fleetmesh-node 0.2.0__py3-none-any.whl

node/protocols/nostr/relayserver.py

@@ -0,0 +1,656 @@
+"""The relay face: a minimal NIP-01 relay over a MeshStore.
+
+EVENT is verified, stored and fanned out to every live subscription that
+matches; REQ answers from the store and stays open; CLOSE ends it. Ephemeral
+kinds are fanned out and never stored, which is what lets kind 21059 gift
+wraps be a transport. NIP-11 answers on GET. This is the seed of the node's
+relay face (step 5), and the fixture the identity and transport tests run
+against; NIP-77 frames come with the sync step.
+"""
+from __future__ import annotations
+
+import json
+import os
+import socket
+import threading
+import time
+from typing import Any, Callable, cast, Mapping, Optional, Sequence, TypedDict
+from fleetmesh_core.storage import negentropy, store  # noqa: E402
+FACE_FUTURE_MAX_SECONDS: int = 900
+from node.interfaces import EventLike, NostrEvent, NostrFilter  # noqa: E402
+from node.transport import ws  # noqa: E402
+from fleetmesh_core.crypto import giftwrap  # noqa: E402
+
+
+class GossipTopicSummary(TypedDict):
+    topic: str
+    admin: str
+    members: int
+    mesh: int
+    expires: Any
+    roster_id: Any
+
+
+class GossipViewReport(TypedDict):
+    enabled: bool
+    topics: list[GossipTopicSummary]
+
+
+class RelayLimitation(TypedDict):
+    max_subscriptions: int
+    max_message_length: int
+    max_subid_length: int
+    max_limit: int
+    auth_required: bool
+    payment_required: bool
+    restricted_writes: bool
+    min_pow_difficulty: int
+    created_at_upper_limit: int
+
+
+class NIP11RelayInformation(TypedDict, total=False):
+    name: str
+    software: str
+    version: str
+    supported_nips: list[int]
+    limitation: RelayLimitation
+    pubkey: str
+
+# What one client may make the face hold or do. sub_max left the grant
+# ceilings because a peer never opens a subscription; a client does, and
+# twenty is the old member advisory. An event the reference would store
+# without complaint can still be too big to be honest about.
+SUB_MAX: int = 20
+# A subscribed client sits silent for as long as nothing matches its filter.
+# The socket timeout used to be the idle limit, so every quiet client was
+# dropped after a minute. Now a quiet client is pinged at each timeout and
+# dropped only when it has answered nothing for this long.
+IDLE_DROP: int = 180
+EVENT_MAX_BYTES: int = 256 * 1024
+# How far ahead of this node's clock an event may be dated and still be stored.
+#
+# The face had no bound at all, and an open one collects what that implies: on
+# the alpha mesh the newest event held was dated three weeks into the future.
+# A future timestamp is not a NIP-59 randomisation - that runs BACKWARDS, up to
+# two days, by construction - so anything ahead of now is a bad clock or a
+# client buying itself the top of every `created_at DESC` listing forever.
+#
+# Fifteen minutes rather than the protocol's own max_clock_skew_seconds. That
+# 60 is the tolerance for judging a peer this node has a grant with, on a box
+# it can expect to run NTP; this is the door onto the public internet, where a
+# phone two minutes out is ordinary and refusing it would be the relay's fault,
+# not the client's.
+#
+# There is deliberately NO lower bound. A gift wrap is supposed to be backdated
+# and NIP-40 already says when a thing expires; a floor here would refuse the
+# exact traffic NIP-59 asks clients to send.
+FUTURE_MAX_SECONDS: int = FACE_FUTURE_MAX_SECONDS   # one number; node/config/records.py owns it
+SID_MAX: int = 64
+# NIP-42: how far a kind 22242's created_at may sit from this relay's clock
+# either way. The challenge is fresh per connection, so replay is already
+# refused; the window is defence against a challenge string that leaked
+# and a client whose clock is a day wrong, and it is the value the NIP names.
+AUTH_WINDOW_SECONDS: int = 600
+# The most events one REQ may be answered with, whatever it asked for.
