@@ -237,9 +237,10 @@ sToMs = \s -> stripUnit s * 1000
237237-- and stripped of trailing dots, with a deny-list filter (`isBadServerName`)
238238-- applied where SSRF is a concern.
239239
240−-- One event in a /poll response. The payload is the opaque cipher blob plus
241−-- delivery metadata for the recipient; the server cannot read the blob.
242−type PollEvent = {id: MessageIdHex, payload: {encryptedBlob: BlobHex, toKey: PubkeyHex}}
240+-- One event in a /poll response: the opaque cipher blob addressed to the
241+-- polling pubkey. The server cannot read the blob; clients derive any
242+-- per-message id locally as `messageIdOf encryptedBlob`.
243+type PollEvent = {encryptedBlob: BlobHex}
243244
244245-- Kind of presence event flowing through federation gossip. `GossipUnknown` is
245246-- the parser's fallback for forward-compatibility with future event types.
@@ -1431,7 +1432,7 @@ pollOnce = \authorization cursor cursorWasReset clientIp serverGen respond t ->
14311432
14321433-- One pass: collect events at `t`. If empty, retry-wait on `pollWakeup`
14331434-- (bumped by send/heartbeat) and re-collect once at the new wall time.
1434−doPoll : {clampedCursor: Int, pubkey: PubkeyHex, startWakeup: Timestamp} -> Int<Ms> -> IO {r *pollWakeup, clock} {cursor: Int<Ms>, events: [{id: MessageIdHex, payload: {encryptedBlob: BlobHex, toKey: PubkeyHex}}], hasMore: Bool}
1435+doPoll : {clampedCursor: Int, pubkey: PubkeyHex, startWakeup: Timestamp} -> Int<Ms> -> IO {r *pollWakeup, clock} {cursor: Int<Ms>, events: [{encryptedBlob: BlobHex}], hasMore: Bool}
14351436doPoll = \s t -> do
14361437 let collectAt = \tnow -> atomic (do
14371438 msgs <- *messages
@@ -1447,7 +1448,7 @@ doPoll = \s t -> do
14471448-- Pull this pubkey's unexpired messages newer than `cursor`, sort by
14481449-- receivedAt, take up to `maxPollEvents`, and report `hasMore` if truncated.
14491450collectPollEvents : [Message] -> PubkeyHex -> Timestamp -> Timestamp -> {events: [PollEvent], cursor: Timestamp, hasMore: Bool}
1450−collectPollEvents = \messages pubkey cursor t -> (\myMsgs -> (\limited -> {events: pluck limited (\m -> {id: messageIdOf m.encryptedBlob, payload: {m.toKey, m.encryptedBlob}}), cursor: fold (\acc m -> max acc m.receivedAt) cursor limited, hasMore: count myMsgs > count limited}) (takeRelation maxPollEvents (sortBy (\m -> m.receivedAt) myMsgs))) (filter messages (\m -> m.toKey == pubkey && t - m.receivedAt < messageMaxAge && m.receivedAt > cursor))
1451+collectPollEvents = \messages pubkey cursor t -> (\myMsgs -> (\limited -> {events: pluck limited (\m -> {m.encryptedBlob}), cursor: fold (\acc m -> max acc m.receivedAt) cursor limited, hasMore: count myMsgs > count limited}) (takeRelation maxPollEvents (sortBy (\m -> m.receivedAt) myMsgs))) (filter messages (\m -> m.toKey == pubkey && t - m.receivedAt < messageMaxAge && m.receivedAt > cursor))
14511452
14521453-- Treat the supplied cursor as an ack: drop all messages with
14531454-- receivedAt <= cursor, plus their pending forwards.