@alfe.ai/openclaw-identity 0.0.1

package/dist/index.cjs

@@ -0,0 +1,2 @@
+const require_plugin = require("./plugin.cjs");
+module.exports = require_plugin;

package/dist/index.d.cts

@@ -0,0 +1,2 @@
+import plugin from "./plugin.cjs";
+export { plugin as default };

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+import plugin from "./plugin.js";
+export { plugin as default };

package/dist/index.js

@@ -0,0 +1,2 @@
+import plugin from "./plugin.js";
+export { plugin as default };

package/dist/plugin.cjs

@@ -0,0 +1,404 @@
+let _alfe_ai_config = require("@alfe.ai/config");
+let _sinclair_typebox = require("@sinclair/typebox");
+//#region src/plugin.ts
+/**
+* @alfe.ai/openclaw-identity — OpenClaw native plugin
+*
+* HTTP-based identity resolution, permission enforcement, and CRM tools.
+* Installed as part of the core alfe integration on every agent.
+*
+* Hooks:
+*   - message_received  → resolve sender identity via HTTP, cache, gate access
+*   - before_tool_call  → enforce permissions from cached policy
+*   - after_tool_call   → log tool execution audit
+*
+* All data access via HTTP to the Identity service internal API.
+* Uses the agent's own API key (from ~/.alfe/config.toml) for authentication.
+*/
+function createHttpClient(apiUrl, apiKey) {
+	async function request(method, path, body) {
+		const res = await fetch(`${apiUrl}${path}`, {
+			method,
+			headers: {
+				Authorization: `Bearer ${apiKey}`,
+				"Content-Type": "application/json"
+			},
+			...body ? { body: JSON.stringify(body) } : {}
+		});
+		if (!res.ok) {
+			const text = await res.text().catch(() => "");
+			throw new Error(`Identity API ${method} ${path}: ${String(res.status)} ${text}`);
+		}
+		return (await res.json()).data;
+	}
+	return { request };
+}
+const CACHE_TTL_MS = 6e4;
+const sessionCache = /* @__PURE__ */ new Map();
+function getCached(key) {
+	const entry = sessionCache.get(key);
+	if (!entry) return null;
+	if (Date.now() > entry.expiresAt) {
+		sessionCache.delete(key);
+		return null;
+	}
+	return entry.value;
+}
+function setCached(key, value) {
+	sessionCache.set(key, {
+		value,
+		expiresAt: Date.now() + CACHE_TTL_MS
+	});
+}
+function ok(data) {
+	return {
+		content: [{
+			type: "text",
+			text: JSON.stringify(data)
+		}],
+		details: data
+	};
+}
+function errResult(message) {
+	return {
+		content: [{
+			type: "text",
+			text: JSON.stringify({ error: message })
+		}],
+		details: { error: message }
+	};
+}
+function defineTool(def) {
+	return {
+		name: def.name,
+		description: def.description,
+		label: def.name,
+		parameters: def.parameters,
+		execute: async (_toolCallId, params) => {
+			try {
+				return ok(await def.handler(params));
+			} catch (e) {
+				return errResult(e.message);
+			}
+		}
+	};
+}
+const plugin = {
+	id: "alfe-identity",
+	name: "Alfe Identity",
+	description: "Identity resolution, access gating, and permission enforcement",
+	version: "0.0.1",
+	activate(api) {
+		const log = api.logger;
+		log.info("Alfe Identity plugin activating...");
+		let apiUrl;
+		let apiKey;
+		try {
+			const config = (0, _alfe_ai_config.resolveConfig)();
+			apiUrl = config.apiUrl;
+			apiKey = config.apiKey;
+		} catch (err) {
+			log.error(`Identity plugin: failed to resolve config — ${err instanceof Error ? err.message : String(err)}`);
+			return;
+		}
+		const http = createHttpClient(apiUrl, apiKey);
+		const identityToolNames = /* @__PURE__ */ new Set();
+		const tools = [
+			defineTool({
+				name: "who_is_this",
+				description: "Look up full identity context by platform and ID — returns profile, notes, tags, platforms, and recent changelog",
+				parameters: _sinclair_typebox.Type.Object({
+					platform: _sinclair_typebox.Type.String({ description: "Platform name (discord, slack, chat, sms, whatsapp, etc.)" }),
+					platformId: _sinclair_typebox.Type.String({ description: "Platform-specific user identifier" }),
+					tenantId: _sinclair_typebox.Type.String()
+				}),
+				handler: async (params) => {
+					const result = await http.request("POST", "/internal/identity/resolve", {
+						platform: params.platform,
+						platformId: params.platformId,
+						tenantId: params.tenantId,
+						agentId: "plugin"
+					});
+					if (!result.identityId) return { found: false };
+					return http.request("GET", `/internal/identity/${encodeURIComponent(result.identityId)}/context?tenantId=${encodeURIComponent(params.tenantId)}`);
+				}
+			}),
+			defineTool({
+				name: "lookup_identity",
+				description: "Search identities by name, email, phone, tag, or platform. Returns multiple matches.",
+				parameters: _sinclair_typebox.Type.Object({
+					tenantId: _sinclair_typebox.Type.String(),
+					query: _sinclair_typebox.Type.Optional(_sinclair_typebox.Type.String({ description: "Text search query" })),
+					status: _sinclair_typebox.Type.Optional(_sinclair_typebox.Type.String()),
+					tag: _sinclair_typebox.Type.Optional(_sinclair_typebox.Type.String()),
+					platform: _sinclair_typebox.Type.Optional(_sinclair_typebox.Type.String())
