onelobby 0.5.0 → 0.7.0

package/dist/direct/hub-local.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hub-local.js","sourceRoot":"","sources":["../../src/direct/hub-local.ts"],"names":[],"mappings":"AAGA;;;;GAIG;AACH,MAAM,OAAO,cAAc;IAUI;IAT7B,wFAAwF;IACxF,MAAM,CAAU,OAAO,GAAG,OAAO,CAAC;IAClC,UAAU,GAAG,CAAC,CAAC;IACf,MAAM,GAAyB,IAAI,CAAC;IACpC,SAAS,GAA4B,IAAI,CAAC;IAC1C,OAAO,GAA0B,IAAI,CAAC;IACtC,OAAO,GAA0B,IAAI,CAAC;IAC9B,OAAO,CAAiB;IAEhC,YAA6B,GAAiB;QAAjB,QAAG,GAAH,GAAG,CAAc;QAC5C,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,KAAK,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CACjJ,IAAI,CAAC,MAAM,EAAE,CACd,CAAC;QACF,cAAc,CAAC,GAAG,EAAE;YAClB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;gBAClB,IAAI,CAAC,MAAM,EAAE,CAAC;gBACd,OAAO;YACT,CAAC;YACD,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC;YACpB,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,IAAY;QACf,IAAI,IAAI,CAAC,UAAU,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO;YAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAClF,CAAC;IAED,KAAK;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC;QACvB,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,KAAK,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,EAAE,CAAC;QACd,IAAI,OAAO,IAAI,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC3C,CAAC;IAEO,MAAM;QACZ,IAAI,IAAI,CAAC,UAAU,KAAK,CAAC;YAAE,OAAO;QAClC,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC;QACpB,cAAc,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACzC,CAAC","sourcesContent":["import type { SocketLike } from \"../transport.js\";\nimport type { SignalingHub, Session } from \"./hub.js\";\n\n/**\n * A direct host's own signaling socket (C#'s `HubSignalingSocket`): sends go straight into the hub; the hub's\n * replies are delivered on a microtask, so callbacks never run inside the hub. No Node APIs, so a browser tab can\n * use it too (`kit.hostNostr`).\n */\nexport class LocalHubSocket implements SocketLike {\n  /** Address the hub sees for the host itself (rate limits and kicks are per address). */\n  static readonly ADDRESS = \"local\";\n  readyState = 0;\n  onopen: SocketLike[\"onopen\"] = null;\n  onmessage: SocketLike[\"onmessage\"] = null;\n  onclose: SocketLike[\"onclose\"] = null;\n  onerror: SocketLike[\"onerror\"] = null;\n  private session: Session | null;\n\n  constructor(private readonly hub: SignalingHub) {\n    this.session = hub.connect(LocalHubSocket.ADDRESS, (text) => queueMicrotask(() => this.readyState === 1 && this.onmessage?.({ data: text })), () =>\n      this.finish(),\n    );\n    queueMicrotask(() => {\n      if (!this.session) {\n        this.finish();\n        return;\n      }\n      this.readyState = 1;\n      this.onopen?.();\n    });\n  }\n\n  send(data: string): void {\n    if (this.readyState === 1 && this.session) this.hub.receive(this.session, data);\n  }\n\n  close(): void {\n    const s = this.session;\n    const wasOpen = this.readyState === 1;\n    this.finish();\n    if (wasOpen && s) this.hub.disconnect(s);\n  }\n\n  private finish(): void {\n    if (this.readyState === 3) return;\n    this.readyState = 3;\n    queueMicrotask(() => this.onclose?.());\n  }\n}\n"]}

package/dist/direct/hub.d.ts

@@ -1,10 +1,13 @@
 /**
- * The signaling hub (protocol lk1) in TypeScript, for a Node process that hosts direct-IP lobbies
- * (docs/direct-ip.md s.2): a line-by-line port of `server/OneLobby.Hub/Hub.cs`, held to the same rules by
+ * The signaling hub (protocol lk1) in TypeScript, for a Node process or a browser tab that hosts direct lobbies
+ * (docs/design/direct-ip.md s.2): a line-by-line port of `server/OneLobby.Hub/Hub.cs`, held to the same rules by
  * `conformance/server`. Transport-agnostic: feed it text frames with `receive`, call `tick` about once a second.
