appplayer_secure 0.1.2

AppPlayer security library (merged) — domain-neutral primitives (SIGN/STORE/CRYPTO/TRUST/AUDIT/MAUTH/BIO) + AppPlayer domain layer (roles/events/facade).

0.1.2 - 2026-07-30 - Core extracted to appplayer_secure_core

No public API change. Every name keeps its spelling and its call form; import 'package:appplayer_secure/appplayer_secure.dart' still resolves all of them. Existing consumers upgrade with no code edit.

Changed

• The domain-neutral primitives (SIGN · STORE · CRYPTO · TRUST · AUDIT · MAUTH · BIO, shared types and errors, role enums, event catalog, both sealers) moved to the new pure-Dart package appplayer_secure_core, which this package depends on and re-exports.

  This package keeps what needs Flutter: FlutterSecureStorageBackend, DefaultBiometricAdapter, AppPlayerRootCAs (including fromAsset) and the AppPlayerSecure facade.

  The split exists so a headless host can use the primitives. This package declares flutter, flutter_secure_storage and local_auth, which a Dart-only image cannot resolve — and no arrangement of entry points changes that, because resolution follows the pubspec, not the imports.

Added

• UnavailableBiometricAdapter (via the core) — reports biometrics as unavailable and refuses every authentication.

0.1.1 - 2026-06-28

Added

• PassphraseSealer — seals/unseals a Map<String, String> under an operator passphrase (PBKDF2-HMAC-SHA256, 210k iterations → ChaCha20-Poly1305 AEAD), producing a portable, opaque base64 blob with the KDF salt + AEAD nonce embedded. Unlike AtRestSealer — whose symmetric key lives only in the machine keychain and cannot leave the device — the key is derived purely from the passphrase, so a sealed blob can be migrated to another machine and reopened with the same passphrase (e.g. operational-credential portability). Exported from the barrel. Additive — no existing surface changed.

0.1.0 - 2026-06-18 - Initial publish

Added

• Domain-neutral security primitives: signature · secure_storage · cryptography · trust_chain · audit · mutual_auth · biometric, plus shared types / error.
• AppPlayer domain layer: roles (SignerRole / TrustRole + MakeMind Root CA registry), events (AuditEvent catalog), AppPlayerSecure facade.
• First publish — merges the former secure primitives and appplayer_secure domain wrapper into one package.