@trylimbo/sdk-issuer 0.2.25-canary.37 → 0.2.25

package/gen/ffi/index.d.ts

@@ -181,12 +181,13 @@ declare const pointerLiteralSymbol: unique symbol;
  */
 declare const uniffiTypeNameSymbol: unique symbol;
 declare namespace trylimbo_issuer_d_exports {
-  export { Action, ActionDetail, ActionKind, ActionKind_Tags, Action_Tags, Assertion, AssetDelivery, AssetDelivery_Tags, AssetIssuer, AssetIssuerInterface, AssetIssuerLike, AssetManifestSpec, AssetMarker, AssetMarkerInterface, AssetMarkerLike, AssetOrigin, AssetOrigin_Tags, Block, ByteRange, Code, Component, ComponentEvent, ComponentEvent_Tags, Compute, ComputeImpl, ComputeRequest, ConnectOptions, CreatedOrigin, CustomAction, EmbedOptions, FieldViolation, FileSink, FileSinkInterface, FileSinkLike, FileSource, FileSourceInterface, FileSourceLike, Identity, Ingredient, IngredientKind, IngredientKind_Tags, InitOptions, InitOutcome, JsonObject, JsonValue, MarkOptions, MarkOutcome, MemorySink, MemorySinkInterface, MemorySinkLike, MemorySource, MemorySourceInterface, MemorySourceLike, MintRequest, OpenedOrigin, PluginAuthor, RangeSink, RangeSinkImpl, RangeSource, RangeSourceImpl, RotationPolicy, Scope, SdkError, SdkError_Tags, SegmentKind, SegmentOutcome, SessionKey, SignOptions, SignOutcome, SignOutput, SignOutput_Tags, SignerClient, SignerClientInterface, SignerClientLike, SigningVault, SoftBinding, SoftBindingSource, SoftBindingSource_Tags, SoftwareAgent, StandardAction, StreamDelivery, StreamIssuer, StreamIssuerInterface, StreamIssuerLike, StreamManifestSpec, StreamOrigin, StreamOrigin_Tags, StreamSession, StreamSessionInterface, StreamSessionLike, StreamStart, Thumbnail, Timespan, Url, classifySegment, computeSoftBinding, _default$1 as default, embed };
+  export { Action, ActionDetail, ActionKind, ActionKind_Tags, Action_Tags, Assertion, AssetDelivery, AssetDelivery_Tags, AssetFormat, AssetFormat_Tags, AssetIssuer, AssetIssuerInterface, AssetIssuerLike, AssetManifestSpec, AssetMarker, AssetMarkerInterface, AssetMarkerLike, AssetOrigin, AssetOrigin_Tags, Binder, BinderImpl, Code, Component, ComponentEvent, ComponentEvent_Tags, ConnectOptions, CreatedOrigin, CustomAction, DeriveOptions, EmbedOptions, FieldViolation, FileSink, FileSinkInterface, FileSinkLike, FileSource, FileSourceInterface, FileSourceLike, HeldBinder, HeldBinderInterface, HeldBinderLike, Identity, Ingredient, IngredientSource, IngredientSource_Tags, InitOptions, InitOutcome, IsccBinder, IsccBinderInterface, IsccBinderLike, JsonObject, JsonValue, MarkOptions, MarkOutcome, MemorySink, MemorySinkInterface, MemorySinkLike, MemorySource, MemorySourceInterface, MemorySourceLike, OpenedOrigin, Origin, Origin_Tags, PluginAuthor, RangeSink, RangeSinkImpl, RangeSource, RangeSourceImpl, Region, RotationPolicy, SdkError, SdkError_Tags, SegmentKind, SegmentOutcome, SignOptions, SignOutcome, SignOutput, SignOutput_Tags, SignerClient, SignerClientInterface, SignerClientLike, SigningVault, SoftBinding, StandardAction, StreamDelivery, StreamDelivery_Tags, StreamIssuer, StreamIssuerInterface, StreamIssuerLike, StreamManifestSpec, StreamSession, StreamSessionInterface, StreamSessionLike, StreamStart, Thumbnail, Timestamp, Url, VaultPublicKey, classifySegment, _default$1 as default, embed };
 }
 /**
- * Classify a fragmented-MP4 segment as init, media or unknown (`moov` vs `moof`), so a streaming
- * consumer routes each segment to `StreamIssuer.init` or `StreamSession.sign` without parsing
- * ISOBMFF itself.
+ * Classify a fragmented-MP4 segment from a [`RangeSource`] as init/media/unknown: the
+ * SDK-owned box parse (`moov` vs `moof`) a streaming consumer uses to route each segment
+ * to [`StreamIssuer::init`](stream::StreamIssuer::init) vs
+ * [`StreamSession::sign`](stream::StreamSession::sign) without hand-parsing ISOBMFF itself.
  *
  * Async because it reads, and reading is the caller's storage: the two windows below may each
  * be a round trip. It stays off the island, uniquely among the read-path entry points, because
@@ -201,22 +202,22 @@ export declare function classifySegment(source: RangeSource, asyncOpts_?: {
   signal: AbortSignal;
 }): Promise<SegmentKind>;
 /**
- * The values this SDK computes for `alg` over an asset, `[]` when it finds none. `format` is
- * the asset's media type; omitted, the bytes name it.
+ * Embed a signed manifest into an asset, writing the composed result back through
+ * `sink`. `plugins` are the caller's plugins for non-c2pa formats (e.g. MXF), in dispatch
+ * order, resolved the same way [`AssetIssuer::sign`](asset::AssetIssuer::sign) resolves
+ * them, per [the `plugins` contract](crate::asset#the-plugins-contract): the write lands on a
+ * bounded region for a plugin match, on the whole (small) asset otherwise; an empty list is
+ * a c2pa-native embed. `format` overrides the sniffed format. Pure local byte-wrangling: no
+ * signer round-trip.
  *
- * # Errors
+ * # Why the body is offloaded rather than run inline
  *
- * An algorithm this SDK computes no value of, a `format` that is no media type or that the bytes
- * contradict, an unreadable source, or no trustworthy answer.
- */
-export declare function computeSoftBinding(alg: string, source: RangeSource, format?: string | undefined, asyncOpts_?: {
-  signal: AbortSignal;
-}): Promise<Array<Block>>;
-/**
- * Embed `sidecar`, the signed manifest a sign returned, into the asset `sink` holds, writing the
- * composed result back through `sink`.
- * `plugins` resolve a non-c2pa format (e.g. MXF) as `AssetIssuer.sign` resolves them; none is a
- * c2pa-native embed. No signer round trip.
+ * UniFFI polls a future on the thread that called it and never spawns, so an `async fn` whose
+ * body never suspends completes in its first poll, on the caller's thread, blocking it exactly
+ * as a sync export would: measured at 88ms for a 10MB asset on Node, during which nothing else
+ * in the process runs. It is also the read path's hard requirement, not just a courtesy: the
+ * splice reads through `sink`, and the caller's thread is the one that has to answer those
+ * reads. See [`task`](shared::task).
  *
  * # Errors
  *
@@ -224,37 +225,31 @@ export declare function computeSoftBinding(alg: string, source: RangeSource, for
  * authoring/`locate` disagrees after the write, or the c2pa handler can't
  * parse/splice the asset.
  */
-export declare function embed(sink: RangeSink, sidecar: ArrayBuffer, options: EmbedOptions, plugins?: Array<PluginAuthor>, asyncOpts_?: {
+export declare function embed(sink: RangeSink, manifest: ArrayBuffer, options: EmbedOptions, plugins: Array<PluginAuthor>, asyncOpts_?: {
   signal: AbortSignal;
 }): Promise<void>;
 /**
- * The tool that performed an action (a C2PA `generator-info-map`).
- */
-export type SoftwareAgent = {
-  name: string;
-};
-/**
- * Generated factory for {@link SoftwareAgent} record objects.
+ * Typealias from the type name used in the UDL file to the builtin type.  This
+ * is needed because the UDL type name is used in function/method signatures.
  */
-export declare const SoftwareAgent: Readonly<{
-  create: (partial: Partial<SoftwareAgent> & Required<Omit<SoftwareAgent, never>>) => SoftwareAgent;
-  new: (partial: Partial<SoftwareAgent> & Required<Omit<SoftwareAgent, never>>) => SoftwareAgent;
-  defaults: () => Partial<SoftwareAgent>;
-}>;
+export type Timestamp = string;
 /**
  * Typealias from the type name used in the UDL file to the builtin type.  This
  * is needed because the UDL type name is used in function/method signatures.
  */
 export type Url = string;
 /**
- * Facts recorded on an action.
+ * Optional facts folded into a derived or workflow action.
  */
 export type ActionDetail = {
-  when?: Date;
-  softwareAgent?: SoftwareAgent;
+  /**
+   * When the action happened.
+   */
+  when?: Timestamp;
+  softwareAgent?: string;
   description?: string;
   /**
-   * The URI of an IPTC or C2PA term, e.g.
+   * The URI its term is published at, e.g.
    * `http://cv.iptc.org/newscodes/digitalsourcetype/digitalCapture`.
    */
   sourceType?: Url;
@@ -292,28 +287,30 @@ export declare const Assertion: Readonly<{
   defaults: () => Partial<Assertion>;
 }>;
 /**
- * The asset is an original; the signer derives `c2pa.created` from these facts.
+ * The asset is an original; the signer derives `c2pa.created`.
  */
 export type CreatedOrigin = {
   /**
-   * The URI of an IPTC or C2PA term, e.g.
+   * The URI its term is published at, e.g.
    * `http://cv.iptc.org/newscodes/digitalsourcetype/digitalCapture`.
    */
   sourceType: Url;
-  when?: Date;
-  softwareAgent?: SoftwareAgent;
-  description?: string;
+  detail?: ActionDetail;
 };
 /**
  * Generated factory for {@link CreatedOrigin} record objects.
  */
 export declare const CreatedOrigin: Readonly<{
-  create: (partial: Partial<CreatedOrigin> & Required<Omit<CreatedOrigin, "description" | "softwareAgent" | "when">>) => CreatedOrigin;
-  new: (partial: Partial<CreatedOrigin> & Required<Omit<CreatedOrigin, "description" | "softwareAgent" | "when">>) => CreatedOrigin;
+  create: (partial: Partial<CreatedOrigin> & Required<Omit<CreatedOrigin, "detail">>) => CreatedOrigin;
+  new: (partial: Partial<CreatedOrigin> & Required<Omit<CreatedOrigin, "detail">>) => CreatedOrigin;
   defaults: () => Partial<CreatedOrigin>;
 }>;
 /**
  * A canonical gRPC/Connect status code: the coarse, closed failure class.
+ *
+ * The wasm lane projects this as a camelCase string like every other tagged value
+ * there, so a consumer narrows on `err.code === "resourceExhausted"`; the native lane
+ * projects an enum.
  */
 export declare enum Code {
   Canceled = 0,
@@ -338,9 +335,7 @@ export declare enum Code {
  */
 export type FieldViolation = {
   /**
-   * The offending field: rooted at the call's argument when an SDK refuses it
-   * (`options.soft_bindings[1].alg`), at the request when a service does
-   * (`provenance.actions[0].label`).
+   * A dotted proto path to the offending field (`""` for a message-level rule).
    */
   field: string;
   /**
@@ -348,7 +343,7 @@ export type FieldViolation = {
    */
   description: string;
   /**
-   * The rule that failed, such as `string.min_len` or `alg.unlisted`: the stable branch key.
+   * The constraint id that failed (a protovalidate/CEL rule id), stable across releases.
    */
   reason: string;
 };
@@ -759,56 +754,122 @@ export declare class RangeSourceImpl extends UniffiAbstractObject implements Ran
   uniffiDestroy(): void;
   static instanceOf(obj_: any): obj_ is RangeSourceImpl;
 }
-export declare enum IngredientKind_Tags {
-  Asset = "Asset",
-  Descriptor = "Descriptor"
+export declare enum AssetFormat_Tags {
+  Sniff = "Sniff",
+  Declared = "Declared"
 }
 /**
- * What an ingredient is: an asset whose manifest is read, or a description.
+ * The format of the asset a call is handed. Stated, never defaulted: sniffing is a choice the
+ * caller makes by name, not what happens when they say nothing.
+ */
+export declare const AssetFormat: Readonly<{
+  instanceOf: (obj: any) => obj is AssetFormat;
+  Sniff: {
+    new (): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "AssetFormat";
+      readonly tag: AssetFormat_Tags.Sniff;
+    };
+    "new"(): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "AssetFormat";
+      readonly tag: AssetFormat_Tags.Sniff;
+    };
+    instanceOf(obj: any): obj is {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "AssetFormat";
+      readonly tag: AssetFormat_Tags.Sniff;
+    };
+  };
+  Declared: {
+    new (inner: {
+      mediaType: string;
+    }): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "AssetFormat";
+      readonly tag: AssetFormat_Tags.Declared;
+      readonly inner: Readonly<{
+        mediaType: string;
+      }>;
+    };
+    "new"(inner: {
+      mediaType: string;
+    }): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "AssetFormat";
+      readonly tag: AssetFormat_Tags.Declared;
+      readonly inner: Readonly<{
+        mediaType: string;
+      }>;
+    };
+    instanceOf(obj: any): obj is {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "AssetFormat";
+      readonly tag: AssetFormat_Tags.Declared;
+      readonly inner: Readonly<{
+        mediaType: string;
+      }>;
+    };
+  };
+}>;
+/**
+ * The format of the asset a call is handed. Stated, never defaulted: sniffing is a choice the
+ * caller makes by name, not what happens when they say nothing.
  */
-export declare const IngredientKind: Readonly<{
-  instanceOf: (obj: any) => obj is IngredientKind;
+export type AssetFormat = InstanceType<typeof AssetFormat['Sniff' | 'Declared']>;
+export declare enum IngredientSource_Tags {
+  Asset = "Asset",
+  Descriptor = "Descriptor"
+}
+export declare const IngredientSource: Readonly<{
+  instanceOf: (obj: any) => obj is IngredientSource;
   Asset: {
     new (inner: {
       source: RangeSource;
-      format?: string;
-      discoveredBy: Array<string>;
+      format: AssetFormat;
     }): {
       /**
        * @private
        * This field is private and should not be used, use `tag` instead.