- * Metrics are left out (that is onelobby-server's job); everything else (codes, list, resume, private lobbies,
- * kicks, migration claims, TURN credentials, rate limits) behaves as in C#.
+ * Metrics (same names, labels and help text as C#, rendered by `metrics.render()`) are counted too, so every hub shape
+ * looks the same from outside; everything else (codes, list, resume, private lobbies, kicks, migration claims, TURN
+ * credentials, rate limits) behaves as in C#.
  */
+import { Metrics } from "./metrics.js";
+export { Metrics };
 export declare const PROTO = "lk1";
 /** The settings the hub reads; same names and defaults as C#'s `HubOptions`. */
 export interface HubOptions {
@@ -26,6 +29,8 @@ export interface HubOptions {
     createPerMin: number;
     joinPerMin: number;
     signalPerSec: number;
+    /** Open sockets per address (loopback included); `disableIpLimits` lifts it, `rateScale` scales it. */
+    socketsPerIp: number;
     openLobbiesPerIp: number;
     idleTimeoutMs: number;
     resumeWindowMs: number;
@@ -39,8 +44,14 @@ export interface HubOptions {
     issueCodes: boolean;
 }
 export declare function defaultHubOptions(): HubOptions;
-/** Settings for a hub inside the host's game (docs/direct-ip.md s.2): no codes, no list, no ICE servers. */
+/** Settings for a hub inside the host's game (docs/design/direct-ip.md s.2): no codes, no list, no ICE servers. */
 export declare function directHubOptions(maxPlayers: number, password?: string | null): HubOptions;
+/** A session's total `signal` budget is this many targets' worth of `signalPerSec` (spec/signaling.md rate limits). */
+export declare const SIGNAL_FANOUT = 8;
+/** Hub sessions bridged from Nostr have the address `nostr:<pubkey prefix>`. */
+export declare const NOSTR_ADDR = "nostr:";
+/** `signal` per second per (sender, Nostr target): relays reject high publish rates. */
+export declare const NOSTR_SIGNAL_PER_SEC = 10;
 /** Sliding-window counter: at most `limit` events per `windowMs`. */
 export declare class RateWindow {
     readonly limit: number;
@@ -60,8 +71,7 @@ export declare class Session {
     readonly ip: string;
     readonly connId: string;
     readonly send: (text: string) => void;
-    readonly close: () => void;
-    readonly signalRate: RateWindow;
+    readonly close: (code?: number, reason?: string) => void;
     closed: boolean;
     lastSeen: number;
     helloDone: boolean;
@@ -72,7 +82,13 @@ export declare class Session {
     member: Member | null;
     pendingIn: HubLobby | null;
     pendingMember: Member | null;
-    constructor(id: number, ip: string, connId: string, send: (text: string) => void, close: () => void, signalRate: RateWindow);
+    constructor(id: number, ip: string, connId: string, send: (text: string) => void, close: (code?: number, reason?: string) => void);
+    /** Nostr joiners: the remote address of the host's WebRTC link to this session, once known (kick bans it too). */
+    linkIp: string | null;
+    /** One window per target member (a member belongs to one lobby, so a new lobby starts fresh). */
+    readonly signalRates: Map<Member, RateWindow>;
+    /** All signals of this session, so the per-target budget does not grow without bound with the lobby. */
+    signalTotal: RateWindow | null;
 }
 declare class Member {
     peerId: number;
@@ -82,6 +98,7 @@ declare class Member {
     detachedAt: number;
     token: string;
     ip: string;
+    renames: RateWindow | null;
 }
 declare class HubLobby {
     code: string;
@@ -132,13 +149,20 @@ export declare class SignalingHub {
     private createdOnce;
     private members;
     private readonly logSalt;
+    readonly metrics: Metrics;
     constructor(options?: Partial<HubOptions>, deps?: HubDeps);
     get lobbyCount(): number;
     get socketCount(): number;
     private get scale();
     /** Registers a socket. Returns null (after sending server_full and closing) when over maxPeers. */
-    connect(ip: string, send: (text: string) => void, close: () => void): Session | null;
+    connect(ip: string, send: (text: string) => void, close: (code?: number, reason?: string) => void): Session | null;
     disconnect(s: Session): void;
+    /**
+     * The host's WebRTC link to joiner `peerId` has the remote address `ip` (selected candidate pair; the host's own
+     * lobby reports it, a relayed or mDNS address must not be passed). Only Nostr sessions take it: their socket address
+     * is a pubkey the joiner chose. A joiner whose link address is banned is removed as kicked; a later kick bans it.
