@trylimbo/sdk-issuer 0.2.24 → 0.2.25-canary.38

package/gen/ffi/index.d.ts

@@ -181,13 +181,12 @@ declare const pointerLiteralSymbol: unique symbol;
  */
 declare const uniffiTypeNameSymbol: unique symbol;
 declare namespace trylimbo_issuer_d_exports {
-  export { Action, ActionDetail, ActionKind, ActionKind_Tags, Action_Tags, Assertion, AssetDelivery, AssetDelivery_Tags, AssetFormat, AssetFormat_Tags, AssetIssuer, AssetIssuerInterface, AssetIssuerLike, AssetManifestSpec, AssetMarker, AssetMarkerInterface, AssetMarkerLike, AssetOrigin, AssetOrigin_Tags, Binder, BinderImpl, Code, Component, ComponentEvent, ComponentEvent_Tags, ConnectOptions, CreatedOrigin, CustomAction, DeriveOptions, EmbedOptions, FieldViolation, FileSink, FileSinkInterface, FileSinkLike, FileSource, FileSourceInterface, FileSourceLike, HeldBinder, HeldBinderInterface, HeldBinderLike, Identity, Ingredient, IngredientSource, IngredientSource_Tags, InitOptions, InitOutcome, IsccBinder, IsccBinderInterface, IsccBinderLike, JsonObject, JsonValue, MarkOptions, MarkOutcome, MemorySink, MemorySinkInterface, MemorySinkLike, MemorySource, MemorySourceInterface, MemorySourceLike, OpenedOrigin, Origin, Origin_Tags, PluginAuthor, RangeSink, RangeSinkImpl, RangeSource, RangeSourceImpl, Region, RotationPolicy, SdkError, SdkError_Tags, SegmentKind, SegmentOutcome, SignOptions, SignOutcome, SignOutput, SignOutput_Tags, SignerClient, SignerClientInterface, SignerClientLike, SigningVault, SoftBinding, StandardAction, StreamDelivery, StreamDelivery_Tags, StreamIssuer, StreamIssuerInterface, StreamIssuerLike, StreamManifestSpec, StreamSession, StreamSessionInterface, StreamSessionLike, StreamStart, Thumbnail, Timestamp, Url, VaultPublicKey, classifySegment, _default$1 as default, embed };
+  export { Action, ActionDetail, ActionKind, ActionKind_Tags, Action_Tags, Assertion, AssetDelivery, AssetDelivery_Tags, AssetIssuer, AssetIssuerInterface, AssetIssuerLike, AssetManifestSpec, AssetMarker, AssetMarkerInterface, AssetMarkerLike, AssetOrigin, AssetOrigin_Tags, Block, ByteRange, Code, Component, ComponentEvent, ComponentEvent_Tags, Compute, ComputeImpl, ComputeRequest, ConnectOptions, CreatedOrigin, CustomAction, EmbedOptions, FieldViolation, FileSink, FileSinkInterface, FileSinkLike, FileSource, FileSourceInterface, FileSourceLike, Identity, Ingredient, IngredientKind, IngredientKind_Tags, InitOptions, InitOutcome, JsonObject, JsonValue, MarkOptions, MarkOutcome, MemorySink, MemorySinkInterface, MemorySinkLike, MemorySource, MemorySourceInterface, MemorySourceLike, MintRequest, OpenedOrigin, PluginAuthor, RangeSink, RangeSinkImpl, RangeSource, RangeSourceImpl, RotationPolicy, Scope, SdkError, SdkError_Tags, SegmentKind, SegmentOutcome, SessionKey, SignOptions, SignOutcome, SignOutput, SignOutput_Tags, SignerClient, SignerClientInterface, SignerClientLike, SigningVault, SoftBinding, SoftBindingSource, SoftBindingSource_Tags, SoftwareAgent, StandardAction, StreamDelivery, StreamIssuer, StreamIssuerInterface, StreamIssuerLike, StreamManifestSpec, StreamOrigin, StreamOrigin_Tags, StreamSession, StreamSessionInterface, StreamSessionLike, StreamStart, Thumbnail, Timespan, Url, classifySegment, computeSoftBinding, _default$1 as default, embed };
 }
 /**
- * Classify a fragmented-MP4 segment from a [`RangeSource`] as init/media/unknown: the
- * SDK-owned box parse (`moov` vs `moof`) a streaming consumer uses to route each segment
- * to [`StreamIssuer::init`](stream::StreamIssuer::init) vs
- * [`StreamSession::sign`](stream::StreamSession::sign) without hand-parsing ISOBMFF itself.
+ * Classify a fragmented-MP4 segment as init, media or unknown (`moov` vs `moof`), so a streaming
+ * consumer routes each segment to `StreamIssuer.init` or `StreamSession.sign` without parsing
+ * ISOBMFF itself.
  *
  * Async because it reads, and reading is the caller's storage: the two windows below may each
  * be a round trip. It stays off the island, uniquely among the read-path entry points, because
@@ -202,22 +201,22 @@ export declare function classifySegment(source: RangeSource, asyncOpts_?: {
   signal: AbortSignal;
 }): Promise<SegmentKind>;
 /**
- * Embed a signed manifest into an asset, writing the composed result back through
- * `sink`. `plugins` are the caller's plugins for non-c2pa formats (e.g. MXF), in dispatch
- * order, resolved the same way [`AssetIssuer::sign`](asset::AssetIssuer::sign) resolves
- * them, per [the `plugins` contract](crate::asset#the-plugins-contract): the write lands on a
- * bounded region for a plugin match, on the whole (small) asset otherwise; an empty list is
- * a c2pa-native embed. `format` overrides the sniffed format. Pure local byte-wrangling: no
- * signer round-trip.
+ * The values this SDK computes for `alg` over an asset, `[]` when it finds none. `format` is
+ * the asset's media type; omitted, the bytes name it.
  *
- * # Why the body is offloaded rather than run inline
+ * # Errors
  *
- * UniFFI polls a future on the thread that called it and never spawns, so an `async fn` whose
- * body never suspends completes in its first poll, on the caller's thread, blocking it exactly
- * as a sync export would: measured at 88ms for a 10MB asset on Node, during which nothing else
- * in the process runs. It is also the read path's hard requirement, not just a courtesy: the
- * splice reads through `sink`, and the caller's thread is the one that has to answer those
- * reads. See [`task`](shared::task).
+ * An algorithm this SDK computes no value of, a `format` that is no media type or that the bytes
+ * contradict, an unreadable source, or no trustworthy answer.
+ */
+export declare function computeSoftBinding(alg: string, source: RangeSource, format?: string | undefined, asyncOpts_?: {
+  signal: AbortSignal;
+}): Promise<Array<Block>>;
+/**
+ * Embed `sidecar`, the signed manifest a sign returned, into the asset `sink` holds, writing the
+ * composed result back through `sink`.
+ * `plugins` resolve a non-c2pa format (e.g. MXF) as `AssetIssuer.sign` resolves them; none is a
+ * c2pa-native embed. No signer round trip.
  *
  * # Errors
  *
@@ -225,31 +224,37 @@ export declare function classifySegment(source: RangeSource, asyncOpts_?: {
  * authoring/`locate` disagrees after the write, or the c2pa handler can't
  * parse/splice the asset.
  */
-export declare function embed(sink: RangeSink, manifest: ArrayBuffer, options: EmbedOptions, plugins: Array<PluginAuthor>, asyncOpts_?: {
+export declare function embed(sink: RangeSink, sidecar: ArrayBuffer, options: EmbedOptions, plugins?: Array<PluginAuthor>, asyncOpts_?: {
   signal: AbortSignal;
 }): Promise<void>;
 /**
- * Typealias from the type name used in the UDL file to the builtin type.  This
- * is needed because the UDL type name is used in function/method signatures.
+ * The tool that performed an action (a C2PA `generator-info-map`).
  */
-export type Timestamp = string;
+export type SoftwareAgent = {
+  name: string;
+};
+/**
+ * Generated factory for {@link SoftwareAgent} record objects.
+ */
+export declare const SoftwareAgent: Readonly<{
+  create: (partial: Partial<SoftwareAgent> & Required<Omit<SoftwareAgent, never>>) => SoftwareAgent;
+  new: (partial: Partial<SoftwareAgent> & Required<Omit<SoftwareAgent, never>>) => SoftwareAgent;
+  defaults: () => Partial<SoftwareAgent>;
+}>;
 /**
  * Typealias from the type name used in the UDL file to the builtin type.  This
  * is needed because the UDL type name is used in function/method signatures.
  */
 export type Url = string;
 /**
- * Optional facts folded into a derived or workflow action.
+ * Facts recorded on an action.
  */
 export type ActionDetail = {
-  /**
-   * When the action happened.
-   */
-  when?: Timestamp;
-  softwareAgent?: string;
+  when?: Date;
+  softwareAgent?: SoftwareAgent;
   description?: string;
   /**
-   * The URI its term is published at, e.g.
+   * The URI of an IPTC or C2PA term, e.g.
    * `http://cv.iptc.org/newscodes/digitalsourcetype/digitalCapture`.
    */
   sourceType?: Url;
@@ -287,30 +292,28 @@ export declare const Assertion: Readonly<{
   defaults: () => Partial<Assertion>;
 }>;
 /**
- * The asset is an original; the signer derives `c2pa.created`.
+ * The asset is an original; the signer derives `c2pa.created` from these facts.
  */
 export type CreatedOrigin = {
   /**
-   * The URI its term is published at, e.g.
+   * The URI of an IPTC or C2PA term, e.g.
    * `http://cv.iptc.org/newscodes/digitalsourcetype/digitalCapture`.
    */
   sourceType: Url;
-  detail?: ActionDetail;
+  when?: Date;
+  softwareAgent?: SoftwareAgent;
+  description?: string;
 };
 /**
  * Generated factory for {@link CreatedOrigin} record objects.
  */
 export declare const CreatedOrigin: Readonly<{
-  create: (partial: Partial<CreatedOrigin> & Required<Omit<CreatedOrigin, "detail">>) => CreatedOrigin;
-  new: (partial: Partial<CreatedOrigin> & Required<Omit<CreatedOrigin, "detail">>) => CreatedOrigin;
+  create: (partial: Partial<CreatedOrigin> & Required<Omit<CreatedOrigin, "description" | "softwareAgent" | "when">>) => CreatedOrigin;
+  new: (partial: Partial<CreatedOrigin> & Required<Omit<CreatedOrigin, "description" | "softwareAgent" | "when">>) => CreatedOrigin;
   defaults: () => Partial<CreatedOrigin>;
 }>;
 /**
  * A canonical gRPC/Connect status code: the coarse, closed failure class.
- *
- * The wasm lane projects this as a camelCase string like every other tagged value
- * there, so a consumer narrows on `err.code === "resourceExhausted"`; the native lane
- * projects an enum.
  */
 export declare enum Code {
   Canceled = 0,
@@ -335,7 +338,9 @@ export declare enum Code {
  */
 export type FieldViolation = {
   /**
-   * A dotted proto path to the offending field (`""` for a message-level rule).
+   * The offending field: rooted at the call's argument when an SDK refuses it
+   * (`options.soft_bindings[1].alg`), at the request when a service does
+   * (`provenance.actions[0].label`).
    */
   field: string;
   /**
@@ -343,7 +348,7 @@ export type FieldViolation = {
    */
   description: string;
   /**
-   * The constraint id that failed (a protovalidate/CEL rule id), stable across releases.
+   * The rule that failed, such as `string.min_len` or `alg.unlisted`: the stable branch key.
    */
   reason: string;
 };
@@ -754,122 +759,56 @@ export declare class RangeSourceImpl extends UniffiAbstractObject implements Ran
   uniffiDestroy(): void;
   static instanceOf(obj_: any): obj_ is RangeSourceImpl;
 }
-export declare enum AssetFormat_Tags {
-  Sniff = "Sniff",
-  Declared = "Declared"
-}
-/**
- * The format of the asset a call is handed. Stated, never defaulted: sniffing is a choice the
- * caller makes by name, not what happens when they say nothing.
- */
-export declare const AssetFormat: Readonly<{
-  instanceOf: (obj: any) => obj is AssetFormat;
-  Sniff: {
-    new (): {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "AssetFormat";
-      readonly tag: AssetFormat_Tags.Sniff;
-    };
-    "new"(): {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "AssetFormat";
-      readonly tag: AssetFormat_Tags.Sniff;
-    };
-    instanceOf(obj: any): obj is {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "AssetFormat";
-      readonly tag: AssetFormat_Tags.Sniff;
-    };
-  };
-  Declared: {
-    new (inner: {
-      mediaType: string;
-    }): {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "AssetFormat";
-      readonly tag: AssetFormat_Tags.Declared;
-      readonly inner: Readonly<{
-        mediaType: string;
-      }>;
-    };
-    "new"(inner: {
-      mediaType: string;
-    }): {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "AssetFormat";
-      readonly tag: AssetFormat_Tags.Declared;
-      readonly inner: Readonly<{
-        mediaType: string;
-      }>;
-    };
-    instanceOf(obj: any): obj is {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "AssetFormat";
-      readonly tag: AssetFormat_Tags.Declared;
-      readonly inner: Readonly<{
-        mediaType: string;
-      }>;
-    };
-  };
-}>;
-/**
- * The format of the asset a call is handed. Stated, never defaulted: sniffing is a choice the
- * caller makes by name, not what happens when they say nothing.
- */
-export type AssetFormat = InstanceType<typeof AssetFormat['Sniff' | 'Declared']>;
-export declare enum IngredientSource_Tags {
+export declare enum IngredientKind_Tags {
   Asset = "Asset",
   Descriptor = "Descriptor"
 }
-export declare const IngredientSource: Readonly<{
-  instanceOf: (obj: any) => obj is IngredientSource;
+/**
+ * What an ingredient is: an asset whose manifest is read, or a description.
+ */
+export declare const IngredientKind: Readonly<{
+  instanceOf: (obj: any) => obj is IngredientKind;
   Asset: {
     new (inner: {
       source: RangeSource;
-      format: AssetFormat;
+      format?: string;
+      discoveredBy: Array<string>;
     }): {
       /**
        * @private
        * This field is private and should not be used, use `tag` instead.
        */
-      readonly [uniffiTypeNameSymbol]: "IngredientSource";
-      readonly tag: IngredientSource_Tags.Asset;
+      readonly [uniffiTypeNameSymbol]: "IngredientKind";
+      readonly tag: IngredientKind_Tags.Asset;
       readonly inner: Readonly<{
         source: RangeSource;
-        format: AssetFormat;
+        format?: string;
+        discoveredBy: Array<string>;
       }>;
     };
-    "new"(inner: {
+    new: (partial: Parameters<(partial: Partial<{
       source: RangeSource;
-      format: AssetFormat;
-    }): {
+      format?: string;
+      discoveredBy: Array<string>;
+    }> & Required<Omit<{
+      source: RangeSource;
+      format?: string;
+      discoveredBy: Array<string>;
+    }, "discoveredBy" | "format">>) => {
+      source: RangeSource;
+      format?: string;
+      discoveredBy: Array<string>;
+    }>[0]) => {
       /**
        * @private
        * This field is private and should not be used, use `tag` instead.
