Getting started

SDK security baseline

Build and distribute applications with Dart 3.13.7+ or Flutter 3.47.8+. These are the first patched stable versions for the eMudhra incident; for later builds, use a currently supported SDK with security fixes.

The pubspec minimum describes API compatibility, not the security of an older runtime. Packages were validated with Dart 3.13.7 and Flutter 3.47.8 without changing their public API. Updating a library does not repair an installed application: affected Android, Windows, and Linux applications must be rebuilt and redistributed.

Check the SDK selected by the IDE, local builds, and CI. Updating a global SDK does not ensure that a particular project or CI uses it. Do not disable certificate verification to work around TLS errors.

Install

dart pub add ark_data_layer

Declare a source contract

abstract interface class UserRemoteDataSource implements DataSource {
  Future<List<UserDto>> fetchUsers();
}

DataSource is a marker. The application owns the useful contract and keeps it focused on one technical responsibility.

Implement the Repository

final class UserRepositoryImpl extends Repository<UsersData>
    implements UserRepository {
  UserRepositoryImpl({required super.dataSources})
    : _remote = dataSources.get<UserRemoteDataSource>(),
      super(initialData: const UsersData.empty());

  final UserRemoteDataSource _remote;

  @override
  Future<void> refresh() async {
    final records = await _remote.fetchUsers();
    setData(UsersData(records.map(mapUser)));
  }
}

The concrete class extends the package base and implements an application-owned domain interface. Callers depend on UserRepository, not on DataSourceContainer.

Compose and close

final repository = UserRepositoryImpl(
  dataSources: DataSourceContainer(<DataSource>[remoteSource]),
);

await repository.refresh();
await repository.close();
await remoteSource.close();

The Repository closes its own publication mechanism. It does not close a scope-owned DataSource.