+#
+# A filter with no `limit` used to mean "all of them", which is a promise the
+# face cannot keep once it holds more than it can afford to hold in memory at
+# once - and an open face decides how much that is by collecting. NIP-11 has a
+# field for exactly this, so the cap is declared rather than silently applied,
+# and a client that wants more pages with `until`.
+REQ_MAX: int = 500
+
+
+def _filters_ok(filters: Sequence[Any]) -> Optional[str]:
+    if not filters or not all(isinstance(f, dict) for f in filters):
+        return 'filters must be objects'
+    for f in filters:
+        for k in ('since', 'until', 'limit'):
+            if k in f and (not isinstance(f[k], int) or isinstance(f[k], bool) or f[k] < 0):
+                return '%s must be a non-negative integer' % k
+    return None
+
+
+class RelayServer:
+    def __init__(
+        self,
+        backend: Optional[Any] = None,
+        host: str = '127.0.0.1',
+        port: int = 0,
+        name: str = 'meshnode',
+        clock: Optional[Callable[[], int]] = None,
+        pubkey: Optional[str] = None,
+        require_auth: bool = False,
+        challenge: Optional[str] = None,
+        future_seconds: int = FUTURE_MAX_SECONDS,
+        blob_store: Optional[Any] = None,
+        metrics_enabled: bool = True,
+        metrics_provider: Optional[Callable[[], str]] = None,
+        node: Optional[Any] = None,
+        grants: Optional[Any] = None,
+        host_router: Optional[Any] = None,
+    ) -> None:
+        self.store: Any = backend if backend is not None else store.MemoryStore()
+        # The grant store the metrics page counts peers from; the node hands
+        # it in, a face started on its own has none.
+        self.grants: Optional[Any] = grants
+        self.blob_store: Optional[Any] = blob_store
+        self.metrics_enabled: bool = metrics_enabled
+        self.metrics_provider: Optional[Callable[[], str]] = metrics_provider
+        self.node: Optional[Any] = node
+        self.blossom: Optional[Any] = None
+        # Compartments that answer plain HTTP on this port (nsite) append a
+        # `(conn, req) -> bool` here in start(); the first True wins. Blossom
+        # is asked first because its paths are fixed; a hook routes by Host.
+        self.http_handlers: list[Callable[[socket.socket, ws.PlainHTTP], bool]] = []
+        if blob_store is not None:
+            from . import blossom
+            self.blossom = blossom.BlossomServer(blob_store, node_pk=pubkey, clock=clock)
+        self.name: str = name
+        self.pubkey: Optional[str] = pubkey        # the node key: NIP-11's way of saying whose face this is
+        self.clock: Callable[[], int] = clock or (lambda: int(time.time()))
+        self.require_auth: bool = require_auth
+        self.future_seconds: int = int(future_seconds)
+        # One challenge per connection, made when the socket opens and gone
+        # when it closes. It used to be one string for the life of the
+        # process: a kind 22242 signed for it once was then good on every
+        # later connection, so an AUTH event that any relay operator had seen
+        # was a key to this one for as long as it ran. A `challenge` given to
+        # the constructor pins it for every connection, for tests only.
+        self._fixed_challenge: Optional[str] = challenge
+        self._challenges: dict[int, str] = {}                        # ws id -> challenge
+        self._subs: dict[int, dict[str, list[NostrFilter | Mapping[str, Any]]]] = {}  # (ws id) -> {sid: filters}
+        self._conns: dict[int, ws.WebSocket] = {}                    # ws id -> ws
+        self._authed: dict[int, str] = {}                            # ws id -> authed pubkey
+        self._lock: threading.Lock = threading.Lock()
+        self.host_router: Optional[Any] = host_router
+        if host_router is not None:
+            self._server: Optional[ws.Server] = None
+            self._host: str = host
+            self._port: int = port
+        else:
+            self._server = ws.Server(self._handle, host, port, http_handler=self._http)
+            self._host = self._server.host
+            self._port = self._server.port
+        self._neg: dict[int, dict[str, negentropy.Negentropy]] = {}  # ws id -> {subid: Negentropy}
+        self.accepted: int = 0
+        self.refused_future: int = 0
+        self.on_event_handlers: list[Callable[[NostrEvent], None]] = []
+
+    def add_event_handler(self, handler: Callable[[NostrEvent], None]) -> Callable[[], None]:
+        """Call `handler` with every event this face accepts; returns the call that removes it.
