​

Signed transport (COSE envelope layer)

​

Enable it

cratestack = { package = "cratestack-pg", version = "0.14", features = ["cose"] }
# or `package = "cratestack-api"` for a `db = None` service

​

Wire it

use std::sync::Arc;

use cratestack::cose::{CoseEnvelope, CoseMode, Ed25519Signer, StaticVerifierResolver};
use cratestack::envelope_layer::EnvelopeMode;
use cratestack::InMemoryNonceStore;

// The server's signing key, and the client keys it accepts.
let resolver = StaticVerifierResolver::new().with_key(client_verify_key);
let envelope = CoseEnvelope::server(
    CoseMode::Sign1,
    Arc::new(server_signer),          // an `Ed25519Signer`, or any `CoseSigner`
    Arc::new(resolver),               // any `CoseVerifierResolver`
    Arc::new(InMemoryNonceStore::new()),
)
.build()?;

let envelope_layer =
    cratestack_schema::axum::envelope_layer(envelope, EnvelopeMode::Required, "payments")
        .mount_prefix("/api") // the router is nested under /api
        .build()?;

let router = generated_router
    .layer(idempotency_layer)
    .layer(rate_limit_layer)
    .layer(envelope_layer); // last, so it runs first
let app = axum::Router::new().nest("/api", router);

• audience is this service’s configured logical id, which every binding carries. It is not the Host header, must not be empty, and must differ from the audience this service seals its own outbound requests for.
• The nonce store is the replay cache. InMemoryNonceStore protects one process; behind several replicas use a shared one, such as cratestack_cose::auth::AuthNonceStore::redis(url) (the auth feature of a direct cratestack-cose dependency; see the crate README for the Redis requirements).
• .build() refuses an empty audience, a missing policy or transport, an empty REST route table, a zero body limit, an allow_unresolved template not starting with /, and an envelope whose media type is not application/cose or a type it claims.

​

Placement

• Last, so it runs first. The rate limiter and the idempotency layer key on the VerifiedPrincipal it inserts (cose:<hex thumbprint> by default), so a signed client needs neither Authorization nor ConnectInfo. The idempotency layer hashes the opened payload, so a client that re-seals a retry (a new cti under the same Idempotency-Key) gets the stored response, sealed afresh for the new request.
• Through Router::layer, so MatchedPath and the path parameters are in the request. A ServiceBuilder around the whole app loses them, and nest_service never sets MatchedPath for the outer mount.
• An IP-level limiter outside it. Verification, with its key-resolver and nonce-store lookups, runs before rate limiting, and under Optional so does signing every response to a signed or nonce-bound request. Bound what an unauthenticated flood can cost with a limiter in front of the envelope.

​

Keys that change at run time

use std::sync::Arc;
use cratestack::cose::{CoseEnvelope, CoseMode, CoseVerifierResolver, RegistryVerifierResolver};

// Bound the registry if callers can trigger registrations.
let registry = Arc::new(RegistryVerifierResolver::with_max_keys(10_000));

let envelope = CoseEnvelope::server(
    CoseMode::Sign1,
    Arc::new(server_signer),
    registry.clone() as Arc<dyn CoseVerifierResolver>,
    Arc::new(InMemoryNonceStore::new()),
)
.build()?;

// At enrolment: returns the kid (first 8 bytes of the key's RFC 9679 thumbprint).
let kid = registry.register(device_verify_key.clone())?;

// On sign-out: remove exactly this key...
registry.revoke_key(&device_verify_key);
// ...or everything filed under the kid (see the collision note below).
registry.revoke(&kid);

• Key types. Ed25519, ESP256, and both HMAC algorithms (256/64 and 256/256).
• with_max_keys(n) is a hard bound. A new key past it fails with Conflict; registering a key that is already present succeeds even when the registry is full. new() is unbounded.
• Concurrency. Each call takes one short std RwLock, never held across an .await. A register or revoke is atomic with respect to resolve, and a register that returned is visible to every later resolve. A request whose resolve already returned the key still finishes verifying with it, so a revocation applies to requests that resolve after it returns, not to ones already in flight.
• Per process. The state lives in memory. Every replica needs the same registrations (and a shared nonce store, see above), and a restart starts empty: re-register from your own store.
• Collisions. The kid is only 8 bytes. revoke(kid) removes every key under it: both algorithms of one HMAC secret, and any unrelated key whose kid happens to collide. To cut off one device, use revoke_key(&key).
• Unknown and revoked look the same. An unknown kid resolves to no keys (not an error), so a revoked key and a never-registered one both get the coarse, unsigned 401.
• len() and is_empty() report how many keys are held.