        */
-      readonly [uniffiTypeNameSymbol]: "IngredientSource";
-      readonly tag: IngredientSource_Tags.Asset;
+      readonly [uniffiTypeNameSymbol]: "IngredientKind";
+      readonly tag: IngredientKind_Tags.Asset;
       readonly inner: Readonly<{
         source: RangeSource;
-        format: AssetFormat;
+        format?: string;
+        discoveredBy: Array<string>;
       }>;
     };
     instanceOf(obj: any): obj is {
@@ -877,43 +816,40 @@ export declare const IngredientSource: Readonly<{
        * @private
        * This field is private and should not be used, use `tag` instead.
        */
-      readonly [uniffiTypeNameSymbol]: "IngredientSource";
-      readonly tag: IngredientSource_Tags.Asset;
+      readonly [uniffiTypeNameSymbol]: "IngredientKind";
+      readonly tag: IngredientKind_Tags.Asset;
       readonly inner: Readonly<{
         source: RangeSource;
-        format: AssetFormat;
+        format?: string;
+        discoveredBy: Array<string>;
       }>;
     };
   };
   Descriptor: {
     new (inner: {
-      format?: string;
+      format: string;
     }): {
       /**
        * @private
        * This field is private and should not be used, use `tag` instead.
        */
-      readonly [uniffiTypeNameSymbol]: "IngredientSource";
-      readonly tag: IngredientSource_Tags.Descriptor;
+      readonly [uniffiTypeNameSymbol]: "IngredientKind";
+      readonly tag: IngredientKind_Tags.Descriptor;
       readonly inner: Readonly<{
-        format?: string;
+        format: string;
       }>;
     };
-    new: (partial: Parameters<(partial: Partial<{
-      format?: string;
-    }> & Required<Omit<{
-      format?: string;
-    }, "format">>) => {
-      format?: string;
-    }>[0]) => {
+    "new"(inner: {
+      format: string;
+    }): {
       /**
        * @private
        * This field is private and should not be used, use `tag` instead.
        */
-      readonly [uniffiTypeNameSymbol]: "IngredientSource";
-      readonly tag: IngredientSource_Tags.Descriptor;
+      readonly [uniffiTypeNameSymbol]: "IngredientKind";
+      readonly tag: IngredientKind_Tags.Descriptor;
       readonly inner: Readonly<{
-        format?: string;
+        format: string;
       }>;
     };
     instanceOf(obj: any): obj is {
@@ -921,15 +857,18 @@ export declare const IngredientSource: Readonly<{
        * @private
        * This field is private and should not be used, use `tag` instead.
        */
-      readonly [uniffiTypeNameSymbol]: "IngredientSource";
-      readonly tag: IngredientSource_Tags.Descriptor;
+      readonly [uniffiTypeNameSymbol]: "IngredientKind";
+      readonly tag: IngredientKind_Tags.Descriptor;
       readonly inner: Readonly<{
-        format?: string;
+        format: string;
       }>;
     };
   };
 }>;
-export type IngredientSource = InstanceType<typeof IngredientSource['Asset' | 'Descriptor']>;
+/**
+ * What an ingredient is: an asset whose manifest is read, or a description.
+ */
+export type IngredientKind = InstanceType<typeof IngredientKind['Asset' | 'Descriptor']>;
 /**
  * A pre-rendered thumbnail, attached to the manifest as its `c2pa.thumbnail.claim` resource or
  * to an ingredient as its `c2pa.thumbnail.ingredient`. The split-signer has no asset bytes to
@@ -939,24 +878,23 @@ export type IngredientSource = InstanceType<typeof IngredientSource['Asset' | 'D
 export type Thumbnail = {
   data: ArrayBuffer;
   /**
-   * MIME type. `image/jpeg` and `image/png` are the interop-safe choices: consumer
-   * verifiers like Adobe inspect may not render other previews.
+   * Its media type, judged against `data` as an asset's is; `None` reads it from `data`.
+   * `image/jpeg` and `image/png` are the ones consumer verifiers render.
    */
-  format: string;
+  format?: string;
 };
 /**
  * Generated factory for {@link Thumbnail} record objects.
  */
 export declare const Thumbnail: Readonly<{
-  create: (partial: Partial<Thumbnail> & Required<Omit<Thumbnail, never>>) => Thumbnail;
-  new: (partial: Partial<Thumbnail> & Required<Omit<Thumbnail, never>>) => Thumbnail;
+  create: (partial: Partial<Thumbnail> & Required<Omit<Thumbnail, "format">>) => Thumbnail;
+  new: (partial: Partial<Thumbnail> & Required<Omit<Thumbnail, "format">>) => Thumbnail;
   defaults: () => Partial<Thumbnail>;
 }>;
 export type Ingredient = {
-  source: IngredientSource;
+  kind: IngredientKind;
   title?: string;
   thumbnail?: Thumbnail;
-  discoveredBy: Array<string>;
 };
 /**
  * Generated factory for {@link Ingredient} record objects.
@@ -1094,15 +1032,15 @@ export type AssetOrigin = InstanceType<typeof AssetOrigin['Created' | 'Opened' |
  */
 export type JsonObject = string;
 /**
- * An entity-namespaced action (reverse-DNS `label`; the signer rejects
- * `c2pa.*`/`cawg.*`). `params` merges into the action's `parameters`.
+ * An entity-namespaced action: a reverse-DNS `label` outside `c2pa.` and `cawg.`, which are
+ * refused in any case. A C2PA action is a [`StandardAction`].
  */
 export type CustomAction = {
   label: string;
-  params: JsonObject;
+  parameters: JsonObject;
   detail?: ActionDetail;
   /**
-   * `Component.id`s this action acted on.
+   * The `components` keys this action acted on.
    */
   componentIds: Array<string>;
 };
@@ -1110,13 +1048,62 @@ export type CustomAction = {
  * Generated factory for {@link CustomAction} record objects.
  */
 export declare const CustomAction: Readonly<{
-  create: (partial: Partial<CustomAction> & Required<Omit<CustomAction, "detail">>) => CustomAction;
-  new: (partial: Partial<CustomAction> & Required<Omit<CustomAction, "detail">>) => CustomAction;
+  create: (partial: Partial<CustomAction> & Required<Omit<CustomAction, "componentIds" | "detail">>) => CustomAction;
+  new: (partial: Partial<CustomAction> & Required<Omit<CustomAction, "componentIds" | "detail">>) => CustomAction;
   defaults: () => Partial<CustomAction>;
 }>;
+/**
+ * A `soft-binding-timespan-map`: where the range starts in the media and how long it lasts, in
+ * whole milliseconds.
+ */
+export type Timespan = {
+  start: number;
+  duration: number;
+};
+/**
+ * Generated factory for {@link Timespan} record objects.
+ */
+export declare const Timespan: Readonly<{
+  create: (partial: Partial<Timespan> & Required<Omit<Timespan, never>>) => Timespan;
+  new: (partial: Partial<Timespan> & Required<Omit<Timespan, never>>) => Timespan;
+  defaults: () => Partial<Timespan>;
+}>;
+/**
+ * A `soft-binding-scope-map`: where in the content a value applies. Empty is the whole content.
+ */
+export type Scope = {
+  timespan?: Timespan;
+};
+/**
+ * Generated factory for {@link Scope} record objects.
+ */
+export declare const Scope: Readonly<{
+  create: (partial: Partial<Scope> & Required<Omit<Scope, "timespan">>) => Scope;
+  new: (partial: Partial<Scope> & Required<Omit<Scope, "timespan">>) => Scope;
+  defaults: () => Partial<Scope>;
+}>;
+/**
+ * A `soft-binding-block-map`.
+ */
+export type Block = {
+  value: ArrayBuffer;
+  scope: Scope;
+};
+/**
+ * Generated factory for {@link Block} record objects.
+ */
+export declare const Block: Readonly<{
+  create: (partial: Partial<Block> & Required<Omit<Block, "scope">>) => Block;
+  new: (partial: Partial<Block> & Required<Omit<Block, "scope">>) => Block;
+  defaults: () => Partial<Block>;
+}>;
+/**
+ * One `c2pa.soft-binding` assertion (C2PA 2.4 18.10.3): a listed algorithm and its values, one
+ * per block.
+ */
 export type SoftBinding = {
   alg: string;
-  value: string;
+  blocks: Array<Block>;
 };
 /**
  * Generated factory for {@link SoftBinding} record objects.
@@ -1149,13 +1136,12 @@ export declare enum ActionKind_Tags {
   ResizedProportional = "ResizedProportional",
   Transcoded = "Transcoded",
   Trimmed = "Trimmed",
-  Unknown = "Unknown",
   WatermarkedBound = "WatermarkedBound",
   WatermarkedUnbound = "WatermarkedUnbound"
 }
 /**
- * The C2PA 2.3 workflow actions; see the core [`provenance::ActionKind`] for what each is.
- * Mirrored for the one variant that carries a binding, which crosses as the two-string record.
+ * The C2PA 2.4 workflow actions; see the core [`provenance::ActionKind`] for what each is.
+ * Mirrored for the one variant that carries a binding, which crosses as the FFI record.
  */
 export declare const ActionKind: Readonly<{
   instanceOf: (obj: any) => obj is ActionKind;
@@ -1731,32 +1717,6 @@ export declare const ActionKind: Readonly<{
       readonly tag: ActionKind_Tags.Trimmed;
     };
   };
-  Unknown: {
-    new (): {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "ActionKind";
-      readonly tag: ActionKind_Tags.Unknown;
-    };
-    "new"(): {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "ActionKind";
-      readonly tag: ActionKind_Tags.Unknown;
-    };
-    instanceOf(obj: any): obj is {
-      /**
-       * @private
-       * This field is private and should not be used, use `tag` instead.
-       */
-      readonly [uniffiTypeNameSymbol]: "ActionKind";
-      readonly tag: ActionKind_Tags.Unknown;
-    };
-  };
   WatermarkedBound: {
     new (inner: {
       binding: SoftBinding;
@@ -1824,12 +1784,13 @@ export declare const ActionKind: Readonly<{
   };
 }>;
 /**
- * The C2PA 2.3 workflow actions; see the core [`provenance::ActionKind`] for what each is.
- * Mirrored for the one variant that carries a binding, which crosses as the two-string record.
+ * The C2PA 2.4 workflow actions; see the core [`provenance::ActionKind`] for what each is.
+ * Mirrored for the one variant that carries a binding, which crosses as the FFI record.
  */
-export type ActionKind = InstanceType<typeof ActionKind['AddedText' | 'AdjustedColor' | 'ChangedSpeed' | 'Converted' | 'Cropped' | 'Deleted' | 'Drawing' | 'Dubbed' | 'Edited' | 'EditedMetadata' | 'Enhanced' | 'Filtered' | 'Mastered' | 'Mixed' | 'Orientation' | 'Published' | 'Remixed' | 'Repackaged' | 'Resized' | 'ResizedProportional' | 'Transcoded' | 'Trimmed' | 'Unknown' | 'WatermarkedBound' | 'WatermarkedUnbound']>;
+export type ActionKind = InstanceType<typeof ActionKind['AddedText' | 'AdjustedColor' | 'ChangedSpeed' | 'Converted' | 'Cropped' | 'Deleted' | 'Drawing' | 'Dubbed' | 'Edited' | 'EditedMetadata' | 'Enhanced' | 'Filtered' | 'Mastered' | 'Mixed' | 'Orientation' | 'Published' | 'Remixed' | 'Repackaged' | 'Resized' | 'ResizedProportional' | 'Transcoded' | 'Trimmed' | 'WatermarkedBound' | 'WatermarkedUnbound']>;
 export type StandardAction = {
   kind: ActionKind;
+  parameters: JsonObject;
   detail?: ActionDetail;
   componentIds: Array<string>;
 };
@@ -1837,8 +1798,8 @@ export type StandardAction = {
  * Generated factory for {@link StandardAction} record objects.
  */
 export declare const StandardAction: Readonly<{
-  create: (partial: Partial<StandardAction> & Required<Omit<StandardAction, "detail">>) => StandardAction;
-  new: (partial: Partial<StandardAction> & Required<Omit<StandardAction, "detail">>) => StandardAction;
+  create: (partial: Partial<StandardAction> & Required<Omit<StandardAction, "componentIds" | "detail" | "parameters">>) => StandardAction;
+  new: (partial: Partial<StandardAction> & Required<Omit<StandardAction, "componentIds" | "detail" | "parameters">>) => StandardAction;
   defaults: () => Partial<StandardAction>;
 }>;
 export declare enum Action_Tags {
@@ -1908,8 +1869,7 @@ export declare const Action: Readonly<{
 }>;
 export type Action = InstanceType<typeof Action['Custom' | 'Standard']>;
 /**
- * Pass `None` to skip the CAWG identity signing path entirely. Each entry of `identities` is
- * one CAWG `VerifiedIdentity` object.
+ * A CAWG identity assertion: each of `identities` is one CAWG `verifiedIdentities` entry.
  */
 export type Identity = {
   roles: Array<string>;
@@ -1919,8 +1879,8 @@ export type Identity = {
  * Generated factory for {@link Identity} record objects.
  */
 export declare const Identity: Readonly<{
-  create: (partial: Partial<Identity> & Required<Omit<Identity, never>>) => Identity;
-  new: (partial: Partial<Identity> & Required<Omit<Identity, never>>) => Identity;
+  create: (partial: Partial<Identity> & Required<Omit<Identity, "roles">>) => Identity;
+  new: (partial: Partial<Identity> & Required<Omit<Identity, "roles">>) => Identity;
   defaults: () => Partial<Identity>;
 }>;
 export declare enum ComponentEvent_Tags {
@@ -1982,6 +1942,7 @@ export declare const ComponentEvent: Readonly<{
   };
   Removed: {
     new (inner: {
+      label: string;
       detail?: ActionDetail;
     }): {
       /**
@@ -1991,14 +1952,18 @@ export declare const ComponentEvent: Readonly<{
       readonly [uniffiTypeNameSymbol]: "ComponentEvent";
       readonly tag: ComponentEvent_Tags.Removed;
       readonly inner: Readonly<{
+        label: string;
         detail?: ActionDetail;
       }>;
     };
     new: (partial: Parameters<(partial: Partial<{
+      label: string;
       detail?: ActionDetail;
     }> & Required<Omit<{
+      label: string;
       detail?: ActionDetail;
     }, "detail">>) => {
+      label: string;
       detail?: ActionDetail;
     }>[0]) => {
       /**
@@ -2008,6 +1973,7 @@ export declare const ComponentEvent: Readonly<{
       readonly [uniffiTypeNameSymbol]: "ComponentEvent";
       readonly tag: ComponentEvent_Tags.Removed;
       readonly inner: Readonly<{
+        label: string;
         detail?: ActionDetail;
       }>;
     };
@@ -2019,6 +1985,7 @@ export declare const ComponentEvent: Readonly<{
       readonly [uniffiTypeNameSymbol]: "ComponentEvent";
       readonly tag: ComponentEvent_Tags.Removed;
       readonly inner: Readonly<{
+        label: string;
         detail?: ActionDetail;
       }>;
     };
@@ -2058,8 +2025,10 @@ export declare const ComponentEvent: Readonly<{
  * to be folded into and the variant has none.
