@openclaw/nostr 2026.7.2-beta.2 → 2026.7.2-beta.4

package/dist/{channel-B51rExHD.js → channel-DqbdMXMg.js}

@@ -1,23 +1,24 @@
-import { a as resolveDefaultNostrAccountId, c as validatePrivateKey, i as listNostrAccountIds, n as nostrSetupWizard, o as resolveNostrAccount, s as normalizePubkey, t as nostrSetupAdapter } from "./setup-surface-B52P4uo2.js";
+import { a as listNostrAccountIds, c as normalizePubkey, l as validatePrivateKey, n as nostrSetupContract, o as resolveDefaultNostrAccountId, r as nostrSetupWizard, s as resolveNostrAccount, t as nostrSetupAdapter } from "./setup-surface-ChtM-WSY.js";
 import { a as collectStatusIssuesFromLastError, i as buildChannelConfigSchema, n as NostrProfileSchema, o as createDefaultChannelRuntimeState, r as DEFAULT_ACCOUNT_ID, s as formatPairingApproveHint, t as NostrConfigSchema } from "./config-schema-CelPzg1N.js";
-import { i as DEFAULT_RELAYS } from "./setup-adapter-DEU3o8MF.js";
+import { a as DEFAULT_RELAYS } from "./setup-adapter-BjKmSwdW.js";
 import { t as normalizeNostrStateAccountId } from "./state-account-id-CvBZ9s6P.js";
 import { describeAccountSnapshot } from "openclaw/plugin-sdk/account-helpers";
 import { createScopedDmSecurityResolver, createTopLevelChannelConfigAdapter } from "openclaw/plugin-sdk/channel-config-helpers";
 import { createChatChannelPlugin } from "openclaw/plugin-sdk/channel-core";
-import { createChannelMessageAdapterFromOutbound } from "openclaw/plugin-sdk/channel-outbound";
-import { buildPassiveChannelStatusSummary, buildTrafficStatusSummary, runStoppablePassiveMonitor } from "openclaw/plugin-sdk/extension-shared";
+import { missingTargetError } from "openclaw/plugin-sdk/channel-feedback";
+import { DEFAULT_INGRESS_ADOPTION_STALL_MS, bindIngressLifecycleToReplyOptions, createChannelIngressMonitor, createChannelMessageAdapterFromOutbound, runPassiveAccountLifecycle } from "openclaw/plugin-sdk/channel-outbound";
+import { buildPassiveChannelStatusSummary, buildTrafficStatusSummary } from "openclaw/plugin-sdk/extension-shared";
 import { createComputedAccountStatusAdapter } from "openclaw/plugin-sdk/status-helpers";
 import { normalizeStringEntries } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { resolveStableChannelMessageIngress } from "openclaw/plugin-sdk/channel-ingress-runtime";
 import { createChannelPairingController } from "openclaw/plugin-sdk/channel-pairing";
 import { attachChannelToResult } from "openclaw/plugin-sdk/channel-send-result";
+import { stripMarkdown } from "openclaw/plugin-sdk/text-chunking";
 import { SimplePool, finalizeEvent, getPublicKey, verifyEvent } from "nostr-tools";
 import { decrypt, encrypt } from "nostr-tools/nip04";
 import { createDirectDmPreCryptoGuardPolicy } from "openclaw/plugin-sdk/direct-dm-guard-policy";
 import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
 import { createPluginRuntimeStore } from "openclaw/plugin-sdk/runtime-store";
-import { resolveIntegerOption, resolvePositiveTimerTimeoutMs } from "openclaw/plugin-sdk/number-runtime";
 import { buildChannelOutboundSessionRoute, stripChannelTargetPrefix } from "openclaw/plugin-sdk/core";
 //#region extensions/nostr/src/metrics.ts
 function createZeroMetricsState() {
@@ -240,6 +241,395 @@ function createNoopMetrics() {
 	};
 }
 //#endregion
+//#region extensions/nostr/src/nostr-cursor.ts
+const CURSOR_WRITE_RETRY_MS = [
+	0,
+	100,
+	300
+];
+const CURSOR_RECOVERY_RETRY_MS = 1e3;
+/** Tracks the largest EOSE-safe Nostr timestamp without skipping undurable relay events. */
+function createNostrDurableCursor(options) {
+	const nowSec = options.nowSec ?? (() => Math.floor(Date.now() / 1e3));
+	let durableCandidate;
+	let transientReplayCeiling;
+	let backfillComplete = false;
+	const safeCandidate = () => {
+		if (durableCandidate === void 0) return;
+		return Math.min(durableCandidate, transientReplayCeiling ?? Number.MAX_SAFE_INTEGER);
+	};
+	return {
+		recordDurableAppend: (event) => {
+			if (!Number.isSafeInteger(event.created_at)) return;
+			const previousSafeCandidate = safeCandidate();
+			durableCandidate = Math.max(durableCandidate ?? 0, Math.min(event.created_at, nowSec()));
+			const nextSafeCandidate = safeCandidate();
+			return backfillComplete && nextSafeCandidate !== previousSafeCandidate ? nextSafeCandidate : void 0;
+		},
+		recordTransientRejection: (event) => {
+			if (!Number.isSafeInteger(event.created_at) || event.created_at < options.since) return;
+			const previousSafeCandidate = safeCandidate();
+			transientReplayCeiling = Math.min(transientReplayCeiling ?? Number.MAX_SAFE_INTEGER, event.created_at + options.replayOverlapSec);
+			const nextSafeCandidate = safeCandidate();
+			return backfillComplete && nextSafeCandidate !== previousSafeCandidate ? nextSafeCandidate : void 0;
+		},
+		markBackfillComplete: () => {
+			backfillComplete = true;
+			return safeCandidate();
+		}
+	};
+}
+/** Serializes cursor writes so a safety rewind always lands after older progress writes. */
+function createNostrCursorStateWriter(options) {
+	let desiredCursor = Math.max(options.minimumCursor, options.initialCursor);
+	let dirty = false;
+	let timer;
+	let writeTail = Promise.resolve();
+	let activeFlush;
+	let recoveryFlush;
+	const writeWithRetry = async (cursor) => {
+		let lastError;
+		for (const delayMs of CURSOR_WRITE_RETRY_MS) {
+			if (delayMs > 0) await new Promise((resolve) => {
+				setTimeout(resolve, delayMs);
+			});
+			try {
+				await options.write(cursor);
+				return;
+			} catch (error) {
+				lastError = error;
+			}
+		}
+		throw new Error("Nostr cursor state write failed.", { cause: lastError });
+	};
+	const enqueueWrite = (cursor) => {
+		const write = writeTail.then(() => writeWithRetry(cursor));
+		writeTail = write.catch(() => void 0);
+		return write;
+	};
+	const clearTimer = () => {
+		if (timer) {
+			clearTimeout(timer);
+			timer = void 0;
+		}
+	};
+	const runFlush = async () => {
+		for (;;) {
+			if (!dirty) {
+				await writeTail;
+				if (!dirty) return;
+			}
+			dirty = false;
+			const cursor = desiredCursor;
+			try {
+				await enqueueWrite(cursor);
+			} catch (error) {
+				dirty = true;
+				throw error;
+			}
+		}
+	};
+	const flush = () => {
+		clearTimer();
+		if (activeFlush) return activeFlush;
+		const tracked = runFlush().finally(() => {
+			if (activeFlush === tracked) activeFlush = void 0;
+		});
+		activeFlush = tracked;
+		return tracked;
+	};
+	const setDesiredCursor = (cursor) => {
+		desiredCursor = Math.max(options.minimumCursor, cursor);
+		dirty = true;
+	};
+	return {
+		schedule: (cursor) => {
+			setDesiredCursor(cursor);
+			clearTimer();
+			timer = setTimeout(() => {
+				timer = void 0;
+				flush().catch((error) => options.onBackgroundError?.(error));
+			}, options.debounceMs);
+			timer.unref?.();
+		},
+		persistNow: async (cursor) => {
+			setDesiredCursor(cursor);
+			await flush();
+		},
+		flush,
+		flushUntilSuccess: () => {
+			recoveryFlush ??= (async () => {
+				for (;;) try {
+					await flush();
+					return;
+				} catch (error) {
+					options.onBackgroundError?.(error);
+					await new Promise((resolve) => {
+						setTimeout(resolve, options.recoveryRetryMs ?? CURSOR_RECOVERY_RETRY_MS);
+					});
+				}
+			})().finally(() => {
+				recoveryFlush = void 0;
+			});
+			return recoveryFlush;
+		}
+	};
+}
+var NostrIngressPermanentError = class extends Error {
+	constructor(reason, message, options) {
+		super(message, options);
+		this.name = "NostrIngressPermanentError";
+		this.reason = reason;
+	}
+};
+function isNostrIngressRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function requiredString(value, field) {
