@alfe.ai/openclaw-identity 0.0.10 → 0.0.11

package/dist/index.cjs

@@ -1,2 +1,27 @@
-const require_plugin = require("./plugin2.cjs");
-module.exports = require_plugin.plugin;
+Object.defineProperties(exports, {
+	__esModule: { value: true },
+	[Symbol.toStringTag]: { value: "Module" }
+});
+const require_plugin = require("./plugin.cjs");
+//#region src/runtime-contract.ts
+/**
+* Build the gate context object used by sift evaluation. This is the
+* round-6 "strict namespacing" shape — `args` is a top-level field, not
+* spread, so an attacker-controlled `tool` field inside `toolArgs` cannot
+* override the gate's `tool` value.
+*
+* Stage E's gate calls:
+*   ability.has(
+*     { subject: "agent", action: "exec", scope: `agent:${ctx.agentId}` },
+*     buildGateContext(event),
+*   );
+*/
+function buildGateContext(event) {
+	return {
+		tool: event.toolName,
+		args: event.toolArgs
+	};
+}
+//#endregion
+exports.buildGateContext = buildGateContext;
+exports.default = require_plugin;

package/dist/index.d.cts

@@ -1,2 +1,147 @@
 import plugin from "./plugin.cjs";
-export { plugin as default };
+
+//#region src/policy-cache.d.ts
+
+type IdentityFailureMode = "open" | "closed" | "permissive";
+/**
+ * Evaluate whether a tool call should be blocked based on the cached policy
+ * and failure mode.
+ */
+
+//#endregion
+//#region src/runtime-contract.d.ts
+
+/**
+ * The tool the agent is about to call.
+ *
+ * `toolName` SHOULD be namespaced (e.g., `gmail:send_email`, `calendar:create_event`)
+ * so sift `$glob: "gmail:*"` conditions work and namespace collisions are
+ * impossible. Plugins that don't yet namespace their tools will be migrated
+ * during Stage I rollout.
+ */
+interface ToolCallEvent {
+  /** Namespaced tool name, e.g. "gmail:send_email". */
+  readonly toolName: string;
+  /** Arbitrary argument bag passed to the tool's `execute` function. */
+  readonly toolArgs: Record<string, unknown>;
+}
+/**
+ * What initiated the tool call. Three buckets:
+ *   - "user_message"  — a human (or another agent) sent a message that the
+ *                       agent is now responding to. `actingIdentityId` is the
+ *                       identity of the message sender.
+ *   - "scheduled"     — autonomous run (cron/trigger). `actingIdentityId` is
+ *                       the agent's own identity (`idn_agt_*`).
+ *   - "tool_chain"    — a follow-up tool call from a previous tool's result
+ *                       within the same agent invocation. `actingIdentityId`
+ *                       is whatever resolved at the start of the chain.
+ *   - "api"           — a tool call invoked via the agent's REST API by an
+ *                       external caller authenticated with an `alfe_*` token.
+ *                       `actingIdentityId` may be undefined; `tokenPermissions`
+ *                       carries the gate-relevant `Permission[]`.
+ */
+type ToolCallTrigger = "user_message" | "scheduled" | "tool_chain" | "api";
+/**
+ * How the caller authenticated.
+ *   - "jwt"   — Clerk JWT path (human user). `actingIdentityId` resolved from
+ *               the JWT's `sub` via the identity service.
+ *   - "agent" — autonomous agent (no external caller). `actingIdentityId` is
+ *               the agent's own `idn_agt_*`.
+ *   - "token" — `alfe_*` API token. `tokenPermissions` is set; the gate uses
+ *               the token's permissions directly without an identity lookup.
+ *   - "none"  — no auth context (fail-closed in prod via IdentityFailureMode).
+ */
+type ToolCallAuthMethod = "jwt" | "agent" | "token" | "none";
+/**
+ * Permission shape the gate consumes. This is a structural duplicate of
+ * `Permission` from `@auriclabs/roles@0.1.1` so the openclaw plugin doesn't
+ * have to depend on the library directly (the library is consumed inside the
+ * gate itself in Stage E). Keep the two shapes in lockstep.
