
  */
 export declare const ValidationCode: Readonly<{
-  create: (partial: Partial<ValidationCode> & Required<Omit<ValidationCode, never>>) => ValidationCode;
-  new: (partial: Partial<ValidationCode> & Required<Omit<ValidationCode, never>>) => ValidationCode;
+  create: (partial: Partial<ValidationCode> & Required<Omit<ValidationCode, "explanation">>) => ValidationCode;
+  new: (partial: Partial<ValidationCode> & Required<Omit<ValidationCode, "explanation">>) => ValidationCode;
   defaults: () => Partial<ValidationCode>;
 }>;
 /**
@@ -3487,147 +3607,59 @@ export type SegmentTiming = {
  */
 export declare const SegmentTiming: Readonly<{
   create: (partial: Partial<SegmentTiming> & Required<Omit<SegmentTiming, "eventDurationSecs" | "timescale">>) => SegmentTiming;
-  new: (partial: Partial<SegmentTiming> & Required<Omit<SegmentTiming, "eventDurationSecs" | "timescale">>) => SegmentTiming;
-  defaults: () => Partial<SegmentTiming>;
-}>;
-/**
- * Outcome of validating a media segment against its stream's init.
- */
-export type MediaValidation = {
-  valid: boolean;
-  codes: Array<ValidationCode>;
-  keyId: ArrayBuffer;
-  timing: SegmentTiming;
-  manifestId: string;
-};
-/**
- * Generated factory for {@link MediaValidation} record objects.
- */
-export declare const MediaValidation: Readonly<{
-  create: (partial: Partial<MediaValidation> & Required<Omit<MediaValidation, never>>) => MediaValidation;
-  new: (partial: Partial<MediaValidation> & Required<Omit<MediaValidation, never>>) => MediaValidation;
-  defaults: () => Partial<MediaValidation>;
-}>;
-/**
- * When [`AssetVerifier::verify_asset`] queries the registry.
- */
-export declare enum RecoveryPolicy {
-  /**
-   * When the asset has no embedded manifest or its active manifest is invalid. This includes
-   * stripped assets and invalid manifests, for which C2PA 2.4 permits soft-binding discovery.
-   * A valid embedded manifest costs no registry round trip.
-   */
-  WhenMissing = 0,
-  /**
-   * On every verify, alongside the embedded manifest, so the two can be compared.
-   *
-   * C2PA 2.4's `watermark-golden` and `fingerprint-golden` flows end on exactly that
-   * comparison, and it is the only thing that catches a manifest SUBSTITUTED under an
-   * untouched mark (use case UC3 in the spec's list, UC2 in ours): the replacement verifies
-   * perfectly on its own, and only disagrees with what the mark actually resolves to.
-   *
-   * It queries the registry on every verify, without making it load-bearing on the asset's own
-   * credential: the flow provides information about a substitution rather than gating the local
-   * manifest, so a registry that cannot be reached leaves [`RecoveryStatus::Incomplete`], the
-   * reason as a [`RecoveryIssue`], and [`GoldenComparison::RecoveryIncomplete`]. A caller for whom a
-   * cross-check that never ran must not pass for agreement branches on that status.
-   */
-  Always = 1
-}
-/**
- * What one verify may do with the registry. Required whenever a registry is configured.
- *
- * One field per Soft Binding Resolution API operation, and an absent one is not called.
- * `matches/byBinding` is decided by the binders handed to the verify: each is derived and looked
- * up, all together, and every result is kept. The content forms run after that, each for the
- * detectors it names, hinted with the first fingerprint the binders derived. Results merge by
- * manifest; nothing is ranked or dropped.
- */
-export type Recovery = {
-  /**
-   * When the registry is consulted at all.
-   */
-  when: RecoveryPolicy;
-  /**
-   * `matches/byContent`: the bounded asset bytes travel in the request.
-   */
-  byContent?: ByContent;
-  /**
-   * `matches/byReference`: the registry fetches the asset from the caller's URL instead, for
-   * an asset above the upload cap.
-   */
-  byReference?: ByReference;
-};
-/**
- * Generated factory for {@link Recovery} record objects.
- */
-export declare const Recovery: Readonly<{
-  create: (partial: Partial<Recovery> & Required<Omit<Recovery, "byContent" | "byReference">>) => Recovery;
-  new: (partial: Partial<Recovery> & Required<Omit<Recovery, "byContent" | "byReference">>) => Recovery;
-  defaults: () => Partial<Recovery>;
+  new: (partial: Partial<SegmentTiming> & Required<Omit<SegmentTiming, "eventDurationSecs" | "timescale">>) => SegmentTiming;
+  defaults: () => Partial<SegmentTiming>;
 }>;
 /**
- * A byte range holding a bare C2PA manifest store, or reserved for one. A record of
- * primitives, so a plugin in its OWN UniFFI namespace declares a structurally identical
- * one and the two cross the boundary without sharing a Rust type.
+ * Outcome of validating a media segment against its stream's init.
  */
-export type Region = {
-  offset: bigint;
-  length: bigint;
+export type MediaValidation = {
+  valid: boolean;
+  codes: Array<ValidationCode>;
+  keyId: ArrayBuffer;
+  timing: SegmentTiming;
+  manifestId: string;
 };
 /**
- * Generated factory for {@link Region} record objects.
+ * Generated factory for {@link MediaValidation} record objects.
  */
-export declare const Region: Readonly<{
-  create: (partial: Partial<Region> & Required<Omit<Region, never>>) => Region;
-  new: (partial: Partial<Region> & Required<Omit<Region, never>>) => Region;
-  defaults: () => Partial<Region>;
+export declare const MediaValidation: Readonly<{
+  create: (partial: Partial<MediaValidation> & Required<Omit<MediaValidation, never>>) => MediaValidation;
+  new: (partial: Partial<MediaValidation> & Required<Omit<MediaValidation, never>>) => MediaValidation;
+  defaults: () => Partial<MediaValidation>;
 }>;
 /**
- * Construction options for [`StreamVerifier::new`] (and the `StreamVerifier.create`
- * JS binding). `trust_c2pa_anchors` defaults to `true` when omitted.