+	if (typeof value === "string" && value.trim()) return value;
+	throw new NostrIngressPermanentError("invalid-event", `Nostr event is missing ${field}.`);
+}
+function inspectNostrIngressEvent(event) {
+	if (!isNostrIngressRecord(event)) throw new NostrIngressPermanentError("invalid-event", "Nostr event must be an object.");
+	return {
+		eventId: requiredString(event.id, "id"),
+		laneKey: `direct:${requiredString(event.pubkey, "pubkey")}`
+	};
+}
+/** Convert the retired persisted LRU seed into durable completion tombstones. */
+async function migrateNostrLegacyRecentEventIds(params) {
+	const migratedAt = params.migratedAt ?? Date.now();
+	let migrated = 0;
+	for (const eventId of new Set(params.eventIds)) {
+		if (!eventId.trim()) continue;
+		const result = await params.queue.enqueue(eventId, {
+			version: 1,
+			receivedAt: migratedAt,
+			rawEvent: ""
+		}, {
+			receivedAt: migratedAt,
+			laneKey: `legacy:${eventId}`
+		});
+		if (result.kind === "accepted" || result.kind === "pending" && result.record.payload.rawEvent === "") {
+			if (!await params.queue.complete(eventId, { completedAt: migratedAt })) throw new Error(`Failed to migrate Nostr replay event ${eventId}.`);
+		}
+		migrated += 1;
+	}
+	return migrated;
+}
+//#endregion
+//#region extensions/nostr/src/runtime.ts
+const { setRuntime: setNostrRuntime, getRuntime: getNostrRuntime } = createPluginRuntimeStore({
+	pluginId: "nostr",
+	errorMessage: "Nostr runtime not initialized"
+});
+//#endregion
+//#region extensions/nostr/src/nostr-ingress.ts
+const NOSTR_INGRESS_POLL_INTERVAL_MS = 500;
+const NOSTR_INGRESS_PRUNE_INTERVAL_MS = 3600 * 1e3;
+const NOSTR_INGRESS_COMPLETED_TTL_MS = 720 * 60 * 60 * 1e3;
+const NOSTR_INGRESS_COMPLETED_MAX_ENTRIES = 1e5;
+const NOSTR_INGRESS_FAILED_TTL_MS = 720 * 60 * 60 * 1e3;
+const NOSTR_INGRESS_FAILED_MAX_ENTRIES = 1e5;
+const NOSTR_INGRESS_APPEND_RETRY_MS = [
+	0,
+	100,
+	300
+];
+var NostrIngressAdmissionRejectedError = class extends Error {
+	constructor(reason, message) {
+		super(message);
+		this.name = "NostrIngressAdmissionRejectedError";
+		this.reason = reason;
+	}
+};
+function deserializeNostrIngressEvent(rawEvent, claimedId) {
+	let parsed;
+	try {
+		parsed = JSON.parse(rawEvent);
+	} catch (error) {
+		throw new NostrIngressPermanentError("invalid-event", `Nostr ingress row ${claimedId} contains invalid JSON.`, { cause: error });
+	}
+	if (!isNostrIngressRecord(parsed)) throw new NostrIngressPermanentError("invalid-event", `Nostr ingress row ${claimedId} has an invalid event shape.`);
+	if (typeof parsed.kind !== "number" || typeof parsed.created_at !== "number" || typeof parsed.content !== "string" || typeof parsed.sig !== "string" || !Array.isArray(parsed.tags)) throw new NostrIngressPermanentError("invalid-event", `Nostr ingress row ${claimedId} has an invalid event shape.`);
+	return parsed;
+}
+function createNostrIngress(options) {
+	let queue = options.queue;
+	let admissionFailure;
+	let admissionWindowStartedAt = Date.now();
+	let admissionWindowCount = 0;
+	let queuedAdmissions = 0;
+	let stopping = false;
+	let stopTask;
+	const createStoppedError = () => /* @__PURE__ */ new Error("Nostr ingress stopped");
+	const getQueue = () => {
+		queue ??= getNostrRuntime().state.openChannelIngressQueue({ accountId: options.accountId });
+		return queue;
+	};
+	const legacyMigration = migrateNostrLegacyRecentEventIds({
+		queue: getQueue(),
+		eventIds: options.legacyEventIds ?? []
+	});
+	const monitor = createChannelIngressMonitor({
+		queue: getQueue,
+		inspect: (event) => {
+			const facts = inspectNostrIngressEvent(event);
+			return {
+				eventId: facts.eventId,
+				laneKey: facts.laneKey
+			};
+		},
+		payload: {
+			version: 1,
+			serialize: (event, { receivedAt }) => ({
+				receivedAt,
+				rawEvent: JSON.stringify(event)
+			}),
+			deserialize: (body, { claim }) => deserializeNostrIngressEvent(body.rawEvent, claim.id),
+			encode: ({ body }) => ({
+				version: 1,
+				...body
+			}),
+			decode: (payload, { claim }) => {
+				if (typeof payload !== "object" || payload === null || typeof payload.rawEvent !== "string") throw new NostrIngressPermanentError("invalid-event", `Nostr ingress row ${claim.id} has an invalid payload.`);
+				return {
+					version: payload.version,
+					body: {
+						receivedAt: typeof payload.receivedAt === "number" ? payload.receivedAt : 0,
+						rawEvent: payload.rawEvent
+					}
+				};
+			},
+			createClaimError: (kind, claim) => new NostrIngressPermanentError("invalid-event", kind === "invalid-version" ? `Nostr ingress row ${claim.id} has an unsupported version.` : `Nostr ingress row ${claim.id} changed event identity.`)
+		},
+		deliver: (event, lifecycle) => options.deliver(event, lifecycle),
+		pollIntervalMs: options.pollIntervalMs ?? NOSTR_INGRESS_POLL_INTERVAL_MS,
+		retention: {
+			pruneIntervalMs: NOSTR_INGRESS_PRUNE_INTERVAL_MS,
+			completedTtlMs: NOSTR_INGRESS_COMPLETED_TTL_MS,
+			completedMaxEntries: NOSTR_INGRESS_COMPLETED_MAX_ENTRIES,
+			failedTtlMs: NOSTR_INGRESS_FAILED_TTL_MS,
+			failedMaxEntries: NOSTR_INGRESS_FAILED_MAX_ENTRIES
+		},
+		drain: {
+			adoptionStallTimeoutMs: options.adoptionStallTimeoutMs ?? DEFAULT_INGRESS_ADOPTION_STALL_MS,
+			resolveNonRetryableFailure: (error) => error instanceof NostrIngressPermanentError ? {
+				reason: error.reason,
+				message: error.message
+			} : null,
+			onLog: (message) => options.onError?.(new Error(message), "ingress drain")
+		},
+		createStoppedError,
+		onError: (error) => options.onError?.(error, "ingress drain")
+	});
+	const monitorStart = legacyMigration.then(() => {
+		if (!stopping) monitor.start();
+	});
+	monitorStart.catch((error) => options.onError?.(error, "ingress drain"));
+	let admissionTail = Promise.resolve();
+	const prepareAdmission = (event) => {
+		const facts = inspectNostrIngressEvent(event);
+		const receivedAt = Date.now();
+		if (receivedAt - admissionWindowStartedAt >= options.admissionRateLimit.windowMs) {
+			admissionWindowStartedAt = receivedAt;
+			admissionWindowCount = 0;
+		}
+		if (admissionWindowCount >= options.admissionRateLimit.maxEvents) throw new NostrIngressAdmissionRejectedError("rate-limited", "Nostr event exceeds the durable admission rate.");
+		admissionWindowCount += 1;
+		if (queuedAdmissions >= options.maxQueuedAdmissions) throw new NostrIngressAdmissionRejectedError("backpressure", "Nostr event exceeds the in-memory admission backlog.");
+		let payload;
+		let serializedPayload;
+		try {
+			payload = {
+				version: 1,
+				receivedAt,
+				rawEvent: JSON.stringify(event)
+			};
+			serializedPayload = JSON.stringify(payload);
+		} catch (error) {
+			throw new NostrIngressPermanentError("invalid-event", "Nostr event could not be serialized for durable ingress.", { cause: error });
+		}
+		if (Buffer.byteLength(serializedPayload, "utf8") > options.maxSerializedPayloadBytes) throw new NostrIngressAdmissionRejectedError("oversized-event", "Nostr event exceeds the durable ingress size limit.");
+		return {
+			event,
+			facts,
+			receivedAt,
+			payload
+		};
+	};
+	const admitOnce = async (prepared) => {
+		await legacyMigration;
+		const pending = await getQueue().listPending({ limit: options.maxPendingEvents });
+		const claims = await getQueue().listClaims();
+		if (pending.length + claims.length >= options.maxPendingEvents) throw new NostrIngressAdmissionRejectedError("backpressure", "Nostr event exceeds the durable ingress backlog.");
+		let lastError;
+		for (const delayMs of NOSTR_INGRESS_APPEND_RETRY_MS) {
+			if (delayMs > 0) await new Promise((resolve) => {
+				setTimeout(resolve, delayMs);
+			});
+			try {
