appplayer_secure 0.1.3

AppPlayer security library (merged) — domain-neutral primitives (SIGN/STORE/CRYPTO/TRUST/AUDIT/MAUTH/BIO) + AppPlayer domain layer (roles/events/facade).

appplayer_secure

AppPlayer security library — the Flutter-facing layer.

The domain-neutral primitives live in appplayer_secure_core, which is pure Dart. This package depends on it, re-exports it, and adds the parts that need Flutter, so a Flutter host depends on this one package and sees both halves.

A headless host — a server, CLI or test harness — depends on appplayer_secure_core instead and never pulls the Flutter SDK into its dependency graph.

• Primitives (domain-neutral): SIGN · STORE · CRYPTO · TRUST · AUDIT · MAUTH · BIO, plus shared types / error. Callers may use these directly with their own role/event types.
• AppPlayer domain layer: roles (SignerRole / TrustRole enums + MakeMind Root CA registry), events (AppPlayer AuditEvent catalog), and a single AppPlayerSecure facade (seal/open, sign/verify chains, mutual auth).

What this package adds on top of the core:

FlutterSecureStorageBackend	SecureStorage over the OS keychain (flutter_secure_storage)
DefaultBiometricAdapter	BiometricAdapter over the OS prompt (local_auth)
AppPlayerRootCAs	Root CA registry, including fromAsset
AppPlayerSecure	the facade that assembles all of it

Both platform bindings are injectable seams — override them in tests with the in-memory / unavailable adapters from the core.

Quick use

import 'package:appplayer_secure/appplayer_secure.dart';

final secure = AppPlayerSecure.production();
final sealed = await secure.seal('vault', utf8.encode('secret'));
final opened = await secure.open('vault', sealed);

The host typically exposes this as the secure.* capability (see the secure_capability recipe) rather than depending on it directly.

Modules

Area	Responsibility
signature	sign / verify, multi-signer chains
secure_storage	at-rest sealed storage (keychain / in-memory backends)
cryptography	AEAD / hashing / KDF providers
trust_chain	certificate chain + CRL validation
audit	tamper-evident audit log (BLAKE3 hash chain)
mutual_auth	peer mutual authentication
biometric	Face ID / Touch ID / fingerprint / Windows Hello
roles · events · facade	AppPlayer domain layer