@openclaw/nostr 2026.9.8 → 2026.10.1-beta.1

package/dist/.setup/{channel-D2d-FP8G.mjs → channel-BaBU_Q15.mjs}

@@ -1,6 +1,6 @@
-import { a as listNostrAccountIds, c as normalizePubkey, n as nostrSetupContract, o as resolveDefaultNostrAccountId, r as nostrSetupWizard, s as resolveNostrAccount } from "./setup-surface-Dx8QxWSP.mjs";
-import { n as NostrProfileSchema, t as NostrConfigSchema } from "./config-schema-B3uU2qBS.mjs";
-import { c as validatePrivateKey, l as DEFAULT_RELAYS } from "./setup-adapter-KJ_iGKiG.mjs";
+import { a as listNostrAccountIds, c as normalizePubkey, n as nostrSetupContract, o as resolveDefaultNostrAccountId, r as nostrSetupWizard, s as resolveNostrAccount } from "./setup-surface-b-YWJSGV.mjs";
+import { n as NostrProfileSchema, t as NostrConfigSchema } from "./config-schema-HuEK1L2K.mjs";
+import { l as validatePrivateKey, u as DEFAULT_RELAYS } from "./setup-adapter-I55hhpDp.mjs";
 import { describeAccountSnapshot } from "openclaw/plugin-sdk/account-helpers";
 import { createScopedDmSecurityResolver, createTopLevelChannelConfigAdapter } from "openclaw/plugin-sdk/channel-config-helpers";
 import { createChatChannelPlugin } from "openclaw/plugin-sdk/channel-core";
@@ -10,6 +10,7 @@ import { DEFAULT_ACCOUNT_ID, buildChannelConfigSchema, formatPairingApproveHint
 import { buildPassiveChannelStatusSummary, buildTrafficStatusSummary } from "openclaw/plugin-sdk/extension-shared";
 import { collectStatusIssuesFromLastError, createComputedAccountStatusAdapter, createDefaultChannelRuntimeState } from "openclaw/plugin-sdk/status-helpers";
 import { isRecord, normalizeStringEntries } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { parseAccessGroupAllowFromEntry } from "openclaw/plugin-sdk/access-groups";
 import { createChannelPairingController } from "openclaw/plugin-sdk/channel-pairing";
 import { attachChannelToResult } from "openclaw/plugin-sdk/channel-send-result";
 import { channelReadyPatch } from "openclaw/plugin-sdk/gateway-runtime";
@@ -169,9 +170,6 @@ function createMetrics(onMetric) {
 		reset
 	};
 }
-/**
-* Create a no-op metrics instance (for when metrics are disabled).
-*/
 function createNoopMetrics() {
 	const emptySnapshot = createMetricsSnapshot(createZeroMetricsState(), 0);
 	return {
@@ -313,13 +311,7 @@ function createNostrCursorStateWriter(options) {
 		}
 	};
 }
-var NostrIngressPermanentError = class extends Error {
-	constructor(reason, message, options) {
-		super(message, options);
-		this.reason = reason;
-		this.name = "NostrIngressPermanentError";
-	}
-};
+const NostrIngressPermanentError = createChannelIngressError("NostrIngressPermanentError", { withReason: true });
 function requiredString(value, field) {
 	if (typeof value === "string" && value.trim()) return value;
 	throw new NostrIngressPermanentError("invalid-event", `Nostr event is missing ${field}.`);
@@ -624,7 +616,6 @@ async function publishProfile(pool, sk, relays, profile, lastPublishedAt) {
 //#endregion
 //#region extensions/nostr/src/nostr-relay-subscription.ts
 const DEFAULT_EOSE_CONFIRM_DEADLINE_MS = 1e4;
-const LIBRARY_EOSE_TIMEOUT_MARGIN_MS = 1e3;
 /** Separates real relay EOSE frames from nostr-tools timeout/close synthesis. */
 function createNostrRelaySubscriptionGroup(options) {
 	const relays = [...new Set(options.relays)];
@@ -632,7 +623,7 @@ function createNostrRelaySubscriptionGroup(options) {
 	const deadlineTimers = /* @__PURE__ */ new Set();
 	let locallyClosing = false;
 	const backfillStatus = new Map(relays.map((relay) => [relay, "pending"]));
-	const confirmDeadlineMs = options.eoseConfirmDeadlineMs ?? DEFAULT_EOSE_CONFIRM_DEADLINE_MS;
+	const confirmDeadlineMs = DEFAULT_EOSE_CONFIRM_DEADLINE_MS;
 	const settleBackfill = (relay, status) => {
 		if (backfillStatus.get(relay) !== "pending") return;
 		backfillStatus.set(relay, status);
@@ -673,7 +664,7 @@ function createNostrRelaySubscriptionGroup(options) {
 						settleBackfill(relay, "incomplete");
 						if (!locallyClosing && !options.abort.aborted) options.onClose(relay, reasons.map(({ reason }) => reason));
 					},
-					maxWait: confirmDeadlineMs + LIBRARY_EOSE_TIMEOUT_MARGIN_MS,
+					maxWait: 11e3,
 					abort: options.abort
 				}));
 			}
@@ -912,7 +903,7 @@ async function startNostrBus(options) {
 			return;
 		}
 		const replyTo = async (text) => {
-			await sendEncryptedDm(pool, sk, event.pubkey, text, relays, metrics, circuitBreakers, healthTracker, onError, { replyToEventId: event.id });
+			await sendEncryptedDm(event.pubkey, text, { replyToEventId: event.id });
 		};
 		if (Buffer.byteLength(event.content, "utf8") > guardPolicy.maxCiphertextBytes) {
 			if (rejectIfRateLimited(globalRateLimiter, "global", "rate_limit.global")) throw new Error(`Nostr event ${event.id} hit the global rate limit.`);
@@ -1107,81 +1098,75 @@ async function startNostrBus(options) {
 		})();
 		return closePromise;
 	};
+	async function sendEncryptedDm(toPubkey, text, sendOptions) {