+				const result = await getQueue().enqueue(prepared.facts.eventId, prepared.payload, {
+					receivedAt: prepared.receivedAt,
+					laneKey: prepared.facts.laneKey
+				});
+				options.afterDurableAppend(prepared.event);
+				monitor.requestDrain();
+				return result.kind === "accepted" ? "accepted" : "duplicate";
+			} catch (error) {
+				lastError = error;
+			}
+		}
+		throw new Error(`Nostr durable admission failed: ${formatErrorMessage(lastError)}`, { cause: lastError });
+	};
+	return {
+		ready: async () => {
+			await monitorStart;
+		},
+		receive: (event) => {
+			if (stopping) return Promise.reject(createStoppedError());
+			let prepared;
+			try {
+				prepared = prepareAdmission(event);
+			} catch (error) {
+				return Promise.reject(error);
+			}
+			queuedAdmissions += 1;
+			const settledAdmission = admissionTail.then(async () => {
+				if (admissionFailure) throw admissionFailure;
+				try {
+					return await admitOnce(prepared);
+				} catch (error) {
+					if (error instanceof NostrIngressAdmissionRejectedError || error instanceof NostrIngressPermanentError) throw error;
+					admissionFailure = error instanceof Error ? error : new Error(formatErrorMessage(error), { cause: error });
+					throw admissionFailure;
+				}
+			}).finally(() => {
+				queuedAdmissions -= 1;
+			});
+			admissionTail = settledAdmission.then(() => void 0, () => void 0);
+			return settledAdmission;
+		},
+		stop: () => {
+			if (stopTask) return stopTask;
+			stopping = true;
+			const pauseTask = monitor.pause();
+			stopTask = (async () => {
+				await admissionTail;
+				await monitorStart.catch(() => void 0);
+				await pauseTask;
+				await monitor.stop();
+			})();
+			return stopTask;
+		},
+		waitForIdle: async () => {
+			await admissionTail;
+			await monitorStart;
+			await monitor.waitForIdle();
+		}
+	};
+}
+//#endregion
 //#region extensions/nostr/src/nostr-profile-core.ts
 /**
 * Convert our config profile schema to NIP-01 content format.
@@ -275,6 +665,16 @@ function contentToProfile(content) {
 	return profile;
 }
 //#endregion
+//#region extensions/nostr/src/relay-publish.ts
+const CONNECTION_FAILURE_PREFIX = "connection failure: ";
+async function publishNostrEventToRelay(pool, relay, event) {
+	const publishPromise = pool.publish([relay], event)[0];
+	if (!publishPromise) throw new Error(`Failed to create publish promise for relay ${relay}`);
+	const result = await publishPromise;
+	if (result.startsWith(CONNECTION_FAILURE_PREFIX)) throw new Error(result.slice(20));
+	return result;
+}
+//#endregion
 //#region extensions/nostr/src/nostr-profile.ts
 /**
 * Nostr Profile Management (NIP-01 kind:0)
@@ -323,7 +723,7 @@ async function publishProfileEvent(pool, relays, event) {
 			const timeoutPromise = new Promise((_, reject) => {
 				timer = setTimeout(() => reject(/* @__PURE__ */ new Error("timeout")), RELAY_PUBLISH_TIMEOUT_MS);
 			});
-			await Promise.race([...pool.publish([relay], event), timeoutPromise]);
+			await Promise.race([publishNostrEventToRelay(pool, relay, event), timeoutPromise]);
 			successes.push(relay);
 		} catch (err) {
 			const errorMessage = formatErrorMessage(err);
@@ -357,11 +757,111 @@ async function publishProfile(pool, sk, relays, profile, lastPublishedAt) {
 	return publishProfileEvent(pool, relays, createProfileEvent(sk, profile, lastPublishedAt));
 }
 //#endregion
-//#region extensions/nostr/src/runtime.ts
-const { setRuntime: setNostrRuntime, getRuntime: getNostrRuntime } = createPluginRuntimeStore({
-	pluginId: "nostr",
-	errorMessage: "Nostr runtime not initialized"
-});
+//#region extensions/nostr/src/nostr-rate-limiter.ts
+function createFixedWindowRateLimiter(params) {
+	const windowMs = Math.max(1, Math.floor(params.windowMs));
+	const maxRequests = Math.max(1, Math.floor(params.maxRequests));
+	const maxTrackedKeys = Math.max(1, Math.floor(params.maxTrackedKeys));
+	const state = /* @__PURE__ */ new Map();
+	const touch = (key, value) => {
+		state.delete(key);
+		state.set(key, value);
+	};
+	const prune = (nowMs) => {
+		for (const [key, entry] of state) if (nowMs - entry.windowStartMs >= windowMs) state.delete(key);
+		while (state.size > maxTrackedKeys) {
+			const oldest = state.keys().next().value;
+			if (!oldest) break;
+			state.delete(oldest);
+		}
+	};
+	return {
+		isRateLimited: (key, nowMs = Date.now()) => {
+			if (!key) return false;
+			prune(nowMs);
+			const existing = state.get(key);
+			if (!existing || nowMs - existing.windowStartMs >= windowMs) {
+				touch(key, {
+					count: 1,
+					windowStartMs: nowMs
+				});
+				return false;
+			}
+			const nextCount = existing.count + 1;
+			touch(key, {
+				count: nextCount,
+				windowStartMs: existing.windowStartMs
+			});
+			return nextCount > maxRequests;
+		},
+		size: () => state.size,
+		clear: () => state.clear()
+	};
+}
+//#endregion
+//#region extensions/nostr/src/nostr-relay-subscription.ts
+const DEFAULT_EOSE_CONFIRM_DEADLINE_MS = 1e4;
+const LIBRARY_EOSE_TIMEOUT_MARGIN_MS = 1e3;
+/** Separates real relay EOSE frames from nostr-tools timeout/close synthesis. */
+function createNostrRelaySubscriptionGroup(options) {
+	const relays = [...new Set(options.relays)];
+	const subscriptions = [];
+	const deadlineTimers = /* @__PURE__ */ new Set();
+	let locallyClosing = false;
+	const backfillStatus = new Map(relays.map((relay) => [relay, "pending"]));
+	const confirmDeadlineMs = options.eoseConfirmDeadlineMs ?? DEFAULT_EOSE_CONFIRM_DEADLINE_MS;
+	const settleBackfill = (relay, status) => {
+		if (backfillStatus.get(relay) !== "pending") return;
+		backfillStatus.set(relay, status);
+		if ([...backfillStatus.values()].some((value) => value === "pending")) return;
+		if ([...backfillStatus.values()].every((value) => value === "confirmed")) options.onBackfillComplete(relays);
+	};
+	const clearDeadlines = () => {
+		for (const timer of deadlineTimers) clearTimeout(timer);
+		deadlineTimers.clear();
+	};
+	return {
+		start: () => {
+			for (const relay of relays) {
+				let relayClosed = false;
+				let deadlineReached = false;
+				const deadlineTimer = setTimeout(() => {
+					deadlineTimers.delete(deadlineTimer);
+					deadlineReached = true;
+					settleBackfill(relay, "incomplete");
+				}, confirmDeadlineMs);
+				deadlineTimer.unref?.();
+				deadlineTimers.add(deadlineTimer);
+				subscriptions.push(options.pool.subscribeMany([relay], options.filter, {
+					onevent: options.onEvent,
+					oneose: () => {
+						queueMicrotask(() => {
+							if (!relayClosed && !deadlineReached) {
+								clearTimeout(deadlineTimer);
+								deadlineTimers.delete(deadlineTimer);
+								settleBackfill(relay, "confirmed");
+							}
+						});
+					},
+					onclose: (reasons) => {
+						relayClosed = true;
+						clearTimeout(deadlineTimer);
+						deadlineTimers.delete(deadlineTimer);
+						settleBackfill(relay, "incomplete");
+						if (!locallyClosing && !options.abort.aborted) options.onClose(relay, reasons);
+					},
+					maxWait: confirmDeadlineMs + LIBRARY_EOSE_TIMEOUT_MARGIN_MS,
+					abort: options.abort
+				}));
+			}
+		},
+		close: async (reason) => {
+			locallyClosing = true;
+			clearDeadlines();
+			await Promise.all(subscriptions.map(async (subscription) => subscription.close(reason)));
+		}
+	};
+}
 //#endregion
 //#region extensions/nostr/src/nostr-state-store.ts
 const STORE_VERSION = 2;
@@ -416,210 +916,15 @@ async function writeNostrProfileState(params) {
 	await openNostrProfileStateStore(params.env).register(normalizeNostrStateAccountId(params.accountId), payload);
 }
 //#endregion
-//#region extensions/nostr/src/seen-tracker.ts
-/**
-* LRU-based seen event tracker with TTL support.
