@toon-protocol/relay 2.0.1 → 2.0.2

package/README.md

@@ -29,8 +29,39 @@ NOSTR_SECRET_KEY=<64-char-hex> npx @toon-protocol/relay
 | `TOON_MNEMONIC` | — | BIP-39 mnemonic (NIP-06 derivation) |
 | `TOON_RELAY_PORT` | `7100` | WebSocket read port |
 | `TOON_BLS_PORT` | `3100` | HTTP write/health port |
+| `TOON_HOST` | `0.0.0.0` | WebSocket bind host |
+| `TOON_WRITE_HOST` | `0.0.0.0` | HTTP write/health bind host (see [write-port exposure](#paid-ephemeral-verify-skip-relay85)) |
 | `TOON_DATA_DIR` | `./data` | SQLite data directory |
 | `TOON_DEV_MODE` | `false` | Skip event-signature verification on `POST /write` |
+| `TOON_VERIFY_EPHEMERAL` | `false` | Run FULL schnorr verification on ephemeral kinds too (see below) |
+| `TOON_VERIFY_WORKERS` | CPUs − 1 | Worker threads for persistent-kind signature verification; `0` = inline on the event loop (automatic on 1-core boxes) |
+| `TOON_MAX_CONNECTIONS` | `4096` | Maximum concurrent WebSocket read connections (each costs one file descriptor — mind `ulimit -n`) |
+
+## Paid-ephemeral verify skip (relay#85)
+
+By default the relay **skips schnorr verification for ephemeral kinds**
+(NIP-16, `20000 <= kind < 30000`) on `POST /write` and keeps only the SHA-256
+event-id check. This is a deliberate, payment-gated bypass:
+
+- **Why it is safe here:** every request reaching `POST /write` has already
+  passed the upstream connector's payment claim gate — payment is the
+  admission/spam gate. Protocol rule: clients trust the signature chain and
+  verify every event themselves, never the relay. Relay-side schnorr on paid
+  ephemeral frames buys no additional trust; forging a speaker costs real
+  money to emit frames every client discards.
+- **What is still checked:** the SHA-256 id check always runs, so the relay
+  never broadcasts bytes that disagree with the event id clients verify by.
+- **When you MUST turn it off:** if your write port is fronted by anything
+  other than a payment-gating connector — or you ever add a FREE ephemeral
+  write lane — set `TOON_VERIFY_EPHEMERAL=true` (`--verify-ephemeral`,
+  `verifyEphemeral: true`). A free lane must NOT reuse this skip.
+- **Exposure guard:** the write port must be reachable only via the
+  connector. In docker, never host-publish it (`expose:`, not `ports:` —
+  docker-published ports bypass ufw). Outside docker, bind it internally via
+  `TOON_WRITE_HOST=127.0.0.1`. At startup the relay logs a prominent warning
+  if the write listener binds a non-internal interface while the skip is
+  active (warning only — container topologies legitimately bind `0.0.0.0`
+  and stay private by not publishing the port).
 
 ## Run (programmatic)
 
@@ -46,8 +77,9 @@ await relay.stop();
 
 | Method | Path | Description |
 |--------|------|-------------|
-| `POST` | `/write` | Store an event. Body `{ "event": <NostrEvent> }`. Trusts injected `X-TOON-Payer`/`-Amount`/`-Chain` headers (echoed, not validated); verifies only the event signature. |
+| `POST` | `/write` | Store an event. Body `{ "event": <NostrEvent> }`. Trusts injected `X-TOON-Payer`/`-Amount`/`-Chain` headers (echoed, not validated); verifies only the event signature (ephemeral kinds: id check only by default, see above). |
 | `GET`  | `/health` | Liveness, identity (`pubkey`), `capabilities`, and `version`. |
+| `GET`  | `/metrics` | JSON telemetry: `eventLoopDelayMs` (mean/p50/p99/max — loop lag is ephemeral-frame tail latency) and `verify` (per-event verify wall time incl. pool queueing, active implementation, worker count). The trigger metrics for scaling decisions (relay#85). |
 
 ## WebSocket Relay Server
 
@@ -79,7 +111,7 @@ const results = memStore.query([{ kinds: [1], limit: 10 }]);
 
 ## TOON Codec
 
-Re-exported from [`@toon-protocol/core`](https://github.com/toon-protocol/core) for convenience.
