Module message 

Off-chain wire types and their verifiers.

The relay chain decodes none of this; it only matches the StreamsRoot commitments in the UMP signals. But the two ends of each protocol are different chains’ collators, so the encodings and the envelope variant indices are part of the wire format.

• leaf_hash turns a payload into an MMR leaf. A message is a bounded payload keyed by StreamId; source, stream and position are structural, so there is no message struct.
• Fetch: MessagesRequest / MessagesResponse, verified by verify_messages against a StreamsRoot the requester has already verified. The extension + tree_proof check is the same one the requires-lift performs.
• Event read: EventRequest / EventResponse, the single-leaf read of an Ack / Broadcast / Private stream, verified by verify_event.
• Envelope: ExchangeRequest / ExchangeResponse multiplex both over /spec-msg/exchange, verified by verify_exchange, which also binds the response variant to the request’s. Variant indices are frozen.

Structs

EventRequest

Request for a single event of a lossy stream (Ack / Broadcast / Private), verified under a chosen StreamsRoot. The server either serves or fails; nothing is resolved server-side.

EventResponse

Response carrying one event leaf and the proofs placing it under the requested StreamsRoot. Nothing is trusted. under fixes the stream’s leaf count, so the head is the leaf at count - 1; an old leaf cannot be served as the head.

MessagesRequest

Request for a range of a stream’s messages, verified under a chosen StreamsRoot.

MessagesResponse

Response: payloads from base on, plus the proofs binding them and everything before them to the requested StreamsRoot. Nothing is trusted; fabricated peaks, payloads or proofs cannot reproduce a committed root.

Enums

ExchangeRequest

The /spec-msg/exchange request envelope. Variant indices are frozen; foreign implementations decode by them.

ExchangeResponse

The /spec-msg/exchange response envelope. No error variant: a server that cannot serve refuses at the transport level.

ExchangeVerified

Verified outcome of an ExchangeResponse: a fetch, or a VerifiedEvent.

VerifiedEvent

Outcome of verifying an EventResponse. A head read yields the stream MmrFrontier, which lossy consumption records as its interval endpoint; a positional read yields none, since an inclusion proof reconstructs a root, not a frontier.

VerifyError

Why verifying an off-chain response failed. RootMismatch is benign (retry under a fresher root); the rest indicate a malformed or forged response.

Constants

MAX_MESSAGES_PER_RESPONSE

Maximum payloads in one MessagesResponse, enforced at decode. The byte budget does not bound the count: an empty payload costs one wire byte and no budget, yet is hashed into a leaf, so without this bound one response could carry millions. A consumer fetches the rest under a later request.

MAX_SPECULATIVE_MESSAGE_LEN

Maximum size in bytes of a single speculative message payload.

Functions

leaf_hash

Hash a payload into a stream MMR leaf: H(LEAF_TAG ++ leaf_version ++ payload). Source, stream and position are structural and not in the preimage. Versions are hash-disjoint, so only the correct one reproduces a committed root.

verify_event

Verify an EventResponse against its EventRequest: req.at selects head (None) or leaf k, so a head response is never accepted for a positional request or vice versa. On Ok, resp.payload is verified. The public entry for event reads.

verify_exchange

Verify a /spec-msg/exchange response against its request. The variants must match (VariantMismatch otherwise); then dispatches to verify_messages or verify_event. The top-level public entry.

verify_messages

Verify a MessagesResponse against its MessagesRequest: resp.base == req.start, total payload bytes within req.max_bytes (0 means proofs only), then the payloads under req.stream / req.under. On Ok, resp.payloads are verified. The public entry for the fetch protocol.