- *
- * `#[binding]` derives the wasm shape (`trustC2paAnchors` camelCase, optional) and,
- * with `ffi`, a `uniffi::Record` for the native `StreamVerifier.create` binding, so there
- * is no per-lane DTO copy. Off both lanes it is a plain struct.
+ * When [`AssetVerifier::verify_asset`] queries the repository.
  */
-export type StreamVerifierOptions = {
-  /**
-   * PEM trust anchors for the caller's own issuers.
-   */
-  trustAnchors: Array<string>;
-  /**
-   * Also trust the bundled official C2PA anchors on top of `trust_anchors`.
-   * Defaults to `true`; set `false` to trust only `trust_anchors`.
-   */
-  trustC2paAnchors?: boolean;
+export declare enum RecoveryTrigger {
   /**
-   * Issuer DIDs whose CAWG identity (ICA) credentials count as validated, matched
-   * exactly against the credential issuer. Omitted or empty trusts no issuer: an
-   * identity assertion on the init segment's manifest then reports
-   * `cawg.ica.untrusted_issuer` and withholds `cawg.ica.credential_valid`.
+   * When the asset has no embedded manifest or its active manifest is invalid. This includes
+   * stripped assets and invalid manifests, for which C2PA 2.4 permits soft-binding discovery.
+   * A valid embedded manifest costs no repository round trip.
    */
-  trustedIcaIssuers?: Array<string>;
+  ManifestMissing = 0,
   /**
-   * How far a segment's timestamp may sit from wall-clock before it is rejected as
-   * skewed. Defaults to [`DEFAULT_SEGMENT_SKEW_TOLERANCE_SECS`]. A deployment whose
-   * encoder clock drifts further than that needs this rather than a fork.
+   * On every verify, alongside the embedded manifest, so the two can be compared.
+   *
+   * C2PA 2.4's `watermark-golden` and `fingerprint-golden` flows end on exactly that
+   * comparison, and it is the only thing that catches a manifest SUBSTITUTED under an
+   * untouched mark (use case UC3 in the spec's list, UC2 in ours): the replacement verifies
+   * perfectly on its own, and only disagrees with what the mark actually resolves to.
+   *
+   * It queries the repository on every verify, without making it load-bearing on the asset's own
+   * credential: the flow provides information about a substitution rather than gating the local
+   * manifest, so a repository that cannot be reached leaves [`RecoveryStatus::Incomplete`], the
+   * reason as a [`RecoveryIssue`], and [`GoldenComparison::RecoveryIncomplete`]. A caller for whom a
+   * cross-check that never ran must not pass for agreement branches on that status.
    */
-  segmentSkewToleranceSecs?: bigint;
-};
-/**
- * Generated factory for {@link StreamVerifierOptions} record objects.
- */
-export declare const StreamVerifierOptions: Readonly<{
-  create: (partial: Partial<StreamVerifierOptions> & Required<Omit<StreamVerifierOptions, "segmentSkewToleranceSecs" | "trustC2paAnchors" | "trustedIcaIssuers">>) => StreamVerifierOptions;
-  new: (partial: Partial<StreamVerifierOptions> & Required<Omit<StreamVerifierOptions, "segmentSkewToleranceSecs" | "trustC2paAnchors" | "trustedIcaIssuers">>) => StreamVerifierOptions;
-  defaults: () => Partial<StreamVerifierOptions>;
-}>;
+  Always = 1
+}
 /**
  * A canonical gRPC/Connect status code: the coarse, closed failure class.
  *
- * The wasm lane projects this as the Connect `snake_case` string, so a consumer
- * narrows on `err.code === "resource_exhausted"`; the native lane projects an enum.
+ * The wasm lane projects this as a camelCase string like every other tagged value
+ * there, so a consumer narrows on `err.code === "resourceExhausted"`; the native lane
+ * projects an enum.
  */
 export declare enum Code {
   Canceled = 0,
@@ -4047,189 +4079,122 @@ export declare class RangeSourceImpl extends UniffiAbstractObject implements Ran
   static instanceOf(obj_: any): obj_ is RangeSourceImpl;
 }
 /**
- * A soft-binding binder: how a recoverable binding is derived from an asset. Put these inside the
- * issuer's manifest mode to sign and index under them, and pass them in verify options to recover.
+ * A soft-binding binder: how a recoverable binding is derived from an asset. Put these inside
+ * the issuer's manifest mode to sign and index under them, and pass them in verify options to
+ * recover. Implement it for an algorithm the SDK does not ship; the SDK's own are
+ * [`IsccBinder`] and [`HeldBinder`].
+ *
+ * `derive` answers this binder's binding for `source`, or `None` when there is none.
+ * `options.format` is how the asset's format is known. `None` and an error
+ * mean different things: `None` is "no binding here", an error is "the question could not be
+ * answered", so a binder that failed never reads as an unmarked asset.
  */
-export interface BinderLike {
-  /**
-   * This binder's binding for `source`, or `None` when there is none. `format` overrides
-   * the format sniffed from the leading bytes.
-   *
-   * `None` and an error mean different things: `None` is "no binding here", an error is
-   * "the question could not be answered", so a binder that failed never reads as an
-   * unmarked asset.
-   *
-   * # Errors
-   *
-   * An unreadable source, or a binder that could not answer.
-   */
+export interface Binder {
   derive(source: RangeSource, options: DeriveOptions, asyncOpts_?: {
     signal: AbortSignal;
   }): Promise<SoftBinding | undefined>;
 }
 /**
- * @deprecated Use `BinderLike` instead.
