at_commons

• feat: add AtNetworkTimeouts.defaultResponseBudget (90s) — the overall budget for one complete response, as distinct from defaultTimeout, which bounds the wait for the next bytes and restarts every time a chunk arrives. A large response is many such waits in a row, and only this budget bounds their sum, so a peer that trickles bytes indefinitely is caught by this and by nothing else. Deliberately not passed through cap: it bounds an aggregate rather than a single operation, and its own default already exceeds the 60s ceiling. Nothing reads it yet.

• docs: signingAlgo says plainly that it names the APKAM authentication key's algorithm — the key that signs the from: challenge — and not the algorithm an enrollment signs documents with. The name invites the second reading and the two are deliberately different algorithms from rollout 1 onward. Stated on EnrollParams, EnrollVerbBuilder and PkamVerbBuilder, which all declare the field and previously said this in two forms and none.

• feat: add EnrollVerbBuilder.apkamPublicKeySignature, threading the existing EnrollParams.apkamPublicKeySignature through to the built command. The field had no route to the wire, so an enroll:update could not carry the proof of possession the atServer requires before it installs a new apkamPublicKey — which made the rotation the field exists for unsendable.

• feat: add Metadata.copy() — a field-for-field copy, so callers handing metadata from one object to another stop hand-rolling the field list. A hand-rolled copier silently drops any field added to Metadata later: the value still round-trips and only the missing field is absent at the far end, which is how immutable and appMetadata went astray on several paths in at_client. A caller that must not carry a field clears it after copying, so the exception is written where it applies rather than being the default.

• feat: add EnrollVerbBuilder.apsk, threading the existing EnrollParams.apsk through to the built command. The field had no route to the wire, so nothing could send the value the atServer publishes verbatim.
• feat: add EnrollParams.apskLegacy and the matching EnrollVerbBuilder field, carrying the bare RSA _apsk string an enrollment publishes verbatim. Every deployed _apsk consumer base64-decodes the value as an RSA key, so a plain-legacy enrollment must be able to publish that shape through the same verb every other enrollment uses. A separate field rather than widening apsk to two types, which would have been source-breaking on a published field. The atServer writes it as-is — not JSON-encoded, since a quoted string is not what a bare-RSA parser reads — and refuses a request carrying both fields, which would disagree about one record with no basis for choosing between them.
• fix: EnrollParams.apsk's entry status is active or retired, not verifyOnly as 5.14.0 documented, and the entry carries a kid like every other key entry in the protocol. retired is use-neutral — "retained, not for new operations" — because use already names the operation a key serves: a retired signing key still verifies old envelopes, and a retired encapsulation key still opens records already sealed to it. Documentation only; the atServer stores the value verbatim, so no record carries either spelling.

• feat: add EnrollParams.apsk — the value a client composes for its own public:_apsk.<enrollmentId>.a.__e@<atSign> signing key, carried on enroll:request and stored verbatim on the enrollment record. A Map<String, dynamic> like metadata, opaque to the atServer, capped there at 20KB encoded.

  It exists so the atServer can stop composing that value from (apkamPublicKey, signingAlgo). PKAM verification is record-authoritative and reads the enrollment record, so _apsk is a client-side artefact the server has no use for and no business knowing the format of — it was publishing one only because the record's rightful writer, the enrollee, does not exist yet at approval. Sending the value moves the format back to the side that owns it, and a new signing-key shape stops needing a server release. Absent means no _apsk is published at all.

  The form the client composes is a versioned array of signing keys — {"v":1,"keys":[{"use","alg","pub","status"}]} — spelled as KeyPackage's keys are, so one vocabulary covers every "list of keys with algorithms" in the protocol. An entry whose status is verifyOnly has stopped signing but is retained: envelopes are stored durably and re-verified later, so removing a key would retroactively unverify everything ever signed with it.

• feat: add EnrollOperationEnum.update and the matching enroll:update alternation in the enroll grammar — an approved enrollment amending its own record's apkamPublicKey, signingAlgo, apsk and metadata. Self-only: the connection's enrollment id must equal the target's. It never reaches namespaces or the approval state, because an operation an enrollment can invoke on itself must not be able to widen its own grant.

  This is what lets an enrollment replace its APKAM authentication keypair while keeping its id, rather than the replacement being a new enrollment.

• feat: add EnrollParams.apkamPublicKeySignature — base64 of a signature by the new APKAM private key over <enrollmentId>|<apkamPublicKey>|<signingAlgo>, required on an enroll:update that changes apkamPublicKey.

  The connection proves possession of the enrollment's current key and nothing else proves possession of the new one, so without this a compromised-but-authenticated client can install a public key whose private half is held by someone else — locking out the legitimate holder while the record still looks valid.