+
+        A handler that raises is skipped for that event, never the face."""
+        if handler not in self.on_event_handlers:
+            self.on_event_handlers.append(handler)
+
+        def remove() -> None:
+            if handler in self.on_event_handlers:
+                self.on_event_handlers.remove(handler)
+        return remove
+
+    @property
+    def server(self) -> Any:
+        if self._server is not None:
+            return self._server
+        if self.host_router is not None:
+            srv = getattr(self.host_router, 'server', None) or getattr(self.host_router, '_server', None)
+            if srv is not None:
+                return srv
+        class _StoppedServerProxy:
+            host = self.host
+            port = self.port
+        return _StoppedServerProxy()
+
+    @property
+    def host(self) -> str:
+        if self._server is not None:
+            return self._server.host
+        if self.host_router is not None:
+            return self.host_router.host
+        return self._host
+
+    @property
+    def port(self) -> int:
+        if self._server is not None:
+            return self._server.port
+        if self.host_router is not None:
+            return self.host_router.port
+        return self._port
+
+    @property
+    def url(self) -> str:
+        if self._server is not None:
+            return self._server.url
+        if self.host_router is not None:
+            return self.host_router.url
+        return 'ws://%s:%d' % (self.host, self.port)
+
+    def start(self) -> RelayServer:
+        if self._server is not None:
+            self._server.start()
+        return self
+
+    def stop(self) -> None:
+        if self._server is not None:
+            self._server.stop()
+
+    def handle_http_request(self, conn: socket.socket, req: ws.PlainHTTP) -> bool:
+        """Handle an HTTP request. Returns True if handled, False if unhandled."""
+        if self.blossom and self.blossom.handle_request(conn, req):
+            return True
+        for handler in self.http_handlers:
+            if handler(conn, req):
+                return True
+        clean_path = req.path.split('?', 1)[0].rstrip('/')
+        headers = req.headers or {}
+        if clean_path in ('', '/nip11') or headers.get(b'accept', b'').startswith(b'application/nostr+json'):
+            body = json.dumps(self.nip11()).encode()
+            ws.http_response(conn, '200 OK', body, 'application/nostr+json')
+            return True
+        elif clean_path == '/metrics' and getattr(self, 'metrics_enabled', True):
+            body = self.render_metrics().encode('utf-8')
+            ws.http_response(conn, '200 OK', body, 'text/plain; version=0.0.4; charset=utf-8')
+            return True
+        elif clean_path == '/gossip':
+            body = json.dumps(self.gossip_view()).encode('utf-8')
+            ws.http_response(conn, '200 OK', body, 'application/json')
+            return True
+        elif clean_path == '/didcomm':
+            ws.http_response(conn, '501 Not Implemented',
+                             b'{"error":"transport https declared, not implemented; use iroh, libp2p or nostr"}',
+                             'application/json')
+            return True
+        return False
+
+    def mount_ingress(self, host: Any, owner: str = 'nostr') -> None:
+        """Mount Nostr relay WebSocket and HTTP endpoints onto ProtocolHostRouter."""