  */
 export type ComponentEvent = InstanceType<typeof ComponentEvent['Placed' | 'Removed' | 'InputTo']>;
+/**
+ * An ingredient other than the parent; see the core [`provenance::Component`].
+ */
 export type Component = {
-  id: string;
   asset: Ingredient;
   event: ComponentEvent;
 };
@@ -2074,160 +2043,201 @@ export declare const Component: Readonly<{
 export type AssetManifestSpec = {
   title?: string;
   origin: AssetOrigin;
+  /**
+   * Every action performed on the asset; the manifest states the list is complete (C2PA
+   * `allActionsIncluded`).
+   */
   actions: Array<Action>;
   identity?: Identity;
   assertions: Array<Assertion>;
-  components: Array<Component>;
+  /**
+   * Keyed by the handle actions name them by.
+   */
+  components: Map<string, Component>;
 };
 /**
  * Generated factory for {@link AssetManifestSpec} record objects.
  */
 export declare const AssetManifestSpec: Readonly<{
-  create: (partial: Partial<AssetManifestSpec> & Required<Omit<AssetManifestSpec, "identity" | "title">>) => AssetManifestSpec;
-  new: (partial: Partial<AssetManifestSpec> & Required<Omit<AssetManifestSpec, "identity" | "title">>) => AssetManifestSpec;
+  create: (partial: Partial<AssetManifestSpec> & Required<Omit<AssetManifestSpec, "actions" | "assertions" | "components" | "identity" | "title">>) => AssetManifestSpec;
+  new: (partial: Partial<AssetManifestSpec> & Required<Omit<AssetManifestSpec, "actions" | "assertions" | "components" | "identity" | "title">>) => AssetManifestSpec;
   defaults: () => Partial<AssetManifestSpec>;
 }>;
 /**
- * Transport tunables and per-request metadata for the signer connection.
- *
- * `headers`, when present, are attached to every RPC (e.g.
- * `Authorization: Bearer …`, or routing/tenant metadata) and are
- * lower-cased on the wire; omit them to connect with no extra metadata.
- *
- * # Both deadlines are required
- *
- * They were optional, and omitting them left a call with no deadline at all: a signer that
- * accepted the connection and then stopped answering held the caller's thread for ever, with no
- * cancellation path, because the SDK runs each call on a thread of its own and nothing was
- * watching the clock. There is no figure the SDK could pick on a caller's behalf that is right
- * for both a local signer and one across a region, so it asks.
- *
- * Neither bounds the hash: that runs client side, between the two legs of the signing protocol,
- * and is not an RPC. These bound the network alone.
+ * A byte range holding a bare C2PA manifest store, or reserved for one. A record of
+ * primitives, so a plugin in its OWN UniFFI namespace declares a structurally identical
+ * one and the two cross the boundary without sharing a Rust type.
+ */
+export type ByteRange = {
+  offset: bigint;
+  length: bigint;
+};
+/**
+ * Generated factory for {@link ByteRange} record objects.
+ */
+export declare const ByteRange: Readonly<{
+  create: (partial: Partial<ByteRange> & Required<Omit<ByteRange, never>>) => ByteRange;
+  new: (partial: Partial<ByteRange> & Required<Omit<ByteRange, never>>) => ByteRange;
+  defaults: () => Partial<ByteRange>;
+}>;
+/**
+ * What one [`Compute::compute`] is asked: the asset and its media type.
+ */
+export type ComputeRequest = {
+  source: RangeSource;
+  format: string;
+};
+/**
+ * Generated factory for {@link ComputeRequest} record objects.
+ */
+export declare const ComputeRequest: Readonly<{
+  create: (partial: Partial<ComputeRequest> & Required<Omit<ComputeRequest, never>>) => ComputeRequest;
+  new: (partial: Partial<ComputeRequest> & Required<Omit<ComputeRequest, never>>) => ComputeRequest;
+  defaults: () => Partial<ComputeRequest>;
+}>;
+/**
+ * The signer connection. Neither deadline bounds the hash, which runs client side between the
+ * two RPCs.
  */
 export type ConnectOptions = {
-  headers?: Map<string, string>;
   /**
-   * Per-RPC deadline. Bounds one leg of the signing protocol, not the whole sign.
+   * Sent on every request, names lower-cased; two names that differ only by case are refused.
+   */
+  headers: Map<string, string>;
+  /**
+   * Bounds one signer RPC, or how long a mark may wait for the next byte; the service's own
+   * limit bounds a whole mark. Default 30 s.
    */
-  rpcTimeoutMs: number;
+  rpcTimeout?: number;
   /**
-   * Bounds the initial connection setup, so an unreachable signer fails fast rather than
-   * waiting out the OS SYN timeout.
+   * Bounds opening the connection. Default 5 s.
    */
-  connectTimeoutMs: number;
+  connectTimeout?: number;
 };
 /**
  * Generated factory for {@link ConnectOptions} record objects.
  */
 export declare const ConnectOptions: Readonly<{
-  create: (partial: Partial<ConnectOptions> & Required<Omit<ConnectOptions, "headers">>) => ConnectOptions;
-  new: (partial: Partial<ConnectOptions> & Required<Omit<ConnectOptions, "headers">>) => ConnectOptions;
+  create: (partial: Partial<ConnectOptions> & Required<Omit<ConnectOptions, "connectTimeout" | "headers" | "rpcTimeout">>) => ConnectOptions;
+  new: (partial: Partial<ConnectOptions> & Required<Omit<ConnectOptions, "connectTimeout" | "headers" | "rpcTimeout">>) => ConnectOptions;
   defaults: () => Partial<ConnectOptions>;
 }>;
 /**
- * Everything one [`Binder::derive`] needs beyond the asset.
+ * What one [`embed`] is told beyond the sink, the sidecar and the plugins.
  */
-export type DeriveOptions = {
-  format: AssetFormat;
+export type EmbedOptions = {
+  /**
+   * The asset's media type; `None` reads it from the sink's leading bytes.
+   */
+  format?: string;
 };
 /**
- * Generated factory for {@link DeriveOptions} record objects.
+ * Generated factory for {@link EmbedOptions} record objects.
  */
-export declare const DeriveOptions: Readonly<{
-  create: (partial: Partial<DeriveOptions> & Required<Omit<DeriveOptions, never>>) => DeriveOptions;
-  new: (partial: Partial<DeriveOptions> & Required<Omit<DeriveOptions, never>>) => DeriveOptions;
-  defaults: () => Partial<DeriveOptions>;
+export declare const EmbedOptions: Readonly<{
+  create: (partial: Partial<EmbedOptions> & Required<Omit<EmbedOptions, "format">>) => EmbedOptions;
+  new: (partial: Partial<EmbedOptions> & Required<Omit<EmbedOptions, "format">>) => EmbedOptions;
+  defaults: () => Partial<EmbedOptions>;
 }>;
 /**
- * Everything one [`embed`] needs beyond the sink, the manifest and the plugins: how the
- * asset's format is known, stated or sniffed from the sink's leading bytes.
+ * Where a stream's init manifest lives. The init segment always carries it, so there is no
+ * remote-only delivery, and the segment comes back as bytes, so there is no output to name.
  */
-export type EmbedOptions = {
-  format: AssetFormat;
+export declare enum StreamDelivery {
+  Embedded = 0,
+  EmbeddedAndRemote = 1
+}
+/**
+ * How long a session key signs, and when to rotate it.
+ */
+export type RotationPolicy = {
+  /**
+   * From the key's creation, in whole seconds (C2PA `validityPeriod`); the verifier refuses
+   * a segment signed after it.
+   */
+  validityPeriod: number;
+  /**
+   * The share of `validity_period`, 1 to 100, after which `rotation_due` is set.
+   */
+  refreshPercent: number;
 };
 /**
- * Generated factory for {@link EmbedOptions} record objects.
+ * Generated factory for {@link RotationPolicy} record objects.
  */
-export declare const EmbedOptions: Readonly<{
-  create: (partial: Partial<EmbedOptions> & Required<Omit<EmbedOptions, never>>) => EmbedOptions;
-  new: (partial: Partial<EmbedOptions> & Required<Omit<EmbedOptions, never>>) => EmbedOptions;
-  defaults: () => Partial<EmbedOptions>;
+export declare const RotationPolicy: Readonly<{
+  create: (partial: Partial<RotationPolicy> & Required<Omit<RotationPolicy, never>>) => RotationPolicy;
+  new: (partial: Partial<RotationPolicy> & Required<Omit<RotationPolicy, never>>) => RotationPolicy;
+  defaults: () => Partial<RotationPolicy>;
 }>;
 /**
- * A soft-binding binder: how a recoverable binding is derived from an asset. Put these inside
- * the issuer's manifest mode to sign and index under them, and pass them in verify options to
- * recover. Implement it for an algorithm the SDK does not ship; the SDK's own are
- * [`IsccBinder`] and [`HeldBinder`].
- *
- * `derive` answers this binder's binding for `source`, or `None` when there is none.
- * `options.format` is how the asset's format is known. `None` and an error
- * mean different things: `None` is "no binding here", an error is "the question could not be
- * answered", so a binder that failed never reads as an unmarked asset.
+ * Computes one soft-binding algorithm's values from an asset (a fingerprint calculated, a
+ * watermark detected). `[]` is "no value here"; an error is "no trustworthy answer", so a failed
+ * engine never reads as an unmarked asset.
  */
-export interface Binder {
-  derive(source: RangeSource, options: DeriveOptions, asyncOpts_?: {
+export interface Compute {
+  /**
+   * The C2PA soft-binding algorithm list label, e.g. `io.iscc.v0`.
+   */
+  alg(): string;
+  compute(request: ComputeRequest, asyncOpts_?: {
     signal: AbortSignal;
-  }): Promise<SoftBinding | undefined>;
+  }): Promise<Array<Block>>;
 }
 /**
- * A soft-binding binder: how a recoverable binding is derived from an asset. Put these inside
- * the issuer's manifest mode to sign and index under them, and pass them in verify options to
- * recover. Implement it for an algorithm the SDK does not ship; the SDK's own are
- * [`IsccBinder`] and [`HeldBinder`].
- *
- * `derive` answers this binder's binding for `source`, or `None` when there is none.
- * `options.format` is how the asset's format is known. `None` and an error
- * mean different things: `None` is "no binding here", an error is "the question could not be
- * answered", so a binder that failed never reads as an unmarked asset.
+ * Computes one soft-binding algorithm's values from an asset (a fingerprint calculated, a
+ * watermark detected). `[]` is "no value here"; an error is "no trustworthy answer", so a failed
+ * engine never reads as an unmarked asset.
  */
-export declare class BinderImpl extends UniffiAbstractObject implements Binder {
-  readonly [uniffiTypeNameSymbol] = "BinderImpl";
+export declare class ComputeImpl extends UniffiAbstractObject implements Compute {
+  readonly [uniffiTypeNameSymbol] = "ComputeImpl";
   readonly [destructorGuardSymbol]: UniffiGcObject;
   readonly [pointerLiteralSymbol]: UniffiHandle;
   private constructor();
-  derive(source: RangeSource, options: DeriveOptions, asyncOpts_?: {
+  /**
+   * The C2PA soft-binding algorithm list label, e.g. `io.iscc.v0`.
+   */
+  alg(): string;
+  compute(request: ComputeRequest, asyncOpts_?: {
     signal: AbortSignal;
-  }): Promise<SoftBinding | undefined>;
+  }): Promise<Array<Block>>;
   uniffiDestroy(): void;
-  static instanceOf(obj_: any): obj_ is BinderImpl;
+  static instanceOf(obj_: any): obj_ is ComputeImpl;
 }
-export declare enum StreamDelivery_Tags {
-  Embedded = "Embedded",
-  Remote = "Remote",
-  Both = "Both"
+export declare enum SoftBindingSource_Tags {
+  Builtin = "Builtin",
+  Held = "Held",
+  Custom = "Custom"
 }
 /**
- * How a live stream's init manifest is delivered and which binders it declares. A stream
- * returns its signed init segment as bytes, so there is no output to name.
+ * Where one assertion's values come from.
  */
-export declare const StreamDelivery: Readonly<{
-  instanceOf: (obj: any) => obj is StreamDelivery;
-  Embedded: {
+export declare const SoftBindingSource: Readonly<{
+  instanceOf: (obj: any) => obj is SoftBindingSource;
+  Builtin: {
     new (inner: {
-      binders: Array<Binder>;
+      alg: string;
     }): {
       /**
        * @private
        * This field is private and should not be used, use `tag` instead.
        */
-      readonly [uniffiTypeNameSymbol]: "StreamDelivery";
-      readonly tag: StreamDelivery_Tags.Embedded;
+      readonly [uniffiTypeNameSymbol]: "SoftBindingSource";
+      readonly tag: SoftBindingSource_Tags.Builtin;
       readonly inner: Readonly<{
-        binders: Array<Binder>;
+        alg: string;
       }>;
     };
     "new"(inner: {
-      binders: Array<Binder>;
+      alg: string;
     }): {
       /**
        * @private
        * This field is private and should not be used, use `tag` instead.
        */
-      readonly [uniffiTypeNameSymbol]: "StreamDelivery";
-      readonly tag: StreamDelivery_Tags.Embedded;
+      readonly [uniffiTypeNameSymbol]: "SoftBindingSource";
+      readonly tag: SoftBindingSource_Tags.Builtin;
       readonly inner: Readonly<{
-        binders: Array<Binder>;
+        alg: string;
       }>;
     };
     instanceOf(obj: any): obj is {
@@ -2235,38 +2245,38 @@ export declare const StreamDelivery: Readonly<{
        * @private
        * This field is private and should not be used, use `tag` instead.
        */
-      readonly [uniffiTypeNameSymbol]: "StreamDelivery";
-      readonly tag: StreamDelivery_Tags.Embedded;
+      readonly [uniffiTypeNameSymbol]: "SoftBindingSource";
+      readonly tag: SoftBindingSource_Tags.Builtin;
       readonly inner: Readonly<{
-        binders: Array<Binder>;
+        alg: string;
       }>;
     };
   };
-  Remote: {
+  Held: {
     new (inner: {
-      binders: Array<Binder>;
+      binding: SoftBinding;
     }): {
       /**
        * @private
        * This field is private and should not be used, use `tag` instead.