​

Modes

• Everything is signed under Required, GET, HEAD and DELETE included: a bodiless request seals an empty payload and reaches the router bodiless. A signed HEAD still sends its COSE message as a request body, to which RFC 9110 gives no semantics: hyper and reqwest pass it over HTTP/1.1, but an intermediary may drop it (the request then fails, 401) or refuse the request. Prefer GET under Required.
• A signed request is always answered sealed, under Optional as under Required, with its Accept forced to application/cbor. A verification failure is the 401, never a downgrade to unsigned.
• An unsigned seal under Optional binds the nonce and the payload, not the caller. It proves this server answered this nonce and body, not who asked; do not read it as an authenticated exchange.
• In every mode, a body whose Content-Type is application/cose (any case, any parameters) is opened and verified, or refused with the 415. It is never forwarded.
• A bodiless OPTIONS (a CORS preflight) passes untouched on both transports.

​

Per-op policy

use cratestack::envelope_layer::{EnvelopeMode, PolicyRequest};

let policy = |request: &PolicyRequest<'_>| {
    if request.is_subscription() { EnvelopeMode::Optional } else { EnvelopeMode::Required }
};

• An RPC subscription is shown with its bare op id (model.Widget.subscribe) and is_subscription() set.
• /rpc/batch runs under the strictest mode of batch itself and of every frame’s op (is_batch_frame() set, method POST), so a batch cannot carry an op its policy would refuse unsigned. The frames are read by the body’s base Content-Type (parameters and case ignored).
• EnvelopePolicy::unresolved_mode() decides traffic the layer cannot attribute to one op (next section). It defaults to Required; an EnvelopeMode used as the policy answers itself.

​

Fail closed

• Hand-written routes on the same router (/health, a .well-known path) are listed with .allow_unresolved(["/health"]), relative to the mount prefix. Plain traffic to them passes; a COSE body is still the 415.
• Another method on a generated path is the layer’s own 405 with an Allow header (body code METHOD_NOT_ALLOWED on REST, invalid_argument on RPC), so a hand-written handler for that method cannot run unsigned.
• An unmatched path (a 404) passes through, as does a Router::fallback handler, which sets no MatchedPath and is therefore not protected.
• A closure policy fails closed by default. .unresolved_mode(EnvelopeMode::Optional) (or Off) is the explicit opt-out: unbindable routes then pass plain, with a warning logged once per process, and so does every route when the prefix is wrong. Prefer allow_unresolved.
• A plain batch whose frames the layer cannot read is refused unless the strictest of batch and unresolved_mode is Off: the unsigned 401 under Required, an unsigned 400 otherwise. A signed batch is opened unless both are Off (then the 415); once opened, unreadable frames are a sealed 400, and a batch whose every answer is Off is the unsigned 415.
• /rpc/{op_id} never binds an op id that is batch, contains / or has no ., checked on the decoded value (so /rpc/%62atch is caught): a COSE body there is the 415.

​

What is bound

• the audience, the method, and the route: the REST route template the schema declares, or the RPC op id (batch for /rpc/batch, subscribe/<op id> for a subscription);
• every matched path parameter, a parameterised mount’s (nest("/t/{tenant}", ..)) included, so a request signed for tenant a cannot be replayed at tenant b;
• the query in canonical_query form: distinct keys bind alike in any order, but one key’s repeated values keep their order (?tag=a&tag=b is not ?tag=b&tag=a). An RPC call binds its query too; generated RPC clients send none, and a client that adds one (a cache-buster) must bind it;
• the op contract digest and the payload media type: the request’s own type on a request, the response’s own type on a response, application/cbor unless the peers negotiated another (see Payload media types). The digest is the called op’s (OP_CONTRACTS on the client, ACCEPTED_CONTRACTS on the server; a signed /rpc/batch binds the whole-contract CLIENT_CONTRACT_SHA256_BYTES). The client names the digest it used in the unbound Cratestack-Contract header (see Evolving a schema under signed clients);
• bound_headers: Idempotency-Key and If-Match exactly as sent (UTF-8, untrimmed), or null. A proxy that strips the key from a re-sealed retry (so it would run twice) or alters If-Match breaks the signature. A request sending either header twice, or a value that is not UTF-8, is refused with an unsigned 400;
• for a response: the request digest (SHA-256 of the request’s exact COSE bytes, or for an unsigned Optional request, of its nonce and payload) and the status.