+		const ciphertext = encrypt(sk, toPubkey, text);
+		const tags = [["p", toPubkey]];
+		if (sendOptions?.replyToEventId) tags.push(["e", sendOptions.replyToEventId]);
+		const reply = finalizeEvent({
+			kind: 4,
+			content: ciphertext,
+			tags,
+			created_at: Math.floor(Date.now() / 1e3)
+		}, sk);
+		const sortedRelays = healthTracker.getSortedRelays(relays);
+		let lastError;
+		for (const relay of sortedRelays) {
+			sendOptions?.assertDirectAdapterHandoff?.();
+			const cb = circuitBreakers.get(relay);
+			if (cb && !cb.canAttempt()) continue;
+			const startTime = Date.now();
+			const recordFailure = (err) => {
+				lastError = err instanceof Error ? err : new Error(String(err));
+				const latency = Date.now() - startTime;
+				cb?.recordFailure();
+				healthTracker.recordFailure(relay);
+				metrics.emit("relay.error", 1, {
+					relay,
+					latency
+				});
+				onError?.(lastError, `publish to ${relay}`);
+			};
+			const connection = await pool.ensureRelay(relay, { connectionTimeout: pool.maxWaitForConnection }).catch((err) => {
+				recordFailure(/* @__PURE__ */ new Error(`connection failure: ${String(err)}`));
+			});
+			if (!connection) continue;
+			sendOptions?.assertDirectAdapterHandoff?.();
+			if (sendOptions?.onPlatformSendDispatch) {
+				await sendOptions.onPlatformSendDispatch();
+				sendOptions.assertDirectAdapterHandoff?.();
+			}
+			try {
+				await connection.publish(reply);
+				const latency = Date.now() - startTime;
+				cb?.recordSuccess();
+				healthTracker.recordSuccess(relay, latency);
+				return reply.id;
+			} catch (err) {
+				recordFailure(err);
+			}
+		}
+		throw new Error(`Failed to publish to any relay: ${lastError?.message}`);
+	}
 	return {
 		close,
 		publicKey: pk,
-		sendDm: (toPubkey, text, sendOptions) => sendEncryptedDm(pool, sk, toPubkey, text, relays, metrics, circuitBreakers, healthTracker, onError, sendOptions),
+		sendDm: sendEncryptedDm,
 		getMetrics: () => metrics.getSnapshot(),
 		publishProfile: publishProfile$1,
 		getProfileState
 	};
 }
-async function sendEncryptedDm(pool, sk, toPubkey, text, relays, metrics, circuitBreakers, healthTracker, onError, options) {
-	const ciphertext = encrypt(sk, toPubkey, text);
-	const tags = [["p", toPubkey]];
-	if (options?.replyToEventId) tags.push(["e", options.replyToEventId]);
-	const reply = finalizeEvent({
-		kind: 4,
-		content: ciphertext,
-		tags,
-		created_at: Math.floor(Date.now() / 1e3)
-	}, sk);
-	const sortedRelays = healthTracker.getSortedRelays(relays);
-	let lastError;
-	for (const relay of sortedRelays) {
-		options?.assertDirectAdapterHandoff?.();
-		const cb = circuitBreakers.get(relay);
-		if (cb && !cb.canAttempt()) continue;
-		const startTime = Date.now();
-		const recordFailure = (err) => {
-			lastError = err instanceof Error ? err : new Error(String(err));
-			const latency = Date.now() - startTime;
-			cb?.recordFailure();
-			healthTracker.recordFailure(relay);
-			metrics.emit("relay.error", 1, {
-				relay,
-				latency
-			});
-			onError?.(lastError, `publish to ${relay}`);
-		};
-		const connection = await pool.ensureRelay(relay, { connectionTimeout: pool.maxWaitForConnection }).catch((err) => {
-			recordFailure(/* @__PURE__ */ new Error(`connection failure: ${String(err)}`));
-		});
-		if (!connection) continue;
-		options?.assertDirectAdapterHandoff?.();
-		if (options?.onPlatformSendDispatch) {
-			await options.onPlatformSendDispatch();
-			options.assertDirectAdapterHandoff?.();
-		}
-		try {
-			await connection.publish(reply);
-			const latency = Date.now() - startTime;
-			cb?.recordSuccess();
-			healthTracker.recordSuccess(relay, latency);
-			return reply.id;
-		} catch (err) {
-			recordFailure(err);
-		}
-	}
-	throw new Error(`Failed to publish to any relay: ${lastError?.message}`);
-}
 //#endregion
 //#region extensions/nostr/src/gateway.ts
 const activeBuses = /* @__PURE__ */ new Map();
-const ACCESS_GROUP_PREFIX = "accessGroup:";
 function normalizeRelayLifecycleKey(relay) {
 	return new URL(relay).toString();
 }
-function parseNostrAccessGroupAllowFromEntry(entry) {
-	const trimmed = entry.trim();
-	if (!trimmed.startsWith(ACCESS_GROUP_PREFIX)) return null;
-	return trimmed.slice(12).trim() || null;
-}
 function normalizeNostrAllowEntry(entry) {
 	const trimmed = entry.trim();
 	if (!trimmed) return null;
 	if (trimmed === "*") return "*";
-	const accessGroup = parseNostrAccessGroupAllowFromEntry(trimmed);
+	const accessGroup = parseAccessGroupAllowFromEntry(trimmed);
 	if (accessGroup) return `accessGroup:${accessGroup}`;
 	try {
 		return normalizePubkey(trimmed.replace(/^nostr:/i, ""));
@@ -1494,11 +1479,10 @@ const nostrPluginOutboundAdapter = {
 			ok: false,
 			error: missingTargetError("Nostr", NOSTR_TARGET_HINT)
 		};
-		const normalized = normalizeNostrTarget(trimmed);
 		try {
 			return {
 				ok: true,
-				to: normalizePubkey(normalized)
+				to: normalizePubkey(stripNostrTargetPrefix(trimmed))
 			};
 		} catch {
 			return {

