chore: merge main into rewrite/main

Brings 142 commits from main onto the rewrite line, which had 30 of its own.
Three files conflicted and each resolution keeps the side that matches the code
this branch actually runs:

- .github/workflows/checks.yml — union. The rewrite's path filters for
  resources/ and crates/ stay; main's two globs (.github/workflows/** and
  .github/scripts/**) are added to the src filter, because a unit test reads
  those files and #965 skipped the suite a release.yml change broke.
- CONFIGURATION.md — the rewrite's mirroring.static[] rows stay. main removed
  the setting along with its TypeScript worker; this branch still parses it in
  nostream-config (settings.rs, guided.rs, validate.rs and the mirror_filters
  test), so main's "removed" row describes a worker that never existed here.
- resources/default-settings.yaml — the rewrite's connection.maxConnectionsPerIp
  block stays, and main's comment about period units is kept above the
  rateLimits list it describes.

The knex 3.2.9 bump from #1024 arrives with the merge, so the standalone PR that
carried the same fix onto this branch is superseded.

Author: chappie-daemon

.changeset/knex-3-2-9-security.md

@@ -0,0 +1,22 @@
+---
+"nostream": patch
+---
+
+fix(deps): bump knex to 3.2.9 for the search_path SQL injection (AIKIDO-2026-10469)
+
+knex 0.0.1–3.2.8 interpolates values passed to `searchPath` for the Postgres
+dialect into generated SQL without validating or escaping them, so a value an
+attacker can influence becomes an injected identifier. 3.2.9 escapes the double
+quotes (#6411); this repository declares `knex` 2.4.2 on both the default branch
+and `rewrite/main`.
+
+nostream never sets `searchPath` — `grep -rn "search_path" src/` finds nothing —
+so the reachable path is not exercised today, and the bump is taken to remove a
+vulnerable dependency from the image, not to close a reachable hole.
+
+knex 3.0.0 drops Node < 16, which the repo already requires (>=24.14.1), and 3.2.0
+tightens `RawBinding`. The one compile error that surfaced,
+`src/scripts/benchmark-queries.ts` passing `bindings as readonly unknown[]` to
+`db.raw()`, is fixed by dropping the assertion: `toSQL().bindings` is already the
+accepted type. The emitted JavaScript is byte-identical with and without the
+assertion.

.changeset/peering-peer-auth.md

@@ -0,0 +1,16 @@
+---
+"nostream": minor
+---
+
+feat(peering): authenticate peer relays with NIP-42 using the relay keypair
+
+Adds the peering identity layer: a configured `peering.peers` trust list keyed
+by relay pubkey (hex or `npub`), outbound NIP-42 AUTH signed with the relay's own
+keypair, and inbound recognition of a verified peer pubkey on the connection
+state. Peer status is tied to the NIP-42 session, so it expires or clears with
+the socket; a valid AUTH from an unconfigured pubkey stays an ordinary client.
+
+`peering.peers[].relayUrl` is the outbound address only — identity is always the
+verified pubkey, never the URL. Relay key storage and the AUTH exchange are
+documented in `docs/PEERING.md`, and the new fields are validated with the rest
+of the settings document.

