@openclaw/nostr 2026.9.5 → 2026.9.7

package/dist/.setup/{channel-ByGdjtr3.mjs → channel-D2d-FP8G.mjs}

@@ -1,16 +1,15 @@
 import { a as listNostrAccountIds, c as normalizePubkey, n as nostrSetupContract, o as resolveDefaultNostrAccountId, r as nostrSetupWizard, s as resolveNostrAccount } from "./setup-surface-Dx8QxWSP.mjs";
-import { a as collectStatusIssuesFromLastError, i as buildChannelConfigSchema, n as NostrProfileSchema, o as createDefaultChannelRuntimeState, r as DEFAULT_ACCOUNT_ID, s as formatPairingApproveHint, t as NostrConfigSchema } from "./config-schema-CkYd8ACn.mjs";
+import { n as NostrProfileSchema, t as NostrConfigSchema } from "./config-schema-B3uU2qBS.mjs";
 import { c as validatePrivateKey, l as DEFAULT_RELAYS } from "./setup-adapter-KJ_iGKiG.mjs";
-import { t as normalizeNostrStateAccountId } from "./state-account-id-CvBZ9s6P.mjs";
 import { describeAccountSnapshot } from "openclaw/plugin-sdk/account-helpers";
 import { createScopedDmSecurityResolver, createTopLevelChannelConfigAdapter } from "openclaw/plugin-sdk/channel-config-helpers";
 import { createChatChannelPlugin } from "openclaw/plugin-sdk/channel-core";
 import { missingTargetError } from "openclaw/plugin-sdk/channel-feedback";
 import { DEFAULT_INGRESS_ADOPTION_STALL_MS, bindIngressLifecycleToReplyOptions, createChannelIngressError, createChannelIngressMonitor, createChannelMessageAdapterFromOutbound, runPassiveAccountLifecycle } from "openclaw/plugin-sdk/channel-outbound";
+import { DEFAULT_ACCOUNT_ID, buildChannelConfigSchema, formatPairingApproveHint } from "openclaw/plugin-sdk/channel-plugin-common";
 import { buildPassiveChannelStatusSummary, buildTrafficStatusSummary } from "openclaw/plugin-sdk/extension-shared";
-import { createComputedAccountStatusAdapter } from "openclaw/plugin-sdk/status-helpers";
-import { isRecord as isNostrIngressRecord, normalizeStringEntries } from "openclaw/plugin-sdk/string-coerce-runtime";
-import { resolveStableChannelMessageIngress } from "openclaw/plugin-sdk/channel-ingress-runtime";
+import { collectStatusIssuesFromLastError, createComputedAccountStatusAdapter, createDefaultChannelRuntimeState } from "openclaw/plugin-sdk/status-helpers";
+import { isRecord, normalizeStringEntries } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { createChannelPairingController } from "openclaw/plugin-sdk/channel-pairing";
 import { attachChannelToResult } from "openclaw/plugin-sdk/channel-send-result";
 import { channelReadyPatch } from "openclaw/plugin-sdk/gateway-runtime";
@@ -23,6 +22,7 @@ import { retryAsync } from "openclaw/plugin-sdk/retry-runtime";
 import { sleepWithAbort } from "openclaw/plugin-sdk/runtime-env";
 import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
 import { createPluginRuntimeStore } from "openclaw/plugin-sdk/runtime-store";
+import { withTimeout } from "openclaw/plugin-sdk/time-runtime";
 import { buildChannelOutboundSessionRoute, stripChannelTargetPrefix } from "openclaw/plugin-sdk/core";
 //#region extensions/nostr/src/metrics.ts
 function createZeroMetricsState() {
@@ -103,118 +103,59 @@ function createMetrics(onMetric) {
 		}
 		return relay;
 	}
+	const relayMetric = (update) => (value, relayUrl) => {
+		if (relayUrl) update(getOrCreateRelay(relayUrl), value);
+	};
+	const updates = /* @__PURE__ */ new Map([
+		["event.received", (value) => state.eventsReceived += value],
+		["event.processed", (value) => state.eventsProcessed += value],
+		["event.duplicate", (value) => state.eventsDuplicate += value],
+		["event.rejected.invalid_shape", (value) => state.eventsRejected.invalidShape += value],
+		["event.rejected.wrong_kind", (value) => state.eventsRejected.wrongKind += value],
+		["event.rejected.stale", (value) => state.eventsRejected.stale += value],
+		["event.rejected.future", (value) => state.eventsRejected.future += value],
+		["event.rejected.rate_limited", (value) => state.eventsRejected.rateLimited += value],
+		["event.rejected.invalid_signature", (value) => state.eventsRejected.invalidSignature += value],
+		["event.rejected.oversized_ciphertext", (value) => state.eventsRejected.oversizedCiphertext += value],