+				}),
+				handler: async (params) => {
+					const qs = new URLSearchParams({ tenantId: params.tenantId });
+					if (params.query) qs.set("q", params.query);
+					if (params.status) qs.set("status", params.status);
+					if (params.tag) qs.set("tag", params.tag);
+					if (params.platform) qs.set("platform", params.platform);
+					return http.request("GET", `/internal/identity/search?${qs.toString()}`);
+				}
+			}),
+			defineTool({
+				name: "create_identity",
+				description: "Create a new identity record with profile fields",
+				parameters: _sinclair_typebox.Type.Object({
+					tenantId: _sinclair_typebox.Type.String(),
+					platform: _sinclair_typebox.Type.String(),
+					platformId: _sinclair_typebox.Type.String(),
+					displayName: _sinclair_typebox.Type.Optional(_sinclair_typebox.Type.String())
+				}),
+				handler: (params) => http.request("POST", "/internal/identity/resolve", {
+					platform: params.platform,
+					platformId: params.platformId,
+					displayName: params.displayName,
+					tenantId: params.tenantId,
+					agentId: "plugin"
+				})
+			}),
+			defineTool({
+				name: "merge_identities",
+				description: "Merge two identity records — transfers notes, tags, aliases, platforms to survivor",
+				parameters: _sinclair_typebox.Type.Object({
+					survivorId: _sinclair_typebox.Type.String({ description: "Identity to keep" }),
+					mergedId: _sinclair_typebox.Type.String({ description: "Identity to merge into survivor" }),
+					tenantId: _sinclair_typebox.Type.String()
+				}),
+				handler: (params) => http.request("POST", `/internal/identity/${encodeURIComponent(params.survivorId)}/merge`, {
+					tenantId: params.tenantId,
+					mergedId: params.mergedId,
+					changedBy: {
+						type: "agent",
+						id: "plugin"
+					}
+				})
+			}),
+			defineTool({
+				name: "unmerge_identities",
+				description: "Reverse a merge — restore previously merged identity",
+				parameters: _sinclair_typebox.Type.Object({
+					mergedId: _sinclair_typebox.Type.String({ description: "Identity that was merged (has mergedInto pointer)" }),
+					tenantId: _sinclair_typebox.Type.String()
+				}),
+				handler: (params) => http.request("POST", `/internal/identity/${encodeURIComponent(params.mergedId)}/unmerge`, {
+					tenantId: params.tenantId,
+					changedBy: {
+						type: "agent",
+						id: "plugin"
+					}
+				})
+			}),
+			defineTool({
+				name: "link_platform",
+				description: "Link a platform identity to an existing identity record",
+				parameters: _sinclair_typebox.Type.Object({
+					identityId: _sinclair_typebox.Type.String(),
+					platform: _sinclair_typebox.Type.String(),
+					platformId: _sinclair_typebox.Type.String(),
+					tenantId: _sinclair_typebox.Type.String()
+				}),
+				handler: (params) => http.request("POST", "/internal/identity/resolve", {
+					platform: params.platform,
+					platformId: params.platformId,
+					tenantId: params.tenantId,
+					agentId: "plugin"
+				})
+			}),
+			defineTool({
+				name: "add_identity_note",
+				description: "Add an observation or note about a contact",
+				parameters: _sinclair_typebox.Type.Object({
+					identityId: _sinclair_typebox.Type.String(),
+					tenantId: _sinclair_typebox.Type.String(),
+					content: _sinclair_typebox.Type.String(),
+					category: _sinclair_typebox.Type.Optional(_sinclair_typebox.Type.String({ description: "observation, preference, relationship, context, or warning" }))
+				}),
+				handler: (params) => http.request("POST", `/internal/identity/${encodeURIComponent(params.identityId)}/notes`, {
+					tenantId: params.tenantId,
+					content: params.content,
+					category: params.category,
+					changedBy: {
+						type: "agent",
+						id: "plugin"
+					}
+				})
+			}),
+			defineTool({
+				name: "tag_identity",
+				description: "Add or remove a tag on an identity",
+				parameters: _sinclair_typebox.Type.Object({
+					identityId: _sinclair_typebox.Type.String(),
+					tenantId: _sinclair_typebox.Type.String(),
+					tag: _sinclair_typebox.Type.String(),
+					action: _sinclair_typebox.Type.String({ description: "'add' or 'remove'" })
+				}),
+				handler: (params) => http.request("POST", `/internal/identity/${encodeURIComponent(params.identityId)}/tags`, {
+					tenantId: params.tenantId,
+					tag: params.tag,
+					action: params.action,
+					changedBy: {
+						type: "agent",
+						id: "plugin"
+					}
+				})
+			}),
+			defineTool({
+				name: "get_identity_changelog",
+				description: "Get full changelog for an identity — all versions, diffs, who changed what",
+				parameters: _sinclair_typebox.Type.Object({
+					identityId: _sinclair_typebox.Type.String(),
+					tenantId: _sinclair_typebox.Type.String(),
+					limit: _sinclair_typebox.Type.Optional(_sinclair_typebox.Type.Number())
+				}),
+				handler: async (params) => {
+					const qs = new URLSearchParams({ tenantId: params.tenantId });
+					if (params.limit) qs.set("limit", String(Number(params.limit)));
