@openclaw/nostr 2026.8.1-beta.3 → 2026.8.2

package/dist/api.js

@@ -1,7 +1,7 @@
-import { s as resolveNostrAccount } from "./setup-surface-uA4hN27A.js";
+import { s as resolveNostrAccount } from "./setup-surface-mA5PMspO.js";
 import { getPluginRuntimeGatewayRequestScope } from "./runtime-api.js";
 import { n as NostrProfileSchema } from "./config-schema-CkYd8ACn.js";
-import { a as getNostrRuntime, i as contentToProfile, n as nostrPlugin, o as setNostrRuntime, r as publishNostrProfile, t as getNostrProfileState } from "./channel-ity6au4a.js";
+import { a as getNostrRuntime, i as contentToProfile, n as nostrPlugin, o as setNostrRuntime, r as publishNostrProfile, t as getNostrProfileState } from "./channel-CLybVB2-.js";
 import { normalizeLowercaseStringOrEmpty, normalizeOptionalLowercaseString, readStringValue } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { z } from "zod";
 import { SimplePool } from "nostr-tools";
@@ -18,7 +18,8 @@ function validateUrlSafety(urlStr) {
 			ok: false,
 			error: "URL must use https:// protocol"
 		};
-		if (isBlockedHostnameOrIp(url.hostname.trim().toLowerCase())) return {
+		const hostname = url.hostname.trim().toLowerCase();
+		if (isBlockedHostnameOrIp(hostname)) return {
 			ok: false,
 			error: "URL must not point to private/internal addresses"
 		};
@@ -208,7 +209,7 @@ function sendJson(res, status, body) {
 	res.setHeader("Content-Type", "application/json; charset=utf-8");
 	res.end(JSON.stringify(body));
 }
-async function readJsonBody(req, maxBytes = 64 * 1024, timeoutMs = 3e4) {
+async function readJsonBody(req, maxBytes = 65536, timeoutMs = 3e4) {
 	const result = await readJsonBodyWithLimit(req, {
 		maxBytes,
 		timeoutMs,
@@ -234,7 +235,8 @@ function isLoopbackRemoteAddress(remoteAddress) {
 }
 function isLoopbackOriginLike(value) {
 	try {
-		return isLoopbackHost(new URL(value).hostname);
+		const url = new URL(value);
+		return isLoopbackHost(url.hostname);
 	} catch {
 		return false;
 	}