+		["event.rejected.oversized_plaintext", (value) => state.eventsRejected.oversizedPlaintext += value],
+		["event.rejected.decrypt_failed", (value) => state.eventsRejected.decryptFailed += value],
+		["event.rejected.self_message", (value) => state.eventsRejected.selfMessage += value],
+		["rate_limit.per_sender", (value) => state.rateLimiting.perSenderHits += value],
+		["rate_limit.global", (value) => state.rateLimiting.globalHits += value],
+		["decrypt.success", (value) => state.decrypt.success += value],
+		["decrypt.failure", (value) => state.decrypt.failure += value],
+		["memory.seen_tracker_size", (value) => state.memory.seenTrackerSize = value],
+		["memory.rate_limiter_entries", (value) => state.memory.rateLimiterEntries = value],
+		["relay.connect", relayMetric((relay, value) => relay.connects += value)],
+		["relay.disconnect", relayMetric((relay, value) => relay.disconnects += value)],
+		["relay.reconnect", relayMetric((relay, value) => relay.reconnects += value)],
+		["relay.error", relayMetric((relay, value) => relay.errors += value)],
+		["relay.message.event", relayMetric((relay, value) => relay.messagesReceived.event += value)],
+		["relay.message.eose", relayMetric((relay, value) => relay.messagesReceived.eose += value)],
+		["relay.message.closed", relayMetric((relay, value) => relay.messagesReceived.closed += value)],
+		["relay.message.notice", relayMetric((relay, value) => relay.messagesReceived.notice += value)],
+		["relay.message.ok", relayMetric((relay, value) => relay.messagesReceived.ok += value)],
+		["relay.message.auth", relayMetric((relay, value) => relay.messagesReceived.auth += value)],
+		["relay.circuit_breaker.open", relayMetric((relay, value) => {
+			relay.circuitBreakerState = "open";
+			relay.circuitBreakerOpens += value;
+		})],
+		["relay.circuit_breaker.close", relayMetric((relay, value) => {
+			relay.circuitBreakerState = "closed";
+			relay.circuitBreakerCloses += value;
+		})],
+		["relay.circuit_breaker.half_open", relayMetric((relay) => {
+			relay.circuitBreakerState = "half_open";
+		})]
+	]);
 	function emit(name, value = 1, labels) {
-		if (onMetric) onMetric({
+		onMetric?.({
 			name,
 			value,
 			timestamp: Date.now(),
 			labels
 		});
-		const relayUrl = labels?.relay;
-		switch (name) {
-			case "event.received":
-				state.eventsReceived += value;
-				break;
-			case "event.processed":
-				state.eventsProcessed += value;
-				break;
-			case "event.duplicate":
-				state.eventsDuplicate += value;
-				break;
-			case "event.rejected.invalid_shape":
-				state.eventsRejected.invalidShape += value;
-				break;
-			case "event.rejected.wrong_kind":
-				state.eventsRejected.wrongKind += value;
-				break;
-			case "event.rejected.stale":
-				state.eventsRejected.stale += value;
-				break;
-			case "event.rejected.future":
-				state.eventsRejected.future += value;
-				break;
-			case "event.rejected.rate_limited":
-				state.eventsRejected.rateLimited += value;
-				break;
-			case "event.rejected.invalid_signature":
-				state.eventsRejected.invalidSignature += value;
-				break;
-			case "event.rejected.oversized_ciphertext":
-				state.eventsRejected.oversizedCiphertext += value;
-				break;
-			case "event.rejected.oversized_plaintext":
-				state.eventsRejected.oversizedPlaintext += value;
-				break;
-			case "event.rejected.decrypt_failed":
-				state.eventsRejected.decryptFailed += value;
-				break;
-			case "event.rejected.self_message":
-				state.eventsRejected.selfMessage += value;
-				break;
-			case "relay.connect":
-				if (relayUrl) getOrCreateRelay(relayUrl).connects += value;
-				break;
-			case "relay.disconnect":
-				if (relayUrl) getOrCreateRelay(relayUrl).disconnects += value;
-				break;
-			case "relay.reconnect":
-				if (relayUrl) getOrCreateRelay(relayUrl).reconnects += value;
-				break;
-			case "relay.error":
-				if (relayUrl) getOrCreateRelay(relayUrl).errors += value;
-				break;
-			case "relay.message.event":
-				if (relayUrl) getOrCreateRelay(relayUrl).messagesReceived.event += value;
-				break;
-			case "relay.message.eose":
-				if (relayUrl) getOrCreateRelay(relayUrl).messagesReceived.eose += value;
-				break;
-			case "relay.message.closed":