+ */
+interface RuntimePermission {
+  readonly subject: string;
+  readonly action: string;
+  readonly scope?: string;
+  /**
+   * Round 7 storage shape: sift conditions stored per-permission. The runtime
+   * gate evaluates the condition against `{ tool, args }` (round 6 strict
+   * namespacing). Glob source travels under `$glob`; the compiled regex
+   * travels under `_glob_re` with a `_glob_v` version marker (round 7 audit
+   * 3.6 storage shape).
+   */
+  readonly conditions?: Record<string, unknown>;
+  readonly type?: "can" | "cannot";
+}
+/**
+ * Calling context for the tool call. Populated by the OpenClaw daemon at
+ * dispatch time.
+ */
+interface ToolCallContext {
+  /** Required: the tenant (`org_*`) that owns the agent. */
+  readonly tenantId: string;
+  /** Required: the agent (`agt_*`) that is about to call the tool. */
+  readonly agentId: string;
+  /** Required: how the caller authenticated. */
+  readonly authMethod: ToolCallAuthMethod;
+  /** Required: what initiated the call. */
+  readonly trigger: ToolCallTrigger;
+  /**
+   * The identity (`idn_*`) the agent is acting on behalf of. Resolution
+   * order:
+   *   1. If `trigger === "user_message"`: the chat-context identity (sender).
+   *   2. If `trigger === "scheduled"` or `trigger === "tool_chain"`: the
+   *      agent's own `idn_agt_*` (autonomous default).
+   *   3. If `authMethod === "token"`: optional; the token-path gate uses
+   *      `tokenPermissions` and may skip identity resolution entirely.
+   *   4. Otherwise: undefined; the per-agent `IdentityFailureMode` decides
+   *      whether to allow / deny / log-and-continue.
+   */
+  readonly actingIdentityId?: string;
+  /**
+   * Round 5 / Round 7: `alfe_*` tokens carry their own flat `Permission[]`
+   * directly. When `authMethod === "token"`, the daemon populates this with
+   * `TokenEntity.permissions` (post Stage B.0.7 atomic flip — pre-flip the
+   * authorizer derives this from `record.scopes` via `scopesToPermissions`).
+   * The Stage E gate evaluates these permissions directly at scope
+   * `agent:<agentId>` without an identity lookup.
+   */
+  readonly tokenPermissions?: readonly RuntimePermission[];
+  /** Optional: chat conversation id (when trigger is `user_message`). */
+  readonly conversationId?: string;
+  /** Optional: channel id (when trigger is `user_message`). */
+  readonly channelId?: string;
+}
+/**
+ * Return value of the `before_tool_call` hook.
+ *   - `undefined` — allow.
+ *   - `{ block: true, blockReason: string }` — deny with reason surfaced to
+ *     the agent's response (Stage E behaviour).
+ */
+type ToolCallHookResult = undefined | {
+  block: true;
+  blockReason: string;
+};
+/**
+ * Strongly-typed `before_tool_call` hook signature. The plugin's stub uses
+ * this signature today; Stage E swaps the stub for the real `agent:exec` +
+ * sift gate against `@auriclabs/roles`.
+ */
+type BeforeToolCallHook = (event: ToolCallEvent, ctx: ToolCallContext) => Promise<ToolCallHookResult>;
+/**
+ * Build the gate context object used by sift evaluation. This is the
+ * round-6 "strict namespacing" shape — `args` is a top-level field, not
+ * spread, so an attacker-controlled `tool` field inside `toolArgs` cannot
+ * override the gate's `tool` value.
+ *
+ * Stage E's gate calls:
+ *   ability.has(
+ *     { subject: "agent", action: "exec", scope: `agent:${ctx.agentId}` },
+ *     buildGateContext(event),
+ *   );
+ */
+declare function buildGateContext(event: ToolCallEvent): {
+  tool: string;
+  args: Record<string, unknown>;
+};
+//#endregion
+export { type BeforeToolCallHook, type IdentityFailureMode, type RuntimePermission, type ToolCallAuthMethod, type ToolCallContext, type ToolCallEvent, type ToolCallHookResult, type ToolCallTrigger, buildGateContext, plugin as default };

package/dist/index.d.ts

@@ -1,2 +1,147 @@
 import plugin from "./plugin.js";
-export { plugin as default };
+
+//#region src/policy-cache.d.ts
+
+type IdentityFailureMode = "open" | "closed" | "permissive";
+/**
+ * Evaluate whether a tool call should be blocked based on the cached policy
+ * and failure mode.