+     */
+    reportLinkAddress(peerId: number, ip: string): void;
     private closeSession;
     /** Call about once a second: idle timeouts, resume-window expiry, code retirement. */
     tick(): void;
@@ -153,8 +177,14 @@ export declare class SignalingHub {
     private list;
     private leave;
     private signal;
+    /**
+     * spec/signaling.md rate limits: `signal` is counted per sender and target, so a host answering several joiners at once
+     * gets the budget for each, and per sender in total (SIGNAL_FANOUT targets' worth).
+     */
+    private signalRate;
     private requireHost;
     private hostMeta;
+    private setName;
     private hostPhase;
     private kick;
     private approve;
@@ -178,4 +208,3 @@ export declare class SignalingHub {
     private logEvent;
     private hashIp;
 }
-export {};

package/dist/direct/hub.js

@@ -1,12 +1,14 @@
-/// <reference types="node" />
-import { createHash, createHmac, randomBytes, randomInt } from "node:crypto";
 /**
- * The signaling hub (protocol lk1) in TypeScript, for a Node process that hosts direct-IP lobbies
- * (docs/direct-ip.md s.2): a line-by-line port of `server/OneLobby.Hub/Hub.cs`, held to the same rules by
+ * The signaling hub (protocol lk1) in TypeScript, for a Node process or a browser tab that hosts direct lobbies
+ * (docs/design/direct-ip.md s.2): a line-by-line port of `server/OneLobby.Hub/Hub.cs`, held to the same rules by
  * `conformance/server`. Transport-agnostic: feed it text frames with `receive`, call `tick` about once a second.
- * Metrics are left out (that is onelobby-server's job); everything else (codes, list, resume, private lobbies,
- * kicks, migration claims, TURN credentials, rate limits) behaves as in C#.
+ * Metrics (same names, labels and help text as C#, rendered by `metrics.render()`) are counted too, so every hub shape
+ * looks the same from outside; everything else (codes, list, resume, private lobbies, kicks, migration claims, TURN
+ * credentials, rate limits) behaves as in C#.
  */
+import { Metrics } from "./metrics.js";
+import { randomBelow, randomHex, shortHash, turnCredential } from "./sha1.js";
+export { Metrics };
 export const PROTO = "lk1";
 const NAME_MAX = 24;
 const LOBBY_NAME_MAX = 48;
@@ -19,11 +21,11 @@ export function defaultHubOptions() {
     return {
         turnUrls: [], turnSecret: "", stunUrls: ["stun:stun.l.google.com:19302"], region: "", allowedGames: [], gameQuotas: {},
         maxLobbies: 1000, maxPeers: 10000, hardMaxPlayers: 64, rateScale: 1, turnTtlSeconds: 3600, maxMessageBytes: 16 * 1024,
-        disableIpLimits: false, createPerMin: 10, joinPerMin: 60, signalPerSec: 20, openLobbiesPerIp: 8, idleTimeoutMs: 30_000,
+        disableIpLimits: false, createPerMin: 10, joinPerMin: 60, signalPerSec: 20, socketsPerIp: 32, openLobbiesPerIp: 8, idleTimeoutMs: 30_000,
         resumeWindowMs: 60_000, codeReuseMs: 24 * 3600 * 1000, listLimitMax: 100, singleLobby: false, password: null, issueCodes: true,
     };
 }
-/** Settings for a hub inside the host's game (docs/direct-ip.md s.2): no codes, no list, no ICE servers. */
+/** Settings for a hub inside the host's game (docs/design/direct-ip.md s.2): no codes, no list, no ICE servers. */
 export function directHubOptions(maxPlayers, password) {
     const n = Math.min(250, Math.max(2, maxPlayers));
     return {
@@ -32,6 +34,12 @@ export function directHubOptions(maxPlayers, password) {
         maxLobbies: 1, hardMaxPlayers: n, maxPeers: n + 8,
     };
 }
+/** A session's total `signal` budget is this many targets' worth of `signalPerSec` (spec/signaling.md rate limits). */
+export const SIGNAL_FANOUT = 8;
+/** Hub sessions bridged from Nostr have the address `nostr:<pubkey prefix>`. */
+export const NOSTR_ADDR = "nostr:";