- */
-export type BinderInterface = BinderLike;
-/**
- * A soft-binding binder: how a recoverable binding is derived from an asset. Put these inside the
- * issuer's manifest mode to sign and index under them, and pass them in verify options to recover.
+ * A soft-binding binder: how a recoverable binding is derived from an asset. Put these inside
+ * the issuer's manifest mode to sign and index under them, and pass them in verify options to
+ * recover. Implement it for an algorithm the SDK does not ship; the SDK's own are
+ * [`IsccBinder`] and [`HeldBinder`].
+ *
+ * `derive` answers this binder's binding for `source`, or `None` when there is none.
+ * `options.format` is how the asset's format is known. `None` and an error
+ * mean different things: `None` is "no binding here", an error is "the question could not be
+ * answered", so a binder that failed never reads as an unmarked asset.
  */
-export declare class Binder extends UniffiAbstractObject implements BinderLike {
-  readonly [uniffiTypeNameSymbol] = "Binder";
+export declare class BinderImpl extends UniffiAbstractObject implements Binder {
+  readonly [uniffiTypeNameSymbol] = "BinderImpl";
   readonly [destructorGuardSymbol]: UniffiGcObject;
   readonly [pointerLiteralSymbol]: UniffiHandle;
   private constructor();
-  /**
-   * A caller-supplied binder for a soft-binding algorithm not built into the SDK.
-   */
-  static custom(plugin: BinderPlugin): BinderLike;
-  /**
-   * A binding you already hold, such as an out-of-band video ISCC. Reads nothing.
-   */
-  static held(binding: SoftBinding): BinderLike;
-  /**
-   * Local ISCC Image-Code for supported image formats.
-   */
-  static iscc(): BinderLike;
-  /**
-   * This binder's binding for `source`, or `None` when there is none. `format` overrides
-   * the format sniffed from the leading bytes.
-   *
-   * `None` and an error mean different things: `None` is "no binding here", an error is
-   * "the question could not be answered", so a binder that failed never reads as an
-   * unmarked asset.
-   *
-   * # Errors
-   *
-   * An unreadable source, or a binder that could not answer.
-   */
   derive(source: RangeSource, options: DeriveOptions, asyncOpts_?: {
     signal: AbortSignal;
   }): Promise<SoftBinding | undefined>;
   uniffiDestroy(): void;
-  static instanceOf(obj_: any): obj_ is Binder;
+  static instanceOf(obj_: any): obj_ is BinderImpl;
 }
 /**
- * The read surface a plugin implements. Implemented by the CALLER, in Rust
- * behind its own cdylib or directly in the host language, and handed to `verify`.
- *
- * Every method is given the asset as a [`RangeSource`], so a plugin never opens its own
- * view and the bytes it parses are the bytes the core hashes.
+ * What one [`AssetVerifier::verify`] may do to recover a manifest: the binders this client
+ * derives for itself, decided into `matches/byBinding`, and one field per content operation,
+ * absent when not to be called. It needs a configured repository and at least one query.
  */
-export interface PluginRead {
-  /**
-   * The media types this plugin owns: its dispatch set, declared as data. The core
-   * asserts a [`sniff`](Self::sniff) result is a member of this list.
-   */
-  mediaTypes(): Array<string>;
-  /**
-   * Recognize the format from the real asset, or `None` to decline it.
-   */
-  sniff(src: RangeSource, asyncOpts_?: {
-    signal: AbortSignal;
-  }): Promise<string | undefined>;
-  /**
-   * The manifest window(s), or empty when none is present. MUST be byte-identical
-   * regardless of slot contents (empty at sign, filled after embed, zeroed after strip).
-   */
-  locate(src: RangeSource, asyncOpts_?: {
-    signal: AbortSignal;
-  }): Promise<Array<Region>>;
-}
+export type Recovery = {
+  when: RecoveryTrigger;
+  binders: Array<Binder>;
+  byContent?: ByContent;
+  byReference?: ByReference;
+};
 /**
- * The plugins one `verify` call may dispatch to. Rust-backed on purpose: see
- * the module docs for why a plain sequence of foreign objects cannot cross today.
+ * Generated factory for {@link Recovery} record objects.
  */
-export interface PluginRegistryLike {
-  /**
-   * Whether no plugin is registered, meaning a c2pa-only verify.
-   *
-   * # Errors
-   *
-   * `Internal` when the registry lock was poisoned by a panicking plugin.
-   */
-  isEmpty(): boolean;
-  /**
-   * How many plugins are registered.
-   *
-   * # Errors
-   *
-   * `Internal` when the registry lock was poisoned by a panicking plugin.
-   */
-  len(): number;
-  /**
-   * Add one plugin. The first registered whose `sniff` hits owns the asset; `c2pa`
-   * remains the built-in fallback when none does. Verifying dispatches on content, not on
-   * a declared format: there is no trustworthy declaration at verify time.
-   *
-   * # Errors
-   *
-   * `Internal` when the registry lock was poisoned by a panicking plugin.
-   */
-  register(plugin: PluginRead): void;
-}
+export declare const Recovery: Readonly<{
+  create: (partial: Partial<Recovery> & Required<Omit<Recovery, "byContent" | "byReference">>) => Recovery;
+  new: (partial: Partial<Recovery> & Required<Omit<Recovery, "byContent" | "byReference">>) => Recovery;
+  defaults: () => Partial<Recovery>;
+}>;
 /**
- * @deprecated Use `PluginRegistryLike` instead.
+ * A byte range holding a bare C2PA manifest store, or reserved for one. A record of
+ * primitives, so a plugin in its OWN UniFFI namespace declares a structurally identical
+ * one and the two cross the boundary without sharing a Rust type.
  */
-export type PluginRegistryInterface = PluginRegistryLike;
+export type Region = {
+  offset: bigint;
+  length: bigint;
+};
 /**
- * The plugins one `verify` call may dispatch to. Rust-backed on purpose: see
- * the module docs for why a plain sequence of foreign objects cannot cross today.