+					return http.request("GET", `/internal/identity/${encodeURIComponent(params.identityId)}/changelog?${qs.toString()}`);
+				}
+			}),
+			defineTool({
+				name: "rollback_identity",
+				description: "Revert an identity to a previous version",
+				parameters: _sinclair_typebox.Type.Object({
+					identityId: _sinclair_typebox.Type.String(),
+					tenantId: _sinclair_typebox.Type.String(),
+					targetVersion: _sinclair_typebox.Type.Number()
+				}),
+				handler: (params) => http.request("POST", `/internal/identity/${encodeURIComponent(params.identityId)}/rollback`, {
+					tenantId: params.tenantId,
+					targetVersion: params.targetVersion,
+					changedBy: {
+						type: "agent",
+						id: "plugin"
+					}
+				})
+			}),
+			defineTool({
+				name: "enforce_policy",
+				description: "Resolve sender identity and return their tool policy",
+				parameters: _sinclair_typebox.Type.Object({
+					platform: _sinclair_typebox.Type.String(),
+					senderId: _sinclair_typebox.Type.String(),
+					channelId: _sinclair_typebox.Type.Optional(_sinclair_typebox.Type.String()),
+					tenantId: _sinclair_typebox.Type.String()
+				}),
+				handler: (params) => http.request("POST", "/internal/identity/enforce", {
+					platform: params.platform,
+					senderId: params.senderId,
+					channelId: params.channelId,
+					tenantId: params.tenantId
+				})
+			}),
+			defineTool({
+				name: "check_permission",
+				description: "Check if a specific tool call is allowed for a sender",
+				parameters: _sinclair_typebox.Type.Object({
+					platform: _sinclair_typebox.Type.String(),
+					senderId: _sinclair_typebox.Type.String(),
+					toolName: _sinclair_typebox.Type.String(),
+					tenantId: _sinclair_typebox.Type.String()
+				}),
+				handler: (params) => http.request("POST", "/internal/identity/check-tool", {
+					platform: params.platform,
+					senderId: params.senderId,
+					toolName: params.toolName,
+					tenantId: params.tenantId
+				})
+			})
+		];
+		for (const tool of tools) {
+			api.registerTool(tool);
+			identityToolNames.add(tool.name);
+		}
+		log.info(`Registered ${String(tools.length)} identity tools`);
+		api.on("message_received", async (...args) => {
+			const event = args[0];
+			const ctx = args[1];
+			const platform = ctx.channelId ?? "unknown";
+			const senderId = event.from;
+			if (!senderId) return;
+			const cacheKey = ctx.conversationId ?? `${platform}:${senderId}`;
+			const cached = getCached(cacheKey);
+			if (cached) {
+				if (!cached.accessAllowed) return {
+					block: true,
+					blockReason: "Identity: access denied for this sender"
+				};
+				return;
+			}
+			try {
+				const tenantId = ctx.tenantId ?? "";
+				const agentId = ctx.agentId ?? "";
+				const resolveResult = await http.request("POST", "/internal/identity/resolve", {
+					platform,
+					platformId: senderId,
+					tenantId,
+					agentId
+				});
+				setCached(cacheKey, {
+					...await http.request("POST", "/internal/identity/enforce", {
+						platform,
+						senderId,
+						tenantId
+					}),
+					accessAllowed: resolveResult.accessAllowed
+				});
+				if (!resolveResult.accessAllowed) return {
+					block: true,
+					blockReason: "Identity: access denied for this sender"
+				};
+				log.info(`Identity resolved: ${senderId} → ${resolveResult.identityId ?? "unknown"} (${resolveResult.status})`);
+			} catch (e) {
+				log.error(`Identity resolution failed for ${senderId}: ${e.message}`);
+			}
+		}, { priority: 100 });
+		api.on("before_tool_call", async (...args) => {
+			const event = args[0];
+			const ctx = args[1];
+			if (identityToolNames.has(event.toolName)) return;
+			const sessionKey = ctx.sessionKey;
+			if (!sessionKey) return;
+			const perms = getCached(sessionKey);
+			if (!perms) return {
+				block: true,
+				blockReason: "Identity: no identity context established — tool access denied"
+			};
+			if (!perms.identified) return {
+				block: true,
+				blockReason: "Identity: unknown sender identity — tool access denied"
+			};
+			if (perms.deniedTools.includes("*") || perms.deniedTools.includes(event.toolName)) return {
+				block: true,
+				blockReason: `Identity: tool '${event.toolName}' is denied for your role`
+			};
+			if (perms.allowedTools.length > 0 && !perms.allowedTools.includes(event.toolName)) return {
+				block: true,
+				blockReason: `Identity: tool '${event.toolName}' is not in your allowed tools`
+			};
+		}, { priority: 100 });
+		api.on("after_tool_call", async (...args) => {
+			const event = args[0];
+			const ctx = args[1];
+			const sessionKey = ctx.sessionKey;
+			if (!sessionKey) return;
+			const perms = getCached(sessionKey);
+			if (!perms?.identityId) return;
+			try {
+				await http.request("POST", "/internal/identity/check-tool", {
+					platform: "tool_audit",
+					senderId: perms.identityId,
+					toolName: event.toolName,
+					tenantId: ctx.tenantId ?? ""
+				});
+			} catch (e) {
+				log.error(`Audit logging failed: ${e.message}`);
+			}
+		});
+		log.info("Alfe Identity plugin activated");
+	}
+};
+//#endregion
+module.exports = plugin;