        */
-      readonly [uniffiTypeNameSymbol]: "StreamDelivery";
-      readonly tag: StreamDelivery_Tags.Remote;
+      readonly [uniffiTypeNameSymbol]: "SoftBindingSource";
+      readonly tag: SoftBindingSource_Tags.Held;
       readonly inner: Readonly<{
-        binders: Array<Binder>;
+        binding: SoftBinding;
       }>;
     };
     "new"(inner: {
-      binders: Array<Binder>;
+      binding: SoftBinding;
     }): {
       /**
        * @private
        * This field is private and should not be used, use `tag` instead.
        */
-      readonly [uniffiTypeNameSymbol]: "StreamDelivery";
-      readonly tag: StreamDelivery_Tags.Remote;
+      readonly [uniffiTypeNameSymbol]: "SoftBindingSource";
+      readonly tag: SoftBindingSource_Tags.Held;
       readonly inner: Readonly<{
-        binders: Array<Binder>;
+        binding: SoftBinding;
       }>;
     };
     instanceOf(obj: any): obj is {
@@ -2274,38 +2284,38 @@ export declare const StreamDelivery: Readonly<{
        * @private
        * This field is private and should not be used, use `tag` instead.
        */
-      readonly [uniffiTypeNameSymbol]: "StreamDelivery";
-      readonly tag: StreamDelivery_Tags.Remote;
+      readonly [uniffiTypeNameSymbol]: "SoftBindingSource";
+      readonly tag: SoftBindingSource_Tags.Held;
       readonly inner: Readonly<{
-        binders: Array<Binder>;
+        binding: SoftBinding;
       }>;
     };
   };
-  Both: {
+  Custom: {
     new (inner: {
-      binders: Array<Binder>;
+      compute: Compute;
     }): {
       /**
        * @private
        * This field is private and should not be used, use `tag` instead.
        */
-      readonly [uniffiTypeNameSymbol]: "StreamDelivery";
-      readonly tag: StreamDelivery_Tags.Both;
+      readonly [uniffiTypeNameSymbol]: "SoftBindingSource";
+      readonly tag: SoftBindingSource_Tags.Custom;
       readonly inner: Readonly<{
-        binders: Array<Binder>;
+        compute: Compute;
       }>;
     };
     "new"(inner: {
-      binders: Array<Binder>;
+      compute: Compute;
     }): {
       /**
        * @private
        * This field is private and should not be used, use `tag` instead.
        */
-      readonly [uniffiTypeNameSymbol]: "StreamDelivery";
-      readonly tag: StreamDelivery_Tags.Both;
+      readonly [uniffiTypeNameSymbol]: "SoftBindingSource";
+      readonly tag: SoftBindingSource_Tags.Custom;
       readonly inner: Readonly<{
-        binders: Array<Binder>;
+        compute: Compute;
       }>;
     };
     instanceOf(obj: any): obj is {
@@ -2313,63 +2323,42 @@ export declare const StreamDelivery: Readonly<{
        * @private
        * This field is private and should not be used, use `tag` instead.
        */
-      readonly [uniffiTypeNameSymbol]: "StreamDelivery";
-      readonly tag: StreamDelivery_Tags.Both;
+      readonly [uniffiTypeNameSymbol]: "SoftBindingSource";
+      readonly tag: SoftBindingSource_Tags.Custom;
       readonly inner: Readonly<{
-        binders: Array<Binder>;
+        compute: Compute;
       }>;
     };
   };
 }>;
 /**
- * How a live stream's init manifest is delivered and which binders it declares. A stream
- * returns its signed init segment as bytes, so there is no output to name.
+ * Where one assertion's values come from.
  */
-export type StreamDelivery = InstanceType<typeof StreamDelivery['Embedded' | 'Remote' | 'Both']>;
+export type SoftBindingSource = InstanceType<typeof SoftBindingSource['Builtin' | 'Held' | 'Custom']>;
 /**
- * `validity_period_secs` is the session-key validity window in seconds
- * after `created_at`; the verifier rejects segments signed past this
- * (plus skew tolerance).
- *
- * `refresh_percent` is 0..=100; once this percentage of
- * `validity_period_secs` elapses, `sign` returns `rotation_due: true`
- * so the consumer can rotate before verifier-side expiry.
- */
-export type RotationPolicy = {
-  validityPeriodSecs: number;
-  refreshPercent: number;
-};
-/**
- * Generated factory for {@link RotationPolicy} record objects.
- */
-export declare const RotationPolicy: Readonly<{
-  create: (partial: Partial<RotationPolicy> & Required<Omit<RotationPolicy, never>>) => RotationPolicy;
-  new: (partial: Partial<RotationPolicy> & Required<Omit<RotationPolicy, never>>) => RotationPolicy;
-  defaults: () => Partial<RotationPolicy>;
-}>;
-/**
- * Options for a stream's `init` and `rotate`: where the init manifest lives and the binders
- * run over the init segment for it, and the session-key validity window.
+ * Options for a stream's `init` and `rotate`: where the init manifest lives, the session-key
+ * validity window, and the soft bindings declared for the init segment.
  */
 export type InitOptions = {
   delivery: StreamDelivery;
   rotationPolicy: RotationPolicy;
+  softBindings: Array<SoftBindingSource>;
 };
 /**
  * Generated factory for {@link InitOptions} record objects.
  */
 export declare const InitOptions: Readonly<{
-  create: (partial: Partial<InitOptions> & Required<Omit<InitOptions, never>>) => InitOptions;
-  new: (partial: Partial<InitOptions> & Required<Omit<InitOptions, never>>) => InitOptions;
+  create: (partial: Partial<InitOptions> & Required<Omit<InitOptions, "softBindings">>) => InitOptions;
+  new: (partial: Partial<InitOptions> & Required<Omit<InitOptions, "softBindings">>) => InitOptions;
   defaults: () => Partial<InitOptions>;
 }>;
 /**
- * Result of [`StreamIssuer::init`](super::StreamIssuer::init). `valid_until_epoch_secs` is the
- * UNIX-epoch second at which the session key's validity elapses.
+ * Result of [`StreamIssuer::init`](super::StreamIssuer::init): the signed init segment, and when
+ * its session key stops signing.
  */
 export type InitOutcome = {
-  signedInitBytes: ArrayBuffer;
-  validUntilEpochSecs: bigint;
+  bytes: ArrayBuffer;
+  validUntil: Date;
 };
 /**
  * Generated factory for {@link InitOutcome} record objects.
@@ -2380,52 +2369,39 @@ export declare const InitOutcome: Readonly<{
   defaults: () => Partial<InitOutcome>;
 }>;
 /**
- * Everything one [`AssetMarker::mark`] needs beyond the asset, every field stated.
+ * What one [`AssetMarker::mark`] is told beyond the asset.
  */
 export type MarkOptions = {
   /**
-   * How the asset's format is known.
+   * The asset's media type; `None` reads it from the leading bytes.
    */
-  format: AssetFormat;
+  format?: string;
   /**
-   * Filename recorded with the mark, and the multipart part name.
+   * The watermarks to insert, as algorithm list labels; `[]` inserts every one the
+   * deployment offers, in its order.
    */
-  fileName: string;
-  /**
-   * Whether the signposting layer is applied beside the marks that resolve back to the
-   * manifest; `false` applies only those.
-   */
-  signpost: boolean;
+  algorithms: Array<string>;
 };
 /**
  * Generated factory for {@link MarkOptions} record objects.
  */
 export declare const MarkOptions: Readonly<{
-  create: (partial: Partial<MarkOptions> & Required<Omit<MarkOptions, never>>) => MarkOptions;
-  new: (partial: Partial<MarkOptions> & Required<Omit<MarkOptions, never>>) => MarkOptions;
+  create: (partial: Partial<MarkOptions> & Required<Omit<MarkOptions, "algorithms" | "format">>) => MarkOptions;
+  new: (partial: Partial<MarkOptions> & Required<Omit<MarkOptions, "algorithms" | "format">>) => MarkOptions;
   defaults: () => Partial<MarkOptions>;
 }>;
 /**
- * Result of [`AssetMarker::mark`](super::AssetMarker::mark): the marked asset and the provenance
- * its marking created. The neutral core is [`marker::MarkOutcome`]; this differs only in carrying the
- * asset as [`Bytes`].
+ * Result of [`AssetMarker::mark`](super::AssetMarker::mark), whose marked asset went into its
+ * sink.
  */
 export type MarkOutcome = {
   /**
-   * The marked asset. Sign these bytes, not the ones handed in.
-   */
-  bytes: ArrayBuffer;
-  /**
-   * The marked asset's media type, which a marker may change by re-encoding.
+   * The marked asset's media type, which a watermark service may change by re-encoding.
    */
   format: string;
   /**
-   * The name the marking service recorded.
-   */
-  fileName: string;
-  /**
-   * One `c2pa.watermarked.bound` or `.unbound` per mark, in the order applied, a bound one
-   * carrying the binding it resolves through. Append to the manifest's `actions`.
+   * One `c2pa.watermarked.bound` or `.unbound` per mark, in the order inserted. Append them to
+   * the manifest's `actions`.
    */
   actions: Array<Action>;
 };
@@ -2438,32 +2414,28 @@ export declare const MarkOutcome: Readonly<{
   defaults: () => Partial<MarkOutcome>;
 }>;
 /**
- * A byte range holding a bare C2PA manifest store, or reserved for one. A record of
- * primitives, so a plugin in its OWN UniFFI namespace declares a structurally identical
- * one and the two cross the boundary without sharing a Rust type.
+ * What a [`SigningVault::mint`] is asked: how long the key will be signed under, so the vault can
+ * give it that lifetime and expire it itself; a key no `forget` reaches then dies where it is held.
  */
-export type Region = {
-  offset: bigint;
-  length: bigint;
+export type MintRequest = {
+  validityPeriod: number;
 };
 /**
- * Generated factory for {@link Region} record objects.
+ * Generated factory for {@link MintRequest} record objects.
  */
-export declare const Region: Readonly<{
-  create: (partial: Partial<Region> & Required<Omit<Region, never>>) => Region;
-  new: (partial: Partial<Region> & Required<Omit<Region, never>>) => Region;
-  defaults: () => Partial<Region>;
+export declare const MintRequest: Readonly<{
+  create: (partial: Partial<MintRequest> & Required<Omit<MintRequest, never>>) => MintRequest;
+  new: (partial: Partial<MintRequest> & Required<Omit<MintRequest, never>>) => MintRequest;
+  defaults: () => Partial<MintRequest>;
 }>;
 /**
- * Result of [`StreamSession::sign`](super::StreamSession::sign). `rotation_due` flips once
- * `policy.refresh_percent`% of validity has elapsed; `valid_until_epoch_secs` is repeated
- * per segment so callers can schedule rotation precisely instead of reacting only to the
- * flag.
+ * Result of [`StreamSession::sign`](super::StreamSession::sign). `valid_until` repeats per
+ * segment so a caller can schedule the rotation rather than only react to `rotation_due`.
  */
 export type SegmentOutcome = {
   bytes: ArrayBuffer;
   rotationDue: boolean;
-  validUntilEpochSecs: bigint;
+  validUntil: Date;
 };
 /**
  * Generated factory for {@link SegmentOutcome} record objects.
@@ -2473,6 +2445,23 @@ export declare const SegmentOutcome: Readonly<{
   new: (partial: Partial<SegmentOutcome> & Required<Omit<SegmentOutcome, never>>) => SegmentOutcome;
   defaults: () => Partial<SegmentOutcome>;
 }>;
+/**
+ * A minted session key's public half. `kid` is the vault's handle for it (typically SHA-256 of
+ * the public key); `public_key` is the uncompressed SEC1 point (65 bytes from `0x04` for ES256),
+ * which the SDK wraps as a `COSE_Key` (C2PA 2.4 19.4.4).
+ */
+export type SessionKey = {
+  kid: ArrayBuffer;
+  publicKey: ArrayBuffer;
+};
+/**
+ * Generated factory for {@link SessionKey} record objects.
+ */
+export declare const SessionKey: Readonly<{
+  create: (partial: Partial<SessionKey> & Required<Omit<SessionKey, never>>) => SessionKey;
+  new: (partial: Partial<SessionKey> & Required<Omit<SessionKey, never>>) => SessionKey;
+  defaults: () => Partial<SessionKey>;
+}>;
 /**
  * A ranged read+write backend for embedding. All four methods are first-class (UniFFI
  * has no trait inheritance for foreign callbacks, so the read half is duplicated from
@@ -2534,10 +2523,9 @@ export declare enum SignOutput_Tags {
   Asset = "Asset"
 }
 /**
- * What a `sign` hands back beyond the sidecar it always returns: the sidecar alone, or the
- * signed asset written through `into` in the same call. See the core
- * [`SignOutput`](crate::manifest::spec::SignOutput) for what pointing `into` at the asset's own
- * storage means.
+ * What a `sign` hands back beyond the sidecar it always returns: the sidecar alone, or the whole
+ * signed asset written into `into` in the same call, replacing what it held. See the core
+ * [`SignOutput`](core::SignOutput) for what pointing `into` at the asset's own storage means.
  */
 export declare const SignOutput: Readonly<{
   instanceOf: (obj: any) => obj is SignOutput;
@@ -2608,30 +2596,27 @@ export declare const SignOutput: Readonly<{
   };
 }>;
 /**
- * What a `sign` hands back beyond the sidecar it always returns: the sidecar alone, or the
- * signed asset written through `into` in the same call. See the core
- * [`SignOutput`](crate::manifest::spec::SignOutput) for what pointing `into` at the asset's own
- * storage means.
+ * What a `sign` hands back beyond the sidecar it always returns: the sidecar alone, or the whole
+ * signed asset written into `into` in the same call, replacing what it held. See the core
+ * [`SignOutput`](core::SignOutput) for what pointing `into` at the asset's own storage means.
  */
 export type SignOutput = InstanceType<typeof SignOutput['Sidecar' | 'Asset']>;
 export declare enum AssetDelivery_Tags {
   Embedded = "Embedded",
   Remote = "Remote",
-  Both = "Both"
+  EmbeddedAndRemote = "EmbeddedAndRemote"
 }
 /**
- * How a static asset's manifest is delivered, which binders it declares, and what comes back.
+ * Where a static asset's manifest lives and, when it is in the asset, what comes back.
  *
- * Embedded manifests may still need bindings, for example to describe a bound watermark, but
- * are not indexed. Remote needs at least one resolved binding, from a binder or a bound
- * watermark action, and never touches the asset, so it names no output; both is recoverable
- * through its embedded manifest and permits an empty strategy list.
