@openclaw/nostr 2026.7.2-beta.5 → 2026.8.1-beta.2

package/dist/api.js

@@ -1,15 +1,15 @@
-import { s as resolveNostrAccount } from "./setup-surface-BJCFpe02.js";
+import { s as resolveNostrAccount } from "./setup-surface-DAhyNOcb.js";
 import { getPluginRuntimeGatewayRequestScope } from "./runtime-api.js";
-import { n as NostrProfileSchema } from "./config-schema-CelPzg1N.js";
-import { a as getNostrRuntime, i as contentToProfile, n as nostrPlugin, o as setNostrRuntime, r as publishNostrProfile, t as getNostrProfileState } from "./channel-DNeI-LB-.js";
+import { n as NostrProfileSchema } from "./config-schema-CkYd8ACn.js";
+import { a as getNostrRuntime, i as contentToProfile, n as nostrPlugin, o as setNostrRuntime, r as publishNostrProfile, t as getNostrProfileState } from "./channel-BifOvAwp.js";
 import { normalizeLowercaseStringOrEmpty, normalizeOptionalLowercaseString, readStringValue } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { z } from "zod";
 import { SimplePool } from "nostr-tools";
 import { KeyedAsyncQueue } from "openclaw/plugin-sdk/keyed-async-queue";
+import { isBlockedHostnameOrIp, isLoopbackHost } from "openclaw/plugin-sdk/ssrf-runtime";
 import { readJsonBodyWithLimit, requestBodyErrorToText } from "openclaw/plugin-sdk/webhook-request-guards";
 import { createFixedWindowRateLimiter } from "openclaw/plugin-sdk/webhook-ingress";
 import { resolveTimerTimeoutMs } from "openclaw/plugin-sdk/number-runtime";
-import { isBlockedHostnameOrIp } from "openclaw/plugin-sdk/ssrf-runtime";
 //#region extensions/nostr/src/nostr-profile-url-safety.ts
 function validateUrlSafety(urlStr) {
 	try {
@@ -114,7 +114,11 @@ async function importProfileFromRelays(opts) {
 			error: "No profile found on any relay",
 			relaysQueried
 		};
-		const bestEvent = events.reduce((current, candidate) => candidate.event.created_at > current.event.created_at ? candidate : current);
+		const bestEvent = events.reduce((current, candidate) => {
+			const candidateIsNewer = candidate.event.created_at > current.event.created_at;
+			const candidateWinsTie = candidate.event.created_at === current.event.created_at && candidate.event.id < current.event.id;
+			return candidateIsNewer || candidateWinsTie ? candidate : current;
+		});
 		let parsedContent;
 		try {
 			parsedContent = JSON.parse(bestEvent.event.content);
@@ -230,8 +234,7 @@ function isLoopbackRemoteAddress(remoteAddress) {
 }
 function isLoopbackOriginLike(value) {
 	try {
-		const hostname = normalizeLowercaseStringOrEmpty(new URL(value).hostname);
-		return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1";
+		return isLoopbackHost(new URL(value).hostname);
 	} catch {
 		return false;
 	}

