Struct ProtectedLocalKeyStore 

pub struct ProtectedLocalKeyStore { /* private fields */ }

Host-owned protected storage scoped to one database at one location.

Key material lives in the host’s secret items; a separate nonsecret marker detects loss of an established authority. Neither is part of Aven’s database export, SQLite backup, or archive backup.

Implementations

impl ProtectedLocalKeyStore

pub async fn seed_http_inputs( &self, database: &Database, ) -> Result<(SeedAuthority, SeedPublicationIntent, Option<Package>)>

Resumes sealed ownership before exposing any publication transport input.

pub fn required_seed( &self, package: &ProtectedLocalPackageKey, ) -> Result<SeedAuthority>

pub async fn prepare_seed_source( &self, database: &Database, ) -> Result<SeedSourceAuthority>

Explicit irreversible opt-in before capture. Early failure can leave the installation fenced; the denial marker never authorizes key regeneration.

pub async fn prepare_seed_adoption_intent( &self, database: &Database, ) -> Result<SeedPublicationIntent>

Fences SQLite cancellation before persisting exact protected intent. An intent cannot be locally abandoned.

pub async fn adopt_seed_publication( &self, database: &Database, outcome: &PublicationOutcome, ) -> Result<bool>

Authenticates host authority and commits adoption, then retries pin cleanup. Cleanup failure is reported without rolling back the committed adoption.

impl ProtectedLocalKeyStore

pub async fn active_inputs( &self, db: &Database, locator: &str, ) -> Result<ActiveInputs>

pub async fn adopt_refresh( &self, db: &Database, inputs: &mut ActiveInputs, evidence: Evidence, ) -> Result<()>

pub async fn adopt_verified_refresh( &self, db: &Database, inputs: &mut ActiveInputs, evidence: Evidence, target: Membership, ) -> Result<()>

target must be what evidence verifies to.

pub async fn open_invitation( &self, db: &Database, inputs: &ActiveInputs, ) -> Result<Option<OpenInvitation>>

pub async fn invitation_progress( &self, db: &Database, handle: &[u8; 32], ) -> Result<InvitationProgress>

Reads only this invitation’s terminal phases, so waiting for a join can check it often without loading every journal.

pub async fn retire_open_invitation( &self, db: &Database, inputs: &ActiveInputs, ) -> Result<(Option<Outbound>, Option<OpenInvitation>)>

Retires the open invitation if no grant has been sent. The returned journal remains available for best-effort server cancellation.

pub async fn prepare_invitation( &self, db: &Database, inputs: &ActiveInputs, expires: Option<u64>, handle: Option<[u8; 32]>, ) -> Result<Outbound>

pub async fn registered_invitation( &self, db: &Database, inputs: &ActiveInputs, journal: &Outbound, ) -> Result<Invitation>

pub async fn prepare_admission( &self, db: &Database, inputs: &ActiveInputs, journal: &Outbound, request: &[u8], ) -> Result<Vec<u8>>

pub async fn expired_disclosure( &self, db: &Database, inputs: &ActiveInputs, ) -> Result<Option<Outbound>>

The unresolved journal whose grant may have been sent, once its declared expiry has passed. Expiry only starts withdrawal work.

pub async fn mark_withdrawing( &self, db: &Database, inputs: &ActiveInputs, journal: &Outbound, ) -> Result<()>

Fences local candidate creation and resends before remote cancellation.

pub async fn reconcile_disclosure( &self, db: &Database, inputs: &ActiveInputs, journal: &Outbound, ) -> Result<Disclosure>

Resolves a possibly disclosed journal from verified membership only. A candidate at its signed slot is an admission and finishes ready. withdrawn requires every stored candidate to have lost its slot, no candidate recipient ever becoming a member, and a later non-pending generation absent from every candidate predecessor.

pub async fn finish_inviter( &self, db: &Database, inputs: &ActiveInputs, journal: &Outbound, record: &[u8], ) -> Result<()>

pub async fn prepare_peer( &self, db: &Database, locator: &str, invitation: Option<Invitation>, ) -> Result<Joiner>

The request to post: a known invitation’s exact attempt, otherwise the latest attempt, or the one a pinned response answers.

pub async fn replace_peer( &self, db: &Database, locator: &str, invitation: Invitation, ) -> Result<Joiner>