package/dist/plugin.d.cts

@@ -0,0 +1,39 @@
+import { TSchema } from "@sinclair/typebox";
+
+//#region src/plugin.d.ts
+
+interface PluginLogger {
+  info: (...args: unknown[]) => void;
+  warn: (...args: unknown[]) => void;
+  error: (...args: unknown[]) => void;
+  debug: (...args: unknown[]) => void;
+}
+interface ToolDef {
+  name: string;
+  description: string;
+  label: string;
+  parameters: TSchema;
+  execute: (toolCallId: string, params: Record<string, unknown>) => Promise<{
+    content: {
+      type: "text";
+      text: string;
+    }[];
+    details: unknown;
+  }>;
+}
+interface PluginApi {
+  logger: PluginLogger;
+  registerTool: (tool: ToolDef) => void;
+  on: (event: string, handler: (...args: unknown[]) => Promise<unknown>, options?: {
+    priority?: number;
+  }) => void;
+}
+declare const plugin: {
+  id: string;
+  name: string;
+  description: string;
+  version: string;
+  activate(api: PluginApi): void;
+};
+//#endregion
+export { plugin as default };

package/dist/plugin.d.ts

@@ -0,0 +1,39 @@
+import { TSchema } from "@sinclair/typebox";
+
+//#region src/plugin.d.ts
+
+interface PluginLogger {
+  info: (...args: unknown[]) => void;
+  warn: (...args: unknown[]) => void;
+  error: (...args: unknown[]) => void;
+  debug: (...args: unknown[]) => void;
+}
+interface ToolDef {
+  name: string;
+  description: string;
+  label: string;
+  parameters: TSchema;
+  execute: (toolCallId: string, params: Record<string, unknown>) => Promise<{
+    content: {
+      type: "text";
+      text: string;
+    }[];
+    details: unknown;
+  }>;
+}
+interface PluginApi {
+  logger: PluginLogger;
+  registerTool: (tool: ToolDef) => void;
+  on: (event: string, handler: (...args: unknown[]) => Promise<unknown>, options?: {
+    priority?: number;
+  }) => void;
+}
+declare const plugin: {
+  id: string;
+  name: string;
+  description: string;
+  version: string;
+  activate(api: PluginApi): void;
+};
+//#endregion
+export { plugin as default };

