Module domain_key 

Local store for the ed25519 keys that authorise domain-scoped publishing.

A domain publisher proves control by hosting a .well-known manifest that lists public keys, and signing each publish with the matching private key (see memstead_base::domain_authority_wire). This module owns the private half: one key per domain, stored under ~/.config/memstead/domain-keys/, and the helpers to generate, load, sign with, and render the manifest for it.

The key file holds the base64 of the 32-byte ed25519 seed, mode 0600. The directory can be overridden with MEMSTEAD_DOMAIN_KEYS_DIR (used by tests).

Functions

exists

Is there already a key stored for domain?

generate

Generate a fresh keypair for domain and persist the private key. Refuses to overwrite an existing key unless force (rotation is deliberate — a lost old key cannot sign, so clobbering silently would strand published mems). Returns the new key’s ed25519:<base64> public-key string.

keys_dir

Directory holding per-domain key files. Honours MEMSTEAD_DOMAIN_KEYS_DIR (test hook), else ~/.config/memstead/domain-keys/.

load

Load the signing key for domain. Errors actionably if none is stored.

manifest_json

The proof manifest to host at https://<domain>/.well-known/memstead-publishing.json.

public_key_string

ed25519:<base64> public-key string for a signing key — the form listed in the manifest and presented on a publish.

sign

Sign payload, returning the ed25519:<base64> signature string.