Struct DeRecProtocolBuilder 

pub struct DeRecProtocolBuilder<ChannelStore, ShareStore, SecretStore, UserSecretStore, StateStore, Transport, OwnTransport> { /* private fields */ }

Typestate builder for DeRecProtocol.

Call each store/transport setter, then build. The “every required slot is filled” constraint is enforced at compile time by the impl-block bounds — calling build() on an incomplete builder is a type error, not a runtime panic.

Setters may be called in any order.

Example

let protocol = DeRecProtocolBuilder::new()
    .with_channel_store(my_channel_store)
    .with_share_store(my_share_store)
    .with_secret_store(my_secret_store)
    .with_transport(my_transport)
    .with_own_transport(TransportProtocol { uri: "https://me.example.com".into(), .. })
    // Plus any optional with_* setters to override defaults.
    .build();

Implementations

impl DeRecProtocolBuilder<BuilderSlotMissingMarker, BuilderSlotMissingMarker, BuilderSlotMissingMarker, BuilderSlotMissingMarker, BuilderSlotMissingMarker, BuilderSlotMissingMarker, BuilderSlotMissingMarker>

pub fn new(secret_id: u64) -> Self

Construct a new builder bound to a specific secret.

secret_id identifies the single secret this protocol instance manages. Apps that juggle multiple secrets instantiate one DeRecProtocol per secret_id.

impl<ChannelStore, ShareStore, SecretStore, UserSecretStore, StateStore, Transport, OwnTransport> DeRecProtocolBuilder<ChannelStore, ShareStore, SecretStore, UserSecretStore, StateStore, Transport, OwnTransport>

pub fn with_threshold(self, threshold: usize) -> Self

Minimum number of shares required to reconstruct the secret.

Default: 3. This setter is infallible — invariant checks run at build time and surface a structured crate::Error so callers can handle invalid configurations uniformly across SDKs (FFI / WASM bindings translate that error into their native shape rather than seeing a panic propagate across the language boundary).

pub fn with_keep_versions_count(self, count: usize) -> Self

Number of recent versions each helper must retain.

Default: 3.

pub fn with_timeout(self, timeout: Duration) -> Self

Protocol-wide staleness boundary.

Any inbound envelope whose timestamp is older than this is discarded on receipt, regardless of flow.

The same threshold is also used to age out local state that is waiting on a peer: incomplete pairings, in-flight sharing rounds, and outstanding unpair acknowledgements.

Granularity

One second is the smallest effective unit. The protocol’s wire timestamps (protobuf Timestamp.seconds) carry only whole-second resolution, so message ages can only be measured to the nearest second. As a consequence:

• sub-second precision in the supplied Duration is truncated (Duration::from_millis(2500) becomes 2 seconds);
• any value below one second is clamped to one second, so an accidental Duration::ZERO does not silently disable the timeout.

Default: 5 minutes.

pub fn with_communication_info(self, info: HashMap<String, String>) -> Self

Key-value pairs included in CommunicationInfo within pairing request and response messages (e.g. "name", "email", "phone").

Default: empty.

pub fn with_auto_respond_on_failure(self, enabled: bool) -> Self

Whether the protocol replies to peers on inbound processing failures.

• true: on a failed inbound request (e.g. format errors, decryption failures), the protocol automatically sends a failure response to the peer.
• false: inbound processing errors are only surfaced as events and no response is sent — the application decides how to respond.

Default: false.

pub fn with_unpair_ack(self, ack: UnpairAck) -> Self

Whether the unpair initiator waits for the peer’s acknowledgement before dropping local state.

• UnpairAck::Required: keep state until the peer responds with Ok, or until the timeout configured via Self::with_timeout elapses.
• UnpairAck::NotRequired: drop state immediately after sending the request; any later response is silently ignored.

Default: UnpairAck::Required.

pub fn with_auto_reply_to(self, enabled: bool) -> Self

Whether outbound requests carry an ephemeral replyTo set to this node’s own transport endpoint.

• true: every outbound request envelope stamps request.replyTo = own_transport. The responder routes its response to that endpoint, ignoring the channel’s stored peer endpoint. Useful when two peers share a channel record but reach out from different endpoints (e.g. replicas talking to a helper that was paired with a sibling replica) — without this, the responder would reply to the sibling.
• false: outbound requests leave replyTo unset. The responder routes to the channel’s stored endpoint, which is correct for the single-device case.