-* Prevents unbounded memory growth under high load or abuse.
-*/
-/**
-* Create a new seen tracker with LRU eviction and TTL expiration.
-*/
-function createSeenTracker(options) {
-	const maxEntries = resolveIntegerOption(options?.maxEntries, 1e5, { min: 1 });
-	const ttlMs = resolvePositiveTimerTimeoutMs(options?.ttlMs, 3600 * 1e3);
-	const pruneIntervalMs = resolvePositiveTimerTimeoutMs(options?.pruneIntervalMs, 600 * 1e3);
-	const entries = /* @__PURE__ */ new Map();
-	let head = null;
-	let tail = null;
-	function moveToFront(id) {
-		const entry = entries.get(id);
-		if (!entry) return;
-		if (head === id) return;
-		if (entry.prev) {
-			const prevEntry = entries.get(entry.prev);
-			if (prevEntry) prevEntry.next = entry.next;
-		}
-		if (entry.next) {
-			const nextEntry = entries.get(entry.next);
-			if (nextEntry) nextEntry.prev = entry.prev;
-		}
-		if (tail === id) tail = entry.prev;
-		entry.prev = null;
-		entry.next = head;
-		if (head) {
-			const headEntry = entries.get(head);
-			if (headEntry) headEntry.prev = id;
-		}
-		head = id;
-		if (!tail) tail = id;
-	}
-	function removeFromList(id) {
-		const entry = entries.get(id);
-		if (!entry) return;
-		if (entry.prev) {
-			const prevEntry = entries.get(entry.prev);
-			if (prevEntry) prevEntry.next = entry.next;
-		} else head = entry.next;
-		if (entry.next) {
-			const nextEntry = entries.get(entry.next);
-			if (nextEntry) nextEntry.prev = entry.prev;
-		} else tail = entry.prev;
-	}
-	function evictLRU() {
-		if (!tail) return;
-		const idToEvict = tail;
-		removeFromList(idToEvict);
-		entries.delete(idToEvict);
-	}
-	function insertAtFront(id, seenAt) {
-		const newEntry = {
-			seenAt,
-			prev: null,
-			next: head
-		};
-		if (head) {
-			const headEntry = entries.get(head);
-			if (headEntry) headEntry.prev = id;
-		}
-		entries.set(id, newEntry);
-		head = id;
-		if (!tail) tail = id;
-	}
-	function pruneExpired() {
-		const now = Date.now();
-		const toDelete = [];
-		for (const [id, entry] of entries) if (now - entry.seenAt > ttlMs) toDelete.push(id);
-		for (const id of toDelete) {
-			removeFromList(id);
-			entries.delete(id);
-		}
-	}
-	let pruneTimer;
-	if (pruneIntervalMs > 0) {
-		pruneTimer = setInterval(pruneExpired, pruneIntervalMs);
-		if (pruneTimer.unref) pruneTimer.unref();
-	}
-	function add(id) {
-		const now = Date.now();
-		const existing = entries.get(id);
-		if (existing) {
-			existing.seenAt = now;
-			moveToFront(id);
-			return;
-		}
-		while (entries.size >= maxEntries) evictLRU();
-		insertAtFront(id, now);
-	}
-	function has(id) {
-		const entry = entries.get(id);
-		if (!entry) {
-			add(id);
-			return false;
-		}
-		if (Date.now() - entry.seenAt > ttlMs) {
-			removeFromList(id);
-			entries.delete(id);
-			add(id);
-			return false;
-		}
-		entry.seenAt = Date.now();
-		moveToFront(id);
-		return true;
-	}
-	function peek(id) {
-		const entry = entries.get(id);
-		if (!entry) return false;
-		if (Date.now() - entry.seenAt > ttlMs) {
-			removeFromList(id);
-			entries.delete(id);
-			return false;
-		}
-		return true;
-	}
-	function deleteEntry(id) {
-		if (entries.has(id)) {
-			removeFromList(id);
-			entries.delete(id);
-		}
-	}
-	function clear() {
-		entries.clear();
-		head = null;
-		tail = null;
-	}
-	function size() {
-		return entries.size;
-	}
-	function stop() {
-		if (pruneTimer) {
-			clearInterval(pruneTimer);
-			pruneTimer = void 0;
-		}
-	}
-	function seed(ids) {
-		const now = Date.now();
-		for (const id of ids.toReversed()) if (!entries.has(id) && entries.size < maxEntries) insertAtFront(id, now);
-	}
-	return {
-		has,
-		add,
-		peek,
-		delete: deleteEntry,
-		clear,
-		size,
-		stop,
-		seed
-	};
-}
-//#endregion
 //#region extensions/nostr/src/nostr-bus.ts
 const STARTUP_LOOKBACK_SEC = 120;
-const MAX_PERSISTED_EVENT_IDS = 5e3;
 const STATE_PERSIST_DEBOUNCE_MS = 5e3;
+const NOSTR_INGRESS_ENVELOPE_OVERHEAD_BYTES = 16 * 1024;
+const NOSTR_INGRESS_MAX_PENDING_EVENTS = 1e3;
 const DEFAULT_INBOUND_GUARD_POLICY = createDirectDmPreCryptoGuardPolicy();
 const CIRCUIT_BREAKER_THRESHOLD = 5;
 const CIRCUIT_BREAKER_RESET_MS = 3e4;
 const HEALTH_WINDOW_MS = 6e4;
-function createFixedWindowRateLimiter(params) {
-	const windowMs = Math.max(1, Math.floor(params.windowMs));
-	const maxRequests = Math.max(1, Math.floor(params.maxRequests));
-	const maxTrackedKeys = Math.max(1, Math.floor(params.maxTrackedKeys));
-	const state = /* @__PURE__ */ new Map();
-	const touch = (key, value) => {
-		state.delete(key);
-		state.set(key, value);
-	};
-	const prune = (nowMs) => {
-		for (const [key, entry] of state) if (nowMs - entry.windowStartMs >= windowMs) state.delete(key);
-		while (state.size > maxTrackedKeys) {
-			const oldest = state.keys().next().value;
-			if (!oldest) break;
-			state.delete(oldest);
-		}
-	};
-	return {
-		isRateLimited: (key, nowMs = Date.now()) => {
-			if (!key) return false;
-			prune(nowMs);
-			const existing = state.get(key);
-			if (!existing || nowMs - existing.windowStartMs >= windowMs) {
-				touch(key, {
-					count: 1,
-					windowStartMs: nowMs
-				});
-				return false;
-			}
-			const nextCount = existing.count + 1;
-			touch(key, {
-				count: nextCount,
-				windowStartMs: existing.windowStartMs
-			});
-			return nextCount > maxRequests;
-		},
-		size: () => state.size,
-		clear: () => state.clear()
-	};
-}
 function createCircuitBreaker(relay, metrics, threshold = CIRCUIT_BREAKER_THRESHOLD, resetMs = CIRCUIT_BREAKER_RESET_MS) {
 	const state = {
 		state: "closed",
@@ -715,10 +1020,11 @@ function createRelayHealthTracker() {
 * Start the Nostr DM bus - subscribes to NIP-04 encrypted DMs
 */
 async function startNostrBus(options) {
-	const { privateKey, relays = DEFAULT_RELAYS, onMessage, authorizeSender, onError, onEose, onMetric, maxSeenEntries = 1e5, seenTtlMs = 3600 * 1e3 } = options;
+	const { privateKey, relays = DEFAULT_RELAYS, onMessage, authorizeSender, onError, onEose, onMetric } = options;
 	const sk = validatePrivateKey(privateKey);
 	const pk = getPublicKey(sk);
 	const pool = new SimplePool();
+	pool.onRelayConnectionSuccess = options.onConnect;
 	const accountId = options.accountId ?? pk.slice(0, 16);
 	const gatewayStartedAt = Math.floor(Date.now() / 1e3);
 	const guardPolicy = createDirectDmPreCryptoGuardPolicy({
@@ -730,41 +1036,32 @@ async function startNostrBus(options) {
 		}