        */
-      readonly [uniffiTypeNameSymbol]: "IngredientKind";
-      readonly tag: IngredientKind_Tags.Asset;
+      readonly [uniffiTypeNameSymbol]: "IngredientSource";
+      readonly tag: IngredientSource_Tags.Asset;
       readonly inner: Readonly<{
         source: RangeSource;
-        format?: string;
-        discoveredBy: Array<string>;
+        format: AssetFormat;
       }>;
     };
-    new: (partial: Parameters<(partial: Partial<{
-      source: RangeSource;
-      format?: string;
-      discoveredBy: Array<string>;
-    }> & Required<Omit<{
-      source: RangeSource;
-      format?: string;
-      discoveredBy: Array<string>;
-    }, "discoveredBy" | "format">>) => {
+    "new"(inner: {
       source: RangeSource;
-      format?: string;
-      discoveredBy: Array<string>;
-    }>[0]) => {
+      format: AssetFormat;
+    }): {
       /**
        * @private
        * This field is private and should not be used, use `tag` instead.
        */
-      readonly [uniffiTypeNameSymbol]: "IngredientKind";
-      readonly tag: IngredientKind_Tags.Asset;
+      readonly [uniffiTypeNameSymbol]: "IngredientSource";
+      readonly tag: IngredientSource_Tags.Asset;
       readonly inner: Readonly<{
         source: RangeSource;
-        format?: string;
-        discoveredBy: Array<string>;
+        format: AssetFormat;
       }>;
     };
     instanceOf(obj: any): obj is {
@@ -816,40 +877,43 @@ export declare const IngredientKind: Readonly<{
        * @private
        * This field is private and should not be used, use `tag` instead.
        */
-      readonly [uniffiTypeNameSymbol]: "IngredientKind";
-      readonly tag: IngredientKind_Tags.Asset;
+      readonly [uniffiTypeNameSymbol]: "IngredientSource";
+      readonly tag: IngredientSource_Tags.Asset;
       readonly inner: Readonly<{
         source: RangeSource;
-        format?: string;
-        discoveredBy: Array<string>;
+        format: AssetFormat;
       }>;
     };
   };
   Descriptor: {
     new (inner: {
-      format: string;
+      format?: string;
     }): {
       /**
        * @private
        * This field is private and should not be used, use `tag` instead.
        */
-      readonly [uniffiTypeNameSymbol]: "IngredientKind";
-      readonly tag: IngredientKind_Tags.Descriptor;
+      readonly [uniffiTypeNameSymbol]: "IngredientSource";
+      readonly tag: IngredientSource_Tags.Descriptor;
       readonly inner: Readonly<{
-        format: string;
+        format?: string;
       }>;
     };
-    "new"(inner: {
-      format: string;
-    }): {
+    new: (partial: Parameters<(partial: Partial<{
+      format?: string;
+    }> & Required<Omit<{
+      format?: string;
+    }, "format">>) => {
+      format?: string;
+    }>[0]) => {
       /**
        * @private
        * This field is private and should not be used, use `tag` instead.
        */
-      readonly [uniffiTypeNameSymbol]: "IngredientKind";
-      readonly tag: IngredientKind_Tags.Descriptor;
+      readonly [uniffiTypeNameSymbol]: "IngredientSource";
+      readonly tag: IngredientSource_Tags.Descriptor;
       readonly inner: Readonly<{
-        format: string;
+        format?: string;
       }>;
     };
     instanceOf(obj: any): obj is {
@@ -857,18 +921,15 @@ export declare const IngredientKind: Readonly<{
        * @private
        * This field is private and should not be used, use `tag` instead.
        */
-      readonly [uniffiTypeNameSymbol]: "IngredientKind";
-      readonly tag: IngredientKind_Tags.Descriptor;
+      readonly [uniffiTypeNameSymbol]: "IngredientSource";
+      readonly tag: IngredientSource_Tags.Descriptor;
       readonly inner: Readonly<{
-        format: string;
+        format?: string;
       }>;
     };
   };
 }>;
-/**
- * What an ingredient is: an asset whose manifest is read, or a description.
- */
-export type IngredientKind = InstanceType<typeof IngredientKind['Asset' | 'Descriptor']>;
+export type IngredientSource = InstanceType<typeof IngredientSource['Asset' | 'Descriptor']>;
 /**
  * A pre-rendered thumbnail, attached to the manifest as its `c2pa.thumbnail.claim` resource or
  * to an ingredient as its `c2pa.thumbnail.ingredient`. The split-signer has no asset bytes to
@@ -878,23 +939,24 @@ export type IngredientKind = InstanceType<typeof IngredientKind['Asset' | 'Descr
 export type Thumbnail = {
   data: ArrayBuffer;
   /**
-   * Its media type, judged against `data` as an asset's is; `None` reads it from `data`.
-   * `image/jpeg` and `image/png` are the ones consumer verifiers render.
+   * MIME type. `image/jpeg` and `image/png` are the interop-safe choices: consumer
+   * verifiers like Adobe inspect may not render other previews.
    */
-  format?: string;
+  format: string;
 };
 /**
  * Generated factory for {@link Thumbnail} record objects.
  */
 export declare const Thumbnail: Readonly<{
-  create: (partial: Partial<Thumbnail> & Required<Omit<Thumbnail, "format">>) => Thumbnail;
-  new: (partial: Partial<Thumbnail> & Required<Omit<Thumbnail, "format">>) => Thumbnail;
+  create: (partial: Partial<Thumbnail> & Required<Omit<Thumbnail, never>>) => Thumbnail;
+  new: (partial: Partial<Thumbnail> & Required<Omit<Thumbnail, never>>) => Thumbnail;
   defaults: () => Partial<Thumbnail>;
 }>;
 export type Ingredient = {
-  kind: IngredientKind;
+  source: IngredientSource;
   title?: string;
   thumbnail?: Thumbnail;
+  discoveredBy: Array<string>;
 };
 /**
  * Generated factory for {@link Ingredient} record objects.
@@ -1032,15 +1094,15 @@ export type AssetOrigin = InstanceType<typeof AssetOrigin['Created' | 'Opened' |
  */
 export type JsonObject = string;
 /**
- * An entity-namespaced action: a reverse-DNS `label` outside `c2pa.` and `cawg.`, which are
- * refused in any case. A C2PA action is a [`StandardAction`].
+ * An entity-namespaced action (reverse-DNS `label`; the signer rejects
+ * `c2pa.*`/`cawg.*`). `params` merges into the action's `parameters`.
  */
 export type CustomAction = {
   label: string;
-  parameters: JsonObject;
+  params: JsonObject;
   detail?: ActionDetail;
   /**
-   * The `components` keys this action acted on.
+   * `Component.id`s this action acted on.
    */
   componentIds: Array<string>;
 };
@@ -1048,62 +1110,13 @@ export type CustomAction = {
  * Generated factory for {@link CustomAction} record objects.
  */
 export declare const CustomAction: Readonly<{
-  create: (partial: Partial<CustomAction> & Required<Omit<CustomAction, "componentIds" | "detail">>) => CustomAction;
-  new: (partial: Partial<CustomAction> & Required<Omit<CustomAction, "componentIds" | "detail">>) => CustomAction;
+  create: (partial: Partial<CustomAction> & Required<Omit<CustomAction, "detail">>) => CustomAction;
+  new: (partial: Partial<CustomAction> & Required<Omit<CustomAction, "detail">>) => CustomAction;
   defaults: () => Partial<CustomAction>;
 }>;
-/**
- * A `soft-binding-timespan-map`: where the range starts in the media and how long it lasts, in
- * whole milliseconds.
- */
-export type Timespan = {
-  start: number;
-  duration: number;
-};
-/**
- * Generated factory for {@link Timespan} record objects.
- */
-export declare const Timespan: Readonly<{
-  create: (partial: Partial<Timespan> & Required<Omit<Timespan, never>>) => Timespan;
-  new: (partial: Partial<Timespan> & Required<Omit<Timespan, never>>) => Timespan;
-  defaults: () => Partial<Timespan>;
-}>;
-/**
- * A `soft-binding-scope-map`: where in the content a value applies. Empty is the whole content.
- */
-export type Scope = {
-  timespan?: Timespan;
-};
-/**
- * Generated factory for {@link Scope} record objects.
- */
-export declare const Scope: Readonly<{
-  create: (partial: Partial<Scope> & Required<Omit<Scope, "timespan">>) => Scope;
-  new: (partial: Partial<Scope> & Required<Omit<Scope, "timespan">>) => Scope;
-  defaults: () => Partial<Scope>;
-}>;
-/**
- * A `soft-binding-block-map`.
- */
-export type Block = {
-  value: ArrayBuffer;
-  scope: Scope;
-};
-/**
- * Generated factory for {@link Block} record objects.
- */
-export declare const Block: Readonly<{
-  create: (partial: Partial<Block> & Required<Omit<Block, "scope">>) => Block;
-  new: (partial: Partial<Block> & Required<Omit<Block, "scope">>) => Block;
-  defaults: () => Partial<Block>;
-}>;
-/**
- * One `c2pa.soft-binding` assertion (C2PA 2.4 18.10.3): a listed algorithm and its values, one
- * per block.
- */
 export type SoftBinding = {
   alg: string;
-  blocks: Array<Block>;
+  value: string;
 };
 /**
  * Generated factory for {@link SoftBinding} record objects.
@@ -1136,12 +1149,13 @@ export declare enum ActionKind_Tags {
   ResizedProportional = "ResizedProportional",
   Transcoded = "Transcoded",
   Trimmed = "Trimmed",
+  Unknown = "Unknown",
   WatermarkedBound = "WatermarkedBound",
   WatermarkedUnbound = "WatermarkedUnbound"
 }
 /**
- * The C2PA 2.4 workflow actions; see the core [`provenance::ActionKind`] for what each is.
- * Mirrored for the one variant that carries a binding, which crosses as the FFI record.
+ * The C2PA 2.3 workflow actions; see the core [`provenance::ActionKind`] for what each is.
+ * Mirrored for the one variant that carries a binding, which crosses as the two-string record.
  */
 export declare const ActionKind: Readonly<{
   instanceOf: (obj: any) => obj is ActionKind;
@@ -1717,6 +1731,32 @@ export declare const ActionKind: Readonly<{
       readonly tag: ActionKind_Tags.Trimmed;
     };
   };
+  Unknown: {
+    new (): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "ActionKind";
+      readonly tag: ActionKind_Tags.Unknown;
+    };
+    "new"(): {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "ActionKind";
+      readonly tag: ActionKind_Tags.Unknown;
+    };
+    instanceOf(obj: any): obj is {
+      /**
+       * @private
+       * This field is private and should not be used, use `tag` instead.
+       */
+      readonly [uniffiTypeNameSymbol]: "ActionKind";
+      readonly tag: ActionKind_Tags.Unknown;
+    };
+  };
   WatermarkedBound: {
     new (inner: {
       binding: SoftBinding;
@@ -1784,10 +1824,10 @@ export declare const ActionKind: Readonly<{
   };
 }>;
 /**
- * The C2PA 2.4 workflow actions; see the core [`provenance::ActionKind`] for what each is.
- * Mirrored for the one variant that carries a binding, which crosses as the FFI record.
+ * The C2PA 2.3 workflow actions; see the core [`provenance::ActionKind`] for what each is.
+ * Mirrored for the one variant that carries a binding, which crosses as the two-string record.
  */
-export type ActionKind = InstanceType<typeof ActionKind['AddedText' | 'AdjustedColor' | 'ChangedSpeed' | 'Converted' | 'Cropped' | 'Deleted' | 'Drawing' | 'Dubbed' | 'Edited' | 'EditedMetadata' | 'Enhanced' | 'Filtered' | 'Mastered' | 'Mixed' | 'Orientation' | 'Published' | 'Remixed' | 'Repackaged' | 'Resized' | 'ResizedProportional' | 'Transcoded' | 'Trimmed' | 'WatermarkedBound' | 'WatermarkedUnbound']>;
+export type ActionKind = InstanceType<typeof ActionKind['AddedText' | 'AdjustedColor' | 'ChangedSpeed' | 'Converted' | 'Cropped' | 'Deleted' | 'Drawing' | 'Dubbed' | 'Edited' | 'EditedMetadata' | 'Enhanced' | 'Filtered' | 'Mastered' | 'Mixed' | 'Orientation' | 'Published' | 'Remixed' | 'Repackaged' | 'Resized' | 'ResizedProportional' | 'Transcoded' | 'Trimmed' | 'Unknown' | 'WatermarkedBound' | 'WatermarkedUnbound']>;
 export type StandardAction = {
   kind: ActionKind;
   detail?: ActionDetail;
@@ -1797,8 +1837,8 @@ export type StandardAction = {
  * Generated factory for {@link StandardAction} record objects.
  */
 export declare const StandardAction: Readonly<{
-  create: (partial: Partial<StandardAction> & Required<Omit<StandardAction, "componentIds" | "detail">>) => StandardAction;
-  new: (partial: Partial<StandardAction> & Required<Omit<StandardAction, "componentIds" | "detail">>) => StandardAction;
+  create: (partial: Partial<StandardAction> & Required<Omit<StandardAction, "detail">>) => StandardAction;
+  new: (partial: Partial<StandardAction> & Required<Omit<StandardAction, "detail">>) => StandardAction;
   defaults: () => Partial<StandardAction>;
 }>;
 export declare enum Action_Tags {
@@ -1868,7 +1908,8 @@ export declare const Action: Readonly<{
 }>;
 export type Action = InstanceType<typeof Action['Custom' | 'Standard']>;
 /**
- * A CAWG identity assertion: each of `identities` is one CAWG `verifiedIdentities` entry.
+ * Pass `None` to skip the CAWG identity signing path entirely. Each entry of `identities` is
+ * one CAWG `VerifiedIdentity` object.
  */
 export type Identity = {
   roles: Array<string>;
@@ -1878,8 +1919,8 @@ export type Identity = {
  * Generated factory for {@link Identity} record objects.