.factory/config.json

@@ -0,0 +1,3 @@
+{
+  "integrationBase": "rewrite/main"
+}

.github/assets/logo.jpg

@@ -0,0 +1,126 @@
+#!/usr/bin/env bash
+#
+# Run a wrangler deploy, retrying only a transient Cloudflare failure.
+#
+#   .github/scripts/deploy-with-retry.sh <wrangler command...>
+#
+# The command is taken from the caller so each workflow keeps its own
+# invocation (`npx wrangler deploy --config wrangler.preview.jsonc` for a
+# preview, `pnpm exec wrangler deploy --config wrangler.router.jsonc` with
+# `--var` for production).
+#
+# Only three signals are retried, because retrying anything else triples the
+# noise and delays the message that matters:
+#
+#   - `code: 10013`, the Cloudflare API's "unknown error" seen in #970
+#   - an HTTP 5xx from the Cloudflare API
+#   - a connection reset
+#
+# An expired per-attempt timeout is retried too: a hung upload is the case the
+# timeout exists for, and failing on the first one would defeat it.
+#
+# Authentication failures, a missing environment and wrangler validation
+# errors fail on the first attempt.
+#
+# Every attempt after the first is announced with a `::warning::` naming the
+# attempt and the reason, so the flake rate stays visible in the Actions UI
+# instead of disappearing behind a passing job.
+#
+# Environment:
+#   DEPLOY_ATTEMPTS         total attempts (default 3)
+#   DEPLOY_ATTEMPT_TIMEOUT  seconds allowed per attempt (default 180)
+#   DEPLOY_BACKOFFS         seconds to wait before each retry (default "10 30")
+set -uo pipefail
+
+attempts=${DEPLOY_ATTEMPTS:-3}
+attempt_timeout=${DEPLOY_ATTEMPT_TIMEOUT:-180}
+read -r -a backoffs <<< "${DEPLOY_BACKOFFS:-10 30}"
+
+if [ "$#" -eq 0 ]; then
+  echo "usage: $0 <wrangler command...>" >&2
+  exit 2
+fi
+
+if ! [[ "$attempts" =~ ^[1-9][0-9]*$ ]]; then
+  echo "DEPLOY_ATTEMPTS must be a positive integer, got '$attempts'" >&2
+  exit 2
+fi
+
+# `timeout` is coreutils: every GitHub runner has it, a stock macOS does not.
+# Falling back keeps the script usable from a laptop (the unit suite runs it),
+# and says so rather than silently dropping the bound. Bash 3.2 ships on macOS,
+# so an empty array cannot be expanded with "${timeout_cmd[@]}" under `set -u`.
+timeout_cmd=()
+if command -v timeout >/dev/null 2>&1; then
+  timeout_cmd=(timeout --kill-after=10 "$attempt_timeout")
+elif command -v gtimeout >/dev/null 2>&1; then
+  timeout_cmd=(gtimeout --kill-after=10 "$attempt_timeout")
+else
+  echo "::warning::no 'timeout' or 'gtimeout' on PATH — deploy attempts are not bounded (install coreutils to restore the per-attempt limit)"
+fi
+
+logs=$(mktemp -d)
+trap 'rm -rf "$logs"' EXIT
+
+# Echo the transient reason found in an attempt's output, or return 1 when the
+# failure is one we must not retry.
+transient_reason() {
+  local log=$1
+  local http
+
+  if grep -qE 'code: ?10013' "$log"; then
+    printf 'Cloudflare API error code 10013'
+    return 0
+  fi
+  http=$(grep -oE 'HTTP 5[0-9][0-9]' "$log" | head -1 || true)
+  if [ -n "$http" ]; then
+    printf '%s from the Cloudflare API' "$http"
+    return 0
+  fi
+  if grep -qiE 'ECONNRESET|connection reset|socket hang up' "$log"; then
+    printf 'connection reset'
+    return 0
+  fi
+
+  return 1
+}
+
+for (( attempt = 1; attempt <= attempts; attempt++ )); do
+  log="$logs/attempt-$attempt.log"
+  status=0
+  echo "deploy attempt $attempt/$attempts: $*"
+  # The whole attempt is bounded: an upload that stops making progress must not
+  # hold the job until the workflow's own timeout. `--kill-after` covers a
+  # process that ignores TERM. Without coreutils the bound is dropped and the
+  # warning above says so, rather than turning every deploy into exit 127.
+  ${timeout_cmd[@]+"${timeout_cmd[@]}"} "$@" >"$log" 2>&1 || status=$?
+  cat "$log"
+
+  if [ "$status" -eq 0 ]; then
+    echo "deploy succeeded on attempt $attempt/$attempts"
+    exit 0
+  fi
+
+  reason=$(transient_reason "$log") || reason=
+  if [ -z "$reason" ]; then
+    if [ "$status" -eq 124 ] || [ "$status" -eq 137 ]; then
+      reason="attempt timed out after ${attempt_timeout}s"
+    else
+      echo "::error::deploy failed on attempt $attempt/$attempts with a non-transient error (exit $status) — not retrying" >&2
+      tail -n 30 "$log" >&2
+      exit "$status"
+    fi
+  fi
+
+  if [ "$attempt" -ge "$attempts" ]; then
+    echo "::error::deploy failed after $attempts attempts — last failure: $reason" >&2
+    tail -n 30 "$log" >&2
+    exit "$status"
+  fi
+
+  delay=${backoffs[$((attempt - 1))]:-0}
+  echo "::warning::wrangler deploy attempt $((attempt + 1))/$attempts after attempt $attempt/$attempts failed with: $reason — waiting ${delay}s"
+  if [ "$delay" -gt 0 ]; then
+    sleep "$delay"
+  fi
+done