-				if (relayUrl) getOrCreateRelay(relayUrl).messagesReceived.closed += value;
-				break;
-			case "relay.message.notice":
-				if (relayUrl) getOrCreateRelay(relayUrl).messagesReceived.notice += value;
-				break;
-			case "relay.message.ok":
-				if (relayUrl) getOrCreateRelay(relayUrl).messagesReceived.ok += value;
-				break;
-			case "relay.message.auth":
-				if (relayUrl) getOrCreateRelay(relayUrl).messagesReceived.auth += value;
-				break;
-			case "relay.circuit_breaker.open":
-				if (relayUrl) {
-					const r = getOrCreateRelay(relayUrl);
-					r.circuitBreakerState = "open";
-					r.circuitBreakerOpens += value;
-				}
-				break;
-			case "relay.circuit_breaker.close":
-				if (relayUrl) {
-					const r = getOrCreateRelay(relayUrl);
-					r.circuitBreakerState = "closed";
-					r.circuitBreakerCloses += value;
-				}
-				break;
-			case "relay.circuit_breaker.half_open":
-				if (relayUrl) getOrCreateRelay(relayUrl).circuitBreakerState = "half_open";
-				break;
-			case "rate_limit.per_sender":
-				state.rateLimiting.perSenderHits += value;
-				break;
-			case "rate_limit.global":
-				state.rateLimiting.globalHits += value;
-				break;
-			case "decrypt.success":
-				state.decrypt.success += value;
-				break;
-			case "decrypt.failure":
-				state.decrypt.failure += value;
-				break;
-			case "memory.seen_tracker_size":
-				state.memory.seenTrackerSize = value;
-				break;
-			case "memory.rate_limiter_entries": state.memory.rateLimiterEntries = value;
-		}
+		updates.get(name)?.(value, labels?.relay);
 	}
 	function getSnapshot() {
 		return createMetricsSnapshot(state);
@@ -384,7 +325,7 @@ function requiredString(value, field) {
 	throw new NostrIngressPermanentError("invalid-event", `Nostr event is missing ${field}.`);
 }
 function inspectNostrIngressEvent(event) {
-	if (!isNostrIngressRecord(event)) throw new NostrIngressPermanentError("invalid-event", "Nostr event must be an object.");
+	if (!isRecord(event)) throw new NostrIngressPermanentError("invalid-event", "Nostr event must be an object.");
 	return {
 		eventId: requiredString(event.id, "id"),
 		laneKey: `direct:${requiredString(event.pubkey, "pubkey")}`
@@ -433,8 +374,7 @@ function deserializeNostrIngressEvent(rawEvent, claimedId) {
 	} catch (error) {
 		throw new NostrIngressPermanentError("invalid-event", `Nostr ingress row ${claimedId} contains invalid JSON.`, { cause: error });
 	}
-	if (!isNostrIngressRecord(parsed)) throw new NostrIngressPermanentError("invalid-event", `Nostr ingress row ${claimedId} has an invalid event shape.`);
-	if (typeof parsed.kind !== "number" || typeof parsed.created_at !== "number" || typeof parsed.content !== "string" || typeof parsed.sig !== "string" || !Array.isArray(parsed.tags)) throw new NostrIngressPermanentError("invalid-event", `Nostr ingress row ${claimedId} has an invalid event shape.`);
+	if (!isRecord(parsed) || typeof parsed.kind !== "number" || typeof parsed.created_at !== "number" || typeof parsed.content !== "string" || typeof parsed.sig !== "string" || !Array.isArray(parsed.tags)) throw new NostrIngressPermanentError("invalid-event", `Nostr ingress row ${claimedId} has an invalid event shape.`);
 	return parsed;
 }
 function createNostrIngress(options) {
@@ -482,7 +422,7 @@ function createNostrIngress(options) {
 			},
 			createClaimError: (kind, claim) => new NostrIngressPermanentError("invalid-event", kind === "invalid-version" ? `Nostr ingress row ${claim.id} has an unsupported version.` : `Nostr ingress row ${claim.id} changed event identity.`)
 		},
-		deliver: (event, lifecycle) => options.deliver(event, lifecycle),
+		deliver: options.deliver,
 		pollIntervalMs: options.pollIntervalMs ?? NOSTR_INGRESS_POLL_INTERVAL_MS,
 		retention: {
 			completedMaxEntries: 1e5,
@@ -612,6 +552,16 @@ function createNostrIngress(options) {
 }
 //#endregion
 //#region extensions/nostr/src/nostr-profile-core.ts
+const PROFILE_FIELDS = [
+	["name", "name"],
+	["displayName", "display_name"],
+	["about", "about"],
+	["picture", "picture"],
+	["banner", "banner"],
+	["website", "website"],
+	["nip05", "nip05"],
+	["lud16", "lud16"]
+];
 /**
 * Convert our config profile schema to NIP-01 content format.