  */
 export declare const Identity: Readonly<{
-  create: (partial: Partial<Identity> & Required<Omit<Identity, "roles">>) => Identity;
-  new: (partial: Partial<Identity> & Required<Omit<Identity, "roles">>) => Identity;
+  create: (partial: Partial<Identity> & Required<Omit<Identity, never>>) => Identity;
+  new: (partial: Partial<Identity> & Required<Omit<Identity, never>>) => Identity;
   defaults: () => Partial<Identity>;
 }>;
 export declare enum ComponentEvent_Tags {
@@ -1941,7 +1982,6 @@ export declare const ComponentEvent: Readonly<{
   };
   Removed: {
     new (inner: {
-      label: string;
       detail?: ActionDetail;
     }): {
       /**
@@ -1951,18 +1991,14 @@ export declare const ComponentEvent: Readonly<{
       readonly [uniffiTypeNameSymbol]: "ComponentEvent";
       readonly tag: ComponentEvent_Tags.Removed;
       readonly inner: Readonly<{
-        label: string;
         detail?: ActionDetail;
       }>;
     };
     new: (partial: Parameters<(partial: Partial<{
-      label: string;
       detail?: ActionDetail;
     }> & Required<Omit<{
-      label: string;
       detail?: ActionDetail;
     }, "detail">>) => {
-      label: string;
       detail?: ActionDetail;
     }>[0]) => {
       /**
@@ -1972,7 +2008,6 @@ export declare const ComponentEvent: Readonly<{
       readonly [uniffiTypeNameSymbol]: "ComponentEvent";
       readonly tag: ComponentEvent_Tags.Removed;
       readonly inner: Readonly<{
-        label: string;
         detail?: ActionDetail;
       }>;
     };
@@ -1984,7 +2019,6 @@ export declare const ComponentEvent: Readonly<{
       readonly [uniffiTypeNameSymbol]: "ComponentEvent";
       readonly tag: ComponentEvent_Tags.Removed;
       readonly inner: Readonly<{
-        label: string;
         detail?: ActionDetail;
       }>;
     };
@@ -2024,10 +2058,8 @@ export declare const ComponentEvent: Readonly<{
  * to be folded into and the variant has none.
  */
 export type ComponentEvent = InstanceType<typeof ComponentEvent['Placed' | 'Removed' | 'InputTo']>;
-/**
- * An ingredient other than the parent; see the core [`provenance::Component`].
- */
 export type Component = {
+  id: string;
   asset: Ingredient;
   event: ComponentEvent;
 };
@@ -2042,201 +2074,160 @@ export declare const Component: Readonly<{
 export type AssetManifestSpec = {
   title?: string;
   origin: AssetOrigin;
-  /**
-   * Every action performed on the asset; the manifest states the list is complete (C2PA
-   * `allActionsIncluded`).
-   */
   actions: Array<Action>;
   identity?: Identity;
   assertions: Array<Assertion>;
-  /**
-   * Keyed by the handle actions name them by.
-   */
-  components: Map<string, Component>;
+  components: Array<Component>;
 };
 /**
  * Generated factory for {@link AssetManifestSpec} record objects.
  */
 export declare const AssetManifestSpec: Readonly<{
-  create: (partial: Partial<AssetManifestSpec> & Required<Omit<AssetManifestSpec, "actions" | "assertions" | "components" | "identity" | "title">>) => AssetManifestSpec;
-  new: (partial: Partial<AssetManifestSpec> & Required<Omit<AssetManifestSpec, "actions" | "assertions" | "components" | "identity" | "title">>) => AssetManifestSpec;
+  create: (partial: Partial<AssetManifestSpec> & Required<Omit<AssetManifestSpec, "identity" | "title">>) => AssetManifestSpec;
+  new: (partial: Partial<AssetManifestSpec> & Required<Omit<AssetManifestSpec, "identity" | "title">>) => AssetManifestSpec;
   defaults: () => Partial<AssetManifestSpec>;
 }>;
 /**
- * A byte range holding a bare C2PA manifest store, or reserved for one. A record of
- * primitives, so a plugin in its OWN UniFFI namespace declares a structurally identical
- * one and the two cross the boundary without sharing a Rust type.
- */
-export type ByteRange = {
-  offset: bigint;
-  length: bigint;
-};
-/**
- * Generated factory for {@link ByteRange} record objects.
- */
-export declare const ByteRange: Readonly<{
-  create: (partial: Partial<ByteRange> & Required<Omit<ByteRange, never>>) => ByteRange;
-  new: (partial: Partial<ByteRange> & Required<Omit<ByteRange, never>>) => ByteRange;
-  defaults: () => Partial<ByteRange>;
-}>;
-/**
- * What one [`Compute::compute`] is asked: the asset and its media type.
- */
-export type ComputeRequest = {
-  source: RangeSource;
-  format: string;
-};
-/**
- * Generated factory for {@link ComputeRequest} record objects.
- */
-export declare const ComputeRequest: Readonly<{
-  create: (partial: Partial<ComputeRequest> & Required<Omit<ComputeRequest, never>>) => ComputeRequest;
-  new: (partial: Partial<ComputeRequest> & Required<Omit<ComputeRequest, never>>) => ComputeRequest;
-  defaults: () => Partial<ComputeRequest>;
-}>;
-/**
- * The signer connection. Neither deadline bounds the hash, which runs client side between the
- * two RPCs.
+ * Transport tunables and per-request metadata for the signer connection.
+ *
+ * `headers`, when present, are attached to every RPC (e.g.
+ * `Authorization: Bearer …`, or routing/tenant metadata) and are
+ * lower-cased on the wire; omit them to connect with no extra metadata.
+ *
+ * # Both deadlines are required
+ *
+ * They were optional, and omitting them left a call with no deadline at all: a signer that
+ * accepted the connection and then stopped answering held the caller's thread for ever, with no
+ * cancellation path, because the SDK runs each call on a thread of its own and nothing was
+ * watching the clock. There is no figure the SDK could pick on a caller's behalf that is right
+ * for both a local signer and one across a region, so it asks.
+ *
+ * Neither bounds the hash: that runs client side, between the two legs of the signing protocol,
+ * and is not an RPC. These bound the network alone.
  */
 export type ConnectOptions = {
+  headers?: Map<string, string>;
   /**
-   * Sent on every request, names lower-cased; two names that differ only by case are refused.
-   */
-  headers: Map<string, string>;
-  /**
-   * Bounds one signer RPC, or how long a mark may wait for the next byte; the service's own
-   * limit bounds a whole mark. Default 30 s.
+   * Per-RPC deadline. Bounds one leg of the signing protocol, not the whole sign.
    */
-  rpcTimeout?: number;
+  rpcTimeoutMs: number;
   /**
-   * Bounds opening the connection. Default 5 s.
+   * Bounds the initial connection setup, so an unreachable signer fails fast rather than
+   * waiting out the OS SYN timeout.
    */
-  connectTimeout?: number;
+  connectTimeoutMs: number;
 };
 /**
  * Generated factory for {@link ConnectOptions} record objects.
  */
 export declare const ConnectOptions: Readonly<{
-  create: (partial: Partial<ConnectOptions> & Required<Omit<ConnectOptions, "connectTimeout" | "headers" | "rpcTimeout">>) => ConnectOptions;
-  new: (partial: Partial<ConnectOptions> & Required<Omit<ConnectOptions, "connectTimeout" | "headers" | "rpcTimeout">>) => ConnectOptions;
+  create: (partial: Partial<ConnectOptions> & Required<Omit<ConnectOptions, "headers">>) => ConnectOptions;
+  new: (partial: Partial<ConnectOptions> & Required<Omit<ConnectOptions, "headers">>) => ConnectOptions;
   defaults: () => Partial<ConnectOptions>;
 }>;
 /**
- * What one [`embed`] is told beyond the sink, the sidecar and the plugins.
+ * Everything one [`Binder::derive`] needs beyond the asset.
  */
-export type EmbedOptions = {
-  /**
-   * The asset's media type; `None` reads it from the sink's leading bytes.
-   */
-  format?: string;
+export type DeriveOptions = {
+  format: AssetFormat;
 };
 /**
- * Generated factory for {@link EmbedOptions} record objects.
+ * Generated factory for {@link DeriveOptions} record objects.
  */
-export declare const EmbedOptions: Readonly<{
-  create: (partial: Partial<EmbedOptions> & Required<Omit<EmbedOptions, "format">>) => EmbedOptions;
-  new: (partial: Partial<EmbedOptions> & Required<Omit<EmbedOptions, "format">>) => EmbedOptions;
-  defaults: () => Partial<EmbedOptions>;
+export declare const DeriveOptions: Readonly<{
+  create: (partial: Partial<DeriveOptions> & Required<Omit<DeriveOptions, never>>) => DeriveOptions;
+  new: (partial: Partial<DeriveOptions> & Required<Omit<DeriveOptions, never>>) => DeriveOptions;
+  defaults: () => Partial<DeriveOptions>;
 }>;
 /**
- * Where a stream's init manifest lives. The init segment always carries it, so there is no
- * remote-only delivery, and the segment comes back as bytes, so there is no output to name.
+ * Everything one [`embed`] needs beyond the sink, the manifest and the plugins: how the
+ * asset's format is known, stated or sniffed from the sink's leading bytes.
  */
-export declare enum StreamDelivery {
-  Embedded = 0,
-  EmbeddedAndRemote = 1
-}
-/**
- * How long a session key signs, and when to rotate it.
- */
-export type RotationPolicy = {
-  /**
-   * From the key's creation, in whole seconds (C2PA `validityPeriod`); the verifier refuses
-   * a segment signed after it.
-   */
-  validityPeriod: number;
-  /**
-   * The share of `validity_period`, 0 to 100, after which `rotation_due` is set.
-   */
-  refreshPercent: number;
+export type EmbedOptions = {
+  format: AssetFormat;
 };
 /**
- * Generated factory for {@link RotationPolicy} record objects.
+ * Generated factory for {@link EmbedOptions} record objects.
  */
-export declare const RotationPolicy: Readonly<{
-  create: (partial: Partial<RotationPolicy> & Required<Omit<RotationPolicy, never>>) => RotationPolicy;
-  new: (partial: Partial<RotationPolicy> & Required<Omit<RotationPolicy, never>>) => RotationPolicy;
-  defaults: () => Partial<RotationPolicy>;
+export declare const EmbedOptions: Readonly<{
+  create: (partial: Partial<EmbedOptions> & Required<Omit<EmbedOptions, never>>) => EmbedOptions;
+  new: (partial: Partial<EmbedOptions> & Required<Omit<EmbedOptions, never>>) => EmbedOptions;
+  defaults: () => Partial<EmbedOptions>;
 }>;
 /**
- * Computes one soft-binding algorithm's values from an asset (a fingerprint calculated, a
- * watermark detected). `[]` is "no value here"; an error is "no trustworthy answer", so a failed
- * engine never reads as an unmarked asset.
+ * A soft-binding binder: how a recoverable binding is derived from an asset. Put these inside
+ * the issuer's manifest mode to sign and index under them, and pass them in verify options to
+ * recover. Implement it for an algorithm the SDK does not ship; the SDK's own are
+ * [`IsccBinder`] and [`HeldBinder`].
+ *
+ * `derive` answers this binder's binding for `source`, or `None` when there is none.
+ * `options.format` is how the asset's format is known. `None` and an error
+ * mean different things: `None` is "no binding here", an error is "the question could not be
+ * answered", so a binder that failed never reads as an unmarked asset.
  */
-export interface Compute {
-  /**
-   * The C2PA soft-binding algorithm list label, e.g. `io.iscc.v0`.
-   */
-  alg(): string;
-  compute(request: ComputeRequest, asyncOpts_?: {
+export interface Binder {
+  derive(source: RangeSource, options: DeriveOptions, asyncOpts_?: {
     signal: AbortSignal;
-  }): Promise<Array<Block>>;
+  }): Promise<SoftBinding | undefined>;
 }
 /**
- * Computes one soft-binding algorithm's values from an asset (a fingerprint calculated, a
- * watermark detected). `[]` is "no value here"; an error is "no trustworthy answer", so a failed
- * engine never reads as an unmarked asset.
+ * A soft-binding binder: how a recoverable binding is derived from an asset. Put these inside
+ * the issuer's manifest mode to sign and index under them, and pass them in verify options to
+ * recover. Implement it for an algorithm the SDK does not ship; the SDK's own are
+ * [`IsccBinder`] and [`HeldBinder`].
+ *
+ * `derive` answers this binder's binding for `source`, or `None` when there is none.
+ * `options.format` is how the asset's format is known. `None` and an error
+ * mean different things: `None` is "no binding here", an error is "the question could not be
+ * answered", so a binder that failed never reads as an unmarked asset.
  */
-export declare class ComputeImpl extends UniffiAbstractObject implements Compute {
-  readonly [uniffiTypeNameSymbol] = "ComputeImpl";
+export declare class BinderImpl extends UniffiAbstractObject implements Binder {
+  readonly [uniffiTypeNameSymbol] = "BinderImpl";
   readonly [destructorGuardSymbol]: UniffiGcObject;
   readonly [pointerLiteralSymbol]: UniffiHandle;
   private constructor();
-  /**
-   * The C2PA soft-binding algorithm list label, e.g. `io.iscc.v0`.
-   */
-  alg(): string;
-  compute(request: ComputeRequest, asyncOpts_?: {
+  derive(source: RangeSource, options: DeriveOptions, asyncOpts_?: {
     signal: AbortSignal;
-  }): Promise<Array<Block>>;
+  }): Promise<SoftBinding | undefined>;
   uniffiDestroy(): void;
-  static instanceOf(obj_: any): obj_ is ComputeImpl;
+  static instanceOf(obj_: any): obj_ is BinderImpl;
 }
-export declare enum SoftBindingSource_Tags {
-  Builtin = "Builtin",
-  Held = "Held",
-  Custom = "Custom"
+export declare enum StreamDelivery_Tags {
+  Embedded = "Embedded",
+  Remote = "Remote",
+  Both = "Both"
 }
 /**
- * Where one assertion's values come from.
+ * How a live stream's init manifest is delivered and which binders it declares. A stream
+ * returns its signed init segment as bytes, so there is no output to name.
  */
-export declare const SoftBindingSource: Readonly<{
-  instanceOf: (obj: any) => obj is SoftBindingSource;
-  Builtin: {
+export declare const StreamDelivery: Readonly<{
+  instanceOf: (obj: any) => obj is StreamDelivery;
+  Embedded: {
     new (inner: {
-      alg: string;
+      binders: Array<Binder>;
     }): {
       /**
        * @private
        * This field is private and should not be used, use `tag` instead.
        */
-      readonly [uniffiTypeNameSymbol]: "SoftBindingSource";
-      readonly tag: SoftBindingSource_Tags.Builtin;
+      readonly [uniffiTypeNameSymbol]: "StreamDelivery";
+      readonly tag: StreamDelivery_Tags.Embedded;
       readonly inner: Readonly<{
-        alg: string;
+        binders: Array<Binder>;
       }>;
     };
     "new"(inner: {
-      alg: string;
+      binders: Array<Binder>;
     }): {
       /**
        * @private
        * This field is private and should not be used, use `tag` instead.
        */
-      readonly [uniffiTypeNameSymbol]: "SoftBindingSource";
-      readonly tag: SoftBindingSource_Tags.Builtin;
+      readonly [uniffiTypeNameSymbol]: "StreamDelivery";
+      readonly tag: StreamDelivery_Tags.Embedded;
       readonly inner: Readonly<{
-        alg: string;
+        binders: Array<Binder>;
       }>;
     };
     instanceOf(obj: any): obj is {
@@ -2244,38 +2235,38 @@ export declare const SoftBindingSource: Readonly<{
        * @private
        * This field is private and should not be used, use `tag` instead.