Only affects outbound requests originated through DeRecProtocol::start. Responders always honour an inbound replyTo regardless of this flag (it is purely a per-request hint on the wire).

Default: false.

pub fn with_auto_accept(self, policy: AutoAcceptPolicy) -> Self

Per-flow opt-in for auto-accepting inbound requests.

When a flow’s field on the policy is true, DeRecProtocol::process internally runs the equivalent of DeRecProtocol::accept for that flow and emits crate::protocol::DeRecEvent::AutoAccepted in place of crate::protocol::DeRecEvent::ActionRequired (followed in the same event vec by the flow’s completion events).

Default: crate::protocol::AutoAcceptPolicy::default() — every field false, behaviour identical to today’s ActionRequired flow. See the field-level docs on crate::protocol::AutoAcceptPolicy for the per-flow trade-offs.

pub fn with_replica_id(self, id: u64) -> Self

Configure this node’s local replica identity.

Required to participate in any replica-mode pairing — when set, the orchestrator auto-injects the id (hex-encoded) under the reserved key derec.replica_id in outbound PairRequest / PairResponse envelopes whose sender_kind is ReplicaSource or ReplicaDestination, and accepts inbound replica pairings that advertise the peer’s id under the same key.

Apps that do not use replica flows simply do not call this setter. With no replica id configured, the orchestrator rejects every replica-mode entry point with Error::ReplicaIdNotConfigured; Owner and Helper pairings are unaffected.

The id must be stable across restarts — persist it on the device once and pass the same value on every protocol init. Use crate::generate_replica_id to mint a fresh one with the OS CSPRNG.

Default: unset (replica flows disabled).

pub fn with_parameter_range(self, range: ParameterRange) -> Self

Declare the local node’s acceptable ParameterRange for pair negotiation.

Embedded in outbound PairRequest / PairResponse envelopes and checked against the peer’s range on inbound ones: if any field’s range fails to intersect (e.g. local minShareSize exceeds peer maxShareSize) the pairing is rejected with Error::Pairing(PairingError::IncompatibleParameterRange { .. }).

Default: unset — the local side advertises no constraints and accepts any peer range.

impl<ShareStore, SecretStore, UserSecretStore, StateStore, Transport, OwnTransport> DeRecProtocolBuilder<BuilderSlotMissingMarker, ShareStore, SecretStore, UserSecretStore, StateStore, Transport, OwnTransport>

pub fn with_channel_store<Cs: DeRecChannelStore>( self, store: Cs, ) -> DeRecProtocolBuilder<BuilderSlotSetMarker<Cs>, ShareStore, SecretStore, UserSecretStore, StateStore, Transport, OwnTransport>

Set the DeRecChannelStore implementation responsible for persisting channel records.

impl<ChannelStore, SecretStore, UserSecretStore, StateStore, Transport, OwnTransport> DeRecProtocolBuilder<ChannelStore, BuilderSlotMissingMarker, SecretStore, UserSecretStore, StateStore, Transport, OwnTransport>

pub fn with_share_store<Sh: DeRecShareStore>( self, store: Sh, ) -> DeRecProtocolBuilder<ChannelStore, BuilderSlotSetMarker<Sh>, SecretStore, UserSecretStore, StateStore, Transport, OwnTransport>

Set the DeRecShareStore implementation responsible for persisting secret shares.

impl<ChannelStore, ShareStore, UserSecretStore, StateStore, Transport, OwnTransport> DeRecProtocolBuilder<ChannelStore, ShareStore, BuilderSlotMissingMarker, UserSecretStore, StateStore, Transport, OwnTransport>

pub fn with_secret_store<Ss: DeRecSecretStore>( self, store: Ss, ) -> DeRecProtocolBuilder<ChannelStore, ShareStore, BuilderSlotSetMarker<Ss>, UserSecretStore, StateStore, Transport, OwnTransport>

Set the DeRecSecretStore implementation responsible for persisting per-channel key material (pairing secrets, shared keys, pairing contacts).