 * Strips undefined fields and validates URLs.
@@ -619,14 +569,10 @@ function createNostrIngress(options) {
 function profileToContent(profile) {
 	const validated = NostrProfileSchema.parse(profile);
 	const content = {};
-	if (validated.name !== void 0) content.name = validated.name;
-	if (validated.displayName !== void 0) content.display_name = validated.displayName;
-	if (validated.about !== void 0) content.about = validated.about;
-	if (validated.picture !== void 0) content.picture = validated.picture;
-	if (validated.banner !== void 0) content.banner = validated.banner;
-	if (validated.website !== void 0) content.website = validated.website;
-	if (validated.nip05 !== void 0) content.nip05 = validated.nip05;
-	if (validated.lud16 !== void 0) content.lud16 = validated.lud16;
+	for (const [configKey, contentKey] of PROFILE_FIELDS) {
+		const value = validated[configKey];
+		if (value !== void 0) content[contentKey] = value;
+	}
 	return content;
 }
 /**
@@ -635,76 +581,36 @@ function profileToContent(profile) {
 */
 function contentToProfile(content) {
 	const profile = {};
-	if (content.name !== void 0) profile.name = content.name;
-	if (content.display_name !== void 0) profile.displayName = content.display_name;
-	if (content.about !== void 0) profile.about = content.about;
-	if (content.picture !== void 0) profile.picture = content.picture;
-	if (content.banner !== void 0) profile.banner = content.banner;
-	if (content.website !== void 0) profile.website = content.website;
-	if (content.nip05 !== void 0) profile.nip05 = content.nip05;
-	if (content.lud16 !== void 0) profile.lud16 = content.lud16;
+	for (const [configKey, contentKey] of PROFILE_FIELDS) {
+		const value = content[contentKey];
+		if (value !== void 0) profile[configKey] = value;
+	}
 	return profile;
 }
 //#endregion
 //#region extensions/nostr/src/nostr-profile.ts
-/**
-* Nostr Profile Management (NIP-01 kind:0)
-*
-* Profile events are "replaceable" - the latest created_at wins.
-* This module handles profile event creation and publishing.
-*/
-/**
-* Create a signed kind:0 profile event.
-*
-* @param sk - Private key as Uint8Array (32 bytes)
-* @param profile - Profile data to include
-* @param lastPublishedAt - Previous profile timestamp (for monotonic guarantee)
-* @returns Signed Nostr event
-*/
-function createProfileEvent(sk, profile, lastPublishedAt) {
-	const content = profileToContent(profile);
-	const contentJson = JSON.stringify(content);
+const RELAY_PUBLISH_TIMEOUT_MS = 5e3;
+/** Publish one signed kind:0 event, reporting each relay's result without retrying. */
+async function publishProfile(pool, sk, relays, profile, lastPublishedAt) {
+	const content = JSON.stringify(profileToContent(profile));
 	const now = Math.floor(Date.now() / 1e3);
-	const createdAt = lastPublishedAt !== void 0 ? Math.max(now, lastPublishedAt + 1) : now;
-	return finalizeEvent({
+	const event = finalizeEvent({
 		kind: 0,
-		content: contentJson,
+		content,
 		tags: [],
-		created_at: createdAt
+		created_at: lastPublishedAt !== void 0 ? Math.max(now, lastPublishedAt + 1) : now
 	}, sk);
-}
-/** Per-relay publish timeout (ms) */
-const RELAY_PUBLISH_TIMEOUT_MS = 5e3;
-/**
-* Publish a profile event to multiple relays.
-*
-* Best-effort: publishes to all relays in parallel, reports per-relay results.
-* Does NOT retry automatically - caller should handle retries if needed.
-*
-* @param pool - SimplePool instance for relay connections
-* @param relays - Array of relay WebSocket URLs
-* @param event - Signed profile event (kind:0)
-* @returns Publish results with successes and failures
-*/
-async function publishProfileEvent(pool, relays, event) {
 	const successes = [];
 	const failures = [];
 	const publishPromises = relays.map(async (relay) => {
-		let timer;
 		try {
-			const timeoutPromise = new Promise((_, reject) => {
-				timer = setTimeout(() => reject(/* @__PURE__ */ new Error("timeout")), RELAY_PUBLISH_TIMEOUT_MS);
-			});
-			await Promise.race([pool.publish([relay], event)[0], timeoutPromise]);
+			await withTimeout(Promise.resolve(pool.publish([relay], event)[0]), RELAY_PUBLISH_TIMEOUT_MS, { message: "timeout" });
 			successes.push(relay);
 		} catch (err) {
-			const errorMessage = formatErrorMessage(err);
 			failures.push({
 				relay,
-				error: errorMessage
+				error: formatErrorMessage(err)
 			});
-		} finally {
-			if (timer) clearTimeout(timer);
 		}
 	});
 	await Promise.all(publishPromises);
@@ -715,19 +621,6 @@ async function publishProfileEvent(pool, relays, event) {
 		createdAt: event.created_at
 	};
 }
-/**
-* Create and publish a profile event in one call.