​

What the router sees

• The AuthProvider authenticates that payload. A client that also sends Authorization: Signature signs the payload, not the COSE bytes.
• The layer inserts cratestack_core::VerifiedSigner (visible to the AuthProvider in RequestContext::extensions), and generated handlers record it on the context (ctx.verified_signer()). It is a fact, not an authentication: identity stays the AuthProvider’s decision, unless you wrap the provider in CoseAuthProvider (Since 0.16.0, cratestack#1077.)
• The layer inserts VerifiedPrincipal, which the rate limiter and the idempotency layer key on (princ:<sha256>); see Idempotency and Rate limiting.

​

Authenticate a signer

use cratestack_cose::auth::CoseAuthProvider;

let provider = CoseAuthProvider::new(header_provider, device_registry) // Arc<dyn DeviceKeyResolver>
    .with_service_keys(service_registry)  // Arc<dyn CoseVerifierResolver>, e.g. RegistryVerifierResolver
    .authenticate_devices(true);          // off by default

1. Your header provider runs first. An identity it returns wins, and the registries are not asked. An error from it is returned as is: a header the provider refuses is never replaced by the signer. A header it accepts but maps to anonymous is not a refusal, and the signer supersedes it.
2. With no verified signer, the answer is the header provider’s. The signer is read only from the request’s in-process extensions, never from a header or body, so a client cannot fake one.
3. A verified signer is matched by its full thumbprint; the 8-byte kid is only a prefix. The service registry is asked first, then the device registry, which is asked only when device authentication is on. A key that is unknown or revoked is anonymous, not an error, so policy refuses it as it refuses any anonymous caller. A failure of a registry that is asked is a 500, so an outage is not mistaken for an unknown key. Unlike cratestack-auth’s verifier, which treats a JWKS/service error as a miss, a service-registry error here is not a miss: it fails the request, including for a device signer, even with the gate off (the service registry is asked first). This fails closed.

• Under Required, the envelope does not bind a header identity to the signer. When the header provider authenticates, its identity wins, so one device can act as the user named in another device’s header.
• An ESP256 or WebCrypto device key authenticates only through the service registry (as kind service), because DeviceKeyResolver is Ed25519-only.

​

Payload media types

​

Opting in

let layer = cratestack_schema::axum::envelope_layer(envelope, EnvelopeMode::Required, "payments")
    .payload_media_types(
        ["application/cbor", "application/x-www-form-urlencoded"], // what a client may seal
        ["application/cbor", "application/json"],                  // what the layer may seal back
    )
    .build()?;

​

What happens to a request

​

Errors

​

Extension points

use bytes::Bytes;
use cratestack::envelope_layer::{OpenedRequest, SealContext, Sealed, ServerEnvelope, async_trait};
use cratestack::{Binding, CratestackError};
use cratestack::cose::CoseEnvelope;

struct Audited { inner: CoseEnvelope }

#[async_trait]
impl ServerEnvelope for Audited {
    fn media_type(&self) -> &'static str {
        ServerEnvelope::media_type(&self.inner)
    }

    async fn open_request(&self, body: Bytes, bind: &Binding<'_>) -> Result<OpenedRequest, CratestackError> {
        ServerEnvelope::open_request(&self.inner, body, bind).await
    }

    async fn seal_response(
        &self,
        payload: &[u8],
        bind: &Binding<'_>,
        context: &SealContext,
    ) -> Result<Sealed, CratestackError> {
        ServerEnvelope::seal_response(&self.inner, payload, bind, context).await
    }
}

use cratestack::envelope_layer::{ThumbprintPrincipal, VerifiedRequest};

let builder = builder.principal_mapper(ThumbprintPrincipal::with_prefix("device:"));
// or
let builder = builder.principal_mapper(|v: &VerifiedRequest<'_>| {
    Ok(format!("owner:{}", lookup_owner(v.signer().thumbprint())))
});

​

What the layer enforces whatever a plug-in does

• A request with an application/cose body (or one the envelope claims) is opened and verified before anything else sees it, or refused with the 415, whatever the policy says.
• Under Required, no unsigned request reaches the router and no response to a signed request goes out plain; one the layer cannot seal is replaced by a sealed error.
• Every verification failure is the same coarse, unsigned 401; any other envelope error is a 500 whose detail is only logged.
• The PrincipalMapper only ever sees a VerifiedRequest, which has no public constructor. An empty principal is refused (a sealed 500).
• The resolver and the policy are consulted once per request, and the response binding reuses the values the request was opened against, so no plug-in can make the two disagree.
• A Sealed whose media type is not application/cose or one the envelope claims is never sent.