package/dist/{channel-DNeI-LB-.js → channel-BifOvAwp.js}

@@ -1,19 +1,20 @@
-import { a as listNostrAccountIds, c as normalizePubkey, l as validatePrivateKey, n as nostrSetupContract, o as resolveDefaultNostrAccountId, r as nostrSetupWizard, s as resolveNostrAccount, t as nostrSetupAdapter } from "./setup-surface-BJCFpe02.js";
-import { a as collectStatusIssuesFromLastError, i as buildChannelConfigSchema, n as NostrProfileSchema, o as createDefaultChannelRuntimeState, r as DEFAULT_ACCOUNT_ID, s as formatPairingApproveHint, t as NostrConfigSchema } from "./config-schema-CelPzg1N.js";
-import { a as DEFAULT_RELAYS } from "./setup-adapter-BjKmSwdW.js";
+import { a as listNostrAccountIds, c as normalizePubkey, l as validatePrivateKey, n as nostrSetupContract, o as resolveDefaultNostrAccountId, r as nostrSetupWizard, s as resolveNostrAccount } from "./setup-surface-DAhyNOcb.js";
+import { a as collectStatusIssuesFromLastError, i as buildChannelConfigSchema, n as NostrProfileSchema, o as createDefaultChannelRuntimeState, r as DEFAULT_ACCOUNT_ID, s as formatPairingApproveHint, t as NostrConfigSchema } from "./config-schema-CkYd8ACn.js";
+import { s as DEFAULT_RELAYS } from "./setup-adapter-DLthHa2q.js";
 import { t as normalizeNostrStateAccountId } from "./state-account-id-CvBZ9s6P.js";
 import { describeAccountSnapshot } from "openclaw/plugin-sdk/account-helpers";
 import { createScopedDmSecurityResolver, createTopLevelChannelConfigAdapter } from "openclaw/plugin-sdk/channel-config-helpers";
 import { createChatChannelPlugin } from "openclaw/plugin-sdk/channel-core";
 import { missingTargetError } from "openclaw/plugin-sdk/channel-feedback";
-import { DEFAULT_INGRESS_ADOPTION_STALL_MS, bindIngressLifecycleToReplyOptions, createChannelIngressMonitor, createChannelMessageAdapterFromOutbound, runPassiveAccountLifecycle } from "openclaw/plugin-sdk/channel-outbound";
+import { DEFAULT_INGRESS_ADOPTION_STALL_MS, bindIngressLifecycleToReplyOptions, createChannelIngressError, createChannelIngressMonitor, createChannelMessageAdapterFromOutbound, runPassiveAccountLifecycle } from "openclaw/plugin-sdk/channel-outbound";
 import { buildPassiveChannelStatusSummary, buildTrafficStatusSummary } from "openclaw/plugin-sdk/extension-shared";
 import { createComputedAccountStatusAdapter } from "openclaw/plugin-sdk/status-helpers";
-import { normalizeStringEntries } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { isRecord as isNostrIngressRecord, normalizeStringEntries } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { resolveStableChannelMessageIngress } from "openclaw/plugin-sdk/channel-ingress-runtime";
 import { createChannelPairingController } from "openclaw/plugin-sdk/channel-pairing";
 import { attachChannelToResult } from "openclaw/plugin-sdk/channel-send-result";
-import { stripMarkdown } from "openclaw/plugin-sdk/text-chunking";
+import { channelReadyPatch } from "openclaw/plugin-sdk/gateway-runtime";
+import { chunkTextForOutbound, sanitizeAssistantVisibleText, stripMarkdown } from "openclaw/plugin-sdk/text-chunking";
 import { SimplePool, finalizeEvent, getPublicKey, verifyEvent } from "nostr-tools";
 import { decrypt, encrypt } from "nostr-tools/nip04";
 import { createDirectDmPreCryptoGuardPolicy } from "openclaw/plugin-sdk/direct-dm-guard-policy";
@@ -378,13 +379,10 @@ function createNostrCursorStateWriter(options) {
 var NostrIngressPermanentError = class extends Error {
 	constructor(reason, message, options) {
 		super(message, options);
-		this.name = "NostrIngressPermanentError";
 		this.reason = reason;
+		this.name = "NostrIngressPermanentError";
 	}
 };
-function isNostrIngressRecord(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
 function requiredString(value, field) {
 	if (typeof value === "string" && value.trim()) return value;
 	throw new NostrIngressPermanentError("invalid-event", `Nostr event is missing ${field}.`);
@@ -426,23 +424,12 @@ const { setRuntime: setNostrRuntime, getRuntime: getNostrRuntime } = createPlugi
 //#endregion
 //#region extensions/nostr/src/nostr-ingress.ts
 const NOSTR_INGRESS_POLL_INTERVAL_MS = 500;
-const NOSTR_INGRESS_PRUNE_INTERVAL_MS = 3600 * 1e3;
-const NOSTR_INGRESS_COMPLETED_TTL_MS = 720 * 60 * 60 * 1e3;
-const NOSTR_INGRESS_COMPLETED_MAX_ENTRIES = 1e5;
-const NOSTR_INGRESS_FAILED_TTL_MS = 720 * 60 * 60 * 1e3;
-const NOSTR_INGRESS_FAILED_MAX_ENTRIES = 1e5;
 const NOSTR_INGRESS_APPEND_RETRY_MS = [
 	0,
 	100,
 	300
 ];
-var NostrIngressAdmissionRejectedError = class extends Error {
-	constructor(reason, message) {
-		super(message);
