@openclaw/nostr 2026.10.10 → 2026.11.5-beta.1

package/dist/.setup/{channel-C2iK5Fjg.mjs → channel-DtlupG0V.mjs}

@@ -4,8 +4,9 @@ import { n as NostrProfileSchema, t as nostrSetupPlugin } from "./channel.setup-
 import { createScopedDmSecurityResolver, createTopLevelChannelConfigAdapter } from "openclaw/plugin-sdk/channel-config-helpers";
 import { createChatChannelPlugin } from "openclaw/plugin-sdk/channel-core";
 import { missingTargetError } from "openclaw/plugin-sdk/channel-feedback";
-import { DEFAULT_INGRESS_ADOPTION_STALL_MS, bindIngressLifecycleToReplyOptions, createChannelIngressError, createChannelIngressMonitor, createChannelMessageAdapterFromOutbound, runPassiveAccountLifecycle } from "openclaw/plugin-sdk/channel-outbound";
+import { bindIngressLifecycleToReplyOptions, createChannelIngressError, createChannelIngressMonitor, createChannelMessageAdapterFromOutbound, runPassiveAccountLifecycle } from "openclaw/plugin-sdk/channel-outbound";
 import { DEFAULT_ACCOUNT_ID, formatPairingApproveHint } from "openclaw/plugin-sdk/channel-plugin-common";
+import { buildChannelOutboundSessionRoute, stripChannelTargetPrefix } from "openclaw/plugin-sdk/core";
 import { buildPassiveChannelStatusSummary, buildTrafficStatusSummary } from "openclaw/plugin-sdk/extension-shared";
 import { collectStatusIssuesFromLastError, createComputedAccountStatusAdapter, createDefaultChannelRuntimeState } from "openclaw/plugin-sdk/status-helpers";
 import { isRecord, normalizeStringEntries } from "openclaw/plugin-sdk/string-coerce-runtime";
@@ -19,23 +20,11 @@ import { decrypt, encrypt } from "nostr-tools/nip04";
 import { createDirectDmPreCryptoGuardPolicy } from "openclaw/plugin-sdk/direct-dm-guard-policy";
 import { captureEffectAuthority } from "openclaw/plugin-sdk/fetch-runtime";
 import { createFixedWindowRateLimiter } from "openclaw/plugin-sdk/webhook-ingress";
-import { retryAsync } from "openclaw/plugin-sdk/retry-runtime";
+import { isStateDatabaseAdmissionClosedError, retryAsync } from "openclaw/plugin-sdk/retry-runtime";
 import { sleepWithAbort } from "openclaw/plugin-sdk/runtime-env";
 import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
 import { createPluginRuntimeStore } from "openclaw/plugin-sdk/runtime-store";
 import { withTimeout } from "openclaw/plugin-sdk/time-runtime";
-import { buildChannelOutboundSessionRoute, stripChannelTargetPrefix } from "openclaw/plugin-sdk/core";
-// extensions/nostr/src/metrics.ts
-function createMetrics(onMetric) {
-	return { emit(name, value = 1, labels) {
-		onMetric?.({
-			name,
-			value,
-			timestamp: Date.now(),
-			labels
-		});
-	} };
-}
 // extensions/nostr/src/nostr-cursor.ts
 const CURSOR_WRITE_RETRY_MS = [
 	0,
@@ -45,7 +34,6 @@ const CURSOR_WRITE_RETRY_MS = [
 const CURSOR_RECOVERY_RETRY_MS = 1e3;
 /** Tracks the largest EOSE-safe Nostr timestamp without skipping undurable relay events. */
 function createNostrDurableCursor(options) {
-	const nowSec = options.nowSec ?? (() => Math.floor(Date.now() / 1e3));
 	let durableCandidate;
 	let transientReplayCeiling;
 	let backfillComplete = false;
@@ -57,7 +45,8 @@ function createNostrDurableCursor(options) {
 		recordDurableAppend: (event) => {
 			if (!Number.isSafeInteger(event.created_at)) return;
 			const previousSafeCandidate = safeCandidate();
-			durableCandidate = Math.max(durableCandidate ?? 0, Math.min(event.created_at, nowSec()));
+			const nowSec = Math.floor(Date.now() / 1e3);
+			durableCandidate = Math.max(durableCandidate ?? 0, Math.min(event.created_at, nowSec));
 			const nextSafeCandidate = safeCandidate();
 			return backfillComplete && nextSafeCandidate !== previousSafeCandidate ? nextSafeCandidate : void 0;
 		},
@@ -79,7 +68,6 @@ function createNostrCursorStateWriter(options) {
 	let desiredCursor = Math.max(options.minimumCursor, options.initialCursor);
 	let dirty = false;
 	let timer;
-	let writeTail = Promise.resolve();
 	let activeFlush;
 	let recoveryFlush;
 	const writeWithRetry = async (cursor) => {
@@ -94,27 +82,20 @@ function createNostrCursorStateWriter(options) {
 			throw new Error("Nostr cursor state write failed.", { cause: error });
 		}
 	};
-	const enqueueWrite = (cursor) => {
-		const write = writeTail.then(() => writeWithRetry(cursor));
-		writeTail = write.catch(() => void 0);
-		return write;
-	};
 	const clearTimer = () => {
-		if (timer) {
-			clearTimeout(timer);
-			timer = void 0;
-		}
+		clearTimeout(timer);
+		timer = void 0;
 	};
 	const runFlush = async () => {
 		for (;;) {
 			if (!dirty) {
-				await writeTail;
+				await Promise.resolve();
 				if (!dirty) return;
