register method

Future<KeyPackage> register()

Generates (or loads, via loadApkamKeys) this APKAM keypair's KEM enc keypair and publishes its APKAM signing key (so peers can verify its envelopes), then returns this client's KeyPackage. Idempotent.

The returned key package is conveyed into the enrollment record by riding enroll:request as opaque EnrollParams.metadata at enrollment time — no directory call writes it, and the only later route into the record is the enrollment's own enroll:update. Peers then discover it via the gated enroll:listns verb.

Implementation

Future<KeyPackage> register() async {
  if (_encKeys.isEmpty) {
    final loaded = await loadApkamKeys?.call();
    if (loaded == null) {
      _encKeys.add(await _mintEncKey(configuredKeyAlgo));
      await saveApkamKeys?.call(PersistedApkamKeys(encKeys: [
        for (final held in _encKeys)
          PersistedEncKey(
              encSeed: base64Encode(held.seed),
              keyAlgo: held.keyAlgo,
              status: held.status),
      ]));
    } else {
      if (loaded.encKeys.isEmpty) {
        throw StateError(
            'loadApkamKeys returned a holding with no keys in it. An app '
            'with nothing to restore returns null, which mints a fresh key; '
            'an empty list says "these are the keys" and names none, and '
            'minting one anyway would answer at an address this enrollment '
            'never advertised.');
      }
      for (final entry in loaded.encKeys) {
        _encKeys.add(await _expandEncKey(entry));
      }
    }
  }
  await publishPublicSigningKey();
  _registered = true;
  logger.info('Prepared $encKeyAlgo key package for enrollment '
      '$enrollmentId (kpid $kpid, ${_encKeys.length} key(s) held)');
  return myKeyPackage;
}