+ */
+
+//#endregion
+//#region src/runtime-contract.d.ts
+
+/**
+ * The tool the agent is about to call.
+ *
+ * `toolName` SHOULD be namespaced (e.g., `gmail:send_email`, `calendar:create_event`)
+ * so sift `$glob: "gmail:*"` conditions work and namespace collisions are
+ * impossible. Plugins that don't yet namespace their tools will be migrated
+ * during Stage I rollout.
+ */
+interface ToolCallEvent {
+  /** Namespaced tool name, e.g. "gmail:send_email". */
+  readonly toolName: string;
+  /** Arbitrary argument bag passed to the tool's `execute` function. */
+  readonly toolArgs: Record<string, unknown>;
+}
+/**
+ * What initiated the tool call. Three buckets:
+ *   - "user_message"  — a human (or another agent) sent a message that the
+ *                       agent is now responding to. `actingIdentityId` is the
+ *                       identity of the message sender.
+ *   - "scheduled"     — autonomous run (cron/trigger). `actingIdentityId` is
+ *                       the agent's own identity (`idn_agt_*`).
+ *   - "tool_chain"    — a follow-up tool call from a previous tool's result
+ *                       within the same agent invocation. `actingIdentityId`
+ *                       is whatever resolved at the start of the chain.
+ *   - "api"           — a tool call invoked via the agent's REST API by an
+ *                       external caller authenticated with an `alfe_*` token.
+ *                       `actingIdentityId` may be undefined; `tokenPermissions`
+ *                       carries the gate-relevant `Permission[]`.
+ */
+type ToolCallTrigger = "user_message" | "scheduled" | "tool_chain" | "api";
+/**
+ * How the caller authenticated.
+ *   - "jwt"   — Clerk JWT path (human user). `actingIdentityId` resolved from
+ *               the JWT's `sub` via the identity service.
+ *   - "agent" — autonomous agent (no external caller). `actingIdentityId` is
+ *               the agent's own `idn_agt_*`.
+ *   - "token" — `alfe_*` API token. `tokenPermissions` is set; the gate uses
+ *               the token's permissions directly without an identity lookup.
+ *   - "none"  — no auth context (fail-closed in prod via IdentityFailureMode).
+ */
+type ToolCallAuthMethod = "jwt" | "agent" | "token" | "none";
+/**
+ * Permission shape the gate consumes. This is a structural duplicate of
+ * `Permission` from `@auriclabs/roles@0.1.1` so the openclaw plugin doesn't
+ * have to depend on the library directly (the library is consumed inside the
+ * gate itself in Stage E). Keep the two shapes in lockstep.
+ */
+interface RuntimePermission {
+  readonly subject: string;
+  readonly action: string;
+  readonly scope?: string;
+  /**
+   * Round 7 storage shape: sift conditions stored per-permission. The runtime
+   * gate evaluates the condition against `{ tool, args }` (round 6 strict
+   * namespacing). Glob source travels under `$glob`; the compiled regex
+   * travels under `_glob_re` with a `_glob_v` version marker (round 7 audit
+   * 3.6 storage shape).
+   */
+  readonly conditions?: Record<string, unknown>;
+  readonly type?: "can" | "cannot";
+}
+/**
+ * Calling context for the tool call. Populated by the OpenClaw daemon at
+ * dispatch time.
+ */
+interface ToolCallContext {
+  /** Required: the tenant (`org_*`) that owns the agent. */
+  readonly tenantId: string;
+  /** Required: the agent (`agt_*`) that is about to call the tool. */
+  readonly agentId: string;
+  /** Required: how the caller authenticated. */
+  readonly authMethod: ToolCallAuthMethod;
+  /** Required: what initiated the call. */
+  readonly trigger: ToolCallTrigger;
+  /**
+   * The identity (`idn_*`) the agent is acting on behalf of. Resolution
+   * order:
+   *   1. If `trigger === "user_message"`: the chat-context identity (sender).
+   *   2. If `trigger === "scheduled"` or `trigger === "tool_chain"`: the
+   *      agent's own `idn_agt_*` (autonomous default).