 			}
 			dirty = false;
 			const cursor = desiredCursor;
 			try {
-				await enqueueWrite(cursor);
+				await Promise.resolve().then(() => writeWithRetry(cursor));
 			} catch (error) {
 				dirty = true;
 				throw error;
@@ -154,6 +135,7 @@ function createNostrCursorStateWriter(options) {
 					await flush();
 					return;
 				} catch (error) {
+					if (isStateDatabaseAdmissionClosedError(error)) throw error;
 					options.onBackgroundError?.(error);
 					await sleepWithAbort(CURSOR_RECOVERY_RETRY_MS);
 				}
@@ -178,8 +160,7 @@ function inspectNostrIngressEvent(event) {
 }
 /** Convert the retired persisted LRU seed into durable completion tombstones. */
 async function migrateNostrLegacyRecentEventIds(params) {
-	const migratedAt = params.migratedAt ?? Date.now();
-	let migrated = 0;
+	const migratedAt = Date.now();
 	for (const eventId of new Set(params.eventIds)) {
 		if (!eventId.trim()) continue;
 		const result = await params.queue.enqueue(eventId, {
@@ -193,9 +174,7 @@ async function migrateNostrLegacyRecentEventIds(params) {
 		if (result.kind === "accepted" || result.kind === "pending" && result.record.payload.rawEvent === "") {
 			if (!await params.queue.complete(eventId, { completedAt: migratedAt })) throw new Error(`Failed to migrate Nostr replay event ${eventId}.`);
 		}
-		migrated += 1;
 	}
-	return migrated;
 }
 // extensions/nostr/src/runtime.ts
 const { setRuntime: setNostrRuntime, getRuntime: getNostrRuntime } = createPluginRuntimeStore({
@@ -204,11 +183,6 @@ const { setRuntime: setNostrRuntime, getRuntime: getNostrRuntime } = createPlugi
 });
 // extensions/nostr/src/nostr-ingress.ts
 const NOSTR_INGRESS_POLL_INTERVAL_MS = 500;
-const NOSTR_INGRESS_APPEND_RETRY_MS = [
-	0,
-	100,
-	300
-];
 const NostrIngressAdmissionRejectedError = createChannelIngressError("NostrIngressAdmissionRejectedError", { withReason: true });
 function deserializeNostrIngressEvent(rawEvent, claimedId) {
 	let parsed;
@@ -235,20 +209,35 @@ function createNostrIngress(options) {
 	};
 	const monitor = createChannelIngressMonitor({
 		queue: getQueue,
-		inspect: (event) => {
-			const facts = inspectNostrIngressEvent(event);
-			return {
-				eventId: facts.eventId,
-				laneKey: facts.laneKey
-			};
+		inspect: ({ facts }) => facts,
+		inspectAsync: async ({ facts }, context) => {
+			if (context.phase === "admission") {
+				await monitorStart;
+				if (admissionFailure) throw admissionFailure;
+				const pending = await getQueue().listPending({ limit: options.maxPendingEvents });
+				const claims = await getQueue().listClaims();
+				if (pending.length + claims.length >= options.maxPendingEvents) throw new NostrIngressAdmissionRejectedError("backpressure", "Nostr event exceeds the durable ingress backlog.");
+			}
+			return facts;
 		},
 		payload: {
 			version: 1,
-			serialize: (event, { receivedAt }) => ({
-				receivedAt,
-				rawEvent: JSON.stringify(event)
+			serialize: ({ payload }) => ({
+				receivedAt: payload.receivedAt,
+				rawEvent: payload.rawEvent
 			}),
-			deserialize: (body, { claim }) => deserializeNostrIngressEvent(body.rawEvent, claim.id),
+			deserialize: (body, { claim }) => {
+				const event = deserializeNostrIngressEvent(body.rawEvent, claim.id);
+				return {
+					event,
+					facts: inspectNostrIngressEvent(event),
+					receivedAt: body.receivedAt,
+					payload: {
+						version: 1,
+						...body
+					}
+				};
+			},
 			encode: ({ body }) => ({
 				version: 1,
 				...body
@@ -265,14 +254,19 @@ function createNostrIngress(options) {
 			},
 			createClaimError: (kind, claim) => new NostrIngressPermanentError("invalid-event", kind === "invalid-version" ? `Nostr ingress row ${claim.id} has an unsupported version.` : `Nostr ingress row ${claim.id} changed event identity.`)
 		},
-		deliver: options.deliver,
-		pollIntervalMs: options.pollIntervalMs ?? NOSTR_INGRESS_POLL_INTERVAL_MS,
+		deliver: ({ event }, lifecycle) => options.deliver(event, lifecycle),
+		onDurableAdmission: ({ event }) => options.afterDurableAppend(event),
+		onAdmissionFailure: (_event, error) => {
+			if (error instanceof NostrIngressAdmissionRejectedError || error instanceof NostrIngressPermanentError) return;
+			admissionFailure ??= new Error(`Nostr durable admission failed: ${formatErrorMessage(error)}`, { cause: error });
+			throw admissionFailure;
+		},
+		pollIntervalMs: NOSTR_INGRESS_POLL_INTERVAL_MS,
 		retention: {
 			completedMaxEntries: 1e5,
 			failedMaxEntries: 1e5
 		},
 		drain: {
-			adoptionStallTimeoutMs: options.adoptionStallTimeoutMs ?? DEFAULT_INGRESS_ADOPTION_STALL_MS,
