infusion_ffi 1.3.10

Public Flutter FFI plugin for Infusion (core closed-source). Mobile uses prebuilt AAR/Pod; desktop downloads prebuilt binaries from GitHub Releases.

infusion_ffi

Public Flutter FFI plugin for Infusion without Rust sources.

• Android: downloads prebuilt AAR from GitHub Releases v1.0.0
• iOS: downloads prebuilt .xcframework from GitHub Releases v1.0.0 during pod install
• Desktop: downloads prebuilt binaries from GitHub Releases v1.0.0 on first use

Core code remains private. This repository exposes only the public Dart/Flutter wrapper and minimal platform glue.

Usage

dependencies:
  infusion_ffi: ^1.0.0

On desktop, ensure releases host platform binaries named:

• macOS: libinfusion_ffi.dylib
• Linux: libinfusion_ffi.so
• Windows: infusion_ffi.dll

API

Import and call the loader before FFI symbol lookups:

import 'package:infusion_ffi/infusion_ffi.dart';

final lib = await InfusionLoader.load();

Testing / Local Development

If the automatic library loader fails (e.g. during flutter test), you must manually specify the path to the shared library using the INFUSION_LIB_PATH environment variable:

export INFUSION_LIB_PATH=/path/to/libinfusion_ffi.dylib  # or .so / .dll
flutter test

Advanced Security

Encryption (Seal/Open)

Encrypt data into a sealed "frame" that contains the ciphertext, an authentication tag (AEAD), and metadata headers (like algorithm ID and key derivation info).

// Seal (Encrypt)
final plaintext = Uint8List.fromList(utf8.encode('Top Secret'));
final frame = await infusion.seal(
  data: plaintext,
  policyId: 0, // 0 = default policy
);

// Open (Decrypt)
final decrypted = await infusion.open(frame); // Throws if auth fails
print(utf8.decode(decrypted)); // "Top Secret"

Capabilities (Access Control)

Infusion uses "Capability Tokens" (CapTokens) to delegate access rights.

// Issue a capability
final capToken = await infusion.issueCap(
  scopeCid: myScopeCid, // CID of the resource/scope
  rights: 0x01,         // Bitmask (e.g., READ permission)
  expTs: 1735689600,    // Expiration timestamp (Unix)
  delegatedPub32: recipientPublicKey, // 32-byte Ed25519 public key
);

// Verify a capability
// Checks signature, expiration, and if 'requesterPub32' matches the delegate
final isValid = await infusion.verifyCap(
  capToken: capToken,
  requesterPub32: recipientPublicKey,
);

Key Derivation

Derive deterministic sub-keys from your vault's master seed using a context string. Useful for generating keys for other systems (e.g., Hive encryption keys) without storing them.

final contextInfo = Uint8List.fromList(utf8.encode('hive_box_encryption'));
final derivedKey = await infusion.deriveKey(contextInfo);