​

The Rust client

use std::sync::Arc;
use cratestack::client_rust::{CborCodec, ClientConfig, ClientEnvelope, CratestackClient};
use cratestack::cose::{CoseEnvelope, CoseMode, Ed25519Signer, StaticVerifierResolver};

// Our signing key, and the server key we pinned at enrolment.
let envelope = CoseEnvelope::client(
    CoseMode::Sign1,
    Arc::new(our_signer),
    Arc::new(StaticVerifierResolver::new().with_key(server_verify_key)),
)
.build()?;

let runtime = CratestackClient::new(ClientConfig::new(base_url), CborCodec)
    // "payments" is the server's configured audience, never its host name.
    .with_envelope(ClientEnvelope::new(envelope, "payments")?)?;
let client = cratestack_schema::client::Client::new(runtime); // REST or RPC alike

​

Sealing a call you send yourself

let route = RouteRef::new("/v1/charges", &[]);
let sealed = envelope
    .seal_call(
        SealCall::new("POST", route, contract_sha) // the op's digest, e.g. from OP_CONTRACTS
            .payload(b"amount=1500&currency=xaf", "application/x-www-form-urlencoded")
            .accept("application/json")
            .idempotency_key("idem-1"),
    )
    .await?;

let mut request = http.post(url).body(sealed.body.clone());
for (name, value) in &sealed.headers {
    request = request.header(name, value); // Content-Type, Accept, Cratestack-*, bound headers
}
let response = request.send().await?;
let (status, headers) = (response.status().as_u16(), response.headers().clone());
let opened = sealed.pending.open(status, &headers, response.bytes().await?).await?;
// opened.payload_type, opened.body: verified, and a type the call asked for

let signer = ExternalSigner::esp256(&public_key_sec1, move |tbs| {
    let keystore = keystore.clone();
    async move { keystore.sign(tbs).await } // DER or raw, as the keystore returns it
})?;

​

The Dart client

import 'package:cratestack_cbor/cose.dart';

final envelope = await ClientEnvelope.create(
  signer: Ed25519Signer.fromSeed(seed), // in memory: never a device key
  serverKeys: [CoseServerKey.ed25519(serverPublicKey)], // pinned at enrolment
  audience: 'payments', // the server's configured name, never its host
);

final binding = CallBinding(
  method: 'POST',
  route: 'procedure.echo', // the RPC op id, or the REST route template
  contractSha: opContractDigest, // 32 bytes
);
final sealed = await envelope.sealRequest(cborPayload, binding);
// POST `sealed` with Content-Type and Accept: envelope.mediaType, and
// Cratestack-Contract: ClientEnvelope.contractHeaderValue(opContractDigest)
final opened = await envelope.openResponse(
  responseBody,
  binding: binding,
  sealedRequest: sealed,
  status: 200,
);
final reply = codec.decodeJson(opened.payload); // opened.payload is CBOR

• Mount parameters come first. pathParams is the list the server’s router matched, in order. If it is nested under a path with parameters (nest("/t/{tenant}", ..)), the mount’s values come before the route’s own, as in the Rust client’s with_mount_params.
• Send the bound headers yourself. An Idempotency-Key or If-Match goes into the CallBinding and onto the request, byte for byte, or the server answers 401.
• Send Cratestack-Contract. ClientEnvelope.contractHeaderValue(digest) gives its value (11 characters of unpadded base64url). It is not bound; it tells a server that accepts several digests which one you sealed under. Call it after create, because it needs the backend started.
• Reseal, never replay. Each seal carries a fresh cti, so a retry calls sealRequest again.
• Redirects. The same rule as the Rust client: do not follow them with your HTTP client. On the web the browser follows them for you.