 			resolveNonRetryableFailure: (error) => error instanceof NostrIngressPermanentError ? {
 				reason: error.reason,
 				message: error.message
@@ -291,7 +285,6 @@ function createNostrIngress(options) {
 		if (!stopping) monitor.start();
 	})();
 	monitorStart.catch((error) => options.onError?.(error, "ingress drain"));
-	let admissionTail = Promise.resolve();
 	const prepareAdmission = (event) => {
 		const facts = inspectNostrIngressEvent(event);
 		const receivedAt = Date.now();
@@ -322,34 +315,8 @@ function createNostrIngress(options) {
 			payload
 		};
 	};
-	const admitOnce = async (prepared) => {
-		await monitorStart;
-		const pending = await getQueue().listPending({ limit: options.maxPendingEvents });
-		const claims = await getQueue().listClaims();
-		if (pending.length + claims.length >= options.maxPendingEvents) throw new NostrIngressAdmissionRejectedError("backpressure", "Nostr event exceeds the durable ingress backlog.");
-		try {
-			return await retryAsync(async () => {
-				const result = await getQueue().enqueue(prepared.facts.eventId, prepared.payload, {
-					receivedAt: prepared.receivedAt,
-					laneKey: prepared.facts.laneKey
-				});
-				options.afterDurableAppend(prepared.event);
-				monitor.requestDrain();
-				return result.kind === "accepted" ? "accepted" : "duplicate";
-			}, {
-				attempts: NOSTR_INGRESS_APPEND_RETRY_MS.length,
-				minDelayMs: 0,
-				delayMs: ({ attempt }) => NOSTR_INGRESS_APPEND_RETRY_MS[attempt] ?? 0,
-				sleep: (delayMs) => sleepWithAbort(delayMs)
-			});
-		} catch (error) {
-			throw new Error(`Nostr durable admission failed: ${formatErrorMessage(error)}`, { cause: error });
-		}
-	};
 	return {
-		ready: async () => {
-			await monitorStart;
-		},
+		ready: () => monitorStart,
 		receive: (event) => {
 			if (stopping) return Promise.reject(createStoppedError());
 			let prepared;
@@ -359,27 +326,15 @@ function createNostrIngress(options) {
 				return Promise.reject(error);
 			}
 			queuedAdmissions += 1;
-			const settledAdmission = admissionTail.then(async () => {
-				if (admissionFailure) throw admissionFailure;
-				try {
-					return await admitOnce(prepared);
-				} catch (error) {
-					if (error instanceof NostrIngressAdmissionRejectedError || error instanceof NostrIngressPermanentError) throw error;
-					admissionFailure = error instanceof Error ? error : new Error(formatErrorMessage(error), { cause: error });
-					throw admissionFailure;
-				}
-			}).finally(() => {
+			return monitor.admit(prepared, { receivedAt: prepared.receivedAt }).then((result) => result.queueResult?.kind === "accepted" ? "accepted" : "duplicate").finally(() => {
 				queuedAdmissions -= 1;
 			});
-			admissionTail = settledAdmission.then(() => void 0, () => void 0);
-			return settledAdmission;
 		},
 		stop: () => {
 			if (stopTask) return stopTask;
 			stopping = true;
 			const pauseTask = monitor.pause();
 			stopTask = (async () => {
-				await admissionTail;
 				await monitorStart.catch(() => void 0);
 				await pauseTask;
 				await monitor.stop();
@@ -387,7 +342,6 @@ function createNostrIngress(options) {
 			return stopTask;
 		},
 		waitForIdle: async () => {
-			await admissionTail;
 			await monitorStart;
 			await monitor.waitForIdle();
 		}
@@ -456,67 +410,6 @@ async function publishProfile(pool, sk, relays, profile, lastPublishedAt) {
 		createdAt: event.created_at
 	};
 }
-// extensions/nostr/src/nostr-relay-subscription.ts
-const DEFAULT_EOSE_CONFIRM_DEADLINE_MS = 1e4;
-/** Separates real relay EOSE frames from nostr-tools timeout/close synthesis. */
-function createNostrRelaySubscriptionGroup(options) {
-	const relays = [...new Set(options.relays)];
-	const subscriptions = [];
-	const deadlineTimers = /* @__PURE__ */ new Set();
-	let locallyClosing = false;
-	const backfillStatus = new Map(relays.map((relay) => [relay, "pending"]));
-	const settleBackfill = (relay, status) => {
-		if (backfillStatus.get(relay) !== "pending") return;
-		backfillStatus.set(relay, status);
-		if ([...backfillStatus.values()].some((value) => value === "pending")) return;
-		if ([...backfillStatus.values()].every((value) => value === "confirmed")) options.onBackfillComplete(relays);
-	};
-	const clearDeadlines = () => {
-		for (const timer of deadlineTimers) clearTimeout(timer);
-		deadlineTimers.clear();
-	};
-	return {
-		start: () => {
-			for (const relay of relays) {
-				let relayClosed = false;
-				let deadlineReached = false;
-				const deadlineTimer = setTimeout(() => {
-					deadlineTimers.delete(deadlineTimer);
-					deadlineReached = true;