Like prepare_peer, but an unknown invitation becomes a new attempt while joining is unfinished. The installation keys, enrollment pin and fence stay unchanged, and every earlier attempt is retained.

pub async fn peer_attempts( &self, db: &Database, locator: &str, ) -> Result<Vec<Joiner>>

Every retained attempt, oldest first, or only the one a pinned response answers. Attempts are never removed.

pub async fn open_peer_response( &self, db: &Database, mail: &Mailbox, ) -> Result<ProvisionalGrant>

Opens a mailbox admission without retaining it. The signature and membership binding are unchecked here, so only finish_peer pins it.

pub async fn finish_peer( &self, db: &Database, mail: &Mailbox, evidence: &Evidence, ) -> Result<()>

Pins mail only after evidence proves its exact outcome, so an unverified response never blocks a correct one.

pub async fn install_peer_snapshot( &self, db: &Database, transport: &Client, locator: &str, downloaded: &(dyn Fn(u64, Option<u64>) + Sync), ) -> Result<SharedStateInstallReport>

pub async fn adopt_download_refresh( &self, db: &Database, identity: [u8; 32], peer: &Joiner, verified: &VerifiedEnrollment, evidence: &Evidence, target: Membership, ) -> Result<Membership>

pub async fn tail_inputs( &self, db: &Database, locator: &str, ) -> Result<TailSnapshot>

Validated tail material for one drain. It stays current until the enrollment marker changes or the server reports a stale context.

pub async fn association(&self, db: &Database) -> Result<Option<(bool, String)>>

Whether this installation joined as a peer, and the server locator its enrollment identity is bound to.

pub async fn enrollment_readiness( &self, db: &Database, ) -> Result<EnrollmentReadiness>

impl ProtectedLocalKeyStore

pub async fn management_intent( &self, db: &Database, inputs: &ActiveInputs, target: Option<[u8; 32]>, withdraw: Option<[u8; 32]>, ) -> Result<Option<Intent>>

target requests removal, withdraw an invitation withdrawal, and neither resumes unfinished work or finishes a pending rotation.

pub async fn management_dispatch( &self, db: &Database, inputs: &ActiveInputs, intent: &Intent, high: u64, ) -> Result<Option<Dispatch>>

impl ProtectedLocalKeyStore

pub async fn prepare_seed_claim( &self, database: &Database, setup_id: [u8; 32], ) -> Result<SeedAuthority>

Persists private seed keys, bearer and exact validated genesis before use. Reuses package vault/generation/secret and refuses a changed setup binding. The public DB pin detects lost protected authority, never authorizes replacement.

pub async fn package_seed_capture( &self, database: &Database, blob_dir: &Path, setup_id: [u8; 32], ) -> Result<EncryptedLocalSharedStatePackage>

Freezes a local package only under already persisted seed genesis context. Incompatible frozen bytes fail unchanged; cancel/recapture explicitly. This does not prove server claim admission or enable dispatch.

impl ProtectedLocalKeyStore

pub async fn open( database: &Database, storage: Arc<dyn ProtectedStorage>, ) -> StoreResult<Self>

Opens the namespace of database in storage.

pub fn load_or_create(&self) -> StoreResult<ProtectedLocalPackageKey>

Loads the established keyring, or creates and durably marks a new one.

An existing marker with missing key material is an error. Existing or corrupt material is never replaced. If key persistence succeeds but the marker write fails, retry loads the same key and completes the marker.

pub fn load_required(&self) -> StoreResult<ProtectedLocalPackageKey>

Loads an established authority without generating key material.

If key persistence completed before its nonsecret marker, this completes the marker using the existing key identity.

pub async fn package_local_capture( &self, database: &Database, blob_dir: &Path, membership_predecessor: [u8; 32], ) -> Result<EncryptedLocalSharedStatePackage, Error>

Creates or reuses protected key material before freezing package bytes. The predecessor is caller-supplied context, not membership authorization. An existing freeze requires its established authority even if bytes are missing.

pub fn erase(&self) -> StoreResult<()>

Deletes every protected item and record of this database, including authority markers, so the database can start sync again as if it never took part. Secrets go before markers, so an interrupted erase reads as missing authority until it is rerun, never as a fresh namespace.