package/dist/{channel-ity6au4a.js → channel-CLybVB2-.js}

@@ -1,6 +1,6 @@
-import { a as listNostrAccountIds, c as normalizePubkey, l as validatePrivateKey, n as nostrSetupContract, o as resolveDefaultNostrAccountId, r as nostrSetupWizard, s as resolveNostrAccount } from "./setup-surface-uA4hN27A.js";
+import { a as listNostrAccountIds, c as normalizePubkey, n as nostrSetupContract, o as resolveDefaultNostrAccountId, r as nostrSetupWizard, s as resolveNostrAccount } from "./setup-surface-mA5PMspO.js";
 import { a as collectStatusIssuesFromLastError, i as buildChannelConfigSchema, n as NostrProfileSchema, o as createDefaultChannelRuntimeState, r as DEFAULT_ACCOUNT_ID, s as formatPairingApproveHint, t as NostrConfigSchema } from "./config-schema-CkYd8ACn.js";
-import { c as DEFAULT_RELAYS } from "./setup-adapter-ClKW2fkz.js";
+import { c as validatePrivateKey, l as DEFAULT_RELAYS } from "./setup-adapter-KJ_iGKiG.js";
 import { t as normalizeNostrStateAccountId } from "./state-account-id-CvBZ9s6P.js";
 import { describeAccountSnapshot } from "openclaw/plugin-sdk/account-helpers";
 import { createScopedDmSecurityResolver, createTopLevelChannelConfigAdapter } from "openclaw/plugin-sdk/channel-config-helpers";
@@ -213,9 +213,7 @@ function createMetrics(onMetric) {
 			case "memory.seen_tracker_size":
 				state.memory.seenTrackerSize = value;
 				break;
-			case "memory.rate_limiter_entries":
-				state.memory.rateLimiterEntries = value;
-				break;
+			case "memory.rate_limiter_entries": state.memory.rateLimiterEntries = value;
 		}
 	}
 	function getSnapshot() {
@@ -365,9 +363,7 @@ function createNostrCursorStateWriter(options) {
 					return;
 				} catch (error) {
 					options.onBackgroundError?.(error);
-					await new Promise((resolve) => {
-						setTimeout(resolve, options.recoveryRetryMs ?? CURSOR_RECOVERY_RETRY_MS);
-					});
+					await sleepWithAbort(CURSOR_RECOVERY_RETRY_MS);
 				}
 			})().finally(() => {
 				recoveryFlush = void 0;
@@ -679,11 +675,12 @@ function createProfileEvent(sk, profile, lastPublishedAt) {
 	const content = profileToContent(profile);
 	const contentJson = JSON.stringify(content);
 	const now = Math.floor(Date.now() / 1e3);
+	const createdAt = lastPublishedAt !== void 0 ? Math.max(now, lastPublishedAt + 1) : now;
 	return finalizeEvent({
 		kind: 0,
 		content: contentJson,
 		tags: [],
-		created_at: lastPublishedAt !== void 0 ? Math.max(now, lastPublishedAt + 1) : now
+		created_at: createdAt
 	}, sk);
 }
 /** Per-relay publish timeout (ms) */
@@ -862,7 +859,7 @@ async function writeNostrProfileState(params) {
 //#region extensions/nostr/src/nostr-bus.ts
 const STARTUP_LOOKBACK_SEC = 120;
 const STATE_PERSIST_DEBOUNCE_MS = 5e3;
-const NOSTR_INGRESS_ENVELOPE_OVERHEAD_BYTES = 16 * 1024;
+const NOSTR_INGRESS_ENVELOPE_OVERHEAD_BYTES = 16384;
 const NOSTR_INGRESS_MAX_PENDING_EVENTS = 1e3;
 const DEFAULT_INBOUND_GUARD_POLICY = createDirectDmPreCryptoGuardPolicy();
 const CIRCUIT_BREAKER_THRESHOLD = 5;
@@ -1447,7 +1444,8 @@ const startNostrGatewayAccount = async (ctx) => {
 						commandAuthorized: resolvedAccess.commandAccess.requested ? resolvedAccess.commandAccess.authorized : void 0,
 						turnAdoptionLifecycle: bindIngressLifecycleToReplyOptions(lifecycle).turnAdoptionLifecycle,
 						deliver: async (payload) => {
-							const sanitizedText = sanitizeAssistantVisibleText(payload && typeof payload === "object" && "text" in payload ? payload.text ?? "" : "");
+							const outboundText = payload && typeof payload === "object" && "text" in payload ? payload.text ?? "" : "";
+							const sanitizedText = sanitizeAssistantVisibleText(outboundText);
 							if (!sanitizedText) return;
 							const tableMode = runtime.channel.text.resolveMarkdownTableMode({
 								cfg: ctx.cfg,
@@ -1542,9 +1540,10 @@ const nostrOutboundAdapter = {
 		const message = stripMarkdown(core.channel.text.convertMarkdownTables(text ?? "", tableMode));
 		if (!message) throw new Error("Nostr send requires non-empty text after markdown stripping.");
 		const normalizedTo = normalizePubkey(to);
+		const eventId = await bus.sendDm(normalizedTo, message);
 		return attachChannelToResult("nostr", {
 			to: normalizedTo,
-			messageId: await bus.sendDm(normalizedTo, message)
+			messageId: eventId
 		});
 	}
 };