+ * Embedded manifests are not indexed, so a watermark on one is refused: it could never lead back
+ * to the manifest. Remote needs a soft binding the deployment resolves and never touches the
+ * asset, so it names no output.
  */
 export declare const AssetDelivery: Readonly<{
   instanceOf: (obj: any) => obj is AssetDelivery;
   Embedded: {
     new (inner: {
-      binders: Array<Binder>;
       output: SignOutput;
     }): {
       /**
@@ -2641,12 +2626,10 @@ export declare const AssetDelivery: Readonly<{
       readonly [uniffiTypeNameSymbol]: "AssetDelivery";
       readonly tag: AssetDelivery_Tags.Embedded;
       readonly inner: Readonly<{
-        binders: Array<Binder>;
         output: SignOutput;
       }>;
     };
     "new"(inner: {
-      binders: Array<Binder>;
       output: SignOutput;
     }): {
       /**
@@ -2656,7 +2639,6 @@ export declare const AssetDelivery: Readonly<{
       readonly [uniffiTypeNameSymbol]: "AssetDelivery";
       readonly tag: AssetDelivery_Tags.Embedded;
       readonly inner: Readonly<{
-        binders: Array<Binder>;
         output: SignOutput;
       }>;
     };
@@ -2668,37 +2650,26 @@ export declare const AssetDelivery: Readonly<{
       readonly [uniffiTypeNameSymbol]: "AssetDelivery";
       readonly tag: AssetDelivery_Tags.Embedded;
       readonly inner: Readonly<{
-        binders: Array<Binder>;
         output: SignOutput;
       }>;
     };
   };
   Remote: {
-    new (inner: {
-      binders: Array<Binder>;
-    }): {
+    new (): {
       /**
        * @private
        * This field is private and should not be used, use `tag` instead.
        */
       readonly [uniffiTypeNameSymbol]: "AssetDelivery";
       readonly tag: AssetDelivery_Tags.Remote;
-      readonly inner: Readonly<{
-        binders: Array<Binder>;
-      }>;
     };
-    "new"(inner: {
-      binders: Array<Binder>;
-    }): {
+    "new"(): {
       /**
        * @private
        * This field is private and should not be used, use `tag` instead.
        */
       readonly [uniffiTypeNameSymbol]: "AssetDelivery";
       readonly tag: AssetDelivery_Tags.Remote;
-      readonly inner: Readonly<{
-        binders: Array<Binder>;
-      }>;
     };
     instanceOf(obj: any): obj is {
       /**
@@ -2707,14 +2678,10 @@ export declare const AssetDelivery: Readonly<{
        */
       readonly [uniffiTypeNameSymbol]: "AssetDelivery";
       readonly tag: AssetDelivery_Tags.Remote;
-      readonly inner: Readonly<{
-        binders: Array<Binder>;
-      }>;
     };
   };
-  Both: {
+  EmbeddedAndRemote: {
     new (inner: {
-      binders: Array<Binder>;
       output: SignOutput;
     }): {
       /**
@@ -2722,14 +2689,12 @@ export declare const AssetDelivery: Readonly<{
        * This field is private and should not be used, use `tag` instead.
        */
       readonly [uniffiTypeNameSymbol]: "AssetDelivery";
-      readonly tag: AssetDelivery_Tags.Both;
+      readonly tag: AssetDelivery_Tags.EmbeddedAndRemote;
       readonly inner: Readonly<{
-        binders: Array<Binder>;
         output: SignOutput;
       }>;
     };
     "new"(inner: {
-      binders: Array<Binder>;
       output: SignOutput;
     }): {
       /**
@@ -2737,9 +2702,8 @@ export declare const AssetDelivery: Readonly<{
        * This field is private and should not be used, use `tag` instead.
        */
       readonly [uniffiTypeNameSymbol]: "AssetDelivery";
-      readonly tag: AssetDelivery_Tags.Both;
+      readonly tag: AssetDelivery_Tags.EmbeddedAndRemote;
       readonly inner: Readonly<{
-        binders: Array<Binder>;
         output: SignOutput;
       }>;
     };
@@ -2749,48 +2713,51 @@ export declare const AssetDelivery: Readonly<{
        * This field is private and should not be used, use `tag` instead.
        */
       readonly [uniffiTypeNameSymbol]: "AssetDelivery";
-      readonly tag: AssetDelivery_Tags.Both;
+      readonly tag: AssetDelivery_Tags.EmbeddedAndRemote;
       readonly inner: Readonly<{
-        binders: Array<Binder>;
         output: SignOutput;
       }>;
     };
   };
 }>;
 /**
- * How a static asset's manifest is delivered, which binders it declares, and what comes back.
+ * Where a static asset's manifest lives and, when it is in the asset, what comes back.
  *
- * Embedded manifests may still need bindings, for example to describe a bound watermark, but
- * are not indexed. Remote needs at least one resolved binding, from a binder or a bound
- * watermark action, and never touches the asset, so it names no output; both is recoverable
- * through its embedded manifest and permits an empty strategy list.
+ * Embedded manifests are not indexed, so a watermark on one is refused: it could never lead back
+ * to the manifest. Remote needs a soft binding the deployment resolves and never touches the
+ * asset, so it names no output.
  */
-export type AssetDelivery = InstanceType<typeof AssetDelivery['Embedded' | 'Remote' | 'Both']>;
+export type AssetDelivery = InstanceType<typeof AssetDelivery['Embedded' | 'Remote' | 'EmbeddedAndRemote']>;
 /**
- * Options for `sign`. The delivery owns where the manifest lives, its binders and what comes
- * back; the format is how the asset's is known, stated or sniffed; the thumbnail is the claim
- * thumbnail the caller rendered, since the split-signer never sees the asset.
+ * What one `sign` is told beyond the asset, its manifest and the plugins.
  */
 export type SignOptions = {
   delivery: AssetDelivery;
-  format: AssetFormat;
+  /**
+   * The asset's media type; `None` reads it from the leading bytes.
+   */
+  format?: string;
+  /**
+   * The claim thumbnail, rendered by the caller: the split signer never sees the asset.
+   */
   thumbnail?: Thumbnail;
+  softBindings: Array<SoftBindingSource>;
 };
 /**
  * Generated factory for {@link SignOptions} record objects.
  */
 export declare const SignOptions: Readonly<{
-  create: (partial: Partial<SignOptions> & Required<Omit<SignOptions, "thumbnail">>) => SignOptions;
-  new: (partial: Partial<SignOptions> & Required<Omit<SignOptions, "thumbnail">>) => SignOptions;
+  create: (partial: Partial<SignOptions> & Required<Omit<SignOptions, "format" | "softBindings" | "thumbnail">>) => SignOptions;
+  new: (partial: Partial<SignOptions> & Required<Omit<SignOptions, "format" | "softBindings" | "thumbnail">>) => SignOptions;
   defaults: () => Partial<SignOptions>;
 }>;
 /**
  * Result of [`AssetIssuer::sign`](super::AssetIssuer::sign): the sidecar to embed plus its active
- * C2PA manifest id. Remote and both modes persist that id; embedded mode does not.
+ * C2PA manifest id. `Remote` and `EmbeddedAndRemote` persist that id; `Embedded` does not.
  */
 export type SignOutcome = {
   /**
-   * The manifest sidecar to embed into the asset (see [`embed`](crate::ffi::embed)).
+   * The manifest sidecar to embed into the asset (see `embed`).
    */
   sidecar: ArrayBuffer;
   /**
@@ -2806,23 +2773,23 @@ export declare const SignOutcome: Readonly<{
   new: (partial: Partial<SignOutcome> & Required<Omit<SignOutcome, never>>) => SignOutcome;
   defaults: () => Partial<SignOutcome>;
 }>;
-export declare enum Origin_Tags {
+export declare enum StreamOrigin_Tags {
   Created = "Created",
   Opened = "Opened"
 }
 /**
- * An origin a live stream states; see the core [`provenance::Origin`].
+ * An origin a stream states; see the core [`provenance::StreamOrigin`].
  */
-export declare const Origin: Readonly<{
-  instanceOf: (obj: any) => obj is Origin;
+export declare const StreamOrigin: Readonly<{
+  instanceOf: (obj: any) => obj is StreamOrigin;
   Created: {
     new (v0: CreatedOrigin): {
       /**
        * @private
        * This field is private and should not be used, use `tag` instead.
        */
-      readonly [uniffiTypeNameSymbol]: "Origin";
-      readonly tag: Origin_Tags.Created;
+      readonly [uniffiTypeNameSymbol]: "StreamOrigin";
+      readonly tag: StreamOrigin_Tags.Created;
       readonly inner: Readonly<[CreatedOrigin]>;
     };
     "new"(v0: CreatedOrigin): {
@@ -2830,8 +2797,8 @@ export declare const Origin: Readonly<{
        * @private
        * This field is private and should not be used, use `tag` instead.
        */
-      readonly [uniffiTypeNameSymbol]: "Origin";
-      readonly tag: Origin_Tags.Created;
+      readonly [uniffiTypeNameSymbol]: "StreamOrigin";
+      readonly tag: StreamOrigin_Tags.Created;
       readonly inner: Readonly<[CreatedOrigin]>;
     };
     instanceOf(obj: any): obj is {
@@ -2839,8 +2806,8 @@ export declare const Origin: Readonly<{
        * @private
        * This field is private and should not be used, use `tag` instead.
        */
-      readonly [uniffiTypeNameSymbol]: "Origin";
-      readonly tag: Origin_Tags.Created;
+      readonly [uniffiTypeNameSymbol]: "StreamOrigin";
+      readonly tag: StreamOrigin_Tags.Created;
       readonly inner: Readonly<[CreatedOrigin]>;
     };
   };
@@ -2850,8 +2817,8 @@ export declare const Origin: Readonly<{
        * @private
        * This field is private and should not be used, use `tag` instead.
        */
-      readonly [uniffiTypeNameSymbol]: "Origin";
-      readonly tag: Origin_Tags.Opened;
+      readonly [uniffiTypeNameSymbol]: "StreamOrigin";
+      readonly tag: StreamOrigin_Tags.Opened;
       readonly inner: Readonly<[OpenedOrigin]>;
     };
     "new"(v0: OpenedOrigin): {
@@ -2859,8 +2826,8 @@ export declare const Origin: Readonly<{
        * @private
        * This field is private and should not be used, use `tag` instead.
        */
-      readonly [uniffiTypeNameSymbol]: "Origin";
-      readonly tag: Origin_Tags.Opened;
+      readonly [uniffiTypeNameSymbol]: "StreamOrigin";
+      readonly tag: StreamOrigin_Tags.Opened;
       readonly inner: Readonly<[OpenedOrigin]>;
     };
     instanceOf(obj: any): obj is {
@@ -2868,62 +2835,73 @@ export declare const Origin: Readonly<{
        * @private
        * This field is private and should not be used, use `tag` instead.
        */
-      readonly [uniffiTypeNameSymbol]: "Origin";
-      readonly tag: Origin_Tags.Opened;
+      readonly [uniffiTypeNameSymbol]: "StreamOrigin";
+      readonly tag: StreamOrigin_Tags.Opened;
       readonly inner: Readonly<[OpenedOrigin]>;
     };
   };
 }>;
 /**
- * An origin a live stream states; see the core [`provenance::Origin`].
+ * An origin a stream states; see the core [`provenance::StreamOrigin`].
  */
-export type Origin = InstanceType<typeof Origin['Created' | 'Opened']>;
+export type StreamOrigin = InstanceType<typeof StreamOrigin['Created' | 'Opened']>;
 /**
- * The manifest a live stream's init segment is signed with: the asset spec's twin whose origin
- * is an [`Origin`], since an init segment has no store the SDK opens as the parent.
+ * The manifest a stream's init segment is signed with: the asset spec's twin whose origin is a
+ * [`StreamOrigin`], since an init segment has no store the SDK opens as the parent.
  */
 export type StreamManifestSpec = {
   title?: string;
-  origin: Origin;
+  origin: StreamOrigin;
+  /**
+   * Every action performed on the asset; the manifest states the list is complete (C2PA
+   * `allActionsIncluded`).
+   */
   actions: Array<Action>;
   identity?: Identity;
   assertions: Array<Assertion>;
-  components: Array<Component>;
+  /**
+   * Keyed by the handle actions name them by.
+   */
+  components: Map<string, Component>;
 };
 /**
  * Generated factory for {@link StreamManifestSpec} record objects.
  */
 export declare const StreamManifestSpec: Readonly<{
-  create: (partial: Partial<StreamManifestSpec> & Required<Omit<StreamManifestSpec, "identity" | "title">>) => StreamManifestSpec;
-  new: (partial: Partial<StreamManifestSpec> & Required<Omit<StreamManifestSpec, "identity" | "title">>) => StreamManifestSpec;
+  create: (partial: Partial<StreamManifestSpec> & Required<Omit<StreamManifestSpec, "actions" | "assertions" | "components" | "identity" | "title">>) => StreamManifestSpec;
+  new: (partial: Partial<StreamManifestSpec> & Required<Omit<StreamManifestSpec, "actions" | "assertions" | "components" | "identity" | "title">>) => StreamManifestSpec;
   defaults: () => Partial<StreamManifestSpec>;
 }>;
 /**
- * One live stream, from `init` to `stop`.
+ * One stream, from `init` to `stop` or `rotate`.
  *
- * Carries the whole per-stream state, so it cannot be mistyped, reused after `stop`, or
- * confused with another stream's: every call after `init` goes through the handle that started
- * it, and nothing about the stream ever appears in a caller's argument list again.
+ * Carries the whole per-stream state, so it cannot be mistyped or confused with another
+ * stream's: every call after `init` goes through the handle that started it, and nothing about
+ * the stream ever appears in a caller's argument list again. Once `stop` or a `rotate` succeeds
+ * it refuses every call.
  */
 export interface StreamSessionLike {
   /**
    * Sign one media (moof) segment from a [`RangeSource`]. Does not touch the signer channel;
    * works through a signer outage. `rotation_due` flips when the key validity threshold
-   * passes; re-`init` on the issuer to rotate.
+   * passes; then call `StreamIssuer.rotate` with this session.
    *
    * # Errors
    *
-   * Fails on a vault error, or a segment that isn't a BMFF media segment.
+   * Fails on a vault error, a segment that isn't a BMFF media segment, or with
+   * `FAILED_PRECONDITION` (`SESSION_ENDED`) after `stop` or a `rotate`.
    */
-  sign(body: RangeSource, asyncOpts_?: {
+  sign(source: RangeSource, asyncOpts_?: {
     signal: AbortSignal;
   }): Promise<SegmentOutcome>;
   /**
-   * End the stream: forget its session key, so nothing can sign under it again.
+   * End the stream: forget its session key, so nothing can sign under it again. Idempotent:
+   * stopping an ended session succeeds. A failed stop can be retried.