package/dist/plugin.js

@@ -0,0 +1,404 @@
+import { resolveConfig } from "@alfe.ai/config";
+import { Type } from "@sinclair/typebox";
+//#region src/plugin.ts
+/**
+* @alfe.ai/openclaw-identity — OpenClaw native plugin
+*
+* HTTP-based identity resolution, permission enforcement, and CRM tools.
+* Installed as part of the core alfe integration on every agent.
+*
+* Hooks:
+*   - message_received  → resolve sender identity via HTTP, cache, gate access
+*   - before_tool_call  → enforce permissions from cached policy
+*   - after_tool_call   → log tool execution audit
+*
+* All data access via HTTP to the Identity service internal API.
+* Uses the agent's own API key (from ~/.alfe/config.toml) for authentication.
+*/
+function createHttpClient(apiUrl, apiKey) {
+	async function request(method, path, body) {
+		const res = await fetch(`${apiUrl}${path}`, {
+			method,
+			headers: {
+				Authorization: `Bearer ${apiKey}`,
+				"Content-Type": "application/json"
+			},
+			...body ? { body: JSON.stringify(body) } : {}
+		});
+		if (!res.ok) {
+			const text = await res.text().catch(() => "");
+			throw new Error(`Identity API ${method} ${path}: ${String(res.status)} ${text}`);
+		}
+		return (await res.json()).data;
+	}
+	return { request };
+}
+const CACHE_TTL_MS = 6e4;
+const sessionCache = /* @__PURE__ */ new Map();
+function getCached(key) {
+	const entry = sessionCache.get(key);
+	if (!entry) return null;
+	if (Date.now() > entry.expiresAt) {
+		sessionCache.delete(key);
+		return null;
+	}
+	return entry.value;
+}
+function setCached(key, value) {
+	sessionCache.set(key, {
+		value,
+		expiresAt: Date.now() + CACHE_TTL_MS
+	});
+}
+function ok(data) {
+	return {
+		content: [{
+			type: "text",
+			text: JSON.stringify(data)
+		}],
+		details: data
+	};
+}
+function errResult(message) {
+	return {
+		content: [{
+			type: "text",
+			text: JSON.stringify({ error: message })
+		}],
+		details: { error: message }
+	};
+}
+function defineTool(def) {
+	return {
+		name: def.name,
+		description: def.description,
+		label: def.name,
+		parameters: def.parameters,
+		execute: async (_toolCallId, params) => {
+			try {
+				return ok(await def.handler(params));
+			} catch (e) {
+				return errResult(e.message);
+			}
+		}
+	};
+}
+const plugin = {
+	id: "alfe-identity",
+	name: "Alfe Identity",
+	description: "Identity resolution, access gating, and permission enforcement",
+	version: "0.0.1",
+	activate(api) {
+		const log = api.logger;
+		log.info("Alfe Identity plugin activating...");
+		let apiUrl;
+		let apiKey;
+		try {
+			const config = resolveConfig();
+			apiUrl = config.apiUrl;
+			apiKey = config.apiKey;
+		} catch (err) {
+			log.error(`Identity plugin: failed to resolve config — ${err instanceof Error ? err.message : String(err)}`);
+			return;
+		}
+		const http = createHttpClient(apiUrl, apiKey);
+		const identityToolNames = /* @__PURE__ */ new Set();
+		const tools = [
+			defineTool({
+				name: "who_is_this",
+				description: "Look up full identity context by platform and ID — returns profile, notes, tags, platforms, and recent changelog",
+				parameters: Type.Object({
+					platform: Type.String({ description: "Platform name (discord, slack, chat, sms, whatsapp, etc.)" }),
+					platformId: Type.String({ description: "Platform-specific user identifier" }),
+					tenantId: Type.String()
+				}),
+				handler: async (params) => {
+					const result = await http.request("POST", "/internal/identity/resolve", {
+						platform: params.platform,
+						platformId: params.platformId,
+						tenantId: params.tenantId,
+						agentId: "plugin"
+					});
+					if (!result.identityId) return { found: false };
+					return http.request("GET", `/internal/identity/${encodeURIComponent(result.identityId)}/context?tenantId=${encodeURIComponent(params.tenantId)}`);
+				}
+			}),
+			defineTool({
+				name: "lookup_identity",
+				description: "Search identities by name, email, phone, tag, or platform. Returns multiple matches.",
+				parameters: Type.Object({
+					tenantId: Type.String(),
+					query: Type.Optional(Type.String({ description: "Text search query" })),
+					status: Type.Optional(Type.String()),
+					tag: Type.Optional(Type.String()),
+					platform: Type.Optional(Type.String())
+				}),
+				handler: async (params) => {
+					const qs = new URLSearchParams({ tenantId: params.tenantId });
+					if (params.query) qs.set("q", params.query);
+					if (params.status) qs.set("status", params.status);