+/** `signal` per second per (sender, Nostr target): relays reject high publish rates. */
+export const NOSTR_SIGNAL_PER_SEC = 10;
 /** Sliding-window counter: at most `limit` events per `windowMs`. */
 export class RateWindow {
     limit;
@@ -105,7 +113,6 @@ export class Session {
     connId;
     send;
     close;
-    signalRate;
     closed = false;
     lastSeen = 0;
     helloDone = false;
@@ -116,14 +123,19 @@ export class Session {
     member = null;
     pendingIn = null;
     pendingMember = null;
-    constructor(id, ip, connId, send, close, signalRate) {
+    constructor(id, ip, connId, send, close) {
         this.id = id;
         this.ip = ip;
         this.connId = connId;
         this.send = send;
         this.close = close;
-        this.signalRate = signalRate;
     }
+    /** Nostr joiners: the remote address of the host's WebRTC link to this session, once known (kick bans it too). */
+    linkIp = null;
+    /** One window per target member (a member belongs to one lobby, so a new lobby starts fresh). */
+    signalRates = new Map();
+    /** All signals of this session, so the per-target budget does not grow without bound with the lobby. */
+    signalTotal = null;
 }
 class Member {
     peerId = 0;
@@ -133,6 +145,7 @@ class Member {
     detachedAt = 0;
     token = "";
     ip = "";
+    renames = null;
 }
 class HubLobby {
     code = "";
@@ -162,7 +175,7 @@ class HubLobby {
         return this.members.find((m) => m.peerId === peerId);
     }
 }
-const KNOWN_TYPES = new Set(["hello", "create", "join", "list", "leave", "signal", "meta", "phase", "kick", "approve", "ping", "host_changed", "path"]);
+const KNOWN_TYPES = new Set(["hello", "create", "join", "list", "leave", "signal", "meta", "phase", "kick", "approve", "ping", "host_changed", "path", "set_name"]);
 const str = (o, k) => (typeof o[k] === "string" ? o[k] : null);
 const int = (o, k) => {
     const v = o[k];
@@ -171,7 +184,7 @@ const int = (o, k) => {
 const bool = (o, k) => (typeof o[k] === "boolean" ? o[k] : null);
 const has = (o, k) => o[k] !== undefined && o[k] !== null;
 const field = (name) => ({ field: name });
-const hex = (n) => randomBytes(n).toString("hex");
+const hex = (n) => randomHex(n);
 const byCode = (a, b) => (a < b ? -1 : a > b ? 1 : 0);
 /** Not sanitised (spec/signaling.md): over the limits or non-string values are rejected. */
 function readMeta(node) {
@@ -208,11 +221,22 @@ export class SignalingHub {
     createdOnce = false;
     members = 0;
     logSalt = hex(8);
+    metrics = new Metrics();
     constructor(options = {}, deps = {}) {
         this.o = { ...defaultHubOptions(), ...options };
         this.now = deps.now ?? (() => Date.now());
-        this.rand = deps.randomInt ?? ((n) => randomInt(n));
+        this.rand = deps.randomInt ?? ((n) => randomBelow(n));
         this.log = deps.log ?? (() => { });
+        const m = this.metrics;
+        m.gauge("onelobby_lobbies", "Live lobbies.", () => this.lobbyCount);
+        m.gauge("onelobby_sockets", "Open signaling sockets.", () => this.socketCount);
+        m.gauge("onelobby_lobbies_retired", "Join codes held back from reuse.", () => this.retired.size);
+        m.describe("onelobby_messages_total", "Client messages received, by type.");
+        m.describe("onelobby_errors_total", "Error replies sent, by code.");
+        m.describe("onelobby_path_total", "ICE path reports from peers: direct vs relayed (DESIGN s.10).");
+        m.describe("onelobby_connections_total", "Sockets accepted since start.");
+        m.describe("onelobby_lobbies_created_total", "Lobbies created since start.");
+        m.describe("onelobby_rate_limit_hits_total", "Requests refused by a rate limit, by kind.");
     }
     get lobbyCount() {