package/dist/.setup/{config-schema-B3uU2qBS.mjs → config-schema-HuEK1L2K.mjs}

@@ -2,9 +2,6 @@ import { AllowFromListSchema, DmPolicySchema, MarkdownConfigSchema } from "openc
 import { buildSecretInputSchema } from "openclaw/plugin-sdk/secret-input";
 import { z } from "zod";
 //#region extensions/nostr/src/config-schema.ts
-/**
-* Validates https:// URLs only (no javascript:, data:, file:, etc.)
-*/
 const safeUrlSchema = z.string().url().refine((url) => {
 	try {
 		return new URL(url).protocol === "https:";
@@ -17,32 +14,22 @@ const safeUrlSchema = z.string().url().refine((url) => {
 * https://github.com/nostr-protocol/nips/blob/master/01.md
 */
 const NostrProfileSchema = z.object({
-	/** Username (NIP-01: name) - max 256 chars */
 	name: z.string().max(256).optional(),
-	/** Display name (NIP-01: display_name) - max 256 chars */
+	/** NIP-01 display_name. */
 	displayName: z.string().max(256).optional(),
-	/** Bio/description (NIP-01: about) - max 2000 chars */
 	about: z.string().max(2e3).optional(),
-	/** Profile picture URL (must be https) */
 	picture: safeUrlSchema.optional(),
-	/** Banner image URL (must be https) */
 	banner: safeUrlSchema.optional(),
-	/** Website URL (must be https) */
 	website: safeUrlSchema.optional(),
 	/** NIP-05 identifier (e.g., "user@example.com") */
 	nip05: z.string().optional(),
 	/** Lightning address (LUD-16) */
 	lud16: z.string().optional()
 });
-/**
-* Zod schema for channels.nostr.* configuration
-*/
 const NostrConfigSchema = z.object({
-	/** Account name (optional display name) */
 	name: z.string().optional(),
 	/** Optional default account id for routing/account selection. */
 	defaultAccount: z.string().optional(),
-	/** Whether this channel is enabled */
 	enabled: z.boolean().optional(),
 	configWrites: z.boolean().optional(),
 	/** Markdown formatting overrides (tables). */
@@ -51,7 +38,6 @@ const NostrConfigSchema = z.object({
 	privateKey: buildSecretInputSchema().optional(),
 	/** WebSocket relay URLs to connect to */
 	relays: z.array(z.string()).optional(),
-	/** DM access policy: pairing, allowlist, open, or disabled */
 	dmPolicy: DmPolicySchema.optional(),
 	/** Allowed sender pubkeys (npub or hex format) */
 	allowFrom: AllowFromListSchema,

