@trylimbo/sdk-issuer 0.1.0-canary.100

package/gen/ffi/index.d.ts

@@ -0,0 +1,2778 @@
+//#region ../../../../node_modules/@ubjs/core/dist/esm/ffi-types.d.ts
+type UniffiByteArray = Uint8Array;
+//#endregion
+//#region ../../../../node_modules/@ubjs/core/dist/esm/cursor.d.ts
+/**
+ * Positional reader/writer over an `ArrayBuffer` slice with monomorphic typed
+ * accessors. One `DataView` and one `Uint8Array` are built at construction and
+ * reused for every primitive operation — no per-read DataView allocation, no
+ * function-pointer dispatch.
+ *
+ * Big-endian on the wire (matches the UniFFI RustBuffer wire format).
+ */
+declare class Cursor {
+  private readonly dv;
+  private readonly u8;
+  private readonly start;
+  private readonly end;
+  private pos;
+  constructor(buffer: ArrayBuffer, offset: number, length: number);
+  static fromUint8Array(view: Uint8Array): Cursor;
+  remaining(): number;
+  skip(n: number): void;
+  readU8(): number;
+  readI8(): number;
+  readU16(): number;
+  readI16(): number;
+  readU32(): number;
+  readI32(): number;
+  readU64(): bigint;
+  readI64(): bigint;
+  readF32(): number;
+  readF64(): number;
+  readBool(): boolean;
+  writeU8(v: number): void;
+  writeI8(v: number): void;
+  writeU16(v: number): void;
+  writeI16(v: number): void;
+  writeU32(v: number): void;
+  writeI32(v: number): void;
+  writeU64(v: bigint): void;
+  writeI64(v: bigint): void;
+  writeF32(v: number): void;
+  writeF64(v: number): void;
+  writeBool(v: boolean): void;
+  readBytes(len: number): Uint8Array;
+  readArrayBuffer(len: number): ArrayBuffer;
+  writeBytes(src: Uint8Array): void;
+  private boundsCheck;
+}
+//#endregion
+//#region ../../../../node_modules/@ubjs/core/dist/esm/ffi-converters.d.ts
+type RustBufferAllocator = (n: number) => Uint8Array;
+interface FfiConverter<FfiType, TsType> {
+  lift(value: FfiType): TsType;
+  lower(value: TsType, alloc: RustBufferAllocator): FfiType;
+  readFromCursor(c: Cursor): TsType;
+  writeIntoCursor(value: TsType, c: Cursor): void;
+  allocationSize(value: TsType): number;
+}
+//#endregion
+//#region ../../../../node_modules/@ubjs/core/dist/esm/handle-map.d.ts
+type UniffiHandle = bigint;
+declare class UniffiHandleMap<T> {
+  private map;
+  private currentHandle;
+  insert(value: T): UniffiHandle;
+  get(handle: UniffiHandle): T;
+  /**
+   * Creates a second handle pointing to the same object. Rust calls this (via
+   * `CallbackInterfaceClone`) when it clones an Arc holding a foreign-implemented
+   * trait object, so two Arc references can exist with independent lifetimes.
+   *
+   * This clones the *handle*, not the object itself. Both handles resolve to the
+   * same JS object reference, and removing either handle does not affect the other.
+   */
+  clone(handle: UniffiHandle): UniffiHandle;
+  remove(handle: UniffiHandle): T | undefined;
+  has(handle: UniffiHandle): boolean;
+  get size(): number;
+}
+//#endregion
+//#region ../../../../node_modules/@ubjs/core/dist/esm/rust-call.d.ts
+/**
+ * A member of any object, acting as a GC guard / destructor guard.
+ *
+ * The object has a destructor lambda, called when the GC collects the object.
+ */
+type UniffiGcObject = {
+  /**
+   * Called by the `object.uniffiDestroy()` to disable the
+   * action of the destructor guard.
+   */
+  markDestroyed(): void;
+};
+//#endregion
+//#region ../../../../node_modules/@ubjs/core/dist/esm/objects.d.ts
+/**
+ * Marker interface for all `interface` objects that cross the FFI.
+ * Reminder: `interface` objects have methods written in Rust.
+ *
+ * This typesscript interface contains the unffi methods that are needed to make
+ * the FFI work. It should shrink to zero methods.
+ */
+declare abstract class UniffiAbstractObject {
+  /**
+   * Explicitly tell Rust to destroy the native peer that backs this object.
+   *
+   * Once this method has been called, any following method calls will throw an error.
+   *
+   * Can be called more than once.
+   */
+  abstract uniffiDestroy(): void;
+  /**
+   * A convenience method to use this object, then destroy it after its use.
+   * @param block
+   * @returns
+   */
+  uniffiUse<T>(block: (obj: this) => T): T;
+}
+/**
+ * The interface for a helper class generated for each `interface` class.
+ *
+ * Methods of this interface are not exposed to the API.
+ */
+interface UniffiObjectFactory<T> {
+  bless(pointer: UniffiHandle): UniffiGcObject;
+  unbless(ptr: UniffiGcObject): void;
+  create(pointer: UniffiHandle): T;
+  pointer(obj: T): UniffiHandle;
+  clonePointer(obj: T): UniffiHandle;
+  freePointer(pointer: UniffiHandle): void;
+  isConcreteType(obj: any): obj is T;
+}
+/**
+ * An FfiConverter for an object.
+ */
+declare class FfiConverterObject<T> implements FfiConverter<UniffiHandle, T> {
+  protected factory: UniffiObjectFactory<T>;
+  constructor(factory: UniffiObjectFactory<T>);
+  lift(value: UniffiHandle): T;
+  lower(value: T, _alloc: RustBufferAllocator): UniffiHandle;
+  readFromCursor(c: Cursor): T;
+  writeIntoCursor(value: T, c: Cursor): void;
+  protected lowerHandle(value: T): UniffiHandle;
+  allocationSize(value: T): number;
+}
+declare class FfiConverterObjectWithCallbacks<T> extends FfiConverterObject<T> {
+  private handleMap;
+  constructor(factory: UniffiObjectFactory<T>, handleMap?: UniffiHandleMap<T>);
+  protected lowerHandle(value: T): UniffiHandle;
+  lift(value: UniffiHandle): T;
+  drop(handle: UniffiHandle): T | undefined;
+  /**
+   * Called by Rust's `CallbackInterfaceClone` vtable entry when it clones an
+   * Arc holding a foreign-implemented object. Returns a new handle pointing to
+   * the same JS object; removing either handle does not affect the other.
+   */
+  clone(handle: UniffiHandle): UniffiHandle;
+}
+//#endregion
+//#region ../../../../node_modules/@ubjs/core/dist/esm/symbols.d.ts
+/**
+ * A destructor guard object is created for every
+ * `interface` object.
+ *
+ * It corresponds to the `DestructibleObject` in C++, which
+ * uses a C++ destructor to simulate the JS garbage collector.
+ *
+ * The implementation is in {@link RustArcPtr.h}.
+ */
+declare const destructorGuardSymbol: unique symbol;
+/**
+ * The `bigint` pointer corresponding to the Rust memory address
+ * of the native peer.
+ */
+declare const pointerLiteralSymbol: unique symbol;
+/**
+ * The `string` name of the object, enum or error class.
+ *
+ * This drives the `instanceOf` method implementations.
+ */
+declare const uniffiTypeNameSymbol: unique symbol;
+declare namespace trylimbo_issuer_d_exports {
+  export { Action, ActionDetail, ActionKind, Action_Tags, Assertion, AssetIssuer, AssetIssuerInterface, AssetIssuerLike, AssetMarker, AssetMarkerInterface, AssetMarkerLike, Binder, BinderInterface, BinderLike, Code, Component, ComponentEvent, ConnectOptions, CreatedOrigin, CustomAction, DeriveOptions, EmbedOptions, FieldViolation, FileSink, FileSinkInterface, FileSinkLike, FileSource, FileSourceInterface, FileSourceLike, IdentityOptions, Ingredient, InitOutcome, ManifestMode, ManifestMode_Tags, ManifestSpec, Mark, MarkOptions, Mark_Tags, Marked, MemorySink, MemorySinkInterface, MemorySinkLike, MemorySource, MemorySourceInterface, MemorySourceLike, OpenedOrigin, Origin, Origin_Tags, PluginAuthor, PluginRegistry, PluginRegistryInterface, PluginRegistryLike, RangeSink, RangeSinkImpl, RangeSource, RangeSourceImpl, Region, RotationPolicy, SdkError, SdkError_Tags, SegmentKind, SignOptions, SignOutcome, SignedSegmentOutcome, SignerClient, SignerClientInterface, SignerClientLike, SigningVault, SoftBinding, StandardAction, StreamIssuer, StreamIssuerInterface, StreamIssuerLike, StreamSession, StreamSessionInterface, StreamSessionLike, StreamStart, Thumbnail, Value, VaultPublicKey, classifySegment, _default$1 as default, embed };
+}
+/**
+ * Classify a fragmented-MP4 segment from a [`RangeSource`] as init/media/unknown: the
+ * SDK-owned box parse (`moov` vs `moof`) a streaming consumer uses to route each segment
+ * to [`StreamIssuer::init`](stream::StreamIssuer::init) vs
+ * [`StreamSession::sign`](stream::StreamSession::sign) without hand-parsing ISOBMFF itself.
+ *
+ * Async because it reads, and reading is the caller's storage: the two windows below may each
+ * be a round trip. It stays off the island, uniquely among the read-path entry points, because
+ * it awaits the source directly instead of driving anything synchronous underneath, so there is
+ * no blocking thread for one to protect.
+ *
+ * # Errors
+ *
+ * Fails when the source cannot be read.
+ */
+declare function classifySegment(source: RangeSource, asyncOpts_?: {
+  signal: AbortSignal;
+}): Promise<SegmentKind>;
+/**
+ * Embed a signed manifest into an asset, writing the composed result back through
+ * `sink`. `plugins` resolves a non-c2pa format (e.g. MXF) the same way
+ * [`AssetIssuer::sign`](asset::AssetIssuer::sign) did, per [the `plugins`
+ * contract](crate::asset#the-plugins-contract): the write lands on a bounded region
+ * for a plugin match, on the whole (small) asset otherwise. `format` overrides the
+ * sniffed format. Pure local byte-wrangling: no signer round-trip.
+ *
+ * # Why the body is offloaded rather than run inline
+ *
+ * UniFFI polls a future on the thread that called it and never spawns, so an `async fn` whose
+ * body never suspends completes in its first poll, on the caller's thread, blocking it exactly
+ * as a sync export would: measured at 88ms for a 10MB asset on Node, during which nothing else
+ * in the process runs. It is also the read path's hard requirement, not just a courtesy: the
+ * splice reads through `sink`, and the caller's thread is the one that has to answer those
+ * reads. See [`task`](shared::task).
+ *
+ * # Errors
+ *
+ * Fails when the format can't be inferred and none was given, a plugin's
+ * authoring/`locate` disagrees after the write, or the c2pa handler can't
+ * parse/splice the asset.
+ */
+declare function embed(sink: RangeSink, manifest: ArrayBuffer, options: EmbedOptions, asyncOpts_?: {
+  signal: AbortSignal;
+}): Promise<void>;
+/**
+ * Optional facts folded into a derived or workflow action.
+ */
+type ActionDetail = {
+  /**
+   * RFC 3339 timestamp of when the action happened.
+   */
+  when?: string;
+  softwareAgent?: string;
+  description?: string;
+  /**
+   * The URI its term is published at, e.g.
+   * `http://cv.iptc.org/newscodes/digitalsourcetype/digitalCapture`.
+   */
+  sourceType?: string;
+};
+/**
+ * Generated factory for {@link ActionDetail} record objects.
+ */
+declare const ActionDetail: Readonly<{
+  create: (partial: Partial<ActionDetail> & Required<Omit<ActionDetail, "description" | "softwareAgent" | "sourceType" | "when">>) => ActionDetail;
+  new: (partial: Partial<ActionDetail> & Required<Omit<ActionDetail, "description" | "softwareAgent" | "sourceType" | "when">>) => ActionDetail;
+  defaults: () => Partial<ActionDetail>;
+}>;
+/**
+ * Typealias from the type name used in the UDL file to the builtin type.  This
+ * is needed because the UDL type name is used in function/method signatures.
+ */
+type Value = string;
+/**
+ * `data` is JSON; converted to CBOR before crossing the wire. Labels are
+ * client-namespaced: the `c2pa.*`/`cawg.identity` namespaces belong to
+ * the signer, which derives those assertions from the typed request
+ * fields and rejects them here. Foreign callers build an `Assertion`
+ * directly (`{ label, data }`) and nest it in `ManifestSpec.assertions`.
+ */
+type Assertion = {
+  label: string;
+  data: Value;
+};
+/**
+ * Generated factory for {@link Assertion} record objects.
+ */
+declare const Assertion: Readonly<{
+  create: (partial: Partial<Assertion> & Required<Omit<Assertion, never>>) => Assertion;
+  new: (partial: Partial<Assertion> & Required<Omit<Assertion, never>>) => Assertion;
+  defaults: () => Partial<Assertion>;
+}>;
+/**
+ * A pre-rendered thumbnail of the asset, attached to the manifest as a
+ * `c2pa.thumbnail.claim.{jpeg|png}` assertion. The split-signer has no asset
+ * bytes to generate one, so studios render their own small JPEG/PNG and pass
+ * it here; external verifiers (Adobe inspect) use it as the preview tile.
