NtsClient class

Owned NTS client handle.

Each NtsClient owns its own per-host session table on the Rust side, so two instances never share cookie or key state. The top-level convenience functions ntsQuery and ntsWarmCookies continue to delegate to a process-wide default client whose state is shared across all callers (the same behaviour as 1.x / 2.x); construct an explicit NtsClient when you need:

• Test isolation, so one test's cached sessions do not bleed into another's.
• On-demand cache invalidation via invalidate (per-host) or clear (everything), e.g. for diagnostics tools that want to force a fresh NTS-KE handshake.
• Scope-bounded session ownership, so the cache lives only as long as the owning client and is bounded to the hosts that client is interested in.

The client is safe to share across same-isolate async callers; the underlying Rust table is mutex-guarded, so concurrent await-ed calls on a single client serialize only for the brief window each cache lookup needs.

The handle wraps a flutter_rust_bridge RustOpaque that owns a finalizable native Arc, which is not sendable across isolate boundaries through a SendPort — a different isolate must construct its own NtsClient (which gets its own independent session table) rather than receiving one minted on the main isolate. The session table is owned by the NtsClient handle, not by the isolate; the top-level ntsQuery / ntsWarmCookies functions delegate to a process-wide default client whose table is shared across every isolate that calls them. There is no clone-as-sendable-token API on the public surface today.

Initialization: await NtsRustLib.init() from package:nts/src/ffi/frb_generated.dart must have completed before the NtsClient default constructor or any of its methods is called — the constructor synchronously dispatches through the FRB bridge to mint the underlying Rust handle, and the methods reach the same dispatch table. This is the same initialization step the top-level ntsQuery / ntsWarmCookies functions require; see the library-level dartdoc on package:nts/nts.dart for the full bootstrap walk-through.

Constructors

NtsClient({TrustMode trustMode = TrustMode.platformWithFallback, List<int>? customRoots})

Construct a fresh client whose session table starts empty. Two clients constructed this way never share session state with each other or with the process-wide default used by the top-level ntsQuery / ntsWarmCookies functions.

factory

Properties

hashCode → int

The hash code for this object.

no setter, inherited

runtimeType → Type

A representation of the runtime type of the object.

no setter, inherited

trustMode → TrustMode

Trust-anchor policy this client was constructed with. Synchronous: backed by a one-byte read on the Rust side.

no setter

Methods

clear() → void

Drop every cached session in this client's table. Cheap; intended for test cleanup and for apps that want to bound long-lived process memory by resetting the cache between work batches.

getTime({required NtsServerSpec spec, DateTime? verificationTime, int? verificationTimeMs}) → Future<NtsSyncedTime>

Per-client equivalent of the top-level ntsGetTime: one-call synchronized clock built on warmCookies + a burst of query calls against this client's own session table.

invalidate(NtsServerSpec spec) → bool

Drop this client's cached session for spec's host:port, if any. Returns true when an entry was removed, false when no session was cached for that key. The next query or warmCookies for that spec triggers a fresh NTS-KE handshake.

noSuchMethod(Invocation invocation) → dynamic

Invoked when a nonexistent method or property is accessed.

inherited

query({required NtsServerSpec spec, Duration timeout = kDefaultTimeout, int? timeoutMs, int dnsConcurrencyCap = kDefaultDnsConcurrencyCap, int bridgeConcurrencyCap = kDefaultBridgeConcurrencyCap, DateTime? verificationTime, int? verificationTimeMs}) → Future<NtsTimeSample>

Per-client equivalent of the top-level ntsQuery. The cookie pool, AEAD keys, and KE session live in this client's table; on the first call (or after the cookie pool is exhausted) a full NTS-KE handshake runs, then subsequent calls reuse the cached session.

toString() → String

A string representation of this object.

inherited

warmCookies({required NtsServerSpec spec, Duration timeout = kDefaultTimeout, int? timeoutMs, int dnsConcurrencyCap = kDefaultDnsConcurrencyCap, int bridgeConcurrencyCap = kDefaultBridgeConcurrencyCap, DateTime? verificationTime, int? verificationTimeMs}) → Future<NtsWarmCookiesOutcome>

Per-client equivalent of the top-level ntsWarmCookies. Forces a fresh NTS-KE handshake and ingests the delivered cookie pool into this client's table, replacing any previously cached session for the spec.

Operators

operator ==(Object other) → bool

The equality operator.

inherited