package/dist/.setup/{setup-adapter-KJ_iGKiG.mjs → setup-adapter-I55hhpDp.mjs}

@@ -41,6 +41,34 @@ function resolveNostrPrivateKey(value) {
 	return process.env["NOSTR_PRIVATE_KEY"]?.trim() ?? "";
 }
 //#endregion
+//#region extensions/nostr/src/accounts.ts
+function getNostrConfig(cfg) {
+	return cfg.channels?.nostr;
+}
+function resolveNostrAccountBase(cfg, accountId) {
+	const nostrCfg = getNostrConfig(cfg);
+	const privateKey = resolveNostrPrivateKey(nostrCfg?.privateKey);
+	return {
+		accountId,
+		name: typeof nostrCfg?.name === "string" ? nostrCfg.name : void 0,
+		enabled: nostrCfg?.enabled !== false,
+		configured: hasConfiguredNostrPrivateKey(nostrCfg?.privateKey),
+		privateKey,
+		publicKey: "",
+		relays: nostrCfg?.relays ?? DEFAULT_RELAYS,
+		profile: nostrCfg?.profile,
+		config: {
+			enabled: nostrCfg?.enabled,
+			name: nostrCfg?.name,
+			privateKey: nostrCfg?.privateKey,
+			relays: nostrCfg?.relays,
+			dmPolicy: nostrCfg?.dmPolicy,
+			allowFrom: nostrCfg?.allowFrom,
+			profile: nostrCfg?.profile
+		}
+	};
+}
+//#endregion
 //#region extensions/nostr/src/setup-adapter.ts
 const channel = "nostr";
 function buildNostrSetupPatch(accountId, patch) {
@@ -155,4 +183,4 @@ function createNostrSetupStatus(resolveAccount) {
 	});
 }
 //#endregion
-export { parseRelayUrls as a, validatePrivateKey as c, createNostrSetupStatus as i, DEFAULT_RELAYS as l, createNostrSetupAdapter as n, hasConfiguredNostrPrivateKey as o, createNostrSetupContract as r, resolveNostrPrivateKey as s, buildNostrSetupPatch as t };
+export { parseRelayUrls as a, hasConfiguredNostrPrivateKey as c, createNostrSetupStatus as i, validatePrivateKey as l, createNostrSetupAdapter as n, getNostrConfig as o, createNostrSetupContract as r, resolveNostrAccountBase as s, buildNostrSetupPatch as t, DEFAULT_RELAYS as u };

package/dist/.setup/setup-plugin-api-BUsavy-i.mjs

@@ -0,0 +1,2 @@
+import { t as nostrSetupPlugin } from "./setup-plugin-api-C_HK3q8q.mjs";
+export { nostrSetupPlugin };

package/dist/.setup/{setup-plugin-api-Ci0XxWqb.mjs → setup-plugin-api-C_HK3q8q.mjs}

@@ -1,45 +1,21 @@
-import { t as NostrConfigSchema } from "./config-schema-B3uU2qBS.mjs";
-import { i as createNostrSetupStatus, l as DEFAULT_RELAYS, n as createNostrSetupAdapter, o as hasConfiguredNostrPrivateKey, r as createNostrSetupContract, s as resolveNostrPrivateKey } from "./setup-adapter-KJ_iGKiG.mjs";
+import { t as NostrConfigSchema } from "./config-schema-HuEK1L2K.mjs";
+import { i as createNostrSetupStatus, n as createNostrSetupAdapter, o as getNostrConfig, r as createNostrSetupContract, s as resolveNostrAccountBase } from "./setup-adapter-I55hhpDp.mjs";
 import { describeAccountSnapshot } from "openclaw/plugin-sdk/account-helpers";
 import { buildChannelConfigSchema } from "openclaw/plugin-sdk/channel-plugin-common";
 import { normalizeAccountId } from "openclaw/plugin-sdk/account-id";
 import { createDelegatedSetupWizardProxy } from "openclaw/plugin-sdk/setup-runtime";
 //#region extensions/nostr/src/channel.setup.ts
 const channel = "nostr";
-function getNostrConfig(cfg) {
-	return cfg.channels?.nostr;
-}
 function resolveDefaultSetupNostrAccountId(cfg) {
 	return normalizeAccountId(getNostrConfig(cfg)?.defaultAccount);
 }
 function resolveSetupNostrAccount(params) {
-	const nostrCfg = getNostrConfig(params.cfg);
 	const accountId = normalizeAccountId(params.accountId ?? resolveDefaultSetupNostrAccountId(params.cfg));
-	const privateKey = resolveNostrPrivateKey(nostrCfg?.privateKey);
-	const configured = hasConfiguredNostrPrivateKey(nostrCfg?.privateKey);
-	return {
-		accountId,
-		name: typeof nostrCfg?.name === "string" ? nostrCfg.name : void 0,
-		enabled: nostrCfg?.enabled !== false,
-		configured,
-		privateKey,
-		publicKey: "",
-		relays: nostrCfg?.relays ?? DEFAULT_RELAYS,
-		profile: nostrCfg?.profile,
-		config: {
-			enabled: nostrCfg?.enabled,
-			name: nostrCfg?.name,
-			privateKey: nostrCfg?.privateKey,
-			relays: nostrCfg?.relays,
-			dmPolicy: nostrCfg?.dmPolicy,
-			allowFrom: nostrCfg?.allowFrom,
-			profile: nostrCfg?.profile
-		}
-	};
+	return resolveNostrAccountBase(params.cfg, accountId);
 }
 const nostrSetupWizard = createDelegatedSetupWizardProxy({
 	channel,
-	loadWizard: async () => (await import("./setup-surface-Dx8QxWSP.mjs").then((n) => n.i)).nostrSetupWizard,
+	loadWizard: async () => (await import("./setup-surface-b-YWJSGV.mjs").then((n) => n.i)).nostrSetupWizard,
 	status: createNostrSetupStatus(resolveSetupNostrAccount),
 	resolveShouldPromptAccountIds: () => false,
 	delegatePrepare: true,