+   *   3. If `authMethod === "token"`: optional; the token-path gate uses
+   *      `tokenPermissions` and may skip identity resolution entirely.
+   *   4. Otherwise: undefined; the per-agent `IdentityFailureMode` decides
+   *      whether to allow / deny / log-and-continue.
+   */
+  readonly actingIdentityId?: string;
+  /**
+   * Round 5 / Round 7: `alfe_*` tokens carry their own flat `Permission[]`
+   * directly. When `authMethod === "token"`, the daemon populates this with
+   * `TokenEntity.permissions` (post Stage B.0.7 atomic flip — pre-flip the
+   * authorizer derives this from `record.scopes` via `scopesToPermissions`).
+   * The Stage E gate evaluates these permissions directly at scope
+   * `agent:<agentId>` without an identity lookup.
+   */
+  readonly tokenPermissions?: readonly RuntimePermission[];
+  /** Optional: chat conversation id (when trigger is `user_message`). */
+  readonly conversationId?: string;
+  /** Optional: channel id (when trigger is `user_message`). */
+  readonly channelId?: string;
+}
+/**
+ * Return value of the `before_tool_call` hook.
+ *   - `undefined` — allow.
+ *   - `{ block: true, blockReason: string }` — deny with reason surfaced to
+ *     the agent's response (Stage E behaviour).
+ */
+type ToolCallHookResult = undefined | {
+  block: true;
+  blockReason: string;
+};
+/**
+ * Strongly-typed `before_tool_call` hook signature. The plugin's stub uses
+ * this signature today; Stage E swaps the stub for the real `agent:exec` +
+ * sift gate against `@auriclabs/roles`.
+ */
+type BeforeToolCallHook = (event: ToolCallEvent, ctx: ToolCallContext) => Promise<ToolCallHookResult>;
+/**
+ * Build the gate context object used by sift evaluation. This is the
+ * round-6 "strict namespacing" shape — `args` is a top-level field, not
+ * spread, so an attacker-controlled `tool` field inside `toolArgs` cannot
+ * override the gate's `tool` value.
+ *
+ * Stage E's gate calls:
+ *   ability.has(
+ *     { subject: "agent", action: "exec", scope: `agent:${ctx.agentId}` },
+ *     buildGateContext(event),
+ *   );
+ */
+declare function buildGateContext(event: ToolCallEvent): {
+  tool: string;
+  args: Record<string, unknown>;
+};
+//#endregion
+export { type BeforeToolCallHook, type IdentityFailureMode, type RuntimePermission, type ToolCallAuthMethod, type ToolCallContext, type ToolCallEvent, type ToolCallHookResult, type ToolCallTrigger, buildGateContext, plugin as default };

package/dist/index.js

@@ -1,2 +1,22 @@
-import { t as plugin } from "./plugin2.js";
-export { plugin as default };
+import plugin from "./plugin.js";
+//#region src/runtime-contract.ts
+/**
+* Build the gate context object used by sift evaluation. This is the
+* round-6 "strict namespacing" shape — `args` is a top-level field, not
+* spread, so an attacker-controlled `tool` field inside `toolArgs` cannot
+* override the gate's `tool` value.
+*
+* Stage E's gate calls:
+*   ability.has(
+*     { subject: "agent", action: "exec", scope: `agent:${ctx.agentId}` },
+*     buildGateContext(event),
+*   );
+*/
+function buildGateContext(event) {
+	return {
+		tool: event.toolName,
+		args: event.toolArgs
+	};
+}
+//#endregion
+export { buildGateContext, plugin as default };

package/dist/plugin.cjs

@@ -1,2 +1,325 @@
-const require_plugin = require("./plugin2.cjs");
-module.exports = require_plugin.plugin;
+let _alfe_ai_config = require("@alfe.ai/config");
+let _alfe_ai_agent_api_client = require("@alfe.ai/agent-api-client");
+let _sinclair_typebox = require("@sinclair/typebox");
+//#region src/plugin.ts
+/**
+* @alfe.ai/openclaw-identity — OpenClaw native plugin
+*
+* HTTP-based identity resolution + AccessConfig admission gate. Installed as
+* part of the core alfe integration on every agent.
+*
+* Hooks:
+*   - message_received  → always resolves the sender, gates on accessAllowed,
+*                         blocks unknown senders (read-only resolve).