impl<ChannelStore, ShareStore, SecretStore, StateStore, Transport, OwnTransport> DeRecProtocolBuilder<ChannelStore, ShareStore, SecretStore, BuilderSlotMissingMarker, StateStore, Transport, OwnTransport>

pub fn with_user_secret_store<Us: DeRecUserSecretStore>( self, store: Us, ) -> DeRecProtocolBuilder<ChannelStore, ShareStore, SecretStore, BuilderSlotSetMarker<Us>, StateStore, Transport, OwnTransport>

Set the DeRecUserSecretStore implementation responsible for persisting the user-facing secret contents keyed by secret_id. Written on every start(FlowKind::ProtectSecret); read by the pair-completion auto-publish hook so freshly-paired peers receive the current secret without an explicit re-publish.

impl<ChannelStore, ShareStore, SecretStore, UserSecretStore, StateStore, OwnTransport> DeRecProtocolBuilder<ChannelStore, ShareStore, SecretStore, UserSecretStore, StateStore, BuilderSlotMissingMarker, OwnTransport>

pub fn with_transport<Tr: DeRecTransport>( self, transport: Tr, ) -> DeRecProtocolBuilder<ChannelStore, ShareStore, SecretStore, UserSecretStore, StateStore, BuilderSlotSetMarker<Tr>, OwnTransport>

Set the DeRecTransport implementation responsible for delivering outbound envelopes to peers.

impl<ChannelStore, ShareStore, SecretStore, UserSecretStore, StateStore, Transport> DeRecProtocolBuilder<ChannelStore, ShareStore, SecretStore, UserSecretStore, StateStore, Transport, BuilderSlotMissingMarker>

pub fn with_own_transport( self, own_transport: impl IntoOwnTransport, ) -> DeRecProtocolBuilder<ChannelStore, ShareStore, SecretStore, UserSecretStore, StateStore, Transport, BuilderSlotSetMarker<Result<TransportProtocol, TransportValidationError>>>

The local node’s transport endpoint that peers will use to reach it.

Embedded into outgoing contact and pairing messages so peers know where to send their replies. Accepts anything implementing IntoOwnTransport: a typed TransportProtocol, a &str, or a String. URI validation is deferred to build so the setter chain stays infallible — a malformed URI surfaces as crate::Error::Transport when build() runs.

impl<ChannelStore, ShareStore, SecretStore, UserSecretStore, Transport, OwnTransport> DeRecProtocolBuilder<ChannelStore, ShareStore, SecretStore, UserSecretStore, BuilderSlotMissingMarker, Transport, OwnTransport>

pub fn with_state_store<St: DeRecStateStore>( self, store: St, ) -> DeRecProtocolBuilder<ChannelStore, ShareStore, SecretStore, UserSecretStore, BuilderSlotSetMarker<St>, Transport, OwnTransport>

Set the DeRecStateStore implementation responsible for persisting in-flight orchestrator state (outstanding verification challenges, recovery accumulators, pending unpair acknowledgements). Required for stateless / load-balanced deployments where the process may be recycled between an outbound request and its inbound response; see the trait documentation for the concurrency contract.

impl<Cs: DeRecChannelStore, Sh: DeRecShareStore, Ss: DeRecSecretStore, Us: DeRecUserSecretStore, St: DeRecStateStore, Tr: DeRecTransport> DeRecProtocolBuilder<BuilderSlotSetMarker<Cs>, BuilderSlotSetMarker<Sh>, BuilderSlotSetMarker<Ss>, BuilderSlotSetMarker<Us>, BuilderSlotSetMarker<St>, BuilderSlotSetMarker<Tr>, BuilderSlotSetMarker<Result<TransportProtocol, TransportValidationError>>>

pub fn build(self) -> Result<DeRecProtocol<Cs, Sh, Ss, Us, St, Tr>>

Consume the builder and return a fully-initialized DeRecProtocol.

The “all required slots set” constraint is enforced by this impl block’s type bounds — the call is only reachable once every slot has been filled. Runtime invariant checks (currently: threshold >= 2 and own-transport URI validity) are deferred to this point and surface as crate::Error.

Errors

• crate::Error::InvalidInput if threshold < 2. A threshold of 0 or 1 collapses threshold secret sharing and lets a single helper reconstruct the secret unilaterally.
• crate::Error::Transport if the URI passed to with_own_transport failed validation (malformed scheme, empty URI, …).