+ * Generated factory for {@link Region} record objects.
  */
-export declare class PluginRegistry extends UniffiAbstractObject implements PluginRegistryLike {
-  readonly [uniffiTypeNameSymbol] = "PluginRegistry";
-  readonly [destructorGuardSymbol]: UniffiGcObject;
-  readonly [pointerLiteralSymbol]: UniffiHandle;
-  constructor();
+export declare const Region: Readonly<{
+  create: (partial: Partial<Region> & Required<Omit<Region, never>>) => Region;
+  new: (partial: Partial<Region> & Required<Omit<Region, never>>) => Region;
+  defaults: () => Partial<Region>;
+}>;
+/**
+ * Construction options for [`StreamVerifier::new`] (and the `StreamVerifier.create`
+ * JS binding). Every field is stated: nothing here is chosen on the caller's behalf.
+ *
+ * `#[binding]` derives the wasm shape (`trustC2paAnchors` camelCase) and,
+ * with `ffi`, a `uniffi::Record` for the native `StreamVerifier.create` binding, so there
+ * is no per-lane DTO copy. Off both lanes it is a plain struct.
+ */
+export type StreamVerifierOptions = {
   /**
-   * Whether no plugin is registered, meaning a c2pa-only verify.
-   *
-   * # Errors
-   *
-   * `Internal` when the registry lock was poisoned by a panicking plugin.
+   * PEM trust anchors for the manifest signers the caller trusts.
    */
-  isEmpty(): boolean;
+  trustAnchors: Array<string>;
   /**
-   * How many plugins are registered.
-   *
-   * # Errors
-   *
-   * `Internal` when the registry lock was poisoned by a panicking plugin.
+   * PEM trust anchors for the time-stamping authorities the caller trusts.
    */
-  len(): number;
+  tsaTrustAnchors: Array<string>;
   /**
-   * Add one plugin. The first registered whose `sniff` hits owns the asset; `c2pa`
-   * remains the built-in fallback when none does. Verifying dispatches on content, not on
-   * a declared format: there is no trustworthy declaration at verify time.
-   *
-   * # Errors
-   *
-   * `Internal` when the registry lock was poisoned by a panicking plugin.
+   * Also trust the bundled official C2PA anchors, manifest and TSA lists, beside the
+   * caller's. `false` trusts the caller's lists alone.
    */
-  register(plugin: PluginRead): void;
-  uniffiDestroy(): void;
-  static instanceOf(obj_: any): obj_ is PluginRegistry;
-}
-/**
- * Everything one [`AssetVerifier::verify`] needs beyond the asset.
- *
- * `recovery` is required when the verifier has a registry and absent for embedded-only
- * verification. `plugins` carries caller plugins for non-c2pa formats (e.g. MXF); a built-in
- * C2PA media format needs none.
- */
-export type VerifyOptions = {
-  binders: Array<BinderLike>;
-  recovery?: Recovery;
-  plugins?: PluginRegistryLike;
+  trustC2paAnchors: boolean;
+  /**
+   * Issuer DIDs whose CAWG identity (ICA) credentials count as validated, matched
+   * exactly against the credential issuer. Empty trusts no issuer: an identity assertion
+   * on the init segment's manifest then reports `cawg.ica.untrusted_issuer` and withholds
+   * `cawg.ica.credential_valid`.
+   */
+  trustedIcaIssuers: Array<string>;
+  /**
+   * How far a segment's timestamp may sit from wall-clock before it is rejected as
+   * skewed, in seconds: the deployment's own encoder-clock allowance, stated rather than
+   * assumed.
+   */
+  segmentSkewToleranceSecs: bigint;
 };
 /**
- * Generated factory for {@link VerifyOptions} record objects.
+ * Generated factory for {@link StreamVerifierOptions} record objects.
  */
-export declare const VerifyOptions: Readonly<{
-  create: (partial: Partial<VerifyOptions> & Required<Omit<VerifyOptions, "plugins" | "recovery">>) => VerifyOptions;
-  new: (partial: Partial<VerifyOptions> & Required<Omit<VerifyOptions, "plugins" | "recovery">>) => VerifyOptions;
-  defaults: () => Partial<VerifyOptions>;
+export declare const StreamVerifierOptions: Readonly<{
+  create: (partial: Partial<StreamVerifierOptions> & Required<Omit<StreamVerifierOptions, never>>) => StreamVerifierOptions;
+  new: (partial: Partial<StreamVerifierOptions> & Required<Omit<StreamVerifierOptions, never>>) => StreamVerifierOptions;
+  defaults: () => Partial<StreamVerifierOptions>;
 }>;
 export declare enum SegmentValidation_Tags {
   Init = "Init",
@@ -4237,7 +4202,7 @@ export declare enum SegmentValidation_Tags {
   Unknown = "Unknown"
 }
 /**
- * Result of `StreamValidation.validate`.
+ * Result of `StreamSession.validate`.
  */
 export declare const SegmentValidation: Readonly<{
   instanceOf: (obj: any) => obj is SegmentValidation;
@@ -4327,27 +4292,55 @@ export declare const SegmentValidation: Readonly<{
   };
 }>;
 /**
- * Result of `StreamValidation.validate`.
+ * Result of `StreamSession.validate`.
  */
 export type SegmentValidation = InstanceType<typeof SegmentValidation['Init' | 'Media' | 'Unknown']>;
+/**
+ * The read surface a plugin implements. Implemented by the CALLER, in Rust
+ * behind its own cdylib or directly in the host language, and handed to `verify`.
+ *
+ * Every method is given the asset as a [`RangeSource`], so a plugin never opens its own
+ * view and the bytes it parses are the bytes the core hashes.