+        host.mount_websocket('/', self._handle, owner=owner)
+        host.mount_route('/', self.handle_http_request, methods=('*',), owner=owner)
+        host.mount_route('/nip11', self.handle_http_request, methods=('GET',), owner=owner)
+        host.mount_route('/metrics', self.handle_http_request, methods=('GET',), owner=owner)
+        host.mount_route('/gossip', self.handle_http_request, methods=('GET',), owner=owner)
+        host.mount_route('/didcomm', self.handle_http_request, methods=('GET', 'POST'), owner=owner)
+        if self.blossom is not None:
+            host.mount_route('/upload', self.blossom.handle_request, methods=('PUT', 'HEAD', 'OPTIONS'), owner=owner)
+            host.mount_route('/list', self.blossom.handle_request, methods=('GET', 'HEAD', 'OPTIONS'), owner=owner)
+            host.mount_route('/mirror', self.blossom.handle_request, methods=('PUT', 'OPTIONS'), owner=owner)
+
+    # ---- one connection --------------------------------------------------
+    def _handle(self, sock: ws.WebSocket, path: str) -> None:
+        key = id(sock)
+        challenge = self._fixed_challenge or ('challenge-' + os.urandom(16).hex())
+        with self._lock:
+            self._conns[key], self._subs[key] = sock, {}
+            self._challenges[key] = challenge
+        if self.require_auth:
+            sock.send_text(json.dumps(['AUTH', challenge]))
+        try:
+            while True:
+                try:
+                    raw = sock.recv_text()
+                except socket.timeout:
+                    if sock.idle() > IDLE_DROP:
+                        raise
+                    sock.ping()
+                    continue
+                try:
+                    msg = json.loads(raw)
+                except ValueError:
+                    sock.send_text(json.dumps(['NOTICE', 'not JSON']))
+                    continue
+                if not isinstance(msg, list) or not msg:
+                    continue
+                verb = msg[0]
+                sid = msg[1] if len(msg) > 1 else None
+                if verb in ('REQ', 'CLOSE', 'NEG-OPEN', 'NEG-MSG', 'NEG-CLOSE') and not (
+                        isinstance(sid, str) and 0 < len(sid) <= SID_MAX):
+                    sock.send_text(json.dumps(['NOTICE', 'subscription id must be a short string']))
+                    continue
+                # NIP-01 verb dispatch. The arity guards of the old elif chain
+                # are the sequence patterns: a verb with too few members falls
+                # through to the same NOTICE an unknown verb gets, as before.
+                match msg:
+                    case ['EVENT', ev, *_]:
+                        self._on_event(sock, ev, key)
+                    case ['REQ', str(req_sid), *filters]:
+                        if not filters:
+                            sock.send_text(json.dumps(['CLOSED', req_sid, 'invalid: filters required']))
+                            continue
+                        why = _filters_ok(filters)
+                        if why is not None:
+                            sock.send_text(json.dumps(['CLOSED', req_sid, 'invalid: ' + why]))
+                            continue
+                        with self._lock:
+                            open_subs = len(self._subs.get(key, {}))
+                        if open_subs >= SUB_MAX and req_sid not in self._subs.get(key, {}):
+                            sock.send_text(json.dumps(['CLOSED', req_sid, 'blocked: too many subscriptions']))
+                            continue
+                        self._on_req(sock, key, req_sid, filters)
+                    case ['AUTH', auth_ev, *_]:
+                        self._on_auth(sock, key, auth_ev)
+                    case ['CLOSE', str(close_sid), *_]:
+                        with self._lock:
+                            self._subs[key].pop(close_sid, None)
+                    case ['NEG-OPEN', str(neg_sid), neg_filter, neg_msg, *_]:
+                        self._neg_open(sock, key, neg_sid, neg_filter, neg_msg)
+                    case ['NEG-MSG', str(neg_sid), neg_msg, *_]:
+                        self._neg_msg(sock, key, neg_sid, neg_msg)
+                    case ['NEG-CLOSE', str(neg_sid), *_]:
+                        self._neg.get(key, {}).pop(neg_sid, None)
+                    case _:
+                        sock.send_text(json.dumps(['NOTICE', 'unknown verb']))
+        finally:
+            with self._lock:
+                self._conns.pop(key, None)
+                self._subs.pop(key, None)
+                self._authed.pop(key, None)
+                self._challenges.pop(key, None)
+
+    def _on_auth(self, sock: ws.WebSocket, key: int, ev: Any) -> None:
+        if not isinstance(ev, dict) or not giftwrap.verify_event(ev):
+            sock.send_text(json.dumps(['OK', ev.get('id', '') if isinstance(ev, dict) and isinstance(ev.get('id'), str) else '',
+                                       False, 'invalid: signature or id does not verify']))
+            return
+        if ev.get('kind') != 22242:
+            sock.send_text(json.dumps(['OK', ev.get('id', ''), False, 'invalid: kind must be 22242']))
+            return
+        with self._lock:
+            expected = self._challenges.get(key)
+        # Compared for this connection only. id(ws) is reused once a socket
+        # is gone, which is why the entry is removed on disconnect rather
+        # than left to match a stranger's later connection.