+*   - before_tool_call  → typed `(event: ToolCallEvent, ctx: ToolCallContext)`
+*                         hook (Phase 1 Stage A.0). Today: permissive no-op
+*                         stub. Phase 1 Stage E swaps the stub for the
+*                         `agent:exec` + sift gate (Decision 17).
+*
+* `after_tool_call` is intentionally absent — tool-call audit lives in a
+* future dedicated audit service, not in identity.
+*/
+const pkg = (0, require("node:module").createRequire)(require("url").pathToFileURL(__filename).href)("../package.json");
+const RESOLVE_CACHE_TTL_MS = 6e4;
+const resolveCache = /* @__PURE__ */ new Map();
+function getCachedResolve(key) {
+	const entry = resolveCache.get(key);
+	if (!entry) return null;
+	if (Date.now() > entry.expiresAt) {
+		resolveCache.delete(key);
+		return null;
+	}
+	return entry;
+}
+function setCachedResolve(key, value) {
+	resolveCache.set(key, {
+		...value,
+		expiresAt: Date.now() + RESOLVE_CACHE_TTL_MS
+	});
+}
+function ok(data) {
+	return {
+		content: [{
+			type: "text",
+			text: JSON.stringify(data)
+		}],
+		details: data
+	};
+}
+function errResult(message) {
+	return {
+		content: [{
+			type: "text",
+			text: JSON.stringify({ error: message })
+		}],
+		details: { error: message }
+	};
+}
+function defineTool(def) {
+	return {
+		name: def.name,
+		description: def.description,
+		label: def.name,
+		parameters: def.parameters,
+		execute: async (_toolCallId, params) => {
+			try {
+				return ok(await def.handler(params));
+			} catch (e) {
+				return errResult(e.message);
+			}
+		}
+	};
+}
+const plugin = {
+	id: "@alfe.ai/openclaw-identity",
+	name: "Alfe Identity",
+	description: "Identity resolution and access gating for inbound messages",
+	version: pkg.version,
+	activate(api) {
+		const log = api.logger;
+		log.info("Alfe Identity plugin activating...");
+		let client;
+		try {
+			const config = (0, _alfe_ai_config.resolveConfig)();
+			client = new _alfe_ai_agent_api_client.AgentApiClient({
+				apiKey: config.apiKey,
+				apiUrl: config.apiUrl
+			});
+		} catch (err) {
+			log.error(`Identity plugin: failed to resolve config — ${err instanceof Error ? err.message : String(err)}`);
+			return;
+		}
+		const tools = [
+			defineTool({
+				name: "who_is_this",
+				description: "Look up an identity by provider + platformId — returns full identity context (profile, contacts, platforms, notes, tags, recent changelog). Returns `{found:false}` for unknown senders. This tool DOES NOT create new identities.",
+				parameters: _sinclair_typebox.Type.Object({
+					provider: _sinclair_typebox.Type.String({ description: "Provider name (discord, slack, chat, google-chat, clerk, etc.)" }),
+					platformId: _sinclair_typebox.Type.String({ description: "Provider-specific user identifier" })
+				}),
+				handler: async (params) => {
+					const result = await client.resolveIdentity({
+						provider: params.provider,
+						platformId: params.platformId
+					});
+					if (!result.identityId) return { found: false };
+					return client.getIdentityContext(result.identityId);
+				}
+			}),
+			defineTool({
+				name: "lookup_identity",
+				description: "Search identities by name. Returns multiple matches.",
+				parameters: _sinclair_typebox.Type.Object({
+					query: _sinclair_typebox.Type.Optional(_sinclair_typebox.Type.String({ description: "Text search query" })),
+					status: _sinclair_typebox.Type.Optional(_sinclair_typebox.Type.String())
+				}),
+				handler: (params) => client.searchIdentities({
+					q: params.query,
+					status: params.status
+				})
+			}),
+			defineTool({
+				name: "merge_identities",
+				description: "Merge two identity records — transfers contacts, platforms, notes, tags, aliases to the survivor. Hard-move, transactional.",
+				parameters: _sinclair_typebox.Type.Object({
+					survivorId: _sinclair_typebox.Type.String({ description: "Identity to keep" }),
+					mergedId: _sinclair_typebox.Type.String({ description: "Identity to merge into survivor" })
