🥮 mooncakes.io

    moonbitstack/moonseal/spec does not have a README file

    Identity

    source
    pub(open) trait Identity {
      fn unwrap(Self, stanza~ : Stanza) -> Bytes? raise Refused
    }

    A recipient type, from the decrypting side: given a stanza, either the file key or None for "not mine, try the next one".

    A stanza of a type this identity does not implement is None, and so is one that is well formed but sealed to another key. A stanza that claims to be this type and is malformed is a refusal, because at that point the file is broken rather than addressed to somebody else.

    Recipient

    source
    pub(open) trait Recipient {
      fn wrap(Self, file_key~ : BytesView, random~ : &
    Source    ) -> Stanza raise Refused
    }

    A recipient type, from the encrypting side: it takes the file key and wraps it into a stanza only the matching identity can unwrap.

    random is where the ephemeral material comes from. It is passed rather than found so that the one source a caller chose serves every stanza of a file, and so that a Replay seals the same file twice.

    Refused

    source
    pub(all) suberror Refused {
      Header(at~ : Int, want~ : String)
      Stanza(want~ : String)
      Mac
      NoMatch
      Payload(at~ : Int)
      Armor(at~ : Int, want~ : String)
      Key(want~ : Int, got~ : Int)
      Random(
    Unavailable    )
      Limit(want~ : Int, got~ : Int)
    } derive(Eq, 
    Debug    )

    Why this library would not do what it was asked.

    The variants are the places a file can stop being a file: the header does not say what the format says it says, a stanza of a known type does not either, the MAC over the header does not check out, no identity opened any stanza, a payload chunk did not authenticate, the text was not the armor it claimed to be, a key is not the size this format defines, the random source the caller handed in could not give what the file needs, or an input was longer than this library will read.

    at is an offset in bytes from the start of the input the call was given.
    impl Show for Refused

    Refused::equal

    source
    fn Refused::equal(Refused, Refused) -> Bool

    Refused::not_equal

    source
    fn Refused::not_equal(x : Refused, y : Refused) -> Bool

    Refused::output

    source
    fn Refused::output(self : Refused, logger : &Logger) -> Unit

    Refused::to_repr

    source

    Refused::to_string

    source
    fn Refused::to_string(self : Refused) -> String

    Stanza

    source
    pub(all) struct Stanza {
      kind : String
      args : Array[String]
      body : Bytes
    }

    One recipient stanza: the type, the arguments after it, and the body that carries the file key wrapped for whoever holds the matching secret.

    A recipient type is nothing more than a name, a list of arguments it defines the meaning of, and a body; the header carries them without understanding them, which is what lets a type this library has never heard of travel through it.

    Stanza::new

    source
    fn Stanza::new(kind~ : String, args~ : Array[String], body~ : Bytes) -> Stanza

    draw

    source
    fn draw(random : &
    Source    , len : Int) -> Bytes raise Refused

    len bytes from random, or the reason it had none as a refusal.

    A recipient type calls this for its ephemeral material, so that a failing source arrives as the one error type every call here raises.

    Source Files

    Powered by MoonBit

    Site sourceReport issueModulesSkillsBuild queueStatistics

    © 2026 mooncakes.io