+        has_challenge = expected is not None and any(
+            isinstance(t, list) and len(t) > 1 and t[0] == 'challenge' and t[1] == expected
+            for t in ev.get('tags', []))
+        if not has_challenge:
+            sock.send_text(json.dumps(['OK', ev['id'], False, 'invalid: challenge mismatch']))
+            return
+        created = ev.get('created_at')
+        if not isinstance(created, int) or abs(created - self.clock()) > AUTH_WINDOW_SECONDS:
+            sock.send_text(json.dumps(['OK', ev['id'], False,
+                                       'invalid: created_at is outside the %d second window' % AUTH_WINDOW_SECONDS]))
+            return
+        with self._lock:
+            self._authed[key] = ev['pubkey']
+        sock.send_text(json.dumps(['OK', ev['id'], True, '']))
+
+    def _on_event(self, sock: ws.WebSocket, ev: Any, key: int = 0) -> None:
+        if self.require_auth and key not in self._authed:
+            sock.send_text(json.dumps(['OK', ev.get('id', '') if isinstance(ev, dict) and isinstance(ev.get('id'), str) else '',
+                                       False, 'auth-required: authentication required']))
+            return
+        if isinstance(ev, dict) and len(json.dumps(ev, separators=(',', ':'))) > EVENT_MAX_BYTES:
+            sock.send_text(json.dumps(['OK', ev.get('id', '') if isinstance(ev.get('id'), str) else '', False,
+                                       'invalid: event is larger than %d bytes' % EVENT_MAX_BYTES]))
+            return
+        if not isinstance(ev, dict) or not giftwrap.verify_event(ev):
+            sock.send_text(json.dumps(['OK', ev.get('id', '') if isinstance(ev, dict) and isinstance(ev.get('id'), str) else '',
+                                       False, 'invalid: signature or id does not verify']))
+            return
+        # A verified event has id, pubkey, created_at, kind and sig of the right
+        # types - the id is a hash over them and the check would have failed
+        # otherwise. verify_event tolerates an omitted tags/content as empty,
+        # and this face has always accepted such events, so the type is
+        # asserted here rather than checked again and made stricter.
+        event = cast(NostrEvent, ev)
+        now = self.clock()
+        # Checked after the signature, so a rejection is about an event that is
+        # genuinely someone's, and before the store, so nothing dated past the
+        # bound is ever written down.
+        created = ev.get('created_at')
+        if self.future_seconds and isinstance(created, int) and created > now + self.future_seconds:
+            # Counted before the answer goes out, the way `accepted` is. The
+            # other order means a client holding its OK can read the counter
+            # before this thread has reached it, so a caller that refuses two
+            # events and then asks how many were refused is told one. Rare
+            # enough to pass every local run and turn up on a loaded CI runner.
+            self.refused_future += 1
+            sock.send_text(json.dumps(['OK', ev['id'], False,
+                                       'invalid: created_at is %d seconds in the future, and this relay '
+                                       'accepts at most %d' % (created - now, self.future_seconds)]))
+            return
+        if store.is_ephemeral(ev['kind']):
+            result = 'ephemeral'
+        else:
+            result = self.store.insert_event(event, now)
+            # A client handed this to us directly, which is the only provenance
+            # that lets a coverage claim assert completeness.