-					settleBackfill(relay, "incomplete");
-				}, DEFAULT_EOSE_CONFIRM_DEADLINE_MS);
-				deadlineTimer.unref?.();
-				deadlineTimers.add(deadlineTimer);
-				subscriptions.push(options.pool.subscribeMany([relay], options.filter, {
-					onevent: options.onEvent,
-					oneose: () => {
-						queueMicrotask(() => {
-							if (!relayClosed && !deadlineReached) {
-								clearTimeout(deadlineTimer);
-								deadlineTimers.delete(deadlineTimer);
-								settleBackfill(relay, "confirmed");
-							}
-						});
-					},
-					onclose: (reasons) => {
-						relayClosed = true;
-						clearTimeout(deadlineTimer);
-						deadlineTimers.delete(deadlineTimer);
-						settleBackfill(relay, "incomplete");
-						if (!locallyClosing && !options.abort.aborted) options.onClose(relay, reasons.map(({ reason }) => reason));
-					},
-					maxWait: 11e3,
-					abort: options.abort
-				}));
-			}
-		},
-		close: async (reason) => {
-			locallyClosing = true;
-			clearDeadlines();
-			await Promise.all(subscriptions.map(async (subscription) => subscription.close(reason)));
-		}
-	};
-}
 // extensions/nostr/src/state-account-id.ts
 function normalizeNostrStateAccountId(accountId) {
 	const trimmed = accountId?.trim();
@@ -526,31 +419,29 @@ function normalizeNostrStateAccountId(accountId) {
 // extensions/nostr/src/nostr-state-store.ts
 const STORE_VERSION = 2;
 const PROFILE_STATE_VERSION = 1;
-function openNostrBusStateStore(env) {
+function openNostrBusStateStore() {
 	return getNostrRuntime().state.openKeyedStore({
 		namespace: "bus-state",
-		maxEntries: 256,
-		...env ? { env } : {}
+		maxEntries: 256
 	});
 }
-function openNostrProfileStateStore(env) {
+function openNostrProfileStateStore() {
 	return getNostrRuntime().state.openKeyedStore({
 		namespace: "profile-state",
-		maxEntries: 256,
-		...env ? { env } : {}
+		maxEntries: 256
 	});
 }
 async function readNostrBusState(params) {
-	return await openNostrBusStateStore(params.env).lookup(normalizeNostrStateAccountId(params.accountId)) ?? null;
+	return await openNostrBusStateStore().lookup(normalizeNostrStateAccountId(params.accountId)) ?? null;
 }
 async function writeNostrBusState(params) {
 	const payload = {
 		version: STORE_VERSION,
 		lastProcessedAt: params.lastProcessedAt,
 		gatewayStartedAt: params.gatewayStartedAt,
-		recentEventIds: (params.recentEventIds ?? []).filter((x) => typeof x === "string")
+		recentEventIds: params.recentEventIds ?? []
 	};
-	await openNostrBusStateStore(params.env).register(normalizeNostrStateAccountId(params.accountId), payload);
+	await openNostrBusStateStore().register(normalizeNostrStateAccountId(params.accountId), payload);
 }
 /**
 * Determine the `since` timestamp for subscription.
@@ -564,7 +455,7 @@ function computeSinceTimestamp(state, nowSec = Math.floor(Date.now() / 1e3)) {
 	return Math.max(...candidates);
 }
 async function readNostrProfileState(params) {
-	return await openNostrProfileStateStore(params.env).lookup(normalizeNostrStateAccountId(params.accountId)) ?? null;
+	return await openNostrProfileStateStore().lookup(normalizeNostrStateAccountId(params.accountId)) ?? null;
 }
 async function writeNostrProfileState(params) {
 	const payload = {
@@ -573,109 +464,26 @@ async function writeNostrProfileState(params) {
 		lastPublishedEventId: params.lastPublishedEventId,
 		lastPublishResults: params.lastPublishResults
 	};
-	await openNostrProfileStateStore(params.env).register(normalizeNostrStateAccountId(params.accountId), payload);
+	await openNostrProfileStateStore().register(normalizeNostrStateAccountId(params.accountId), payload);
 }
 // extensions/nostr/src/nostr-bus.ts
 const STARTUP_LOOKBACK_SEC = 120;
 const STATE_PERSIST_DEBOUNCE_MS = 5e3;
 const NOSTR_INGRESS_ENVELOPE_OVERHEAD_BYTES = 16384;
 const NOSTR_INGRESS_MAX_PENDING_EVENTS = 1e3;
-const CIRCUIT_BREAKER_THRESHOLD = 5;
-const CIRCUIT_BREAKER_RESET_MS = 3e4;
-const HEALTH_WINDOW_MS = 6e4;
-function createCircuitBreaker(relay, metrics) {
-	const state = {
-		state: "closed",
-		failures: 0,
-		lastFailure: 0
-	};
-	return {
-		canAttempt() {
-			if (state.state === "open") {
-				if (Date.now() - state.lastFailure >= CIRCUIT_BREAKER_RESET_MS) {
-					state.state = "half_open";
-					metrics.emit("relay.circuit_breaker.half_open", 1, { relay });
-					return true;
-				}
-				return false;
-			}
-			return true;
-		},
-		recordSuccess() {
-			if (state.state === "half_open") {
-				state.state = "closed";
-				state.failures = 0;
-				metrics.emit("relay.circuit_breaker.close", 1, { relay });
-			} else if (state.state === "closed") state.failures = 0;