• feat: add AtNetworkTimeouts — the process-wide network-timeout policy: defaultTimeout (30s, the per-attempt default), maxAllowed (60s hard cap on any single network operation), defaultOnboardingTimeout (5 min — the poll budget for waiting on a newly-registered atSign to be provisioned, deliberately longer than the per-op cap), and cap(). The single place to set the SDK's network timeouts (#1909).
• feat: add SecureSocketConfig.connectTimeout so a connect deadline can be threaded through to SecureSocket.connect.

• feat: add the enroll:listns:<listNamespace> operation to the enroll verb grammar (the gated per-namespace enrollment-discovery verb), ordered before list in the operation alternation so it is not prefix-shadowed.
• feat: add EnrollParams.metadata (opaque Map<String, dynamic>, stored verbatim on the enrollment record and returned from discovery) and EnrollParams.signingAlgo (rsa2048 | mldsa65), with the matching EnrollVerbBuilder fields; an empty metadata map is dropped from the built command.
• feat: widen the pkam verb signingAlgo literal to accept mldsa65 (post-quantum ML-DSA APKAM authentication).

• feat: add Metadata.appMetadata (AppMetadata{providerId, additional}), emitted on the wire as :appMetadata: (base64-encoded JSON) on the update, update:meta and notify verbs and parsed back by the verb builders. providerId routes pluggable-crypto decryption; additional is provider-owned opaque metadata. providerId must be a non-empty string (a FormatException is thrown otherwise).

• feat: add :cl flag to the scan verb syntax, plus ScanVerbBuilder.commitLog
• feat: add :nc (no-commit) flag to the update, update:meta, update:json and delete verb syntaxes, plus UpdateVerbBuilder.noCommit and DeleteVerbBuilder.noCommit
• feat: add :dAt (deletedAt) timestamp to the delete verb syntax, plus DeleteVerbBuilder.deletedAt
• feat: emit Metadata.createdAt / updatedAt / expiresAt / availableAt on the wire as :cAt: / :uAt: / :eAt: / :aAt: (used by update, update:meta and notify)
• feat: timestamp wire format is ISO 8601 UTC with 6 fractional-second digits, e.g. 2026-05-05T11:59:44.123456Z; helper at VerbUtil.formatIso8601Micros

• feat: add AtKey.fullKey getter — key name including its namespace
• feat: add AtKey.fullKeyAndOwner getter — fullKey combined with the owning atSign
• feat: add equals method for AtBytes

• feat: add AtBytes supporting hardware acceleration in at_chops

• feat: extend syntax of info verb, adding info:mtls and info:mtlsbrief

• chore: remove @experimental annotation from EnrollVerbBuilder.otp

• chore: fix lint from the new strict_top_level_inference rule

• feat: add AtRootDomain with basic parsing including proxy.

• chore(deps): bump uuid to "^4.0.0"

• fix: NotifyVerbBuilder.buildCommand() uses AtKey.toString() instead of doing its own thing.

• feat: add EnrollmentConstants. Contains various patterns and regular expressions for enrollment-related data

• feat: add immutable flag to Metadata and force flag to the DeleteVerbBuilder. Immutable records may not be updated once the immutable flag has been set, and may not be deleted unless the force flag has been set in the delete command.

• feat: add Atsign string extensions
• feat: add AtServerEvent interface and AtSignPKChangedEvent class

• fix: remove isPaginated check in SyncVerbBuilder and always set from: and limit: since sync:from verb expects these params to be set.

• fix: Introduce IV params for apkam enrollment flow

• feat: Introduce skipDeletesUntil for sync:from verb

• fix: Add "publicKeyHash" and "hashingAlgo" type to metadata.
• build[deps]: Upgraded the following package:
  • json_annotation to v4.9.0
  • meta to v1.16.0
  • build_runner to v2.4.13
  • json_serializable to v6.9.0
  • lints to v5.0.0
  • test to v1.25.8
  • test_process to v2.1.0

• fix: export regex utils class

• [Breaking Change]feat: Emit the isEncrypted value in the metadata if it is false
• fix: update pkam regex to accept sha512 as hashing algo

• feat: Add "expiry" enroll params to support apkam keys to auto expiry after specified time duration

• feat: Add "delete" operation to the enroll verb to allow deletion of denied enrollments

• feat: Add "unrevoke" operation to the enroll verb to restore revoked APKAM keys
• fix: Add isEncrypted flag to notify command for both true and false

• chore: deprecate MessageTypeEnum.text
• fix: remove deprecated annotation from Metadata.pubKeyCS

• fix: Add a "force" variable to enroll_verb_builder to propagate enroll:revoke:force value
• fix: Deprecate apkam in PkamAuthMode enum

• feat: enroll verb syntax change for enroll:revoke:force and added new exception AtEnrollmentRevokeException

• fix: Add shared_key.atsign@atsign to reservedKey regex

• fix: Add fetch operation to enroll verb to get the enrollment details

• fix: max key length validation changes
• fix: PublicKey toString method should return 'cached:' when isCached is set in metadata

• feat: Enhance enroll:list to enable filtering based on enrollment status

• fix: "toJson()" invoked on "pubKeyHash" leads to NullPointerException.