+            if result == 'stored' and hasattr(self.store, 'note_origin'):
+                self.store.note_origin(ev['id'], self.store.LOCAL)
+        self.accepted += 1
+        sock.send_text(json.dumps(['OK', ev['id'], True, '' if result != 'duplicate' else 'duplicate: already have it']))
+        self._fanout(event)
+        for handler in list(self.on_event_handlers):
+            try:
+                handler(event)
+            except Exception:
+                pass
+
+    def _fanout(self, ev: EventLike) -> None:
+        with self._lock:
+            targets = [(w, sid) for k, w in self._conns.items()
+                       for sid, filters in self._subs.get(k, {}).items()
+                       if any(store.matches(ev, f) for f in filters)]
+        if not targets:
+            return
+        # The event is serialised once and the subscription id spliced in per
+        # target; json.dumps(['EVENT', sid, ev]) with these separators is
+        # exactly this concatenation, so the frame bytes are unchanged.
+        # Measured 9-10x faster at 50 subscribers on a typical kind-1 event.
+        body = ',' + json.dumps(ev, separators=(',', ':')) + ']'
+        for w, sid in targets:
+            try:
+                w.send_text('["EVENT",' + json.dumps(sid) + body)
+            except OSError:
+                pass
+
+    def _on_req(self, sock: ws.WebSocket, key: int, sid: str, filters: Sequence[NostrFilter | Mapping[str, Any]]) -> None:
+        if self.require_auth and key not in self._authed:
+            sock.send_text(json.dumps(['CLOSED', sid, 'auth-required: authentication required']))
+            return
+        now = self.clock()
+        # How many can leave, decided before anything is read. The filter used
+        # to be dropped here - items_range({}) - so every event in the time
+        # range was parsed to build the id list and parsed again to be matched,
+        # and the limit was applied to what survived. On a face holding 8,923
+        # events that is 200 MB of JSON per REQ, which is what was OOM-killing
+        # the public node every three hours.
+        asked = [f['limit'] for f in filters if isinstance(f.get('limit'), int)]
+        limit = min(min(asked) if asked else REQ_MAX, REQ_MAX)
+        # Registered before anything is replayed, and so before the EOSE that
+        # tells the client the subscription exists. The other order had the
+        # face send stored events, send the EOSE, and only then put the filters
+        # where `_fanout` looks: a client that waits for its EOSE and then
+        # causes an event - which is exactly what `relay.subscribe(ready=True)`
+        # documents as the way to know it is registered - could have that
+        # event fanned out to nobody in the window between the two lines. An
+        # ephemeral kind is then gone for good, because no relay stores one,
+        # and no timeout on the reader can recover it.
+        #
+        # The cost of this order is that an event arriving during the replay
+        # can go out live and appear in the replay too. That is a duplicate id
+        # on a subscription, which NIP-01 requires a client to tolerate and
+        # every reader here already does - a lost ephemeral event is not
+        # recoverable by anyone.
+        with self._lock:
+            self._subs[key][sid] = [
+                {**store.compiled(f), **{k: f[k] for k in ('since', 'until') if k in f}}
+                for f in filters
+            ]
+        found: dict[str, NostrEvent] = {}
+        for f in filters:
+            since, until = f.get('since', 0), f.get('until', 2 ** 31)
+            for ev in self.store.newest_matching(f, since, until, now, limit):
+                found[ev['id']] = ev
+        # The newest `limit` of the union is a subset of each filter's newest
+        # `limit`, so merging the bounded answers and cutting again is the same
+        # set the unbounded version sent.
+        out = sorted(found.values(), key=lambda e: (-e['created_at'], e['id']))
+        for ev in out[:limit]:
+            sock.send_text(json.dumps(['EVENT', sid, ev], separators=(',', ':')))
+        sock.send_text(json.dumps(['EOSE', sid]))
+
+    # ---- NIP-77 ------------------------------------------------------------
+    def _neg_open(self, sock: ws.WebSocket, key: int, sid: str, filt: Any, initial_hex: Any) -> None:
+        """NEG-OPEN: reconcile the filter's range with the client's first frame."""