+ */
+export interface PluginReader {
+  /**
+   * The media types this plugin owns: its dispatch set, declared as data. The core
+   * asserts a [`sniff`](Self::sniff) result is a member of this list.
+   */
+  mediaTypes(): Array<string>;
+  /**
+   * Recognize the format from the real asset, or `None` to decline it.
+   */
+  sniff(src: RangeSource, asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<string | undefined>;
+  /**
+   * The manifest window(s), or empty when none is present. MUST be byte-identical
+   * regardless of slot contents (empty at sign, filled after embed, zeroed after strip).
+   */
+  locate(src: RangeSource, asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<Array<Region>>;
+}
 /**
  * A C2PA asset verifier bound to a trust configuration. Construct once, verify many.
  */
 export interface AssetVerifierLike {
   /**
-   * Verify an asset from a [`RangeSource`] using the per-call binders and recovery options.
-   * `plugins` carries the caller's
-   * plugins for non-c2pa formats (e.g. MXF); pass an empty `PluginRegistry` for a
-   * built-in C2PA media format. The SDK links no plugin itself. Returns embedded/recovered
-   * credentials plus typed recovery and golden-comparison outcomes.
+   * Verify an asset from a [`RangeSource`]. `recovery` is what this verify may do to recover
+   * a manifest, or nothing: then the asset is read for what it carries and no repository is
+   * asked. `plugins` are the caller's plugins for non-c2pa formats (e.g. MXF), in dispatch
+   * order; an empty list is a built-in C2PA media format. The SDK links no plugin itself.
+   * Returns embedded/recovered credentials plus typed recovery and golden-comparison
+   * outcomes.
    *
    * # Errors
    *
-   * `READER_INVALID` when the source can't be read/parsed, or a registry failure
-   * involving the asset backend, registry, or a fetched manifest. Local binder faults,
+   * `READER_INVALID` when the source can't be read/parsed, or a repository failure
+   * involving the asset backend, repository, or a fetched manifest. Local binder faults,
    * refused queries, and skipped oversized uploads are retained in the recovery summary.
    */
-  verify(source: RangeSource, options: VerifyOptions, asyncOpts_?: {
+  verify(source: RangeSource, recovery: Recovery | undefined, plugins: Array<PluginReader>, asyncOpts_?: {
     signal: AbortSignal;
   }): Promise<AssetVerification>;
 }
@@ -4372,19 +4365,20 @@ export declare class AssetVerifier extends UniffiAbstractObject implements Asset
    */
   static create(options: AssetVerifierOptions): AssetVerifierLike;
   /**
-   * Verify an asset from a [`RangeSource`] using the per-call binders and recovery options.
-   * `plugins` carries the caller's
-   * plugins for non-c2pa formats (e.g. MXF); pass an empty `PluginRegistry` for a
-   * built-in C2PA media format. The SDK links no plugin itself. Returns embedded/recovered
-   * credentials plus typed recovery and golden-comparison outcomes.
+   * Verify an asset from a [`RangeSource`]. `recovery` is what this verify may do to recover
+   * a manifest, or nothing: then the asset is read for what it carries and no repository is
+   * asked. `plugins` are the caller's plugins for non-c2pa formats (e.g. MXF), in dispatch
+   * order; an empty list is a built-in C2PA media format. The SDK links no plugin itself.
+   * Returns embedded/recovered credentials plus typed recovery and golden-comparison
+   * outcomes.
    *
    * # Errors
    *
-   * `READER_INVALID` when the source can't be read/parsed, or a registry failure
-   * involving the asset backend, registry, or a fetched manifest. Local binder faults,
+   * `READER_INVALID` when the source can't be read/parsed, or a repository failure
+   * involving the asset backend, repository, or a fetched manifest. Local binder faults,
    * refused queries, and skipped oversized uploads are retained in the recovery summary.
    */
-  verify(source: RangeSource, options: VerifyOptions, asyncOpts_?: {
+  verify(source: RangeSource, recovery: Recovery | undefined, plugins: Array<PluginReader>, asyncOpts_?: {
     signal: AbortSignal;
   }): Promise<AssetVerification>;
   uniffiDestroy(): void;
@@ -4456,6 +4450,63 @@ export declare class FileSource extends UniffiAbstractObject implements FileSour
   uniffiDestroy(): void;
   static instanceOf(obj_: any): obj_ is FileSource;
 }
+/**
+ * A binding you already hold, such as an out-of-band video ISCC. Reads nothing.
+ */
+export interface HeldBinderLike {
+  derive(source: RangeSource, options: DeriveOptions, asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<SoftBinding | undefined>;
+}
+/**
+ * @deprecated Use `HeldBinderLike` instead.
+ */
+export type HeldBinderInterface = HeldBinderLike;
+/**
+ * A binding you already hold, such as an out-of-band video ISCC. Reads nothing.
+ */
+export declare class HeldBinder extends UniffiAbstractObject implements HeldBinderLike {
+  readonly [uniffiTypeNameSymbol] = "HeldBinder";
+  readonly [destructorGuardSymbol]: UniffiGcObject;
+  readonly [pointerLiteralSymbol]: UniffiHandle;
+  /**
+   * # Errors
+   *
+   * A binding with an empty algorithm or value.
+   */
+  constructor(binding: SoftBinding);
+  derive(source: RangeSource, options: DeriveOptions, asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<SoftBinding | undefined>;
+  uniffiDestroy(): void;
+  static instanceOf(obj_: any): obj_ is HeldBinder;
+}
+/**
+ * Local ISCC Image-Code for supported image formats.
+ */
+export interface IsccBinderLike {
+  derive(source: RangeSource, options: DeriveOptions, asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<SoftBinding | undefined>;
+}
+/**
+ * @deprecated Use `IsccBinderLike` instead.
+ */
+export type IsccBinderInterface = IsccBinderLike;
+/**
+ * Local ISCC Image-Code for supported image formats.