-		},
-		recordFailure() {
-			state.failures++;
-			state.lastFailure = Date.now();
-			if (state.state === "half_open" || state.state === "closed" && state.failures >= CIRCUIT_BREAKER_THRESHOLD) {
-				state.state = "open";
-				metrics.emit("relay.circuit_breaker.open", 1, { relay });
-			}
-		}
-	};
-}
-function createRelayHealthTracker() {
-	const stats = /* @__PURE__ */ new Map();
-	function getOrCreate(relay) {
-		let s = stats.get(relay);
-		if (!s) {
-			s = {
-				successCount: 0,
-				failureCount: 0,
-				latencySum: 0,
-				lastSuccess: 0,
-				lastFailure: 0
-			};
-			stats.set(relay, s);
-		}
-		return s;
-	}
-	return {
-		recordSuccess(relay, latencyMs) {
-			const s = getOrCreate(relay);
-			s.successCount++;
-			s.latencySum += latencyMs;
-			s.lastSuccess = Date.now();
-		},
-		recordFailure(relay) {
-			const s = getOrCreate(relay);
-			s.failureCount++;
-			s.lastFailure = Date.now();
-		},
-		getScore(relay) {
-			const s = stats.get(relay);
-			if (!s) return .5;
-			const total = s.successCount + s.failureCount;
-			const successRate = s.successCount / total;
-			const now = Date.now();
-			const recencyBonus = s.lastSuccess > s.lastFailure ? Math.max(0, 1 - (now - s.lastSuccess) / HEALTH_WINDOW_MS) * .2 : 0;
-			const avgLatency = s.successCount > 0 ? s.latencySum / s.successCount : 1e3;
-			const latencyPenalty = Math.min(.2, avgLatency / 1e4);
-			return Math.max(0, Math.min(1, successRate + recencyBonus - latencyPenalty));
-		},
-		getSortedRelays(relays) {
-			return relays.toSorted((a, b) => this.getScore(b) - this.getScore(a));
-		}
-	};
-}
+const DEFAULT_EOSE_CONFIRM_DEADLINE_MS = 1e4;
 /** Subscribe to NIP-04 encrypted DMs. */
 async function startNostrBus(options) {
-	const { privateKey, relays = DEFAULT_RELAYS, onMessage, authorizeSender, onError, onEose, onMetric } = options;
+	const { privateKey, relays = DEFAULT_RELAYS, onMessage, authorizeSender, onError, onEose, onRejected } = options;
 	const sk = validatePrivateKey(privateKey);
 	const pk = getPublicKey(sk);
 	const pool = new SimplePool();
+	const admissionPubkeys = options.admissionPubkeys ? new Set(options.admissionPubkeys) : void 0;
 	pool.onRelayConnectionSuccess = options.onConnect;
 	const accountId = options.accountId ?? pk.slice(0, 16);
 	const gatewayStartedAt = Math.floor(Date.now() / 1e3);
-	const guardPolicy = createDirectDmPreCryptoGuardPolicy(options.guardPolicy);
-	const metrics = createMetrics(onMetric);
-	const circuitBreakers = /* @__PURE__ */ new Map();
-	const healthTracker = createRelayHealthTracker();
-	for (const relay of relays) circuitBreakers.set(relay, createCircuitBreaker(relay, metrics));
+	const guardPolicy = createDirectDmPreCryptoGuardPolicy();
+	let preferredRelay;
 	const state = await readNostrBusState({ accountId });
 	const baseSince = computeSinceTimestamp(state, gatewayStartedAt);
 	const since = Math.max(0, baseSince - STARTUP_LOOKBACK_SEC);
@@ -709,52 +517,44 @@ async function startNostrBus(options) {
 		maxRequests: guardPolicy.rateLimit.maxGlobalPerWindow,
 		maxTrackedKeys: 1
 	});
-	const updateRateLimiterSizeMetric = () => {
-		metrics.emit("memory.rate_limiter_entries", perSenderRateLimiter.size() + globalRateLimiter.size());
-	};
-	const rejectIfRateLimited = (limiter, key, metric) => {
-		updateRateLimiterSizeMetric();
+	const rejectIfRateLimited = (limiter, key) => {
 		const limited = limiter.isRateLimited(key);
-		if (limited) {
-			metrics.emit(metric);
-			metrics.emit("event.rejected.rate_limited");
-		}
-		updateRateLimiterSizeMetric();
+		if (limited) onRejected?.("rate_limited");
 		return limited;
 	};
 	async function dispatchEvent(event, lifecycle) {
 		if (event.pubkey === pk) {
-			metrics.emit("event.rejected.self_message");
+			onRejected?.("self_message");
 			return;
 		}
 		if (event.created_at > Math.floor(Date.now() / 1e3) + guardPolicy.maxFutureSkewSec) {
-			metrics.emit("event.rejected.future");
+			onRejected?.("future");
 			throw new Error(`Nostr event ${event.id} is too far in the future.`);
 		}
 		if (!guardPolicy.allowedKinds.includes(event.kind)) {
-			metrics.emit("event.rejected.wrong_kind");
+			onRejected?.("wrong_kind");
 			return;
 		}
 		if (!event.tags.some((tag) => tag[0] === "p" && tag[1] === pk)) {
-			metrics.emit("event.rejected.wrong_kind");
+			onRejected?.("wrong_kind");
 			return;
 		}
 		const replyTo = async (text) => {
 			await sendEncryptedDm(event.pubkey, text, { replyToEventId: event.id });
 		};
 		if (Buffer.byteLength(event.content, "utf8") > guardPolicy.maxCiphertextBytes) {