+        now = self.clock()
+        if not isinstance(filt, dict) or _filters_ok([filt]) is not None or not isinstance(initial_hex, str):
+            sock.send_text(json.dumps(['NEG-ERR', sid, 'blocked: filter must be an object and the frame hex']))
+            return
+        try:
+            items = self.store.items_range(filt, filt.get('since', 0), filt.get('until', 2 ** 31), now)
+            neg = negentropy.Negentropy(items, is_client=False)
+            reply, _, _ = neg.reconcile(bytes.fromhex(initial_hex))
+        except negentropy.UnsupportedVersion:
+            sock.send_text(json.dumps(['NEG-MSG', sid, '%02x' % negentropy.VERSION]))
+            return
+        except (ValueError, TypeError, negentropy.Malformed) as e:
+            sock.send_text(json.dumps(['NEG-ERR', sid, 'blocked: %s' % e]))
+            return
+        self._neg.setdefault(key, {})[sid] = neg
+        sock.send_text(json.dumps(['NEG-MSG', sid, (reply or b'').hex()]))
+
+    def _neg_msg(self, sock: ws.WebSocket, key: int, sid: str, frame_hex: str) -> None:
+        neg = self._neg.get(key, {}).get(sid)
+        if neg is None:
+            sock.send_text(json.dumps(['NEG-ERR', sid, 'closed: no such negentropy subscription']))
+            return
+        try:
+            reply, _, _ = neg.reconcile(bytes.fromhex(frame_hex))
+        except (ValueError, TypeError, negentropy.Malformed) as e:
+            sock.send_text(json.dumps(['NEG-ERR', sid, 'blocked: %s' % e]))
+            return
+        sock.send_text(json.dumps(['NEG-MSG', sid, (reply or b'').hex()]))
+
+    # ---- HTTP, NIP-11, Blossom & Prometheus Metrics --------------------------
+    def render_metrics(self) -> str:
+        """Render Prometheus / OpenMetrics exposition format."""
+        if self.metrics_provider is not None:
+            try:
+                return self.metrics_provider()
+            except Exception:
+                pass
+
+        lines = [
+            '# HELP fleetmesh_events_stored_total Total events stored in local store.',
+            '# TYPE fleetmesh_events_stored_total counter',
+        ]
+        stored_count = 0
+        if hasattr(self.store, 'count'):
+            try:
+                stored_count = self.store.count()
+            except Exception:
+                pass
+        lines.append(f'fleetmesh_events_stored_total {stored_count}')
+
+        active_subs = 0
+        with self._lock:
+            active_conns = len(self._conns)
+            active_subs = sum(len(s) for s in self._subs.values())
+
+        lines.extend([
+            '# HELP fleetmesh_active_connections Current active WebSocket connections.',
+            '# TYPE fleetmesh_active_connections gauge',
+            f'fleetmesh_active_connections {active_conns}',
+            '# HELP fleetmesh_active_subscriptions Current active event subscriptions.',
+            '# TYPE fleetmesh_active_subscriptions gauge',
+            f'fleetmesh_active_subscriptions {active_subs}',
+            '# HELP fleetmesh_events_accepted_total Total valid events accepted through relay face.',
+            '# TYPE fleetmesh_events_accepted_total counter',
+            f'fleetmesh_events_accepted_total {self.accepted}',
+            '# HELP fleetmesh_events_refused_future_total Total events refused due to future timestamps.',
+            '# TYPE fleetmesh_events_refused_future_total counter',
+            f'fleetmesh_events_refused_future_total {self.refused_future}',
+        ])
+
+        if self.blob_store is not None:
+            blob_count = 0
+            blob_bytes = 0
+            if hasattr(self.blob_store, 'count'):
+                try:
+                    blob_count = self.blob_store.count()
+                except Exception:
+                    pass
+            if hasattr(self.blob_store, 'total_bytes'):
+                try:
+                    blob_bytes = self.blob_store.total_bytes()
+                except Exception:
+                    pass
+            lines.extend([
+                '# HELP fleetmesh_blobs_total Total content-addressed blobs in Blossom CAS.',
+                '# TYPE fleetmesh_blobs_total gauge',
+                f'fleetmesh_blobs_total {blob_count}',
+                '# HELP fleetmesh_blobs_bytes_total Total size in bytes of blobs in Blossom CAS.',
+                '# TYPE fleetmesh_blobs_bytes_total gauge',
+                f'fleetmesh_blobs_bytes_total {blob_bytes}',
+            ])
+
+        if self.grants is not None and hasattr(self.grants, 'list'):
+            # Export peers categorized by trust tier
+            try:
+                by_tier: dict[str, int] = {}
+                for g in self.grants.list():
+                    payload = g.get('payload')
+                    t = payload.get('tier') if isinstance(payload, dict) else g.get('tier', 'unknown')
+                    by_tier[str(t)] = by_tier.get(str(t), 0) + 1
+                lines.append('# HELP fleetmesh_peers_by_tier Number of peers categorized by trust tier.')