• feat: changes to replace md5 checksum - deprecated pubKeyCS in AtKey and introduced new class PublicKeyHash

• fix: Add "InvalidPinException" which is thrown when an invalid Semi Permanent Passcode is submitted.

• [Breaking Change] fix: Updated regex for Reserved keys (Internal keys used by the server)
• fix: Add "put" operation to OTP verb to store semi-permanent pass codes
• Remove attributes related to AtKey and metadata in verb builders. Instead, use AtKey instance.

• fix: Deprecate encryptedDefaultEncryptedPrivateKey in EnrollParams and introduce encryptedDefaultEncryptedPrivateKey for readability
• fix: Replace encryptedDefaultEncryptedPrivateKey with encryptedDefaultEncryptionPrivateKey in EnrollVerbBuilder

• feat: Introduced TTL(Time to Live) for OTP verb to configure OTP expiry

• feat: Introduce "AtInvalidEnrollmentException" which is thrown when an enrollment is expired or invalid
• feat: Introduce error code 'AT0030' for Invalid Enrollment Status
• chore: Deprecated all variables in src/at_constants.dart, use AtConstants.<variable-name> instead

• feat: Introduce "AtThrottleLimitExceeded" exception which is thrown when enrollment request exceeds the limit
• feat: Introduce new error codes for apkam enrollments

• fix: Modify "totp" verb regex to include alphanumeric characters
• feat: Introduce "EnrollResponse" class which represents the enrollment response.

What's Changed

• build(deps): bump github/codeql-action from 2.1.37 to 2.1.38 by @dependabot in #881
• build(deps): bump actions/setup-python from 4.4.0 to 4.5.0 by @dependabot in #882
• build(deps): bump requests from 2.28.1 to 2.28.2 in /tools by @dependabot in #883
• feat: Introduce AtServiceFactory to make AtClientManager more reusable and more testable by @gkc in #885
• build(deps): bump dnspython from 2.2.1 to 2.3.0 in /tools by @dependabot in #886
• feat: Inject AtChops instance (if any) so that it is available everywhere that it can be used by @gkc in #887
• build(deps): bump dart-lang/setup-dart from 1.3 to 1.4 by @dependabot in #889
• build(deps): bump github/codeql-action from 2.1.38 to 2.1.39 by @dependabot in #890
• feat: client commit log compaction by @sitaram-kalluri in #855
• chore: update at_persistence_secondary_server version and remove depe… by @sitaram-kalluri in #896
• build(deps): bump github/codeql-action from 2.1.39 to 2.2.0 by @dependabot in #897
• fix: add atChops as optional argument in AtServiceFactory.atClient by @sitaram-kalluri in #898
• build(deps): bump github/codeql-action from 2.2.0 to 2.2.1 by @dependabot in #901

Full Changelog: v3.0.51...v3.0.53

• feat: Modify "enroll" verb regex.
• feat: Introduce "EnrollParams" class to encapsulate enrollment attributes.

• fix: Add revoke and list operations to "enroll" verb
• fix: Modify "keys" verb regex and verb builder

What's Changed

• fix: git#865 - fixes notifying the switch atSign event multiple times by @sitaram-kalluri in #867
• fix: Switch atsign bug by @murali-shris in #864
• feat: Add atSign to AtSignLoggers' names when feasible. Some code simplification and refactoring by @gkc in #870
• fix: reverted async,path to older versions by @purnimavenkatasubbu in #879

Full Changelog: v3.0.50...v3.0.51

• feat: added exception class for enrollment exception

What's Changed

• feat: initial commit for at_chops uptake by @murali-shris in #809
• fix: Fix pub score by @purnimavenkatasubbu in #876

• feat: add self notification flag in monitor syntax for APKAM feature

• feat: added syntax and verb builder for keys verb
• feat: introduced verb builder for enroll and pkam verbs
• chore: Moved this package to a new repo & updated repository URL

• feat: totp support in enroll verb

• fix: Enhance stats verb to allow regex for stats:15
• feat: Add syntax and verb builder for APKAM enroll verb

• fix: Modify emoji list to allow variation selector Unicode

• fix: Add constants for AtClientParticulars

• feat: introduce enum for pkam authentication mode

• feat: Enhanced the monitor verb syntax
  1. added strict flag to allow client to request that only regex-matching notifications are sent - e.g. do not send other 'control' type notifications like the 'statsNotifications'
  2. added multiplexed flag to allow client to indicate that this socket is also being used for request-response interactions

• fix: Tightened the validation of 'public' key names. Keys like this: public:@bob:foo.bar@alice will now correctly be identified as not being valid.

• fix: Add 'configkey' to list of reserved keys for key validation purposes

• fix: Add notification expiry to the notify verb builder.

• feat: add new exceptions for at_chops operations.

• fix: add hashing algorithm to pkam syntax.