         return this.lobbies.size;
@@ -226,15 +250,22 @@ export class SignalingHub {
     // ---------------------------------------------------------------- connection lifecycle
     /** Registers a socket. Returns null (after sending server_full and closing) when over maxPeers. */
     connect(ip, send, close) {
-        const s = new Session(++this.nextSession, ip, hex(6), send, close, new RateWindow(this.o.signalPerSec * this.scale, 1000));
+        const s = new Session(++this.nextSession, ip, hex(6), send, close);
         s.lastSeen = this.now();
+        this.metrics.inc("onelobby_connections_total");
         if (this.sessions.size >= this.o.maxPeers) {
             this.error(s, "server_full", "server is at its peer limit");
             s.close();
             return null;
         }
+        const st = this.ipOf(ip);
+        if (!this.o.disableIpLimits && st.sockets >= this.o.socketsPerIp * this.scale) {
+            this.rateLimited(s, "sockets", 5000, "max_sockets");
+            s.close(1008, "too_many_sockets");
+            return null;
+        }
         this.sessions.set(s.id, s);
-        this.ipOf(ip).sockets++;
+        st.sockets++;
         return s;
     }
     disconnect(s) {
@@ -259,10 +290,30 @@ export class SignalingHub {
             s.lobby = null;
             this.logEvent("detach", lobby, s);
             this.broadcast(lobby, { t: "peer_left", peerId: m.peerId, reason: "timeout" });
+            this.metrics.inc("onelobby_peers_left_total", "reason", "timeout");
             if (lobby.hostId === m.peerId)
                 this.promoteHost(lobby, m.peerId);
         }
     }
+    /**
+     * The host's WebRTC link to joiner `peerId` has the remote address `ip` (selected candidate pair; the host's own
+     * lobby reports it, a relayed or mDNS address must not be passed). Only Nostr sessions take it: their socket address
+     * is a pubkey the joiner chose. A joiner whose link address is banned is removed as kicked; a later kick bans it.
+     */
+    reportLinkAddress(peerId, ip) {
+        for (const lobby of this.lobbies.values()) {
+            const mem = lobby.find(peerId);
+            const sess = mem?.session;
+            if (!mem || !sess || !sess.ip.startsWith(NOSTR_ADDR))
+                continue;
+            sess.linkIp = ip;
+            if (lobby.kicked.has(ip)) {
+                this.removeMember(lobby, mem, "kicked");
+                this.closeSession(sess);
+            }
+            return;
+        }
+    }
     closeSession(s) {
         s.close();
         this.disconnect(s);
@@ -272,8 +323,10 @@ export class SignalingHub {
     tick() {
         const now = this.now();
         for (const s of [...this.sessions.values()])
-            if (now - s.lastSeen > this.o.idleTimeoutMs)
+            if (now - s.lastSeen > this.o.idleTimeoutMs) {
+                this.metrics.inc("onelobby_idle_timeouts_total");
                 this.closeSession(s);
+            }
         for (const lobby of [...this.lobbies.values()])
             for (const m of [...lobby.members])
                 if (m.detachedAt > 0 && now - m.detachedAt >= this.o.resumeWindowMs)
@@ -308,6 +361,7 @@ export class SignalingHub {
             this.error(s, "bad_request", "expected a JSON object with a string t", field("t"));
             return;
         }
+        this.metrics.inc("onelobby_messages_total", "type", KNOWN_TYPES.has(t) ? t : "unknown");
         if (t === "hello")
             return this.hello(s, msg);
         if (!s.helloDone) {
@@ -333,6 +387,7 @@ export class SignalingHub {
             }
             case "host_changed": return this.claimHost(s, msg);
             case "path": return this.pathReport(s, msg);
+            case "set_name": return this.setName(s, msg);