+                lines.append('# TYPE fleetmesh_peers_by_tier gauge')
+                for t, cnt in sorted(by_tier.items()):
+                    lines.append(f'fleetmesh_peers_by_tier{{tier="{t}"}} {cnt}')
+            except Exception:
+                pass
+
+        return '\n'.join(lines) + '\n'
+
+    def _http(self, conn: socket.socket, req_or_path: Any, headers: Optional[dict[bytes, bytes]] = None) -> None:
+        if isinstance(req_or_path, ws.PlainHTTP):
+            req = req_or_path
+        else:
+            path = str(req_or_path)
+            hdrs = headers or {}
+            req = ws.PlainHTTP(path=path, headers=hdrs, method='GET', sock=conn)
+
+        if not self.handle_http_request(conn, req):
+            ws.http_response(conn, '404 Not Found', b'{"error":"not found"}')
+
+    def gossip_view(self) -> GossipViewReport:
+        # gossip is an optional compartment: looked up on the node by name
+        # the way ctx.optional() does, absent when the node has not got one.
+        gossip = getattr(self.node, 'gossip', None) if self.node is not None else None
+        if gossip is None:
+            return {'enabled': False, 'topics': []}
+        rows = gossip.command('topics', {})
+        return {'enabled': True,
+                'topics': [{'topic': r['topic'], 'admin': r['admin'], 'members': len(r['members']),
+                            'mesh': len(r['mesh']), 'expires': r['expires'], 'roster_id': r['roster_id']}
+                           for r in rows]}
+
+    def nip11(self) -> NIP11RelayInformation:
+        from fleetmesh_core.identity import identity
+        doc: NIP11RelayInformation = {
+            'name': self.name,
+            'software': identity.FLEETMESH.rstrip('/'),
+            'version': '0.0.1',
+            'supported_nips': [1, 11, 40, 59, 77],
+            # What the face enforces, in NIP-11's own words, so a NIP-66
+            # event about it can carry the requirement tags honestly.
+            'limitation': {
+                'max_subscriptions': SUB_MAX,
+                'max_message_length': EVENT_MAX_BYTES,
+                'max_subid_length': SID_MAX,
+                'max_limit': REQ_MAX,
+                'auth_required': self.require_auth,
+                'payment_required': False,
+                'restricted_writes': False,
+                'min_pow_difficulty': 0,
+                # NIP-11 states these as absolute timestamps, so it is computed
+                # rather than declared: a client reads the door this node has
+                # open right now. No lower limit is published because none is
+                # enforced - see FUTURE_MAX_SECONDS.
+                'created_at_upper_limit': self.clock() + self.future_seconds,
+            },
+        }
+        if self.pubkey:
+            doc['pubkey'] = self.pubkey
+        return doc

node/protocols/p2panda/__init__.py

@@ -0,0 +1,22 @@
+"""p2panda protocol suite for Fleetmesh.
+
+Native implementation of the p2panda peer-to-peer data protocol:
+- Canonical CBOR deterministic encoding (RFC 8949)
+- Ed25519 author identity & cryptographic verification
+- Append-only multi-writer operation log persistence
+- Transport rung integration with TransportRouter ladder
+"""
+from __future__ import annotations
+
+from .identity import P2PandaIdentityAdapter
+from .package import P2PandaProtocolPackage
+from .rung import P2PandaRung
+from .store import P2PandaLogStore, P2PandaStoreError
+
+__all__ = [
+    'P2PandaIdentityAdapter',
+    'P2PandaLogStore',
+    'P2PandaProtocolPackage',
+    'P2PandaRung',
+    'P2PandaStoreError',
+]