+Vendored in-repo (`src/toon/codec.ts`) so the relay depends only on the lightweight `@toon-format/toon` encoder rather than `@toon-protocol/core`'s full transitive tree. The relay has no runtime dependency on `@toon-protocol/core`.
 
 ```ts
 import { encodeEventToToon, decodeEventFromToon } from '@toon-protocol/relay';

package/dist/{chunk-FXQSNOCG.js → chunk-QZQRHQEQ.js}

@@ -1,3 +1,9 @@
+import {
+  verifyEventId,
+  verifyEventSignature,
+  verifyImplementation
+} from "./chunk-SMT6G3XD.js";
+
 // src/version.ts
 var VERSION = "0.1.0";
 
@@ -5,7 +11,7 @@ var VERSION = "0.1.0";
 var DEFAULT_RELAY_CONFIG = {
   port: 7e3,
   host: "0.0.0.0",
-  maxConnections: 100,
+  maxConnections: 4096,
   maxSubscriptionsPerConnection: 20,
   maxFiltersPerSubscription: 10,
   databasePath: ":memory:"
@@ -132,6 +138,7 @@ function getDTagValue(tags) {
 var SqliteEventStore = class {
   db;
   insertStmt;
+  insertOrIgnoreStmt;
   getStmt;
   deleteByPubkeyKindStmt;
   deleteByPubkeyKindDTagStmt;
@@ -144,11 +151,17 @@ var SqliteEventStore = class {
   constructor(dbPath = ":memory:") {
     try {
       this.db = new Database(dbPath);
+      this.db.pragma("journal_mode = WAL");
+      this.db.pragma("synchronous = NORMAL");
       initializeSchema(this.db);
       this.insertStmt = this.db.prepare(`
         INSERT OR REPLACE INTO events (id, pubkey, kind, content, tags, created_at, sig, received_at)
         VALUES (?, ?, ?, ?, ?, ?, ?, ?)
       `);
+      this.insertOrIgnoreStmt = this.db.prepare(`
+        INSERT OR IGNORE INTO events (id, pubkey, kind, content, tags, created_at, sig, received_at)
+        VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+      `);
       this.getStmt = this.db.prepare("SELECT * FROM events WHERE id = ?");
       this.deleteByPubkeyKindStmt = this.db.prepare(
         "DELETE FROM events WHERE pubkey = ? AND kind = ?"
@@ -182,11 +195,7 @@ var SqliteEventStore = class {
       } else if (isParameterizedReplaceableKind(event.kind)) {
         this.storeParameterizedReplaceableEvent(event, tagsJson, receivedAt);
       } else {
-        const insertOrIgnore = this.db.prepare(`
-          INSERT OR IGNORE INTO events (id, pubkey, kind, content, tags, created_at, sig, received_at)
-          VALUES (?, ?, ?, ?, ?, ?, ?, ?)