-			if (rejectIfRateLimited(globalRateLimiter, "global", "rate_limit.global")) throw new Error(`Nostr event ${event.id} hit the global rate limit.`);
-			metrics.emit("event.rejected.oversized_ciphertext");
+			if (rejectIfRateLimited(globalRateLimiter, "global")) throw new Error(`Nostr event ${event.id} hit the global rate limit.`);
+			onRejected?.("oversized_ciphertext");
 			return;
 		}
-		if (rejectIfRateLimited(globalRateLimiter, "global", "rate_limit.global")) throw new Error(`Nostr event ${event.id} hit the global rate limit.`);
+		if (rejectIfRateLimited(globalRateLimiter, "global")) throw new Error(`Nostr event ${event.id} hit the global rate limit.`);
 		if (!verifyEvent(event)) {
-			metrics.emit("event.rejected.invalid_signature");
+			onRejected?.("invalid_signature");
 			const error = new NostrIngressPermanentError("invalid-signature", `Nostr event ${event.id} has an invalid signature.`);
 			onError?.(error, `event ${event.id}`);
 			throw error;
 		}
-		if (rejectIfRateLimited(perSenderRateLimiter, event.pubkey, "rate_limit.per_sender")) throw new Error(`Nostr sender ${event.pubkey} hit the rate limit.`);
+		if (rejectIfRateLimited(perSenderRateLimiter, event.pubkey)) throw new Error(`Nostr sender ${event.pubkey} hit the rate limit.`);
 		if (authorizeSender) {
 			if (await authorizeSender({
 				senderPubkey: event.pubkey,
@@ -764,15 +564,13 @@ async function startNostrBus(options) {
 		let plaintext;
 		try {
 			plaintext = decrypt(sk, event.pubkey, event.content);
-			metrics.emit("decrypt.success");
 		} catch (error) {
-			metrics.emit("decrypt.failure");
-			metrics.emit("event.rejected.decrypt_failed");
+			onRejected?.("decrypt_failed");
 			onError?.(error, `decrypt from ${event.pubkey}`);
 			throw new NostrIngressPermanentError("decrypt-failed", `Nostr event ${event.id} could not be decrypted.`, { cause: error });
 		}
 		if (Buffer.byteLength(plaintext, "utf8") > guardPolicy.maxPlaintextBytes) {
-			metrics.emit("event.rejected.oversized_plaintext");
+			onRejected?.("oversized_plaintext");
 			return;
 		}
 		if (lifecycle.abortSignal.aborted) throw new Error(`Nostr event ${event.id} stopped before dispatch.`);
@@ -780,7 +578,6 @@ async function startNostrBus(options) {
 			eventId: event.id,
 			createdAt: event.created_at
 		}, lifecycle);
-		metrics.emit("event.processed");
 	}
 	const dmFilter = {
 		kinds: [4],
@@ -788,13 +585,13 @@ async function startNostrBus(options) {
 		since
 	};
 	const relayAbort = new AbortController();
-	let relaySubscriptions;
+	let closeRelaySubscriptions;
 	let relayStopPromise;
 	const stopRelays = (reason) => {
 		relayStopPromise ??= (async () => {
 			relayAbort.abort(reason);
 			try {
-				await relaySubscriptions?.close(reason);
+				await closeRelaySubscriptions?.(reason);
 			} catch (error) {
 				onError?.(error, "close subscription");
 			} finally {
@@ -829,20 +626,17 @@ async function startNostrBus(options) {
 		if (cursor !== void 0) await cursorWriter.persistNow(cursor);
 	};
 	const handleRelayEvent = async (event) => {
-		metrics.emit("event.received");
 		if (typeof event.created_at === "number" && event.created_at < since) {
-			metrics.emit("event.rejected.stale");
+			onRejected?.("stale");
 			return;
 		}
+		if (admissionPubkeys && !admissionPubkeys.has(event.pubkey)) return;
 		try {
-			if (await ingress.receive(event) === "duplicate") metrics.emit("event.duplicate");
+			await ingress.receive(event);
 		} catch (error) {
 			onError?.(error, `durable admission for event ${event.id}`);
 			if (error instanceof NostrIngressAdmissionRejectedError) {
-				if (error.reason === "rate-limited") {
-					metrics.emit("rate_limit.global");
-					metrics.emit("event.rejected.rate_limited");
-				}
+				if (error.reason === "rate-limited") onRejected?.("rate_limited");
 				if (error.reason !== "oversized-event") try {
 					await persistTransientReplayCursor(event);
 				} catch (cursorError) {
@@ -873,30 +667,68 @@ async function startNostrBus(options) {
 			gatewayStartedAt: cursorStartedAt,
 			recentEventIds: []
 		});
-		relaySubscriptions = createNostrRelaySubscriptionGroup({
-			pool,
-			relays,
-			filter: dmFilter,
-			abort: relayAbort.signal,
-			onEvent: (event) => {
-				const task = handleRelayEvent(event);
-				if (options.trackIngressTask) options.trackIngressTask(task.then(() => ingress.waitForIdle()));
-			},
-			onBackfillComplete: (confirmedRelays) => {
-				backfillFinalizePromise ??= ingress.waitForIdle().then(() => {
-					const cursor = durableCursor.markBackfillComplete();
-					if (cursor !== void 0) cursorWriter.schedule(cursor);
