@@ -48,15 +48,9 @@ federationScheme = "https://"
48-- long after `receivedAt`; expired rows are pruned by `pruneExpired` (30 days).
48-- long after `receivedAt`; expired rows are pruned by `pruneExpired` (30 days).
49messageMaxAge : Int<Ms>
49messageMaxAge : Int<Ms>
50messageMaxAge = 2592000000
50messageMaxAge = 2592000000
51−-- Length (chars) of a hex-encoded Ed25519 pubkey (32 bytes → 64 hex).
54-- Max length of a hex-encoded message body / opaque blob (40 MiB hex ≈ 20 MiB bytes).
51-- Max length of a hex-encoded message body / opaque blob (40 MiB hex ≈ 20 MiB bytes).
55maxBlobLen : Int
52maxBlobLen : Int
56maxBlobLen = 41943040
53maxBlobLen = 41943040
57−-- Length of a hex-encoded Ed25519 signature (64 bytes → 128 hex).
60-- Cap on items in a batched send request.
54-- Cap on items in a batched send request.
61maxBatchSize : Int
55maxBatchSize : Int
62maxBatchSize = 100
56maxBatchSize = 100
@@ -195,11 +189,11 @@ isValidBoundedHex = \maxLen s -> not tooLong s maxLen && isValidHex s
195isValidExactHex : Int -> Text -> Bool
189isValidExactHex : Int -> Text -> Bool
196isValidExactHex = \exactLen s -> count (chars s) == exactLen && isValidHex s
190isValidExactHex = \exactLen s -> count (chars s) == exactLen && isValidHex s
197-- Hex-encoded Ed25519 public key (32 bytes → 64 chars exact).
191-- Hex-encoded Ed25519 public key (32 bytes → 64 chars exact).
198−type PubkeyHex = Text where isValidExactHex pubkeyLen
192+type PubkeyHex = Text where isValidExactHex 64
199-- Hex-encoded ciphertext or opaque blob; capped at `maxBlobLen` (~20 MiB).
193-- Hex-encoded ciphertext or opaque blob; capped at `maxBlobLen` (~20 MiB).
200type BlobHex = Text where isValidBoundedHex maxBlobLen
194type BlobHex = Text where isValidBoundedHex maxBlobLen
201-- Hex-encoded Ed25519 signature (64 bytes → 128 chars exact).
195-- Hex-encoded Ed25519 signature (64 bytes → 128 chars exact).
202−type SignatureHex = Text where isValidExactHex signatureLen
196+type SignatureHex = Text where isValidExactHex 128
203-- Normalized hostname (lowercased, no trailing dot, length-bounded). The SSRF
197-- Normalized hostname (lowercased, no trailing dot, length-bounded). The SSRF
204-- deny-list (`isBadServerName`) is enforced separately at federation egress
198-- deny-list (`isBadServerName`) is enforced separately at federation egress
205-- (`handleRecvGossip`); keeping it out of the type predicate lets the default
199-- (`handleRecvGossip`); keeping it out of the type predicate lets the default