-        `);
-        insertOrIgnore.run(
+        this.insertOrIgnoreStmt.run(
           event.id,
           event.pubkey,
           event.kind,
@@ -419,7 +428,124 @@ var SqliteEventStore = class {
   }
 };
 
+// src/crypto/verify-pool.ts
+import { existsSync } from "fs";
+import { cpus } from "os";
+import { fileURLToPath } from "url";
+import { Worker } from "worker_threads";
+import { performance } from "perf_hooks";
+import { verifiedSymbol } from "nostr-tools/pure";
+function defaultVerifyWorkers() {
+  return Math.max(0, cpus().length - 1);
+}
+function resolveWorkerUrl() {
+  for (const candidate of [
+    new URL("./verify-worker.js", import.meta.url),
+    new URL("../../dist/verify-worker.js", import.meta.url)
+  ]) {
+    try {
+      if (existsSync(fileURLToPath(candidate))) return candidate;
+    } catch {
+    }
+  }
+  return null;
+}
+function createVerifyPool(options = {}) {
+  const requestedSize = options.size ?? defaultVerifyWorkers();
+  const onMeasure = options.onMeasure;
+  const measured = (fn) => {
+    if (!onMeasure) return fn();
+    const start = performance.now();
+    const result = fn();
+    onMeasure(performance.now() - start);
+    return result;
+  };
+  const inlineVerify = (event) => Promise.resolve(measured(() => verifyEventSignature(event)));
+  const workerUrl = requestedSize > 0 ? resolveWorkerUrl() : null;
+  if (requestedSize > 0 && !workerUrl) {
+    console.warn(
+      "[relay] verify pool: compiled worker (dist/verify-worker.js) not found -- falling back to inline verification (build the package to enable workers)"
+    );
+  }
+  const workers = [];
+  let seq = 0;
+  let destroyed = false;
+  const retireWorker = (pw, reason) => {
+    const index = workers.indexOf(pw);
+    if (index === -1) return;
+    workers.splice(index, 1);
+    if (!destroyed) {
+      console.warn(
+        `[relay] verify pool: worker retired (${reason}); ` + (workers.length > 0 ? `${workers.length} worker(s) remain` : "falling back to inline verification")
+      );
+    }
+    for (const { resolve, event } of pw.pending.values()) {
+      resolve(verifyEventSignature(event));
+    }
+    pw.pending.clear();
+  };
+  if (workerUrl) {
+    for (let i = 0; i < requestedSize; i++) {
+      const worker = new Worker(workerUrl);
+      const pw = { worker, pending: /* @__PURE__ */ new Map() };
+      worker.on("message", (reply) => {
+        const entry = pw.pending.get(reply.seq);
+        if (!entry) return;
+        pw.pending.delete(reply.seq);
+        entry.event[verifiedSymbol] = reply.ok;
+        entry.resolve(reply.ok);
+      });
+      worker.on(
+        "error",
+        (error) => retireWorker(pw, `error: ${error.message}`)
+      );
+      worker.on("exit", () => retireWorker(pw, "exit"));
+      workers.push(pw);
+    }
+  }
+  const poolVerify = (event) => {
+    const cached = event[verifiedSymbol];
+    if (typeof cached === "boolean") return Promise.resolve(cached);
+    let target = workers[0];
+    if (!target) return inlineVerify(event);
+    for (const pw of workers) {
+      if (pw.pending.size < target.pending.size) target = pw;
+    }
+    const start = performance.now();
+    return new Promise((resolve) => {
+      const id = ++seq;
+      target.pending.set(id, {
+        event,
+        resolve: (ok) => {
+          onMeasure?.(performance.now() - start);
+          resolve(ok);
+        }
+      });
+      target.worker.postMessage({ seq: id, event });
+    });
+  };
+  return {
+    verify(event) {
+      return workers.length > 0 ? poolVerify(event) : inlineVerify(event);
+    },
+    get size() {
+      return workers.length;
+    },
+    async destroy() {
+      destroyed = true;
+      const toTerminate = [...workers];
+      for (const pw of toTerminate) {
+        retireWorker(pw, "destroy");
+      }
+      await Promise.all(toTerminate.map((pw) => pw.worker.terminate()));
+    }
+  };
+}
+
 // src/websocket/ConnectionHandler.ts
+function serializeEventFrame(subscriptionId, eventJson) {
+  return `["EVENT",${JSON.stringify(subscriptionId)},${eventJson}]`;
+}
 var ConnectionHandler = class {
   constructor(ws, eventStore, config = {}) {
     this.ws = ws;
@@ -519,12 +645,21 @@ var ConnectionHandler = class {
   /**
    * Push a new event to all matching subscriptions on this connection.