package/dist/.setup/{setup-surface-Dx8QxWSP.mjs → setup-surface-b-YWJSGV.mjs}

@@ -1,4 +1,4 @@
-import { a as parseRelayUrls, c as validatePrivateKey, i as createNostrSetupStatus, l as DEFAULT_RELAYS, n as createNostrSetupAdapter, o as hasConfiguredNostrPrivateKey, r as createNostrSetupContract, s as resolveNostrPrivateKey, t as buildNostrSetupPatch } from "./setup-adapter-KJ_iGKiG.mjs";
+import { a as parseRelayUrls, c as hasConfiguredNostrPrivateKey, i as createNostrSetupStatus, l as validatePrivateKey, n as createNostrSetupAdapter, o as getNostrConfig, r as createNostrSetupContract, s as resolveNostrAccountBase, t as buildNostrSetupPatch, u as DEFAULT_RELAYS } from "./setup-adapter-I55hhpDp.mjs";
 import { createAccountListHelpers } from "openclaw/plugin-sdk/account-helpers";
 import { normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { hasConfiguredSecretInput, normalizeSecretInputString } from "openclaw/plugin-sdk/secret-input";
@@ -38,41 +38,21 @@ function normalizePubkey(input) {
 const { listAccountIds: listNostrAccountIds, resolveDefaultAccountId: resolveDefaultNostrAccountId } = createAccountListHelpers("nostr", {
 	fallbackAccountIdWhenEmpty: false,
 	resolveImplicitAccountId: (cfg) => {
-		const account = cfg.channels?.nostr;
+		const account = getNostrConfig(cfg);
 		return hasConfiguredNostrPrivateKey(account?.privateKey) ? normalizeOptionalAccountId(account?.defaultAccount) ?? DEFAULT_ACCOUNT_ID : void 0;
 	}
 });
-/**
-* Resolve a Nostr account from config
-*/
 function resolveNostrAccount(opts) {
-	const accountId = normalizeAccountId(opts.accountId ?? resolveDefaultNostrAccountId(opts.cfg));
-	const nostrCfg = opts.cfg.channels?.nostr;
-	const baseEnabled = nostrCfg?.enabled !== false;
-	const privateKey = resolveNostrPrivateKey(nostrCfg?.privateKey);
-	const configured = hasConfiguredNostrPrivateKey(nostrCfg?.privateKey);
+	const accountId = normalizeAccountId(opts.accountId ?? resolveDefaultNostrAccountId({ channels: { nostr: getNostrConfig(opts.cfg) } }));
+	const account = resolveNostrAccountBase(opts.cfg, accountId);
 	let publicKey = "";
-	if (privateKey) try {
-		publicKey = getPublicKeyFromPrivate(privateKey);
+	if (account.privateKey) try {
+		publicKey = getPublicKeyFromPrivate(account.privateKey);
 	} catch {}
 	return {
-		accountId,
-		name: normalizeOptionalString(nostrCfg?.name),
-		enabled: baseEnabled,
-		configured,
-		privateKey,
-		publicKey,
-		relays: nostrCfg?.relays ?? DEFAULT_RELAYS,
-		profile: nostrCfg?.profile,
-		config: {
-			enabled: nostrCfg?.enabled,
-			name: nostrCfg?.name,
-			privateKey: nostrCfg?.privateKey,
-			relays: nostrCfg?.relays,
-			dmPolicy: nostrCfg?.dmPolicy,
-			allowFrom: nostrCfg?.allowFrom,
-			profile: nostrCfg?.profile
-		}
+		...account,
+		name: normalizeOptionalString(account.config.name),
+		publicKey
 	};
 }
 //#endregion
@@ -124,7 +104,7 @@ const nostrDmPolicy = createTopLevelChannelDmPolicy({
 	channel,
 	policyKey: "channels.nostr.dmPolicy",
 	allowFromKey: "channels.nostr.allowFrom",
-	getCurrent: (cfg) => cfg.channels?.nostr?.dmPolicy ?? "pairing",
+	getCurrent: (cfg) => getNostrConfig(cfg)?.dmPolicy ?? "pairing",
 	promptAllowFrom: promptNostrAllowFrom
 });
 const nostrSetupAdapter = createNostrSetupAdapter({ resolveAccountId: (cfg, accountId) => accountId?.trim() || resolveDefaultNostrAccountId(cfg) });
@@ -195,7 +175,7 @@ const nostrSetupWizard = {
 				cfg,
 				accountId
 			});
-			const configuredRelays = cfg.channels?.nostr?.relays;
+			const configuredRelays = account.config.relays;
 			return (configuredRelays && configuredRelays.length > 0 ? account.relays : []).join(", ");
 		},
 		keepPrompt: (value) => t("wizard.nostr.relayUrlsKeep", { value }),