 	});
 	const metrics = onMetric ? createMetrics(onMetric) : createNoopMetrics();
-	const seen = createSeenTracker({
-		maxEntries: maxSeenEntries,
-		ttlMs: seenTtlMs
-	});
 	const circuitBreakers = /* @__PURE__ */ new Map();
 	const healthTracker = createRelayHealthTracker();
 	for (const relay of relays) circuitBreakers.set(relay, createCircuitBreaker(relay, metrics));
 	const state = await readNostrBusState({ accountId });
 	const baseSince = computeSinceTimestamp(state, gatewayStartedAt);
 	const since = Math.max(0, baseSince - STARTUP_LOOKBACK_SEC);
-	if (state?.recentEventIds?.length) seen.seed(state.recentEventIds);
-	await writeNostrBusState({
-		accountId,
-		lastProcessedAt: state?.lastProcessedAt ?? gatewayStartedAt,
-		gatewayStartedAt,
-		recentEventIds: state?.recentEventIds ?? []
-	});
-	let pendingWrite;
-	let lastProcessedAt = state?.lastProcessedAt ?? gatewayStartedAt;
-	let recentEventIds = (state?.recentEventIds ?? []).slice(-5e3);
-	function scheduleStatePersist(eventCreatedAt, eventId) {
-		lastProcessedAt = Math.max(lastProcessedAt, eventCreatedAt);
-		recentEventIds.push(eventId);
-		if (recentEventIds.length > MAX_PERSISTED_EVENT_IDS) recentEventIds = recentEventIds.slice(-5e3);
-		if (pendingWrite) clearTimeout(pendingWrite);
-		pendingWrite = setTimeout(() => {
-			writeNostrBusState({
+	const cursorStartedAt = state?.gatewayStartedAt ?? gatewayStartedAt;
+	const initialCursor = Math.max(baseSince, state?.lastProcessedAt ?? cursorStartedAt);
+	const cursorWriter = createNostrCursorStateWriter({
+		initialCursor,
+		minimumCursor: baseSince,
+		debounceMs: STATE_PERSIST_DEBOUNCE_MS,
+		write: async (cursor) => {
+			await writeNostrBusState({
 				accountId,
-				lastProcessedAt,
-				gatewayStartedAt,
-				recentEventIds
-			}).catch((err) => onError?.(err, "persist state"));
-		}, STATE_PERSIST_DEBOUNCE_MS);
-	}
-	const inflight = /* @__PURE__ */ new Set();
+				lastProcessedAt: cursor,
+				gatewayStartedAt: cursorStartedAt,
+				recentEventIds: []
+			});
+		},
+		onBackgroundError: (error) => onError?.(error, "persist state")
+	});
+	const durableCursor = createNostrDurableCursor({
+		since,
+		replayOverlapSec: STARTUP_LOOKBACK_SEC
+	});
 	const perSenderRateLimiter = createFixedWindowRateLimiter({
 		windowMs: guardPolicy.rateLimit.windowMs,
 		maxRequests: guardPolicy.rateLimit.maxPerSenderPerWindow,
@@ -778,147 +1075,217 @@ async function startNostrBus(options) {
 	const updateRateLimiterSizeMetric = () => {
 		metrics.emit("memory.rate_limiter_entries", perSenderRateLimiter.size() + globalRateLimiter.size());
 	};
-	async function handleEvent(event) {
+	const rejectIfGlobalRateLimited = () => {
+		updateRateLimiterSizeMetric();
+		if (globalRateLimiter.isRateLimited("global")) {
+			metrics.emit("rate_limit.global");
+			metrics.emit("event.rejected.rate_limited");
+			updateRateLimiterSizeMetric();
+			return true;
+		}
+		updateRateLimiterSizeMetric();
+		return false;
+	};
+	const rejectIfVerifiedSenderRateLimited = (senderPubkey) => {
+		updateRateLimiterSizeMetric();
+		if (perSenderRateLimiter.isRateLimited(senderPubkey)) {
+			metrics.emit("rate_limit.per_sender");
+			metrics.emit("event.rejected.rate_limited");
+			updateRateLimiterSizeMetric();
+			return true;
+		}
+		updateRateLimiterSizeMetric();
+		return false;
+	};
+	async function dispatchEvent(event, lifecycle) {
+		if (event.pubkey === pk) {
+			metrics.emit("event.rejected.self_message");
+			return;
+		}
+		if (event.created_at > Math.floor(Date.now() / 1e3) + guardPolicy.maxFutureSkewSec) {
+			metrics.emit("event.rejected.future");
+			throw new Error(`Nostr event ${event.id} is too far in the future.`);
+		}
+		if (!guardPolicy.allowedKinds.includes(event.kind)) {
+			metrics.emit("event.rejected.wrong_kind");
+			return;
+		}
+		let targetsUs = false;
+		for (const tag of event.tags) if (tag[0] === "p" && tag[1] === pk) {
+			targetsUs = true;
+			break;
+		}
+		if (!targetsUs) {
+			metrics.emit("event.rejected.wrong_kind");
+			return;
+		}
+		const replyTo = async (text) => {
+			await sendEncryptedDm(pool, sk, event.pubkey, text, relays, metrics, circuitBreakers, healthTracker, onError, event.id);
+		};
+		if (Buffer.byteLength(event.content, "utf8") > guardPolicy.maxCiphertextBytes) {
+			if (rejectIfGlobalRateLimited()) throw new Error(`Nostr event ${event.id} hit the global rate limit.`);
+			metrics.emit("event.rejected.oversized_ciphertext");
+			return;
+		}
+		if (rejectIfGlobalRateLimited()) throw new Error(`Nostr event ${event.id} hit the global rate limit.`);
+		if (!verifyEvent(event)) {
+			metrics.emit("event.rejected.invalid_signature");
+			const error = new NostrIngressPermanentError("invalid-signature", `Nostr event ${event.id} has an invalid signature.`);
+			onError?.(error, `event ${event.id}`);
+			throw error;
+		}
+		if (rejectIfVerifiedSenderRateLimited(event.pubkey)) throw new Error(`Nostr sender ${event.pubkey} hit the rate limit.`);
+		if (authorizeSender) {
+			if (await authorizeSender({
+				senderPubkey: event.pubkey,
+				reply: replyTo
+			}) !== "allow") return;
+		}
+		let plaintext;
 		try {
-			metrics.emit("event.received");
-			if (seen.peek(event.id) || inflight.has(event.id)) {
-				metrics.emit("event.duplicate");
-				return;
-			}
-			inflight.add(event.id);
-			const markSeen = () => {
-				seen.add(event.id);
-				metrics.emit("memory.seen_tracker_size", seen.size());
-			};
-			const rejectAndMarkSeen = (metric) => {
-				markSeen();
-				metrics.emit(metric);
-			};
-			if (event.pubkey === pk) {
-				rejectAndMarkSeen("event.rejected.self_message");
-				return;
-			}
-			if (event.created_at < since) {
-				rejectAndMarkSeen("event.rejected.stale");
-				return;
-			}
-			if (event.created_at > Math.floor(Date.now() / 1e3) + guardPolicy.maxFutureSkewSec) {
-				metrics.emit("event.rejected.future");
-				return;
-			}
-			if (!guardPolicy.allowedKinds.includes(event.kind)) {
-				rejectAndMarkSeen("event.rejected.wrong_kind");
-				return;
-			}
-			let targetsUs = false;
-			for (const t of event.tags) if (t[0] === "p" && t[1] === pk) {
-				targetsUs = true;
-				break;
-			}
-			if (!targetsUs) {
-				rejectAndMarkSeen("event.rejected.wrong_kind");
-				return;
+			plaintext = decrypt(sk, event.pubkey, event.content);
+			metrics.emit("decrypt.success");
+		} catch (error) {
