mintSigningRootAfterActivation function

Future<void> mintSigningRootAfterActivation(
  1. AtClient client, {
  2. required AtKeysIo atKeysIo,
})

Creates the atSign-level ML-DSA-65 signing root at public:pq_signing_root@<atSign>, if it is not already there.

Swallows its own failure: the activation has already succeeded by the time this runs, a root minted later heals nothing worse than a delay, and failing the caller over it would leave a live atSign reported as unactivated with a CRAM secret already spent.

client must be authenticated as the atSign's first enrollment, which the atServer grants __manage — that is what entitles it to create the root at all.

Implementation

Future<void> mintSigningRootAfterActivation(
  AtClient client, {
  required AtKeysIo atKeysIo,
}) async {
  try {
    await PqSigningRoot(client, keysIo: atKeysIo)
        .mintIfAbsent(isFullyPrivileged: true);
  } catch (e) {
    _logger.warning('${client.getCurrentAtSign()} activated but its '
        'signing-root step did not complete; a start-time pull or a later '
        'mint retries it: $e');
  }
}