A node's announcement, signed by the node, that it shares the content with this tag 2 content id.

The storage key of a content id's announcements.

Check an unsigned domain record before a pool signs it as its node: a domain type, a payload map, a subject that is absent or a non-empty binary, a lifetime that runs forward and fits the type's maximum, never shortened, and a payload and subject of at most 256 KiB together that nest at most 63 levels. Returns the refusal by name.

Whether a record is of a domain type (tags 0x20 to 0xFF): its owner sets its payload rules, and its slot is its signer's key id, with its subject when it has one.

The wire form of a signed or verified record: its {key, tbs, signature} map, tbs unchanged.

An unsigned record of a domain type (tags 0x20 to 0xFF). The subject_id option names the record's subject, a non-empty binary: an empty subject would name a slot apart from no subject.

A foundation parameter, signed by a foundation key.

A foundation's list of trusted realms: each entry pairs a realm id with the realm key id that signs the realm's records, signed by a foundation key. Its payload holds exactly realms_trusted (D28).

The storage key of a foundation's realm trust list, from the foundation key id. The station computes it to fetch the list without holding its record.

A foundation's seed list, signed by a foundation key.

A foundation's tier 3 attestation of a station, signed by a foundation key.

The longest window a realm member endorsement may have, valid_from to valid_until, in milliseconds: 30 days. Its builder refuses a longer one, and macula_hyparview_endorsement:verify_endorsement/3 refuses one it receives.

A node record about the node NodeId, which signs it.

Whether a node signs this record about itself: a node record, a procedure advertisement or a content announcement, whose payload names the signing node. A tombstone is not one: it withdraws a record, and whoever signs it checks that the record was theirs.

A realm's statement, signed by the realm key, that the org OrgName is held by the key with key id OrgKeyId.

The storage key of an org directory record, from the realm id and the org name.

Check a payload before anything is encoded: its external size is at most 256 KiB, and it nests at most 63 levels of maps and lists, which a record's tbs leaves it under the decoder's 64. Returns record_too_large or malformed.

A payload field, read whatever key form it arrived in: {text, Name}, the binary, or an existing atom. A text value is returned as its binary.

A provider's advertisement of a procedure in a realm, signed by the provider. For a procedure with an org namespace the authorization option carries the provider authorization: org_directory and procedure_delegation as the records' wire form, the only authorization form. The builder refuses any other.

An org's grant, signed by its org key, that the node Advertiser may serve procedures under the org.

The storage key of a procedure delegation, from the org key id and the advertiser's node_id.

The storage key of a procedure's advertisements, from the realm id and the procedure name.

A procedure's org namespace: the text before the first "/" of its name, when there is one and it is not "_".

The trusted realms of a foundation realm trust list, as realm id to realm key id (D28).

A realm's directory record, signed by the realm key: its name and the key id of its admin key.

A realm's statement, signed by the realm key, that a node is a member with roles. Its window, valid_from to valid_until, is at most 30 days and never ends before it starts: a longer one raises a badmatch on {error, endorsement_window_too_long}, and a reversed one on {error, endorsement_window_reversed}.

The stations serving a realm, signed by the realm key.

The record with a new version, created now, with the same lifetime, signed again with Key.

Sign a record with a key whose purpose fits its type. Raises key_purpose_mismatch for a key of another purpose, key_id_mismatch when the payload names a signer other than this key, {malformed, Type} for a record whose fields, subject or payload verify/3 would refuse, and record_too_large past 256 KiB. The field and payload checks are verify/3's own, run before anything is signed, so sign/2 never returns a record verify/3 refuses apart from the clock.

signer_entry/4 at the current time.

The entry one signer holds among the entries a lookup of a slot returns, as wire forms or {key, tbs, signature} maps. Expected is {key_id, Id} for a key named by its MACULA-KEY-ID-V1 key id, or {node_id, Id} for an identity key. Every entry is read as far as its carried key, whatever the answer's order or length, and no signature is checked to select. Only the entries under the expected key are verified: highest claimed version first, stopping at the first that verifies and names Id as its key_id, and at most 4. So an entry under another key costs no verify, and forged entries under the expected key cost a bounded few. The outcome is that record, not_found when no entry is under the key, or the refusal of the last entry verified. The stats count the entries under the key, the entries verified, and the entries past the 80 a slot holds, which a station that keeps to its slot places never sends.

A station's dialable endpoint, signed by the station and stored under its node_id.

The storage key of a station's endpoint record, from the station's node_id.

The 32-byte DHT storage key of a record. A record stored under its signer needs its key_id, so it must be signed or verified; a record named by its payload does not.

A tombstone that withdraws a record: it names the record's type, version and slot fields, takes the record's slot, and lives until the record has expired plus the clock tolerance, so no replica serves the record again after the tombstone lapses. Sign it with the key that signed the record.

The procedure advertisement type tag, for callers that look records up by type.

Verify a record, given as its wire form or as its {key, tbs, signature} map, under the verifier's profile and clock. Refusals are returned, never raised.

The caller's check of a verified advertisement's provider authorization, against the realm trust it holds: the realm-signed org directory and the org-signed procedure delegation, the only authorization form. The realm key is the carried realm key the caller pins, or the realm key id the foundation realm trust list's pairs name for the advertisement's realm_id (D28). A procedure with an org namespace needs an authorization for that org, a procedure without one carries none, and the advertisement expires no later than any part of its authorization. An authorization in any other form, a certificate chain included, is refused as authorization_form_unsupported: 11.0.0 has no certificate form.

Check a record given as its wire form, or as a signed map, before it is decoded or encoded: a wire form is a binary of at most 256 KiB, and a signed map's key, tbs and signature are binaries of at most 256 KiB together. Returns record_too_large or malformed.