package/dist/channel-plugin-api.js

@@ -1,2 +1,2 @@
-import { n as nostrPlugin } from "./channel-ity6au4a.js";
+import { n as nostrPlugin } from "./channel-CLybVB2-.js";
 export { nostrPlugin };

package/dist/doctor-contract-api.js

@@ -49,7 +49,8 @@ async function listLegacyFiles(params) {
 	const files = [];
 	for (const entry of entries) {
 		if (!entry.isFile() || !entry.name.startsWith(params.prefix) || !entry.name.endsWith(suffix)) continue;
-		const accountId = normalizeNostrStateAccountId(entry.name.slice(params.prefix.length, -5));
+		const rawAccountId = entry.name.slice(params.prefix.length, -5);
+		const accountId = normalizeNostrStateAccountId(rawAccountId);
 		const filePath = path.join(dir, entry.name);
 		try {
 			const value = params.parse(await readJsonFile(filePath));

package/dist/{setup-adapter-ClKW2fkz.js → setup-adapter-KJ_iGKiG.js}

@@ -1,5 +1,6 @@
 import { uniqueStrings } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { hasConfiguredSecretInput, normalizeSecretInputString } from "openclaw/plugin-sdk/secret-input";
+import { decode } from "nostr-tools/nip19";
 import { DEFAULT_ACCOUNT_ID } from "openclaw/plugin-sdk/routing";
 import { createSetupTranslator, createStandardChannelSetupStatus, patchTopLevelChannelConfigSection, splitSetupEntries } from "openclaw/plugin-sdk/setup";
 import { defineChannelSetupContract } from "openclaw/plugin-sdk/channel-setup";
@@ -8,6 +9,29 @@ const DEFAULT_RELAYS = ["wss://relay.damus.io", "wss://nos.lol"];
 //#endregion
 //#region extensions/nostr/src/private-key.ts
 const NOSTR_PRIVATE_KEY_ENV_VAR = "NOSTR_PRIVATE_KEY";
+const SECP256K1_ORDER = BigInt("0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141");
+/** Validate and normalize a private key (hex or NIP-19 nsec). */
+function validatePrivateKey(key) {
+	const trimmed = key.trim();
+	let bytes;
+	if (trimmed.startsWith("nsec1") || trimmed.startsWith("NSEC1")) {
+		let decoded;
+		try {
+			decoded = decode(trimmed);
+		} catch {
+			throw new Error("Invalid nsec private key");
+		}
+		if (decoded.type !== "nsec") throw new Error("Invalid nsec key type");
+		bytes = decoded.data;
+	} else {
+		if (!/^[0-9a-fA-F]{64}$/.test(trimmed)) throw new Error("Private key must be 64 hex characters or nsec bech32 format");
+		bytes = Uint8Array.from({ length: 32 }, (_, index) => Number.parseInt(trimmed.slice(index * 2, index * 2 + 2), 16));
+	}
+	if (bytes.length !== 32) throw new Error("Private key must decode to 32 bytes");
+	const scalar = Array.from(bytes).reduce((value, byte) => value << 8n | BigInt(byte), 0n);
+	if (scalar === 0n || scalar >= SECP256K1_ORDER) throw new Error("Private key scalar is out of range");
+	return bytes;
+}
 function hasConfiguredNostrPrivateKey(value) {
 	return hasConfiguredSecretInput(value) || Boolean(process.env["NOSTR_PRIVATE_KEY"]?.trim());
 }
@@ -56,7 +80,11 @@ function createNostrSetupAdapter(params) {
 			if (!input.useEnv) {
 				const privateKey = input.privateKey?.trim();
 				if (!privateKey) return "Nostr requires --private-key or --use-env.";
-				if (!params.validatePrivateKey(privateKey)) return "Nostr private key must be valid nsec or 64-character hex.";
+				try {
+					validatePrivateKey(privateKey);
+				} catch {
+					return "Nostr private key must be valid nsec or 64-character hex.";
+				}
 			}
 			if (input.relayUrls?.trim()) return parseRelayUrls(input.relayUrls).error ?? null;
 			return null;
@@ -127,4 +155,4 @@ function createNostrSetupStatus(resolveAccount) {
 	});
 }
 //#endregion
-export { parseRelayUrls as a, DEFAULT_RELAYS as c, createNostrSetupStatus as i, createNostrSetupAdapter as n, hasConfiguredNostrPrivateKey as o, createNostrSetupContract as r, resolveNostrPrivateKey as s, buildNostrSetupPatch as t };
+export { parseRelayUrls as a, validatePrivateKey as c, createNostrSetupStatus as i, DEFAULT_RELAYS as l, createNostrSetupAdapter as n, hasConfiguredNostrPrivateKey as o, createNostrSetupContract as r, resolveNostrPrivateKey as s, buildNostrSetupPatch as t };