    * Used when events are stored outside the WebSocket flow (e.g., via ILP).
+   *
+   * @param event - The event to fan out (used for filter matching).
+   * @param eventJson - Optional pre-serialized `JSON.stringify(event)`.
+   *   `NostrRelayServer.broadcastEvent` serializes the event ONCE and passes
+   *   it here so a 500-subscriber fan-out costs one serialization, not 500
+   *   (relay#91). When omitted (direct callers), the event is serialized
+   *   on first matching send.
    */
-  notifyNewEvent(event) {
+  notifyNewEvent(event, eventJson) {
+    let json = eventJson;
     for (const sub of this.subscriptions.values()) {
       const matches = sub.filters.some((f) => matchFilter(event, f));
       if (matches) {
-        this.sendEvent(sub.id, event);
+        json ??= JSON.stringify(event);
+        this.send(serializeEventFrame(sub.id, json));
       }
     }
   }
@@ -548,9 +683,11 @@ var ConnectionHandler = class {
    * with the event as a plain JSON object — so any standard nostr client can
    * parse it and verify `id`/`sig` from the wire bytes (#46). Never re-encode
    * the event (TOON text, double-JSON-stringify, etc.) at this boundary.
+   * serializeEventFrame is byte-identical to the full JSON.stringify
+   * envelope (pinned by tests).
    */
   sendEvent(subscriptionId, event) {
-    this.send(["EVENT", subscriptionId, event]);
+    this.send(serializeEventFrame(subscriptionId, JSON.stringify(event)));
   }
   sendEose(subscriptionId) {
     this.send(["EOSE", subscriptionId]);
@@ -561,15 +698,32 @@ var ConnectionHandler = class {
   sendNotice(message) {
     this.send(["NOTICE", message]);
   }
+  /** Send a message: pre-serialized frames go out as-is (relay#91). */
   send(message) {
     if (this.ws.readyState === 1) {
-      this.ws.send(JSON.stringify(message));
+      this.ws.send(
+        typeof message === "string" ? message : JSON.stringify(message)
+      );
     }
   }
 };
 
 // src/websocket/NostrRelayServer.ts
+import { readFileSync } from "fs";
 import { WebSocketServer } from "ws";
+var FD_HEADROOM = 128;
+function readOpenFilesSoftLimit(read = (p) => readFileSync(p, "utf8")) {
+  try {
+    const line = read("/proc/self/limits").split("\n").find((l) => l.startsWith("Max open files"));
+    const match = line?.match(/Max open files\s+(\S+)/);
+    if (!match?.[1]) return null;
+    if (match[1] === "unlimited") return Infinity;
+    const limit = parseInt(match[1], 10);
+    return Number.isNaN(limit) ? null : limit;
+  } catch {
+    return null;
+  }
+}
 var NostrRelayServer = class {
   constructor(config = {}, eventStore) {
     this.eventStore = eventStore;
@@ -599,6 +753,12 @@ var NostrRelayServer = class {
           if (address && typeof address === "object") {
             console.log(`[NostrRelayServer] Listening on port ${address.port}`);
           }
+          const fdLimit = readOpenFilesSoftLimit();
+          if (fdLimit !== null && Number.isFinite(fdLimit) && this.config.maxConnections > fdLimit - FD_HEADROOM) {
+            console.warn(
+              `[NostrRelayServer] maxConnections (${this.config.maxConnections}) exceeds the process fd soft limit (${fdLimit}) minus ${FD_HEADROOM} headroom -- connections will fail with EMFILE before the cap. Raise \`ulimit -n\` or lower maxConnections.`
+            );
+          }
           resolve();
         });
       } catch (error) {
@@ -648,14 +808,24 @@ var NostrRelayServer = class {
    * Broadcast an event to all connected clients with matching subscriptions.
    * Call this after storing an event outside the WebSocket flow (e.g., via ILP)
    * so that discovery subscribers are notified.