+ */
+type Thumbnail = {
+  data: ArrayBuffer;
+  /**
+   * MIME type. C2PA defines `c2pa.thumbnail.claim.{jpeg,png,svg}`;
+   * `image/jpeg` and `image/png` are the interop-safe choices (consumer
+   * verifiers like Adobe inspect may not render SVG previews).
+   */
+  format: string;
+};
+/**
+ * Generated factory for {@link Thumbnail} record objects.
+ */
+declare const Thumbnail: Readonly<{
+  create: (partial: Partial<Thumbnail> & Required<Omit<Thumbnail, never>>) => Thumbnail;
+  new: (partial: Partial<Thumbnail> & Required<Omit<Thumbnail, never>>) => Thumbnail;
+  defaults: () => Partial<Thumbnail>;
+}>;
+type Ingredient = {
+  data: ArrayBuffer;
+  title?: string;
+  format?: string;
+  thumbnail?: Thumbnail;
+  discoveredBy: Array<string>;
+};
+/**
+ * Generated factory for {@link Ingredient} record objects.
+ */
+declare const Ingredient: Readonly<{
+  create: (partial: Partial<Ingredient> & Required<Omit<Ingredient, "discoveredBy" | "format" | "thumbnail" | "title">>) => Ingredient;
+  new: (partial: Partial<Ingredient> & Required<Omit<Ingredient, "discoveredBy" | "format" | "thumbnail" | "title">>) => Ingredient;
+  defaults: () => Partial<Ingredient>;
+}>;
+/**
+ * The event that brought a [`Component`] into (or out of) the asset. The
+ * signer derives the relationship and lifecycle action from it: `placed` /
+ * `removed` → `componentOf` + `c2pa.placed`/`c2pa.removed`; `inputTo` →
+ * the `inputTo` relationship, no action.
+ */
+declare enum ComponentEvent {
+  Placed = 0,
+  Removed = 1,
+  InputTo = 2
+}
+type Component = {
+  id: string;
+  asset: Ingredient;
+  event: ComponentEvent;
+  detail?: ActionDetail;
+};
+/**
+ * Generated factory for {@link Component} record objects.
+ */
+declare const Component: Readonly<{
+  create: (partial: Partial<Component> & Required<Omit<Component, "detail">>) => Component;
+  new: (partial: Partial<Component> & Required<Omit<Component, "detail">>) => Component;
+  defaults: () => Partial<Component>;
+}>;
+/**
+ * Transport tunables and per-request metadata for the signer connection.
+ *
+ * `headers`, when present, are attached to every RPC (e.g.
+ * `Authorization: Bearer …`, or routing/tenant metadata) and are
+ * lower-cased on the wire; omit them to connect with no extra metadata.
+ *
+ * # Both deadlines are required
+ *
+ * They were optional, and omitting them left a call with no deadline at all: a signer that
+ * accepted the connection and then stopped answering held the caller's thread for ever, with no
+ * cancellation path, because the SDK runs each call on a thread of its own and nothing was
+ * watching the clock. There is no figure the SDK could pick on a caller's behalf that is right
+ * for both a local signer and one across a region, so it asks.
+ *
+ * Neither bounds the hash: that runs client side, between the two legs of the signing protocol,
+ * and is not an RPC. These bound the network alone.
+ */
+type ConnectOptions = {
+  headers?: Map<string, string>;
+  /**
+   * Per-RPC deadline. Bounds one leg of the signing protocol, not the whole sign.
+   */
+  rpcTimeoutMs: number;
+  /**
+   * Bounds the initial connection setup, so an unreachable signer fails fast rather than
+   * waiting out the OS SYN timeout.
+   */
+  connectTimeoutMs: number;
+};
+/**
+ * Generated factory for {@link ConnectOptions} record objects.
+ */
+declare const ConnectOptions: Readonly<{
+  create: (partial: Partial<ConnectOptions> & Required<Omit<ConnectOptions, "headers">>) => ConnectOptions;
+  new: (partial: Partial<ConnectOptions> & Required<Omit<ConnectOptions, "headers">>) => ConnectOptions;
+  defaults: () => Partial<ConnectOptions>;
+}>;
+/**
+ * The asset is an original; the signer derives `c2pa.created`.
+ */
+type CreatedOrigin = {
+  /**
+   * The URI its term is published at, e.g.
+   * `http://cv.iptc.org/newscodes/digitalsourcetype/digitalCapture`.
+   */
+  sourceType: string;
+  detail?: ActionDetail;
+};
+/**
+ * Generated factory for {@link CreatedOrigin} record objects.
+ */
+declare const CreatedOrigin: Readonly<{
+  create: (partial: Partial<CreatedOrigin> & Required<Omit<CreatedOrigin, "detail">>) => CreatedOrigin;
+  new: (partial: Partial<CreatedOrigin> & Required<Omit<CreatedOrigin, "detail">>) => CreatedOrigin;
+  defaults: () => Partial<CreatedOrigin>;
+}>;
+/**
+ * An entity-namespaced action (reverse-DNS `label`; the signer rejects
+ * `c2pa.*`/`cawg.*`). `params` (a JSON object) merges into the action's
+ * `parameters`.
+ */
+type CustomAction = {
+  label: string;
+  params?: Value;
+  detail?: ActionDetail;
+  /**
+   * `Component.id`s this action acted on.
+   */
+  componentIds?: Array<string>;
+};
+/**
+ * Generated factory for {@link CustomAction} record objects.
+ */
+declare const CustomAction: Readonly<{
+  create: (partial: Partial<CustomAction> & Required<Omit<CustomAction, "componentIds" | "detail" | "params">>) => CustomAction;
+  new: (partial: Partial<CustomAction> & Required<Omit<CustomAction, "componentIds" | "detail" | "params">>) => CustomAction;
+  defaults: () => Partial<CustomAction>;
+}>;
+/**
+ * Everything one [`Binder::derive`] needs beyond the asset. `format` overrides the format sniffed
+ * from the leading bytes.
+ */
+type DeriveOptions = {
+  format?: string;
+};
+/**
+ * Generated factory for {@link DeriveOptions} record objects.
+ */
+declare const DeriveOptions: Readonly<{
+  create: (partial: Partial<DeriveOptions> & Required<Omit<DeriveOptions, "format">>) => DeriveOptions;
+  new: (partial: Partial<DeriveOptions> & Required<Omit<DeriveOptions, "format">>) => DeriveOptions;
+  defaults: () => Partial<DeriveOptions>;
+}>;
+/**
+ * A canonical gRPC/Connect status code: the coarse, closed failure class.
+ *
+ * The wasm lane projects this as the Connect `snake_case` string, so a consumer
+ * narrows on `err.code === "resource_exhausted"`; the native lane projects an enum.
+ */
+declare enum Code {
+  Canceled = 0,
+  Unknown = 1,
+  InvalidArgument = 2,
+  DeadlineExceeded = 3,
+  NotFound = 4,
+  AlreadyExists = 5,
+  PermissionDenied = 6,
+  ResourceExhausted = 7,
+  FailedPrecondition = 8,
+  Aborted = 9,
+  OutOfRange = 10,
+  Unimplemented = 11,
+  Internal = 12,
+  Unavailable = 13,
+  DataLoss = 14,
+  Unauthenticated = 15
+}
+/**
+ * One `google.rpc.BadRequest.FieldViolation`: a request field that failed a constraint.
+ */
+type FieldViolation = {
+  /**
+   * A dotted proto path to the offending field (`""` for a message-level rule).
+   */
+  field: string;
+  /**
+   * Human-readable explanation of the violation.
+   */
+  description: string;
+  /**
+   * The constraint id that failed (a protovalidate/CEL rule id), stable across releases.
+   */
+  reason: string;
+};
+/**
+ * Generated factory for {@link FieldViolation} record objects.
+ */
+declare const FieldViolation: Readonly<{
+  create: (partial: Partial<FieldViolation> & Required<Omit<FieldViolation, never>>) => FieldViolation;
+  new: (partial: Partial<FieldViolation> & Required<Omit<FieldViolation, never>>) => FieldViolation;
+  defaults: () => Partial<FieldViolation>;
+}>;
+declare enum SdkError_Tags {
+  Reason = "Reason",
+  Invalid = "Invalid",
+  Status = "Status"
+}
+/**
+ * The error every SDK call throws: a decoded `google.rpc.Status`, discriminated
+ * as a semantic reason, a request validation, or a bare status. `code` and `message`
+ * are common to every variant.
+ */
+declare const SdkError: Readonly<{
+  instanceOf: (obj: any) => obj is SdkError;
+  Reason: {
+    new (inner: {
+      code: Code;
+      message: string;
+      reason: string;
+      domain: string;
+      metadata: Map<string, string>;
+    }): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "SdkError";
+      readonly tag: SdkError_Tags.Reason;
+      readonly inner: Readonly<{
+        code: Code;
+        message: string;
+        reason: string;
+        domain: string;
+        metadata: Map<string, string>;
+      }>;
+      name: string;
+      message: string;
+      stack?: string;
+      cause?: unknown;
+    };
+    "new"(inner: {
+      code: Code;
+      message: string;
+      reason: string;
+      domain: string;
+      metadata: Map<string, string>;
+    }): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "SdkError";
+      readonly tag: SdkError_Tags.Reason;
+      readonly inner: Readonly<{
+        code: Code;
+        message: string;
+        reason: string;
+        domain: string;
+        metadata: Map<string, string>;
+      }>;
+      name: string;
+      message: string;
+      stack?: string;
+      cause?: unknown;
+    };
+    instanceOf(obj: any): obj is {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "SdkError";
+      readonly tag: SdkError_Tags.Reason;
+      readonly inner: Readonly<{
+        code: Code;
+        message: string;
+        reason: string;
+        domain: string;
+        metadata: Map<string, string>;
+      }>;
+      name: string;
+      message: string;
+      stack?: string;
+      cause?: unknown;
+    };
+    hasInner(obj: any): obj is {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "SdkError";
+      readonly tag: SdkError_Tags.Reason;
+      readonly inner: Readonly<{
+        code: Code;
+        message: string;
+        reason: string;
+        domain: string;
+        metadata: Map<string, string>;
+      }>;
+      name: string;
+      message: string;
+      stack?: string;
+      cause?: unknown;
+    };
+    getInner(obj: {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "SdkError";
+      readonly tag: SdkError_Tags.Reason;
+      readonly inner: Readonly<{
+        code: Code;
+        message: string;
+        reason: string;
+        domain: string;
+        metadata: Map<string, string>;
+      }>;
+      name: string;
+      message: string;
+      stack?: string;
+      cause?: unknown;
+    }): Readonly<{
+      code: Code;
+      message: string;
+      reason: string;
+      domain: string;
+      metadata: Map<string, string>;
+    }>;
+    captureStackTrace(targetObject: object, constructorOpt?: Function): void;
+    prepareStackTrace(err: Error, stackTraces: NodeJS.CallSite[]): any;
+    stackTraceLimit: number;
+  };
+  Invalid: {
+    new (inner: {
+      code: Code;
+      message: string;
+      fieldViolations: Array<FieldViolation>;
+    }): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "SdkError";
+      readonly tag: SdkError_Tags.Invalid;
+      readonly inner: Readonly<{
+        code: Code;
+        message: string;
+        fieldViolations: Array<FieldViolation>;
+      }>;
+      name: string;
+      message: string;
+      stack?: string;
+      cause?: unknown;
+    };
+    "new"(inner: {
+      code: Code;
+      message: string;
+      fieldViolations: Array<FieldViolation>;
+    }): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "SdkError";
+      readonly tag: SdkError_Tags.Invalid;
+      readonly inner: Readonly<{
+        code: Code;
+        message: string;
+        fieldViolations: Array<FieldViolation>;
+      }>;
+      name: string;
+      message: string;
+      stack?: string;
+      cause?: unknown;
+    };
+    instanceOf(obj: any): obj is {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "SdkError";
+      readonly tag: SdkError_Tags.Invalid;
+      readonly inner: Readonly<{
+        code: Code;
+        message: string;
+        fieldViolations: Array<FieldViolation>;
+      }>;
+      name: string;
+      message: string;
+      stack?: string;
+      cause?: unknown;
+    };
+    hasInner(obj: any): obj is {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "SdkError";
+      readonly tag: SdkError_Tags.Invalid;
+      readonly inner: Readonly<{
+        code: Code;
+        message: string;
+        fieldViolations: Array<FieldViolation>;
+      }>;
+      name: string;
+      message: string;
+      stack?: string;
+      cause?: unknown;
+    };
+    getInner(obj: {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "SdkError";
+      readonly tag: SdkError_Tags.Invalid;
+      readonly inner: Readonly<{
+        code: Code;
+        message: string;
+        fieldViolations: Array<FieldViolation>;
+      }>;
+      name: string;
+      message: string;
+      stack?: string;
+      cause?: unknown;
+    }): Readonly<{
+      code: Code;
+      message: string;
+      fieldViolations: Array<FieldViolation>;
+    }>;
+    captureStackTrace(targetObject: object, constructorOpt?: Function): void;
+    prepareStackTrace(err: Error, stackTraces: NodeJS.CallSite[]): any;
+    stackTraceLimit: number;
+  };
+  Status: {
+    new (inner: {
+      code: Code;
+      message: string;
+    }): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "SdkError";
+      readonly tag: SdkError_Tags.Status;
+      readonly inner: Readonly<{
+        code: Code;
+        message: string;
+      }>;
+      name: string;
+      message: string;
+      stack?: string;
+      cause?: unknown;
+    };
+    "new"(inner: {
+      code: Code;
+      message: string;
+    }): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "SdkError";
+      readonly tag: SdkError_Tags.Status;
+      readonly inner: Readonly<{
+        code: Code;
+        message: string;
+      }>;
+      name: string;
+      message: string;
+      stack?: string;
+      cause?: unknown;
+    };
+    instanceOf(obj: any): obj is {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "SdkError";
+      readonly tag: SdkError_Tags.Status;
+      readonly inner: Readonly<{
+        code: Code;
+        message: string;
+      }>;
+      name: string;
+      message: string;
+      stack?: string;
+      cause?: unknown;
+    };
+    hasInner(obj: any): obj is {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "SdkError";
+      readonly tag: SdkError_Tags.Status;
+      readonly inner: Readonly<{
+        code: Code;
+        message: string;
+      }>;
+      name: string;
+      message: string;
+      stack?: string;
+      cause?: unknown;
+    };
+    getInner(obj: {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "SdkError";
+      readonly tag: SdkError_Tags.Status;
+      readonly inner: Readonly<{
+        code: Code;
+        message: string;
+      }>;
+      name: string;
+      message: string;
+      stack?: string;
+      cause?: unknown;
+    }): Readonly<{
+      code: Code;
+      message: string;
+    }>;
+    captureStackTrace(targetObject: object, constructorOpt?: Function): void;
+    prepareStackTrace(err: Error, stackTraces: NodeJS.CallSite[]): any;
+    stackTraceLimit: number;
+  };
+}>;
+/**
+ * The error every SDK call throws: a decoded `google.rpc.Status`, discriminated
+ * as a semantic reason, a request validation, or a bare status. `code` and `message`
+ * are common to every variant.