+			metrics.emit("decrypt.failure");
+			metrics.emit("event.rejected.decrypt_failed");
+			onError?.(error, `decrypt from ${event.pubkey}`);
+			throw new NostrIngressPermanentError("decrypt-failed", `Nostr event ${event.id} could not be decrypted.`, { cause: error });
+		}
+		if (Buffer.byteLength(plaintext, "utf8") > guardPolicy.maxPlaintextBytes) {
+			metrics.emit("event.rejected.oversized_plaintext");
+			return;
+		}
+		if (lifecycle.abortSignal.aborted) throw new Error(`Nostr event ${event.id} stopped before dispatch.`);
+		await onMessage(event.pubkey, plaintext, replyTo, {
+			eventId: event.id,
+			createdAt: event.created_at
+		}, lifecycle);
+		metrics.emit("event.processed");
+	}
+	const dmFilter = {
+		kinds: [4],
+		"#p": [pk],
+		since
+	};
+	const relayAbort = new AbortController();
+	let relaySubscriptions;
+	let relayStopPromise;
+	const stopRelays = (reason) => {
+		relayStopPromise ??= (async () => {
+			relayAbort.abort(reason);
+			try {
+				await relaySubscriptions?.close(reason);
+			} catch (error) {
+				onError?.(error, "close subscription");
+			} finally {
+				try {
+					pool.close(relays);
+				} catch (error) {
+					onError?.(error, "close relay pool");
+				}
 			}
-			const replyTo = async (text) => {
-				await sendEncryptedDm(pool, sk, event.pubkey, text, relays, metrics, circuitBreakers, healthTracker, onError);
-			};
-			const rejectIfGlobalRateLimited = () => {
-				updateRateLimiterSizeMetric();
-				if (globalRateLimiter.isRateLimited("global")) {
+		})();
+		return relayStopPromise;
+	};
+	const ingress = createNostrIngress({
+		accountId,
+		legacyEventIds: state?.recentEventIds ?? [],
+		maxSerializedPayloadBytes: guardPolicy.maxCiphertextBytes + NOSTR_INGRESS_ENVELOPE_OVERHEAD_BYTES,
+		maxPendingEvents: NOSTR_INGRESS_MAX_PENDING_EVENTS,
+		maxQueuedAdmissions: guardPolicy.rateLimit.maxGlobalPerWindow,
+		admissionRateLimit: {
+			windowMs: guardPolicy.rateLimit.windowMs,
+			maxEvents: guardPolicy.rateLimit.maxGlobalPerWindow
+		},
+		afterDurableAppend: (event) => {
+			const cursor = durableCursor.recordDurableAppend(event);
+			if (cursor !== void 0) cursorWriter.schedule(cursor);
+		},
+		deliver: dispatchEvent,
+		onError
+	});
+	const persistTransientReplayCursor = async (event) => {
+		const cursor = durableCursor.recordTransientRejection(event);
+		if (cursor !== void 0) await cursorWriter.persistNow(cursor);
+	};
+	const recoverCursorPersistence = async () => {
+		await cursorWriter.flushUntilSuccess();
+	};
+	const handleRelayEvent = async (event) => {
+		metrics.emit("event.received");
+		if (typeof event.created_at === "number" && event.created_at < since) {
+			metrics.emit("event.rejected.stale");
+			return;
+		}
+		try {
+			if (await ingress.receive(event) === "duplicate") metrics.emit("event.duplicate");
+		} catch (error) {
+			onError?.(error, `durable admission for event ${event.id}`);
+			if (error instanceof NostrIngressAdmissionRejectedError) {
+				if (error.reason === "rate-limited") {
 					metrics.emit("rate_limit.global");
 					metrics.emit("event.rejected.rate_limited");
-					updateRateLimiterSizeMetric();
-					return true;
 				}
-				updateRateLimiterSizeMetric();
-				return false;
-			};
-			const rejectIfVerifiedSenderRateLimited = () => {
-				updateRateLimiterSizeMetric();
-				if (perSenderRateLimiter.isRateLimited(event.pubkey)) {
-					metrics.emit("rate_limit.per_sender");
-					metrics.emit("event.rejected.rate_limited");
-					updateRateLimiterSizeMetric();
-					return true;
+				if (error.reason !== "oversized-event") try {
+					await persistTransientReplayCursor(event);
+				} catch (cursorError) {
+					onError?.(cursorError, "persist transient replay cursor");
+					await stopRelays("cursor persistence failed");
+					await recoverCursorPersistence();
 				}
-				updateRateLimiterSizeMetric();
-				return false;
-			};
-			if (Buffer.byteLength(event.content, "utf8") > guardPolicy.maxCiphertextBytes) {
-				if (rejectIfGlobalRateLimited()) return;
-				rejectAndMarkSeen("event.rejected.oversized_ciphertext");
 				return;
 			}
-			if (rejectIfGlobalRateLimited()) return;
-			if (!verifyEvent(event)) {
-				rejectAndMarkSeen("event.rejected.invalid_signature");
-				onError?.(/* @__PURE__ */ new Error("Invalid signature"), `event ${event.id}`);
-				return;
-			}
-			if (rejectIfVerifiedSenderRateLimited()) return;
-			if (authorizeSender) {
-				if (await authorizeSender({
-					senderPubkey: event.pubkey,
-					reply: replyTo
-				}) !== "allow") {
-					markSeen();
-					return;
-				}
-			}
-			let plaintext;
+			if (error instanceof NostrIngressPermanentError) return;
+			let cursorPersistenceFailed = false;
 			try {
-				plaintext = decrypt(sk, event.pubkey, event.content);
-				metrics.emit("decrypt.success");
-			} catch (err) {
-				markSeen();
-				metrics.emit("decrypt.failure");
-				metrics.emit("event.rejected.decrypt_failed");
-				onError?.(err, `decrypt from ${event.pubkey}`);
-				return;
-			}
-			if (Buffer.byteLength(plaintext, "utf8") > guardPolicy.maxPlaintextBytes) {
-				markSeen();
-				metrics.emit("event.rejected.oversized_plaintext");
-				return;
+				await persistTransientReplayCursor(event);
+			} catch (cursorError) {
+				onError?.(cursorError, "persist transient replay cursor");
+				cursorPersistenceFailed = true;
 			}
-			await onMessage(event.pubkey, plaintext, replyTo, {
-				eventId: event.id,
-				createdAt: event.created_at
-			});
-			markSeen();
-			metrics.emit("event.processed");
-			scheduleStatePersist(event.created_at, event.id);
-		} catch (err) {
-			onError?.(err, `event ${event.id}`);
-		} finally {
-			inflight.delete(event.id);
+			await stopRelays("durable admission failed");
+			if (cursorPersistenceFailed) await recoverCursorPersistence();
 		}
-	}
-	const dmFilter = {
-		kinds: [4],
-		"#p": [pk],
-		since
 	};
-	const relayAbort = new AbortController();
-	const sub = pool.subscribeMany(relays, dmFilter, {
-		onevent: (event) => {
-			handleEvent(event);
-		},
-		oneose: () => {
-			for (const relay of relays) metrics.emit("relay.message.eose", 1, { relay });
-			onEose?.(relays.join(", "));
-		},
-		onclose: (reason) => {
-			for (const relay of relays) {
+	let backfillFinalizePromise;
+	try {
+		await ingress.ready();
+		await writeNostrBusState({
+			accountId,
+			lastProcessedAt: initialCursor,