​

Claim objects

​

Sign and open

use cratestack::cose::{CwtClaims, Ed25519Signer, StaticVerifierResolver, open_claims, sign_claims};

const TYP: &str = "application/vnd.example.grant+cwt";

// Offline, on the issuing device.
let signer = Ed25519Signer::from_seed(&seed);
let claims = CwtClaims {
    aud: Some("terminal-fleet".into()),
    exp: Some(now + 3_600),
    iat: Some(now),
    cti: Some(grant_id.to_vec()), // unique, if you want it single-use
};
let bytes = sign_claims(&signer, TYP, &claims, &payload, b"tenant-1").await?;

// Later, on whichever device or service receives the bytes.
let resolver = StaticVerifierResolver::new().with_key(signer.verify_key());
let opened = open_claims(&resolver, &bytes, TYP, b"tenant-1").await?;

// open_claims has verified the signature and nothing else. Now decide.
if opened.claims.exp.is_none_or(|exp| exp < now) { /* expired, or never meant to be accepted */ }
if opened.claims.aud.as_deref() != Some("terminal-fleet") { /* not for us */ }
if !seen_ids.insert(opened.claims.cti.clone()) { /* already accepted once */ }
let grant = opened.payload; // exactly the bytes that were signed

​

What the crate checks, and what it leaves to you

• An object with no exp never expires. The same bytes open as many times as they are presented. Put an exp in every object that should not live forever, and compare it with your own clock.
• aud is not compared. Check it against the audience you serve.
• cti is not recorded. To make an object single-use, give it a cti and keep the ones you accepted, in a store whose lifetime matches the object’s.
• Verified is not fresh. The OpenedClaims doc says so on purpose: a valid signature means the holder of the key signed these bytes at some point, nothing more.

​

The wire shape

18([
  protected   : bstr .cbor { 1: alg, 4: kid, ? 15: { ? 3: aud, ? 4: exp, ? 6: iat, ? 7: cti }, 16: typ },
  unprotected : {},
  payload     : bstr,         ; embedded, never detached
  signature   : bstr
])

• alg is Ed25519 (-19) or ESP256 (-9), the fully specified ids of RFC 9864; kid is the 8-byte thumbprint prefix, as in the envelope.
• Label 15 carries the CWT claims (RFC 8392, in a COSE header by RFC 9597). Each claim is written only when present. aud is a single string of at most MAX_AUD_LEN (256) bytes, exp and iat are whole seconds since the Unix epoch, and cti is 1 to MAX_CTI_LEN (64) bytes.
• Label 16 is typ (RFC 9596), mandatory, 1 to MAX_TYP_LEN (128) bytes. It names what the object is, it is signed, and open_claims refuses any other (WrongType), so an object minted for one purpose cannot be presented as another.
• external_aad is signed but not sent: the opener must supply the same bytes. Put in it what the object is bound to without carrying, such as a tenant or a purpose. Empty is fine.
• Encoding is deterministic (RFC 8949 section 4.2.1) and an ESP256 signature is low-s. The opener is as strict as the envelope’s: no unknown, duplicate or out-of-order label, no non-minimal or indefinite head, nothing unprotected, no detached payload, no trailing bytes.

​

Kept apart from the envelope

​

Errors

​

Evolving a schema under signed clients

​

How the server picks the digest

Cratestack-Contract: <first 8 bytes of the op digest, unpadded base64url>   (11 characters)

• The header selects, it never widens. It only chooses among digests the server already accepts for the op, and the signature covers all 32 bytes, so a lie is the ordinary 401.
• A selector that names no accepted digest is an unsigned 426 with RpcErrorBody { code: "contract_unsupported" } (REST CONTRACT_UNSUPPORTED), answered before any key lookup. It reveals only that this op’s shape is no longer served, which every client binary already carries; it is unsigned, so the client treats it as a hint. The same answer goes to an unsigned, nonce-bound request whose well-formed selector names nothing, so both paths behave alike.
• Why the 426 carries no Upgrade header. RFC 9110 §15.5.22 asks for one. Upgrade is a connection-level field (§7.8), forbidden on HTTP/2 (RFC 9113 §8.2.2), stripped by hyper’s h2 server and dropped by proxies, and no protocol token names “this op’s contract”, so a compliant header could neither arrive nor say anything. Every other status already means something here (409 is the idempotency and transaction layers, 410 is heuristically cacheable, 412 belongs to conditional headers, 400 is the malformed selector), so 426 is kept and the client recognises the refusal by the body’s code alone, never by the status: a proxy’s own 426 stays Unsigned.
• Without the header (a hand-built client) the layer tries the op’s accepted digests newest first, at most max_contract_trials (default 4). A message’s nonce is recorded only once it verifies, so a failed trial burns nothing. The COSE envelope parses the message and resolves its key once (open_request_any) and repeats only the signature check, so a forged message costs one parse, one key resolution and at most that many verifications.
• The response is sealed under the digest the request used, and the client opens it under the digest it sent.
• A digest from another op is refused: op B’s accepted list does not hold op A’s digest, even with a matching route and selector.