+ */
+type SdkError = InstanceType<typeof SdkError['Reason' | 'Invalid' | 'Status']>;
+/**
+ * The host-supplied ranged reader: `length()` returns the asset size in bytes, `read_at`
+ * reads `length` bytes starting at `offset`. Each call crosses the FFI boundary, and the
+ * caller controls the backing store (memory, file, S3, HTTP, custom).
+ *
+ * # Both methods are async
+ *
+ * Because storage is: an object store is a round trip, and so is anything behind `fetch`. A
+ * synchronous `read_at` forces every such caller to make the asset local first, which is a
+ * whole copy of a file that may be hundreds of gigabytes, to answer reads the SDK was going to
+ * make one window at a time anyway. Implement this over `aiobotocore`, an S3 client, a ranged
+ * `fetch`, or a plain file, and await whatever it takes.
+ *
+ * The SDK never calls back into the thread that called it (see [`task`](super::task)), so an
+ * implementation is free to be as slow as its storage is.
+ *
+ * # Both methods are fallible
+ *
+ * They have to be: an infallible `read_at` can only report a failed read as a short one, which
+ * is indistinguishable from a legitimate end of file, so an S3 timeout would silently verify or
+ * sign a truncated asset.
+ */
+interface RangeSource {
+  length(asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<bigint>;
+  readAt(offset: bigint, length: number, asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<ArrayBuffer>;
+}
+/**
+ * The host-supplied ranged reader: `length()` returns the asset size in bytes, `read_at`
+ * reads `length` bytes starting at `offset`. Each call crosses the FFI boundary, and the
+ * caller controls the backing store (memory, file, S3, HTTP, custom).
+ *
+ * # Both methods are async
+ *
+ * Because storage is: an object store is a round trip, and so is anything behind `fetch`. A
+ * synchronous `read_at` forces every such caller to make the asset local first, which is a
+ * whole copy of a file that may be hundreds of gigabytes, to answer reads the SDK was going to
+ * make one window at a time anyway. Implement this over `aiobotocore`, an S3 client, a ranged
+ * `fetch`, or a plain file, and await whatever it takes.
+ *
+ * The SDK never calls back into the thread that called it (see [`task`](super::task)), so an
+ * implementation is free to be as slow as its storage is.
+ *
+ * # Both methods are fallible
+ *
+ * They have to be: an infallible `read_at` can only report a failed read as a short one, which
+ * is indistinguishable from a legitimate end of file, so an S3 timeout would silently verify or
+ * sign a truncated asset.
+ */
+declare class RangeSourceImpl extends UniffiAbstractObject implements RangeSource {
+  readonly [uniffiTypeNameSymbol] = "RangeSourceImpl";
+  readonly [destructorGuardSymbol]: UniffiGcObject;
+  readonly [pointerLiteralSymbol]: UniffiHandle;
+  private constructor();
+  length(asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<bigint>;
+  readAt(offset: bigint, length: number, asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<ArrayBuffer>;
+  uniffiDestroy(): void;
+  static instanceOf(obj_: any): obj_ is RangeSourceImpl;
+}
+/**
+ * A byte range holding a bare C2PA manifest store, or reserved for one. A record of
+ * primitives, so a plugin in its OWN UniFFI namespace declares a structurally identical
+ * one and the two cross the boundary without sharing a Rust type.
+ */
+type Region = {
+  offset: bigint;
+  length: bigint;
+};
+/**
+ * Generated factory for {@link Region} record objects.
+ */
+declare const Region: Readonly<{
+  create: (partial: Partial<Region> & Required<Omit<Region, never>>) => Region;
+  new: (partial: Partial<Region> & Required<Omit<Region, never>>) => Region;
+  defaults: () => Partial<Region>;
+}>;
+/**
+ * A ranged read+write backend for embedding. All four methods are first-class (UniFFI
+ * has no trait inheritance for foreign callbacks, so the read half is duplicated from
+ * [`super::source::RangeSource`] rather than extended), and all four are async for the same
+ * reason its two are: the store on the other side is a round trip, whether that is an object
+ * store, a file behind an async runtime, or anything reached with `fetch`.
+ *
+ * Every method is fallible. `write_at` in particular has to be: an infallible write can
+ * only be ignored, so `embed` would report success on a write that never reached the
+ * caller's storage.
+ */
+interface RangeSink {
+  length(asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<bigint>;
+  readAt(offset: bigint, length: number, asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<ArrayBuffer>;
+  writeAt(offset: bigint, data: ArrayBuffer, asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<void>;
+  setLength(length: bigint, asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<void>;
+}
+/**
+ * A ranged read+write backend for embedding. All four methods are first-class (UniFFI
+ * has no trait inheritance for foreign callbacks, so the read half is duplicated from
+ * [`super::source::RangeSource`] rather than extended), and all four are async for the same
+ * reason its two are: the store on the other side is a round trip, whether that is an object
+ * store, a file behind an async runtime, or anything reached with `fetch`.
+ *
+ * Every method is fallible. `write_at` in particular has to be: an infallible write can
+ * only be ignored, so `embed` would report success on a write that never reached the
+ * caller's storage.
+ */
+declare class RangeSinkImpl extends UniffiAbstractObject implements RangeSink {
+  readonly [uniffiTypeNameSymbol] = "RangeSinkImpl";
+  readonly [destructorGuardSymbol]: UniffiGcObject;
+  readonly [pointerLiteralSymbol]: UniffiHandle;
+  private constructor();
+  length(asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<bigint>;
+  readAt(offset: bigint, length: number, asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<ArrayBuffer>;
+  writeAt(offset: bigint, data: ArrayBuffer, asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<void>;
+  setLength(length: bigint, asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<void>;
+  uniffiDestroy(): void;
+  static instanceOf(obj_: any): obj_ is RangeSinkImpl;
+}
+/**
+ * The surface an authoring plugin implements: the read half plus `reserve_slot`.
+ */
+interface PluginAuthor {
+  /**
+   * The media types this plugin owns: its dispatch set, declared as data.
+   */
+  mediaTypes(): Array<string>;
+  /**
+   * Recognize the format from the real asset, or `None` to decline it.
+   *
+   * Signing never calls this: it dispatches on `media_types` against the format the caller
+   * resolved, because at sign time the caller is authoritative about what it is signing.
+   * Implement it correctly anyway, since the verify side dispatches on it and whatever
+   * signs a format is eventually verified by it.
+   */
+  sniff(src: RangeSource, asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<string | undefined>;
+  /**
+   * The manifest window(s), or empty when none is present. MUST be byte-identical
+   * regardless of slot contents; the sign driver enforces that with a round-trip.
+   */
+  locate(src: RangeSource, asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<Array<Region>>;
+  /**
+   * Reserve `reserve` bytes of manifest slot by writing container structure through
+   * `dst`, and return exactly where it landed. The core excludes those regions from the
+   * content hash and writes the signed manifest into them, so the plugin never embeds
+   * and never re-locates.
+   */
+  reserveSlot(dst: RangeSink, reserve: bigint, asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<Array<Region>>;
+}
+/**
+ * The plugins one `sign`/`embed` call may dispatch to.
+ */
+interface PluginRegistryLike {
+  /**
+   * Whether no plugin is registered, meaning a c2pa-only sign.
+   *
+   * # Errors
+   *
+   * `Internal` when the registry lock was poisoned by a panicking plugin.
+   */
+  isEmpty(): boolean;
+  /**
+   * How many plugins are registered.
+   *
+   * # Errors
+   *
+   * `Internal` when the registry lock was poisoned by a panicking plugin.
+   */
+  len(): number;
+  /**
+   * Add one plugin. The first registered whose declared media types match the resolved
+   * format owns the asset; a c2pa-native layout is signed internally when none does.
+   *
+   * # Errors
+   *
+   * `Internal` when the registry lock was poisoned by a panicking plugin.
+   */
+  register(plugin: PluginAuthor): void;
+}
+/**
+ * @deprecated Use `PluginRegistryLike` instead.
+ */
+type PluginRegistryInterface = PluginRegistryLike;
+/**
+ * The plugins one `sign`/`embed` call may dispatch to.
+ */
+declare class PluginRegistry extends UniffiAbstractObject implements PluginRegistryLike {
+  readonly [uniffiTypeNameSymbol] = "PluginRegistry";
+  readonly [destructorGuardSymbol]: UniffiGcObject;
+  readonly [pointerLiteralSymbol]: UniffiHandle;
+  constructor();
+  /**
+   * Whether no plugin is registered, meaning a c2pa-only sign.
+   *
+   * # Errors
+   *
+   * `Internal` when the registry lock was poisoned by a panicking plugin.
+   */
+  isEmpty(): boolean;
+  /**
+   * How many plugins are registered.
+   *
+   * # Errors
+   *
+   * `Internal` when the registry lock was poisoned by a panicking plugin.
+   */
+  len(): number;
+  /**
+   * Add one plugin. The first registered whose declared media types match the resolved
+   * format owns the asset; a c2pa-native layout is signed internally when none does.
+   *
+   * # Errors
+   *
+   * `Internal` when the registry lock was poisoned by a panicking plugin.
+   */
+  register(plugin: PluginAuthor): void;
+  uniffiDestroy(): void;
+  static instanceOf(obj_: any): obj_ is PluginRegistry;
+}
+/**
+ * Everything one [`embed`] needs beyond the sink and the manifest.
+ *
+ * `format` overrides the format sniffed from the sink's leading bytes. `plugins` resolves a
+ * non-c2pa format (e.g. MXF) the same way [`AssetIssuer::sign`](asset::AssetIssuer::sign) did; a
+ * c2pa-native embed needs none.
+ */
+type EmbedOptions = {
+  format?: string;
+  plugins?: PluginRegistryLike;
+};
+/**
+ * Generated factory for {@link EmbedOptions} record objects.
+ */
+declare const EmbedOptions: Readonly<{
+  create: (partial: Partial<EmbedOptions> & Required<Omit<EmbedOptions, "format" | "plugins">>) => EmbedOptions;
+  new: (partial: Partial<EmbedOptions> & Required<Omit<EmbedOptions, "format" | "plugins">>) => EmbedOptions;
+  defaults: () => Partial<EmbedOptions>;
+}>;
+/**
+ * Pass `None` to skip the CAWG identity signing path entirely. `identities`
+ * is a JSON array of CAWG `VerifiedIdentity` objects.
+ */
+type IdentityOptions = {
+  roles: Array<string>;
+  identities: Value;
+};
+/**
+ * Generated factory for {@link IdentityOptions} record objects.
+ */
+declare const IdentityOptions: Readonly<{
+  create: (partial: Partial<IdentityOptions> & Required<Omit<IdentityOptions, never>>) => IdentityOptions;
+  new: (partial: Partial<IdentityOptions> & Required<Omit<IdentityOptions, never>>) => IdentityOptions;
+  defaults: () => Partial<IdentityOptions>;
+}>;
+/**
+ * Result of [`StreamIssuer::init`](super::StreamIssuer::init). `valid_until_epoch_secs` is the
+ * UNIX-epoch second at which the session key's validity elapses.
+ */
+type InitOutcome = {
+  signedInitBytes: ArrayBuffer;
+  validUntilEpochSecs: bigint;
+};
+/**
+ * Generated factory for {@link InitOutcome} record objects.
+ */
+declare const InitOutcome: Readonly<{
+  create: (partial: Partial<InitOutcome> & Required<Omit<InitOutcome, never>>) => InitOutcome;
+  new: (partial: Partial<InitOutcome> & Required<Omit<InitOutcome, never>>) => InitOutcome;
+  defaults: () => Partial<InitOutcome>;
+}>;
+type OpenedOrigin = {
+  parent: Ingredient;
+  detail?: ActionDetail;
+};
+/**
+ * Generated factory for {@link OpenedOrigin} record objects.
