KeyPackage class

The X-Wing recipient key(s) one APKAM keypair advertises so that other clients of the same atSign can seal secrets to it.

The recipient unit is the APKAM keypair, not a client process. Enrollment cardinality is 1:1:1 — one enrollment has exactly one APKAM keypair and therefore exactly one key package — so a key package is identified by its enrollmentId (with apkamId carried alongside for reference).

Key packages are enrollment-internal — they live in the enrollment record, conveyed there by riding enroll:request as opaque EnrollParams.metadata at enrollment time, and are discovered only via the gated enroll:listns verb (see EnrollmentDirectory). They are not published as ordinary at-keys. Per the ratified design the advertised key package is wrapped in an APKAM-signed envelope by its generating enrollment and verified against that enrollment's _apsk — the same path same-atSign and cross-atSign — so the encapsulation target is authenticated, not merely server-vouched. (Signing/verifying the advertised package is not yet implemented here — today it is advertised unsigned; per-envelope __ssenv messages are already APKAM-signed, see EnvelopeSigning.)

The wire form is the value stored at metadata.keyPackage in the enrollment record (toJson / fromPayload); enrollmentId and apkamId are carried by the enclosing verb structure, not duplicated in the payload.

Annotations

• @experimental

Constructors

KeyPackage({required String enrollmentId, String? apkamId, required DateTime createdAt, required List<PackageKey> keys, int v = currentVersion})

Properties

apkamId → String?

The APKAM keypair this key package belongs to, as reported by the verb (the enrollment's apkamPubKey). Null on a key package this client builds for its own enrollment — identity is carried by the enclosing enrollment.

final

createdAt → DateTime

final

enrollmentId → String

The enrollment this key package belongs to.

final

hashCode → int

The hash code for this object.

no setter, inherited

keys → List<PackageKey>

final

kpid → String?

The addressing token for this key package: the kid of its enc-use key (the X-Wing public key a sender seals to). Null if the package advertises no key for SecretSharingAlgos.keyAlgos.

no setter

runtimeType → Type

A representation of the runtime type of the object.

no setter, inherited

v → int

final

Methods

bestKeyFor(List<String> supportedAlgos, {String use = SecretSharingAlgos.useEnc}) → PackageKey?

The first key in supportedAlgos order (strongest first) that this key package advertises for use. Returns null if the package and supportedAlgos have no algorithm in common.

noSuchMethod(Invocation invocation) → dynamic

Invoked when a nonexistent method or property is accessed.

inherited

toJson() → Map<String, Object?>

The value stored at metadata.keyPackage — the payload only. enrollmentId / apkamId are carried by the enclosing verb structure (the enrollment and its APKAM-keypair entry), not repeated here.

toString() → String

A string representation of this object.

inherited

Operators

operator ==(Object other) → bool

The equality operator.

inherited

Static Methods

fromPayload(Object? payload, {required String enrollmentId, String? apkamId}) → KeyPackage

Parses a stored key-package payload (from metadata.keyPackage), injecting the enrollmentId / apkamId the enclosing verb structure carried. Skips malformed entries in keys rather than throwing — a payload written by a newer client may carry key entries (or extra fields) this version does not understand.

Constants

currentVersion → const int