    *
    * # Errors
    *
-   * Fails on a vault error.
+   * Fails on a vault error, or with `FAILED_PRECONDITION` (`SESSION_ENDED`) with another
+   * `stop` or `rotate` in flight.
    */
   stop(asyncOpts_?: {
     signal: AbortSignal;
@@ -2934,11 +2912,12 @@ export interface StreamSessionLike {
  */
 export type StreamSessionInterface = StreamSessionLike;
 /**
- * One live stream, from `init` to `stop`.
+ * One stream, from `init` to `stop` or `rotate`.
  *
- * Carries the whole per-stream state, so it cannot be mistyped, reused after `stop`, or
- * confused with another stream's: every call after `init` goes through the handle that started
- * it, and nothing about the stream ever appears in a caller's argument list again.
+ * Carries the whole per-stream state, so it cannot be mistyped or confused with another
+ * stream's: every call after `init` goes through the handle that started it, and nothing about
+ * the stream ever appears in a caller's argument list again. Once `stop` or a `rotate` succeeds
+ * it refuses every call.
  */
 export declare class StreamSession extends UniffiAbstractObject implements StreamSessionLike {
   readonly [uniffiTypeNameSymbol] = "StreamSession";
@@ -2948,21 +2927,24 @@ export declare class StreamSession extends UniffiAbstractObject implements Strea
   /**
    * Sign one media (moof) segment from a [`RangeSource`]. Does not touch the signer channel;
    * works through a signer outage. `rotation_due` flips when the key validity threshold
-   * passes; re-`init` on the issuer to rotate.
+   * passes; then call `StreamIssuer.rotate` with this session.
    *
    * # Errors
    *
-   * Fails on a vault error, or a segment that isn't a BMFF media segment.
+   * Fails on a vault error, a segment that isn't a BMFF media segment, or with
+   * `FAILED_PRECONDITION` (`SESSION_ENDED`) after `stop` or a `rotate`.
    */
-  sign(body: RangeSource, asyncOpts_?: {
+  sign(source: RangeSource, asyncOpts_?: {
     signal: AbortSignal;
   }): Promise<SegmentOutcome>;
   /**
-   * End the stream: forget its session key, so nothing can sign under it again.
+   * End the stream: forget its session key, so nothing can sign under it again. Idempotent:
+   * stopping an ended session succeeds. A failed stop can be retried.
    *
    * # Errors
    *
-   * Fails on a vault error.
+   * Fails on a vault error, or with `FAILED_PRECONDITION` (`SESSION_ENDED`) with another
+   * `stop` or `rotate` in flight.
    */
   stop(asyncOpts_?: {
     signal: AbortSignal;
@@ -2993,25 +2975,8 @@ export declare const StreamStart: Readonly<{
   defaults: () => Partial<StreamStart>;
 }>;
 /**
- * `kid` is the vault-derived handle (typically SHA-256 of SEC1 public).
- * `public_key_sec1` is uncompressed SEC1 (65 bytes starting with `0x04`
- * for ES256); the SDK rewraps as `COSE_Key` for §19.4.4.
- */
-export type VaultPublicKey = {
-  kid: ArrayBuffer;
-  publicKeySec1: ArrayBuffer;
-};
-/**
- * Generated factory for {@link VaultPublicKey} record objects.
- */
-export declare const VaultPublicKey: Readonly<{
-  create: (partial: Partial<VaultPublicKey> & Required<Omit<VaultPublicKey, never>>) => VaultPublicKey;
-  new: (partial: Partial<VaultPublicKey> & Required<Omit<VaultPublicKey, never>>) => VaultPublicKey;
-  defaults: () => Partial<VaultPublicKey>;
-}>;
-/**
- * Whether a fragmented-MP4 segment is the init (moov) or a media (moof) segment: which
- * [`StreamIssuer`](stream::StreamIssuer) entrypoint (`init` vs `sign`) a segment belongs to.
+ * Whether a fragmented-MP4 segment is the init (moov) or a media (moof) segment: whether it goes
+ * to `StreamIssuer.init` or `StreamSession.sign`.
  */
 export declare enum SegmentKind {
   Init = 0,
@@ -3034,25 +2999,25 @@ export interface PluginAuthor {
    * Implement it correctly anyway, since the verify side dispatches on it and whatever
    * signs a format is eventually verified by it.
    */
-  sniff(src: RangeSource, asyncOpts_?: {
+  sniff(source: RangeSource, asyncOpts_?: {
     signal: AbortSignal;
   }): Promise<string | undefined>;
   /**
    * The manifest window(s), or empty when none is present. MUST be byte-identical
    * regardless of slot contents; the sign driver enforces that with a round-trip.
    */
-  locate(src: RangeSource, asyncOpts_?: {
+  locate(source: RangeSource, asyncOpts_?: {
     signal: AbortSignal;
-  }): Promise<Array<Region>>;
+  }): Promise<Array<ByteRange>>;
   /**
    * Reserve `reserve` bytes of manifest slot by writing container structure through
-   * `dst`, and return exactly where it landed. The core excludes those regions from the
-   * content hash and writes the signed manifest into them, so the plugin never embeds
-   * and never re-locates.
+   * `sink`, and return exactly where it landed. The core excludes those regions from the
+   * content hash and writes the signed manifest into them, then checks that `locate`
+   * still reports the same regions.
    */
-  reserveSlot(dst: RangeSink, reserve: bigint, asyncOpts_?: {
+  reserveSlot(sink: RangeSink, reserve: bigint, asyncOpts_?: {
     signal: AbortSignal;
-  }): Promise<Array<Region>>;
+  }): Promise<Array<ByteRange>>;
 }
 /**
  * A C2PA asset signer bound to a [`SignerClient`](super::client::SignerClient).
@@ -3060,16 +3025,14 @@ export interface PluginAuthor {
  */
 export interface AssetIssuerLike {
   /**
-   * Sign an asset from a [`RangeSource`], returning the sidecar plus the registry
-   * `manifest_id`. `options.delivery` selects where the manifest lives, its binders and,
-   * through its output, the sink the signed asset is written through. `options.format` is
-   * how the asset's format is known. `plugins` resolves a non-c2pa format (e.g. MXF); see the
-   * module docs for the dispatch.
+   * Sign an asset from a [`RangeSource`], returning the sidecar and the active manifest's id.
+   * `options.delivery` says where the manifest lives and, through its output, where the signed
+   * asset is written. `plugins` resolves a non-c2pa format (e.g. MXF); see the module docs.
    *
    * # Errors
    *
-   * Fails on RPC failure, a hashing error, an authoring error, a protocol violation,
-   * or when the format can't be inferred and none was given.
+   * A format that is no media type, that the bytes contradict or that neither names; an RPC,
+   * hashing, authoring or protocol failure.
    */
   sign(source: RangeSource, manifest: AssetManifestSpec, options: SignOptions, plugins: Array<PluginAuthor>, asyncOpts_?: {
     signal: AbortSignal;
@@ -3093,41 +3056,40 @@ export declare class AssetIssuer extends UniffiAbstractObject implements AssetIs
    */
   static create(client: SignerClientLike): AssetIssuerLike;
   /**
-   * Sign an asset from a [`RangeSource`], returning the sidecar plus the registry
-   * `manifest_id`. `options.delivery` selects where the manifest lives, its binders and,
-   * through its output, the sink the signed asset is written through. `options.format` is
-   * how the asset's format is known. `plugins` resolves a non-c2pa format (e.g. MXF); see the
-   * module docs for the dispatch.
+   * Sign an asset from a [`RangeSource`], returning the sidecar and the active manifest's id.
+   * `options.delivery` says where the manifest lives and, through its output, where the signed
+   * asset is written. `plugins` resolves a non-c2pa format (e.g. MXF); see the module docs.
    *
    * # Errors
    *
-   * Fails on RPC failure, a hashing error, an authoring error, a protocol violation,
-   * or when the format can't be inferred and none was given.
+   * A format that is no media type, that the bytes contradict or that neither names; an RPC,
+   * hashing, authoring or protocol failure.
    */
-  sign(source: RangeSource, manifest: AssetManifestSpec, options: SignOptions, plugins: Array<PluginAuthor>, asyncOpts_?: {
+  sign(source: RangeSource, manifest: AssetManifestSpec, options: SignOptions, plugins?: Array<PluginAuthor>, asyncOpts_?: {
     signal: AbortSignal;
   }): Promise<SignOutcome>;
   uniffiDestroy(): void;
   static instanceOf(obj_: any): obj_ is AssetIssuer;
 }
 /**
- * Applies invisible watermarks through the deployment's marking service.
+ * Inserts invisible watermarks through the deployment's marking route.
  *
  * Separate from [`AssetIssuer`] because marking is a content edit, not a signing step: it
- * changes pixels, it happens before signing, and it returns the provenance facts it created
- * rather than leaving anything downstream to infer them.
+ * happens before signing, and it returns the actions it owes the manifest.
  */
 export interface AssetMarkerLike {
   /**
-   * Mark an image from a [`RangeSource`] and return it with the actions the marking created,
-   * each bound one carrying its binding.
+   * Mark an asset from a [`RangeSource`], writing the marked asset into `into` in place of
+   * what it held, and return one `c2pa.watermarked.*` action per mark, in the order inserted.
+   * Sign what `into` holds.
    *
    * # Errors
    *
-   * Fails when the format can't be resolved, the asset is above the upload ceiling, the HTTP
-   * request fails, or the service response is malformed.
+   * An unlisted algorithm, a format that is no media type or that the bytes contradict, an
+   * asset above the upload ceiling, a source or sink that fails, or a marking route that
+   * refused or answered out of contract.
    */
-  mark(source: RangeSource, options: MarkOptions, asyncOpts_?: {
+  mark(source: RangeSource, into: RangeSink, options: MarkOptions, asyncOpts_?: {
     signal: AbortSignal;
   }): Promise<MarkOutcome>;
 }
@@ -3136,11 +3098,10 @@ export interface AssetMarkerLike {
  */
 export type AssetMarkerInterface = AssetMarkerLike;
 /**
- * Applies invisible watermarks through the deployment's marking service.
+ * Inserts invisible watermarks through the deployment's marking route.
  *
  * Separate from [`AssetIssuer`] because marking is a content edit, not a signing step: it
- * changes pixels, it happens before signing, and it returns the provenance facts it created
- * rather than leaving anything downstream to infer them.
+ * happens before signing, and it returns the actions it owes the manifest.
  */
 export declare class AssetMarker extends UniffiAbstractObject implements AssetMarkerLike {
   readonly [uniffiTypeNameSymbol] = "AssetMarker";
@@ -3152,15 +3113,17 @@ export declare class AssetMarker extends UniffiAbstractObject implements AssetMa
    */
   static create(client: SignerClientLike): AssetMarkerLike;
   /**
-   * Mark an image from a [`RangeSource`] and return it with the actions the marking created,
-   * each bound one carrying its binding.
+   * Mark an asset from a [`RangeSource`], writing the marked asset into `into` in place of
+   * what it held, and return one `c2pa.watermarked.*` action per mark, in the order inserted.
+   * Sign what `into` holds.
    *
    * # Errors
    *
-   * Fails when the format can't be resolved, the asset is above the upload ceiling, the HTTP
-   * request fails, or the service response is malformed.
+   * An unlisted algorithm, a format that is no media type or that the bytes contradict, an
+   * asset above the upload ceiling, a source or sink that fails, or a marking route that
+   * refused or answered out of contract.
    */
-  mark(source: RangeSource, options: MarkOptions, asyncOpts_?: {
+  mark(source: RangeSource, into: RangeSink, options: MarkOptions, asyncOpts_?: {
     signal: AbortSignal;
   }): Promise<MarkOutcome>;
   uniffiDestroy(): void;
@@ -3178,10 +3141,6 @@ export declare class AssetMarker extends UniffiAbstractObject implements AssetMa
  * That is what makes [`MemorySink`]'s ceiling stop applying: there is no byte array to count in an
  * `i32` and nothing resident, so a multi-GB master is signed at the disk's speed rather than the
  * host thread's, and `bytes()` is not something anyone has to call.
- *
- * No lock. A positioned write to a file is one `pwrite`, which the OS already makes atomic per
- * call, and [`RangeWriter`] takes a shared borrow precisely so a backend like this pays nothing
- * for being shared.
  */
 export interface FileSinkLike {
   length(asyncOpts_?: {
@@ -3213,10 +3172,6 @@ export type FileSinkInterface = FileSinkLike;
  * That is what makes [`MemorySink`]'s ceiling stop applying: there is no byte array to count in an
  * `i32` and nothing resident, so a multi-GB master is signed at the disk's speed rather than the
  * host thread's, and `bytes()` is not something anyone has to call.
- *
- * No lock. A positioned write to a file is one `pwrite`, which the OS already makes atomic per
- * call, and [`RangeWriter`] takes a shared borrow precisely so a backend like this pays nothing
- * for being shared.
  */
 export declare class FileSink extends UniffiAbstractObject implements FileSinkLike {
   readonly [uniffiTypeNameSymbol] = "FileSink";
@@ -3224,8 +3179,8 @@ export declare class FileSink extends UniffiAbstractObject implements FileSinkLi
   readonly [pointerLiteralSymbol]: UniffiHandle;
   private constructor();
   /**
-   * Create `path`, or truncate it if it is already there. What `embed` wants: it composes a
-   * whole asset, so the sink starts empty and grows.
+   * Create `path`, or truncate it if it is already there. What a `sign` output wants: the
+   * signed asset is written into it whole.
    *
    * # Errors
    *
@@ -3233,9 +3188,9 @@ export declare class FileSink extends UniffiAbstractObject implements FileSinkLi
    */
   static create(path: string): FileSinkLike;
   /**
-   * Open an existing `path` for reading and writing, keeping what is in it. What a fixed-slot
-   * patch wants: the asset is already there and only its reserved range changes, so truncating
-   * it would destroy the very thing being signed.
+   * Open an existing `path` for reading and writing, keeping what is in it. What `embed` wants:
+   * the asset is already there and the manifest is written into it, so truncating it would
+   * destroy the very thing being signed.
    *
    * # Errors
    *
@@ -3324,70 +3279,8 @@ export declare class FileSource extends UniffiAbstractObject implements FileSour
   static instanceOf(obj_: any): obj_ is FileSource;
 }
 /**
- * A binding you already hold, such as an out-of-band video ISCC. Reads nothing.
- */
-export interface HeldBinderLike {
-  derive(source: RangeSource, options: DeriveOptions, asyncOpts_?: {
-    signal: AbortSignal;
-  }): Promise<SoftBinding | undefined>;
-}
-/**
- * @deprecated Use `HeldBinderLike` instead.
- */
-export type HeldBinderInterface = HeldBinderLike;
-/**
- * A binding you already hold, such as an out-of-band video ISCC. Reads nothing.