-*
-* @param pool - SimplePool instance
-* @param sk - Private key as Uint8Array
-* @param relays - Array of relay URLs
-* @param profile - Profile data
-* @param lastPublishedAt - Previous timestamp for monotonic ordering
-* @returns Publish results
-*/
-async function publishProfile(pool, sk, relays, profile, lastPublishedAt) {
-	return publishProfileEvent(pool, relays, createProfileEvent(sk, profile, lastPublishedAt));
-}
 //#endregion
 //#region extensions/nostr/src/nostr-relay-subscription.ts
 const DEFAULT_EOSE_CONFIRM_DEADLINE_MS = 1e4;
@@ -793,6 +686,13 @@ function createNostrRelaySubscriptionGroup(options) {
 	};
 }
 //#endregion
+//#region extensions/nostr/src/state-account-id.ts
+function normalizeNostrStateAccountId(accountId) {
+	const trimmed = accountId?.trim();
+	if (!trimmed) return "default";
+	return trimmed.replace(/[^a-z0-9._-]+/gi, "_");
+}
+//#endregion
 //#region extensions/nostr/src/nostr-state-store.ts
 const STORE_VERSION = 2;
 const PROFILE_STATE_VERSION = 1;
@@ -851,22 +751,19 @@ const STARTUP_LOOKBACK_SEC = 120;
 const STATE_PERSIST_DEBOUNCE_MS = 5e3;
 const NOSTR_INGRESS_ENVELOPE_OVERHEAD_BYTES = 16384;
 const NOSTR_INGRESS_MAX_PENDING_EVENTS = 1e3;
-const DEFAULT_INBOUND_GUARD_POLICY = createDirectDmPreCryptoGuardPolicy();
 const CIRCUIT_BREAKER_THRESHOLD = 5;
 const CIRCUIT_BREAKER_RESET_MS = 3e4;
 const HEALTH_WINDOW_MS = 6e4;
-function createCircuitBreaker(relay, metrics, threshold = CIRCUIT_BREAKER_THRESHOLD, resetMs = CIRCUIT_BREAKER_RESET_MS) {
+function createCircuitBreaker(relay, metrics) {
 	const state = {
 		state: "closed",
 		failures: 0,
-		lastFailure: 0,
-		lastSuccess: Date.now()
+		lastFailure: 0
 	};
 	return {
 		canAttempt() {
-			if (state.state === "closed") return true;
 			if (state.state === "open") {
-				if (Date.now() - state.lastFailure >= resetMs) {
+				if (Date.now() - state.lastFailure >= CIRCUIT_BREAKER_RESET_MS) {
 					state.state = "half_open";
 					metrics.emit("relay.circuit_breaker.half_open", 1, { relay });
 					return true;
@@ -881,21 +778,14 @@ function createCircuitBreaker(relay, metrics, threshold = CIRCUIT_BREAKER_THRESH
 				state.failures = 0;
 				metrics.emit("relay.circuit_breaker.close", 1, { relay });
 			} else if (state.state === "closed") state.failures = 0;
-			state.lastSuccess = Date.now();
 		},
 		recordFailure() {
 			state.failures++;
 			state.lastFailure = Date.now();
-			if (state.state === "half_open") {
-				state.state = "open";
-				metrics.emit("relay.circuit_breaker.open", 1, { relay });
-			} else if (state.state === "closed" && state.failures >= threshold) {
+			if (state.state === "half_open" || state.state === "closed" && state.failures >= CIRCUIT_BREAKER_THRESHOLD) {
 				state.state = "open";
 				metrics.emit("relay.circuit_breaker.open", 1, { relay });
 			}
-		},
-		getState() {
-			return state.state;
 		}
 	};
 }
@@ -908,7 +798,6 @@ function createRelayHealthTracker() {
 				successCount: 0,
 				failureCount: 0,
 				latencySum: 0,
-				latencyCount: 0,
 				lastSuccess: 0,
 				lastFailure: 0
 			};
@@ -921,7 +810,6 @@ function createRelayHealthTracker() {
 			const s = getOrCreate(relay);
 			s.successCount++;
 			s.latencySum += latencyMs;
-			s.latencyCount++;
 			s.lastSuccess = Date.now();
 		},
 		recordFailure(relay) {
@@ -937,18 +825,16 @@ function createRelayHealthTracker() {
 			const successRate = s.successCount / total;
 			const now = Date.now();
 			const recencyBonus = s.lastSuccess > s.lastFailure ? Math.max(0, 1 - (now - s.lastSuccess) / HEALTH_WINDOW_MS) * .2 : 0;
-			const avgLatency = s.latencyCount > 0 ? s.latencySum / s.latencyCount : 1e3;
+			const avgLatency = s.successCount > 0 ? s.latencySum / s.successCount : 1e3;