        */
-      readonly [uniffiTypeNameSymbol]: "SoftBindingSource";
-      readonly tag: SoftBindingSource_Tags.Builtin;
+      readonly [uniffiTypeNameSymbol]: "StreamDelivery";
+      readonly tag: StreamDelivery_Tags.Embedded;
       readonly inner: Readonly<{
-        alg: string;
+        binders: Array<Binder>;
       }>;
     };
   };
-  Held: {
+  Remote: {
     new (inner: {
-      binding: SoftBinding;
+      binders: Array<Binder>;
     }): {
       /**
        * @private
        * This field is private and should not be used, use `tag` instead.
        */
-      readonly [uniffiTypeNameSymbol]: "SoftBindingSource";
-      readonly tag: SoftBindingSource_Tags.Held;
+      readonly [uniffiTypeNameSymbol]: "StreamDelivery";
+      readonly tag: StreamDelivery_Tags.Remote;
       readonly inner: Readonly<{
-        binding: SoftBinding;
+        binders: Array<Binder>;
       }>;
     };
     "new"(inner: {
-      binding: SoftBinding;
+      binders: Array<Binder>;
     }): {
       /**
        * @private
        * This field is private and should not be used, use `tag` instead.
        */
-      readonly [uniffiTypeNameSymbol]: "SoftBindingSource";
-      readonly tag: SoftBindingSource_Tags.Held;
+      readonly [uniffiTypeNameSymbol]: "StreamDelivery";
+      readonly tag: StreamDelivery_Tags.Remote;
       readonly inner: Readonly<{
-        binding: SoftBinding;
+        binders: Array<Binder>;
       }>;
     };
     instanceOf(obj: any): obj is {
@@ -2283,38 +2274,38 @@ export declare const SoftBindingSource: Readonly<{
        * @private
        * This field is private and should not be used, use `tag` instead.
        */
-      readonly [uniffiTypeNameSymbol]: "SoftBindingSource";
-      readonly tag: SoftBindingSource_Tags.Held;
+      readonly [uniffiTypeNameSymbol]: "StreamDelivery";
+      readonly tag: StreamDelivery_Tags.Remote;
       readonly inner: Readonly<{
-        binding: SoftBinding;
+        binders: Array<Binder>;
       }>;
     };
   };
-  Custom: {
+  Both: {
     new (inner: {
-      compute: Compute;
+      binders: Array<Binder>;
     }): {
       /**
        * @private
        * This field is private and should not be used, use `tag` instead.
        */
-      readonly [uniffiTypeNameSymbol]: "SoftBindingSource";
-      readonly tag: SoftBindingSource_Tags.Custom;
+      readonly [uniffiTypeNameSymbol]: "StreamDelivery";
+      readonly tag: StreamDelivery_Tags.Both;
       readonly inner: Readonly<{
-        compute: Compute;
+        binders: Array<Binder>;
       }>;
     };
     "new"(inner: {
-      compute: Compute;
+      binders: Array<Binder>;
     }): {
       /**
        * @private
        * This field is private and should not be used, use `tag` instead.
        */
-      readonly [uniffiTypeNameSymbol]: "SoftBindingSource";
-      readonly tag: SoftBindingSource_Tags.Custom;
+      readonly [uniffiTypeNameSymbol]: "StreamDelivery";
+      readonly tag: StreamDelivery_Tags.Both;
       readonly inner: Readonly<{
-        compute: Compute;
+        binders: Array<Binder>;
       }>;
     };
     instanceOf(obj: any): obj is {
@@ -2322,42 +2313,63 @@ export declare const SoftBindingSource: Readonly<{
        * @private
        * This field is private and should not be used, use `tag` instead.
        */
-      readonly [uniffiTypeNameSymbol]: "SoftBindingSource";
-      readonly tag: SoftBindingSource_Tags.Custom;
+      readonly [uniffiTypeNameSymbol]: "StreamDelivery";
+      readonly tag: StreamDelivery_Tags.Both;
       readonly inner: Readonly<{
-        compute: Compute;
+        binders: Array<Binder>;
       }>;
     };
   };
 }>;
 /**
- * Where one assertion's values come from.
+ * How a live stream's init manifest is delivered and which binders it declares. A stream
+ * returns its signed init segment as bytes, so there is no output to name.
  */
-export type SoftBindingSource = InstanceType<typeof SoftBindingSource['Builtin' | 'Held' | 'Custom']>;
+export type StreamDelivery = InstanceType<typeof StreamDelivery['Embedded' | 'Remote' | 'Both']>;
+/**
+ * `validity_period_secs` is the session-key validity window in seconds
+ * after `created_at`; the verifier rejects segments signed past this
+ * (plus skew tolerance).
+ *
+ * `refresh_percent` is 0..=100; once this percentage of
+ * `validity_period_secs` elapses, `sign` returns `rotation_due: true`
+ * so the consumer can rotate before verifier-side expiry.
+ */
+export type RotationPolicy = {
+  validityPeriodSecs: number;
+  refreshPercent: number;
+};
+/**
+ * Generated factory for {@link RotationPolicy} record objects.
+ */
+export declare const RotationPolicy: Readonly<{
+  create: (partial: Partial<RotationPolicy> & Required<Omit<RotationPolicy, never>>) => RotationPolicy;
+  new: (partial: Partial<RotationPolicy> & Required<Omit<RotationPolicy, never>>) => RotationPolicy;
+  defaults: () => Partial<RotationPolicy>;
+}>;
 /**
- * Options for a stream's `init` and `rotate`: where the init manifest lives, the session-key
- * validity window, and the soft bindings declared for the init segment.
+ * Options for a stream's `init` and `rotate`: where the init manifest lives and the binders
+ * run over the init segment for it, and the session-key validity window.
  */
 export type InitOptions = {
   delivery: StreamDelivery;
   rotationPolicy: RotationPolicy;
-  softBindings: Array<SoftBindingSource>;
 };
 /**
  * Generated factory for {@link InitOptions} record objects.
  */
 export declare const InitOptions: Readonly<{
-  create: (partial: Partial<InitOptions> & Required<Omit<InitOptions, "softBindings">>) => InitOptions;
-  new: (partial: Partial<InitOptions> & Required<Omit<InitOptions, "softBindings">>) => InitOptions;
+  create: (partial: Partial<InitOptions> & Required<Omit<InitOptions, never>>) => InitOptions;
+  new: (partial: Partial<InitOptions> & Required<Omit<InitOptions, never>>) => InitOptions;
   defaults: () => Partial<InitOptions>;
 }>;
 /**
- * Result of [`StreamIssuer::init`](super::StreamIssuer::init): the signed init segment, and when
- * its session key stops signing.
+ * Result of [`StreamIssuer::init`](super::StreamIssuer::init). `valid_until_epoch_secs` is the
+ * UNIX-epoch second at which the session key's validity elapses.
  */
 export type InitOutcome = {
-  bytes: ArrayBuffer;
-  validUntil: Date;
+  signedInitBytes: ArrayBuffer;
+  validUntilEpochSecs: bigint;
 };
 /**
  * Generated factory for {@link InitOutcome} record objects.
@@ -2368,39 +2380,52 @@ export declare const InitOutcome: Readonly<{
   defaults: () => Partial<InitOutcome>;
 }>;
 /**
- * What one [`AssetMarker::mark`] is told beyond the asset.
+ * Everything one [`AssetMarker::mark`] needs beyond the asset, every field stated.
  */
 export type MarkOptions = {
   /**
-   * The asset's media type; `None` reads it from the leading bytes.
+   * How the asset's format is known.
    */
-  format?: string;
+  format: AssetFormat;
   /**
-   * The watermarks to insert, as algorithm list labels; `[]` inserts every one the
-   * deployment offers, in its order.
+   * Filename recorded with the mark, and the multipart part name.
    */
-  algorithms: Array<string>;
+  fileName: string;
+  /**
+   * Whether the signposting layer is applied beside the marks that resolve back to the
+   * manifest; `false` applies only those.
+   */
+  signpost: boolean;
 };
 /**
  * Generated factory for {@link MarkOptions} record objects.
  */
 export declare const MarkOptions: Readonly<{
-  create: (partial: Partial<MarkOptions> & Required<Omit<MarkOptions, "algorithms" | "format">>) => MarkOptions;
-  new: (partial: Partial<MarkOptions> & Required<Omit<MarkOptions, "algorithms" | "format">>) => MarkOptions;
+  create: (partial: Partial<MarkOptions> & Required<Omit<MarkOptions, never>>) => MarkOptions;
+  new: (partial: Partial<MarkOptions> & Required<Omit<MarkOptions, never>>) => MarkOptions;
   defaults: () => Partial<MarkOptions>;
 }>;
 /**
- * Result of [`AssetMarker::mark`](super::AssetMarker::mark), whose marked asset went into its
- * sink.
+ * Result of [`AssetMarker::mark`](super::AssetMarker::mark): the marked asset and the provenance
+ * its marking created. The neutral core is [`marker::MarkOutcome`]; this differs only in carrying the
+ * asset as [`Bytes`].
  */
 export type MarkOutcome = {
   /**
-   * The marked asset's media type, which a watermark service may change by re-encoding.
+   * The marked asset. Sign these bytes, not the ones handed in.
+   */
+  bytes: ArrayBuffer;
+  /**
+   * The marked asset's media type, which a marker may change by re-encoding.
    */
   format: string;
   /**
-   * One `c2pa.watermarked.bound` or `.unbound` per mark, in the order inserted. Append them to
-   * the manifest's `actions`.
+   * The name the marking service recorded.
+   */
+  fileName: string;
+  /**
+   * One `c2pa.watermarked.bound` or `.unbound` per mark, in the order applied, a bound one
+   * carrying the binding it resolves through. Append to the manifest's `actions`.
    */
   actions: Array<Action>;
 };
@@ -2413,28 +2438,32 @@ export declare const MarkOutcome: Readonly<{
   defaults: () => Partial<MarkOutcome>;
 }>;
 /**
- * What a [`SigningVault::mint`] is asked: how long the key will be signed under, so the vault can
- * give it that lifetime and expire it itself; a key no `forget` reaches then dies where it is held.
+ * A byte range holding a bare C2PA manifest store, or reserved for one. A record of
+ * primitives, so a plugin in its OWN UniFFI namespace declares a structurally identical
+ * one and the two cross the boundary without sharing a Rust type.
  */
-export type MintRequest = {
-  validityPeriod: number;
+export type Region = {
+  offset: bigint;
+  length: bigint;
 };
 /**
- * Generated factory for {@link MintRequest} record objects.
+ * Generated factory for {@link Region} record objects.
  */
-export declare const MintRequest: Readonly<{
-  create: (partial: Partial<MintRequest> & Required<Omit<MintRequest, never>>) => MintRequest;
-  new: (partial: Partial<MintRequest> & Required<Omit<MintRequest, never>>) => MintRequest;
-  defaults: () => Partial<MintRequest>;
+export declare const Region: Readonly<{
+  create: (partial: Partial<Region> & Required<Omit<Region, never>>) => Region;
+  new: (partial: Partial<Region> & Required<Omit<Region, never>>) => Region;
+  defaults: () => Partial<Region>;
 }>;
 /**
- * Result of [`StreamSession::sign`](super::StreamSession::sign). `valid_until` repeats per
- * segment so a caller can schedule the rotation rather than only react to `rotation_due`.
+ * Result of [`StreamSession::sign`](super::StreamSession::sign). `rotation_due` flips once
+ * `policy.refresh_percent`% of validity has elapsed; `valid_until_epoch_secs` is repeated
+ * per segment so callers can schedule rotation precisely instead of reacting only to the
+ * flag.
  */
 export type SegmentOutcome = {
   bytes: ArrayBuffer;
   rotationDue: boolean;
-  validUntil: Date;
+  validUntilEpochSecs: bigint;
 };
 /**
  * Generated factory for {@link SegmentOutcome} record objects.
@@ -2444,23 +2473,6 @@ export declare const SegmentOutcome: Readonly<{
   new: (partial: Partial<SegmentOutcome> & Required<Omit<SegmentOutcome, never>>) => SegmentOutcome;
   defaults: () => Partial<SegmentOutcome>;
 }>;
-/**
- * A minted session key's public half. `kid` is the vault's handle for it (typically SHA-256 of
- * the public key); `public_key` is the uncompressed SEC1 point (65 bytes from `0x04` for ES256),
- * which the SDK wraps as a `COSE_Key` (C2PA 2.4 19.4.4).
- */
-export type SessionKey = {
-  kid: ArrayBuffer;
-  publicKey: ArrayBuffer;
-};
-/**
- * Generated factory for {@link SessionKey} record objects.
- */
-export declare const SessionKey: Readonly<{
-  create: (partial: Partial<SessionKey> & Required<Omit<SessionKey, never>>) => SessionKey;
-  new: (partial: Partial<SessionKey> & Required<Omit<SessionKey, never>>) => SessionKey;
-  defaults: () => Partial<SessionKey>;
-}>;
 /**
  * A ranged read+write backend for embedding. All four methods are first-class (UniFFI
  * has no trait inheritance for foreign callbacks, so the read half is duplicated from
@@ -2522,9 +2534,10 @@ export declare enum SignOutput_Tags {
   Asset = "Asset"
 }
 /**
- * What a `sign` hands back beyond the sidecar it always returns: the sidecar alone, or the whole
- * signed asset written into `into` in the same call, replacing what it held. See the core
- * [`SignOutput`](core::SignOutput) for what pointing `into` at the asset's own storage means.
+ * What a `sign` hands back beyond the sidecar it always returns: the sidecar alone, or the
+ * signed asset written through `into` in the same call. See the core
+ * [`SignOutput`](crate::manifest::spec::SignOutput) for what pointing `into` at the asset's own
+ * storage means.
  */
 export declare const SignOutput: Readonly<{
   instanceOf: (obj: any) => obj is SignOutput;
@@ -2595,27 +2608,30 @@ export declare const SignOutput: Readonly<{
   };
 }>;
 /**
- * What a `sign` hands back beyond the sidecar it always returns: the sidecar alone, or the whole
- * signed asset written into `into` in the same call, replacing what it held. See the core
- * [`SignOutput`](core::SignOutput) for what pointing `into` at the asset's own storage means.
+ * What a `sign` hands back beyond the sidecar it always returns: the sidecar alone, or the
+ * signed asset written through `into` in the same call. See the core
+ * [`SignOutput`](crate::manifest::spec::SignOutput) for what pointing `into` at the asset's own
+ * storage means.