-		this.name = "NostrIngressAdmissionRejectedError";
-		this.reason = reason;
-	}
-};
+const NostrIngressAdmissionRejectedError = createChannelIngressError("NostrIngressAdmissionRejectedError", { withReason: true });
 function deserializeNostrIngressEvent(rawEvent, claimedId) {
 	let parsed;
 	try {
@@ -467,10 +454,6 @@ function createNostrIngress(options) {
 		queue ??= getNostrRuntime().state.openChannelIngressQueue({ accountId: options.accountId });
 		return queue;
 	};
-	const legacyMigration = migrateNostrLegacyRecentEventIds({
-		queue: getQueue(),
-		eventIds: options.legacyEventIds ?? []
-	});
 	const monitor = createChannelIngressMonitor({
 		queue: getQueue,
 		inspect: (event) => {
@@ -506,11 +489,8 @@ function createNostrIngress(options) {
 		deliver: (event, lifecycle) => options.deliver(event, lifecycle),
 		pollIntervalMs: options.pollIntervalMs ?? NOSTR_INGRESS_POLL_INTERVAL_MS,
 		retention: {
-			pruneIntervalMs: NOSTR_INGRESS_PRUNE_INTERVAL_MS,
-			completedTtlMs: NOSTR_INGRESS_COMPLETED_TTL_MS,
-			completedMaxEntries: NOSTR_INGRESS_COMPLETED_MAX_ENTRIES,
-			failedTtlMs: NOSTR_INGRESS_FAILED_TTL_MS,
-			failedMaxEntries: NOSTR_INGRESS_FAILED_MAX_ENTRIES
+			completedMaxEntries: 1e5,
+			failedMaxEntries: 1e5
 		},
 		drain: {
 			adoptionStallTimeoutMs: options.adoptionStallTimeoutMs ?? DEFAULT_INGRESS_ADOPTION_STALL_MS,
@@ -523,9 +503,14 @@ function createNostrIngress(options) {
 		createStoppedError,
 		onError: (error) => options.onError?.(error, "ingress drain")
 	});
-	const monitorStart = legacyMigration.then(() => {
+	const monitorStart = (async () => {
+		monitor.ensureQueueAvailable();
+		await migrateNostrLegacyRecentEventIds({
+			queue: getQueue(),
+			eventIds: options.legacyEventIds ?? []
+		});
 		if (!stopping) monitor.start();
-	});
+	})();
 	monitorStart.catch((error) => options.onError?.(error, "ingress drain"));
 	let admissionTail = Promise.resolve();
 	const prepareAdmission = (event) => {
@@ -559,7 +544,7 @@ function createNostrIngress(options) {
 		};
 	};
 	const admitOnce = async (prepared) => {
-		await legacyMigration;
+		await monitorStart;
 		const pending = await getQueue().listPending({ limit: options.maxPendingEvents });
 		const claims = await getQueue().listClaims();
 		if (pending.length + claims.length >= options.maxPendingEvents) throw new NostrIngressAdmissionRejectedError("backpressure", "Nostr event exceeds the durable ingress backlog.");
@@ -848,7 +833,7 @@ function createNostrRelaySubscriptionGroup(options) {
 						clearTimeout(deadlineTimer);
 						deadlineTimers.delete(deadlineTimer);
 						settleBackfill(relay, "incomplete");
-						if (!locallyClosing && !options.abort.aborted) options.onClose(relay, reasons);
+						if (!locallyClosing && !options.abort.aborted) options.onClose(relay, reasons.map(({ reason }) => reason));
 					},
 					maxWait: confirmDeadlineMs + LIBRARY_EOSE_TIMEOUT_MARGIN_MS,
 					abort: options.abort
@@ -1374,6 +1359,9 @@ async function sendEncryptedDm(pool, sk, toPubkey, text, relays, metrics, circui
 const activeBuses = /* @__PURE__ */ new Map();
 const metricsSnapshots = /* @__PURE__ */ new Map();
 const ACCESS_GROUP_PREFIX = "accessGroup:";
+function normalizeRelayLifecycleKey(relay) {
+	return new URL(relay).toString();
+}
 function parseNostrAccessGroupAllowFromEntry(entry) {
 	const trimmed = entry.trim();
 	if (!trimmed.startsWith(ACCESS_GROUP_PREFIX)) return null;
@@ -1409,17 +1397,20 @@ const startNostrGatewayAccount = async (ctx) => {
 	const account = ctx.account;
 	ctx.setStatus({
 		accountId: account.accountId,
-		publicKey: account.publicKey
+		publicKey: account.publicKey,
+		lifecycle: "starting"
 	});
 	ctx.log?.info?.(`[${account.accountId}] starting Nostr provider (pubkey: ${account.publicKey})`);
 	if (!account.configured) throw new Error("Nostr private key not configured");
+	const channelRuntime = ctx.channelRuntime;
+	if (!channelRuntime?.inbound?.buildContext) throw new Error("Nostr requires its registered channel runtime context builder");
 	const runtime = getNostrRuntime();
 	const pairing = createChannelPairingController({
 		core: runtime,
 		channel: "nostr",
 		accountId: account.accountId
 	});
-	const resolveInboundAccess = async (senderPubkey, rawBody) => await resolveStableChannelMessageIngress({
+	const resolveInboundAccess = async (senderPubkey, rawBody, contextBinding) => await resolveStableChannelMessageIngress({
 		channelId: "nostr",
 		accountId: account.accountId,
 		identity: nostrIngressIdentity,
