appplayer_secure_core 0.1.0

Pure-Dart security primitives — signatures, secure-storage ports, cryptography, trust chains, audit logging, mutual-auth ports, and at-rest sealing. No Flutter dependency.

0.1.0 - 2026-07-30 - First publish

Pure-Dart core extracted from appplayer_secure 0.1.1, unchanged in behaviour. It exists so a headless host can use the security primitives: the package it was extracted from declares flutter, flutter_secure_storage and local_auth, which a Dart-only image cannot resolve.

Added

• The seven primitive modules (SIGN · STORE · CRYPTO · TRUST · AUDIT · MAUTH · BIO), shared types and errors, the role enums, the audit event catalog, and both sealers — relocated from appplayer_secure, byte-identical apart from import paths. MAUTH is port-only; see below.
• UnavailableBiometricAdapter — reports biometrics as unavailable and refuses every authentication, for hosts with no OS prompt.
• UnavailableMutualAuth — the same shape for MutualAuth: every operation throws SecErrorCode.mauthUnavailable (new code) rather than returning a session. endSession is the exception and is a no-op, because making teardown throw would mask whatever failure sent the caller there.
• DefaultCryptoProvider and InMemoryTrustChainValidator are now exported. They were reachable only by importing src/, which every consumer that needed a concrete provider was doing.

Not included — mutual-auth implementation

DefaultMutualAuth is not in this package. Admitting a security device is part of the MCP security scheme and is public; the session handshake layered on top of it — challenge-response, key agreement, session encryption — is an additional algorithm and is confidential. The implementation lives in appplayer_secure_mauth, which is not published and sits in a private repository, so repository access gates who can build against it.

The port (MutualAuth, MAuthPeer, MAuthResult) stays here: a consumer can express that a session layer exists, and receives UnavailableMutualAuth until one is supplied.

Notes

Extracting the core also fixed a coupling that was invisible while everything lived together: several internal libraries imported their own package's barrel rather than the files they needed, which pulled Flutter into pure cryptography — PassphraseSealer could not be compiled without the Flutter SDK despite using none of it. Imports are narrowed here.