  */
 export type SignOutput = InstanceType<typeof SignOutput['Sidecar' | 'Asset']>;
 export declare enum AssetDelivery_Tags {
   Embedded = "Embedded",
   Remote = "Remote",
-  EmbeddedAndRemote = "EmbeddedAndRemote"
+  Both = "Both"
 }
 /**
- * Where a static asset's manifest lives and, when it is in the asset, what comes back.
+ * How a static asset's manifest is delivered, which binders it declares, and what comes back.
  *
- * Embedded manifests are not indexed, so a watermark on one is refused: it could never lead back
- * to the manifest. Remote needs a soft binding the deployment resolves and never touches the
- * asset, so it names no output.
+ * Embedded manifests may still need bindings, for example to describe a bound watermark, but
+ * are not indexed. Remote needs at least one resolved binding, from a binder or a bound
+ * watermark action, and never touches the asset, so it names no output; both is recoverable
+ * through its embedded manifest and permits an empty strategy list.
  */
 export declare const AssetDelivery: Readonly<{
   instanceOf: (obj: any) => obj is AssetDelivery;
   Embedded: {
     new (inner: {
+      binders: Array<Binder>;
       output: SignOutput;
     }): {
       /**
@@ -2625,10 +2641,12 @@ export declare const AssetDelivery: Readonly<{
       readonly [uniffiTypeNameSymbol]: "AssetDelivery";
       readonly tag: AssetDelivery_Tags.Embedded;
       readonly inner: Readonly<{
+        binders: Array<Binder>;
         output: SignOutput;
       }>;
     };
     "new"(inner: {
+      binders: Array<Binder>;
       output: SignOutput;
     }): {
       /**
@@ -2638,6 +2656,7 @@ export declare const AssetDelivery: Readonly<{
       readonly [uniffiTypeNameSymbol]: "AssetDelivery";
       readonly tag: AssetDelivery_Tags.Embedded;
       readonly inner: Readonly<{
+        binders: Array<Binder>;
         output: SignOutput;
       }>;
     };
@@ -2649,26 +2668,37 @@ export declare const AssetDelivery: Readonly<{
       readonly [uniffiTypeNameSymbol]: "AssetDelivery";
       readonly tag: AssetDelivery_Tags.Embedded;
       readonly inner: Readonly<{
+        binders: Array<Binder>;
         output: SignOutput;
       }>;
     };
   };
   Remote: {
-    new (): {
+    new (inner: {
+      binders: Array<Binder>;
+    }): {
       /**
        * @private
        * This field is private and should not be used, use `tag` instead.
        */
       readonly [uniffiTypeNameSymbol]: "AssetDelivery";
       readonly tag: AssetDelivery_Tags.Remote;
+      readonly inner: Readonly<{
+        binders: Array<Binder>;
+      }>;
     };
-    "new"(): {
+    "new"(inner: {
+      binders: Array<Binder>;
+    }): {
       /**
        * @private
        * This field is private and should not be used, use `tag` instead.
        */
       readonly [uniffiTypeNameSymbol]: "AssetDelivery";
       readonly tag: AssetDelivery_Tags.Remote;
+      readonly inner: Readonly<{
+        binders: Array<Binder>;
+      }>;
     };
     instanceOf(obj: any): obj is {
       /**
@@ -2677,10 +2707,14 @@ export declare const AssetDelivery: Readonly<{
        */
       readonly [uniffiTypeNameSymbol]: "AssetDelivery";
       readonly tag: AssetDelivery_Tags.Remote;
+      readonly inner: Readonly<{
+        binders: Array<Binder>;
+      }>;
     };
   };
-  EmbeddedAndRemote: {
+  Both: {
     new (inner: {
+      binders: Array<Binder>;
       output: SignOutput;
     }): {
       /**
@@ -2688,12 +2722,14 @@ export declare const AssetDelivery: Readonly<{
        * This field is private and should not be used, use `tag` instead.
        */
       readonly [uniffiTypeNameSymbol]: "AssetDelivery";
-      readonly tag: AssetDelivery_Tags.EmbeddedAndRemote;
+      readonly tag: AssetDelivery_Tags.Both;
       readonly inner: Readonly<{
+        binders: Array<Binder>;
         output: SignOutput;
       }>;
     };
     "new"(inner: {
+      binders: Array<Binder>;
       output: SignOutput;
     }): {
       /**
@@ -2701,8 +2737,9 @@ export declare const AssetDelivery: Readonly<{
        * This field is private and should not be used, use `tag` instead.
        */
       readonly [uniffiTypeNameSymbol]: "AssetDelivery";
-      readonly tag: AssetDelivery_Tags.EmbeddedAndRemote;
+      readonly tag: AssetDelivery_Tags.Both;
       readonly inner: Readonly<{
+        binders: Array<Binder>;
         output: SignOutput;
       }>;
     };
@@ -2712,51 +2749,48 @@ export declare const AssetDelivery: Readonly<{
        * This field is private and should not be used, use `tag` instead.
        */
       readonly [uniffiTypeNameSymbol]: "AssetDelivery";
-      readonly tag: AssetDelivery_Tags.EmbeddedAndRemote;
+      readonly tag: AssetDelivery_Tags.Both;
       readonly inner: Readonly<{
+        binders: Array<Binder>;
         output: SignOutput;
       }>;
     };
   };
 }>;
 /**
- * Where a static asset's manifest lives and, when it is in the asset, what comes back.
+ * How a static asset's manifest is delivered, which binders it declares, and what comes back.
  *
- * Embedded manifests are not indexed, so a watermark on one is refused: it could never lead back
- * to the manifest. Remote needs a soft binding the deployment resolves and never touches the
- * asset, so it names no output.
+ * Embedded manifests may still need bindings, for example to describe a bound watermark, but
+ * are not indexed. Remote needs at least one resolved binding, from a binder or a bound
+ * watermark action, and never touches the asset, so it names no output; both is recoverable
+ * through its embedded manifest and permits an empty strategy list.
  */
-export type AssetDelivery = InstanceType<typeof AssetDelivery['Embedded' | 'Remote' | 'EmbeddedAndRemote']>;
+export type AssetDelivery = InstanceType<typeof AssetDelivery['Embedded' | 'Remote' | 'Both']>;
 /**
- * What one `sign` is told beyond the asset, its manifest and the plugins.
+ * Options for `sign`. The delivery owns where the manifest lives, its binders and what comes
+ * back; the format is how the asset's is known, stated or sniffed; the thumbnail is the claim
+ * thumbnail the caller rendered, since the split-signer never sees the asset.
  */
 export type SignOptions = {
   delivery: AssetDelivery;
-  /**
-   * The asset's media type; `None` reads it from the leading bytes.
-   */
-  format?: string;
-  /**
-   * The claim thumbnail, rendered by the caller: the split signer never sees the asset.
-   */
+  format: AssetFormat;
   thumbnail?: Thumbnail;
-  softBindings: Array<SoftBindingSource>;
 };
 /**
  * Generated factory for {@link SignOptions} record objects.
  */
 export declare const SignOptions: Readonly<{
-  create: (partial: Partial<SignOptions> & Required<Omit<SignOptions, "format" | "softBindings" | "thumbnail">>) => SignOptions;
-  new: (partial: Partial<SignOptions> & Required<Omit<SignOptions, "format" | "softBindings" | "thumbnail">>) => SignOptions;
+  create: (partial: Partial<SignOptions> & Required<Omit<SignOptions, "thumbnail">>) => SignOptions;
+  new: (partial: Partial<SignOptions> & Required<Omit<SignOptions, "thumbnail">>) => SignOptions;
   defaults: () => Partial<SignOptions>;
 }>;
 /**
  * Result of [`AssetIssuer::sign`](super::AssetIssuer::sign): the sidecar to embed plus its active
- * C2PA manifest id. `Remote` and `EmbeddedAndRemote` persist that id; `Embedded` does not.
+ * C2PA manifest id. Remote and both modes persist that id; embedded mode does not.
  */
 export type SignOutcome = {
   /**
-   * The manifest sidecar to embed into the asset (see `embed`).
+   * The manifest sidecar to embed into the asset (see [`embed`](crate::ffi::embed)).
    */
   sidecar: ArrayBuffer;
   /**
@@ -2772,23 +2806,23 @@ export declare const SignOutcome: Readonly<{
   new: (partial: Partial<SignOutcome> & Required<Omit<SignOutcome, never>>) => SignOutcome;
   defaults: () => Partial<SignOutcome>;
 }>;
-export declare enum StreamOrigin_Tags {
+export declare enum Origin_Tags {
   Created = "Created",
   Opened = "Opened"
 }
 /**
- * An origin a stream states; see the core [`provenance::StreamOrigin`].
+ * An origin a live stream states; see the core [`provenance::Origin`].
  */
-export declare const StreamOrigin: Readonly<{
-  instanceOf: (obj: any) => obj is StreamOrigin;
+export declare const Origin: Readonly<{
+  instanceOf: (obj: any) => obj is Origin;
   Created: {
     new (v0: CreatedOrigin): {
       /**
        * @private
        * This field is private and should not be used, use `tag` instead.
        */
-      readonly [uniffiTypeNameSymbol]: "StreamOrigin";
-      readonly tag: StreamOrigin_Tags.Created;
+      readonly [uniffiTypeNameSymbol]: "Origin";
+      readonly tag: Origin_Tags.Created;
       readonly inner: Readonly<[CreatedOrigin]>;
     };
     "new"(v0: CreatedOrigin): {
@@ -2796,8 +2830,8 @@ export declare const StreamOrigin: Readonly<{
        * @private
        * This field is private and should not be used, use `tag` instead.
        */
-      readonly [uniffiTypeNameSymbol]: "StreamOrigin";
-      readonly tag: StreamOrigin_Tags.Created;
+      readonly [uniffiTypeNameSymbol]: "Origin";
+      readonly tag: Origin_Tags.Created;
       readonly inner: Readonly<[CreatedOrigin]>;
     };
     instanceOf(obj: any): obj is {
@@ -2805,8 +2839,8 @@ export declare const StreamOrigin: Readonly<{
        * @private
        * This field is private and should not be used, use `tag` instead.
        */
-      readonly [uniffiTypeNameSymbol]: "StreamOrigin";
-      readonly tag: StreamOrigin_Tags.Created;
+      readonly [uniffiTypeNameSymbol]: "Origin";
+      readonly tag: Origin_Tags.Created;
       readonly inner: Readonly<[CreatedOrigin]>;
     };
   };
@@ -2816,8 +2850,8 @@ export declare const StreamOrigin: Readonly<{
        * @private
        * This field is private and should not be used, use `tag` instead.
        */
-      readonly [uniffiTypeNameSymbol]: "StreamOrigin";
-      readonly tag: StreamOrigin_Tags.Opened;
+      readonly [uniffiTypeNameSymbol]: "Origin";
+      readonly tag: Origin_Tags.Opened;
       readonly inner: Readonly<[OpenedOrigin]>;
     };
     "new"(v0: OpenedOrigin): {
@@ -2825,8 +2859,8 @@ export declare const StreamOrigin: Readonly<{
        * @private
        * This field is private and should not be used, use `tag` instead.
        */
-      readonly [uniffiTypeNameSymbol]: "StreamOrigin";
-      readonly tag: StreamOrigin_Tags.Opened;
+      readonly [uniffiTypeNameSymbol]: "Origin";
+      readonly tag: Origin_Tags.Opened;
       readonly inner: Readonly<[OpenedOrigin]>;
     };
     instanceOf(obj: any): obj is {
@@ -2834,73 +2868,62 @@ export declare const StreamOrigin: Readonly<{
        * @private
        * This field is private and should not be used, use `tag` instead.
        */
-      readonly [uniffiTypeNameSymbol]: "StreamOrigin";
-      readonly tag: StreamOrigin_Tags.Opened;
+      readonly [uniffiTypeNameSymbol]: "Origin";
+      readonly tag: Origin_Tags.Opened;
       readonly inner: Readonly<[OpenedOrigin]>;
     };
   };
 }>;
 /**
- * An origin a stream states; see the core [`provenance::StreamOrigin`].
+ * An origin a live stream states; see the core [`provenance::Origin`].
  */
-export type StreamOrigin = InstanceType<typeof StreamOrigin['Created' | 'Opened']>;
+export type Origin = InstanceType<typeof Origin['Created' | 'Opened']>;
 /**
- * The manifest a stream's init segment is signed with: the asset spec's twin whose origin is a
- * [`StreamOrigin`], since an init segment has no store the SDK opens as the parent.
+ * The manifest a live stream's init segment is signed with: the asset spec's twin whose origin
+ * is an [`Origin`], since an init segment has no store the SDK opens as the parent.
  */
 export type StreamManifestSpec = {
   title?: string;
-  origin: StreamOrigin;
-  /**
-   * Every action performed on the asset; the manifest states the list is complete (C2PA
-   * `allActionsIncluded`).
-   */
+  origin: Origin;
   actions: Array<Action>;
   identity?: Identity;
   assertions: Array<Assertion>;
-  /**
-   * Keyed by the handle actions name them by.
-   */
-  components: Map<string, Component>;
+  components: Array<Component>;
 };
 /**
  * Generated factory for {@link StreamManifestSpec} record objects.
  */
 export declare const StreamManifestSpec: Readonly<{
-  create: (partial: Partial<StreamManifestSpec> & Required<Omit<StreamManifestSpec, "actions" | "assertions" | "components" | "identity" | "title">>) => StreamManifestSpec;
-  new: (partial: Partial<StreamManifestSpec> & Required<Omit<StreamManifestSpec, "actions" | "assertions" | "components" | "identity" | "title">>) => StreamManifestSpec;
+  create: (partial: Partial<StreamManifestSpec> & Required<Omit<StreamManifestSpec, "identity" | "title">>) => StreamManifestSpec;
+  new: (partial: Partial<StreamManifestSpec> & Required<Omit<StreamManifestSpec, "identity" | "title">>) => StreamManifestSpec;
   defaults: () => Partial<StreamManifestSpec>;
 }>;
 /**
- * One stream, from `init` to `stop` or `rotate`.
+ * One live stream, from `init` to `stop`.
  *
- * Carries the whole per-stream state, so it cannot be mistyped or confused with another
- * stream's: every call after `init` goes through the handle that started it, and nothing about
- * the stream ever appears in a caller's argument list again. Once `stop` or a `rotate` succeeds
- * it refuses every call.
+ * Carries the whole per-stream state, so it cannot be mistyped, reused after `stop`, or
+ * confused with another stream's: every call after `init` goes through the handle that started
+ * it, and nothing about the stream ever appears in a caller's argument list again.
