Struct SubnetExportPolicy 

pub struct SubnetExportPolicy {
    pub version: u8,
    pub scope: SubnetRef,
    pub topology_epoch: u32,
    pub issuer: EntityId,
    pub exported_channels: Vec<ChannelHash>,
    pub revision: u64,
    pub not_before: u64,
    pub not_after: u64,
    pub signature: [u8; 64],
}

Root-signed statement of EXACTLY which channels are exported at a subtree’s boundary.

The set replaces wholesale — like a gateway credential set — so a revoked export cannot survive inside a merged remainder. An empty set is meaningful: “nothing is exported here”.

Like the advertisement, this is policy DISTRIBUTION, not export authority: the boundary gateway still needs its own EXPORT credential at the boundary scope (D6). The fact tells a gateway what the authority wants exported; the credential is what lets it.

Fields

version: u8

Wire version; only 1 decodes.

scope: SubnetRef

The boundary subtree the policy applies to.

topology_epoch: u32

Topology epoch the policy belongs to.

issuer: EntityId

Signing root.

exported_channels: Vec<ChannelHash>

Canonical 64-bit channel hashes exported at this boundary. At most MAX_EXPORTED_CHANNELS; order is not significant but IS signed, so decode preserves it.

revision: u64

Per-(SubnetRef, kind) ordering revision; replay/reorder safe.

not_before: u64

Validity window start (unix seconds).

not_after: u64

Validity window end (unix seconds, exclusive).

signature: [u8; 64]

ed25519 over SUBNET_EXPORT_POLICY_SIG_DOMAIN ‖ payload.

Implementations

impl SubnetExportPolicy

pub const fn wire_size(count: usize) -> usize

Wire size for a policy naming count channels.

pub fn try_issue( root_keypair: &EntityKeypair, scope: SubnetRef, topology_epoch: u32, exported_channels: Vec<ChannelHash>, revision: u64, not_before: u64, not_after: u64, ) -> Result<Self, SubnetAuthError>

Issue signed by root_keypair (issuer is set from it).

pub fn to_bytes(&self) -> Vec<u8>

Wire form: payload ‖ signature.

pub fn from_bytes(bytes: &[u8]) -> Result<Self, SubnetAuthError>

Strict decode; signature NOT verified here. The count byte must match the exact remaining length — a count that disagrees with the buffer is a forgery attempt or corruption either way.

pub fn verify(&self) -> Result<(), SubnetAuthError>

Signature verification against self.issuer.

pub fn check_time_bounds_at( &self, now: u64, skew_secs: u64, ) -> Result<(), SubnetAuthError>

Window check with saturating skew, the family discipline.

Trait Implementations

impl Clone for SubnetExportPolicy

fn clone(&self) -> SubnetExportPolicy

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SubnetExportPolicy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for SubnetExportPolicy

impl PartialEq for SubnetExportPolicy

fn eq(&self, other: &SubnetExportPolicy) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for SubnetExportPolicy