-					for (const relay of confirmedRelays) metrics.emit("relay.message.eose", 1, { relay });
-					onEose?.(confirmedRelays.join(", "));
-				}).catch((error) => onError?.(error, "finalize relay backfill"));
-			},
-			onClose: (relay, reasons) => {
-				metrics.emit("relay.message.closed", 1, { relay });
-				options.onDisconnect?.(relay);
-				onError?.(/* @__PURE__ */ new Error(`Subscription closed: ${reasons.join(", ")}`), "subscription");
-			}
-		});
-		relaySubscriptions.start();
+		/** Separates real relay EOSE frames from nostr-tools timeout/close synthesis. */
+		const subscriptionRelays = [...new Set(relays)];
+		const subscriptions = [];
+		const deadlineTimers = /* @__PURE__ */ new Set();
+		let locallyClosing = false;
+		const backfillStatus = new Map(subscriptionRelays.map((relay) => [relay, "pending"]));
+		const settleBackfill = (relay, status) => {
+			if (backfillStatus.get(relay) !== "pending") return;
+			backfillStatus.set(relay, status);
+			if ([...backfillStatus.values()].some((value) => value === "pending")) return;
+			if ([...backfillStatus.values()].every((value) => value === "confirmed")) backfillFinalizePromise ??= ingress.waitForIdle().then(() => {
+				const cursor = durableCursor.markBackfillComplete();
+				if (cursor !== void 0) cursorWriter.schedule(cursor);
+				onEose?.(subscriptionRelays.join(", "));
+			}).catch((error) => onError?.(error, "finalize relay backfill"));
+		};
+		closeRelaySubscriptions = async (reason) => {
+			locallyClosing = true;
+			for (const timer of deadlineTimers) clearTimeout(timer);
+			deadlineTimers.clear();
+			await Promise.all(subscriptions.map(async (subscription) => subscription.close(reason)));
+		};
+		const onRelayEvent = (event) => {
+			const task = handleRelayEvent(event);
+			if (options.trackIngressTask) options.trackIngressTask(task.then(() => ingress.waitForIdle()));
+		};
+		for (const relay of subscriptionRelays) {
+			let relayClosed = false;
+			let deadlineReached = false;
+			const deadlineTimer = setTimeout(() => {
+				deadlineTimers.delete(deadlineTimer);
+				deadlineReached = true;
+				settleBackfill(relay, "incomplete");
+			}, DEFAULT_EOSE_CONFIRM_DEADLINE_MS);
+			deadlineTimer.unref?.();
+			deadlineTimers.add(deadlineTimer);
+			subscriptions.push(pool.subscribeMany([relay], dmFilter, {
+				onevent: onRelayEvent,
+				oneose: () => {
+					queueMicrotask(() => {
+						if (!relayClosed && !deadlineReached) {
+							clearTimeout(deadlineTimer);
+							deadlineTimers.delete(deadlineTimer);
+							settleBackfill(relay, "confirmed");
+						}
+					});
+				},
+				onclose: (reasons) => {
+					relayClosed = true;
+					clearTimeout(deadlineTimer);
+					deadlineTimers.delete(deadlineTimer);
+					settleBackfill(relay, "incomplete");
+					if (!locallyClosing && !relayAbort.signal.aborted) {
+						const closeReasons = reasons.map(({ reason }) => reason);
+						options.onDisconnect?.(relay);
+						onError?.(/* @__PURE__ */ new Error(`Subscription closed: ${closeReasons.join(", ")}`), "subscription");
+					}
+				},
+				maxWait: 11e3,
+				abort: relayAbort.signal
+			}));
+		}
 	} catch (error) {
 		await Promise.allSettled([stopRelays("startup failed"), ingress.stop()]);
 		throw error;
@@ -946,22 +778,12 @@ async function startNostrBus(options) {
 			tags,
 			created_at: Math.floor(Date.now() / 1e3)
 		}, sk);
-		const sortedRelays = healthTracker.getSortedRelays(relays);
+		const sortedRelays = relays.toSorted((left, right) => Number(right === preferredRelay) - Number(left === preferredRelay));
 		let lastError;
 		for (const relay of sortedRelays) {
 			sendOptions?.assertDirectAdapterHandoff?.();
-			const cb = circuitBreakers.get(relay);
-			if (cb && !cb.canAttempt()) continue;
-			const startTime = Date.now();
 			const recordFailure = (err) => {
 				lastError = err instanceof Error ? err : new Error(String(err));
-				const latency = Date.now() - startTime;
-				cb?.recordFailure();
-				healthTracker.recordFailure(relay);
-				metrics.emit("relay.error", 1, {
-					relay,
-					latency
-				});
 				onError?.(lastError, `publish to ${relay}`);
 			};
 			const connection = await pool.ensureRelay(relay, { connectionTimeout: pool.maxWaitForConnection }).catch((err) => {
@@ -980,9 +802,7 @@ async function startNostrBus(options) {
 					initiated = true;
 					return connection.publish(reply);
 				});
-				const latency = Date.now() - startTime;
-				cb?.recordSuccess();
-				healthTracker.recordSuccess(relay, latency);
+				preferredRelay = relay;
 				return reply.id;