+ */
+declare const OpenedOrigin: Readonly<{
+  create: (partial: Partial<OpenedOrigin> & Required<Omit<OpenedOrigin, "detail">>) => OpenedOrigin;
+  new: (partial: Partial<OpenedOrigin> & Required<Omit<OpenedOrigin, "detail">>) => OpenedOrigin;
+  defaults: () => Partial<OpenedOrigin>;
+}>;
+declare enum Origin_Tags {
+  Created = "Created",
+  Opened = "Opened"
+}
+declare const Origin: Readonly<{
+  instanceOf: (obj: any) => obj is Origin;
+  Created: {
+    new (v0: CreatedOrigin): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "Origin";
+      readonly tag: Origin_Tags.Created;
+      readonly inner: Readonly<[CreatedOrigin]>;
+    };
+    "new"(v0: CreatedOrigin): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "Origin";
+      readonly tag: Origin_Tags.Created;
+      readonly inner: Readonly<[CreatedOrigin]>;
+    };
+    instanceOf(obj: any): obj is {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "Origin";
+      readonly tag: Origin_Tags.Created;
+      readonly inner: Readonly<[CreatedOrigin]>;
+    };
+  };
+  Opened: {
+    new (v0: OpenedOrigin): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "Origin";
+      readonly tag: Origin_Tags.Opened;
+      readonly inner: Readonly<[OpenedOrigin]>;
+    };
+    "new"(v0: OpenedOrigin): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "Origin";
+      readonly tag: Origin_Tags.Opened;
+      readonly inner: Readonly<[OpenedOrigin]>;
+    };
+    instanceOf(obj: any): obj is {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "Origin";
+      readonly tag: Origin_Tags.Opened;
+      readonly inner: Readonly<[OpenedOrigin]>;
+    };
+  };
+}>;
+type Origin = InstanceType<typeof Origin['Created' | 'Opened']>;
+/**
+ * The C2PA workflow actions expressible as facts. Lifecycle actions
+ * (`c2pa.created`/`opened`/`placed`/`removed`) are not representable; the
+ * signer derives them from [`Origin`] and [`Component`]s.
+ */
+declare enum ActionKind {
+  ColorAdjustments = 0,
+  Converted = 1,
+  Cropped = 2,
+  Drawing = 3,
+  Edited = 4,
+  Filtered = 5,
+  Orientation = 6,
+  Published = 7,
+  Repackaged = 8,
+  Resized = 9,
+  Transcoded = 10,
+  Unknown = 11,
+  /**
+   * An invisible watermark was inserted, creating a soft binding that resolves back to this
+   * manifest. Supply the corresponding binding strategy on the signing request;
+   * signing fails if nothing in the request describes the watermark.
+   */
+  WatermarkedBound = 12,
+  /**
+   * An invisible watermark was inserted that creates no soft binding, so nothing resolves it
+   * back to this manifest. A signposting layer is one.
+   */
+  WatermarkedUnbound = 13
+}
+/**
+ * One C2PA workflow action applied to the asset, in application order.
+ */
+type StandardAction = {
+  kind: ActionKind;
+  detail?: ActionDetail;
+  /**
+   * `Component.id`s this action acted on.
+   */
+  componentIds?: Array<string>;
+};
+/**
+ * Generated factory for {@link StandardAction} record objects.
+ */
+declare const StandardAction: Readonly<{
+  create: (partial: Partial<StandardAction> & Required<Omit<StandardAction, "componentIds" | "detail">>) => StandardAction;
+  new: (partial: Partial<StandardAction> & Required<Omit<StandardAction, "componentIds" | "detail">>) => StandardAction;
+  defaults: () => Partial<StandardAction>;
+}>;
+declare enum Action_Tags {
+  Custom = "Custom",
+  Standard = "Standard"
+}
+/**
+ * A workflow action: standard C2PA vocabulary or entity-namespaced.
+ * Discriminated structurally: variants are tried in declaration order:
+ * [`Standard`](StandardAction) (has `kind`), then [`Custom`](CustomAction)
+ * (has `label`); first with all required fields present wins.
+ *
+ * With no discriminant, a value matching *neither* shape (e.g. a `Standard`
+ * with an unknown `kind`, or a `Custom` missing `label`) fails with a
+ * non-specific "not `StandardAction | CustomAction`" error that doesn't name
+ * the offending field.
+ */
+declare const Action: Readonly<{
+  instanceOf: (obj: any) => obj is Action;
+  Custom: {
+    new (v0: CustomAction): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "Action";
+      readonly tag: Action_Tags.Custom;
+      readonly inner: Readonly<[CustomAction]>;
+    };
+    "new"(v0: CustomAction): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "Action";
+      readonly tag: Action_Tags.Custom;
+      readonly inner: Readonly<[CustomAction]>;
+    };
+    instanceOf(obj: any): obj is {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "Action";
+      readonly tag: Action_Tags.Custom;
+      readonly inner: Readonly<[CustomAction]>;
+    };
+  };
+  Standard: {
+    new (v0: StandardAction): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "Action";
+      readonly tag: Action_Tags.Standard;
+      readonly inner: Readonly<[StandardAction]>;
+    };
+    "new"(v0: StandardAction): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "Action";
+      readonly tag: Action_Tags.Standard;
+      readonly inner: Readonly<[StandardAction]>;
+    };
+    instanceOf(obj: any): obj is {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "Action";
+      readonly tag: Action_Tags.Standard;
+      readonly inner: Readonly<[StandardAction]>;
+    };
+  };
+}>;
+/**
+ * A workflow action: standard C2PA vocabulary or entity-namespaced.
+ * Discriminated structurally: variants are tried in declaration order:
+ * [`Standard`](StandardAction) (has `kind`), then [`Custom`](CustomAction)
+ * (has `label`); first with all required fields present wins.
+ *
+ * With no discriminant, a value matching *neither* shape (e.g. a `Standard`
+ * with an unknown `kind`, or a `Custom` missing `label`) fails with a
+ * non-specific "not `StandardAction | CustomAction`" error that doesn't name
+ * the offending field.
+ */
+type Action = InstanceType<typeof Action['Custom' | 'Standard']>;
+type ManifestSpec = {
+  title?: string;
+  origin: Origin;
+  actions?: Array<Action>;
+  identity?: IdentityOptions;
+  thumbnail?: Thumbnail;
+  assertions?: Array<Assertion>;
+  components?: Array<Component>;
+};
+/**
+ * Generated factory for {@link ManifestSpec} record objects.
+ */
+declare const ManifestSpec: Readonly<{
+  create: (partial: Partial<ManifestSpec> & Required<Omit<ManifestSpec, "actions" | "assertions" | "components" | "identity" | "thumbnail" | "title">>) => ManifestSpec;
+  new: (partial: Partial<ManifestSpec> & Required<Omit<ManifestSpec, "actions" | "assertions" | "components" | "identity" | "thumbnail" | "title">>) => ManifestSpec;
+  defaults: () => Partial<ManifestSpec>;
+}>;
+/**
+ * Everything one [`AssetMarker::mark`] needs beyond the asset.
+ */
+type MarkOptions = {
+  /**
+   * Filename recorded with the mark, and the multipart part name.
+   */
+  fileName?: string;
+  /**
+   * Skip the signposting layer, leaving only marks that resolve back to the manifest.
+   */
+  skipSignpost?: boolean;
+};
+/**
+ * Generated factory for {@link MarkOptions} record objects.
+ */
+declare const MarkOptions: Readonly<{
+  create: (partial: Partial<MarkOptions> & Required<Omit<MarkOptions, "fileName" | "skipSignpost">>) => MarkOptions;
+  new: (partial: Partial<MarkOptions> & Required<Omit<MarkOptions, "fileName" | "skipSignpost">>) => MarkOptions;
+  defaults: () => Partial<MarkOptions>;
+}>;
+type SoftBinding = {
+  alg: string;
+  value: string;
+};
+/**
+ * Generated factory for {@link SoftBinding} record objects.
+ */
+declare const SoftBinding: Readonly<{
+  create: (partial: Partial<SoftBinding> & Required<Omit<SoftBinding, never>>) => SoftBinding;
+  new: (partial: Partial<SoftBinding> & Required<Omit<SoftBinding, never>>) => SoftBinding;
+  defaults: () => Partial<SoftBinding>;
+}>;
+declare enum Mark_Tags {
+  Bound = "Bound",
+  Unbound = "Unbound"
+}
+declare const Mark: Readonly<{
+  instanceOf: (obj: any) => obj is Mark;
+  Bound: {
+    new (inner: {
+      binding: SoftBinding;
+    }): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "Mark";
+      readonly tag: Mark_Tags.Bound;
+      readonly inner: Readonly<{
+        binding: SoftBinding;
+      }>;
+    };
+    "new"(inner: {
+      binding: SoftBinding;
+    }): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "Mark";
+      readonly tag: Mark_Tags.Bound;
+      readonly inner: Readonly<{
+        binding: SoftBinding;
+      }>;
+    };
+    instanceOf(obj: any): obj is {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "Mark";
+      readonly tag: Mark_Tags.Bound;
+      readonly inner: Readonly<{
+        binding: SoftBinding;
+      }>;
+    };
+  };
+  Unbound: {
+    new (): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "Mark";
+      readonly tag: Mark_Tags.Unbound;
+    };
+    "new"(): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "Mark";
+      readonly tag: Mark_Tags.Unbound;
+    };
+    instanceOf(obj: any): obj is {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "Mark";
+      readonly tag: Mark_Tags.Unbound;
+    };
+  };
+}>;
+type Mark = InstanceType<typeof Mark['Bound' | 'Unbound']>;
+/**
+ * Result of [`AssetMarker::mark`](super::AssetMarker::mark): the marked asset and the provenance
+ * its marking created. The neutral core is [`marker::Marked`]; this differs only in carrying the
+ * asset as [`Bytes`].
+ */
+type Marked = {
+  /**
+   * The marked asset. Sign these bytes, not the ones handed in.
+   */
+  bytes: ArrayBuffer;
+  /**
+   * The marked asset's media type, which a marker may change by re-encoding.
+   */
+  format: string;
+  /**
+   * The name the marking service recorded.
+   */
+  fileName: string;
+  /**
+   * Every mark applied, in the order applied.
+   */
+  marks: Array<Mark>;
+  /**
+   * One `c2pa.watermarked.bound` or `.unbound` per mark, in the same order. Append to the
+   * manifest's `actions`.
+   */
+  actions: Array<Action>;
+  /**
+   * What the bound marks resolve through; index the manifest under these.
+   */
+  bindings: Array<SoftBinding>;
+};
+/**
+ * Generated factory for {@link Marked} record objects.
+ */
+declare const Marked: Readonly<{
+  create: (partial: Partial<Marked> & Required<Omit<Marked, never>>) => Marked;
+  new: (partial: Partial<Marked> & Required<Omit<Marked, never>>) => Marked;
+  defaults: () => Partial<Marked>;
+}>;
+/**
+ * `validity_period_secs` is the session-key validity window in seconds
+ * after `created_at`; the verifier rejects segments signed past this
+ * (plus skew tolerance).
+ *
+ * `refresh_percent` is 0..=100; once this percentage of
+ * `validity_period_secs` elapses, `sign` returns `rotation_due: true`
+ * so the consumer can rotate before verifier-side expiry.
+ */
+type RotationPolicy = {
+  validityPeriodSecs: number;
+  refreshPercent: number;
+};
+/**
+ * Generated factory for {@link RotationPolicy} record objects.
+ */
+declare const RotationPolicy: Readonly<{
+  create: (partial: Partial<RotationPolicy> & Required<Omit<RotationPolicy, "refreshPercent" | "validityPeriodSecs">>) => RotationPolicy;
+  new: (partial: Partial<RotationPolicy> & Required<Omit<RotationPolicy, "refreshPercent" | "validityPeriodSecs">>) => RotationPolicy;
+  defaults: () => Partial<RotationPolicy>;
+}>;
+/**
+ * A soft-binding binder: how a recoverable binding is derived from an asset. Put these inside the
+ * issuer's manifest mode to sign and index under them, and pass them in verify options to recover.
+ */
+interface BinderLike {
+  /**
+   * This binder's binding for `source`, or `None` when there is none. `format` overrides
+   * the format sniffed from the leading bytes.
+   *
+   * `None` and an error mean different things: `None` is "no binding here", an error is
+   * "the question could not be answered", so a binder that failed never reads as an
+   * unmarked asset.
+   *
+   * # Errors
+   *
+   * An unreadable source, or a binder that could not answer.
+   */
+  derive(source: RangeSource, options: DeriveOptions, asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<SoftBinding | undefined>;
+}
+/**
+ * @deprecated Use `BinderLike` instead.
+ */
+type BinderInterface = BinderLike;
+/**
+ * A soft-binding binder: how a recoverable binding is derived from an asset. Put these inside the
+ * issuer's manifest mode to sign and index under them, and pass them in verify options to recover.
+ */
+declare class Binder extends UniffiAbstractObject implements BinderLike {
+  readonly [uniffiTypeNameSymbol] = "Binder";
+  readonly [destructorGuardSymbol]: UniffiGcObject;
+  readonly [pointerLiteralSymbol]: UniffiHandle;
+  private constructor();
+  /**
+   * A binding you already hold, such as an out-of-band video ISCC. Reads nothing.