 			const latencyPenalty = Math.min(.2, avgLatency / 1e4);
 			return Math.max(0, Math.min(1, successRate + recencyBonus - latencyPenalty));
 		},
 		getSortedRelays(relays) {
-			return [...relays].toSorted((a, b) => this.getScore(b) - this.getScore(a));
+			return relays.toSorted((a, b) => this.getScore(b) - this.getScore(a));
 		}
 	};
 }
-/**
-* Start the Nostr DM bus - subscribes to NIP-04 encrypted DMs
-*/
+/** Subscribe to NIP-04 encrypted DMs. */
 async function startNostrBus(options) {
 	const { privateKey, relays = DEFAULT_RELAYS, onMessage, authorizeSender, onError, onEose, onMetric } = options;
 	const sk = validatePrivateKey(privateKey);
@@ -957,14 +843,7 @@ async function startNostrBus(options) {
 	pool.onRelayConnectionSuccess = options.onConnect;
 	const accountId = options.accountId ?? pk.slice(0, 16);
 	const gatewayStartedAt = Math.floor(Date.now() / 1e3);
-	const guardPolicy = createDirectDmPreCryptoGuardPolicy({
-		...DEFAULT_INBOUND_GUARD_POLICY,
-		...options.guardPolicy,
-		rateLimit: {
-			...DEFAULT_INBOUND_GUARD_POLICY.rateLimit,
-			...options.guardPolicy?.rateLimit
-		}
-	});
+	const guardPolicy = createDirectDmPreCryptoGuardPolicy(options.guardPolicy);
 	const metrics = onMetric ? createMetrics(onMetric) : createNoopMetrics();
 	const circuitBreakers = /* @__PURE__ */ new Map();
 	const healthTracker = createRelayHealthTracker();
@@ -1005,27 +884,15 @@ async function startNostrBus(options) {
 	const updateRateLimiterSizeMetric = () => {
 		metrics.emit("memory.rate_limiter_entries", perSenderRateLimiter.size() + globalRateLimiter.size());
 	};
-	const rejectIfGlobalRateLimited = () => {
-		updateRateLimiterSizeMetric();
-		if (globalRateLimiter.isRateLimited("global")) {
-			metrics.emit("rate_limit.global");
-			metrics.emit("event.rejected.rate_limited");
-			updateRateLimiterSizeMetric();
-			return true;
-		}
-		updateRateLimiterSizeMetric();
-		return false;
-	};
-	const rejectIfVerifiedSenderRateLimited = (senderPubkey) => {
+	const rejectIfRateLimited = (limiter, key, metric) => {
 		updateRateLimiterSizeMetric();
-		if (perSenderRateLimiter.isRateLimited(senderPubkey)) {
-			metrics.emit("rate_limit.per_sender");
+		const limited = limiter.isRateLimited(key);
+		if (limited) {
+			metrics.emit(metric);
 			metrics.emit("event.rejected.rate_limited");
-			updateRateLimiterSizeMetric();
-			return true;
 		}
 		updateRateLimiterSizeMetric();
-		return false;
+		return limited;
 	};
 	async function dispatchEvent(event, lifecycle) {
 		if (event.pubkey === pk) {
@@ -1040,12 +907,7 @@ async function startNostrBus(options) {
 			metrics.emit("event.rejected.wrong_kind");
 			return;
 		}
-		let targetsUs = false;
-		for (const tag of event.tags) if (tag[0] === "p" && tag[1] === pk) {
-			targetsUs = true;
-			break;
-		}
-		if (!targetsUs) {
+		if (!event.tags.some((tag) => tag[0] === "p" && tag[1] === pk)) {
 			metrics.emit("event.rejected.wrong_kind");
 			return;
 		}
@@ -1053,18 +915,18 @@ async function startNostrBus(options) {
 			await sendEncryptedDm(pool, sk, event.pubkey, text, relays, metrics, circuitBreakers, healthTracker, onError, { replyToEventId: event.id });
 		};
 		if (Buffer.byteLength(event.content, "utf8") > guardPolicy.maxCiphertextBytes) {
-			if (rejectIfGlobalRateLimited()) throw new Error(`Nostr event ${event.id} hit the global rate limit.`);
+			if (rejectIfRateLimited(globalRateLimiter, "global", "rate_limit.global")) throw new Error(`Nostr event ${event.id} hit the global rate limit.`);
 			metrics.emit("event.rejected.oversized_ciphertext");
 			return;
 		}
-		if (rejectIfGlobalRateLimited()) throw new Error(`Nostr event ${event.id} hit the global rate limit.`);