+   *
+   * Serialize-once fan-out (relay#91): the event payload is stringified ONE
+   * time here and reused for every matching subscriber -- only the small
+   * per-subscription `["EVENT",<subId>,...]` envelope is spliced per send.
+   * Previously each of N subscribers re-serialized the identical event
+   * (N=500 pinned a core doing 500 identical stringifies per frame).
    */
   broadcastEvent(event) {
+    const eventJson = JSON.stringify(event);
     for (const handler of this.handlers.values()) {
-      handler.notifyNewEvent(event);
+      handler.notifyNewEvent(event, eventJson);
     }
   }
   handleConnection(ws) {
     if (this.handlers.size >= this.config.maxConnections) {
+      console.warn(
+        `[NostrRelayServer] connection rejected: maxConnections (${this.config.maxConnections}) reached -- raise TOON_MAX_CONNECTIONS if this box has headroom (relay#90)`
+      );
       ws.close(1013, "max connections reached");
       return;
     }
@@ -742,9 +912,81 @@ var RelaySubscriber = class {
   }
 };
 
+// src/launcher/metrics.ts
+import { monitorEventLoopDelay } from "perf_hooks";
+var VERIFY_WINDOW = 2048;
+var NS_PER_MS = 1e6;
+function percentileOf(sorted, fraction) {
+  if (sorted.length === 0) return 0;
+  const index = Math.min(
+    sorted.length - 1,
+    Math.ceil(fraction * sorted.length) - 1
+  );
+  return sorted[Math.max(0, index)] ?? 0;
+}
+function round(value) {
+  if (!Number.isFinite(value)) return 0;
+  return Math.round(value * 1e3) / 1e3;
+}
+function createMetricsRegistry(info) {
+  const loopDelay = monitorEventLoopDelay({
+    resolution: 20
+  });
+  loopDelay.enable();
+  let verifyWorkers = info.verifyWorkers;
+  let count = 0;
+  let totalMs = 0;
+  let maxMs = 0;
+  const window = new Array(VERIFY_WINDOW);
+  let windowFill = 0;
+  let windowCursor = 0;
+  return {
+    recordVerify(ms) {
+      count += 1;
+      totalMs += ms;
+      if (ms > maxMs) maxMs = ms;
+      window[windowCursor] = ms;
+      windowCursor = (windowCursor + 1) % VERIFY_WINDOW;
+      if (windowFill < VERIFY_WINDOW) windowFill += 1;
+    },
+    snapshot() {
+      const recent = window.slice(0, windowFill).sort((a, b) => a - b);
+      return {
+        timestamp: Date.now(),
+        eventLoopDelayMs: {
+          mean: round(loopDelay.mean / NS_PER_MS),
+          p50: round(loopDelay.percentile(50) / NS_PER_MS),
+          p99: round(loopDelay.percentile(99) / NS_PER_MS),
+          max: round(loopDelay.max / NS_PER_MS)
+        },
+        verify: {
+          implementation: info.verifyImplementation,
+          workers: verifyWorkers,
+          count,
+          meanMs: round(count > 0 ? totalMs / count : 0),
+          maxMs: round(maxMs),
+          p50Ms: round(percentileOf(recent, 0.5)),
+          p99Ms: round(percentileOf(recent, 0.99))
+        }
+      };
+    },
+    setVerifyWorkers(workers) {
+      verifyWorkers = workers;
+    },
+    stop() {
+      loopDelay.disable();
+    }
+  };
+}
+
 // src/launcher/handlers/write-handler.ts
-import { verifyEvent as verifyEvent2 } from "nostr-tools/pure";
+function isEphemeralKind(kind) {
+  return kind >= 2e4 && kind < 3e4;
+}
 function createWriteHandler(config) {
+  const logWrites = config.logWrites ?? false;
+  const verifyEphemeral = config.verifyEphemeral ?? false;
+  const verifyEvent2 = config.verifyEvent ?? verifyEventSignature;
   return {
     async handleWrite(c) {