+   */
+  static held(binding: SoftBinding): BinderLike;
+  /**
+   * Local ISCC Image-Code for supported image formats.
+   */
+  static iscc(): BinderLike;
+  /**
+   * This binder's binding for `source`, or `None` when there is none. `format` overrides
+   * the format sniffed from the leading bytes.
+   *
+   * `None` and an error mean different things: `None` is "no binding here", an error is
+   * "the question could not be answered", so a binder that failed never reads as an
+   * unmarked asset.
+   *
+   * # Errors
+   *
+   * An unreadable source, or a binder that could not answer.
+   */
+  derive(source: RangeSource, options: DeriveOptions, asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<SoftBinding | undefined>;
+  uniffiDestroy(): void;
+  static instanceOf(obj_: any): obj_ is Binder;
+}
+declare enum ManifestMode_Tags {
+  Embedded = "Embedded",
+  Remote = "Remote",
+  Both = "Both"
+}
+/**
+ * How the manifest is delivered and which soft-binding strategies it declares.
+ *
+ * Embedded manifests may still need bindings, for example to describe a bound watermark, but
+ * are not indexed. Remote requires at least one resolved binding at the signer protocol boundary;
+ * both is recoverable through its embedded manifest and permits an empty strategy list.
+ */
+declare const ManifestMode: Readonly<{
+  instanceOf: (obj: any) => obj is ManifestMode;
+  Embedded: {
+    new (inner: {
+      binders: Array<BinderLike>;
+      into?: RangeSink;
+    }): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "ManifestMode";
+      readonly tag: ManifestMode_Tags.Embedded;
+      readonly inner: Readonly<{
+        binders: Array<BinderLike>;
+        into?: RangeSink;
+      }>;
+    };
+    new: (partial: Parameters<(partial: Partial<{
+      binders: Array<BinderLike>;
+      into?: RangeSink;
+    }> & Required<Omit<{
+      binders: Array<BinderLike>;
+      into?: RangeSink;
+    }, "binders" | "into">>) => {
+      binders: Array<BinderLike>;
+      into?: RangeSink;
+    }>[0]) => {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "ManifestMode";
+      readonly tag: ManifestMode_Tags.Embedded;
+      readonly inner: Readonly<{
+        binders: Array<BinderLike>;
+        into?: RangeSink;
+      }>;
+    };
+    instanceOf(obj: any): obj is {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "ManifestMode";
+      readonly tag: ManifestMode_Tags.Embedded;
+      readonly inner: Readonly<{
+        binders: Array<BinderLike>;
+        into?: RangeSink;
+      }>;
+    };
+  };
+  Remote: {
+    new (inner: {
+      binders: Array<BinderLike>;
+    }): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "ManifestMode";
+      readonly tag: ManifestMode_Tags.Remote;
+      readonly inner: Readonly<{
+        binders: Array<BinderLike>;
+      }>;
+    };
+    "new"(inner: {
+      binders: Array<BinderLike>;
+    }): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "ManifestMode";
+      readonly tag: ManifestMode_Tags.Remote;
+      readonly inner: Readonly<{
+        binders: Array<BinderLike>;
+      }>;
+    };
+    instanceOf(obj: any): obj is {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "ManifestMode";
+      readonly tag: ManifestMode_Tags.Remote;
+      readonly inner: Readonly<{
+        binders: Array<BinderLike>;
+      }>;
+    };
+  };
+  Both: {
+    new (inner: {
+      binders: Array<BinderLike>;
+      into?: RangeSink;
+    }): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "ManifestMode";
+      readonly tag: ManifestMode_Tags.Both;
+      readonly inner: Readonly<{
+        binders: Array<BinderLike>;
+        into?: RangeSink;
+      }>;
+    };
+    new: (partial: Parameters<(partial: Partial<{
+      binders: Array<BinderLike>;
+      into?: RangeSink;
+    }> & Required<Omit<{
+      binders: Array<BinderLike>;
+      into?: RangeSink;
+    }, "binders" | "into">>) => {
+      binders: Array<BinderLike>;
+      into?: RangeSink;
+    }>[0]) => {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "ManifestMode";
+      readonly tag: ManifestMode_Tags.Both;
+      readonly inner: Readonly<{
+        binders: Array<BinderLike>;
+        into?: RangeSink;
+      }>;
+    };
+    instanceOf(obj: any): obj is {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "ManifestMode";
+      readonly tag: ManifestMode_Tags.Both;
+      readonly inner: Readonly<{
+        binders: Array<BinderLike>;
+        into?: RangeSink;
+      }>;
+    };
+  };
+}>;
+/**
+ * How the manifest is delivered and which soft-binding strategies it declares.
+ *
+ * Embedded manifests may still need bindings, for example to describe a bound watermark, but
+ * are not indexed. Remote requires at least one resolved binding at the signer protocol boundary;
+ * both is recoverable through its embedded manifest and permits an empty strategy list.
+ */
+type ManifestMode = InstanceType<typeof ManifestMode['Embedded' | 'Remote' | 'Both']>;
+/**
+ * Options for `sign`. The mode owns delivery and binding strategies; format and plugins remain
+ * independent transport concerns.
+ */
+type SignOptions = {
+  mode: ManifestMode;
+  format?: string;
+  /**
+   * Resolves a non-c2pa format (e.g. MXF); a c2pa-native sign needs none.
+   */
+  plugins?: PluginRegistryLike;
+};
+/**
+ * Generated factory for {@link SignOptions} record objects.
+ */
+declare const SignOptions: Readonly<{
+  create: (partial: Partial<SignOptions> & Required<Omit<SignOptions, "format" | "plugins">>) => SignOptions;
+  new: (partial: Partial<SignOptions> & Required<Omit<SignOptions, "format" | "plugins">>) => SignOptions;
+  defaults: () => Partial<SignOptions>;
+}>;
+/**
+ * Result of [`AssetIssuer::sign`](super::AssetIssuer::sign): the sidecar to embed plus its active
+ * C2PA manifest id. Remote and both modes persist that id; embedded mode does not.
+ */
+type SignOutcome = {
+  /**
+   * The manifest sidecar to embed into the asset (see [`embed`](crate::ffi::embed)).
+   */
+  sidecar: ArrayBuffer;
+  /**
+   * Active C2PA manifest id.
+   */
+  manifestId: string;
+};
+/**
+ * Generated factory for {@link SignOutcome} record objects.
+ */
+declare const SignOutcome: Readonly<{
+  create: (partial: Partial<SignOutcome> & Required<Omit<SignOutcome, never>>) => SignOutcome;
+  new: (partial: Partial<SignOutcome> & Required<Omit<SignOutcome, never>>) => SignOutcome;
+  defaults: () => Partial<SignOutcome>;
+}>;
+/**
+ * Result of [`StreamSession::sign`](super::StreamSession::sign). `rotation_due` flips once
+ * `policy.refresh_percent`% of validity has elapsed; `valid_until_epoch_secs` is repeated
+ * per segment so callers can schedule rotation precisely instead of reacting only to the
+ * flag.
+ */
+type SignedSegmentOutcome = {
+  bytes: ArrayBuffer;
+  rotationDue: boolean;
+  validUntilEpochSecs: bigint;
+};
+/**
+ * Generated factory for {@link SignedSegmentOutcome} record objects.
+ */
+declare const SignedSegmentOutcome: Readonly<{
+  create: (partial: Partial<SignedSegmentOutcome> & Required<Omit<SignedSegmentOutcome, never>>) => SignedSegmentOutcome;
+  new: (partial: Partial<SignedSegmentOutcome> & Required<Omit<SignedSegmentOutcome, never>>) => SignedSegmentOutcome;
+  defaults: () => Partial<SignedSegmentOutcome>;
+}>;
+/**
+ * One live stream, from `init` to `stop`.
+ *
+ * Carries the whole per-stream state, so it cannot be mistyped, reused after `stop`, or
+ * confused with another stream's: every call after `init` goes through the handle that started
+ * it, and nothing about the stream ever appears in a caller's argument list again.
+ */
+interface StreamSessionLike {
+  /**
+   * Sign one media (moof) segment from a [`RangeSource`]. Does not touch the signer channel;
+   * works through a signer outage. `rotation_due` flips when the key validity threshold
+   * passes; re-`init` on the issuer to rotate.
+   *
+   * # Errors
+   *
+   * Fails on a vault error, or a segment that isn't a BMFF media segment.
+   */
+  sign(body: RangeSource, asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<SignedSegmentOutcome>;
+  /**
+   * End the stream: forget its session key, so nothing can sign under it again.
+   *
+   * # Errors
+   *
+   * Fails on a vault error.
+   */
+  stop(asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<void>;
+}
+/**
+ * @deprecated Use `StreamSessionLike` instead.
+ */
+type StreamSessionInterface = StreamSessionLike;
+/**
+ * One live stream, from `init` to `stop`.
+ *
+ * Carries the whole per-stream state, so it cannot be mistyped, reused after `stop`, or
+ * confused with another stream's: every call after `init` goes through the handle that started
+ * it, and nothing about the stream ever appears in a caller's argument list again.
+ */
+declare class StreamSession extends UniffiAbstractObject implements StreamSessionLike {
+  readonly [uniffiTypeNameSymbol] = "StreamSession";
+  readonly [destructorGuardSymbol]: UniffiGcObject;
+  readonly [pointerLiteralSymbol]: UniffiHandle;
+  private constructor();
+  /**
+   * Sign one media (moof) segment from a [`RangeSource`]. Does not touch the signer channel;
+   * works through a signer outage. `rotation_due` flips when the key validity threshold
+   * passes; re-`init` on the issuer to rotate.
+   *
+   * # Errors
+   *
+   * Fails on a vault error, or a segment that isn't a BMFF media segment.
+   */
+  sign(body: RangeSource, asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<SignedSegmentOutcome>;
+  /**
+   * End the stream: forget its session key, so nothing can sign under it again.
+   *
+   * # Errors
+   *
+   * Fails on a vault error.
+   */
+  stop(asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<void>;
+  uniffiDestroy(): void;
+  static instanceOf(obj_: any): obj_ is StreamSession;
+}
+/**
+ * What [`StreamIssuer::init`] hands back: the signed init segment, and the session to sign the
+ * rest of the stream through.
+ */
+type StreamStart = {
+  /**
+   * The signed init (moov) segment and the session key's expiry.
+   */
+  init: InitOutcome;
+  /**
+   * Sign every subsequent media segment through this.
+   */
+  session: StreamSessionLike;
+};
+/**
+ * Generated factory for {@link StreamStart} record objects.
+ */
+declare const StreamStart: Readonly<{
+  create: (partial: Partial<StreamStart> & Required<Omit<StreamStart, never>>) => StreamStart;
+  new: (partial: Partial<StreamStart> & Required<Omit<StreamStart, never>>) => StreamStart;
+  defaults: () => Partial<StreamStart>;
+}>;
+/**
+ * `kid` is the vault-derived handle (typically SHA-256 of SEC1 public).
+ * `public_key_sec1` is uncompressed SEC1 (65 bytes starting with `0x04`
+ * for ES256); the SDK rewraps as `COSE_Key` for §19.4.4.
+ */
+type VaultPublicKey = {
+  kid: ArrayBuffer;
+  publicKeySec1: ArrayBuffer;
+};
+/**
+ * Generated factory for {@link VaultPublicKey} record objects.
+ */
+declare const VaultPublicKey: Readonly<{
+  create: (partial: Partial<VaultPublicKey> & Required<Omit<VaultPublicKey, never>>) => VaultPublicKey;
+  new: (partial: Partial<VaultPublicKey> & Required<Omit<VaultPublicKey, never>>) => VaultPublicKey;
+  defaults: () => Partial<VaultPublicKey>;
+}>;
+/**
+ * Whether a fragmented-MP4 segment is the init (moov) or a media (moof) segment: which
+ * [`StreamIssuer`](stream::StreamIssuer) entrypoint (`init` vs `sign`) a segment belongs to.
+ */
+declare enum SegmentKind {
+  Init = 0,
+  Media = 1,
+  Unknown = 2
+}
+/**
+ * A C2PA asset signer bound to a [`SignerClient`](super::client::SignerClient).
+ * Construct once with [`create`](Self::create), sign many.
+ */
+interface AssetIssuerLike {
+  /**
+   * Sign an asset from a [`RangeSource`], returning the sidecar plus the registry
+   * `manifest_id`. `options.mode` selects delivery, binding strategies, and, through its
+   * `into`, the sink the signed asset is written through. `options.format` overrides the
+   * format sniffed from the source's leading bytes. `options.plugins` resolves a non-c2pa
+   * format (e.g. MXF); see the module docs for the dispatch.
+   *
+   * # Errors
+   *
+   * Fails on RPC failure, a hashing error, an authoring error, a protocol violation,
+   * or when the format can't be inferred and none was given.
+   */
+  sign(source: RangeSource, manifest: ManifestSpec, options: SignOptions, asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<SignOutcome>;
+}
+/**
+ * @deprecated Use `AssetIssuerLike` instead.
+ */
+type AssetIssuerInterface = AssetIssuerLike;
+/**
+ * A C2PA asset signer bound to a [`SignerClient`](super::client::SignerClient).
+ * Construct once with [`create`](Self::create), sign many.