@@ -1430,11 +1421,13 @@ const startNostrGatewayAccount = async (ctx) => {
 			kind: "direct",
 			id: senderPubkey
 		},
+		contextBinding,
 		dmPolicy: account.config.dmPolicy ?? "pairing",
 		allowFrom: account.config.allowFrom,
 		command: runtime.channel.commands.shouldComputeCommandAuthorized(rawBody, ctx.cfg) ? { modeWhenAccessGroupsOff: "configured" } : void 0
 	});
 	let busHandle = null;
+	const connectedRelays = /* @__PURE__ */ new Set();
 	const authorizeSender = async (input) => {
 		const resolved = await resolveInboundAccess(input.senderId, "");
 		if (resolved.senderAccess.decision === "allow") return "allow";
@@ -1474,6 +1467,12 @@ const startNostrGatewayAccount = async (ctx) => {
 					}
 					const { dispatchInboundDirectDm } = await import("./inbound-direct-dm-runtime-DHn9NoYN.js");
 					await dispatchInboundDirectDm({
+						channelRuntime,
+						resolveChannelIngress: async (contextBinding) => {
+							const exactAccess = await resolveInboundAccess(senderPubkey, text, contextBinding);
+							if (!exactAccess.senderAccess.allowed) throw new Error(`Nostr sender authorization changed before dispatch (${senderPubkey})`);
+							return exactAccess;
+						},
 						cfg: ctx.cfg,
 						channel: "nostr",
 						channelLabel: "Nostr",
@@ -1492,14 +1491,14 @@ const startNostrGatewayAccount = async (ctx) => {
 						commandAuthorized: resolvedAccess.commandAccess.requested ? resolvedAccess.commandAccess.authorized : void 0,
 						turnAdoptionLifecycle: bindIngressLifecycleToReplyOptions(lifecycle).turnAdoptionLifecycle,
 						deliver: async (payload) => {
-							const outboundText = payload && typeof payload === "object" && "text" in payload ? payload.text ?? "" : "";
-							if (!outboundText.trim()) return;
+							const sanitizedText = sanitizeAssistantVisibleText(payload && typeof payload === "object" && "text" in payload ? payload.text ?? "" : "");
+							if (!sanitizedText) return;
 							const tableMode = runtime.channel.text.resolveMarkdownTableMode({
 								cfg: ctx.cfg,
 								channel: "nostr",
 								accountId: account.accountId
 							});
-							const message = stripMarkdown(runtime.channel.text.convertMarkdownTables(outboundText, tableMode));
+							const message = stripMarkdown(runtime.channel.text.convertMarkdownTables(sanitizedText, tableMode));
 							if (message) await reply(message);
 						},
 						onRecordError: (err) => {
@@ -1514,9 +1513,17 @@ const startNostrGatewayAccount = async (ctx) => {
 					ctx.log?.error?.(`[${account.accountId}] Nostr error (${context}): ${error.message}`);
 				},
 				onConnect: (relay) => {
+					connectedRelays.add(normalizeRelayLifecycleKey(relay));
+					ctx.setStatus(channelReadyPatch({ accountId: account.accountId }));
 					ctx.log?.debug?.(`[${account.accountId}] Connected to relay: ${relay}`);
 				},
 				onDisconnect: (relay) => {
+					connectedRelays.delete(normalizeRelayLifecycleKey(relay));
+					if (connectedRelays.size === 0) ctx.setStatus({
+						accountId: account.accountId,
+						connected: false,
+						lifecycle: "recovering"
+					});
 					ctx.log?.debug?.(`[${account.accountId}] Disconnected from relay: ${relay}`);
 				},
 				onEose: (relays) => {
@@ -1564,6 +1571,8 @@ const nostrPairingTextAdapter = {
 const nostrOutboundAdapter = {
 	deliveryMode: "direct",
 	textChunkLimit: 4e3,
+	chunker: chunkTextForOutbound,
+	sanitizeText: ({ text }) => sanitizeAssistantVisibleText(text),
 	deliveryCapabilities: { durableFinal: {
 		text: true,
 		messageSendingHooks: true
@@ -1629,6 +1638,14 @@ function normalizeNostrTarget(target) {
 		return target.trim();
 	}
 }
+function inferNostrTargetChatType(target) {
+	try {
+		normalizePubkey(stripNostrTargetPrefix(target));
+		return "direct";
+	} catch {
+		return;
+	}
+}
 const resolveNostrDmPolicy = createScopedDmSecurityResolver({
 	channelKey: "nostr",
 	resolvePolicy: (account) => account.config.dmPolicy,
@@ -1703,7 +1720,6 @@ const nostrPlugin = createChatChannelPlugin({
 		},
 		reload: { configPrefixes: ["channels.nostr"] },
 		configSchema: buildChannelConfigSchema(NostrConfigSchema),
-		setup: nostrSetupAdapter,
 		setupContract: nostrSetupContract,
 		setupWizard: nostrSetupWizard,
 		config: {
@@ -1718,6 +1734,7 @@ const nostrPlugin = createChatChannelPlugin({
 		messaging: {
 			targetPrefixes: ["nostr"],
 			normalizeTarget: normalizeNostrTarget,
+			inferTargetChatType: ({ to }) => inferNostrTargetChatType(to),
 			targetResolver: {
 				looksLikeId: (input, normalized) => {
 					const trimmed = normalized?.trim() || stripNostrTargetPrefix(input);