  */
 export interface StreamSessionLike {
   /**
    * Sign one media (moof) segment from a [`RangeSource`]. Does not touch the signer channel;
    * works through a signer outage. `rotation_due` flips when the key validity threshold
-   * passes; then call `StreamIssuer.rotate` with this session.
+   * passes; re-`init` on the issuer to rotate.
    *
    * # Errors
    *
-   * Fails on a vault error, a segment that isn't a BMFF media segment, or with
-   * `FAILED_PRECONDITION` (`SESSION_ENDED`) after `stop` or a `rotate`.
+   * Fails on a vault error, or a segment that isn't a BMFF media segment.
    */
-  sign(source: RangeSource, asyncOpts_?: {
+  sign(body: RangeSource, asyncOpts_?: {
     signal: AbortSignal;
   }): Promise<SegmentOutcome>;
   /**
-   * End the stream: forget its session key, so nothing can sign under it again. Idempotent:
-   * stopping an ended session succeeds. A failed stop can be retried.
+   * End the stream: forget its session key, so nothing can sign under it again.
    *
    * # Errors
    *
-   * Fails on a vault error, or with `FAILED_PRECONDITION` (`SESSION_ENDED`) with another
-   * `stop` or `rotate` in flight.
+   * Fails on a vault error.
    */
   stop(asyncOpts_?: {
     signal: AbortSignal;
@@ -2911,12 +2934,11 @@ export interface StreamSessionLike {
  */
 export type StreamSessionInterface = StreamSessionLike;
 /**
- * One stream, from `init` to `stop` or `rotate`.
+ * One live stream, from `init` to `stop`.
  *
- * Carries the whole per-stream state, so it cannot be mistyped or confused with another
- * stream's: every call after `init` goes through the handle that started it, and nothing about
- * the stream ever appears in a caller's argument list again. Once `stop` or a `rotate` succeeds
- * it refuses every call.
+ * Carries the whole per-stream state, so it cannot be mistyped, reused after `stop`, or
+ * confused with another stream's: every call after `init` goes through the handle that started
+ * it, and nothing about the stream ever appears in a caller's argument list again.
  */
 export declare class StreamSession extends UniffiAbstractObject implements StreamSessionLike {
   readonly [uniffiTypeNameSymbol] = "StreamSession";
@@ -2926,24 +2948,21 @@ export declare class StreamSession extends UniffiAbstractObject implements Strea
   /**
    * Sign one media (moof) segment from a [`RangeSource`]. Does not touch the signer channel;
    * works through a signer outage. `rotation_due` flips when the key validity threshold
-   * passes; then call `StreamIssuer.rotate` with this session.
+   * passes; re-`init` on the issuer to rotate.
    *
    * # Errors
    *
-   * Fails on a vault error, a segment that isn't a BMFF media segment, or with
-   * `FAILED_PRECONDITION` (`SESSION_ENDED`) after `stop` or a `rotate`.
+   * Fails on a vault error, or a segment that isn't a BMFF media segment.
    */
-  sign(source: RangeSource, asyncOpts_?: {
+  sign(body: RangeSource, asyncOpts_?: {
     signal: AbortSignal;
   }): Promise<SegmentOutcome>;
   /**
-   * End the stream: forget its session key, so nothing can sign under it again. Idempotent:
-   * stopping an ended session succeeds. A failed stop can be retried.
+   * End the stream: forget its session key, so nothing can sign under it again.
    *
    * # Errors
    *
-   * Fails on a vault error, or with `FAILED_PRECONDITION` (`SESSION_ENDED`) with another
-   * `stop` or `rotate` in flight.
+   * Fails on a vault error.
    */
   stop(asyncOpts_?: {
     signal: AbortSignal;
@@ -2974,8 +2993,25 @@ export declare const StreamStart: Readonly<{
   defaults: () => Partial<StreamStart>;
 }>;
 /**
- * Whether a fragmented-MP4 segment is the init (moov) or a media (moof) segment: whether it goes
- * to `StreamIssuer.init` or `StreamSession.sign`.
+ * `kid` is the vault-derived handle (typically SHA-256 of SEC1 public).
+ * `public_key_sec1` is uncompressed SEC1 (65 bytes starting with `0x04`
+ * for ES256); the SDK rewraps as `COSE_Key` for §19.4.4.
+ */
+export type VaultPublicKey = {
+  kid: ArrayBuffer;
+  publicKeySec1: ArrayBuffer;
+};
+/**
+ * Generated factory for {@link VaultPublicKey} record objects.
+ */
+export declare const VaultPublicKey: Readonly<{
+  create: (partial: Partial<VaultPublicKey> & Required<Omit<VaultPublicKey, never>>) => VaultPublicKey;
+  new: (partial: Partial<VaultPublicKey> & Required<Omit<VaultPublicKey, never>>) => VaultPublicKey;
+  defaults: () => Partial<VaultPublicKey>;
+}>;
+/**
+ * Whether a fragmented-MP4 segment is the init (moov) or a media (moof) segment: which
+ * [`StreamIssuer`](stream::StreamIssuer) entrypoint (`init` vs `sign`) a segment belongs to.
  */
 export declare enum SegmentKind {
   Init = 0,
@@ -2998,25 +3034,25 @@ export interface PluginAuthor {
    * Implement it correctly anyway, since the verify side dispatches on it and whatever
    * signs a format is eventually verified by it.
    */
-  sniff(source: RangeSource, asyncOpts_?: {
+  sniff(src: RangeSource, asyncOpts_?: {
     signal: AbortSignal;
   }): Promise<string | undefined>;
   /**
    * The manifest window(s), or empty when none is present. MUST be byte-identical
    * regardless of slot contents; the sign driver enforces that with a round-trip.
    */
-  locate(source: RangeSource, asyncOpts_?: {
+  locate(src: RangeSource, asyncOpts_?: {
     signal: AbortSignal;
-  }): Promise<Array<ByteRange>>;
+  }): Promise<Array<Region>>;
   /**
    * Reserve `reserve` bytes of manifest slot by writing container structure through
-   * `sink`, and return exactly where it landed. The core excludes those regions from the
+   * `dst`, and return exactly where it landed. The core excludes those regions from the
    * content hash and writes the signed manifest into them, so the plugin never embeds
    * and never re-locates.
    */
-  reserveSlot(sink: RangeSink, reserve: bigint, asyncOpts_?: {
+  reserveSlot(dst: RangeSink, reserve: bigint, asyncOpts_?: {
     signal: AbortSignal;
-  }): Promise<Array<ByteRange>>;
+  }): Promise<Array<Region>>;
 }
 /**
  * A C2PA asset signer bound to a [`SignerClient`](super::client::SignerClient).
@@ -3024,14 +3060,16 @@ export interface PluginAuthor {
  */
 export interface AssetIssuerLike {
   /**
-   * Sign an asset from a [`RangeSource`], returning the sidecar and the active manifest's id.
-   * `options.delivery` says where the manifest lives and, through its output, where the signed
-   * asset is written. `plugins` resolves a non-c2pa format (e.g. MXF); see the module docs.
+   * Sign an asset from a [`RangeSource`], returning the sidecar plus the registry
+   * `manifest_id`. `options.delivery` selects where the manifest lives, its binders and,
+   * through its output, the sink the signed asset is written through. `options.format` is
+   * how the asset's format is known. `plugins` resolves a non-c2pa format (e.g. MXF); see the
+   * module docs for the dispatch.
    *
    * # Errors
    *
-   * A format that is no media type, that the bytes contradict or that neither names; an RPC,
-   * hashing, authoring or protocol failure.
+   * Fails on RPC failure, a hashing error, an authoring error, a protocol violation,
+   * or when the format can't be inferred and none was given.
    */
   sign(source: RangeSource, manifest: AssetManifestSpec, options: SignOptions, plugins: Array<PluginAuthor>, asyncOpts_?: {
     signal: AbortSignal;
@@ -3055,40 +3093,41 @@ export declare class AssetIssuer extends UniffiAbstractObject implements AssetIs
    */
   static create(client: SignerClientLike): AssetIssuerLike;
   /**
-   * Sign an asset from a [`RangeSource`], returning the sidecar and the active manifest's id.
-   * `options.delivery` says where the manifest lives and, through its output, where the signed
-   * asset is written. `plugins` resolves a non-c2pa format (e.g. MXF); see the module docs.
+   * Sign an asset from a [`RangeSource`], returning the sidecar plus the registry
+   * `manifest_id`. `options.delivery` selects where the manifest lives, its binders and,
+   * through its output, the sink the signed asset is written through. `options.format` is
+   * how the asset's format is known. `plugins` resolves a non-c2pa format (e.g. MXF); see the
+   * module docs for the dispatch.
    *
    * # Errors
    *
-   * A format that is no media type, that the bytes contradict or that neither names; an RPC,
-   * hashing, authoring or protocol failure.
+   * Fails on RPC failure, a hashing error, an authoring error, a protocol violation,
+   * or when the format can't be inferred and none was given.
    */
-  sign(source: RangeSource, manifest: AssetManifestSpec, options: SignOptions, plugins?: Array<PluginAuthor>, asyncOpts_?: {
+  sign(source: RangeSource, manifest: AssetManifestSpec, options: SignOptions, plugins: Array<PluginAuthor>, asyncOpts_?: {
     signal: AbortSignal;
   }): Promise<SignOutcome>;
   uniffiDestroy(): void;
   static instanceOf(obj_: any): obj_ is AssetIssuer;
 }
 /**
- * Inserts invisible watermarks through the deployment's marking route.
+ * Applies invisible watermarks through the deployment's marking service.
  *
  * Separate from [`AssetIssuer`] because marking is a content edit, not a signing step: it
- * happens before signing, and it returns the actions it owes the manifest.
+ * changes pixels, it happens before signing, and it returns the provenance facts it created
+ * rather than leaving anything downstream to infer them.
  */
 export interface AssetMarkerLike {
   /**
-   * Mark an asset from a [`RangeSource`], writing the marked asset into `into` in place of
-   * what it held, and return one `c2pa.watermarked.*` action per mark, in the order inserted.
-   * Sign what `into` holds.
+   * Mark an image from a [`RangeSource`] and return it with the actions the marking created,
+   * each bound one carrying its binding.
    *
    * # Errors
    *
-   * An unlisted algorithm, a format that is no media type or that the bytes contradict, an
-   * asset above the upload ceiling, a source or sink that fails, or a marking route that
-   * refused or answered out of contract.
+   * Fails when the format can't be resolved, the asset is above the upload ceiling, the HTTP
+   * request fails, or the service response is malformed.
    */
-  mark(source: RangeSource, into: RangeSink, options: MarkOptions, asyncOpts_?: {
+  mark(source: RangeSource, options: MarkOptions, asyncOpts_?: {
     signal: AbortSignal;
   }): Promise<MarkOutcome>;
 }
@@ -3097,10 +3136,11 @@ export interface AssetMarkerLike {
  */
 export type AssetMarkerInterface = AssetMarkerLike;
 /**
- * Inserts invisible watermarks through the deployment's marking route.
+ * Applies invisible watermarks through the deployment's marking service.
  *
  * Separate from [`AssetIssuer`] because marking is a content edit, not a signing step: it
- * happens before signing, and it returns the actions it owes the manifest.
+ * changes pixels, it happens before signing, and it returns the provenance facts it created
+ * rather than leaving anything downstream to infer them.
  */
 export declare class AssetMarker extends UniffiAbstractObject implements AssetMarkerLike {
   readonly [uniffiTypeNameSymbol] = "AssetMarker";
@@ -3112,17 +3152,15 @@ export declare class AssetMarker extends UniffiAbstractObject implements AssetMa
    */
   static create(client: SignerClientLike): AssetMarkerLike;
   /**
-   * Mark an asset from a [`RangeSource`], writing the marked asset into `into` in place of
-   * what it held, and return one `c2pa.watermarked.*` action per mark, in the order inserted.
-   * Sign what `into` holds.
+   * Mark an image from a [`RangeSource`] and return it with the actions the marking created,
+   * each bound one carrying its binding.
    *
    * # Errors
    *
-   * An unlisted algorithm, a format that is no media type or that the bytes contradict, an
-   * asset above the upload ceiling, a source or sink that fails, or a marking route that
-   * refused or answered out of contract.
+   * Fails when the format can't be resolved, the asset is above the upload ceiling, the HTTP
+   * request fails, or the service response is malformed.
    */
-  mark(source: RangeSource, into: RangeSink, options: MarkOptions, asyncOpts_?: {
+  mark(source: RangeSource, options: MarkOptions, asyncOpts_?: {
     signal: AbortSignal;
   }): Promise<MarkOutcome>;
   uniffiDestroy(): void;
@@ -3140,6 +3178,10 @@ export declare class AssetMarker extends UniffiAbstractObject implements AssetMa
  * That is what makes [`MemorySink`]'s ceiling stop applying: there is no byte array to count in an
  * `i32` and nothing resident, so a multi-GB master is signed at the disk's speed rather than the
  * host thread's, and `bytes()` is not something anyone has to call.
+ *
+ * No lock. A positioned write to a file is one `pwrite`, which the OS already makes atomic per
+ * call, and [`RangeWriter`] takes a shared borrow precisely so a backend like this pays nothing
+ * for being shared.
  */
 export interface FileSinkLike {
   length(asyncOpts_?: {
@@ -3171,6 +3213,10 @@ export type FileSinkInterface = FileSinkLike;
  * That is what makes [`MemorySink`]'s ceiling stop applying: there is no byte array to count in an
  * `i32` and nothing resident, so a multi-GB master is signed at the disk's speed rather than the
  * host thread's, and `bytes()` is not something anyone has to call.
+ *
+ * No lock. A positioned write to a file is one `pwrite`, which the OS already makes atomic per
+ * call, and [`RangeWriter`] takes a shared borrow precisely so a backend like this pays nothing
+ * for being shared.
  */
 export declare class FileSink extends UniffiAbstractObject implements FileSinkLike {
   readonly [uniffiTypeNameSymbol] = "FileSink";
@@ -3178,8 +3224,8 @@ export declare class FileSink extends UniffiAbstractObject implements FileSinkLi
   readonly [pointerLiteralSymbol]: UniffiHandle;
   private constructor();
   /**
-   * Create `path`, or truncate it if it is already there. What a `sign` output wants: the
-   * signed asset is written into it whole.
+   * Create `path`, or truncate it if it is already there. What `embed` wants: it composes a
+   * whole asset, so the sink starts empty and grows.
    *
    * # Errors
    *
@@ -3187,9 +3233,9 @@ export declare class FileSink extends UniffiAbstractObject implements FileSinkLi
    */
   static create(path: string): FileSinkLike;
   /**
-   * Open an existing `path` for reading and writing, keeping what is in it. What `embed` wants:
-   * the asset is already there and the manifest is written into it, so truncating it would
-   * destroy the very thing being signed.
