feat(relay): port the wire handlers, strategies and rate limits

.changeset/relay-wire-handlers.md

@@ -0,0 +1,19 @@
+---
+---
+
+feat(relay): answer a real client over the wire, with the capture's rate limits
+
+`nostream-relay` now serves the wire surface job 008 specified: connection control,
+`EVENT` ingestion through the strategy and limiter pipeline, `REQ`/`CLOSE` with
+streaming `EVENT` and `EOSE`, NIP-42 `AUTH` with restricted reads, `COUNT`, and the
+`OK`/`NOTICE`/`CLOSED` replies the capture sends. The limiter keeps four per-level
+stores with lapse-preferring eviction and a store-owned sweep, so a refused level
+reopens within one window plus one sweep interval.
+
+Parity is measured rather than asserted. `ts_case_parity` runs 462 cases of the
+TypeScript census against the Rust handlers; `wire_parity` replays 16 captured
+sessions, 78 steps, and compares frames byte for byte with one declared tolerance.
+
+The TypeScript tree is untouched: no `src/` or `test/` file changes, so the published
+package has no user-visible change. Decisions are recorded in
+`docs/rewrite/decisions/0004-wire-transport.md`.

CLAUDE.md

@@ -82,7 +82,7 @@ resolver 3:
 | `nostream-core` | domain vocabulary: events, filters, kinds, wire messages, NIP type surfaces, `ShutdownState` |
 | `nostream-config` | typed settings, loader, deep merge, validator, dot-path editor, redaction, guided catalogue |
 | `nostream-storage` | event-store backends (LMDB via heed, Postgres), cache |
-| `nostream-relay` | acceptor, connections, wire protocol, NIP-77 engine |
+| `nostream-relay` | connections, wire protocol, handlers, rate limiters, live dispatch, NIP-77 engine (the acceptor lives in `nostreamd`) |
 | `nostream-services` | NIP-66 monitors, Tor, schedulers, outbound work |
 | `nostream-admin` | admin API and auth |
 | `nostream-cli` | operator command line (`nostream-cli config validate`) |
@@ -139,11 +139,12 @@ resolver 3:
   recorded per case.** When a message or an exemption must change, change the fixture in
   the same commit and say why; never loosen the comparison to make a case pass.
 
-## Porting discipline (this branch, phase 1)
+## Porting discipline (this branch, phase 2)
 
 - **Stubs are labelled, not hidden.** Every unimplemented item carries
-  `/// Phase 1 stub — job 005; <what it will do>; see <TS path>` on the item, takes typed
-  arguments, and returns `NotImplemented`. `grep -rn 'Phase 1 stub' crates` must count
+  `/// Phase 2 stub — job NNN; <what it will do>; see <TS path>` on the item (a stub left
+  from phase 1 keeps its `Phase 1 stub` label until a job touches it), takes typed
+  arguments, and returns `NotImplemented`. `grep -rn 'Phase [12] stub' crates` must count
   the stubs.
 - **No silent `Ok(())`, no plausible fake data, no partial port.** A function that would
   need real behaviour returns the error. A `Result`-returning stub whose body is

Cargo.toml

@@ -16,6 +16,8 @@ chacha20 = "0.10.2"
 chrono = { version = "0.4", default-features = false, features = ["std", "clock", "serde"] }
 clap = { version = "4", features = ["derive"] }
 futures-core = "0.3"
+futures-util = "0.3"
+getrandom = "0.3"
 heed = { version = "0.20", features = ["read-txn-no-tls"] }
 hex = "0.4.3"
 hkdf = "0.13.0"
@@ -40,7 +42,8 @@ sha2 = "0.11.1"
 sqlx = { version = "0.9", default-features = false, features = ["runtime-tokio", "postgres", "migrate", "macros", "chrono", "json", "tls-rustls-ring-webpki"] }
 tempfile = "3"
 thiserror = "2"
-tokio = { version = "1", features = ["macros", "net", "rt-multi-thread", "signal", "sync", "time"] }
+tokio = { version = "1", features = ["io-util", "macros", "net", "rt-multi-thread", "signal", "sync", "time"] }
+tokio-tungstenite = { version = "0.30", features = ["connect", "handshake"] }
 tracing = "0.1"
 tracing-opentelemetry = "0.34"
 tracing-subscriber = { version = "0.3", features = ["env-filter", "fmt"] }

crates/nostream-core/Cargo.toml

@@ -10,6 +10,7 @@ description = "Nostr domain types, wire messages and NIP surfaces for the nostre
 [dependencies]
 base64.workspace = true
 chacha20.workspace = true
+getrandom.workspace = true
 hex.workspace = true
 hkdf.workspace = true
 hmac.workspace = true
@@ -20,6 +21,7 @@ serde_json.workspace = true
 sha2.workspace = true
 thiserror.workspace = true
 tokio.workspace = true
+url.workspace = true
 
 [lints]
 workspace = true