package/dist/channel-plugin-api.js

@@ -1,2 +1,2 @@
-import { n as nostrPlugin } from "./channel-DNeI-LB-.js";
+import { n as nostrPlugin } from "./channel-BifOvAwp.js";
 export { nostrPlugin };

package/dist/{config-schema-CelPzg1N.js → config-schema-CkYd8ACn.js}

@@ -46,6 +46,7 @@ const NostrConfigSchema = z.object({
 	defaultAccount: z.string().optional(),
 	/** Whether this channel is enabled */
 	enabled: z.boolean().optional(),
+	configWrites: z.boolean().optional(),
 	/** Markdown formatting overrides (tables). */
 	markdown: MarkdownConfigSchema,
 	/** Private key in hex or nsec bech32 format */

package/dist/doctor-contract-api.js

@@ -1,22 +1,20 @@
 import { t as normalizeNostrStateAccountId } from "./state-account-id-CvBZ9s6P.js";
+import { asFiniteNumber } from "openclaw/plugin-sdk/string-coerce-runtime";
 import fs from "node:fs/promises";
 import path from "node:path";
-import { archiveLegacyStateSource } from "openclaw/plugin-sdk/runtime-doctor";
+import { archiveLegacyStateSource } from "openclaw/plugin-sdk/runtime-doctor-migrations";
 //#region extensions/nostr/doctor-contract-api.ts
 const BUS_STATE_NAMESPACE = "bus-state";
 const PROFILE_STATE_NAMESPACE = "profile-state";
 const MAX_NOSTR_STATE_ENTRIES = 256;
-function finiteNumberOrNull(value) {
-	return typeof value === "number" && Number.isFinite(value) ? value : null;
-}
 function parseBusState(value) {
 	if (!value || typeof value !== "object" || Array.isArray(value)) return null;
 	const parsed = value;
 	if (parsed.version !== 1 && parsed.version !== 2) return null;
 	return {
 		version: 2,
-		lastProcessedAt: finiteNumberOrNull(parsed.lastProcessedAt),
-		gatewayStartedAt: finiteNumberOrNull(parsed.gatewayStartedAt),
+		lastProcessedAt: asFiniteNumber(parsed.lastProcessedAt) ?? null,
+		gatewayStartedAt: asFiniteNumber(parsed.gatewayStartedAt) ?? null,
 		recentEventIds: parsed.version === 2 && Array.isArray(parsed.recentEventIds) ? parsed.recentEventIds.filter((entry) => typeof entry === "string") : []
 	};
 }
@@ -31,7 +29,7 @@ function parseProfileState(value) {
 	}
 	return {
 		version: 1,
-		lastPublishedAt: finiteNumberOrNull(parsed.lastPublishedAt),
+		lastPublishedAt: asFiniteNumber(parsed.lastPublishedAt) ?? null,
 		lastPublishedEventId: typeof parsed.lastPublishedEventId === "string" ? parsed.lastPublishedEventId : null,
 		lastPublishResults: rawResults === null || Object.keys(lastPublishResults).length === 0 ? null : lastPublishResults
 	};