+ */
+declare class AssetIssuer extends UniffiAbstractObject implements AssetIssuerLike {
+  readonly [uniffiTypeNameSymbol] = "AssetIssuer";
+  readonly [destructorGuardSymbol]: UniffiGcObject;
+  readonly [pointerLiteralSymbol]: UniffiHandle;
+  private constructor();
+  /**
+   * Build a signer over an existing signer connection.
+   */
+  static create(client: SignerClientLike): AssetIssuerLike;
+  /**
+   * Sign an asset from a [`RangeSource`], returning the sidecar plus the registry
+   * `manifest_id`. `options.mode` selects delivery, binding strategies, and, through its
+   * `into`, the sink the signed asset is written through. `options.format` overrides the
+   * format sniffed from the source's leading bytes. `options.plugins` resolves a non-c2pa
+   * format (e.g. MXF); see the module docs for the dispatch.
+   *
+   * # Errors
+   *
+   * Fails on RPC failure, a hashing error, an authoring error, a protocol violation,
+   * or when the format can't be inferred and none was given.
+   */
+  sign(source: RangeSource, manifest: ManifestSpec, options: SignOptions, asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<SignOutcome>;
+  uniffiDestroy(): void;
+  static instanceOf(obj_: any): obj_ is AssetIssuer;
+}
+/**
+ * Applies invisible watermarks through the deployment's marking service.
+ *
+ * Separate from [`AssetIssuer`] because marking is a content edit, not a signing step: it
+ * changes pixels, it happens before signing, and it returns the provenance facts it created
+ * rather than leaving anything downstream to infer them.
+ */
+interface AssetMarkerLike {
+  /**
+   * Mark an image from a [`RangeSource`] and return it with the actions and bindings the
+   * marking created. `format` overrides the sniffed format.
+   *
+   * # Errors
+   *
+   * Fails when the format can't be resolved, the asset is above the upload ceiling, the HTTP
+   * request fails, or the service response is malformed.
+   */
+  mark(source: RangeSource, format: string | undefined, options: MarkOptions, asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<Marked>;
+}
+/**
+ * @deprecated Use `AssetMarkerLike` instead.
+ */
+type AssetMarkerInterface = AssetMarkerLike;
+/**
+ * Applies invisible watermarks through the deployment's marking service.
+ *
+ * Separate from [`AssetIssuer`] because marking is a content edit, not a signing step: it
+ * changes pixels, it happens before signing, and it returns the provenance facts it created
+ * rather than leaving anything downstream to infer them.
+ */
+declare class AssetMarker extends UniffiAbstractObject implements AssetMarkerLike {
+  readonly [uniffiTypeNameSymbol] = "AssetMarker";
+  readonly [destructorGuardSymbol]: UniffiGcObject;
+  readonly [pointerLiteralSymbol]: UniffiHandle;
+  private constructor();
+  /**
+   * Build a marker over a connected client.
+   */
+  static create(client: SignerClientLike): AssetMarkerLike;
+  /**
+   * Mark an image from a [`RangeSource`] and return it with the actions and bindings the
+   * marking created. `format` overrides the sniffed format.
+   *
+   * # Errors
+   *
+   * Fails when the format can't be resolved, the asset is above the upload ceiling, the HTTP
+   * request fails, or the service response is malformed.
+   */
+  mark(source: RangeSource, format: string | undefined, options: MarkOptions, asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<Marked>;
+  uniffiDestroy(): void;
+  static instanceOf(obj_: any): obj_ is AssetMarker;
+}
+/**
+ * A [`RangeSink`] over a local file, opened and written by the SDK itself. The write twin of
+ * [`FileSource`](super::source::FileSource), and the counterpart [`MemorySink`] has no answer to.
+ *
+ * The only sink whose bytes never enter the host language. A [`RangeSink`] written in the host is
+ * called back into for every range, on the host thread that made the call, and [`MemorySink`]
+ * avoids that only by holding the whole asset. A path costs neither, so the writes land on the
+ * same SDK worker thread that is already composing.
+ *
+ * That is what makes [`MemorySink`]'s ceiling stop applying: there is no byte array to count in an
+ * `i32` and nothing resident, so a multi-GB master is signed at the disk's speed rather than the
+ * host thread's, and `bytes()` is not something anyone has to call.
+ *
+ * No lock. A positioned write to a file is one `pwrite`, which the OS already makes atomic per
+ * call, and [`RangeWriter`] takes a shared borrow precisely so a backend like this pays nothing
+ * for being shared.
+ */
+interface FileSinkLike {
+  length(asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<bigint>;
+  readAt(offset: bigint, length: number, asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<ArrayBuffer>;
+  setLength(length: bigint, asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<void>;
+  writeAt(offset: bigint, data: ArrayBuffer, asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<void>;
+}
+/**
+ * @deprecated Use `FileSinkLike` instead.
+ */
+type FileSinkInterface = FileSinkLike;
+/**
+ * A [`RangeSink`] over a local file, opened and written by the SDK itself. The write twin of
+ * [`FileSource`](super::source::FileSource), and the counterpart [`MemorySink`] has no answer to.
+ *
+ * The only sink whose bytes never enter the host language. A [`RangeSink`] written in the host is
+ * called back into for every range, on the host thread that made the call, and [`MemorySink`]
+ * avoids that only by holding the whole asset. A path costs neither, so the writes land on the
+ * same SDK worker thread that is already composing.
+ *
+ * That is what makes [`MemorySink`]'s ceiling stop applying: there is no byte array to count in an
+ * `i32` and nothing resident, so a multi-GB master is signed at the disk's speed rather than the
+ * host thread's, and `bytes()` is not something anyone has to call.
+ *
+ * No lock. A positioned write to a file is one `pwrite`, which the OS already makes atomic per
+ * call, and [`RangeWriter`] takes a shared borrow precisely so a backend like this pays nothing
+ * for being shared.
+ */
+declare class FileSink extends UniffiAbstractObject implements FileSinkLike {
+  readonly [uniffiTypeNameSymbol] = "FileSink";
+  readonly [destructorGuardSymbol]: UniffiGcObject;
+  readonly [pointerLiteralSymbol]: UniffiHandle;
+  private constructor();
+  /**
+   * Create `path`, or truncate it if it is already there. What `embed` wants: it composes a
+   * whole asset, so the sink starts empty and grows.
+   *
+   * # Errors
+   *
+   * The path cannot be created or opened for writing.
+   */
+  static create(path: string): FileSinkLike;
+  /**
+   * Open an existing `path` for reading and writing, keeping what is in it. What a fixed-slot
+   * patch wants: the asset is already there and only its reserved range changes, so truncating
+   * it would destroy the very thing being signed.
+   *
+   * # Errors
+   *
+   * The path does not exist, is not permitted, or cannot be opened for writing.
+   */
+  static open(path: string): FileSinkLike;
+  length(asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<bigint>;
+  readAt(offset: bigint, length: number, asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<ArrayBuffer>;
+  setLength(length: bigint, asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<void>;
+  writeAt(offset: bigint, data: ArrayBuffer, asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<void>;
+  uniffiDestroy(): void;
+  static instanceOf(obj_: any): obj_ is FileSink;
+}
+/**
+ * A [`RangeSource`] over a local file, opened and read by the SDK itself.
+ *
+ * The only source whose bytes never enter the host language. The other two both put the asset
+ * through it: a [`RangeSource`] written in the host is awaited for every window, and
+ * [`MemorySource`] avoids that only by holding the whole asset and copying it across the
+ * boundary to get there. A path costs neither, so the reads happen on the same thread that is
+ * already hashing, with no crossing at all.
+ *
+ * That is what makes the size ceilings stop applying: there is no byte array to count in an
+ * `i32` and nothing resident, so a multi-GB master reads at the disk's speed rather than the
+ * host thread's.
+ *
+ * This is an implementation of the [`RangeSource`] interface, not a way around it: the SDK still
+ * only ever asks for the ranges it needs, and no entry point takes a path.
+ */
+interface FileSourceLike {
+  length(asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<bigint>;
+  readAt(offset: bigint, length: number, asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<ArrayBuffer>;
+}
+/**
+ * @deprecated Use `FileSourceLike` instead.
+ */
+type FileSourceInterface = FileSourceLike;
+/**
+ * A [`RangeSource`] over a local file, opened and read by the SDK itself.
+ *
+ * The only source whose bytes never enter the host language. The other two both put the asset
+ * through it: a [`RangeSource`] written in the host is awaited for every window, and
+ * [`MemorySource`] avoids that only by holding the whole asset and copying it across the
+ * boundary to get there. A path costs neither, so the reads happen on the same thread that is
+ * already hashing, with no crossing at all.
+ *
+ * That is what makes the size ceilings stop applying: there is no byte array to count in an
+ * `i32` and nothing resident, so a multi-GB master reads at the disk's speed rather than the
+ * host thread's.
+ *
+ * This is an implementation of the [`RangeSource`] interface, not a way around it: the SDK still
+ * only ever asks for the ranges it needs, and no entry point takes a path.
+ */
+declare class FileSource extends UniffiAbstractObject implements FileSourceLike {
+  readonly [uniffiTypeNameSymbol] = "FileSource";
+  readonly [destructorGuardSymbol]: UniffiGcObject;
+  readonly [pointerLiteralSymbol]: UniffiHandle;
+  private constructor();
+  /**
+   * Open `path` for reading.
+   *
+   * # Errors
+   *
+   * The file does not exist, is not permitted, or cannot be opened.
+   */
+  static open(path: string): FileSourceLike;
+  length(asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<bigint>;
+  readAt(offset: bigint, length: number, asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<ArrayBuffer>;
+  uniffiDestroy(): void;
+  static instanceOf(obj_: any): obj_ is FileSource;
+}
+/**
+ * An in-memory [`RangeSink`], for a caller that wants `embed`'s composed result back
+ * without writing a custom sink. A **native** implementation of a `with_foreign`
+ * interface (`#[uniffi::export]` on the trait impl, not the foreign callback path), so
+ * a Python caller writes no subclass: `sink = MemorySink(data)`, pass it to `embed`,
+ * then read `sink.bytes()` back. `&self`-only methods need interior mutability, so the
+ * buffer is `Mutex`-guarded (contention is a non-issue: the SDK calls it from one task
+ * at a time per sink).
+ *
+ * # Size ceiling
+ *
+ * The buffer and the copy `bytes()` returns are resident together, so this suits an asset
+ * that fits in memory twice over. The binding counts a byte array in an `i32`, which puts a
+ * hard 2 GiB ceiling on what `bytes()` can hand back; past it `bytes()` fails rather than
+ * returning a truncated asset that looks structurally fine. Embedding into a larger asset
+ * still works, because the SDK only ever writes and reads bounded ranges. Implement
+ * [`RangeSink`] over a file (or any store that seeks) for anything approaching that: the SDK
+ * writes ranges straight through it and never holds the asset.
+ *
+ * Construction and `bytes()` each copy the whole asset, on the calling thread: together with a
+ * `MemorySource` over the same asset that is about 12ms for 10 MB and 1.2s for 500 MB. A ranged
+ * sink pays none of it.
+ */
+interface MemorySinkLike {
+  /**
+   * The buffer's current contents, e.g. after passing this sink through `embed`. A copy.
+   *
+   * # Errors
+   *
+   * The buffer has grown at or above the 2 GiB a byte array can be counted in. `embed` grows
+   * the sink, so a buffer that fitted at construction need not fit here.
+   */
+  bytes(): ArrayBuffer;
+  length(asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<bigint>;
+  readAt(offset: bigint, length: number, asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<ArrayBuffer>;
+  setLength(length: bigint, asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<void>;
+  writeAt(offset: bigint, data: ArrayBuffer, asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<void>;
+}
+/**
+ * @deprecated Use `MemorySinkLike` instead.
+ */
+type MemorySinkInterface = MemorySinkLike;
+/**
+ * An in-memory [`RangeSink`], for a caller that wants `embed`'s composed result back
+ * without writing a custom sink. A **native** implementation of a `with_foreign`
+ * interface (`#[uniffi::export]` on the trait impl, not the foreign callback path), so
+ * a Python caller writes no subclass: `sink = MemorySink(data)`, pass it to `embed`,
+ * then read `sink.bytes()` back. `&self`-only methods need interior mutability, so the
+ * buffer is `Mutex`-guarded (contention is a non-issue: the SDK calls it from one task
+ * at a time per sink).
+ *
+ * # Size ceiling
+ *
+ * The buffer and the copy `bytes()` returns are resident together, so this suits an asset
+ * that fits in memory twice over. The binding counts a byte array in an `i32`, which puts a
+ * hard 2 GiB ceiling on what `bytes()` can hand back; past it `bytes()` fails rather than
+ * returning a truncated asset that looks structurally fine. Embedding into a larger asset
+ * still works, because the SDK only ever writes and reads bounded ranges. Implement
+ * [`RangeSink`] over a file (or any store that seeks) for anything approaching that: the SDK
+ * writes ranges straight through it and never holds the asset.
+ *
+ * Construction and `bytes()` each copy the whole asset, on the calling thread: together with a
+ * `MemorySource` over the same asset that is about 12ms for 10 MB and 1.2s for 500 MB. A ranged
+ * sink pays none of it.
+ */
+declare class MemorySink extends UniffiAbstractObject implements MemorySinkLike {
+  readonly [uniffiTypeNameSymbol] = "MemorySink";
+  readonly [destructorGuardSymbol]: UniffiGcObject;
+  readonly [pointerLiteralSymbol]: UniffiHandle;
+  /**
+   * # Errors
+   *
+   * The buffer is at or above the 2 GiB a byte array can be counted in.