+					if (params.tag) qs.set("tag", params.tag);
+					if (params.platform) qs.set("platform", params.platform);
+					return http.request("GET", `/internal/identity/search?${qs.toString()}`);
+				}
+			}),
+			defineTool({
+				name: "create_identity",
+				description: "Create a new identity record with profile fields",
+				parameters: Type.Object({
+					tenantId: Type.String(),
+					platform: Type.String(),
+					platformId: Type.String(),
+					displayName: Type.Optional(Type.String())
+				}),
+				handler: (params) => http.request("POST", "/internal/identity/resolve", {
+					platform: params.platform,
+					platformId: params.platformId,
+					displayName: params.displayName,
+					tenantId: params.tenantId,
+					agentId: "plugin"
+				})
+			}),
+			defineTool({
+				name: "merge_identities",
+				description: "Merge two identity records — transfers notes, tags, aliases, platforms to survivor",
+				parameters: Type.Object({
+					survivorId: Type.String({ description: "Identity to keep" }),
+					mergedId: Type.String({ description: "Identity to merge into survivor" }),
+					tenantId: Type.String()
+				}),
+				handler: (params) => http.request("POST", `/internal/identity/${encodeURIComponent(params.survivorId)}/merge`, {
+					tenantId: params.tenantId,
+					mergedId: params.mergedId,
+					changedBy: {
+						type: "agent",
+						id: "plugin"
+					}
+				})
+			}),
+			defineTool({
+				name: "unmerge_identities",
+				description: "Reverse a merge — restore previously merged identity",
+				parameters: Type.Object({
+					mergedId: Type.String({ description: "Identity that was merged (has mergedInto pointer)" }),
+					tenantId: Type.String()
+				}),
+				handler: (params) => http.request("POST", `/internal/identity/${encodeURIComponent(params.mergedId)}/unmerge`, {
+					tenantId: params.tenantId,
+					changedBy: {
+						type: "agent",
+						id: "plugin"
+					}
+				})
+			}),
+			defineTool({
+				name: "link_platform",
+				description: "Link a platform identity to an existing identity record",
+				parameters: Type.Object({
+					identityId: Type.String(),
+					platform: Type.String(),
+					platformId: Type.String(),
+					tenantId: Type.String()
+				}),
+				handler: (params) => http.request("POST", "/internal/identity/resolve", {
+					platform: params.platform,
+					platformId: params.platformId,
+					tenantId: params.tenantId,
+					agentId: "plugin"
+				})
+			}),
+			defineTool({
+				name: "add_identity_note",
+				description: "Add an observation or note about a contact",
+				parameters: Type.Object({
+					identityId: Type.String(),
+					tenantId: Type.String(),
+					content: Type.String(),
+					category: Type.Optional(Type.String({ description: "observation, preference, relationship, context, or warning" }))
+				}),
+				handler: (params) => http.request("POST", `/internal/identity/${encodeURIComponent(params.identityId)}/notes`, {
+					tenantId: params.tenantId,
+					content: params.content,
+					category: params.category,
+					changedBy: {
+						type: "agent",
+						id: "plugin"
+					}
+				})
+			}),
+			defineTool({
+				name: "tag_identity",
+				description: "Add or remove a tag on an identity",
+				parameters: Type.Object({
+					identityId: Type.String(),
+					tenantId: Type.String(),
+					tag: Type.String(),
+					action: Type.String({ description: "'add' or 'remove'" })
+				}),
+				handler: (params) => http.request("POST", `/internal/identity/${encodeURIComponent(params.identityId)}/tags`, {
+					tenantId: params.tenantId,
+					tag: params.tag,
+					action: params.action,
+					changedBy: {
+						type: "agent",
+						id: "plugin"
+					}
+				})
+			}),
+			defineTool({
+				name: "get_identity_changelog",
+				description: "Get full changelog for an identity — all versions, diffs, who changed what",
+				parameters: Type.Object({
+					identityId: Type.String(),
+					tenantId: Type.String(),
+					limit: Type.Optional(Type.Number())
+				}),
+				handler: async (params) => {
+					const qs = new URLSearchParams({ tenantId: params.tenantId });
+					if (params.limit) qs.set("limit", String(Number(params.limit)));
+					return http.request("GET", `/internal/identity/${encodeURIComponent(params.identityId)}/changelog?${qs.toString()}`);
+				}
+			}),
+			defineTool({
+				name: "rollback_identity",
+				description: "Revert an identity to a previous version",
+				parameters: Type.Object({
+					identityId: Type.String(),
+					tenantId: Type.String(),