       let body;
@@ -760,13 +1002,23 @@ function createWriteHandler(config) {
       const payer = c.req.header("X-TOON-Payer");
       const amount = c.req.header("X-TOON-Amount");
       const chain = c.req.header("X-TOON-Chain");
-      console.log(
-        `[write] event=${event.id} payer=${payer ?? "-"} amount=${amount ?? "-"} chain=${chain ?? "-"}`
-      );
-      if (!config.devMode && !verifyEvent2(event)) {
-        return c.json({ error: "Invalid event signature" }, 422);
+      if (logWrites) {
+        console.log(
+          `[write] event=${event.id} payer=${payer ?? "-"} amount=${amount ?? "-"} chain=${chain ?? "-"}`
+        );
+      }
+      if (!config.devMode) {
+        if (isEphemeralKind(event.kind) && !verifyEphemeral) {
+          if (!verifyEventId(event)) {
+            return c.json({ error: "Invalid event id" }, 422);
+          }
+        } else if (!await verifyEvent2(event)) {
+          return c.json({ error: "Invalid event signature" }, 422);
+        }
+      }
+      if (!isEphemeralKind(event.kind)) {
+        config.eventStore.store(event);
       }
-      config.eventStore.store(event);
       config.onStored?.(event);
       return c.json(
         {
@@ -814,6 +1066,41 @@ function deriveIdentity(config) {
   const secretKey = hasMnemonic ? privateKeyFromSeedWords(config.mnemonic) : config.secretKey;
   return { secretKey, pubkey: getPublicKey(secretKey) };
 }
+function isInternalBindHost(host) {
+  const h = host.trim().toLowerCase();
+  if (h === "localhost" || h === "::1" || h === "[::1]") return true;
+  if (h.startsWith("127.")) return true;
+  if (h.startsWith("10.")) return true;
+  if (h.startsWith("192.168.")) return true;
+  if (/^172\.(1[6-9]|2\d|3[01])\./.test(h)) return true;
+  if (/^f[cd][0-9a-f]{2}:/.test(h)) return true;
+  if (h.startsWith("fe80:")) return true;
+  return false;
+}
+function warnIfWritePortExposed(writeHost, blsPort, options) {
+  const skipActive = options.devMode || !options.verifyEphemeral;
+  if (!skipActive || isInternalBindHost(writeHost)) {
+    return false;
+  }
+  console.warn(
+    [
+      "",
+      "!".repeat(72),
+      `[relay] WARNING: POST /write is binding ${writeHost}:${blsPort} (a`,
+      "[relay] non-loopback/non-internal interface) while event verification",
+      options.devMode ? "[relay] is fully DISABLED (devMode)." : "[relay] is SKIPPED for paid ephemeral kinds (relay#85 default).",
+      "[relay] This is safe ONLY if the write port is reachable exclusively",
+      "[relay] through the payment-gating connector. In docker, do NOT",
+      "[relay] host-publish this port (`expose:`, never `ports:` -- published",
+      "[relay] ports bypass ufw). If the port is directly reachable, either",
+      "[relay] bind it internally (TOON_WRITE_HOST=127.0.0.1) or restore full",
+      "[relay] verification (TOON_VERIFY_EPHEMERAL=true).",
+      "!".repeat(72),
+      ""
+    ].join("\n")
+  );
+  return true;
+}
 function createSubscription(relayUrl, filter, eventStore, activeSubscriptions) {
   if (!relayUrl.startsWith("ws://") && !relayUrl.startsWith("wss://")) {
     throw new Error(
@@ -846,14 +1133,24 @@ async function startRelay(config) {
   const relayPort = config.relayPort ?? 7100;
   const blsPort = config.blsPort ?? 3100;
   const host = config.host ?? "0.0.0.0";
+  const writeHost = config.writeHost ?? "0.0.0.0";
+  const maxConnections = config.maxConnections ?? DEFAULT_RELAY_CONFIG.maxConnections;