             default: return; // unknown types are ignored
         }
     }
@@ -386,6 +441,7 @@ export class SignalingHub {
             ice: this.iceList(s),
             serverTime: this.now(),
             limits: { maxMsg: this.o.maxMessageBytes, maxPlayers: this.o.hardMaxPlayers },
+            features: ["set_name"],
         };
         if (resumed)
             w.peerId = resumed.peerId;
@@ -399,6 +455,7 @@ export class SignalingHub {
             s.lobby = rl;
             s.member = resumed;
             this.logEvent("resume", rl, s);
+            this.metrics.inc("onelobby_resumes_total");
             for (const other of rl.members)
                 if (other !== resumed)
                     this.sendTo(other, { t: "peer_joined", peer: this.peerObj(resumed) });
@@ -412,7 +469,7 @@ export class SignalingHub {
         if (this.o.turnUrls.length > 0 && this.o.turnSecret.length > 0) {
             const expiry = Math.floor(this.now() / 1000) + this.o.turnTtlSeconds;
             const username = `${expiry}:${s.connId}`;
-            const credential = createHmac("sha1", this.o.turnSecret).update(username).digest("base64");
+            const credential = turnCredential(this.o.turnSecret, username);
             ice.push({ urls: [...this.o.turnUrls], username, credential, ttl: this.o.turnTtlSeconds });
         }
         return ice;
@@ -482,6 +539,7 @@ export class SignalingHub {
         this.createdOnce = true;
         this.gameLobbies.set(s.gameId, (this.gameLobbies.get(s.gameId) ?? 0) + 1);
         ip.open++;
+        this.metrics.inc("onelobby_lobbies_created_total");
         const host = this.addMember(lobby, s, null);
         lobby.hostId = host.peerId;
         this.logEvent("create", lobby, s);
@@ -632,13 +690,20 @@ export class SignalingHub {
         const me = s.member;
         if (!lobby || !me)
             return this.error(s, "bad_request", "not in a lobby");
-        const now = this.now();
-        if (!this.o.disableIpLimits && !s.signalRate.tryHit(now))
-            return this.rateLimited(s, "signal", s.signalRate.retryAfterMs(now), null);
         const to = int(m, "to");
         const target = to === null ? undefined : lobby.find(to);
         if (!target || !target.session || target === me)
             return this.error(s, "bad_request", "unknown signal target", field("to"));
+        // a direct hub has no migration: the only peer links are host <-> joiner, so a joiner cannot dial another joiner
+        if (this.o.singleLobby && me.peerId !== lobby.hostId && target.peerId !== lobby.hostId)
+            return this.error(s, "bad_request", "signals go to or from the host only", field("to"));
+        const now = this.now();
+        const rate = this.signalRate(s, target, now);
+        if (!rate.tryHit(now))
+            return this.rateLimited(s, "signal", rate.retryAfterMs(now), null);
+        const total = (s.signalTotal ??= new RateWindow(this.o.signalPerSec * SIGNAL_FANOUT * this.scale, 1000));
+        if (!total.tryHit(now))
+            return this.rateLimited(s, "signal", total.retryAfterMs(now), null);
         if (!has(m, "sdp") && !has(m, "ice"))
             return this.error(s, "bad_request", "signal needs sdp or ice", field("sdp"));
         const o = { t: "signal", from: me.peerId };
@@ -647,6 +712,23 @@ export class SignalingHub {
         if (has(m, "ice"))
             o.ice = m.ice;
         this.send(target.session, o);
+        this.metrics.inc("onelobby_signals_relayed_total");
+    }
+    /**
+     * spec/signaling.md rate limits: `signal` is counted per sender and target, so a host answering several joiners at once
+     * gets the budget for each, and per sender in total (SIGNAL_FANOUT targets' worth).
