@openclaw/nostr 2026.7.2-beta.2 → 2026.7.2-beta.4

package/dist/api.js

@@ -1,14 +1,14 @@
-import { o as resolveNostrAccount } from "./setup-surface-B52P4uo2.js";
+import { s as resolveNostrAccount } from "./setup-surface-ChtM-WSY.js";
 import { getPluginRuntimeGatewayRequestScope } from "./runtime-api.js";
 import { n as NostrProfileSchema } from "./config-schema-CelPzg1N.js";
-import { a as setNostrRuntime, i as getNostrRuntime, n as nostrPlugin, o as contentToProfile, r as publishNostrProfile, t as getNostrProfileState } from "./channel-B51rExHD.js";
+import { a as getNostrRuntime, i as contentToProfile, n as nostrPlugin, o as setNostrRuntime, r as publishNostrProfile, t as getNostrProfileState } from "./channel-DqbdMXMg.js";
 import { normalizeLowercaseStringOrEmpty, normalizeOptionalLowercaseString, readStringValue } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { z } from "zod";
 import { SimplePool } from "nostr-tools";
-import { resolveTimerTimeoutMs } from "openclaw/plugin-sdk/number-runtime";
 import { KeyedAsyncQueue } from "openclaw/plugin-sdk/keyed-async-queue";
 import { readJsonBodyWithLimit, requestBodyErrorToText } from "openclaw/plugin-sdk/webhook-request-guards";
 import { createFixedWindowRateLimiter } from "openclaw/plugin-sdk/webhook-ingress";
+import { resolveTimerTimeoutMs } from "openclaw/plugin-sdk/number-runtime";
 import { isBlockedHostnameOrIp } from "openclaw/plugin-sdk/ssrf-runtime";
 //#region extensions/nostr/src/nostr-profile-url-safety.ts
 function validateUrlSafety(urlStr) {
@@ -115,9 +115,9 @@ async function importProfileFromRelays(opts) {
 			relaysQueried
 		};
 		const bestEvent = events.reduce((current, candidate) => candidate.event.created_at > current.event.created_at ? candidate : current);
-		let content;
+		let parsedContent;
 		try {
-			content = JSON.parse(bestEvent.event.content);
+			parsedContent = JSON.parse(bestEvent.event.content);
 		} catch {
 			return {
 				ok: false,
@@ -126,9 +126,23 @@ async function importProfileFromRelays(opts) {
 				sourceRelay: bestEvent.relay
 			};
 		}
+		if (typeof parsedContent !== "object" || parsedContent === null || Array.isArray(parsedContent)) return {
+			ok: false,
+			error: "Profile event content must be a JSON object",
+			relaysQueried,
+			sourceRelay: bestEvent.relay
+		};
+		const sanitizedProfile = sanitizeProfileUrls(contentToProfile(parsedContent));
+		const validatedProfile = NostrProfileSchema.safeParse(sanitizedProfile);
+		if (!validatedProfile.success) return {
+			ok: false,
+			error: "Profile event content has invalid fields",
+			relaysQueried,
+			sourceRelay: bestEvent.relay
+		};
 		return {
 			ok: true,
-			profile: sanitizeProfileUrls(contentToProfile(content)),
+			profile: validatedProfile.data,
 			event: {
 				id: bestEvent.event.id,
 				pubkey: bestEvent.event.pubkey,