​

Keeping older clients working through a compatible change

cratestack::include_server_schema!(
    "schemas/app.cstack",
    db = Postgres,
    contracts = "schemas/app.contracts.lock"
);

# before shipping a client build: record the current contracts as a generation
cratestack contract lock  --schema schemas/app.cstack --lock schemas/app.contracts.lock --note "store 1.4.7"
# in CI: fail when the current contract is unlocked, or breaks a locked one
cratestack contract check --schema schemas/app.cstack --lock schemas/app.contracts.lock
# later: stop accepting old generations, or one op's older clients
cratestack contract prune --lock schemas/app.contracts.lock --keep 5
cratestack contract prune --lock schemas/app.contracts.lock --op procedure.placeOrder

• The op’s transport, key, kind, verb, model, procedure name, return type and kept attributes are unchanged.
• An argument or field may be added only as optional. The one exception is a field with @default on a model op’s own model: only a model’s create input leaves a @default field out. A type, or a model reached as a procedure argument, decodes a @default field as required, so an old client’s message would fail to decode; that is refused. A FindMany<T>? argument is refused too (its generated field is never optional and has no default); Page<T> cannot be an argument at all. A required argument, or a field only the input reaches, may become optional. Variants may be appended to an enum only the input reaches. A declaration only the output reaches may gain any field, because decoders ignore keys they do not know.
• Everything else is breaking, notably: removing an argument or field (the signed value would be silently ignored, a meaning the signer never produced), any retype, an arity change in a direction that reads it, a variant added to an enum an old client decodes, inserting, removing or reordering variants, reordering arguments, and adding, removing or changing an attribute of a kept field or declaration (a @default field is not in the create input, so adding one to an existing field drops what an old client sent). A model op’s model counts as both input and output.

​

Upgrading from binding version 1

​

Limits

• Streams cannot be sealed until ADR 0006 P1 (chain mode). A signed request gets Accept of sealable types only (never a stream), so a @stream op answers with one buffered, sealed array; a signed subscription is a sealed 406 before its handler runs. Only an unsigned request under Optional streams (plain), so give subscriptions Optional or Off in the policy.
• Responses are re-buffered to be sealed, up to MAX_RESPONSE_REBUFFER_BYTES (8 MiB); a longer one becomes a sealed 500. The payload is copied once into the sealed message; the zero-copy API is cratestack#1076.
• A semantic change with no shape change is not caught. The digest covers what decodes, so an Int field that switches from major to minor units, or a validator that changes what a value means, leaves it alone. Change the op, or add a new one, when meaning changes.
• A signed /rpc/batch binds the whole-contract digest (CLIENT_CONTRACT_SHA256_BYTES), and is accepted only when it equals the server’s current one, so any client-facing change (a new op, an edit to any op, locked or not) refuses a signed batch from an older client with the 426. Per-frame digests are a follow-up.
• A claim object has no freshness or replay check. It is a different format from the envelope (see Claim objects): the crate verifies the signature and leaves exp, aud and cti to your code. (Since 0.17.0, cratestack#1231.)
• One envelope per layer. A router accepting Sign1 devices and Mac0 services at once needs the composite of cratestack#1078.
• The generated Dart and TypeScript clients do not sign. ADR 0006 §11 has them use the Rust runtime rather than a second implementation, so their generated code stays unsigned; the Flutter runtime mirror rejects an envelope until P1. A Dart or Flutter app seals through cratestack_cbor (since 0.15.4, cratestack#1151). The published @cratestack/cbor-web and the napi addon do not.
• A version 2 server refuses binding version 1 (0.15.0 peers), with no opt-in: upgrade the server and its clients together. Any future change to the AAD bumps the version again.
• A signer is recorded, not authenticated, unless you wrap your provider in CoseAuthProvider (since 0.16.0, cratestack#1077). Device keys authenticate only with authenticate_devices(true); see Authenticate a signer.

​

Read next

1. ADR 0006 for the envelope, the AAD layout and the threat model
2. Idempotency and Rate limiting, which key on the principal the layer inserts
3. Auth provider for identity, which the envelope does not decide
4. Claim objects for a signed payload that is delivered later, outside any request