+					targetVersion: Type.Number()
+				}),
+				handler: (params) => http.request("POST", `/internal/identity/${encodeURIComponent(params.identityId)}/rollback`, {
+					tenantId: params.tenantId,
+					targetVersion: params.targetVersion,
+					changedBy: {
+						type: "agent",
+						id: "plugin"
+					}
+				})
+			}),
+			defineTool({
+				name: "enforce_policy",
+				description: "Resolve sender identity and return their tool policy",
+				parameters: Type.Object({
+					platform: Type.String(),
+					senderId: Type.String(),
+					channelId: Type.Optional(Type.String()),
+					tenantId: Type.String()
+				}),
+				handler: (params) => http.request("POST", "/internal/identity/enforce", {
+					platform: params.platform,
+					senderId: params.senderId,
+					channelId: params.channelId,
+					tenantId: params.tenantId
+				})
+			}),
+			defineTool({
+				name: "check_permission",
+				description: "Check if a specific tool call is allowed for a sender",
+				parameters: Type.Object({
+					platform: Type.String(),
+					senderId: Type.String(),
+					toolName: Type.String(),
+					tenantId: Type.String()
+				}),
+				handler: (params) => http.request("POST", "/internal/identity/check-tool", {
+					platform: params.platform,
+					senderId: params.senderId,
+					toolName: params.toolName,
+					tenantId: params.tenantId
+				})
+			})
+		];
+		for (const tool of tools) {
+			api.registerTool(tool);
+			identityToolNames.add(tool.name);
+		}
+		log.info(`Registered ${String(tools.length)} identity tools`);
+		api.on("message_received", async (...args) => {
+			const event = args[0];
+			const ctx = args[1];
+			const platform = ctx.channelId ?? "unknown";
+			const senderId = event.from;
+			if (!senderId) return;
+			const cacheKey = ctx.conversationId ?? `${platform}:${senderId}`;
+			const cached = getCached(cacheKey);
+			if (cached) {
+				if (!cached.accessAllowed) return {
+					block: true,
+					blockReason: "Identity: access denied for this sender"
+				};
+				return;
+			}
+			try {
+				const tenantId = ctx.tenantId ?? "";
+				const agentId = ctx.agentId ?? "";
+				const resolveResult = await http.request("POST", "/internal/identity/resolve", {
+					platform,
+					platformId: senderId,
+					tenantId,
+					agentId
+				});
+				setCached(cacheKey, {
+					...await http.request("POST", "/internal/identity/enforce", {
+						platform,
+						senderId,
+						tenantId
+					}),
+					accessAllowed: resolveResult.accessAllowed
+				});
+				if (!resolveResult.accessAllowed) return {
+					block: true,
+					blockReason: "Identity: access denied for this sender"
+				};
+				log.info(`Identity resolved: ${senderId} → ${resolveResult.identityId ?? "unknown"} (${resolveResult.status})`);
+			} catch (e) {
+				log.error(`Identity resolution failed for ${senderId}: ${e.message}`);
+			}
+		}, { priority: 100 });
+		api.on("before_tool_call", async (...args) => {
+			const event = args[0];
+			const ctx = args[1];
+			if (identityToolNames.has(event.toolName)) return;
+			const sessionKey = ctx.sessionKey;
+			if (!sessionKey) return;
+			const perms = getCached(sessionKey);
+			if (!perms) return {
+				block: true,
+				blockReason: "Identity: no identity context established — tool access denied"
+			};
+			if (!perms.identified) return {
+				block: true,
+				blockReason: "Identity: unknown sender identity — tool access denied"
+			};
+			if (perms.deniedTools.includes("*") || perms.deniedTools.includes(event.toolName)) return {
+				block: true,
+				blockReason: `Identity: tool '${event.toolName}' is denied for your role`
+			};
+			if (perms.allowedTools.length > 0 && !perms.allowedTools.includes(event.toolName)) return {
+				block: true,
+				blockReason: `Identity: tool '${event.toolName}' is not in your allowed tools`
+			};
+		}, { priority: 100 });
+		api.on("after_tool_call", async (...args) => {
+			const event = args[0];
+			const ctx = args[1];
+			const sessionKey = ctx.sessionKey;
+			if (!sessionKey) return;
+			const perms = getCached(sessionKey);
+			if (!perms?.identityId) return;
+			try {
+				await http.request("POST", "/internal/identity/check-tool", {
+					platform: "tool_audit",
+					senderId: perms.identityId,
+					toolName: event.toolName,
+					tenantId: ctx.tenantId ?? ""
+				});
+			} catch (e) {
+				log.error(`Audit logging failed: ${e.message}`);
+			}
+		});
+		log.info("Alfe Identity plugin activated");
+	}
+};
+//#endregion
+export { plugin as default };