+   * Open an existing `path` for reading and writing, keeping what is in it. What a fixed-slot
+   * patch wants: the asset is already there and only its reserved range changes, so truncating
+   * it would destroy the very thing being signed.
    *
    * # Errors
    *
@@ -3278,8 +3324,70 @@ export declare class FileSource extends UniffiAbstractObject implements FileSour
   static instanceOf(obj_: any): obj_ is FileSource;
 }
 /**
- * An in-memory [`RangeSink`] for a caller that wants `embed`'s composed result back:
- * `sink = MemorySink(data)`, pass it to `embed`, then read `sink.bytes()`.
+ * A binding you already hold, such as an out-of-band video ISCC. Reads nothing.
+ */
+export interface HeldBinderLike {
+  derive(source: RangeSource, options: DeriveOptions, asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<SoftBinding | undefined>;
+}
+/**
+ * @deprecated Use `HeldBinderLike` instead.
+ */
+export type HeldBinderInterface = HeldBinderLike;
+/**
+ * A binding you already hold, such as an out-of-band video ISCC. Reads nothing.
+ */
+export declare class HeldBinder extends UniffiAbstractObject implements HeldBinderLike {
+  readonly [uniffiTypeNameSymbol] = "HeldBinder";
+  readonly [destructorGuardSymbol]: UniffiGcObject;
+  readonly [pointerLiteralSymbol]: UniffiHandle;
+  /**
+   * # Errors
+   *
+   * A binding with an empty algorithm or value.
+   */
+  constructor(binding: SoftBinding);
+  derive(source: RangeSource, options: DeriveOptions, asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<SoftBinding | undefined>;
+  uniffiDestroy(): void;
+  static instanceOf(obj_: any): obj_ is HeldBinder;
+}
+/**
+ * Local ISCC Image-Code for supported image formats.
+ */
+export interface IsccBinderLike {
+  derive(source: RangeSource, options: DeriveOptions, asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<SoftBinding | undefined>;
+}
+/**
+ * @deprecated Use `IsccBinderLike` instead.
+ */
+export type IsccBinderInterface = IsccBinderLike;
+/**
+ * Local ISCC Image-Code for supported image formats.
+ */
+export declare class IsccBinder extends UniffiAbstractObject implements IsccBinderLike {
+  readonly [uniffiTypeNameSymbol] = "IsccBinder";
+  readonly [destructorGuardSymbol]: UniffiGcObject;
+  readonly [pointerLiteralSymbol]: UniffiHandle;
+  constructor();
+  derive(source: RangeSource, options: DeriveOptions, asyncOpts_?: {
+    signal: AbortSignal;
+  }): Promise<SoftBinding | undefined>;
+  uniffiDestroy(): void;
+  static instanceOf(obj_: any): obj_ is IsccBinder;
+}
+/**
+ * An in-memory [`RangeSink`], for a caller that wants `embed`'s composed result back
+ * without writing a custom sink. A **native** implementation of a `with_foreign`
+ * interface (`#[uniffi::export]` on the trait impl, not the foreign callback path), so
+ * a Python caller writes no subclass: `sink = MemorySink(data)`, pass it to `embed`,
+ * then read `sink.bytes()` back. `&self`-only methods need interior mutability, so the
+ * buffer is `Mutex`-guarded (contention is a non-issue: the SDK calls it from one task
+ * at a time per sink).
  *
  * # Size ceiling
  *
@@ -3291,8 +3399,9 @@ export declare class FileSource extends UniffiAbstractObject implements FileSour
  * [`RangeSink`] over a file (or any store that seeks) for anything approaching that: the SDK
  * writes ranges straight through it and never holds the asset.
  *
- * Construction and `bytes()` each move the whole asset across the boundary once, on the calling
- * thread. A ranged sink pays neither.
+ * Construction and `bytes()` each copy the whole asset, on the calling thread: together with a
+ * `MemorySource` over the same asset that is about 12ms for 10 MB and 1.2s for 500 MB. A ranged
+ * sink pays none of it.
  */
 export interface MemorySinkLike {
   /**
@@ -3322,8 +3431,13 @@ export interface MemorySinkLike {
  */
 export type MemorySinkInterface = MemorySinkLike;
 /**
- * An in-memory [`RangeSink`] for a caller that wants `embed`'s composed result back:
- * `sink = MemorySink(data)`, pass it to `embed`, then read `sink.bytes()`.
+ * An in-memory [`RangeSink`], for a caller that wants `embed`'s composed result back
+ * without writing a custom sink. A **native** implementation of a `with_foreign`
+ * interface (`#[uniffi::export]` on the trait impl, not the foreign callback path), so
+ * a Python caller writes no subclass: `sink = MemorySink(data)`, pass it to `embed`,
+ * then read `sink.bytes()` back. `&self`-only methods need interior mutability, so the
+ * buffer is `Mutex`-guarded (contention is a non-issue: the SDK calls it from one task
+ * at a time per sink).
  *
  * # Size ceiling
  *
@@ -3335,8 +3449,9 @@ export type MemorySinkInterface = MemorySinkLike;
  * [`RangeSink`] over a file (or any store that seeks) for anything approaching that: the SDK
  * writes ranges straight through it and never holds the asset.
  *
- * Construction and `bytes()` each move the whole asset across the boundary once, on the calling
- * thread. A ranged sink pays neither.
+ * Construction and `bytes()` each copy the whole asset, on the calling thread: together with a
+ * `MemorySource` over the same asset that is about 12ms for 10 MB and 1.2s for 500 MB. A ranged
+ * sink pays none of it.
  */
 export declare class MemorySink extends UniffiAbstractObject implements MemorySinkLike {
   readonly [uniffiTypeNameSymbol] = "MemorySink";
@@ -3373,8 +3488,11 @@ export declare class MemorySink extends UniffiAbstractObject implements MemorySi
   static instanceOf(obj_: any): obj_ is MemorySink;
 }
 /**
- * An in-memory [`RangeSource`] for a caller that already holds the whole asset as bytes:
- * `MemorySource(data)`, no subclass.
+ * An in-memory [`RangeSource`], for a caller that already holds the whole asset as
+ * bytes and doesn't want to write a custom source. A **native** implementation of a
+ * `with_foreign` interface (`#[uniffi::export]` on the trait impl, not the foreign
+ * callback path), so the generated binding is a plain constructible object and a Python
+ * caller writes no subclass at all: `MemorySource(data)`.
  *
  * # Size ceiling
  *
@@ -3384,10 +3502,9 @@ export declare class MemorySink extends UniffiAbstractObject implements MemorySi
  * [`RangeSource`] over a file handle for anything approaching that: the SDK only ever asks for
  * bounded ranges, so nothing else has to hold the asset.
  *
- * Construction moves the whole asset across the boundary once, on the calling thread; the SDK
- * then holds what arrived and answers every read as a window into it. That crossing is the one
- * part of a sign or verify the SDK cannot move off your thread, and neither a ranged source nor
- * [`FileSource`] pays it.
+ * Construction copies the whole asset across the boundary, on the calling thread: about 5ms for
+ * 10 MB, 315ms for 500 MB. That is the one part of a sign or verify the SDK cannot move off your
+ * thread, and neither a ranged source nor [`FileSource`] pays it.
  */
 export interface MemorySourceLike {
   length(asyncOpts_?: {
@@ -3402,8 +3519,11 @@ export interface MemorySourceLike {
  */
 export type MemorySourceInterface = MemorySourceLike;
 /**
- * An in-memory [`RangeSource`] for a caller that already holds the whole asset as bytes:
- * `MemorySource(data)`, no subclass.
+ * An in-memory [`RangeSource`], for a caller that already holds the whole asset as
+ * bytes and doesn't want to write a custom source. A **native** implementation of a
+ * `with_foreign` interface (`#[uniffi::export]` on the trait impl, not the foreign
+ * callback path), so the generated binding is a plain constructible object and a Python
+ * caller writes no subclass at all: `MemorySource(data)`.
  *
  * # Size ceiling
  *
@@ -3413,10 +3533,9 @@ export type MemorySourceInterface = MemorySourceLike;
  * [`RangeSource`] over a file handle for anything approaching that: the SDK only ever asks for
  * bounded ranges, so nothing else has to hold the asset.
  *
- * Construction moves the whole asset across the boundary once, on the calling thread; the SDK
- * then holds what arrived and answers every read as a window into it. That crossing is the one
- * part of a sign or verify the SDK cannot move off your thread, and neither a ranged source nor
- * [`FileSource`] pays it.
+ * Construction copies the whole asset across the boundary, on the calling thread: about 5ms for
+ * 10 MB, 315ms for 500 MB. That is the one part of a sign or verify the SDK cannot move off your
+ * thread, and neither a ranged source nor [`FileSource`] pays it.
  */
 export declare class MemorySource extends UniffiAbstractObject implements MemorySourceLike {
   readonly [uniffiTypeNameSymbol] = "MemorySource";
@@ -3464,36 +3583,36 @@ export declare class SignerClient extends UniffiAbstractObject implements Signer
    * `options` is malformed. The channel connects lazily, so an unreachable Signer
    * surfaces on the first sign RPC instead.
    */
-  static connect(endpoint: string, options?: ConnectOptions, asyncOpts_?: {
+  static connect(endpoint: string, options: ConnectOptions, asyncOpts_?: {
     signal: AbortSignal;
   }): Promise<SignerClientLike>;
   uniffiDestroy(): void;
   static instanceOf(obj_: any): obj_ is SignerClient;
 }
 /**
- * A stream signer bound to a [`SignerClient`](super::client::SignerClient) and a
+ * A live-stream signer bound to a [`SignerClient`](super::client::SignerClient) and a
  * [`SigningVault`]. Construct once with [`create`](Self::create), then `init` a session and
  * sign every segment through the [`StreamSession`] it returns.
  */
 export interface StreamIssuerLike {
   /**
-   * Open the stream `id`: mint its first session key under `options.rotation_policy`, sign the
-   * init (moov) segment `source` under `options.delivery`, and hand back a [`StreamSession`]
-   * to sign through.
+   * Open the stream at `stream_id`: mint its first session key under
+   * `options.rotation_policy`, sign the init (moov) segment under `options.delivery`, and
+   * hand back a [`StreamSession`] to sign through.
    *
    * On `rotation_due`, call [`StreamIssuer::rotate`], not this.
    *
    * # Errors
    *
-   * Fails on signer RPC failure, a vault error, or a `source` that isn't a BMFF init segment.
+   * Fails on signer RPC failure, a vault error, or an `init_body` that isn't a BMFF init
+   * segment.
    */
-  init(id: string, source: RangeSource, manifest: StreamManifestSpec, options: InitOptions, asyncOpts_?: {
+  init(streamId: string, initBody: RangeSource, manifest: StreamManifestSpec, options: InitOptions, asyncOpts_?: {
     signal: AbortSignal;
   }): Promise<StreamStart>;
   /**
    * Succeed `session` on the stream it already names, signing a fresh init (moov) segment
-   * under a new key and forgetting the outgoing one. Once this succeeds, `session` refuses to
-   * sign; until then it keeps signing, so a failed rotation can be retried.
+   * under a new key and forgetting the outgoing one.
    *
    * The stream id comes from `session`, so a rotation cannot be pointed at the wrong stream,
    * and the retired key cannot be left behind: it would still sign for the rest of its
@@ -3501,10 +3620,9 @@ export interface StreamIssuerLike {
    *
    * # Errors
    *
-   * As [`StreamIssuer::init`], plus `FAILED_PRECONDITION` (`SESSION_ENDED`) for a session
-   * already stopped or rotated, or with a `stop` or `rotate` in flight.
+   * As [`StreamIssuer::init`].
    */
-  rotate(session: StreamSessionLike, source: RangeSource, manifest: StreamManifestSpec, options: InitOptions, asyncOpts_?: {
+  rotate(session: StreamSessionLike, initBody: RangeSource, manifest: StreamManifestSpec, options: InitOptions, asyncOpts_?: {
     signal: AbortSignal;
   }): Promise<StreamStart>;
 }
@@ -3513,7 +3631,7 @@ export interface StreamIssuerLike {
  */
 export type StreamIssuerInterface = StreamIssuerLike;
 /**
- * A stream signer bound to a [`SignerClient`](super::client::SignerClient) and a
+ * A live-stream signer bound to a [`SignerClient`](super::client::SignerClient) and a
  * [`SigningVault`]. Construct once with [`create`](Self::create), then `init` a session and
  * sign every segment through the [`StreamSession`] it returns.
  */
@@ -3527,23 +3645,23 @@ export declare class StreamIssuer extends UniffiAbstractObject implements Stream
    */
   static create(client: SignerClientLike, vault: SigningVault): StreamIssuerLike;
   /**
-   * Open the stream `id`: mint its first session key under `options.rotation_policy`, sign the
-   * init (moov) segment `source` under `options.delivery`, and hand back a [`StreamSession`]
-   * to sign through.
+   * Open the stream at `stream_id`: mint its first session key under
+   * `options.rotation_policy`, sign the init (moov) segment under `options.delivery`, and
+   * hand back a [`StreamSession`] to sign through.
    *
    * On `rotation_due`, call [`StreamIssuer::rotate`], not this.
    *
    * # Errors
    *
-   * Fails on signer RPC failure, a vault error, or a `source` that isn't a BMFF init segment.
+   * Fails on signer RPC failure, a vault error, or an `init_body` that isn't a BMFF init
+   * segment.
    */
-  init(id: string, source: RangeSource, manifest: StreamManifestSpec, options: InitOptions, asyncOpts_?: {
+  init(streamId: string, initBody: RangeSource, manifest: StreamManifestSpec, options: InitOptions, asyncOpts_?: {
     signal: AbortSignal;
   }): Promise<StreamStart>;
   /**
    * Succeed `session` on the stream it already names, signing a fresh init (moov) segment
-   * under a new key and forgetting the outgoing one. Once this succeeds, `session` refuses to
-   * sign; until then it keeps signing, so a failed rotation can be retried.
+   * under a new key and forgetting the outgoing one.
    *
    * The stream id comes from `session`, so a rotation cannot be pointed at the wrong stream,
    * and the retired key cannot be left behind: it would still sign for the rest of its
@@ -3551,26 +3669,24 @@ export declare class StreamIssuer extends UniffiAbstractObject implements Stream
    *
    * # Errors
    *
-   * As [`StreamIssuer::init`], plus `FAILED_PRECONDITION` (`SESSION_ENDED`) for a session
-   * already stopped or rotated, or with a `stop` or `rotate` in flight.