package/dist/{setup-adapter-BjKmSwdW.js → setup-adapter-DLthHa2q.js}

@@ -1,10 +1,19 @@
 import { uniqueStrings } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { hasConfiguredSecretInput, normalizeSecretInputString } from "openclaw/plugin-sdk/secret-input";
 import { DEFAULT_ACCOUNT_ID } from "openclaw/plugin-sdk/routing";
-import { patchTopLevelChannelConfigSection, splitSetupEntries } from "openclaw/plugin-sdk/setup";
+import { createSetupTranslator, createStandardChannelSetupStatus, patchTopLevelChannelConfigSection, splitSetupEntries } from "openclaw/plugin-sdk/setup";
 import { defineChannelSetupContract } from "openclaw/plugin-sdk/channel-setup";
 //#region extensions/nostr/src/default-relays.ts
 const DEFAULT_RELAYS = ["wss://relay.damus.io", "wss://nos.lol"];
 //#endregion
+//#region extensions/nostr/src/private-key.ts
+const NOSTR_PRIVATE_KEY_ENV_VAR = "NOSTR_PRIVATE_KEY";
+function resolveNostrPrivateKey(value) {
+	const configured = normalizeSecretInputString(value);
+	if (configured || hasConfiguredSecretInput(value)) return configured ?? "";
+	return process.env["NOSTR_PRIVATE_KEY"]?.trim() ?? "";
+}
+//#endregion
 //#region extensions/nostr/src/setup-adapter.ts
 const channel = "nostr";
 function buildNostrSetupPatch(accountId, patch) {
@@ -41,25 +50,23 @@ function createNostrSetupAdapter(params) {
 			patch: buildNostrSetupPatch(accountId, name?.trim() ? { name: name.trim() } : {})
 		}),
 		validateInput: ({ input }) => {
-			const typedInput = input;
-			if (!typedInput.useEnv) {
-				const privateKey = typedInput.privateKey?.trim();
+			if (!input.useEnv) {
+				const privateKey = input.privateKey?.trim();
 				if (!privateKey) return "Nostr requires --private-key or --use-env.";
 				if (!params.validatePrivateKey(privateKey)) return "Nostr private key must be valid nsec or 64-character hex.";
 			}
-			if (typedInput.relayUrls?.trim()) return parseRelayUrls(typedInput.relayUrls).error ?? null;
+			if (input.relayUrls?.trim()) return parseRelayUrls(input.relayUrls).error ?? null;
 			return null;
 		},
 		applyAccountConfig: ({ cfg, accountId, input }) => {
-			const typedInput = input;
-			const relayResult = typedInput.relayUrls?.trim() ? parseRelayUrls(typedInput.relayUrls) : { relays: [] };
+			const relayResult = input.relayUrls?.trim() ? parseRelayUrls(input.relayUrls) : { relays: [] };
 			return patchTopLevelChannelConfigSection({
 				cfg,
 				channel,
 				enabled: true,
-				clearFields: typedInput.useEnv ? ["privateKey"] : void 0,
+				clearFields: input.useEnv ? ["privateKey"] : void 0,
 				patch: buildNostrSetupPatch(accountId, {
-					...typedInput.useEnv ? {} : { privateKey: typedInput.privateKey?.trim() },
+					...input.useEnv ? {} : { privateKey: input.privateKey?.trim() },
 					...relayResult.relays.length > 0 ? { relays: relayResult.relays } : {}
 				})
 			});
@@ -89,11 +96,32 @@ function createNostrSetupContract(adapter) {
 				cli: {
 					flags: "--use-env",
 					description: "Use NOSTR_PRIVATE_KEY"
-				}
+				},
+				envVars: [NOSTR_PRIVATE_KEY_ENV_VAR]
 			}
 		},
-		legacyAdapter: adapter
+		adapter
+	});
+}
+function createNostrSetupStatus(resolveAccount) {
+	const t = createSetupTranslator();
+	return createStandardChannelSetupStatus({
+		channelLabel: "Nostr",
+		configuredLabel: t("wizard.channels.statusConfigured"),
+		unconfiguredLabel: t("wizard.channels.statusNeedsPrivateKey"),
+		configuredHint: t("wizard.channels.statusConfigured"),
+		unconfiguredHint: t("wizard.channels.statusNeedsPrivateKey"),
+		configuredScore: 1,
+		unconfiguredScore: 0,
+		includeStatusLine: true,
+		resolveConfigured: ({ cfg, accountId }) => resolveAccount({
+			cfg,
+			accountId
+		}).configured,
+		resolveExtraStatusLines: ({ cfg }) => {
+			return [`Relays: ${resolveAccount({ cfg }).relays.length || DEFAULT_RELAYS.length}`];
+		}
 	});
 }
 //#endregion
-export { DEFAULT_RELAYS as a, parseRelayUrls as i, createNostrSetupAdapter as n, createNostrSetupContract as r, buildNostrSetupPatch as t };
+export { parseRelayUrls as a, createNostrSetupStatus as i, createNostrSetupAdapter as n, resolveNostrPrivateKey as o, createNostrSetupContract as r, DEFAULT_RELAYS as s, buildNostrSetupPatch as t };

package/dist/setup-api.js

@@ -1,2 +1,2 @@
-import { r as nostrSetupWizard, t as nostrSetupAdapter } from "./setup-surface-BJCFpe02.js";
+import { r as nostrSetupWizard, t as nostrSetupAdapter } from "./setup-surface-DAhyNOcb.js";
 export { nostrSetupAdapter, nostrSetupWizard };