+   */
+  constructor(data: ArrayBuffer);
+  /**
+   * The buffer's current contents, e.g. after passing this sink through `embed`. A copy.
+   *
+   * # Errors
+   *
+   * The buffer has grown at or above the 2 GiB a byte array can be counted in. `embed` grows
+   * the sink, so a buffer that fitted at construction need not fit here.
+   */
+  bytes(): ArrayBuffer;
+  length(asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<bigint>;
+  readAt(offset: bigint, length: number, asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<ArrayBuffer>;
+  setLength(length: bigint, asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<void>;
+  writeAt(offset: bigint, data: ArrayBuffer, asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<void>;
+  uniffiDestroy(): void;
+  static instanceOf(obj_: any): obj_ is MemorySink;
+}
+/**
+ * An in-memory [`RangeSource`], for a caller that already holds the whole asset as
+ * bytes and doesn't want to write a custom source. A **native** implementation of a
+ * `with_foreign` interface (`#[uniffi::export]` on the trait impl, not the foreign
+ * callback path), so the generated binding is a plain constructible object and a Python
+ * caller writes no subclass at all: `MemorySource(data)`.
+ *
+ * # Size ceiling
+ *
+ * The asset is resident for the object's lifetime, and the binding counts a byte array in an
+ * `i32`, so a buffer at or above 2 GiB cannot cross the boundary at all. The constructor
+ * rejects one rather than letting a later read come back quietly truncated. Implement
+ * [`RangeSource`] over a file handle for anything approaching that: the SDK only ever asks for
+ * bounded ranges, so nothing else has to hold the asset.
+ *
+ * Construction copies the whole asset across the boundary, on the calling thread: about 5ms for
+ * 10 MB, 315ms for 500 MB. That is the one part of a sign or verify the SDK cannot move off your
+ * thread, and neither a ranged source nor [`FileSource`] pays it.
+ */
+interface MemorySourceLike {
+  length(asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<bigint>;
+  readAt(offset: bigint, length: number, asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<ArrayBuffer>;
+}
+/**
+ * @deprecated Use `MemorySourceLike` instead.
+ */
+type MemorySourceInterface = MemorySourceLike;
+/**
+ * An in-memory [`RangeSource`], for a caller that already holds the whole asset as
+ * bytes and doesn't want to write a custom source. A **native** implementation of a
+ * `with_foreign` interface (`#[uniffi::export]` on the trait impl, not the foreign
+ * callback path), so the generated binding is a plain constructible object and a Python
+ * caller writes no subclass at all: `MemorySource(data)`.
+ *
+ * # Size ceiling
+ *
+ * The asset is resident for the object's lifetime, and the binding counts a byte array in an
+ * `i32`, so a buffer at or above 2 GiB cannot cross the boundary at all. The constructor
+ * rejects one rather than letting a later read come back quietly truncated. Implement
+ * [`RangeSource`] over a file handle for anything approaching that: the SDK only ever asks for
+ * bounded ranges, so nothing else has to hold the asset.
+ *
+ * Construction copies the whole asset across the boundary, on the calling thread: about 5ms for
+ * 10 MB, 315ms for 500 MB. That is the one part of a sign or verify the SDK cannot move off your
+ * thread, and neither a ranged source nor [`FileSource`] pays it.
+ */
+declare class MemorySource extends UniffiAbstractObject implements MemorySourceLike {
+  readonly [uniffiTypeNameSymbol] = "MemorySource";
+  readonly [destructorGuardSymbol]: UniffiGcObject;
+  readonly [pointerLiteralSymbol]: UniffiHandle;
+  /**
+   * # Errors
+   *
+   * The buffer is at or above the 2 GiB a byte array can be counted in.
+   */
+  constructor(data: ArrayBuffer);
+  length(asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<bigint>;
+  readAt(offset: bigint, length: number, asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<ArrayBuffer>;
+  uniffiDestroy(): void;
+  static instanceOf(obj_: any): obj_ is MemorySource;
+}
+/**
+ * A connection to the Limbo Integrity signer service. Construct once with [`connect`](Self::connect);
+ * share it across every [`AssetIssuer`](super::asset::AssetIssuer) so the leaf cert is fetched once.
+ */
+interface SignerClientLike {}
+/**
+ * @deprecated Use `SignerClientLike` instead.
+ */
+type SignerClientInterface = SignerClientLike;
+/**
+ * A connection to the Limbo Integrity signer service. Construct once with [`connect`](Self::connect);
+ * share it across every [`AssetIssuer`](super::asset::AssetIssuer) so the leaf cert is fetched once.
+ */
+declare class SignerClient extends UniffiAbstractObject implements SignerClientLike {
+  readonly [uniffiTypeNameSymbol] = "SignerClient";
+  readonly [destructorGuardSymbol]: UniffiGcObject;
+  readonly [pointerLiteralSymbol]: UniffiHandle;
+  private constructor();
+  /**
+   * Connect to the signing service at `endpoint`.
+   *
+   * # Errors
+   *
+   * `INVALID_ARGUMENT` when `endpoint` is not a valid URI or a header name/value in
+   * `options` is malformed. The channel connects lazily, so an unreachable Signer
+   * surfaces on the first sign RPC instead.
+   */
+  static connect(endpoint: string, options: ConnectOptions, asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<SignerClientLike>;
+  uniffiDestroy(): void;
+  static instanceOf(obj_: any): obj_ is SignerClient;
+}
+/**
+ * A live-stream signer bound to a [`SignerClient`](super::client::SignerClient) and a
+ * [`SigningVault`]. Construct once with [`create`](Self::create), then `init` a session and
+ * sign every segment through the [`StreamSession`] it returns.
+ */
+interface StreamIssuerLike {
+  /**
+   * Open the stream at `stream_id`: mint its first session key under `rotation_policy`, sign
+   * the init (moov) segment, and hand back a [`StreamSession`] to sign through.
+   *
+   * On `rotation_due`, call [`StreamIssuer::rotate`], not this.
+   *
+   * # Errors
+   *
+   * Fails on signer RPC failure, a vault error, or an `init_body` that isn't a BMFF init
+   * segment.
+   */
+  init(streamId: string, initBody: RangeSource, mode: ManifestMode, rotationPolicy: RotationPolicy, manifest: ManifestSpec, asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<StreamStart>;
+  /**
+   * Succeed `session` on the stream it already names, signing a fresh init (moov) segment
+   * under a new key and forgetting the outgoing one.
+   *
+   * The stream id comes from `session`, so a rotation cannot be pointed at the wrong stream,
+   * and the retired key cannot be left behind: it would still sign for the rest of its
+   * validity window.
+   *
+   * # Errors
+   *
+   * As [`StreamIssuer::init`].
+   */
+  rotate(session: StreamSessionLike, initBody: RangeSource, mode: ManifestMode, rotationPolicy: RotationPolicy, manifest: ManifestSpec, asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<StreamStart>;
+}
+/**
+ * @deprecated Use `StreamIssuerLike` instead.
+ */
+type StreamIssuerInterface = StreamIssuerLike;
+/**
+ * A live-stream signer bound to a [`SignerClient`](super::client::SignerClient) and a
+ * [`SigningVault`]. Construct once with [`create`](Self::create), then `init` a session and
+ * sign every segment through the [`StreamSession`] it returns.
+ */
+declare class StreamIssuer extends UniffiAbstractObject implements StreamIssuerLike {
+  readonly [uniffiTypeNameSymbol] = "StreamIssuer";
+  readonly [destructorGuardSymbol]: UniffiGcObject;
+  readonly [pointerLiteralSymbol]: UniffiHandle;
+  private constructor();
+  /**
+   * Build a stream signer over an existing signer connection plus the host's vault.
+   */
+  static create(client: SignerClientLike, vault: SigningVault): StreamIssuerLike;
+  /**
+   * Open the stream at `stream_id`: mint its first session key under `rotation_policy`, sign
+   * the init (moov) segment, and hand back a [`StreamSession`] to sign through.
+   *
+   * On `rotation_due`, call [`StreamIssuer::rotate`], not this.
+   *
+   * # Errors
+   *
+   * Fails on signer RPC failure, a vault error, or an `init_body` that isn't a BMFF init
+   * segment.
+   */
+  init(streamId: string, initBody: RangeSource, mode: ManifestMode, rotationPolicy: RotationPolicy, manifest: ManifestSpec, asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<StreamStart>;
+  /**
+   * Succeed `session` on the stream it already names, signing a fresh init (moov) segment
+   * under a new key and forgetting the outgoing one.
+   *
+   * The stream id comes from `session`, so a rotation cannot be pointed at the wrong stream,
+   * and the retired key cannot be left behind: it would still sign for the rest of its
+   * validity window.
+   *
+   * # Errors
+   *
+   * As [`StreamIssuer::init`].
+   */
+  rotate(session: StreamSessionLike, initBody: RangeSource, mode: ManifestMode, rotationPolicy: RotationPolicy, manifest: ManifestSpec, asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<StreamStart>;
+  uniffiDestroy(): void;
+  static instanceOf(obj_: any): obj_ is StreamIssuer;
+}
+/**
+ * A per-session ECDSA key store, implemented by the host. `mint` returns a fresh public key
+ * that will be signed under for `validity_period_secs`, so give it that lifetime and let the
+ * store expire it; `sign` produces the raw ECDSA signature over `payload` (the SDK frames it
+ * into COSE); `forget` drops a retired key. Every method may raise to abort.
+ */
+interface SigningVault {
+  mint(validityPeriodSecs: bigint, asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<VaultPublicKey>;
+  sign(kid: ArrayBuffer, payload: ArrayBuffer, asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<ArrayBuffer>;
+  forget(kid: ArrayBuffer, asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<void>;
+}
+/**
+ * This should be called before anything else.
+ *
+ * It is likely that this is being done for you by the library's `index.ts`.
+ *
+ * It checks versions of uniffi between when the Rust scaffolding was generated
+ * and when the bindings were generated.
+ *
+ * It also initializes the machinery to enable Rust to talk back to Javascript.
