Module key_package_maintenance 

Key-package maintenance as TaskRunner consumers: payload/seed helpers and the rotate/sweep work the KpRotation/KpDeletion dispatch arms call into. Recurrence + nudging come from the generic layer (TaskOutcome, PullInDeadline).

Enums

KeyPackageMaintenanceError

Functions

discard_key_package

Delete a refused key package’s material and history in one transaction.

kp_deletion_hash

The data hash of kp_deletion_proto.

kp_deletion_proto

The key package deletion task.

kp_rotation_hash

The data hash of kp_rotation_proto.

kp_rotation_proto

The key package rotation task.

kp_seed

Never-expire recurring seed: the reaper’s expires_at_ns < now || attempts >= max_attempts check can never fire.

nudge_deletion

After anything marks superseded KPs for deletion: ensure the KpDeletion singleton exists (pull-in against a missing target is a no-op), then pull it in to the earliest pending delete_at. No-op when nothing is marked, so it is safe (and idempotent) to call on every dispatch.

queue_key_rotation

Queue rotation within five seconds and persist its task in one transaction. Create the recurring task before its deadline update, then emit after commit.

queue_key_rotation_in

Queue rotation on the caller’s writer so a Welcome install can commit with it. The caller emits the task fact in its event buffer.

rotate_if_needed

Upload a fresh key package when rotation is due and return whether it occurred. A confirmed receipt starts retirement of keys published earlier by the backend.

seed_and_reconcile_kp_tasks

Idempotent startup seeding + reconcile: pull-ins only LOWER task deadlines to the live DB columns, repairing rows stranded by a crash mid-nudge.

sweep_expired

Keep expired keys while any durable Welcome remains pending. Otherwise, delete each expired key’s material and history in one transaction.