Struct KeyPackageBundle 

pub struct KeyPackageBundle {
    pub package_id: String,
    pub user_id: String,
    pub key_package_data: Vec<u8>,
    pub created_at_ms: u64,
    pub expires_at_ms: u64,
    pub synced: bool,
    pub reserved_for_publication: bool,
    pub assigned_peer: Option<String>,
    pub provider_hash_ref: Option<Vec<u8>>,
}

A bundle containing a key package and metadata for distribution.

Fields

package_id: String

Unique identifier for this key package.

user_id: String

User ID this key package belongs to.

key_package_data: Vec<u8>

Serialized MLS KeyPackage bytes.

created_at_ms: u64

Timestamp when the key package was created (milliseconds since epoch).

expires_at_ms: u64

Timestamp when the key package expires (milliseconds since epoch).

synced: bool

Whether this key package has been uploaded to a server.

reserved_for_publication: bool

Whether this package is reserved for a publication slot.

An MLS key package’s init key is consumed by the first peer who uses it, so a package standing in a published record must not also be handed to a peer over the push path: the second user of it builds a Welcome that can never be processed. Reserved packages are therefore invisible to both entry points that hand packages out — MlsManager::take_push_key_package (the push path) and MlsManager::get_or_create_key_package (the peer-less one).

Additive and defaulted, so packages written before this field existed deserialize as unreserved — which is what they are.

assigned_peer: Option<String>

The peer this package has been handed to over the push path, if any.

This is what keeps the push path from advertising one init key to everybody: a package is claimed by the first peer it is pushed to and afterwards only ever re-handed to that peer, so a repeat push costs no new key material while two peers never share one. RFC 9420 §16.8 asks for a key package to be rotated as soon as possible after use; the rotation trigger is consumption, which MlsManager::key_package_by_id already reports, and a consumed package’s successor is minted on the next push to that peer.

None means unclaimed — either minted outside the push path (the peer-less FFI entry point) or written before this field existed. Those are claimable, so upgrading does not strand the package already in storage.

Local bookkeeping only: never serialized onto the wire, and never part of the FFI record.

provider_hash_ref: Option<Vec<u8>>

The TLS-serialized OpenMLS hash reference this package’s private init key is stored under in the provider, stamped at mint time.

A cache: deriving the reference from key_package_data costs a TLS parse plus a signature validation, and the push path’s pool scan checks every stored package’s usability on every push — without this it pays that per package per push. Records written before the field existed deserialize as None and are backfilled on their first load.

Local bookkeeping only, like Self::assigned_peer: never on the wire, never in the FFI record.

Implementations

impl KeyPackageBundle

pub fn new( package_id: String, user_id: String, key_package_data: Vec<u8>, lifetime_secs: u64, ) -> Self

Creates a new key package bundle.

pub fn is_expired(&self) -> bool

Checks if the key package has expired (local device’s own packages only).

This compares against the local clock and is valid because created_at_ms and expires_at_ms were set on this same device.

pub fn expired_past_grace(&self, grace_secs: u64) -> bool

Whether the package expired more than grace_secs ago.

Expiry and the destruction of the private init key are deliberately two different moments. An expired package is no longer advertised, but a peer holding a copy handed out just before expiry may still Welcome us — and that Welcome is only processable while the init key is in provider storage. The grace window is how long that stays true; past it the key material is destroyed rather than left resident for the life of the install.

pub fn remaining_lifetime_ms(&self) -> u64

Returns the remaining valid lifetime in milliseconds.

Used when transmitting key packages to peers: the receiver applies this duration relative to their own clock, eliminating cross-device clock skew from expiry calculations.

pub fn from_transfer( package_id: String, user_id: String, key_package_data: Vec<u8>, remaining_lifetime_ms: u64, ) -> Self

Creates a bundle from received transfer data, computing local expiry from the sender-provided remaining lifetime.

Trait Implementations

impl Clone for KeyPackageBundle

fn clone(&self) -> KeyPackageBundle

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for KeyPackageBundle

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for KeyPackageBundle

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for KeyPackageBundle

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.