+		if (rejectIfRateLimited(globalRateLimiter, "global", "rate_limit.global")) throw new Error(`Nostr event ${event.id} hit the global rate limit.`);
 		if (!verifyEvent(event)) {
 			metrics.emit("event.rejected.invalid_signature");
 			const error = new NostrIngressPermanentError("invalid-signature", `Nostr event ${event.id} has an invalid signature.`);
 			onError?.(error, `event ${event.id}`);
 			throw error;
 		}
-		if (rejectIfVerifiedSenderRateLimited(event.pubkey)) throw new Error(`Nostr sender ${event.pubkey} hit the rate limit.`);
+		if (rejectIfRateLimited(perSenderRateLimiter, event.pubkey, "rate_limit.per_sender")) throw new Error(`Nostr sender ${event.pubkey} hit the rate limit.`);
 		if (authorizeSender) {
 			if (await authorizeSender({
 				senderPubkey: event.pubkey,
@@ -1138,9 +1000,6 @@ async function startNostrBus(options) {
 		const cursor = durableCursor.recordTransientRejection(event);
 		if (cursor !== void 0) await cursorWriter.persistNow(cursor);
 	};
-	const recoverCursorPersistence = async () => {
-		await cursorWriter.flushUntilSuccess();
-	};
 	const handleRelayEvent = async (event) => {
 		metrics.emit("event.received");
 		if (typeof event.created_at === "number" && event.created_at < since) {
@@ -1161,7 +1020,7 @@ async function startNostrBus(options) {
 				} catch (cursorError) {
 					onError?.(cursorError, "persist transient replay cursor");
 					await stopRelays("cursor persistence failed");
-					await recoverCursorPersistence();
+					await cursorWriter.flushUntilSuccess();
 				}
 				return;
 			}
@@ -1174,7 +1033,7 @@ async function startNostrBus(options) {
 				cursorPersistenceFailed = true;
 			}
 			await stopRelays("durable admission failed");
-			if (cursorPersistenceFailed) await recoverCursorPersistence();
+			if (cursorPersistenceFailed) await cursorWriter.flushUntilSuccess();
 		}
 	};
 	let backfillFinalizePromise;
@@ -1214,9 +1073,6 @@ async function startNostrBus(options) {
 		await Promise.allSettled([stopRelays("startup failed"), ingress.stop()]);
 		throw error;
 	}
-	const sendDm = async (toPubkey, text, sendOptions) => {
-		return await sendEncryptedDm(pool, sk, toPubkey, text, relays, metrics, circuitBreakers, healthTracker, onError, sendOptions);
-	};
 	const publishProfile$1 = async (profile) => {
 		const lastPublishedAt = (await readNostrProfileState({ accountId }))?.lastPublishedAt ?? void 0;
 		const result = await publishProfile(pool, sk, relays, profile, lastPublishedAt);
@@ -1254,15 +1110,12 @@ async function startNostrBus(options) {
 	return {
 		close,
 		publicKey: pk,
-		sendDm,
+		sendDm: (toPubkey, text, sendOptions) => sendEncryptedDm(pool, sk, toPubkey, text, relays, metrics, circuitBreakers, healthTracker, onError, sendOptions),
 		getMetrics: () => metrics.getSnapshot(),
 		publishProfile: publishProfile$1,
 		getProfileState
 	};
 }
-/**
-* Send an encrypted DM to a pubkey
-*/
 async function sendEncryptedDm(pool, sk, toPubkey, text, relays, metrics, circuitBreakers, healthTracker, onError, options) {
 	const ciphertext = encrypt(sk, toPubkey, text);
 	const tags = [["p", toPubkey]];
@@ -1367,7 +1220,7 @@ const startNostrGatewayAccount = async (ctx) => {
 		channel: "nostr",
 		accountId: account.accountId
 	});
-	const resolveInboundAccess = async (senderPubkey, rawBody, contextBinding) => await resolveStableChannelMessageIngress({
+	const resolveInboundAccess = async (senderPubkey, rawBody, contextBinding) => await channelRuntime.inbound.ingress.resolveStable({
 		channelId: "nostr",
 		accountId: account.accountId,
 		identity: nostrIngressIdentity,
@@ -1421,7 +1274,7 @@ const startNostrGatewayAccount = async (ctx) => {