+			gatewayStartedAt: cursorStartedAt,
+			recentEventIds: []
+		});
+		relaySubscriptions = createNostrRelaySubscriptionGroup({
+			pool,
+			relays,
+			filter: dmFilter,
+			abort: relayAbort.signal,
+			onEvent: (event) => {
+				const task = handleRelayEvent(event);
+				if (options.trackIngressTask) options.trackIngressTask(task.then(() => ingress.waitForIdle()));
+			},
+			onBackfillComplete: (confirmedRelays) => {
+				backfillFinalizePromise ??= ingress.waitForIdle().then(() => {
+					const cursor = durableCursor.markBackfillComplete();
+					if (cursor !== void 0) cursorWriter.schedule(cursor);
+					for (const relay of confirmedRelays) metrics.emit("relay.message.eose", 1, { relay });
+					onEose?.(confirmedRelays.join(", "));
+				}).catch((error) => onError?.(error, "finalize relay backfill"));
+			},
+			onClose: (relay, reasons) => {
 				metrics.emit("relay.message.closed", 1, { relay });
 				options.onDisconnect?.(relay);
+				onError?.(/* @__PURE__ */ new Error(`Subscription closed: ${reasons.join(", ")}`), "subscription");
 			}
-			onError?.(/* @__PURE__ */ new Error(`Subscription closed: ${reason.join(", ")}`), "subscription");
-		},
-		abort: relayAbort.signal
-	});
+		});
+		relaySubscriptions.start();
+	} catch (error) {
+		await Promise.allSettled([stopRelays("startup failed"), ingress.stop()]);
+		throw error;
+	}
 	const sendDm = async (toPubkey, text) => {
-		await sendEncryptedDm(pool, sk, toPubkey, text, relays, metrics, circuitBreakers, healthTracker, onError);
+		return await sendEncryptedDm(pool, sk, toPubkey, text, relays, metrics, circuitBreakers, healthTracker, onError);
 	};
 	const publishProfile$1 = async (profile) => {
 		const lastPublishedAt = (await readNostrProfileState({ accountId }))?.lastPublishedAt ?? void 0;
@@ -942,25 +1309,20 @@ async function startNostrBus(options) {
 			lastPublishResults: stateLocal?.lastPublishResults ?? null
 		};
 	};
-	return {
-		close: () => {
-			relayAbort.abort("closed by caller");
-			Promise.resolve(sub.close("closed by caller")).catch((err) => onError?.(err, "close subscription")).finally(() => {
-				pool.close(relays);
-			});
-			seen.stop();
+	let closePromise;
+	const close = () => {
+		closePromise ??= (async () => {
+			await stopRelays("closed by caller");
+			await ingress.stop();
+			await backfillFinalizePromise;
+			await cursorWriter.flushUntilSuccess();
 			perSenderRateLimiter.clear();
 			globalRateLimiter.clear();
-			if (pendingWrite) {
-				clearTimeout(pendingWrite);
-				writeNostrBusState({
-					accountId,
-					lastProcessedAt,
-					gatewayStartedAt,
-					recentEventIds
-				}).catch((err) => onError?.(err, "persist state on close"));
-			}
-		},
+		})();
+		return closePromise;
+	};
+	return {
+		close,
 		publicKey: pk,
 		sendDm,
 		getMetrics: () => metrics.getSnapshot(),
@@ -971,11 +1333,14 @@ async function startNostrBus(options) {
 /**
 * Send an encrypted DM to a pubkey
 */
-async function sendEncryptedDm(pool, sk, toPubkey, text, relays, metrics, circuitBreakers, healthTracker, onError) {
+async function sendEncryptedDm(pool, sk, toPubkey, text, relays, metrics, circuitBreakers, healthTracker, onError, replyToEventId) {
+	const ciphertext = encrypt(sk, toPubkey, text);
+	const tags = [["p", toPubkey]];
+	if (replyToEventId) tags.push(["e", replyToEventId]);
 	const reply = finalizeEvent({
 		kind: 4,
-		content: encrypt(sk, toPubkey, text),
-		tags: [["p", toPubkey]],
+		content: ciphertext,
+		tags,
 		created_at: Math.floor(Date.now() / 1e3)
 	}, sk);
 	const sortedRelays = healthTracker.getSortedRelays(relays);
@@ -985,15 +1350,13 @@ async function sendEncryptedDm(pool, sk, toPubkey, text, relays, metrics, circui
 		if (cb && !cb.canAttempt()) continue;
 		const startTime = Date.now();
 		try {
-			const publishPromises = pool.publish([relay], reply);
-			if (publishPromises.length === 0) throw new Error(`Failed to create publish promise for relay ${relay}`);
-			await publishPromises[0];
+			await publishNostrEventToRelay(pool, relay, reply);
 			const latency = Date.now() - startTime;
 			cb?.recordSuccess();
 			healthTracker.recordSuccess(relay, latency);
-			return;
+			return reply.id;
 		} catch (err) {
-			lastError = err;
+			lastError = err instanceof Error ? err : new Error(String(err));
 			const latency = Date.now() - startTime;
 			cb?.recordFailure();
 			healthTracker.recordFailure(relay);
@@ -1092,7 +1455,7 @@ const startNostrGatewayAccount = async (ctx) => {
 		ctx.log?.debug?.(`[${account.accountId}] blocked Nostr sender ${input.senderId} (${resolved.senderAccess.reasonCode})`);
 		return "block";
 	};
-	await runStoppablePassiveMonitor({
+	await runPassiveAccountLifecycle({
 		abortSignal: ctx.abortSignal,
 		start: async () => {
 			const bus = await startNostrBus({
@@ -1103,16 +1466,15 @@ const startNostrGatewayAccount = async (ctx) => {
 					senderId: senderPubkey,
 					reply
 				}),
-				onMessage: async (senderPubkey, text, reply, meta) => {
+				onMessage: async (senderPubkey, text, reply, meta, lifecycle) => {
 					const resolvedAccess = await resolveInboundAccess(senderPubkey, text);
 					if (resolvedAccess.senderAccess.decision !== "allow") {
 						ctx.log?.warn?.(`[${account.accountId}] dropping Nostr DM after preflight drift (${senderPubkey}, ${resolvedAccess.senderAccess.reasonCode})`);
 						return;
 					}
-					const { dispatchInboundDirectDmWithRuntime } = await import("./inbound-direct-dm-runtime-EdLLVtkh.js");
-					await dispatchInboundDirectDmWithRuntime({
+					const { dispatchInboundDirectDm } = await import("./inbound-direct-dm-runtime-DHn9NoYN.js");
+					await dispatchInboundDirectDm({
 						cfg: ctx.cfg,
-						runtime,
 						channel: "nostr",
 						channelLabel: "Nostr",
 						accountId: account.accountId,
@@ -1128,6 +1490,7 @@ const startNostrGatewayAccount = async (ctx) => {
 						messageId: meta.eventId,
 						timestamp: meta.createdAt * 1e3,
 						commandAuthorized: resolvedAccess.commandAccess.requested ? resolvedAccess.commandAccess.authorized : void 0,
+						turnAdoptionLifecycle: bindIngressLifecycleToReplyOptions(lifecycle).turnAdoptionLifecycle,
 						deliver: async (payload) => {
 							const outboundText = payload && typeof payload === "object" && "text" in payload ? payload.text ?? "" : "";
 							if (!outboundText.trim()) return;
@@ -1136,7 +1499,8 @@ const startNostrGatewayAccount = async (ctx) => {