 			} catch (err) {
 				if (!initiated) throw err;
@@ -1023,6 +843,17 @@ function normalizeNostrSenderPubkey(value) {
 		return null;
 	}
 }
+function resolveAdmissionPubkeys(account) {
+	if (account.config.dmPolicy !== "allowlist" || !account.config.allowFrom?.length) return;
+	const pubkeys = [];
+	for (const entry of account.config.allowFrom) {
+		if (typeof entry !== "string") return;
+		const normalized = normalizeNostrAllowEntry(entry);
+		if (!normalized || !/^[0-9a-f]{64}$/.test(normalized)) return;
+		pubkeys.push(normalized);
+	}
+	return [...new Set(pubkeys)];
+}
 const nostrIngressIdentity = {
 	key: "nostr-pubkey",
 	normalizeEntry: normalizeNostrAllowEntry,
@@ -1093,6 +924,7 @@ async function startNostrGatewayAccount(ctx) {
 				privateKey: account.privateKey,
 				relays: account.relays,
 				authorizeSender,
+				admissionPubkeys: resolveAdmissionPubkeys(account),
 				onMessage: async (senderPubkey, text, reply, meta, lifecycle) => {
 					const resolvedAccess = await resolveInboundAccess(senderPubkey, text);
 					if (resolvedAccess.senderAccess.decision !== "allow") {
@@ -1163,11 +995,8 @@ async function startNostrGatewayAccount(ctx) {
 				onEose: (relays) => {
 					ctx.log?.debug?.(`[${account.accountId}] EOSE received from relays: ${relays}`);
 				},
-				onMetric: (event) => {
-					if (event.name.startsWith("event.rejected.")) ctx.log?.debug?.(`[${account.accountId}] Metric: ${event.name} ${JSON.stringify(event.labels)}`);
-					else if (event.name === "relay.circuit_breaker.open") ctx.log?.warn?.(`[${account.accountId}] Circuit breaker opened for relay: ${event.labels?.relay}`);
-					else if (event.name === "relay.circuit_breaker.close") ctx.log?.info?.(`[${account.accountId}] Circuit breaker closed for relay: ${event.labels?.relay}`);
-					else if (event.name === "relay.error") ctx.log?.debug?.(`[${account.accountId}] Relay error: ${event.labels?.relay}`);
+				onRejected: (reason) => {
+					ctx.log?.debug?.(`[${account.accountId}] Event rejected: ${reason}`);
 				}
 			});
 			activeBuses.set(account.accountId, bus);
@@ -1194,8 +1023,10 @@ const nostrPairingTextAdapter = {
 		}
 	},
 	notify: async ({ cfg, id, message, accountId }) => {
-		const bus = activeBuses.get(accountId ?? resolveDefaultNostrAccountId(cfg));
-		if (bus) await bus.sendDm(id, message);
+		const aid = accountId ?? resolveDefaultNostrAccountId(cfg);
+		const bus = activeBuses.get(aid);
+		if (!bus) throw new Error(`Nostr bus not running for account ${aid}`);
+		await bus.sendDm(id, message);
 	}
 };
 const nostrOutboundAdapter = {
@@ -1231,9 +1062,21 @@ const nostrOutboundAdapter = {
 	}
 };
 function getActiveNostrBuses() {
-	return new Map(activeBuses);
+	return activeBuses;
+}
+// extensions/nostr/src/channel.ts
+const NOSTR_TARGET_HINT = "<npub|hex pubkey|nostr:npub...>";
+function stripNostrTargetPrefix(target) {
+	return target.trim().replace(/^nostr:/i, "");
+}
+function normalizeNostrTarget(target) {
+	const cleaned = stripNostrTargetPrefix(target);
+	try {
+		return normalizePubkey(cleaned);
+	} catch {
+		return target.trim();
+	}
 }
-// extensions/nostr/src/session-route.ts
 function resolveNostrOutboundSessionRoute(params) {
 	const rawTarget = stripChannelTargetPrefix(params.target, "nostr");
 	let target;
@@ -1257,27 +1100,6 @@ function resolveNostrOutboundSessionRoute(params) {
 		to: `nostr:${target}`
 	});
 }
-// extensions/nostr/src/channel.ts
-const NOSTR_TARGET_HINT = "<npub|hex pubkey|nostr:npub...>";
-function stripNostrTargetPrefix(target) {
-	return target.trim().replace(/^nostr:/i, "");
-}
-function normalizeNostrTarget(target) {
-	const cleaned = stripNostrTargetPrefix(target);
-	try {
-		return normalizePubkey(cleaned);
-	} catch {
-		return target.trim();
-	}
-}
-function inferNostrTargetChatType(target) {
-	try {
-		normalizePubkey(stripNostrTargetPrefix(target));
-		return "direct";
-	} catch {
-		return;
-	}
-}
 const resolveNostrDmPolicy = createScopedDmSecurityResolver({
 	channelKey: "nostr",
 	resolvePolicy: (account) => account.config.dmPolicy,
@@ -1342,7 +1164,14 @@ const nostrPlugin = createChatChannelPlugin({
 		messaging: {
 			targetPrefixes: ["nostr"],
 			normalizeTarget: normalizeNostrTarget,
-			inferTargetChatType: ({ to }) => inferNostrTargetChatType(to),
+			inferTargetChatType: ({ to }) => {
+				try {
+					normalizePubkey(stripNostrTargetPrefix(to));
+					return "direct";
+				} catch {
+					return;
+				}
+			},
 			targetResolver: {
 				looksLikeId: (input, normalized) => {
 					const trimmed = normalized?.trim() || stripNostrTargetPrefix(input);