+ */
+export declare class IsccBinder extends UniffiAbstractObject implements IsccBinderLike {
+  readonly [uniffiTypeNameSymbol] = "IsccBinder";
+  readonly [destructorGuardSymbol]: UniffiGcObject;
+  readonly [pointerLiteralSymbol]: UniffiHandle;
+  constructor();
+  derive(source: RangeSource, options: DeriveOptions, asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<SoftBinding | undefined>;
+  uniffiDestroy(): void;
+  static instanceOf(obj_: any): obj_ is IsccBinder;
+}
 /**
  * An in-memory [`RangeSource`], for a caller that already holds the whole asset as
  * bytes and doesn't want to write a custom source. A **native** implementation of a
@@ -4529,7 +4580,7 @@ export declare class MemorySource extends UniffiAbstractObject implements Memory
  * One stream being validated. It owns the session keys and manifest ids its init segments
  * advertised, so releasing the stream is dropping this object.
  */
-export interface StreamValidationLike {
+export interface StreamSessionLike {
   /**
    * Everything this stream's init segments have registered, as CBOR for another node to
    * [`resume`](StreamVerifier::resume) from.
@@ -4550,7 +4601,7 @@ export interface StreamValidationLike {
    *
    * # Errors
    *
-   * A `stream.invalid` fault when an init segment is malformed or carries no valid
+   * A `STREAM_INVALID` fault when an init segment is malformed or carries no valid
    * manifest, or when a media segment arrives before any init was processed for the
    * stream.
    */
@@ -4559,15 +4610,15 @@ export interface StreamValidationLike {
   }): Promise<SegmentValidation>;
 }
 /**
- * @deprecated Use `StreamValidationLike` instead.
+ * @deprecated Use `StreamSessionLike` instead.
  */
-export type StreamValidationInterface = StreamValidationLike;
+export type StreamSessionInterface = StreamSessionLike;
 /**
  * One stream being validated. It owns the session keys and manifest ids its init segments
  * advertised, so releasing the stream is dropping this object.
  */
-export declare class StreamValidation extends UniffiAbstractObject implements StreamValidationLike {
-  readonly [uniffiTypeNameSymbol] = "StreamValidation";
+export declare class StreamSession extends UniffiAbstractObject implements StreamSessionLike {
+  readonly [uniffiTypeNameSymbol] = "StreamSession";
   readonly [destructorGuardSymbol]: UniffiGcObject;
   readonly [pointerLiteralSymbol]: UniffiHandle;
   private constructor();
@@ -4591,7 +4642,7 @@ export declare class StreamValidation extends UniffiAbstractObject implements St
    *
    * # Errors
    *
-   * A `stream.invalid` fault when an init segment is malformed or carries no valid
+   * A `STREAM_INVALID` fault when an init segment is malformed or carries no valid
    * manifest, or when a media segment arrives before any init was processed for the
    * stream.
    */
@@ -4599,7 +4650,7 @@ export declare class StreamValidation extends UniffiAbstractObject implements St
     signal: AbortSignal;
   }): Promise<SegmentValidation>;
   uniffiDestroy(): void;
-  static instanceOf(obj_: any): obj_ is StreamValidation;
+  static instanceOf(obj_: any): obj_ is StreamSession;
 }
 /**
  * A live-stream verifier bound to a trust configuration. Construct once with
@@ -4607,7 +4658,7 @@ export declare class StreamValidation extends UniffiAbstractObject implements St
  */
 export interface StreamVerifierLike {
   /**
-   * Open `stream_id` for validation, handing back a [`StreamValidation`] to feed
+   * Open `stream_id` for validation, handing back a [`StreamSession`] to feed
    * segments to.
    *
    * No I/O: the handle carries the id so it cannot be mistyped or confused with another
@@ -4615,17 +4666,17 @@ export interface StreamVerifierLike {
    * back the same live session, so a caller that reconnects keeps the state its earlier
    * handle accumulated.
    */
-  open(streamId: string): StreamValidationLike;
+  open(streamId: string): StreamSessionLike;
   /**
    * Open `stream_id` on the state another node exported, merged into whatever this one
    * holds for that id already.
    *
    * # Errors
    *
-   * `STREAM_INVALID` when `state` is not a value [`StreamValidation::export`] produced,
+   * `STREAM_INVALID` when `state` is not a value [`StreamSession::export`] produced,
    * or carries a version this SDK no longer reads.
    */
-  resume(streamId: string, state: ArrayBuffer): StreamValidationLike;
+  resume(streamId: string, state: ArrayBuffer): StreamSessionLike;
 }
 /**
  * @deprecated Use `StreamVerifierLike` instead.
@@ -4649,7 +4700,7 @@ export declare class StreamVerifier extends UniffiAbstractObject implements Stre
    */
   static create(options: StreamVerifierOptions): StreamVerifierLike;
   /**
-   * Open `stream_id` for validation, handing back a [`StreamValidation`] to feed
+   * Open `stream_id` for validation, handing back a [`StreamSession`] to feed
    * segments to.
    *
    * No I/O: the handle carries the id so it cannot be mistyped or confused with another
@@ -4657,33 +4708,20 @@ export declare class StreamVerifier extends UniffiAbstractObject implements Stre
    * back the same live session, so a caller that reconnects keeps the state its earlier
    * handle accumulated.
    */
-  open(streamId: string): StreamValidationLike;
+  open(streamId: string): StreamSessionLike;
   /**
    * Open `stream_id` on the state another node exported, merged into whatever this one
    * holds for that id already.
    *
    * # Errors
    *
-   * `STREAM_INVALID` when `state` is not a value [`StreamValidation::export`] produced,
+   * `STREAM_INVALID` when `state` is not a value [`StreamSession::export`] produced,
    * or carries a version this SDK no longer reads.