 								channel: "nostr",
 								accountId: account.accountId
 							});
-							await reply(runtime.channel.text.convertMarkdownTables(outboundText, tableMode));
+							const message = stripMarkdown(runtime.channel.text.convertMarkdownTables(outboundText, tableMode));
+							if (message) await reply(message);
 						},
 						onRecordError: (err) => {
 							ctx.log?.error?.(`[${account.accountId}] failed recording Nostr inbound session: ${String(err)}`);
@@ -1166,19 +1530,19 @@ const startNostrGatewayAccount = async (ctx) => {
 					if (busHandle) metricsSnapshots.set(account.accountId, busHandle.getMetrics());
 				}
 			});
-			let stopped = false;
 			busHandle = bus;
 			activeBuses.set(account.accountId, bus);
-			ctx.log?.info?.(`[${account.accountId}] Nostr provider started, connected to ${account.relays.length} relay(s)`);
-			return { stop: () => {
-				if (stopped) return;
-				stopped = true;
-				bus.close();
+			ctx.log?.info?.(`[${account.accountId}] Nostr provider started with ${account.relays.length} configured relay(s)`);
+			return { stop: async () => {
+				await bus.close();
 				if (busHandle === bus) busHandle = null;
 				if (activeBuses.get(account.accountId) === bus) activeBuses.delete(account.accountId);
 				metricsSnapshots.delete(account.accountId);
 				ctx.log?.info?.(`[${account.accountId}] Nostr provider stopped`);
 			} };
+		},
+		stop: async (monitor) => {
+			await monitor.stop();
 		}
 	});
 };
@@ -1214,12 +1578,12 @@ const nostrOutboundAdapter = {
 			channel: "nostr",
 			accountId: aid
 		});
-		const message = core.channel.text.convertMarkdownTables(text ?? "", tableMode);
+		const message = stripMarkdown(core.channel.text.convertMarkdownTables(text ?? "", tableMode));
+		if (!message) throw new Error("Nostr send requires non-empty text after markdown stripping.");
 		const normalizedTo = normalizePubkey(to);
-		await bus.sendDm(normalizedTo, message);
 		return attachChannelToResult("nostr", {
 			to: normalizedTo,
-			messageId: `nostr-${Date.now()}`
+			messageId: await bus.sendDm(normalizedTo, message)
 		});
 	}
 };
@@ -1253,6 +1617,18 @@ function resolveNostrOutboundSessionRoute(params) {
 }
 //#endregion
 //#region extensions/nostr/src/channel.ts
+const NOSTR_TARGET_HINT = "<npub|hex pubkey|nostr:npub...>";
+function stripNostrTargetPrefix(target) {
+	return target.trim().replace(/^nostr:/i, "");
+}
+function normalizeNostrTarget(target) {
+	const cleaned = stripNostrTargetPrefix(target);
+	try {
+		return normalizePubkey(cleaned);
+	} catch {
+		return target.trim();
+	}
+}
 const resolveNostrDmPolicy = createScopedDmSecurityResolver({
 	channelKey: "nostr",
 	resolvePolicy: (account) => account.config.dmPolicy,
@@ -1260,13 +1636,7 @@ const resolveNostrDmPolicy = createScopedDmSecurityResolver({
 	policyPathSuffix: "dmPolicy",
 	defaultPolicy: "pairing",
 	approveHint: formatPairingApproveHint("nostr"),
-	normalizeEntry: (raw) => {
-		try {
-			return normalizePubkey(raw.trim().replace(/^nostr:/i, ""));
-		} catch {
-			return raw.trim();
-		}
-	}
+	normalizeEntry: normalizeNostrTarget
 });
 const nostrConfigAdapter = createTopLevelChannelConfigAdapter({
 	sectionKey: "nostr",
@@ -1286,17 +1656,35 @@ const nostrConfigAdapter = createTopLevelChannelConfigAdapter({
 	resolveAllowFrom: (account) => account.config.allowFrom,
 	formatAllowFrom: (allowFrom) => normalizeStringEntries(allowFrom).map((entry) => {
 		if (entry === "*") return "*";
-		try {
-			return normalizePubkey(entry);
-		} catch {
-			return entry;
-		}
+		return normalizeNostrTarget(entry);
 	}).filter(Boolean)
 });
 const nostrMessageAdapter = createChannelMessageAdapterFromOutbound({
 	id: "nostr",
 	outbound: nostrOutboundAdapter
 });
+const nostrPluginOutboundAdapter = {
+	...nostrOutboundAdapter,
+	resolveTarget: ({ to }) => {
+		const trimmed = to?.trim() ?? "";
+		if (!trimmed) return {
+			ok: false,
+			error: missingTargetError("Nostr", NOSTR_TARGET_HINT)
+		};
+		const normalized = normalizeNostrTarget(trimmed);
+		try {
+			return {
+				ok: true,
+				to: normalizePubkey(normalized)
+			};
+		} catch {
+			return {
+				ok: false,
+				error: /* @__PURE__ */ new Error("Nostr target must be a 64-character hex pubkey or npub value")
+			};
+		}
+	}
+};
 const nostrPlugin = createChatChannelPlugin({
 	base: {
 		id: "nostr",
@@ -1316,6 +1704,7 @@ const nostrPlugin = createChatChannelPlugin({
 		reload: { configPrefixes: ["channels.nostr"] },
 		configSchema: buildChannelConfigSchema(NostrConfigSchema),
 		setup: nostrSetupAdapter,
+		setupContract: nostrSetupContract,
 		setupWizard: nostrSetupWizard,
 		config: {
 			...nostrConfigAdapter,
@@ -1328,20 +1717,13 @@ const nostrPlugin = createChatChannelPlugin({
 		},
 		messaging: {
 			targetPrefixes: ["nostr"],
-			normalizeTarget: (target) => {
-				const cleaned = target.trim().replace(/^nostr:/i, "");
-				try {
-					return normalizePubkey(cleaned);
-				} catch {
-					return cleaned;
-				}
-			},
+			normalizeTarget: normalizeNostrTarget,
 			targetResolver: {
-				looksLikeId: (input) => {
-					const trimmed = input.trim();
-					return trimmed.startsWith("npub1") || /^[0-9a-fA-F]{64}$/.test(trimmed);
+				looksLikeId: (input, normalized) => {
+					const trimmed = normalized?.trim() || stripNostrTargetPrefix(input);
+					return trimmed.startsWith("npub1") || trimmed.startsWith("NPUB1") || /^[0-9a-fA-F]{64}$/.test(trimmed);
 				},
-				hint: "<npub|hex pubkey|nostr:npub...>"
+				hint: NOSTR_TARGET_HINT
 			},
 			resolveOutboundSessionRoute: (params) => resolveNostrOutboundSessionRoute(params)
 		},
@@ -1366,7 +1748,7 @@ const nostrPlugin = createChatChannelPlugin({
 	},
 	pairing: { text: nostrPairingTextAdapter },
 	security: { resolveDmPolicy: resolveNostrDmPolicy },
-	outbound: nostrOutboundAdapter
+	outbound: nostrPluginOutboundAdapter
 });
 /**
 * Publish a profile (kind:0) for a Nostr account.
@@ -1392,4 +1774,4 @@ async function getNostrProfileState(accountId = DEFAULT_ACCOUNT_ID) {
 	return bus.getProfileState();
 }
 //#endregion
-export { setNostrRuntime as a, getNostrRuntime as i, nostrPlugin as n, contentToProfile as o, publishNostrProfile as r, getNostrProfileState as t };
+export { getNostrRuntime as a, contentToProfile as i, nostrPlugin as n, setNostrRuntime as o, publishNostrProfile as r, getNostrProfileState as t };