+     */
+    signalRate(s, to, now) {
+        let w = s.signalRates.get(to);
+        if (!w) {
+            for (const [k, v] of s.signalRates)
+                if (v.isIdle(now))
+                    s.signalRates.delete(k);
+            // relays refuse high publish rates, so a Nostr-bridged target gets half the budget
+            w = new RateWindow((to.session?.ip.startsWith(NOSTR_ADDR) ? NOSTR_SIGNAL_PER_SEC : this.o.signalPerSec) * this.scale, 1000);
+            s.signalRates.set(to, w);
+        }
+        return w;
     }
     requireHost(s) {
         if (!s.lobby || !s.member) {
@@ -669,6 +751,22 @@ export class SignalingHub {
         lobby.meta = meta.meta;
         this.broadcastLobby(lobby);
     }
+    setName(s, m) {
+        if (!s.lobby || !s.member)
+            return this.error(s, "bad_request", "not in a lobby");
+        const name = typeof m.name === "string" ? sanitize(m.name, NAME_MAX) : "";
+        if (!name)
+            return this.error(s, "bad_request", "name must be a non-empty string", field("name"));
+        if (name === s.member.name)
+            return;
+        const now = this.now();
+        const rate = (s.member.renames ??= new RateWindow(this.scale, 1000));
+        if (!rate.tryHit(now))
+            return this.rateLimited(s, "set_name", rate.retryAfterMs(now), null);
+        s.member.name = name;
+        s.name = name;
+        this.broadcastLobby(s.lobby);
+    }
     hostPhase(s, m) {
         const lobby = this.requireHost(s);
         if (!lobby)
@@ -705,8 +803,13 @@ export class SignalingHub {
             data.closeCode = code;
         if (closeReason !== null)
             data.closeReason = closeReason;
-        if (ban !== false)
+        if (ban !== false) {
             lobby.kicked.add(target.ip);
+            // a Nostr joiner picks its own key, so also ban the address its WebRTC link came from, when the host saw it
+            const link = target.session?.linkIp;
+            if (link && target.ip.startsWith(NOSTR_ADDR))
+                lobby.kicked.add(link);
+        }
         this.removeMember(lobby, target, ban === false ? "disconnected" : "kicked", Object.keys(data).length ? data : undefined);
     }
     approve(s, m) {
@@ -755,11 +858,14 @@ export class SignalingHub {
         lobby.epoch = epoch;
         lobby.pendingClaimPeer = lobby.pendingClaimEpoch = 0;
         this.broadcast(lobby, { t: "host_changed", hostId: lobby.hostId, epoch: lobby.epoch });
+        this.metrics.inc("onelobby_host_changes_total");
         this.logEvent("host_claim", lobby, s);
     }
     pathReport(s, m) {
         const p = str(m, "path");
-        if (p !== "relayed" && p !== "direct")
+        if (p === "relayed" || p === "direct")
+            this.metrics.inc("onelobby_path_total", "path", p);
+        else
             this.error(s, "bad_request", "path must be relayed or direct", field("path"));
     }
     // ---------------------------------------------------------------- membership changes
@@ -779,6 +885,7 @@ export class SignalingHub {
         }
         if (wasConnected) {
             this.broadcast(lobby, { t: "peer_left", peerId: mem.peerId, reason });
+            this.metrics.inc("onelobby_peers_left_total", "reason", reason);
             if ((reason === "kicked" || reason === "disconnected") && ms)
                 this.error(ms, "kicked", reason === "kicked" ? "the host removed you from the lobby" : "the host disconnected you", kickData);
         }
@@ -811,6 +918,7 @@ export class SignalingHub {
         else
             lobby.epoch++;
         this.broadcast(lobby, { t: "host_changed", hostId: next.peerId, epoch: lobby.epoch });
+        this.metrics.inc("onelobby_host_changes_total");
         const hs = next.session;
         if (hs)
             for (const pm of lobby.pending)
@@ -884,12 +992,14 @@ export class SignalingHub {
             this.send(m.session, o);
     }
     error(s, code, msg, data) {
+        this.metrics.inc("onelobby_errors_total", "code", code);
         const o = { t: "error", code, msg };
         if (data !== undefined)
             o.data = data;
         s.send(JSON.stringify(o));
     }
     rateLimited(s, kind, retryAfterMs, reason) {
+        this.metrics.inc("onelobby_rate_limit_hits_total", "kind", kind);
         this.log(`rate_limit kind=${kind} ip=${this.hashIp(s.ip)}`);
         const data = { retryAfterMs };
         if (reason !== null)
@@ -900,7 +1010,7 @@ export class SignalingHub {
         this.log(`lobby ${ev} code=${l.code} game=${l.gameId} players=${l.members.length} ip=${s ? this.hashIp(s.ip) : "-"}`);
     }
     hashIp(ip) {
-        return createHash("sha256").update(this.logSalt + ip).digest("hex").slice(0, 8);
+        return shortHash(this.logSalt + ip);
     }
 }
 //# sourceMappingURL=hub.js.map