package/dist/setup-plugin-api.js

@@ -1,18 +1,12 @@
-import { i as buildChannelConfigSchema, t as NostrConfigSchema } from "./config-schema-CelPzg1N.js";
-import { a as DEFAULT_RELAYS, n as createNostrSetupAdapter, r as createNostrSetupContract } from "./setup-adapter-BjKmSwdW.js";
+import { i as buildChannelConfigSchema, t as NostrConfigSchema } from "./config-schema-CkYd8ACn.js";
+import { i as createNostrSetupStatus, n as createNostrSetupAdapter, o as resolveNostrPrivateKey, r as createNostrSetupContract, s as DEFAULT_RELAYS } from "./setup-adapter-DLthHa2q.js";
 import { describeAccountSnapshot } from "openclaw/plugin-sdk/account-helpers";
-import { DEFAULT_ACCOUNT_ID, createDelegatedSetupWizardProxy, createSetupTranslator, createStandardChannelSetupStatus } from "openclaw/plugin-sdk/setup-runtime";
+import { DEFAULT_ACCOUNT_ID, createDelegatedSetupWizardProxy } from "openclaw/plugin-sdk/setup-runtime";
 //#region extensions/nostr/src/channel.setup.ts
-const t = createSetupTranslator();
 const channel = "nostr";
 function getNostrConfig(cfg) {
 	return cfg.channels?.nostr;
 }
-function listSetupNostrAccountIds(cfg) {
-	const nostrCfg = getNostrConfig(cfg);
-	if (!(typeof nostrCfg?.privateKey === "string" ? nostrCfg.privateKey.trim() : "")) return [];
-	return [resolveDefaultSetupNostrAccountId(cfg)];
-}
 function resolveDefaultSetupNostrAccountId(cfg) {
 	const configured = getNostrConfig(cfg)?.defaultAccount;
 	return typeof configured === "string" && configured.trim() ? configured.trim() : DEFAULT_ACCOUNT_ID;
@@ -20,7 +14,7 @@ function resolveDefaultSetupNostrAccountId(cfg) {
 function resolveSetupNostrAccount(params) {
 	const nostrCfg = getNostrConfig(params.cfg);
 	const accountId = params.accountId?.trim() || resolveDefaultSetupNostrAccountId(params.cfg);
-	const privateKey = typeof nostrCfg?.privateKey === "string" ? nostrCfg.privateKey.trim() : "";
+	const privateKey = resolveNostrPrivateKey(nostrCfg?.privateKey);
 	const configured = Boolean(privateKey);
 	return {
 		accountId,
@@ -42,34 +36,10 @@ function resolveSetupNostrAccount(params) {
 		}
 	};
 }
-function looksLikeNostrPrivateKey(privateKey) {
-	return privateKey.startsWith("nsec1") || privateKey.startsWith("NSEC1") || /^[0-9a-fA-F]{64}$/.test(privateKey);
-}
-const nostrSetupAdapter = createNostrSetupAdapter({
-	resolveAccountId: (cfg, accountId) => accountId?.trim() || resolveDefaultSetupNostrAccountId(cfg),
-	validatePrivateKey: looksLikeNostrPrivateKey
-});
-const nostrSetupContract = createNostrSetupContract(nostrSetupAdapter);
 const nostrSetupWizard = createDelegatedSetupWizardProxy({
 	channel,
-	loadWizard: async () => (await import("./setup-surface-BJCFpe02.js").then((n) => n.i)).nostrSetupWizard,
-	status: { ...createStandardChannelSetupStatus({
-		channelLabel: "Nostr",
-		configuredLabel: t("wizard.channels.statusConfigured"),
-		unconfiguredLabel: t("wizard.channels.statusNeedsPrivateKey"),
-		configuredHint: t("wizard.channels.statusConfigured"),
-		unconfiguredHint: t("wizard.channels.statusNeedsPrivateKey"),
-		configuredScore: 1,
-		unconfiguredScore: 0,
-		includeStatusLine: true,
-		resolveConfigured: ({ cfg, accountId }) => resolveSetupNostrAccount({
-			cfg,
-			accountId
-		}).configured,
-		resolveExtraStatusLines: ({ cfg }) => {
-			return [`Relays: ${resolveSetupNostrAccount({ cfg }).relays.length || DEFAULT_RELAYS.length}`];
-		}
-	}) },
+	loadWizard: async () => (await import("./setup-surface-DAhyNOcb.js").then((n) => n.i)).nostrSetupWizard,
+	status: createNostrSetupStatus(resolveSetupNostrAccount),
 	resolveShouldPromptAccountIds: () => false,
 	delegatePrepare: true,
 	delegateFinalize: true
@@ -91,11 +61,13 @@ const nostrSetupPlugin = {
 	},
 	reload: { configPrefixes: ["channels.nostr"] },
 	configSchema: buildChannelConfigSchema(NostrConfigSchema),
-	setup: nostrSetupAdapter,
-	setupContract: nostrSetupContract,
+	setupContract: createNostrSetupContract(createNostrSetupAdapter({
+		resolveAccountId: (cfg, accountId) => accountId?.trim() || resolveDefaultSetupNostrAccountId(cfg),
+		validatePrivateKey: (privateKey) => /^(?:nsec1|NSEC1)|^[0-9a-fA-F]{64}$/u.test(privateKey)
+	})),
 	setupWizard: nostrSetupWizard,
 	config: {
-		listAccountIds: listSetupNostrAccountIds,
+		listAccountIds: (cfg) => resolveSetupNostrAccount({ cfg }).configured ? [resolveDefaultSetupNostrAccountId(cfg)] : [],
 		resolveAccount: (cfg, accountId) => resolveSetupNostrAccount({
 			cfg,
 			accountId

