cose library

COSE signed transport for CrateStack Dart/Flutter clients (ADR 0006, cratestack#1026): seal a request and open a response with cratestack-cose, the one Rust implementation, reached through the same backends as the CBOR codec: flutter_rust_bridge natively and the cratestack-cbor-wasm build on the web. Nothing here implements COSE or any crypto in Dart.

Import it next to the codec; a codec-only app imports nothing new:

import 'package:cratestack_cbor/cose.dart';

final envelope = await ClientEnvelope.create(
  signer: Ed25519Signer.fromSeed(seed),
  serverKeys: [CoseServerKey.ed25519(serverPublicKey)],
  audience: 'payments',
);

Errors. Everything the Rust side refuses is a CoseException (a sealed class: CoseRejected, CoseMisuse, and the signer variants). Dart-side argument checks that cannot be right are ArgumentError, thrown by the constructors of the key and binding types before any bridge call, and ClientEnvelope.contractHeaderValue before the backend has started is a StateError.

This client is Required-only, like the Rust client: it seals every request and opens only responses to a sealed request.

Classes

CallBinding

The inputs a call's signature is bound to (ADR 0006 §4). The audience is the envelope's, not the call's.

ClientEnvelope

Seals requests and opens responses for one service (ADR 0006).

CoseServerKey

A key the server's responses verify with, pinned at enrolment.

CoseSigner

Who signs a request. Sealed: the signers of this release hold their key in memory; a key in the Android Keystore or the Secure Enclave comes with the callback signer of a later release.

Ed25519Signer

Signs a COSE_Sign1 with the Ed25519 key of a 32-byte seed.

HmacSigner

Signs a COSE_Mac0 with a shared secret of at least 32 random bytes.

Opened

A response that verified.

Enums

CoseAlg

The four algorithms of ADR 0006 §2.

CoseMode

The message structure an envelope emits and accepts.

Exceptions / Errors

CoseException

Why sealing a request or opening a response failed.

CoseMisuse

The caller or its configuration is wrong: a key of the wrong length, an empty audience, a binding of the wrong shape.

CoseRejected

The message did not verify (the coarse 401): a tampered body, a wrong key, a response to another request, a stale or replayed message. Never says which.

CoseSignerCancelled

The person dismissed the keystore's prompt. Produced by a keystore signer, which a later release adds.

CoseSignerFailed

The keystore failed. Produced by a keystore signer, which a later release adds.

CoseSignerTimedOut

The keystore did not answer in time. Produced by a keystore signer, which a later release adds.