package/dist/api.js

@@ -1,12 +1,13 @@
-import { s as resolveNostrAccount } from "./.setup/setup-surface-Dx8QxWSP.mjs";
+import { s as resolveNostrAccount } from "./.setup/setup-surface-b-YWJSGV.mjs";
 import { getPluginRuntimeGatewayRequestScope } from "./runtime-api.js";
-import { n as NostrProfileSchema } from "./.setup/config-schema-B3uU2qBS.mjs";
-import { a as getNostrRuntime, i as contentToProfile, n as nostrPlugin, o as setNostrRuntime, r as publishNostrProfile, t as getNostrProfileState } from "./.setup/channel-D2d-FP8G.mjs";
+import { n as NostrProfileSchema } from "./.setup/config-schema-HuEK1L2K.mjs";
+import { a as getNostrRuntime, i as contentToProfile, n as nostrPlugin, o as setNostrRuntime, r as publishNostrProfile, t as getNostrProfileState } from "./.setup/channel-BaBU_Q15.mjs";
 import { getPluginRuntimeGatewayRequestScope as getPluginRuntimeGatewayRequestScope$1 } from "openclaw/plugin-sdk/plugin-runtime";
-import { isRecord, normalizeLowercaseStringOrEmpty, normalizeOptionalLowercaseString, readStringValue } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { isRecord, normalizeLowercaseStringOrEmpty, normalizeOptionalLowercaseString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { z } from "zod";
 import { SimplePool } from "nostr-tools";
 import { createFixedWindowRateLimiter } from "openclaw/plugin-sdk/webhook-ingress";
+import { raceWithTimeout } from "openclaw/plugin-sdk/time-runtime";
 import { KeyedAsyncQueue } from "openclaw/plugin-sdk/keyed-async-queue";
 import { isBlockedHostnameOrIp, isLoopbackHost } from "openclaw/plugin-sdk/ssrf-runtime";
 import { readJsonBodyWithLimit, requestBodyErrorToText } from "openclaw/plugin-sdk/webhook-request-guards";
@@ -26,12 +27,9 @@ function normalizeNostrProfileUrlForRuntime(urlStr) {
 		return `${prefix}${high.toString(16)}:${low.toString(16)}${suffix}`;
 	});
 }
-function parseNostrProfileUrl(urlStr) {
-	return new URL(normalizeNostrProfileUrlForRuntime(urlStr));
-}
 function validateUrlSafety(urlStr) {
 	try {
-		const url = parseNostrProfileUrl(urlStr);
+		const url = new URL(normalizeNostrProfileUrlForRuntime(urlStr));
 		if (url.protocol !== "https:") return {
 			ok: false,
 			error: "URL must use https:// protocol"
@@ -82,15 +80,10 @@ async function importProfileFromRelays(opts) {
 	};
 	const pool = new SimplePool();
 	const relaysQueried = [...relays];
-	let deadlineTimer;
-	const deadline = new Promise((resolve) => {
-		deadlineTimer = setTimeout(resolve, timeoutMs);
-		deadlineTimer.unref?.();
-	});
 	const subscriptions = [];
 	try {
 		const events = [];
-		await Promise.race([Promise.all(relays.map((relay) => new Promise((resolve) => {
+		await raceWithTimeout(() => Promise.all(relays.map((relay) => new Promise((resolve) => {
 			const subscription = pool.subscribeMany([relay], {
 				kinds: [0],
 				authors: [pubkey],
@@ -110,7 +103,7 @@ async function importProfileFromRelays(opts) {
 				}
 			});
 			subscriptions.push(subscription);
-		}))), deadline]);
+		}))), timeoutMs, () => void 0, { ref: false });
 		if (events.length === 0) return {
 			ok: false,
 			error: "No profile found on any relay",
@@ -158,7 +151,6 @@ async function importProfileFromRelays(opts) {
 			sourceRelay: bestEvent.relay
 		};
 	} finally {
-		if (deadlineTimer) clearTimeout(deadlineTimer);
 		for (const subscription of subscriptions) subscription.close();
 		pool.close(relays);
 	}
@@ -258,8 +250,7 @@ function isLoopbackOriginLike(value) {
 	}
 }
 function firstHeaderValue(value) {
-	if (Array.isArray(value)) return value[0];
-	return readStringValue(value);