.github/assets/logo.png

@@ -43,6 +43,13 @@ jobs:
               - '.nvmrc'
               - 'resources/default-settings.yaml'
               - '.github/workflows/checks.yml'
+              # A unit test reads these workflows, so a change to any of them
+              # must run the suite that asserts on it. #965 changed release.yml
+              # and skipped the very tests that change broke.
+              - '.github/workflows/**'
+              # test/unit/scripts/deploy-with-retry.spec.ts runs the deploy
+              # script, so a change to it must run the suite that asserts on it.
+              - '.github/scripts/**'
             rust:
               - 'crates/**'
               - 'Cargo.toml'
@@ -123,7 +130,8 @@ jobs:
     if: |
       needs.changes.outputs.src == 'true' &&
       needs.lint.result == 'success' &&
-      needs.build-check.result == 'success'
+      needs.build-check.result == 'success' &&
+      github.head_ref != 'changeset-release/main'
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -166,7 +174,8 @@ jobs:
     if: |
       needs.changes.outputs.src == 'true' &&
       needs.lint.result == 'success' &&
-      needs.build-check.result == 'success'
+      needs.build-check.result == 'success' &&
+      github.head_ref != 'changeset-release/main'
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -293,60 +302,3 @@ jobs:
         run: pnpm install --frozen-lockfile
       - name: Check for changeset
         run: pnpm exec changeset status --since origin/${{ github.base_ref }}
-
-  publish-container-image:
-    name: Build and push container image
-    runs-on: ubuntu-latest
-    needs:
-      - changes
-      - lint
-      - build-check
-      - test-units-and-cover
-      - test-integrations-and-cover
-      - post-tests
-    if: >-
-      always() && github.event_name == 'push' && github.ref == 'refs/heads/main' &&
-      needs.changes.result == 'success' &&
-      (
-        needs.changes.outputs.src != 'true' ||
-        (
-          needs.lint.result == 'success' &&
-          needs.build-check.result == 'success' &&
-          needs.test-units-and-cover.result == 'success' &&
-          needs.test-integrations-and-cover.result == 'success'
-        )
-      ) &&
-      needs.post-tests.result == 'success'
-    env:
-      REGISTRY: ghcr.io
-      IMAGE_NAME: ${{ github.repository }}
-    permissions:
-      contents: read
-      packages: write
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Log in to the Container registry
-        uses: docker/login-action@f054a8b539a109f9f41c372932f1ae047eff08c9
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Extract metadata (tags, labels) for Docker
-        id: meta
-        uses: docker/metadata-action@98669ae865ea3cffbcbaa878cf57c20bbf1c6c38
-        with:
-          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
-          tags: |
-            type=raw,value=main
-            type=sha,prefix=sha-
-
-      - name: Build and push Docker image
-        uses: docker/build-push-action@ad44023a93711e3deb337508980b4b5e9bcdc5dc
-        with:
-          context: .
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}