Struct KeyPackageBundle 

pub struct KeyPackageBundle {
    pub package_id: String,
    pub user_id: String,
    pub key_package_data: Vec<u8>,
    pub created_at_ms: u64,
    pub expires_at_ms: u64,
    pub synced: bool,
    pub reserved_for_publication: bool,
    pub assigned_peer: Option<String>,
    pub provider_hash_ref: Option<Vec<u8>>,
}

A bundle containing a key package and metadata for distribution.

Fields

package_id: String

Unique identifier for this key package.

user_id: String

User ID this key package belongs to.

key_package_data: Vec<u8>

Serialized MLS KeyPackage bytes.

created_at_ms: u64

Timestamp when the key package was created (milliseconds since epoch).

expires_at_ms: u64

Timestamp when the key package expires (milliseconds since epoch).

synced: bool

Whether the application has published this package itself, through MlsManager::mark_key_package_synced.

A synced package stands in a record somebody else holds, so a stranger may still build a Welcome against it. Two things follow, and both are the single-use rule Self::reserved_for_publication already applies: the package is withheld from both entry points that hand packages out, or a pushed-to peer and whoever fetched the uploaded copy would race for one init key; and the record is kept, because the record is the only thing that carries expiry. Deleting it instead, which is what marking used to do, left the private init key in the provider with no path to destruction at all (issue 367).

reserved_for_publication: bool

Whether this package is reserved for a publication slot.

An MLS key package’s init key is consumed by the first peer who uses it, so a package standing in a published record must not also be handed to a peer over the push path: the second user of it builds a Welcome that can never be processed. Reserved packages are therefore invisible to both entry points that hand packages out — MlsManager::take_push_key_package (the push path) and MlsManager::get_or_create_key_package (the peer-less one).

Additive and defaulted, so packages written before this field existed deserialize as unreserved — which is what they are.

assigned_peer: Option<String>

The peer this package has been handed to over the push path, if any.

This is what keeps the push path from advertising one init key to everybody: a package is claimed by the first peer it is pushed to and afterwards only ever re-handed to that peer, so a repeat push costs no new key material while two peers never share one. RFC 9420 §16.8 asks for a key package to be rotated as soon as possible after use; the rotation trigger is consumption, which MlsManager::key_package_by_id already reports, and a consumed package’s successor is minted on the next push to that peer.

None means unclaimed — either minted outside the push path (the peer-less FFI entry point) or written before this field existed. Those are claimable, so upgrading does not strand the package already in storage.

Local bookkeeping only: never serialized onto the wire, and never part of the FFI record.

provider_hash_ref: Option<Vec<u8>>

The TLS-serialized OpenMLS hash reference this package’s private init key is stored under in the provider, stamped at mint time.

A cache: deriving the reference from key_package_data costs a TLS parse plus a signature validation, and the push path’s pool scan checks every stored package’s usability on every push — without this it pays that per package per push. Records written before the field existed deserialize as None and are backfilled on their first load.

Local bookkeeping only, like Self::assigned_peer: never on the wire, never in the FFI record.

Implementations

impl KeyPackageBundle

pub fn new( package_id: String, user_id: String, key_package_data: Vec<u8>, lifetime_secs: u64, ) -> Self

Creates a new key package bundle.

pub fn withheld_from_hand_out(&self) -> bool

Whether this package stands in a record somebody else holds, and so must never be handed out by this device.

One predicate rather than two checks at each hand-out site, so the push path and the peer-less getter cannot come to disagree about which packages are spoken for.

pub fn is_expired(&self) -> bool

Checks if the key package has expired (local device’s own packages only).

This compares against the local clock and is valid because created_at_ms and expires_at_ms were set on this same device.

pub fn expired_past_grace(&self, grace_secs: u64) -> bool

Whether the package expired more than grace_secs ago.

Expiry and the destruction of the private init key are deliberately two different moments. An expired package is no longer advertised, but a peer holding a copy handed out just before expiry may still Welcome us — and that Welcome is only processable while the init key is in provider storage. The grace window is how long that stays true; past it the key material is destroyed rather than left resident for the life of the install.

pub fn remaining_lifetime_ms(&self) -> u64

Returns the remaining valid lifetime in milliseconds.

Used when transmitting key packages to peers: the receiver applies this duration relative to their own clock, eliminating cross-device clock skew from expiry calculations.

pub fn from_transfer( package_id: String, user_id: String, key_package_data: Vec<u8>, remaining_lifetime_ms: u64, ) -> Self

Creates a bundle from received transfer data, computing local expiry from the sender-provided remaining lifetime.

Trait Implementations

impl Clone for KeyPackageBundle

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for KeyPackageBundle

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for KeyPackageBundle

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for KeyPackageBundle

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.