at_client_mixins library

Classes

AtClientEnvelopeSigner
The signing and verifying half of the secret-sharing substrate, on its own: ApkamSigning and EnvelopeSigning sign a payload with this client's APKAM keypair and verify another client's signature against the _apsk its enrollment published, without pulling in a whole secret-sharing instance.
AtClientInvitations
Invitations for one client: the way an app or a CLI uses them.
AtClientSecretSharing
Ready-made composition of the same-atSign secret-sharing mixins, for apps that don't want to mix them into their own classes.
CreatedInvitation
What Invitations.invite hands back for the inviter to send, out of band.
EnrollmentDirectory
The atServer-backed directory of per-enrollment key packages.
EnrollmentUpdater
An approved enrollment amending its own record: enroll:update.
EnrollmentUpdateRequest
What an approved enrollment is asking to change about its own record, through enroll:update.
InvitationAcceptance
An invitee's answer to an invitation, shared with the inviter.
InvitationConnection
The inviter's confirmation of an accepted invitation, shared with the invitee, carrying the content key when there is content.
InvitationKey
An invitation's content key: AES-256-GCM, minted when the invitation is created and released to the invitee only once they have accepted.
What an invitation link carries: who sent it, and which invitation.
InvitationPreview
What an invitation's public preview record holds.
KeyPackage
The KEM recipient key(s) one APKAM keypair advertises so that other clients of the same atSign can seal secrets to it.
NamespaceMember
One enrollment authorised for a namespace, as returned by EnrollmentDirectory.listForNamespace: its access level and the key package of its APKAM keypair.
PackageKey
One public key advertised in a KeyPackage.
PersistedApkamKeys
This APKAM keypair's enc keypairs, persisted (by an app callback) across restarts.
PersistedEncKey
One of this APKAM keypair's enc keypairs, as it is persisted.
ReceivedEnvelope
A decrypted, signature-verified payload received from another APKAM keypair of the same atSign.
ReceivedInvitation
An invitation this atSign received. Only this atSign reads it.
ReceivedSecret
A Secret another APKAM keypair of this atSign shared with this client.
SealedInvitationContent
Content encrypted under an invitation's content key.
Secret
A named secret, scoped to an application namespace.
SecretEnvelope
The encrypted payload one client of an atSign sends to another (addressed to a specific APKAM keypair). The whole envelope is additionally wrapped in an APKAM signature (see EnvelopeSigning) which receivers verify before decrypting.
SecretSharingAlgos
Registry of the algorithm identifiers used in per-APKAM key packages and secret envelopes.
SecretStore
In-memory store of the secrets this atSign's APKAM keypair holds, keyed by (namespace, name).
SecretStorePersistence
Supplied by the app to persist the SecretStore beyond the process lifetime (platform keystore, biometric storage, etc. — the app's concern). Without one, the store is in-memory only.
SentInvitation
An invitation this atSign sent. Only this atSign reads it.
SignedEnvelope
A signed envelope: RFC 7515 general JSON serialization, and the only shape this build signs or verifies.
VerbEnrollmentDirectory
EnrollmentDirectory backed by the atServer's enroll:listns and enroll:infons verbs, which take the same authorisation.

Enums

InvitationOutcome
What happened to one acceptance in an Invitations.processAcceptances pass.
KeyPackageStatus
Why a NamespaceMember has no usable key package — or that it has one.
ReceivedInvitationStatus
Where a received invitation has got to.
SentInvitationStatus
Where a sent invitation has got to.

Mixins

ApkamSigning
AtClientBindings
EnvelopeSigning
Wraps payloads in signed JSON envelopes, and verifies envelopes created by other clients of the same or another atSign.
Invitations
Invitations between atSigns, including to someone who has no atSign yet.
KeyPackageRegistration
Maintains this APKAM keypair's KeyPackage for same-atSign secret sharing.
PairwiseSecretSharing
Pairwise encrypted payload exchange between APKAM keypairs of the same atSign.

Extension Types

KeyEntryStatus
Whether an advertised key entry is still offered for new operations.

Constants

enrollmentApkamSymmetricKeySecretName → const String
The reserved Secret name under which an approver conveys a new enrollment's apkamSymmetricKey.
firstEnrollmentAppName → const String
The app an atSign's FIRST enrollment names when nothing else does.
firstEnrollmentDeviceName → const String
The device an atSign's FIRST enrollment names when nothing else does.