package/dist/setup-api.js

@@ -1,2 +1,2 @@
-import { r as nostrSetupWizard, t as nostrSetupAdapter } from "./setup-surface-uA4hN27A.js";
+import { r as nostrSetupWizard, t as nostrSetupAdapter } from "./setup-surface-mA5PMspO.js";
 export { nostrSetupAdapter, nostrSetupWizard };

package/dist/setup-plugin-api.js

@@ -1,5 +1,5 @@
 import { i as buildChannelConfigSchema, t as NostrConfigSchema } from "./config-schema-CkYd8ACn.js";
-import { c as DEFAULT_RELAYS, i as createNostrSetupStatus, n as createNostrSetupAdapter, o as hasConfiguredNostrPrivateKey, r as createNostrSetupContract, s as resolveNostrPrivateKey } from "./setup-adapter-ClKW2fkz.js";
+import { i as createNostrSetupStatus, l as DEFAULT_RELAYS, n as createNostrSetupAdapter, o as hasConfiguredNostrPrivateKey, r as createNostrSetupContract, s as resolveNostrPrivateKey } from "./setup-adapter-KJ_iGKiG.js";
 import { describeAccountSnapshot } from "openclaw/plugin-sdk/account-helpers";
 import { normalizeAccountId } from "openclaw/plugin-sdk/account-id";
 import { createDelegatedSetupWizardProxy } from "openclaw/plugin-sdk/setup-runtime";
@@ -38,7 +38,7 @@ function resolveSetupNostrAccount(params) {
 }
 const nostrSetupWizard = createDelegatedSetupWizardProxy({
 	channel,
-	loadWizard: async () => (await import("./setup-surface-uA4hN27A.js").then((n) => n.i)).nostrSetupWizard,
+	loadWizard: async () => (await import("./setup-surface-mA5PMspO.js").then((n) => n.i)).nostrSetupWizard,
 	status: createNostrSetupStatus(resolveSetupNostrAccount),
 	resolveShouldPromptAccountIds: () => false,
 	delegatePrepare: true,
@@ -61,10 +61,7 @@ const nostrSetupPlugin = {
 	},
 	reload: { configPrefixes: ["channels.nostr"] },
 	configSchema: buildChannelConfigSchema(NostrConfigSchema),
-	setupContract: createNostrSetupContract(createNostrSetupAdapter({
-		resolveAccountId: (cfg, accountId) => accountId?.trim() || resolveDefaultSetupNostrAccountId(cfg),
-		validatePrivateKey: (privateKey) => /^(?:nsec1|NSEC1)|^[0-9a-fA-F]{64}$/u.test(privateKey)
-	})),
+	setupContract: createNostrSetupContract(createNostrSetupAdapter({ resolveAccountId: (cfg, accountId) => accountId?.trim() || resolveDefaultSetupNostrAccountId(cfg) })),
 	setupWizard: nostrSetupWizard,
 	config: {
 		listAccountIds: (cfg) => resolveSetupNostrAccount({ cfg }).configured ? [resolveDefaultSetupNostrAccountId(cfg)] : [],