package/openclaw.plugin.json

@@ -0,0 +1,7 @@
+{
+  "id": "alfe-identity",
+  "name": "Alfe Identity",
+  "version": "0.0.1",
+  "description": "Identity resolution, access gating, and permission enforcement",
+  "entry": "./dist/plugin.js"
+}

package/package.json

@@ -0,0 +1,40 @@
+{
+  "name": "@alfe.ai/openclaw-identity",
+  "version": "0.0.1",
+  "description": "OpenClaw identity plugin — identity resolution, access gating, permission enforcement",
+  "type": "module",
+  "main": "./dist/plugin.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "require": "./dist/index.cjs",
+      "import": "./dist/index.js"
+    },
+    "./plugin": {
+      "types": "./dist/plugin.d.ts",
+      "require": "./dist/plugin.cjs",
+      "import": "./dist/plugin.js"
+    }
+  },
+  "openclaw": {
+    "extensions": [
+      "./dist/plugin.js"
+    ]
+  },
+  "files": [
+    "dist",
+    "openclaw.plugin.json"
+  ],
+  "dependencies": {
+    "@sinclair/typebox": "^0.34.48",
+    "@alfe.ai/config": "0.0.7"
+  },
+  "license": "UNLICENSED",
+  "scripts": {
+    "build": "tsdown",
+    "dev": "tsdown --watch",
+    "typecheck": "tsc --noEmit",
+    "lint": "eslint ."
+  }
+}