Functions

enrollmentApkamSymmetricKeyResolver(String atSign, {Duration timeout = const Duration(seconds: 30), Duration pollInterval = const Duration(seconds: 2)}) → Stream<String> Function(AtKeys, AtLookUp)
Offers each apkamSymmetricKey an approver encapsulated to this enrollment's key package, once, as it is found.
enrollmentKeyPackageBuilder(String atSign, {DateTime? createdAt, SigningAlgoType signingAlgo = SigningAlgoType.rsa2048, String keyEstablishmentAlgo = SecretSharingAlgos.xWing, ({SigningAlgoType algorithm, String privateKey, String publicKey})? advertisedSigningKey}) → Future<Map<String, dynamic>?> Function(AtKeysIo)
Builds the signed key package that rides an enroll:request, and records its private half in the AtKeys the enrollment will persist.
invitationPreviewKey(Atsign inviter, String id, String namespace) → AtKey
Where inviter publishes the preview of invitation id: public:_<id>.invitations.<namespace><inviter>.
mintAdvertisedSigningKey(Set<SigningAlgoType> inUse) → Future<({SigningAlgoType algorithm, String privateKey, String publicKey})?>
A freshly minted data signing keypair for an enrollment being created, or null when inUse names none.
mintSigningRootAfterActivation(AtClient client, {required AtKeysIo atKeysIo}) → Future<void>
Creates the atSign-level ML-DSA-65 signing root at public:pq_signing_root@<atSign>, if it is not already there.
pqNativeActivationMaterial({required String atSign, required Set<SigningAlgoType> dataSigningKeyAlgorithms, String keyEstablishmentAlgo = SecretSharingAlgos.xWing}) → Future<PqNativeActivationMaterial>
Mints everything that makes an activation PQ-native beyond its ML-DSA-65 APKAM: a data signing key the enrollment owns from birth, and the first enrollment's key package, both on the enroll:request that creates the record.
pqNativeOnboard({required String atSign, required String cramSecret, required AtClientPreference preference, required AtKeysIo atKeysIo, String appName = firstEnrollmentAppName, String deviceName = firstEnrollmentDeviceName, bool? mintLegacyMaterial, AtClientManager? manager, required AtClientStorage storage, AtLookupMuxable? atLookUp, required AtLookUpFactory lookUps, required SecondaryAddressFinder secondaryAddressFinder}) → Future<AtClientManager>
CRAM-activates a brand-new atSign PQ-native and hands back a manager whose current client runs under its first enrollment.
rememberOwnLinkedKids(AtClient client, Set<String> kids) → void
Records kids as the keys client's own enrollment has a link for, which ApkamSigning.signingKeys then prefers.
retrofitIdentity({required AtAuthSession session, required AtClientPreference preference, required String appName, required String deviceName, required Map<String, String> namespaces, Duration? apkamKeysExpiryDuration, SigningAlgoType? signingAlgo, AtLookUp? atLookUp, required AtLookUpFactory lookUps, required SecondaryAddressFinder secondaryAddressFinder}) → Future<AtAuthSession>
The identity half of a self-retrofit: submit the enrollment, check the keyfile names the new id, and hand back the session that carries it. No client is built, nothing authenticates, and no AtClientManager is touched.
selfRetrofit({required AtAuthSession session, required AtClientPreference preference, required String appName, required String deviceName, required Map<String, String> namespaces, Duration? apkamKeysExpiryDuration, SigningAlgoType? signingAlgo, required AtClientStorage storage, AtLookUp? atLookUp, required AtLookUpFactory lookUps, required SecondaryAddressFinder secondaryAddressFinder, Duration connectBudget = AtConnection.defaultBudget}) → Future<AtClient>
Runs the whole PQ self-retrofit and hands back a client running under the NEW enrollment, which the caller owns.
serialiseApskWrite<T>(AtClient client, Future<T> action()) → Future<T>
Runs action with no other _apsk write for client interleaved.
verifyAdvertisedKeyPackage(Object? advertised, {required AtClientEnvelopeSigner signer, required String signerAtSign, required String enrollmentId, String? apkamId}) → Future<(KeyPackage?, KeyPackageStatus)>
Verifies an advertised key package against the _apsk of the enrollment whose record carries it, and says why if it is unusable.
withdrawnApskLocation(AtClient atClient, String atSign, String enrollmentId) → Future<String?>
Where enrollmentId's _apsk went when it is not at .a.__e: r.__e when the enrollment was revoked or superseded, d.__e when it was deleted or expired, or null when neither location holds it.

Typedefs

PqNativeActivationMaterial = ({({SigningAlgoType algorithm, String privateKey, String publicKey})? advertisedSigningKey, FutureOr<Map<String, dynamic>?> Function(AtKeysIo keysIo) metadataBuilder})
What a post-quantum activation puts on the request that creates the atSign's first enrollment: a data signing key the enrollment owns from birth, and the builder of the key package signed with that same key.
SecretRequestPolicy = FutureOr<bool> Function(ReceivedEnvelope request, KeyPackage requester)
Decides whether to answer an inbound kind:'request' secret pull from requester (already resolved + authorized as a key package of the request's namespace). Return true to share the requested held secrets, false to ignore. Set PairwiseSecretSharing.answerSecretRequests to override the default (answer any authorized same-atSign requester — the atServer already gates deliverability by namespace).

Exceptions / Errors

WithdrawnSigningKeyException
A signature refused because the signer's _apsk is no longer at .a.__e: the atServer moved it to location — r.__e when the enrollment was revoked or superseded, d.__e when it was deleted or expired.