    */
-  resume(streamId: string, state: ArrayBuffer): StreamValidationLike;
+  resume(streamId: string, state: ArrayBuffer): StreamSessionLike;
   uniffiDestroy(): void;
   static instanceOf(obj_: any): obj_ is StreamVerifier;
 }
-/**
- * A caller-supplied soft-binding implementation.
- *
- * This is the extension point for algorithms the SDK does not ship. The callback receives the
- * same ranged asset source and resolved media type as the built-in binders and may return no
- * binding when the algorithm does not apply. The returned `alg` identifies the C2PA algorithm
- * used by the caller's recovery plan and registry index.
- */
-export interface BinderPlugin {
-  derive(source: RangeSource, format: string, asyncOpts_?: {
-    signal: AbortSignal;
-  }): Promise<SoftBinding | undefined>;
-}
 /**
  * This should be called before anything else.
  *
@@ -4712,6 +4750,13 @@ declare const _default$1: Readonly<{
       lift(value: UniffiByteArray): AssertionMetadata;
       lower(value: AssertionMetadata, alloc: RustBufferAllocator): UniffiByteArray;
     };
+    FfiConverterTypeAssetFormat: {
+      readFromCursor(c: Cursor): AssetFormat;
+      writeIntoCursor(value: AssetFormat, c: Cursor): void;
+      allocationSize(value: AssetFormat): number;
+      lift(value: UniffiByteArray): AssetFormat;
+      lower(value: AssetFormat, alloc: RustBufferAllocator): UniffiByteArray;
+    };
     FfiConverterTypeAssetType: {
       readFromCursor(c: Cursor): AssetType;
       writeIntoCursor(value: AssetType, c: Cursor): void;
@@ -4734,7 +4779,7 @@ declare const _default$1: Readonly<{
       lift(value: UniffiByteArray): AssetVerifierOptions;
       lower(value: AssetVerifierOptions, alloc: RustBufferAllocator): UniffiByteArray;
     };
-    FfiConverterTypeBinder: FfiConverterObject<BinderLike>;
+    FfiConverterTypeBinder: FfiConverterObjectWithCallbacks<Binder>;
     FfiConverterTypeByContent: {
       readFromCursor(c: Cursor): ByContent;
       writeIntoCursor(value: ByContent, c: Cursor): void;
@@ -4784,6 +4829,13 @@ declare const _default$1: Readonly<{
       lift(value: UniffiByteArray): Coordinate;
       lower(value: Coordinate, alloc: RustBufferAllocator): UniffiByteArray;
     };
+    FfiConverterTypeCredential: {
+      readFromCursor(c: Cursor): Credential;
+      writeIntoCursor(value: Credential, c: Cursor): void;
+      allocationSize(value: Credential): number;
+      lift(value: UniffiByteArray): Credential;
+      lower(value: Credential, alloc: RustBufferAllocator): UniffiByteArray;
+    };
     FfiConverterTypeCredentialOrigin: {
       readFromCursor(c: Cursor): CredentialOrigin;
       writeIntoCursor(value: CredentialOrigin, c: Cursor): void;
@@ -4805,13 +4857,6 @@ declare const _default$1: Readonly<{
       lift(value: UniffiByteArray): DeriveOptions;
       lower(value: DeriveOptions, alloc: RustBufferAllocator): UniffiByteArray;
     };
-    FfiConverterTypeDetectors: {
-      readFromCursor(c: Cursor): Detectors;
-      writeIntoCursor(value: Detectors, c: Cursor): void;
-      allocationSize(value: Detectors): number;
-      lift(value: UniffiByteArray): Detectors;
-      lower(value: Detectors, alloc: RustBufferAllocator): UniffiByteArray;
-    };
     FfiConverterTypeEndInclusivity: {
       readFromCursor(c: Cursor): EndInclusivity;
       writeIntoCursor(value: EndInclusivity, c: Cursor): void;
@@ -4834,13 +4879,6 @@ declare const _default$1: Readonly<{
       lift(value: UniffiByteArray): FingerprintCheck;
       lower(value: FingerprintCheck, alloc: RustBufferAllocator): UniffiByteArray;
     };
-    FfiConverterTypeFoundCredential: {
-      readFromCursor(c: Cursor): FoundCredential;
-      writeIntoCursor(value: FoundCredential, c: Cursor): void;
-      allocationSize(value: FoundCredential): number;
-      lift(value: UniffiByteArray): FoundCredential;
-      lower(value: FoundCredential, alloc: RustBufferAllocator): UniffiByteArray;
-    };
     FfiConverterTypeFrame: {
       readFromCursor(c: Cursor): Frame;
       writeIntoCursor(value: Frame, c: Cursor): void;
@@ -4869,6 +4907,7 @@ declare const _default$1: Readonly<{
       lift(value: UniffiByteArray): HashedUri;
       lower(value: HashedUri, alloc: RustBufferAllocator): UniffiByteArray;
     };
+    FfiConverterTypeHeldBinder: FfiConverterObject<HeldBinderLike>;
     FfiConverterTypeIngredient: {
       readFromCursor(c: Cursor): Ingredient;
       writeIntoCursor(value: Ingredient, c: Cursor): void;
@@ -4890,6 +4929,7 @@ declare const _default$1: Readonly<{
       lift(value: UniffiByteArray): InitValidation;
       lower(value: InitValidation, alloc: RustBufferAllocator): UniffiByteArray;
     };
+    FfiConverterTypeIsccBinder: FfiConverterObject<IsccBinderLike>;
     FfiConverterTypeItem: {
       readFromCursor(c: Cursor): Item;
       writeIntoCursor(value: Item, c: Cursor): void;
@@ -4897,6 +4937,7 @@ declare const _default$1: Readonly<{
       lift(value: UniffiByteArray): Item;