+ */
+declare function uniffiEnsureInitialized(): void;
+declare const _default$1: Readonly<{
+  initialize: typeof uniffiEnsureInitialized;
+  converters: {
+    FfiConverterTypeAction: {
+      readFromCursor(c: Cursor): Action;
+      writeIntoCursor(value: Action, c: Cursor): void;
+      allocationSize(value: Action): number;
+      lift(value: UniffiByteArray): Action;
+      lower(value: Action, alloc: RustBufferAllocator): UniffiByteArray;
+    };
+    FfiConverterTypeActionDetail: {
+      readFromCursor(c: Cursor): ActionDetail;
+      writeIntoCursor(value: ActionDetail, c: Cursor): void;
+      allocationSize(value: ActionDetail): number;
+      lift(value: UniffiByteArray): ActionDetail;
+      lower(value: ActionDetail, alloc: RustBufferAllocator): UniffiByteArray;
+    };
+    FfiConverterTypeActionKind: {
+      readFromCursor(c: Cursor): ActionKind;
+      writeIntoCursor(value: ActionKind, c: Cursor): void;
+      allocationSize(value: ActionKind): number;
+      lift(value: UniffiByteArray): ActionKind;
+      lower(value: ActionKind, alloc: RustBufferAllocator): UniffiByteArray;
+    };
+    FfiConverterTypeAssertion: {
+      readFromCursor(c: Cursor): Assertion;
+      writeIntoCursor(value: Assertion, c: Cursor): void;
+      allocationSize(value: Assertion): number;
+      lift(value: UniffiByteArray): Assertion;
+      lower(value: Assertion, alloc: RustBufferAllocator): UniffiByteArray;
+    };
+    FfiConverterTypeAssetIssuer: FfiConverterObject<AssetIssuerLike>;
+    FfiConverterTypeAssetMarker: FfiConverterObject<AssetMarkerLike>;
+    FfiConverterTypeBinder: FfiConverterObject<BinderLike>;
+    FfiConverterTypeCode: {
+      readFromCursor(c: Cursor): Code;
+      writeIntoCursor(value: Code, c: Cursor): void;
+      allocationSize(value: Code): number;
+      lift(value: UniffiByteArray): Code;
+      lower(value: Code, alloc: RustBufferAllocator): UniffiByteArray;
+    };
+    FfiConverterTypeComponent: {
+      readFromCursor(c: Cursor): Component;
+      writeIntoCursor(value: Component, c: Cursor): void;
+      allocationSize(value: Component): number;
+      lift(value: UniffiByteArray): Component;
+      lower(value: Component, alloc: RustBufferAllocator): UniffiByteArray;
+    };
+    FfiConverterTypeComponentEvent: {
+      readFromCursor(c: Cursor): ComponentEvent;
+      writeIntoCursor(value: ComponentEvent, c: Cursor): void;
+      allocationSize(value: ComponentEvent): number;
+      lift(value: UniffiByteArray): ComponentEvent;
+      lower(value: ComponentEvent, alloc: RustBufferAllocator): UniffiByteArray;
+    };
+    FfiConverterTypeConnectOptions: {
+      readFromCursor(c: Cursor): ConnectOptions;
+      writeIntoCursor(value: ConnectOptions, c: Cursor): void;
+      allocationSize(value: ConnectOptions): number;
+      lift(value: UniffiByteArray): ConnectOptions;
+      lower(value: ConnectOptions, alloc: RustBufferAllocator): UniffiByteArray;
+    };
+    FfiConverterTypeCreatedOrigin: {
+      readFromCursor(c: Cursor): CreatedOrigin;
+      writeIntoCursor(value: CreatedOrigin, c: Cursor): void;
+      allocationSize(value: CreatedOrigin): number;
+      lift(value: UniffiByteArray): CreatedOrigin;
+      lower(value: CreatedOrigin, alloc: RustBufferAllocator): UniffiByteArray;
+    };
+    FfiConverterTypeCustomAction: {
+      readFromCursor(c: Cursor): CustomAction;
+      writeIntoCursor(value: CustomAction, c: Cursor): void;
+      allocationSize(value: CustomAction): number;
+      lift(value: UniffiByteArray): CustomAction;
+      lower(value: CustomAction, alloc: RustBufferAllocator): UniffiByteArray;
+    };
+    FfiConverterTypeDeriveOptions: {
+      readFromCursor(c: Cursor): DeriveOptions;
+      writeIntoCursor(value: DeriveOptions, c: Cursor): void;
+      allocationSize(value: DeriveOptions): number;
+      lift(value: UniffiByteArray): DeriveOptions;
+      lower(value: DeriveOptions, alloc: RustBufferAllocator): UniffiByteArray;
+    };
+    FfiConverterTypeEmbedOptions: {
+      readFromCursor(c: Cursor): EmbedOptions;
+      writeIntoCursor(value: EmbedOptions, c: Cursor): void;
+      allocationSize(value: EmbedOptions): number;
+      lift(value: UniffiByteArray): EmbedOptions;
+      lower(value: EmbedOptions, alloc: RustBufferAllocator): UniffiByteArray;
+    };
+    FfiConverterTypeFieldViolation: {
+      readFromCursor(c: Cursor): FieldViolation;
+      writeIntoCursor(value: FieldViolation, c: Cursor): void;
+      allocationSize(value: FieldViolation): number;
+      lift(value: UniffiByteArray): FieldViolation;
+      lower(value: FieldViolation, alloc: RustBufferAllocator): UniffiByteArray;
+    };
+    FfiConverterTypeFileSink: FfiConverterObject<FileSinkLike>;
+    FfiConverterTypeFileSource: FfiConverterObject<FileSourceLike>;
+    FfiConverterTypeIdentityOptions: {
+      readFromCursor(c: Cursor): IdentityOptions;
+      writeIntoCursor(value: IdentityOptions, c: Cursor): void;
+      allocationSize(value: IdentityOptions): number;
+      lift(value: UniffiByteArray): IdentityOptions;
+      lower(value: IdentityOptions, alloc: RustBufferAllocator): UniffiByteArray;
+    };
+    FfiConverterTypeIngredient: {
+      readFromCursor(c: Cursor): Ingredient;
+      writeIntoCursor(value: Ingredient, c: Cursor): void;
+      allocationSize(value: Ingredient): number;
+      lift(value: UniffiByteArray): Ingredient;
+      lower(value: Ingredient, alloc: RustBufferAllocator): UniffiByteArray;
+    };
+    FfiConverterTypeInitOutcome: {
+      readFromCursor(c: Cursor): InitOutcome;
+      writeIntoCursor(value: InitOutcome, c: Cursor): void;
+      allocationSize(value: InitOutcome): number;
+      lift(value: UniffiByteArray): InitOutcome;
+      lower(value: InitOutcome, alloc: RustBufferAllocator): UniffiByteArray;
+    };
+    FfiConverterTypeManifestMode: {
+      readFromCursor(c: Cursor): ManifestMode;
+      writeIntoCursor(value: ManifestMode, c: Cursor): void;
+      allocationSize(value: ManifestMode): number;
+      lift(value: UniffiByteArray): ManifestMode;
+      lower(value: ManifestMode, alloc: RustBufferAllocator): UniffiByteArray;
+    };
+    FfiConverterTypeManifestSpec: {
+      readFromCursor(c: Cursor): ManifestSpec;
+      writeIntoCursor(value: ManifestSpec, c: Cursor): void;
+      allocationSize(value: ManifestSpec): number;
+      lift(value: UniffiByteArray): ManifestSpec;
+      lower(value: ManifestSpec, alloc: RustBufferAllocator): UniffiByteArray;
+    };
+    FfiConverterTypeMark: {
+      readFromCursor(c: Cursor): Mark;
+      writeIntoCursor(value: Mark, c: Cursor): void;
+      allocationSize(value: Mark): number;
+      lift(value: UniffiByteArray): Mark;
+      lower(value: Mark, alloc: RustBufferAllocator): UniffiByteArray;
+    };
+    FfiConverterTypeMarkOptions: {
+      readFromCursor(c: Cursor): MarkOptions;
+      writeIntoCursor(value: MarkOptions, c: Cursor): void;
+      allocationSize(value: MarkOptions): number;
+      lift(value: UniffiByteArray): MarkOptions;
+      lower(value: MarkOptions, alloc: RustBufferAllocator): UniffiByteArray;
+    };
+    FfiConverterTypeMarked: {
+      readFromCursor(c: Cursor): Marked;
+      writeIntoCursor(value: Marked, c: Cursor): void;
+      allocationSize(value: Marked): number;
+      lift(value: UniffiByteArray): Marked;
+      lower(value: Marked, alloc: RustBufferAllocator): UniffiByteArray;
+    };
+    FfiConverterTypeMemorySink: FfiConverterObject<MemorySinkLike>;
+    FfiConverterTypeMemorySource: FfiConverterObject<MemorySourceLike>;
+    FfiConverterTypeOpenedOrigin: {
+      readFromCursor(c: Cursor): OpenedOrigin;
+      writeIntoCursor(value: OpenedOrigin, c: Cursor): void;
+      allocationSize(value: OpenedOrigin): number;
+      lift(value: UniffiByteArray): OpenedOrigin;
+      lower(value: OpenedOrigin, alloc: RustBufferAllocator): UniffiByteArray;
+    };
+    FfiConverterTypeOrigin: {
+      readFromCursor(c: Cursor): Origin;
+      writeIntoCursor(value: Origin, c: Cursor): void;
+      allocationSize(value: Origin): number;
+      lift(value: UniffiByteArray): Origin;
+      lower(value: Origin, alloc: RustBufferAllocator): UniffiByteArray;
+    };
+    FfiConverterTypePluginRegistry: FfiConverterObject<PluginRegistryLike>;
+    FfiConverterTypeRangeSink: FfiConverterObjectWithCallbacks<RangeSink>;
+    FfiConverterTypeRangeSource: FfiConverterObjectWithCallbacks<RangeSource>;
+    FfiConverterTypeRegion: {
+      readFromCursor(c: Cursor): Region;
+      writeIntoCursor(value: Region, c: Cursor): void;
+      allocationSize(value: Region): number;
+      lift(value: UniffiByteArray): Region;
+      lower(value: Region, alloc: RustBufferAllocator): UniffiByteArray;
+    };
+    FfiConverterTypeRotationPolicy: {
+      readFromCursor(c: Cursor): RotationPolicy;
+      writeIntoCursor(value: RotationPolicy, c: Cursor): void;
+      allocationSize(value: RotationPolicy): number;
+      lift(value: UniffiByteArray): RotationPolicy;
+      lower(value: RotationPolicy, alloc: RustBufferAllocator): UniffiByteArray;
+    };
+    FfiConverterTypeSdkError: {
+      readFromCursor(c: Cursor): SdkError;
+      writeIntoCursor(value: SdkError, c: Cursor): void;
+      allocationSize(value: SdkError): number;
+      lift(value: UniffiByteArray): SdkError;
+      lower(value: SdkError, alloc: RustBufferAllocator): UniffiByteArray;
+    };
+    FfiConverterTypeSegmentKind: {
+      readFromCursor(c: Cursor): SegmentKind;
+      writeIntoCursor(value: SegmentKind, c: Cursor): void;
+      allocationSize(value: SegmentKind): number;
+      lift(value: UniffiByteArray): SegmentKind;
+      lower(value: SegmentKind, alloc: RustBufferAllocator): UniffiByteArray;
+    };
+    FfiConverterTypeSignOptions: {
+      readFromCursor(c: Cursor): SignOptions;
+      writeIntoCursor(value: SignOptions, c: Cursor): void;
+      allocationSize(value: SignOptions): number;
+      lift(value: UniffiByteArray): SignOptions;
+      lower(value: SignOptions, alloc: RustBufferAllocator): UniffiByteArray;
+    };
+    FfiConverterTypeSignOutcome: {
+      readFromCursor(c: Cursor): SignOutcome;
+      writeIntoCursor(value: SignOutcome, c: Cursor): void;
+      allocationSize(value: SignOutcome): number;
+      lift(value: UniffiByteArray): SignOutcome;
+      lower(value: SignOutcome, alloc: RustBufferAllocator): UniffiByteArray;
+    };
+    FfiConverterTypeSignedSegmentOutcome: {
+      readFromCursor(c: Cursor): SignedSegmentOutcome;
+      writeIntoCursor(value: SignedSegmentOutcome, c: Cursor): void;
+      allocationSize(value: SignedSegmentOutcome): number;
+      lift(value: UniffiByteArray): SignedSegmentOutcome;
+      lower(value: SignedSegmentOutcome, alloc: RustBufferAllocator): UniffiByteArray;
+    };
+    FfiConverterTypeSignerClient: FfiConverterObject<SignerClientLike>;
+    FfiConverterTypeSoftBinding: {
+      readFromCursor(c: Cursor): SoftBinding;
+      writeIntoCursor(value: SoftBinding, c: Cursor): void;
+      allocationSize(value: SoftBinding): number;
+      lift(value: UniffiByteArray): SoftBinding;
+      lower(value: SoftBinding, alloc: RustBufferAllocator): UniffiByteArray;
+    };
+    FfiConverterTypeStandardAction: {
+      readFromCursor(c: Cursor): StandardAction;
+      writeIntoCursor(value: StandardAction, c: Cursor): void;
+      allocationSize(value: StandardAction): number;
+      lift(value: UniffiByteArray): StandardAction;
+      lower(value: StandardAction, alloc: RustBufferAllocator): UniffiByteArray;
+    };
+    FfiConverterTypeStreamIssuer: FfiConverterObject<StreamIssuerLike>;
+    FfiConverterTypeStreamSession: FfiConverterObject<StreamSessionLike>;
+    FfiConverterTypeStreamStart: {
+      readFromCursor(c: Cursor): StreamStart;
+      writeIntoCursor(value: StreamStart, c: Cursor): void;
+      allocationSize(value: StreamStart): number;
+      lift(value: UniffiByteArray): StreamStart;
+      lower(value: StreamStart, alloc: RustBufferAllocator): UniffiByteArray;
+    };
+    FfiConverterTypeThumbnail: {
+      readFromCursor(c: Cursor): Thumbnail;
+      writeIntoCursor(value: Thumbnail, c: Cursor): void;
+      allocationSize(value: Thumbnail): number;
+      lift(value: UniffiByteArray): Thumbnail;
+      lower(value: Thumbnail, alloc: RustBufferAllocator): UniffiByteArray;
+    };
+    FfiConverterTypeValue: FfiConverter<UniffiByteArray, string>;
+    FfiConverterTypeVaultPublicKey: {
+      readFromCursor(c: Cursor): VaultPublicKey;
+      writeIntoCursor(value: VaultPublicKey, c: Cursor): void;
+      allocationSize(value: VaultPublicKey): number;
+      lift(value: UniffiByteArray): VaultPublicKey;
+      lower(value: VaultPublicKey, alloc: RustBufferAllocator): UniffiByteArray;
+    };
+  };
+}>;
+//#endregion
+//#region ../../../../target/trylimbo/codegen/ffi-trylimbo_sdk_issuer/index.d.ts
+declare function uniffiInitAsync(): Promise<void>;
+declare const _default: {
+  trylimbo_issuer: typeof trylimbo_issuer_d_exports;
+};
+//#endregion
+export { Action, ActionDetail, ActionKind, Action_Tags, Assertion, AssetIssuer, AssetIssuerInterface, AssetIssuerLike, AssetMarker, AssetMarkerInterface, AssetMarkerLike, Binder, BinderInterface, BinderLike, Code, Component, ComponentEvent, ConnectOptions, CreatedOrigin, CustomAction, DeriveOptions, EmbedOptions, FieldViolation, FileSink, FileSinkInterface, FileSinkLike, FileSource, FileSourceInterface, FileSourceLike, IdentityOptions, Ingredient, InitOutcome, ManifestMode, ManifestMode_Tags, ManifestSpec, Mark, MarkOptions, Mark_Tags, Marked, MemorySink, MemorySinkInterface, MemorySinkLike, MemorySource, MemorySourceInterface, MemorySourceLike, OpenedOrigin, Origin, Origin_Tags, PluginAuthor, PluginRegistry, PluginRegistryInterface, PluginRegistryLike, RangeSink, RangeSinkImpl, RangeSource, RangeSourceImpl, Region, RotationPolicy, SdkError, SdkError_Tags, SegmentKind, SignOptions, SignOutcome, SignedSegmentOutcome, SignerClient, SignerClientInterface, SignerClientLike, SigningVault, SoftBinding, StandardAction, StreamIssuer, StreamIssuerInterface, StreamIssuerLike, StreamSession, StreamSessionInterface, StreamSessionLike, StreamStart, Thumbnail, Value, VaultPublicKey, classifySegment, _default as default, embed, uniffiInitAsync };