package/dist/{setup-surface-BJCFpe02.js → setup-surface-DAhyNOcb.js}

@@ -1,11 +1,11 @@
-import { a as DEFAULT_RELAYS, i as parseRelayUrls, n as createNostrSetupAdapter, r as createNostrSetupContract, t as buildNostrSetupPatch } from "./setup-adapter-BjKmSwdW.js";
+import { a as parseRelayUrls, i as createNostrSetupStatus, n as createNostrSetupAdapter, o as resolveNostrPrivateKey, r as createNostrSetupContract, s as DEFAULT_RELAYS, t as buildNostrSetupPatch } from "./setup-adapter-DLthHa2q.js";
 import { createAccountListHelpers } from "openclaw/plugin-sdk/account-helpers";
 import { normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { hasConfiguredSecretInput, normalizeSecretInputString } from "openclaw/plugin-sdk/secret-input";
 import { getPublicKey, nip19 } from "nostr-tools";
 import { DEFAULT_ACCOUNT_ID, normalizeAccountId, normalizeOptionalAccountId } from "openclaw/plugin-sdk/account-id";
 import { DEFAULT_ACCOUNT_ID as DEFAULT_ACCOUNT_ID$1 } from "openclaw/plugin-sdk/routing";
-import { createSetupTranslator, createStandardChannelSetupStatus, createTopLevelChannelDmPolicy, createTopLevelChannelParsedAllowFromPrompt, defineTokenCredential, formatDocsLink, mergeAllowFromEntries, parseSetupEntriesWithParser, patchTopLevelChannelConfigSection, setSetupChannelEnabled } from "openclaw/plugin-sdk/setup";
+import { createSetupTranslator, createTopLevelChannelDmPolicy, createTopLevelChannelParsedAllowFromPrompt, defineTokenCredential, formatDocsLink, mergeAllowFromEntries, parseSetupEntriesWithParser, patchTopLevelChannelConfigSection, setSetupChannelEnabled } from "openclaw/plugin-sdk/setup";
 //#region \0rolldown/runtime.js
 var __defProp = Object.defineProperty;
 var __exportAll = (all, no_symbols) => {
@@ -59,7 +59,7 @@ const { listAccountIds: listNostrAccountIds, resolveDefaultAccountId: resolveDef
 	fallbackAccountIdWhenEmpty: false,
 	resolveImplicitAccountId: (cfg) => {
 		const account = cfg.channels?.nostr;
-		return normalizeSecretInputString(account?.privateKey) ? normalizeOptionalAccountId(account?.defaultAccount) ?? DEFAULT_ACCOUNT_ID : void 0;
+		return resolveNostrPrivateKey(account?.privateKey) ? normalizeOptionalAccountId(account?.defaultAccount) ?? DEFAULT_ACCOUNT_ID : void 0;
 	}
 });
 /**
@@ -69,7 +69,7 @@ function resolveNostrAccount(opts) {
 	const accountId = normalizeAccountId(opts.accountId ?? resolveDefaultNostrAccountId(opts.cfg));
 	const nostrCfg = opts.cfg.channels?.nostr;
 	const baseEnabled = nostrCfg?.enabled !== false;
-	const privateKey = normalizeSecretInputString(nostrCfg?.privateKey) ?? "";
+	const privateKey = resolveNostrPrivateKey(nostrCfg?.privateKey);
 	const configured = Boolean(privateKey);
 	let publicKey = "";
 	if (privateKey) try {
@@ -162,20 +162,7 @@ const nostrSetupWizard = {
 	channel,
 	resolveAccountIdForConfigure: ({ accountOverride, defaultAccountId }) => accountOverride?.trim() || defaultAccountId,
 	resolveShouldPromptAccountIds: () => false,
-	status: createStandardChannelSetupStatus({
-		channelLabel: "Nostr",
-		configuredLabel: t("wizard.channels.statusConfigured"),
-		unconfiguredLabel: t("wizard.channels.statusNeedsPrivateKey"),
-		configuredHint: t("wizard.channels.statusConfigured"),
-		unconfiguredHint: t("wizard.channels.statusNeedsPrivateKey"),
-		configuredScore: 1,
-		unconfiguredScore: 0,
-		includeStatusLine: true,
-		resolveConfigured: ({ cfg }) => resolveNostrAccount({ cfg }).configured,
-		resolveExtraStatusLines: ({ cfg }) => {
-			return [`Relays: ${resolveNostrAccount({ cfg }).relays.length || DEFAULT_RELAYS.length}`];
-		}
-	}),
+	status: createNostrSetupStatus(resolveNostrAccount),
 	introNote: {
 		title: t("wizard.nostr.setupTitle"),
 		lines: NOSTR_SETUP_HELP_LINES