+	return Array.isArray(value) ? value[0] : value;
 }
 function normalizeIpCandidate(raw) {
 	const unquoted = raw.trim().replace(/^"|"$/g, "");
@@ -283,51 +274,15 @@ function hasNonLoopbackForwardedClient(req) {
 	}
 	return false;
 }
-function enforceLoopbackMutationGuards(ctx, req, res) {
+function resolveLoopbackMutationRejection(req) {
 	const remoteAddress = req.socket.remoteAddress;
-	if (!isLoopbackRemoteAddress(remoteAddress)) {
-		ctx.log?.warn?.(`Rejected mutation from non-loopback remoteAddress=${String(remoteAddress)}`);
-		sendJson(res, 403, {
-			ok: false,
-			error: "Forbidden"
-		});
-		return false;
-	}
-	if (hasNonLoopbackForwardedClient(req)) {
-		ctx.log?.warn?.("Rejected mutation with non-loopback forwarded client headers");
-		sendJson(res, 403, {
-			ok: false,
-			error: "Forbidden"
-		});
-		return false;
-	}
-	if (normalizeOptionalLowercaseString(firstHeaderValue(req.headers["sec-fetch-site"])) === "cross-site") {
-		ctx.log?.warn?.("Rejected mutation with cross-site sec-fetch-site header");
-		sendJson(res, 403, {
-			ok: false,
-			error: "Forbidden"
-		});
-		return false;
-	}
+	if (!isLoopbackRemoteAddress(remoteAddress)) return `Rejected mutation from non-loopback remoteAddress=${String(remoteAddress)}`;
+	if (hasNonLoopbackForwardedClient(req)) return "Rejected mutation with non-loopback forwarded client headers";
+	if (normalizeOptionalLowercaseString(firstHeaderValue(req.headers["sec-fetch-site"])) === "cross-site") return "Rejected mutation with cross-site sec-fetch-site header";
 	const origin = firstHeaderValue(req.headers.origin);
-	if (typeof origin === "string" && !isLoopbackOriginLike(origin)) {
-		ctx.log?.warn?.(`Rejected mutation with non-loopback origin=${origin}`);
-		sendJson(res, 403, {
-			ok: false,
-			error: "Forbidden"
-		});
-		return false;
-	}
+	if (typeof origin === "string" && !isLoopbackOriginLike(origin)) return `Rejected mutation with non-loopback origin=${origin}`;
 	const referer = firstHeaderValue(req.headers.referer ?? req.headers.referrer);
-	if (typeof referer === "string" && !isLoopbackOriginLike(referer)) {
-		ctx.log?.warn?.(`Rejected mutation with non-loopback referer=${referer}`);
-		sendJson(res, 403, {
-			ok: false,
-			error: "Forbidden"
-		});
-		return false;
-	}
-	return true;
+	if (typeof referer === "string" && !isLoopbackOriginLike(referer)) return `Rejected mutation with non-loopback referer=${referer}`;
 }
 function enforceGatewayMutationScope(ctx, accountId, res) {
 	const runtimeScopes = getPluginRuntimeGatewayRequestScope$1()?.client?.connect?.scopes;
@@ -350,7 +305,16 @@ function createNostrProfileHttpHandler(ctx) {
 		try {
 			if (req.method === "GET" && !isImport) return await handleGetProfile(accountId, ctx, res);
 			if (req.method === "PUT" && !isImport || req.method === "POST" && isImport) {
-				if (!enforceGatewayMutationScope(ctx, accountId, res) || !enforceLoopbackMutationGuards(ctx, req, res)) return true;
+				if (!enforceGatewayMutationScope(ctx, accountId, res)) return true;
+				const rejection = resolveLoopbackMutationRejection(req);
+				if (rejection) {
+					ctx.log?.warn?.(rejection);
+					sendJson(res, 403, {
+						ok: false,
+						error: "Forbidden"
+					});
+					return true;
+				}
 				return await (isImport ? handleImportProfile : handleUpdateProfile)(accountId, ctx, req, res);
 			}
 			sendJson(res, 405, {

package/dist/channel-plugin-api.js

@@ -1,2 +1,2 @@
-import { n as nostrPlugin } from "./.setup/channel-D2d-FP8G.mjs";
+import { n as nostrPlugin } from "./.setup/channel-BaBU_Q15.mjs";
 export { nostrPlugin };