- */
-export declare class HeldBinder extends UniffiAbstractObject implements HeldBinderLike {
-  readonly [uniffiTypeNameSymbol] = "HeldBinder";
-  readonly [destructorGuardSymbol]: UniffiGcObject;
-  readonly [pointerLiteralSymbol]: UniffiHandle;
-  /**
-   * # Errors
-   *
-   * A binding with an empty algorithm or value.
-   */
-  constructor(binding: SoftBinding);
-  derive(source: RangeSource, options: DeriveOptions, asyncOpts_?: {
-    signal: AbortSignal;
-  }): Promise<SoftBinding | undefined>;
-  uniffiDestroy(): void;
-  static instanceOf(obj_: any): obj_ is HeldBinder;
-}
-/**
- * Local ISCC Image-Code for supported image formats.
- */
-export interface IsccBinderLike {
-  derive(source: RangeSource, options: DeriveOptions, asyncOpts_?: {
-    signal: AbortSignal;
-  }): Promise<SoftBinding | undefined>;
-}
-/**
- * @deprecated Use `IsccBinderLike` instead.
- */
-export type IsccBinderInterface = IsccBinderLike;
-/**
- * Local ISCC Image-Code for supported image formats.
- */
-export declare class IsccBinder extends UniffiAbstractObject implements IsccBinderLike {
-  readonly [uniffiTypeNameSymbol] = "IsccBinder";
-  readonly [destructorGuardSymbol]: UniffiGcObject;
-  readonly [pointerLiteralSymbol]: UniffiHandle;
-  constructor();
-  derive(source: RangeSource, options: DeriveOptions, asyncOpts_?: {
-    signal: AbortSignal;
-  }): Promise<SoftBinding | undefined>;
-  uniffiDestroy(): void;
-  static instanceOf(obj_: any): obj_ is IsccBinder;
-}
-/**
- * An in-memory [`RangeSink`], for a caller that wants `embed`'s composed result back
- * without writing a custom sink. A **native** implementation of a `with_foreign`
- * interface (`#[uniffi::export]` on the trait impl, not the foreign callback path), so
- * a Python caller writes no subclass: `sink = MemorySink(data)`, pass it to `embed`,
- * then read `sink.bytes()` back. `&self`-only methods need interior mutability, so the
- * buffer is `Mutex`-guarded (contention is a non-issue: the SDK calls it from one task
- * at a time per sink).
+ * An in-memory [`RangeSink`] for a caller that wants `embed`'s composed result back:
+ * `sink = MemorySink(data)`, pass it to `embed`, then read `sink.bytes()`.
  *
  * # Size ceiling
  *
@@ -3399,9 +3292,14 @@ export declare class IsccBinder extends UniffiAbstractObject implements IsccBind
  * [`RangeSink`] over a file (or any store that seeks) for anything approaching that: the SDK
  * writes ranges straight through it and never holds the asset.
  *
- * Construction and `bytes()` each copy the whole asset, on the calling thread: together with a
- * `MemorySource` over the same asset that is about 12ms for 10 MB and 1.2s for 500 MB. A ranged
- * sink pays none of it.
+ * Construction and `bytes()` each move the whole asset across the boundary once, on the calling
+ * thread. A ranged sink pays neither.
+ *
+ * # Capacity
+ *
+ * The buffer never grows past its capacity: [`MemorySink::new`] allows 2 GiB, and
+ * [`MemorySink::with_capacity`] names another. A write or `set_length` that would exceed it fails
+ * `ResourceExhausted` without allocating.
  */
 export interface MemorySinkLike {
   /**
@@ -3431,13 +3329,8 @@ export interface MemorySinkLike {
  */
 export type MemorySinkInterface = MemorySinkLike;
 /**
- * An in-memory [`RangeSink`], for a caller that wants `embed`'s composed result back
- * without writing a custom sink. A **native** implementation of a `with_foreign`
- * interface (`#[uniffi::export]` on the trait impl, not the foreign callback path), so
- * a Python caller writes no subclass: `sink = MemorySink(data)`, pass it to `embed`,
- * then read `sink.bytes()` back. `&self`-only methods need interior mutability, so the
- * buffer is `Mutex`-guarded (contention is a non-issue: the SDK calls it from one task
- * at a time per sink).
+ * An in-memory [`RangeSink`] for a caller that wants `embed`'s composed result back:
+ * `sink = MemorySink(data)`, pass it to `embed`, then read `sink.bytes()`.
  *
  * # Size ceiling
  *
@@ -3449,9 +3342,14 @@ export type MemorySinkInterface = MemorySinkLike;
  * [`RangeSink`] over a file (or any store that seeks) for anything approaching that: the SDK
  * writes ranges straight through it and never holds the asset.
  *
- * Construction and `bytes()` each copy the whole asset, on the calling thread: together with a
- * `MemorySource` over the same asset that is about 12ms for 10 MB and 1.2s for 500 MB. A ranged
- * sink pays none of it.
+ * Construction and `bytes()` each move the whole asset across the boundary once, on the calling
+ * thread. A ranged sink pays neither.
+ *
+ * # Capacity
+ *
+ * The buffer never grows past its capacity: [`MemorySink::new`] allows 2 GiB, and
+ * [`MemorySink::with_capacity`] names another. A write or `set_length` that would exceed it fails
+ * `ResourceExhausted` without allocating.
  */
 export declare class MemorySink extends UniffiAbstractObject implements MemorySinkLike {
   readonly [uniffiTypeNameSymbol] = "MemorySink";
@@ -3463,6 +3361,15 @@ export declare class MemorySink extends UniffiAbstractObject implements MemorySi
    * The buffer is at or above the 2 GiB a byte array can be counted in.
    */
   constructor(data: ArrayBuffer);
+  /**
+   * A sink that refuses to grow past `capacity` bytes.
+   *
+   * # Errors
+   *
+   * The buffer is already larger than `capacity`, or at or above the 2 GiB a byte array can
+   * be counted in.
+   */
+  static withCapacity(data: ArrayBuffer, capacity: bigint): MemorySinkLike;
   /**
    * The buffer's current contents, e.g. after passing this sink through `embed`. A copy.
    *
@@ -3488,11 +3395,8 @@ export declare class MemorySink extends UniffiAbstractObject implements MemorySi
   static instanceOf(obj_: any): obj_ is MemorySink;
 }
 /**
- * An in-memory [`RangeSource`], for a caller that already holds the whole asset as
- * bytes and doesn't want to write a custom source. A **native** implementation of a
- * `with_foreign` interface (`#[uniffi::export]` on the trait impl, not the foreign
- * callback path), so the generated binding is a plain constructible object and a Python
- * caller writes no subclass at all: `MemorySource(data)`.
+ * An in-memory [`RangeSource`] for a caller that already holds the whole asset as bytes:
+ * `MemorySource(data)`, no subclass.
  *
  * # Size ceiling
  *
@@ -3502,9 +3406,10 @@ export declare class MemorySink extends UniffiAbstractObject implements MemorySi
  * [`RangeSource`] over a file handle for anything approaching that: the SDK only ever asks for
  * bounded ranges, so nothing else has to hold the asset.
  *
- * Construction copies the whole asset across the boundary, on the calling thread: about 5ms for
- * 10 MB, 315ms for 500 MB. That is the one part of a sign or verify the SDK cannot move off your
- * thread, and neither a ranged source nor [`FileSource`] pays it.
+ * Construction moves the whole asset across the boundary once, on the calling thread; the SDK
+ * then holds what arrived and answers every read as a window into it. That crossing is the one
+ * part of a sign or verify the SDK cannot move off your thread, and neither a ranged source nor
+ * [`FileSource`] pays it.
  */
 export interface MemorySourceLike {
   length(asyncOpts_?: {
@@ -3519,11 +3424,8 @@ export interface MemorySourceLike {
  */
 export type MemorySourceInterface = MemorySourceLike;
 /**
- * An in-memory [`RangeSource`], for a caller that already holds the whole asset as
- * bytes and doesn't want to write a custom source. A **native** implementation of a
- * `with_foreign` interface (`#[uniffi::export]` on the trait impl, not the foreign
- * callback path), so the generated binding is a plain constructible object and a Python
- * caller writes no subclass at all: `MemorySource(data)`.
+ * An in-memory [`RangeSource`] for a caller that already holds the whole asset as bytes:
+ * `MemorySource(data)`, no subclass.
  *
  * # Size ceiling
  *
@@ -3533,9 +3435,10 @@ export type MemorySourceInterface = MemorySourceLike;
  * [`RangeSource`] over a file handle for anything approaching that: the SDK only ever asks for
  * bounded ranges, so nothing else has to hold the asset.
  *
- * Construction copies the whole asset across the boundary, on the calling thread: about 5ms for
- * 10 MB, 315ms for 500 MB. That is the one part of a sign or verify the SDK cannot move off your
- * thread, and neither a ranged source nor [`FileSource`] pays it.
+ * Construction moves the whole asset across the boundary once, on the calling thread; the SDK
+ * then holds what arrived and answers every read as a window into it. That crossing is the one
+ * part of a sign or verify the SDK cannot move off your thread, and neither a ranged source nor
+ * [`FileSource`] pays it.
  */
 export declare class MemorySource extends UniffiAbstractObject implements MemorySourceLike {
   readonly [uniffiTypeNameSymbol] = "MemorySource";
@@ -3583,36 +3486,36 @@ export declare class SignerClient extends UniffiAbstractObject implements Signer
    * `options` is malformed. The channel connects lazily, so an unreachable Signer
    * surfaces on the first sign RPC instead.
    */
-  static connect(endpoint: string, options: ConnectOptions, asyncOpts_?: {
+  static connect(endpoint: string, options?: ConnectOptions, asyncOpts_?: {
     signal: AbortSignal;
   }): Promise<SignerClientLike>;
   uniffiDestroy(): void;
   static instanceOf(obj_: any): obj_ is SignerClient;
 }
 /**
- * A live-stream signer bound to a [`SignerClient`](super::client::SignerClient) and a
+ * A stream signer bound to a [`SignerClient`](super::client::SignerClient) and a
  * [`SigningVault`]. Construct once with [`create`](Self::create), then `init` a session and
  * sign every segment through the [`StreamSession`] it returns.
  */
 export interface StreamIssuerLike {
   /**
-   * Open the stream at `stream_id`: mint its first session key under
-   * `options.rotation_policy`, sign the init (moov) segment under `options.delivery`, and
-   * hand back a [`StreamSession`] to sign through.
+   * Open the stream `id`: mint its first session key under `options.rotation_policy`, sign the
+   * init (moov) segment `source` under `options.delivery`, and hand back a [`StreamSession`]
+   * to sign through.
    *
    * On `rotation_due`, call [`StreamIssuer::rotate`], not this.
    *
    * # Errors
    *
-   * Fails on signer RPC failure, a vault error, or an `init_body` that isn't a BMFF init
-   * segment.
+   * Fails on signer RPC failure, a vault error, or a `source` that isn't a BMFF init segment.
    */
-  init(streamId: string, initBody: RangeSource, manifest: StreamManifestSpec, options: InitOptions, asyncOpts_?: {
+  init(id: string, source: RangeSource, manifest: StreamManifestSpec, options: InitOptions, asyncOpts_?: {
     signal: AbortSignal;
   }): Promise<StreamStart>;
   /**
    * Succeed `session` on the stream it already names, signing a fresh init (moov) segment
-   * under a new key and forgetting the outgoing one.
+   * under a new key and forgetting the outgoing one. Once this succeeds, `session` refuses to
+   * sign; until then it keeps signing, so a failed rotation can be retried.
    *
    * The stream id comes from `session`, so a rotation cannot be pointed at the wrong stream,
    * and the retired key cannot be left behind: it would still sign for the rest of its
@@ -3620,9 +3523,10 @@ export interface StreamIssuerLike {
    *
    * # Errors
    *
-   * As [`StreamIssuer::init`].
+   * As [`StreamIssuer::init`], plus `FAILED_PRECONDITION` (`SESSION_ENDED`) for a session
+   * already stopped or rotated, or with a `stop` or `rotate` in flight.
    */
-  rotate(session: StreamSessionLike, initBody: RangeSource, manifest: StreamManifestSpec, options: InitOptions, asyncOpts_?: {
+  rotate(session: StreamSessionLike, source: RangeSource, manifest: StreamManifestSpec, options: InitOptions, asyncOpts_?: {
     signal: AbortSignal;
   }): Promise<StreamStart>;
 }
@@ -3631,7 +3535,7 @@ export interface StreamIssuerLike {
  */
 export type StreamIssuerInterface = StreamIssuerLike;
 /**
- * A live-stream signer bound to a [`SignerClient`](super::client::SignerClient) and a
+ * A stream signer bound to a [`SignerClient`](super::client::SignerClient) and a
  * [`SigningVault`]. Construct once with [`create`](Self::create), then `init` a session and
  * sign every segment through the [`StreamSession`] it returns.
  */
@@ -3645,23 +3549,23 @@ export declare class StreamIssuer extends UniffiAbstractObject implements Stream
    */
   static create(client: SignerClientLike, vault: SigningVault): StreamIssuerLike;
   /**
-   * Open the stream at `stream_id`: mint its first session key under
-   * `options.rotation_policy`, sign the init (moov) segment under `options.delivery`, and
-   * hand back a [`StreamSession`] to sign through.
+   * Open the stream `id`: mint its first session key under `options.rotation_policy`, sign the
+   * init (moov) segment `source` under `options.delivery`, and hand back a [`StreamSession`]
+   * to sign through.
    *
    * On `rotation_due`, call [`StreamIssuer::rotate`], not this.
    *
    * # Errors
    *
-   * Fails on signer RPC failure, a vault error, or an `init_body` that isn't a BMFF init
-   * segment.
+   * Fails on signer RPC failure, a vault error, or a `source` that isn't a BMFF init segment.
    */
-  init(streamId: string, initBody: RangeSource, manifest: StreamManifestSpec, options: InitOptions, asyncOpts_?: {
+  init(id: string, source: RangeSource, manifest: StreamManifestSpec, options: InitOptions, asyncOpts_?: {
     signal: AbortSignal;
   }): Promise<StreamStart>;
   /**
    * Succeed `session` on the stream it already names, signing a fresh init (moov) segment
-   * under a new key and forgetting the outgoing one.
+   * under a new key and forgetting the outgoing one. Once this succeeds, `session` refuses to
+   * sign; until then it keeps signing, so a failed rotation can be retried.
    *
    * The stream id comes from `session`, so a rotation cannot be pointed at the wrong stream,
    * and the retired key cannot be left behind: it would still sign for the rest of its
@@ -3669,24 +3573,26 @@ export declare class StreamIssuer extends UniffiAbstractObject implements Stream
    *
    * # Errors
    *
-   * As [`StreamIssuer::init`].
