@openclaw/nostr 2026.7.2-beta.3 → 2026.7.2-beta.4

package/dist/api.js

@@ -1,14 +1,14 @@
-import { o as resolveNostrAccount } from "./setup-surface-BF7_7BEx.js";
+import { s as resolveNostrAccount } from "./setup-surface-ChtM-WSY.js";
 import { getPluginRuntimeGatewayRequestScope } from "./runtime-api.js";
 import { n as NostrProfileSchema } from "./config-schema-CelPzg1N.js";
-import { a as setNostrRuntime, i as getNostrRuntime, n as nostrPlugin, o as contentToProfile, r as publishNostrProfile, t as getNostrProfileState } from "./channel-DgBHZ53s.js";
+import { a as getNostrRuntime, i as contentToProfile, n as nostrPlugin, o as setNostrRuntime, r as publishNostrProfile, t as getNostrProfileState } from "./channel-DqbdMXMg.js";
 import { normalizeLowercaseStringOrEmpty, normalizeOptionalLowercaseString, readStringValue } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { z } from "zod";
 import { SimplePool } from "nostr-tools";
-import { resolveTimerTimeoutMs } from "openclaw/plugin-sdk/number-runtime";
 import { KeyedAsyncQueue } from "openclaw/plugin-sdk/keyed-async-queue";
 import { readJsonBodyWithLimit, requestBodyErrorToText } from "openclaw/plugin-sdk/webhook-request-guards";
 import { createFixedWindowRateLimiter } from "openclaw/plugin-sdk/webhook-ingress";
+import { resolveTimerTimeoutMs } from "openclaw/plugin-sdk/number-runtime";
 import { isBlockedHostnameOrIp } from "openclaw/plugin-sdk/ssrf-runtime";
 //#region extensions/nostr/src/nostr-profile-url-safety.ts
 function validateUrlSafety(urlStr) {
@@ -132,9 +132,17 @@ async function importProfileFromRelays(opts) {
 			relaysQueried,
 			sourceRelay: bestEvent.relay
 		};
+		const sanitizedProfile = sanitizeProfileUrls(contentToProfile(parsedContent));
+		const validatedProfile = NostrProfileSchema.safeParse(sanitizedProfile);
+		if (!validatedProfile.success) return {
+			ok: false,
+			error: "Profile event content has invalid fields",
+			relaysQueried,
+			sourceRelay: bestEvent.relay
+		};
 		return {
 			ok: true,
-			profile: sanitizeProfileUrls(contentToProfile(parsedContent)),
+			profile: validatedProfile.data,
 			event: {
 				id: bestEvent.event.id,
 				pubkey: bestEvent.event.pubkey,