package/dist/doctor-contract-api.js

@@ -15,6 +15,7 @@ function retiredNostrStateMigration(namespace, label) {
 	return {
 		id: `nostr-${namespace}-json-to-plugin-state`,
 		label,
+		collectBackupResources: () => [],
 		async detectLegacyState({ stateDir }) {
 			return await hasLegacyState(stateDir) ? { preview: [warning] } : null;
 		},

package/dist/index.js

@@ -1,23 +1,5 @@
 import { defineBundledChannelEntry, loadBundledEntryExportSync } from "openclaw/plugin-sdk/channel-entry-contract";
 //#region extensions/nostr/index.ts
-function createNostrProfileHttpHandler() {
-	return loadBundledEntryExportSync(import.meta.url, {
-		specifier: "./api.js",
-		exportName: "createNostrProfileHttpHandler"
-	});
-}
-function getNostrRuntime() {
-	return loadBundledEntryExportSync(import.meta.url, {
-		specifier: "./api.js",
-		exportName: "getNostrRuntime"
-	})();
-}
-function resolveNostrAccount(params) {
-	return loadBundledEntryExportSync(import.meta.url, {
-		specifier: "./api.js",
-		exportName: "resolveNostrAccount"
-	})(params);
-}
 var nostr_default = defineBundledChannelEntry({
 	id: "nostr",
 	name: "Nostr",
@@ -36,10 +18,12 @@ var nostr_default = defineBundledChannelEntry({
 		exportName: "setNostrRuntime"
 	},
 	registerFull(api) {
-		const httpHandler = createNostrProfileHttpHandler()({
+		const { createNostrProfileHttpHandler, getNostrRuntime, resolveNostrAccount } = loadBundledEntryExportSync(import.meta.url, { specifier: "./api.js" });
+		const httpHandler = createNostrProfileHttpHandler({
 			getConfigProfile: (accountId) => {
+				const cfg = getNostrRuntime().config.current();
 				return resolveNostrAccount({
-					cfg: getNostrRuntime().config.current(),
+					cfg,
 					accountId
 				}).profile;
 			},
@@ -60,8 +44,9 @@ var nostr_default = defineBundledChannelEntry({
 				});
 			},
 			getAccountInfo: (accountId) => {
+				const cfg = getNostrRuntime().config.current();
 				const account = resolveNostrAccount({
-					cfg: getNostrRuntime().config.current(),
+					cfg,
 					accountId
 				});
 				if (!account.configured || !account.publicKey) return null;

package/dist/setup-api.js

@@ -1,2 +1,2 @@
-import { r as nostrSetupWizard, t as nostrSetupAdapter } from "./.setup/setup-surface-Dx8QxWSP.mjs";
+import { r as nostrSetupWizard, t as nostrSetupAdapter } from "./.setup/setup-surface-b-YWJSGV.mjs";
 export { nostrSetupAdapter, nostrSetupWizard };

package/dist/setup-entry.js

@@ -4,7 +4,7 @@ import { fileURLToPath } from "node:url";
 var setup_entry_default = defineBundledChannelSetupEntry({
 	importMetaUrl: import.meta.url,
 	plugin: {
-		specifier: fileURLToPath(new URL(".setup/setup-plugin-api-BhRAS2I1.mjs", import.meta.url).href),
+		specifier: fileURLToPath(new URL(".setup/setup-plugin-api-BUsavy-i.mjs", import.meta.url).href),
 		exportName: "nostrSetupPlugin"
 	},
 	secrets: {

package/dist/setup-plugin-api.js

@@ -1,2 +1,2 @@
-import { t as nostrSetupPlugin } from "./.setup/setup-plugin-api-Ci0XxWqb.mjs";
+import { t as nostrSetupPlugin } from "./.setup/setup-plugin-api-C_HK3q8q.mjs";
 export { nostrSetupPlugin };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/nostr",
-  "version": "2026.9.8",
+  "version": "2026.10.1-beta.1",
   "description": "OpenClaw Nostr channel plugin for NIP-04 encrypted direct messages.",
   "repository": {
     "type": "git",
@@ -12,7 +12,7 @@
     "zod": "4.6.5"
   },
   "peerDependencies": {
-    "openclaw": ">=2026.9.8"
+    "openclaw": ">=2026.10.1-beta.1"
   },
   "peerDependenciesMeta": {
     "openclaw": {
@@ -80,10 +80,10 @@
       "minHostVersion": ">=2026.4.10"
     },
     "compat": {
-      "pluginApi": ">=2026.9.8"
+      "pluginApi": ">=2026.10.1-beta.1"
     },
     "build": {
-      "openclawVersion": "2026.9.8"
+      "openclawVersion": "2026.10.1-beta.1"
     },
     "release": {
       "publishToClawHub": true,

package/dist/.setup/setup-plugin-api-BhRAS2I1.mjs

@@ -1,2 +0,0 @@
-import { t as nostrSetupPlugin } from "./setup-plugin-api-Ci0XxWqb.mjs";
-export { nostrSetupPlugin };