+   * As [`StreamIssuer::init`], plus `FAILED_PRECONDITION` (`SESSION_ENDED`) for a session
+   * already stopped or rotated, or with a `stop` or `rotate` in flight.
    */
-  rotate(session: StreamSessionLike, initBody: RangeSource, manifest: StreamManifestSpec, options: InitOptions, asyncOpts_?: {
+  rotate(session: StreamSessionLike, source: RangeSource, manifest: StreamManifestSpec, options: InitOptions, asyncOpts_?: {
     signal: AbortSignal;
   }): Promise<StreamStart>;
   uniffiDestroy(): void;
   static instanceOf(obj_: any): obj_ is StreamIssuer;
 }
 /**
- * A per-session ECDSA key store, implemented by the host. `mint` returns a fresh public key
- * that will be signed under for `validity_period_secs`, so give it that lifetime and let the
- * store expire it; `sign` produces the raw ECDSA signature over `payload` (the SDK frames it
- * into COSE); `forget` drops a retired key. Every method may raise to abort.
+ * A per-session ECDSA key store, implemented by the host. `mint` returns a fresh key that will be
+ * signed under for the request's `validity_period`, so give it that lifetime and let the store
+ * expire it; a new input to minting arrives as a field of `MintRequest`. `sign` produces the raw
+ * ECDSA signature over `payload` with the key `kid` names (the SDK frames it into COSE);
+ * `forget` drops a retired key. Every method may raise to abort.
  */
 export interface SigningVault {
-  mint(validityPeriodSecs: bigint, asyncOpts_?: {
+  mint(request: MintRequest, asyncOpts_?: {
     signal: AbortSignal;
-  }): Promise<VaultPublicKey>;
+  }): Promise<SessionKey>;
   sign(kid: ArrayBuffer, payload: ArrayBuffer, asyncOpts_?: {
     signal: AbortSignal;
   }): Promise<ArrayBuffer>;
@@ -3743,13 +3649,6 @@ declare const _default$1: Readonly<{
       lift(value: UniffiByteArray): AssetDelivery;
       lower(value: AssetDelivery, alloc: RustBufferAllocator): UniffiByteArray;
     };
-    FfiConverterTypeAssetFormat: {
-      readFromCursor(c: Cursor): AssetFormat;
-      writeIntoCursor(value: AssetFormat, c: Cursor): void;
-      allocationSize(value: AssetFormat): number;
-      lift(value: UniffiByteArray): AssetFormat;
-      lower(value: AssetFormat, alloc: RustBufferAllocator): UniffiByteArray;
-    };
     FfiConverterTypeAssetIssuer: FfiConverterObject<AssetIssuerLike>;
     FfiConverterTypeAssetManifestSpec: {
       readFromCursor(c: Cursor): AssetManifestSpec;
@@ -3766,7 +3665,20 @@ declare const _default$1: Readonly<{
       lift(value: UniffiByteArray): AssetOrigin;
       lower(value: AssetOrigin, alloc: RustBufferAllocator): UniffiByteArray;
     };
-    FfiConverterTypeBinder: FfiConverterObjectWithCallbacks<Binder>;
+    FfiConverterTypeBlock: {
+      readFromCursor(c: Cursor): Block;
+      writeIntoCursor(value: Block, c: Cursor): void;
+      allocationSize(value: Block): number;
+      lift(value: UniffiByteArray): Block;
+      lower(value: Block, alloc: RustBufferAllocator): UniffiByteArray;
+    };
+    FfiConverterTypeByteRange: {
+      readFromCursor(c: Cursor): ByteRange;
+      writeIntoCursor(value: ByteRange, c: Cursor): void;
+      allocationSize(value: ByteRange): number;
+      lift(value: UniffiByteArray): ByteRange;
+      lower(value: ByteRange, alloc: RustBufferAllocator): UniffiByteArray;
+    };
     FfiConverterTypeCode: {
       readFromCursor(c: Cursor): Code;
       writeIntoCursor(value: Code, c: Cursor): void;
@@ -3788,6 +3700,14 @@ declare const _default$1: Readonly<{
       lift(value: UniffiByteArray): ComponentEvent;
       lower(value: ComponentEvent, alloc: RustBufferAllocator): UniffiByteArray;
     };
+    FfiConverterTypeCompute: FfiConverterObjectWithCallbacks<Compute>;
+    FfiConverterTypeComputeRequest: {
+      readFromCursor(c: Cursor): ComputeRequest;
+      writeIntoCursor(value: ComputeRequest, c: Cursor): void;
+      allocationSize(value: ComputeRequest): number;
+      lift(value: UniffiByteArray): ComputeRequest;
+      lower(value: ComputeRequest, alloc: RustBufferAllocator): UniffiByteArray;
+    };
     FfiConverterTypeConnectOptions: {
       readFromCursor(c: Cursor): ConnectOptions;
       writeIntoCursor(value: ConnectOptions, c: Cursor): void;
@@ -3809,13 +3729,6 @@ declare const _default$1: Readonly<{
       lift(value: UniffiByteArray): CustomAction;
       lower(value: CustomAction, alloc: RustBufferAllocator): UniffiByteArray;
     };
-    FfiConverterTypeDeriveOptions: {
-      readFromCursor(c: Cursor): DeriveOptions;
-      writeIntoCursor(value: DeriveOptions, c: Cursor): void;
-      allocationSize(value: DeriveOptions): number;
-      lift(value: UniffiByteArray): DeriveOptions;
-      lower(value: DeriveOptions, alloc: RustBufferAllocator): UniffiByteArray;
-    };
     FfiConverterTypeEmbedOptions: {
       readFromCursor(c: Cursor): EmbedOptions;
       writeIntoCursor(value: EmbedOptions, c: Cursor): void;
@@ -3832,7 +3745,6 @@ declare const _default$1: Readonly<{
     };
     FfiConverterTypeFileSink: FfiConverterObject<FileSinkLike>;
     FfiConverterTypeFileSource: FfiConverterObject<FileSourceLike>;
-    FfiConverterTypeHeldBinder: FfiConverterObject<HeldBinderLike>;
     FfiConverterTypeIdentity: {
       readFromCursor(c: Cursor): Identity;
       writeIntoCursor(value: Identity, c: Cursor): void;
@@ -3847,12 +3759,12 @@ declare const _default$1: Readonly<{
       lift(value: UniffiByteArray): Ingredient;
       lower(value: Ingredient, alloc: RustBufferAllocator): UniffiByteArray;
     };
-    FfiConverterTypeIngredientSource: {
-      readFromCursor(c: Cursor): IngredientSource;
-      writeIntoCursor(value: IngredientSource, c: Cursor): void;
-      allocationSize(value: IngredientSource): number;
-      lift(value: UniffiByteArray): IngredientSource;
-      lower(value: IngredientSource, alloc: RustBufferAllocator): UniffiByteArray;
+    FfiConverterTypeIngredientKind: {
+      readFromCursor(c: Cursor): IngredientKind;
+      writeIntoCursor(value: IngredientKind, c: Cursor): void;
+      allocationSize(value: IngredientKind): number;
+      lift(value: UniffiByteArray): IngredientKind;
+      lower(value: IngredientKind, alloc: RustBufferAllocator): UniffiByteArray;
     };
     FfiConverterTypeInitOptions: {
       readFromCursor(c: Cursor): InitOptions;
@@ -3868,7 +3780,6 @@ declare const _default$1: Readonly<{
       lift(value: UniffiByteArray): InitOutcome;
       lower(value: InitOutcome, alloc: RustBufferAllocator): UniffiByteArray;
     };
-    FfiConverterTypeIsccBinder: FfiConverterObject<IsccBinderLike>;
     FfiConverterTypeJsonObject: FfiConverter<UniffiByteArray, string>;
     FfiConverterTypeJsonValue: FfiConverter<UniffiByteArray, string>;
     FfiConverterTypeMarkOptions: {
@@ -3887,6 +3798,13 @@ declare const _default$1: Readonly<{
     };
     FfiConverterTypeMemorySink: FfiConverterObject<MemorySinkLike>;
     FfiConverterTypeMemorySource: FfiConverterObject<MemorySourceLike>;
+    FfiConverterTypeMintRequest: {
+      readFromCursor(c: Cursor): MintRequest;
+      writeIntoCursor(value: MintRequest, c: Cursor): void;
+      allocationSize(value: MintRequest): number;
+      lift(value: UniffiByteArray): MintRequest;
+      lower(value: MintRequest, alloc: RustBufferAllocator): UniffiByteArray;
+    };
     FfiConverterTypeOpenedOrigin: {
       readFromCursor(c: Cursor): OpenedOrigin;
       writeIntoCursor(value: OpenedOrigin, c: Cursor): void;
@@ -3894,22 +3812,8 @@ declare const _default$1: Readonly<{
       lift(value: UniffiByteArray): OpenedOrigin;
       lower(value: OpenedOrigin, alloc: RustBufferAllocator): UniffiByteArray;
     };
-    FfiConverterTypeOrigin: {
-      readFromCursor(c: Cursor): Origin;
-      writeIntoCursor(value: Origin, c: Cursor): void;
-      allocationSize(value: Origin): number;
-      lift(value: UniffiByteArray): Origin;
-      lower(value: Origin, alloc: RustBufferAllocator): UniffiByteArray;
-    };
     FfiConverterTypeRangeSink: FfiConverterObjectWithCallbacks<RangeSink>;
     FfiConverterTypeRangeSource: FfiConverterObjectWithCallbacks<RangeSource>;
-    FfiConverterTypeRegion: {
-      readFromCursor(c: Cursor): Region;
-      writeIntoCursor(value: Region, c: Cursor): void;
-      allocationSize(value: Region): number;
-      lift(value: UniffiByteArray): Region;
-      lower(value: Region, alloc: RustBufferAllocator): UniffiByteArray;
-    };
     FfiConverterTypeRotationPolicy: {
       readFromCursor(c: Cursor): RotationPolicy;
       writeIntoCursor(value: RotationPolicy, c: Cursor): void;
@@ -3917,6 +3821,13 @@ declare const _default$1: Readonly<{
       lift(value: UniffiByteArray): RotationPolicy;
       lower(value: RotationPolicy, alloc: RustBufferAllocator): UniffiByteArray;
     };
+    FfiConverterTypeScope: {
+      readFromCursor(c: Cursor): Scope;
+      writeIntoCursor(value: Scope, c: Cursor): void;
+      allocationSize(value: Scope): number;
+      lift(value: UniffiByteArray): Scope;
+      lower(value: Scope, alloc: RustBufferAllocator): UniffiByteArray;
+    };
     FfiConverterTypeSdkError: {
       readFromCursor(c: Cursor): SdkError;
       writeIntoCursor(value: SdkError, c: Cursor): void;
@@ -3938,6 +3849,13 @@ declare const _default$1: Readonly<{
       lift(value: UniffiByteArray): SegmentOutcome;
       lower(value: SegmentOutcome, alloc: RustBufferAllocator): UniffiByteArray;
     };
+    FfiConverterTypeSessionKey: {
+      readFromCursor(c: Cursor): SessionKey;
+      writeIntoCursor(value: SessionKey, c: Cursor): void;
+      allocationSize(value: SessionKey): number;
+      lift(value: UniffiByteArray): SessionKey;
+      lower(value: SessionKey, alloc: RustBufferAllocator): UniffiByteArray;
+    };
     FfiConverterTypeSignOptions: {
       readFromCursor(c: Cursor): SignOptions;
       writeIntoCursor(value: SignOptions, c: Cursor): void;
@@ -3967,6 +3885,20 @@ declare const _default$1: Readonly<{
       lift(value: UniffiByteArray): SoftBinding;
       lower(value: SoftBinding, alloc: RustBufferAllocator): UniffiByteArray;
     };
+    FfiConverterTypeSoftBindingSource: {
+      readFromCursor(c: Cursor): SoftBindingSource;
+      writeIntoCursor(value: SoftBindingSource, c: Cursor): void;
+      allocationSize(value: SoftBindingSource): number;
+      lift(value: UniffiByteArray): SoftBindingSource;
+      lower(value: SoftBindingSource, alloc: RustBufferAllocator): UniffiByteArray;
+    };
+    FfiConverterTypeSoftwareAgent: {
+      readFromCursor(c: Cursor): SoftwareAgent;
+      writeIntoCursor(value: SoftwareAgent, c: Cursor): void;
+      allocationSize(value: SoftwareAgent): number;
+      lift(value: UniffiByteArray): SoftwareAgent;
+      lower(value: SoftwareAgent, alloc: RustBufferAllocator): UniffiByteArray;
+    };
     FfiConverterTypeStandardAction: {
       readFromCursor(c: Cursor): StandardAction;
       writeIntoCursor(value: StandardAction, c: Cursor): void;
@@ -3989,6 +3921,13 @@ declare const _default$1: Readonly<{
       lift(value: UniffiByteArray): StreamManifestSpec;
       lower(value: StreamManifestSpec, alloc: RustBufferAllocator): UniffiByteArray;
     };
+    FfiConverterTypeStreamOrigin: {
+      readFromCursor(c: Cursor): StreamOrigin;
+      writeIntoCursor(value: StreamOrigin, c: Cursor): void;
+      allocationSize(value: StreamOrigin): number;
+      lift(value: UniffiByteArray): StreamOrigin;
+      lower(value: StreamOrigin, alloc: RustBufferAllocator): UniffiByteArray;
+    };
     FfiConverterTypeStreamSession: FfiConverterObject<StreamSessionLike>;
     FfiConverterTypeStreamStart: {
       readFromCursor(c: Cursor): StreamStart;
@@ -4004,15 +3943,14 @@ declare const _default$1: Readonly<{
       lift(value: UniffiByteArray): Thumbnail;
       lower(value: Thumbnail, alloc: RustBufferAllocator): UniffiByteArray;
     };
-    FfiConverterTypeTimestamp: FfiConverter<UniffiByteArray, string>;
-    FfiConverterTypeUrl: FfiConverter<UniffiByteArray, string>;
-    FfiConverterTypeVaultPublicKey: {
-      readFromCursor(c: Cursor): VaultPublicKey;
-      writeIntoCursor(value: VaultPublicKey, c: Cursor): void;
-      allocationSize(value: VaultPublicKey): number;
-      lift(value: UniffiByteArray): VaultPublicKey;
-      lower(value: VaultPublicKey, alloc: RustBufferAllocator): UniffiByteArray;
+    FfiConverterTypeTimespan: {
+      readFromCursor(c: Cursor): Timespan;
+      writeIntoCursor(value: Timespan, c: Cursor): void;
+      allocationSize(value: Timespan): number;
+      lift(value: UniffiByteArray): Timespan;
+      lower(value: Timespan, alloc: RustBufferAllocator): UniffiByteArray;
     };
+    FfiConverterTypeUrl: FfiConverter<UniffiByteArray, string>;
   };
 }>;
 //#endregion