package/dist/{setup-surface-uA4hN27A.js → setup-surface-mA5PMspO.js}

@@ -1,8 +1,9 @@
-import { a as parseRelayUrls, c as DEFAULT_RELAYS, i as createNostrSetupStatus, n as createNostrSetupAdapter, o as hasConfiguredNostrPrivateKey, r as createNostrSetupContract, s as resolveNostrPrivateKey, t as buildNostrSetupPatch } from "./setup-adapter-ClKW2fkz.js";
+import { a as parseRelayUrls, c as validatePrivateKey, i as createNostrSetupStatus, l as DEFAULT_RELAYS, n as createNostrSetupAdapter, o as hasConfiguredNostrPrivateKey, r as createNostrSetupContract, s as resolveNostrPrivateKey, t as buildNostrSetupPatch } from "./setup-adapter-KJ_iGKiG.js";
 import { createAccountListHelpers } from "openclaw/plugin-sdk/account-helpers";
 import { normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { hasConfiguredSecretInput, normalizeSecretInputString } from "openclaw/plugin-sdk/secret-input";
-import { getPublicKey, nip19 } from "nostr-tools";
+import { decode } from "nostr-tools/nip19";
+import { getPublicKey } from "nostr-tools/pure";
 import { DEFAULT_ACCOUNT_ID, normalizeAccountId, normalizeOptionalAccountId } from "openclaw/plugin-sdk/account-id";
 import { DEFAULT_ACCOUNT_ID as DEFAULT_ACCOUNT_ID$1 } from "openclaw/plugin-sdk/routing";
 import { createSetupTranslator, createTopLevelChannelDmPolicy, createTopLevelChannelParsedAllowFromPrompt, defineTokenCredential, formatDocsLink, mergeAllowFromEntries, parseSetupEntriesWithParser, patchTopLevelChannelConfigSection, setSetupChannelEnabled } from "openclaw/plugin-sdk/setup";
@@ -19,34 +20,13 @@ var __exportAll = (all, no_symbols) => {
 };
 //#endregion
 //#region extensions/nostr/src/nostr-key-utils.ts
-/**
-* Validate and normalize a private key (accepts hex or nsec format)
-*/
-function validatePrivateKey(key) {
-	const trimmed = key.trim();
-	if (trimmed.startsWith("nsec1") || trimmed.startsWith("NSEC1")) {
-		const decoded = nip19.decode(trimmed);
-		if (decoded.type !== "nsec") throw new Error("Invalid nsec key: wrong type");
-		return decoded.data;
-	}
-	if (!/^[0-9a-fA-F]{64}$/.test(trimmed)) throw new Error("Private key must be 64 hex characters or nsec bech32 format");
-	const bytes = /* @__PURE__ */ new Uint8Array(32);
-	for (let i = 0; i < 32; i++) bytes[i] = Number.parseInt(trimmed.slice(i * 2, i * 2 + 2), 16);
-	return bytes;
-}
-/**
-* Get public key from private key (hex or nsec format)
-*/
 function getPublicKeyFromPrivate(privateKey) {
 	return getPublicKey(validatePrivateKey(privateKey));
 }
-/**
-* Normalize a pubkey to hex format (accepts npub or hex)
-*/
 function normalizePubkey(input) {
 	const trimmed = input.trim();
 	if (trimmed.startsWith("npub1") || trimmed.startsWith("NPUB1")) {
-		const decoded = nip19.decode(trimmed);
+		const decoded = decode(trimmed);
 		if (decoded.type !== "npub" || typeof decoded.data !== "string") throw new Error("Invalid npub key");
 		return decoded.data.toLowerCase();
 	}
@@ -129,34 +109,25 @@ function parseNostrAllowFrom(raw) {
 		}
 	});
 }
+const promptNostrAllowFrom = createTopLevelChannelParsedAllowFromPrompt({
+	channel,
+	defaultAccountId: resolveDefaultNostrAccountId,
+	noteTitle: t("wizard.nostr.allowlistTitle"),