 						ctx.log?.warn?.(`[${account.accountId}] dropping Nostr DM after preflight drift (${senderPubkey}, ${resolvedAccess.senderAccess.reasonCode})`);
 						return;
 					}
-					const { dispatchInboundDirectDm } = await import("./inbound-direct-dm-runtime-DHn9NoYN.mjs");
+					const { dispatchInboundDirectDm } = await import("openclaw/plugin-sdk/channel-inbound");
 					await dispatchInboundDirectDm({
 						channelRuntime,
 						resolveChannelIngress: async (contextBinding) => {
@@ -1447,8 +1300,7 @@ const startNostrGatewayAccount = async (ctx) => {
 						commandAuthorized: resolvedAccess.commandAccess.requested ? resolvedAccess.commandAccess.authorized : void 0,
 						turnAdoptionLifecycle: bindIngressLifecycleToReplyOptions(lifecycle).turnAdoptionLifecycle,
 						deliver: async (payload) => {
-							const outboundText = payload && typeof payload === "object" && "text" in payload ? payload.text ?? "" : "";
-							const sanitizedText = sanitizeAssistantVisibleText(outboundText);
+							const sanitizedText = sanitizeAssistantVisibleText(payload.text ?? "");
 							if (!sanitizedText) return;
 							const tableMode = runtime.channel.text.resolveMarkdownTableMode({
 								cfg: ctx.cfg,
@@ -1628,10 +1480,7 @@ const nostrConfigAdapter = createTopLevelChannelConfigAdapter({
 		"profile"
 	],
 	resolveAllowFrom: (account) => account.config.allowFrom,
-	formatAllowFrom: (allowFrom) => normalizeStringEntries(allowFrom).map((entry) => {
-		if (entry === "*") return "*";
-		return normalizeNostrTarget(entry);
-	}).filter(Boolean)
+	formatAllowFrom: (allowFrom) => normalizeStringEntries(allowFrom).map(normalizeNostrTarget).filter(Boolean)
 });
 const nostrMessageAdapter = createChannelMessageAdapterFromOutbound({
 	id: "nostr",
@@ -1699,10 +1548,10 @@ const nostrPlugin = createChatChannelPlugin({
 				},
 				hint: NOSTR_TARGET_HINT
 			},
-			resolveOutboundSessionRoute: (params) => resolveNostrOutboundSessionRoute(params)
+			resolveOutboundSessionRoute: resolveNostrOutboundSessionRoute
 		},
 		message: nostrMessageAdapter,
-		status: { ...createComputedAccountStatusAdapter({
+		status: createComputedAccountStatusAdapter({
 			defaultRuntime: createDefaultChannelRuntimeState(DEFAULT_ACCOUNT_ID),
 			collectStatusIssues: (accounts) => collectStatusIssuesFromLastError("nostr", accounts),
 			buildChannelSummary: ({ snapshot }) => buildPassiveChannelStatusSummary(snapshot, { publicKey: snapshot.publicKey ?? null }),
@@ -1717,31 +1566,19 @@ const nostrPlugin = createChatChannelPlugin({
 					...buildTrafficStatusSummary(runtime)
 				}
 			})
-		}) },
+		}),
 		gateway: { startAccount: startNostrGatewayAccount }
 	},
 	pairing: { text: nostrPairingTextAdapter },
 	security: { resolveDmPolicy: resolveNostrDmPolicy },
 	outbound: nostrPluginOutboundAdapter
 });
-/**
-* Publish a profile (kind:0) for a Nostr account.
-* @param accountId - Account ID (defaults to "default")
-* @param profile - Profile data to publish
-* @returns Publish results with successes and failures
-* @throws Error if account is not running
-*/
 async function publishNostrProfile(accountId, profile) {
 	const resolvedAccountId = accountId ?? DEFAULT_ACCOUNT_ID;
 	const bus = getActiveNostrBuses().get(resolvedAccountId);
 	if (!bus) throw new Error(`Nostr bus not running for account ${resolvedAccountId}`);
 	return bus.publishProfile(profile);
 }
-/**
-* Get profile publish state for a Nostr account.
-* @param accountId - Account ID (defaults to "default")
-* @returns Profile publish state or null if account not running
-*/
 async function getNostrProfileState(accountId = DEFAULT_ACCOUNT_ID) {
 	const bus = getActiveNostrBuses().get(accountId);
 	if (!bus) return null;