   const dataDir = config.dataDir ?? "./data";
   const devMode = config.devMode ?? false;
+  const verifyEphemeral = config.verifyEphemeral ?? false;
+  const verifyWorkers = config.verifyWorkers ?? defaultVerifyWorkers();
+  const logWrites = config.logWrites ?? false;
   const resolvedConfig = {
     relayPort,
     blsPort,
     host,
+    writeHost,
+    maxConnections,
     dataDir,
-    devMode
+    devMode,
+    verifyEphemeral,
+    verifyWorkers,
+    logWrites
   };
   let eventStore;
   if (config.eventStore) {
@@ -862,15 +1159,43 @@ async function startRelay(config) {
     mkdirSync(dataDir, { recursive: true });
     eventStore = new SqliteEventStore(join(dataDir, "events.db"));
   }
-  const wsRelay = new NostrRelayServer({ port: relayPort, host }, eventStore);
+  const wsRelay = new NostrRelayServer(
+    { port: relayPort, host, maxConnections },
+    eventStore
+  );
   const app = new Hono();
   app.get(
     "/health",
     (c) => c.json(createHealthResponse({ pubkey: identity.pubkey }))
   );
+  const metrics = createMetricsRegistry({
+    verifyImplementation,
+    verifyWorkers: 0
+    // updated once the pool reports its live size below
+  });
+  const verifyPool = createVerifyPool({
+    size: verifyWorkers,
+    onMeasure: (ms) => metrics.recordVerify(ms)
+  });
+  metrics.setVerifyWorkers(verifyPool.size);
+  app.get("/metrics", (c) => c.json(metrics.snapshot()));
+  console.log(`[relay] event signature verify: ${verifyImplementation}`);
+  console.log(
+    `[relay] ephemeral-kind schnorr verify: ${devMode ? "skipped (devMode)" : verifyEphemeral ? "full (TOON_VERIFY_EPHEMERAL)" : "skipped -- payment-gated write path, id check kept (relay#85)"}`
+  );
+  warnIfWritePortExposed(writeHost, blsPort, { verifyEphemeral, devMode });
+  console.log(
+    `[relay] verify pool: ${verifyPool.size > 0 ? `${verifyPool.size} worker thread(s)` : "inline (0 workers -- verification on the event loop)"}`
+  );
   const writeHandler = createWriteHandler({
     eventStore,
     devMode,
+    verifyEphemeral,
+    verifyEvent: (event) => {
+      metrics.setVerifyWorkers(verifyPool.size);
+      return verifyPool.verify(event);
+    },
+    logWrites,
     onStored: (event) => {
       try {
         wsRelay.broadcastEvent(event);
@@ -881,7 +1206,7 @@ async function startRelay(config) {
   app.post("/write", (c) => writeHandler.handleWrite(c));
   const blsServer = await new Promise((resolve) => {
     const server = serve(
-      { fetch: app.fetch, port: blsPort },
+      { fetch: app.fetch, port: blsPort, hostname: writeHost },
       () => resolve(server)
     );
   });
@@ -912,6 +1237,8 @@ async function startRelay(config) {
       activeSubscriptions.clear();
       await wsRelay.stop();
       blsServer.close();
+      metrics.stop();
+      await verifyPool.destroy();
       if (!config.eventStore) {
         eventStore.close?.();
       }
@@ -929,11 +1256,18 @@ export {
   InMemoryEventStore,
   RelayError,
   SqliteEventStore,
+  defaultVerifyWorkers,
+  createVerifyPool,
+  serializeEventFrame,
   ConnectionHandler,
+  readOpenFilesSoftLimit,
   NostrRelayServer,
   RelaySubscriber,
+  createMetricsRegistry,
   createWriteHandler,
   createHealthResponse,
+  isInternalBindHost,
+  warnIfWritePortExposed,
   startRelay
 };
-//# sourceMappingURL=chunk-FXQSNOCG.js.map
+//# sourceMappingURL=chunk-QZQRHQEQ.js.map