+   * As [`StreamIssuer::init`].
    */
-  rotate(session: StreamSessionLike, source: RangeSource, manifest: StreamManifestSpec, options: InitOptions, asyncOpts_?: {
+  rotate(session: StreamSessionLike, initBody: RangeSource, manifest: StreamManifestSpec, options: InitOptions, asyncOpts_?: {
     signal: AbortSignal;
   }): Promise<StreamStart>;
   uniffiDestroy(): void;
   static instanceOf(obj_: any): obj_ is StreamIssuer;
 }
 /**
- * A per-session ECDSA key store, implemented by the host. `mint` returns a fresh key that will be
- * signed under for the request's `validity_period`, so give it that lifetime and let the store
- * expire it; a new input to minting arrives as a field of `MintRequest`. `sign` produces the raw
- * ECDSA signature over `payload` with the key `kid` names (the SDK frames it into COSE);
- * `forget` drops a retired key. Every method may raise to abort.
+ * A per-session ECDSA key store, implemented by the host. `mint` returns a fresh public key
+ * that will be signed under for `validity_period_secs`, so give it that lifetime and let the
+ * store expire it; `sign` produces the raw ECDSA signature over `payload` (the SDK frames it
+ * into COSE); `forget` drops a retired key. Every method may raise to abort.
  */
 export interface SigningVault {
-  mint(request: MintRequest, asyncOpts_?: {
+  mint(validityPeriodSecs: bigint, asyncOpts_?: {
     signal: AbortSignal;
-  }): Promise<SessionKey>;
+  }): Promise<VaultPublicKey>;
   sign(kid: ArrayBuffer, payload: ArrayBuffer, asyncOpts_?: {
     signal: AbortSignal;
   }): Promise<ArrayBuffer>;
@@ -3627,6 +3743,13 @@ declare const _default$1: Readonly<{
       lift(value: UniffiByteArray): AssetDelivery;
       lower(value: AssetDelivery, alloc: RustBufferAllocator): UniffiByteArray;
     };
+    FfiConverterTypeAssetFormat: {
+      readFromCursor(c: Cursor): AssetFormat;
+      writeIntoCursor(value: AssetFormat, c: Cursor): void;
+      allocationSize(value: AssetFormat): number;
+      lift(value: UniffiByteArray): AssetFormat;
+      lower(value: AssetFormat, alloc: RustBufferAllocator): UniffiByteArray;
+    };
     FfiConverterTypeAssetIssuer: FfiConverterObject<AssetIssuerLike>;
     FfiConverterTypeAssetManifestSpec: {
       readFromCursor(c: Cursor): AssetManifestSpec;
@@ -3643,20 +3766,7 @@ declare const _default$1: Readonly<{
       lift(value: UniffiByteArray): AssetOrigin;
       lower(value: AssetOrigin, alloc: RustBufferAllocator): UniffiByteArray;
     };
-    FfiConverterTypeBlock: {
-      readFromCursor(c: Cursor): Block;
-      writeIntoCursor(value: Block, c: Cursor): void;
-      allocationSize(value: Block): number;
-      lift(value: UniffiByteArray): Block;
-      lower(value: Block, alloc: RustBufferAllocator): UniffiByteArray;
-    };
-    FfiConverterTypeByteRange: {
-      readFromCursor(c: Cursor): ByteRange;
-      writeIntoCursor(value: ByteRange, c: Cursor): void;
-      allocationSize(value: ByteRange): number;
-      lift(value: UniffiByteArray): ByteRange;
-      lower(value: ByteRange, alloc: RustBufferAllocator): UniffiByteArray;
-    };
+    FfiConverterTypeBinder: FfiConverterObjectWithCallbacks<Binder>;
     FfiConverterTypeCode: {
       readFromCursor(c: Cursor): Code;
       writeIntoCursor(value: Code, c: Cursor): void;
@@ -3678,14 +3788,6 @@ declare const _default$1: Readonly<{
       lift(value: UniffiByteArray): ComponentEvent;
       lower(value: ComponentEvent, alloc: RustBufferAllocator): UniffiByteArray;
     };
-    FfiConverterTypeCompute: FfiConverterObjectWithCallbacks<Compute>;
-    FfiConverterTypeComputeRequest: {
-      readFromCursor(c: Cursor): ComputeRequest;
-      writeIntoCursor(value: ComputeRequest, c: Cursor): void;
-      allocationSize(value: ComputeRequest): number;
-      lift(value: UniffiByteArray): ComputeRequest;
-      lower(value: ComputeRequest, alloc: RustBufferAllocator): UniffiByteArray;
-    };
     FfiConverterTypeConnectOptions: {
       readFromCursor(c: Cursor): ConnectOptions;
       writeIntoCursor(value: ConnectOptions, c: Cursor): void;
@@ -3707,6 +3809,13 @@ declare const _default$1: Readonly<{
       lift(value: UniffiByteArray): CustomAction;
       lower(value: CustomAction, alloc: RustBufferAllocator): UniffiByteArray;
     };
+    FfiConverterTypeDeriveOptions: {
+      readFromCursor(c: Cursor): DeriveOptions;
+      writeIntoCursor(value: DeriveOptions, c: Cursor): void;
+      allocationSize(value: DeriveOptions): number;
+      lift(value: UniffiByteArray): DeriveOptions;
+      lower(value: DeriveOptions, alloc: RustBufferAllocator): UniffiByteArray;
+    };
     FfiConverterTypeEmbedOptions: {
       readFromCursor(c: Cursor): EmbedOptions;
       writeIntoCursor(value: EmbedOptions, c: Cursor): void;
@@ -3723,6 +3832,7 @@ declare const _default$1: Readonly<{
     };
     FfiConverterTypeFileSink: FfiConverterObject<FileSinkLike>;
     FfiConverterTypeFileSource: FfiConverterObject<FileSourceLike>;
+    FfiConverterTypeHeldBinder: FfiConverterObject<HeldBinderLike>;
     FfiConverterTypeIdentity: {
       readFromCursor(c: Cursor): Identity;
       writeIntoCursor(value: Identity, c: Cursor): void;
@@ -3737,12 +3847,12 @@ declare const _default$1: Readonly<{
       lift(value: UniffiByteArray): Ingredient;
       lower(value: Ingredient, alloc: RustBufferAllocator): UniffiByteArray;
     };
-    FfiConverterTypeIngredientKind: {
-      readFromCursor(c: Cursor): IngredientKind;
-      writeIntoCursor(value: IngredientKind, c: Cursor): void;
-      allocationSize(value: IngredientKind): number;
-      lift(value: UniffiByteArray): IngredientKind;
-      lower(value: IngredientKind, alloc: RustBufferAllocator): UniffiByteArray;
+    FfiConverterTypeIngredientSource: {
+      readFromCursor(c: Cursor): IngredientSource;
+      writeIntoCursor(value: IngredientSource, c: Cursor): void;
+      allocationSize(value: IngredientSource): number;
+      lift(value: UniffiByteArray): IngredientSource;
+      lower(value: IngredientSource, alloc: RustBufferAllocator): UniffiByteArray;
     };
     FfiConverterTypeInitOptions: {
       readFromCursor(c: Cursor): InitOptions;
@@ -3758,6 +3868,7 @@ declare const _default$1: Readonly<{
       lift(value: UniffiByteArray): InitOutcome;
       lower(value: InitOutcome, alloc: RustBufferAllocator): UniffiByteArray;
     };
+    FfiConverterTypeIsccBinder: FfiConverterObject<IsccBinderLike>;
     FfiConverterTypeJsonObject: FfiConverter<UniffiByteArray, string>;
     FfiConverterTypeJsonValue: FfiConverter<UniffiByteArray, string>;
     FfiConverterTypeMarkOptions: {
@@ -3776,13 +3887,6 @@ declare const _default$1: Readonly<{
     };
     FfiConverterTypeMemorySink: FfiConverterObject<MemorySinkLike>;
     FfiConverterTypeMemorySource: FfiConverterObject<MemorySourceLike>;
-    FfiConverterTypeMintRequest: {
-      readFromCursor(c: Cursor): MintRequest;
-      writeIntoCursor(value: MintRequest, c: Cursor): void;
-      allocationSize(value: MintRequest): number;
-      lift(value: UniffiByteArray): MintRequest;
-      lower(value: MintRequest, alloc: RustBufferAllocator): UniffiByteArray;
-    };
     FfiConverterTypeOpenedOrigin: {
       readFromCursor(c: Cursor): OpenedOrigin;
       writeIntoCursor(value: OpenedOrigin, c: Cursor): void;
@@ -3790,8 +3894,22 @@ declare const _default$1: Readonly<{
       lift(value: UniffiByteArray): OpenedOrigin;
       lower(value: OpenedOrigin, alloc: RustBufferAllocator): UniffiByteArray;
     };
+    FfiConverterTypeOrigin: {
+      readFromCursor(c: Cursor): Origin;
+      writeIntoCursor(value: Origin, c: Cursor): void;
+      allocationSize(value: Origin): number;
+      lift(value: UniffiByteArray): Origin;
+      lower(value: Origin, alloc: RustBufferAllocator): UniffiByteArray;
+    };
     FfiConverterTypeRangeSink: FfiConverterObjectWithCallbacks<RangeSink>;
     FfiConverterTypeRangeSource: FfiConverterObjectWithCallbacks<RangeSource>;
+    FfiConverterTypeRegion: {
+      readFromCursor(c: Cursor): Region;
+      writeIntoCursor(value: Region, c: Cursor): void;
+      allocationSize(value: Region): number;
+      lift(value: UniffiByteArray): Region;
+      lower(value: Region, alloc: RustBufferAllocator): UniffiByteArray;
+    };
     FfiConverterTypeRotationPolicy: {
       readFromCursor(c: Cursor): RotationPolicy;
       writeIntoCursor(value: RotationPolicy, c: Cursor): void;
@@ -3799,13 +3917,6 @@ declare const _default$1: Readonly<{
       lift(value: UniffiByteArray): RotationPolicy;
       lower(value: RotationPolicy, alloc: RustBufferAllocator): UniffiByteArray;
     };
-    FfiConverterTypeScope: {
-      readFromCursor(c: Cursor): Scope;
-      writeIntoCursor(value: Scope, c: Cursor): void;
-      allocationSize(value: Scope): number;
-      lift(value: UniffiByteArray): Scope;
-      lower(value: Scope, alloc: RustBufferAllocator): UniffiByteArray;
-    };
     FfiConverterTypeSdkError: {
       readFromCursor(c: Cursor): SdkError;
       writeIntoCursor(value: SdkError, c: Cursor): void;
@@ -3827,13 +3938,6 @@ declare const _default$1: Readonly<{
       lift(value: UniffiByteArray): SegmentOutcome;
       lower(value: SegmentOutcome, alloc: RustBufferAllocator): UniffiByteArray;
     };
-    FfiConverterTypeSessionKey: {
-      readFromCursor(c: Cursor): SessionKey;
-      writeIntoCursor(value: SessionKey, c: Cursor): void;
-      allocationSize(value: SessionKey): number;
-      lift(value: UniffiByteArray): SessionKey;
-      lower(value: SessionKey, alloc: RustBufferAllocator): UniffiByteArray;
-    };
     FfiConverterTypeSignOptions: {
       readFromCursor(c: Cursor): SignOptions;
       writeIntoCursor(value: SignOptions, c: Cursor): void;
@@ -3863,20 +3967,6 @@ declare const _default$1: Readonly<{
       lift(value: UniffiByteArray): SoftBinding;
       lower(value: SoftBinding, alloc: RustBufferAllocator): UniffiByteArray;
     };
-    FfiConverterTypeSoftBindingSource: {
-      readFromCursor(c: Cursor): SoftBindingSource;
-      writeIntoCursor(value: SoftBindingSource, c: Cursor): void;
-      allocationSize(value: SoftBindingSource): number;
-      lift(value: UniffiByteArray): SoftBindingSource;
-      lower(value: SoftBindingSource, alloc: RustBufferAllocator): UniffiByteArray;
-    };
-    FfiConverterTypeSoftwareAgent: {
-      readFromCursor(c: Cursor): SoftwareAgent;
-      writeIntoCursor(value: SoftwareAgent, c: Cursor): void;
-      allocationSize(value: SoftwareAgent): number;
-      lift(value: UniffiByteArray): SoftwareAgent;
-      lower(value: SoftwareAgent, alloc: RustBufferAllocator): UniffiByteArray;
-    };
     FfiConverterTypeStandardAction: {
       readFromCursor(c: Cursor): StandardAction;
       writeIntoCursor(value: StandardAction, c: Cursor): void;
@@ -3899,13 +3989,6 @@ declare const _default$1: Readonly<{
       lift(value: UniffiByteArray): StreamManifestSpec;
       lower(value: StreamManifestSpec, alloc: RustBufferAllocator): UniffiByteArray;
     };
-    FfiConverterTypeStreamOrigin: {
-      readFromCursor(c: Cursor): StreamOrigin;
-      writeIntoCursor(value: StreamOrigin, c: Cursor): void;
-      allocationSize(value: StreamOrigin): number;
-      lift(value: UniffiByteArray): StreamOrigin;
-      lower(value: StreamOrigin, alloc: RustBufferAllocator): UniffiByteArray;
-    };
     FfiConverterTypeStreamSession: FfiConverterObject<StreamSessionLike>;
     FfiConverterTypeStreamStart: {
       readFromCursor(c: Cursor): StreamStart;
@@ -3921,14 +4004,15 @@ declare const _default$1: Readonly<{
       lift(value: UniffiByteArray): Thumbnail;
       lower(value: Thumbnail, alloc: RustBufferAllocator): UniffiByteArray;
     };
-    FfiConverterTypeTimespan: {
-      readFromCursor(c: Cursor): Timespan;
-      writeIntoCursor(value: Timespan, c: Cursor): void;
-      allocationSize(value: Timespan): number;
-      lift(value: UniffiByteArray): Timespan;
-      lower(value: Timespan, alloc: RustBufferAllocator): UniffiByteArray;
-    };
+    FfiConverterTypeTimestamp: FfiConverter<UniffiByteArray, string>;
     FfiConverterTypeUrl: FfiConverter<UniffiByteArray, string>;
+    FfiConverterTypeVaultPublicKey: {
+      readFromCursor(c: Cursor): VaultPublicKey;
+      writeIntoCursor(value: VaultPublicKey, c: Cursor): void;
+      allocationSize(value: VaultPublicKey): number;
+      lift(value: UniffiByteArray): VaultPublicKey;
+      lower(value: VaultPublicKey, alloc: RustBufferAllocator): UniffiByteArray;
+    };
   };
 }>;
 //#endregion