+	noteLines: NOSTR_ALLOW_FROM_HELP_LINES,
+	message: t("wizard.nostr.allowFromPrompt"),
+	placeholder: "npub1..., 0123abcd...",
+	parseEntries: parseNostrAllowFrom,
+	mergeEntries: ({ existing, parsed }) => mergeAllowFromEntries(existing, parsed)
+});
 const nostrDmPolicy = createTopLevelChannelDmPolicy({
 	label: "Nostr",
 	channel,
 	policyKey: "channels.nostr.dmPolicy",
 	allowFromKey: "channels.nostr.allowFrom",
 	getCurrent: (cfg) => cfg.channels?.nostr?.dmPolicy ?? "pairing",
-	promptAllowFrom: createTopLevelChannelParsedAllowFromPrompt({
-		channel,
-		defaultAccountId: resolveDefaultNostrAccountId,
-		noteTitle: t("wizard.nostr.allowlistTitle"),
-		noteLines: NOSTR_ALLOW_FROM_HELP_LINES,
-		message: t("wizard.nostr.allowFromPrompt"),
-		placeholder: "npub1..., 0123abcd...",
-		parseEntries: parseNostrAllowFrom,
-		mergeEntries: ({ existing, parsed }) => mergeAllowFromEntries(existing, parsed)
-	})
-});
-const nostrSetupAdapter = createNostrSetupAdapter({
-	resolveAccountId: (cfg, accountId) => accountId?.trim() || resolveDefaultNostrAccountId(cfg),
-	validatePrivateKey: (privateKey) => {
-		try {
-			getPublicKeyFromPrivate(privateKey);
-			return true;
-		} catch {
-			return false;
-		}
-	}
+	promptAllowFrom: promptNostrAllowFrom
 });
+const nostrSetupAdapter = createNostrSetupAdapter({ resolveAccountId: (cfg, accountId) => accountId?.trim() || resolveDefaultNostrAccountId(cfg) });
 const nostrSetupContract = createNostrSetupContract(nostrSetupAdapter);
 const nostrSetupWizard = {
 	channel,
@@ -244,4 +215,4 @@ const nostrSetupWizard = {
 	disable: (cfg) => setSetupChannelEnabled(cfg, channel, false)
 };
 //#endregion
-export { listNostrAccountIds as a, normalizePubkey as c, setup_surface_exports as i, validatePrivateKey as l, nostrSetupContract as n, resolveDefaultNostrAccountId as o, nostrSetupWizard as r, resolveNostrAccount as s, nostrSetupAdapter as t };
+export { listNostrAccountIds as a, normalizePubkey as c, setup_surface_exports as i, nostrSetupContract as n, resolveDefaultNostrAccountId as o, nostrSetupWizard as r, resolveNostrAccount as s, nostrSetupAdapter as t };

package/node_modules/nostr-tools/lib/cjs/abstract-pool.js

@@ -650,10 +650,12 @@ var Subscription = class {
       this.closed = true;
     }
     this.relay.openSubs.delete(this.id);
-    this.relay.ongoingOperations--;
-    if (this.relay.ongoingOperations === 0) {
-      this.relay.idleSince = Date.now();
-      this.relay.scheduleIdleClose();
+    if (!this.id.startsWith("<forced-ping>")) {
+      this.relay.ongoingOperations--;
+      if (this.relay.ongoingOperations === 0) {
+        this.relay.idleSince = Date.now();
+        this.relay.scheduleIdleClose();
+      }
     }
     this.onclose?.(reason);
   }
@@ -1004,7 +1006,7 @@ var AbstractSimplePool = class {
         });
       } catch (err) {
         this.onRelayConnectionFailure?.(url);
-        return String("connection failure: " + String(err));
+        return Promise.reject("connection failure: " + String(err));
       }
       return r.publish(event).catch(async (err) => {
         if (err instanceof Error && err.message.startsWith("auth-required: ") && params?.onauth) {