       lower(value: Item, alloc: RustBufferAllocator): UniffiByteArray;
     };
+    FfiConverterTypeJsonValue: FfiConverter<UniffiByteArray, string>;
     FfiConverterTypeLineage: {
       readFromCursor(c: Cursor): Lineage;
       writeIntoCursor(value: Lineage, c: Cursor): void;
@@ -4940,7 +4981,6 @@ declare const _default$1: Readonly<{
       lower(value: MediaValidation, alloc: RustBufferAllocator): UniffiByteArray;
     };
     FfiConverterTypeMemorySource: FfiConverterObject<MemorySourceLike>;
-    FfiConverterTypePluginRegistry: FfiConverterObject<PluginRegistryLike>;
     FfiConverterTypeRange: {
       readFromCursor(c: Cursor): Range;
       writeIntoCursor(value: Range, c: Cursor): void;
@@ -4977,13 +5017,6 @@ declare const _default$1: Readonly<{
       lift(value: UniffiByteArray): RecoveryIssue;
       lower(value: RecoveryIssue, alloc: RustBufferAllocator): UniffiByteArray;
     };
-    FfiConverterTypeRecoveryPolicy: {
-      readFromCursor(c: Cursor): RecoveryPolicy;
-      writeIntoCursor(value: RecoveryPolicy, c: Cursor): void;
-      allocationSize(value: RecoveryPolicy): number;
-      lift(value: UniffiByteArray): RecoveryPolicy;
-      lower(value: RecoveryPolicy, alloc: RustBufferAllocator): UniffiByteArray;
-    };
     FfiConverterTypeRecoveryStatus: {
       readFromCursor(c: Cursor): RecoveryStatus;
       writeIntoCursor(value: RecoveryStatus, c: Cursor): void;
@@ -4998,6 +5031,13 @@ declare const _default$1: Readonly<{
       lift(value: UniffiByteArray): RecoverySummary;
       lower(value: RecoverySummary, alloc: RustBufferAllocator): UniffiByteArray;
     };
+    FfiConverterTypeRecoveryTrigger: {
+      readFromCursor(c: Cursor): RecoveryTrigger;
+      writeIntoCursor(value: RecoveryTrigger, c: Cursor): void;
+      allocationSize(value: RecoveryTrigger): number;
+      lift(value: UniffiByteArray): RecoveryTrigger;
+      lower(value: RecoveryTrigger, alloc: RustBufferAllocator): UniffiByteArray;
+    };
     FfiConverterTypeRegion: {
       readFromCursor(c: Cursor): Region;
       writeIntoCursor(value: Region, c: Cursor): void;
@@ -5012,13 +5052,6 @@ declare const _default$1: Readonly<{
       lift(value: UniffiByteArray): RegionOfInterest;
       lower(value: RegionOfInterest, alloc: RustBufferAllocator): UniffiByteArray;
     };
-    FfiConverterTypeRegistryOptions: {
-      readFromCursor(c: Cursor): RegistryOptions;
-      writeIntoCursor(value: RegistryOptions, c: Cursor): void;
-      allocationSize(value: RegistryOptions): number;
-      lift(value: UniffiByteArray): RegistryOptions;
-      lower(value: RegistryOptions, alloc: RustBufferAllocator): UniffiByteArray;
-    };
     FfiConverterTypeRelationship: {
       readFromCursor(c: Cursor): Relationship;
       writeIntoCursor(value: Relationship, c: Cursor): void;
@@ -5026,6 +5059,13 @@ declare const _default$1: Readonly<{
       lift(value: UniffiByteArray): Relationship;
       lower(value: Relationship, alloc: RustBufferAllocator): UniffiByteArray;
     };
+    FfiConverterTypeRepository: {
+      readFromCursor(c: Cursor): Repository;
+      writeIntoCursor(value: Repository, c: Cursor): void;
+      allocationSize(value: Repository): number;
+      lift(value: UniffiByteArray): Repository;
+      lower(value: Repository, alloc: RustBufferAllocator): UniffiByteArray;
+    };
     FfiConverterTypeResourceRef: {
       readFromCursor(c: Cursor): ResourceRef;
       writeIntoCursor(value: ResourceRef, c: Cursor): void;
@@ -5118,7 +5158,7 @@ declare const _default$1: Readonly<{
       lift(value: UniffiByteArray): StatusCodes;
       lower(value: StatusCodes, alloc: RustBufferAllocator): UniffiByteArray;
     };
-    FfiConverterTypeStreamValidation: FfiConverterObject<StreamValidationLike>;
+    FfiConverterTypeStreamSession: FfiConverterObject<StreamSessionLike>;
     FfiConverterTypeStreamVerifier: FfiConverterObject<StreamVerifierLike>;
     FfiConverterTypeStreamVerifierOptions: {
       readFromCursor(c: Cursor): StreamVerifierOptions;
@@ -5211,7 +5251,6 @@ declare const _default$1: Readonly<{
       lift(value: UniffiByteArray): ValidationStatus;
       lower(value: ValidationStatus, alloc: RustBufferAllocator): UniffiByteArray;
     };
-    FfiConverterTypeValue: FfiConverter<UniffiByteArray, string>;
     FfiConverterTypeVerdict: {
       readFromCursor(c: Cursor): Verdict;
       writeIntoCursor(value: Verdict, c: Cursor): void;
@@ -5226,13 +5265,6 @@ declare const _default$1: Readonly<{
       lift(value: UniffiByteArray): VerdictRule;
       lower(value: VerdictRule, alloc: RustBufferAllocator): UniffiByteArray;
     };
-    FfiConverterTypeVerifyOptions: {
-      readFromCursor(c: Cursor): VerifyOptions;
-      writeIntoCursor(value: VerifyOptions, c: Cursor): void;
-      allocationSize(value: VerifyOptions): number;
-      lift(value: UniffiByteArray): VerifyOptions;
-      lower(value: VerifyOptions, alloc: RustBufferAllocator): UniffiByteArray;
-    };
   };
 }>;
 //#endregion