+				}),
+				handler: (params) => client.mergeIdentities(params.survivorId, {
+					mergedId: params.mergedId,
+					changedBy: {
+						type: "agent",
+						id: "plugin"
+					}
+				})
+			}),
+			defineTool({
+				name: "unmerge_identities",
+				description: "Reverse a merge — restore previously merged identity.",
+				parameters: _sinclair_typebox.Type.Object({ mergedId: _sinclair_typebox.Type.String({ description: "Identity that was merged (has mergedInto pointer)" }) }),
+				handler: (params) => client.unmergeIdentity(params.mergedId, { changedBy: {
+					type: "agent",
+					id: "plugin"
+				} })
+			}),
+			defineTool({
+				name: "add_identity_note",
+				description: "Add an observation or note about an identity. Use category 'context' for unverified affiliation claims (self-reported title/company) — those do NOT belong on the identity row directly.",
+				parameters: _sinclair_typebox.Type.Object({
+					identityId: _sinclair_typebox.Type.String(),
+					content: _sinclair_typebox.Type.String(),
+					category: _sinclair_typebox.Type.Optional(_sinclair_typebox.Type.String({ description: "observation, preference, relationship, context, or warning" }))
+				}),
+				handler: (params) => client.addIdentityNote(params.identityId, {
+					content: params.content,
+					category: params.category,
+					changedBy: {
+						type: "agent",
+						id: "plugin"
+					}
+				})
+			}),
+			defineTool({
+				name: "tag_identity",
+				description: "Add or remove a tag on an identity.",
+				parameters: _sinclair_typebox.Type.Object({
+					identityId: _sinclair_typebox.Type.String(),
+					tag: _sinclair_typebox.Type.String(),
+					action: _sinclair_typebox.Type.String({ description: "'add' or 'remove'" })
+				}),
+				handler: (params) => client.tagIdentity(params.identityId, {
+					tag: params.tag,
+					action: params.action,
+					changedBy: {
+						type: "agent",
+						id: "plugin"
+					}
+				})
+			}),
+			defineTool({
+				name: "get_identity_changelog",
+				description: "Get the changelog for an identity — versions, diffs, who changed what.",
+				parameters: _sinclair_typebox.Type.Object({
+					identityId: _sinclair_typebox.Type.String(),
+					limit: _sinclair_typebox.Type.Optional(_sinclair_typebox.Type.Number())
+				}),
+				handler: (params) => client.getIdentityChangelog(params.identityId, { limit: params.limit })
+			}),
+			defineTool({
+				name: "rollback_identity",
+				description: "Revert an identity to a previous version.",
+				parameters: _sinclair_typebox.Type.Object({
+					identityId: _sinclair_typebox.Type.String(),
+					targetVersion: _sinclair_typebox.Type.Number()
+				}),
+				handler: (params) => client.rollbackIdentity(params.identityId, {
+					targetVersion: params.targetVersion,
+					changedBy: {
+						type: "agent",
+						id: "plugin"
+					}
+				})
+			}),
+			defineTool({
+				name: "update_identity",
+				description: "Update display-shape fields on an identity: name / avatarUrl / timezone / locale. Contact mutations go through the verify flow — this tool will NOT accept email or mobile. Title and company live on org membership rows, not here.",
+				parameters: _sinclair_typebox.Type.Object({
+					identityId: _sinclair_typebox.Type.String(),
+					name: _sinclair_typebox.Type.Optional(_sinclair_typebox.Type.String()),
+					avatarUrl: _sinclair_typebox.Type.Optional(_sinclair_typebox.Type.String()),
+					timezone: _sinclair_typebox.Type.Optional(_sinclair_typebox.Type.String()),
+					locale: _sinclair_typebox.Type.Optional(_sinclair_typebox.Type.String())
+				}),
+				handler: (params) => {
+					const { identityId, ...rest } = params;
+					return client.updateIdentity(identityId, rest);
+				}
+			}),
+			defineTool({
+				name: "request_identity_verification",
+				description: "Send a verification phrase to verify the user controls an email or mobile endpoint. Use this when the user has just told you their email or mobile number and you want them to confirm it. Pass exactly one of `contactEmail` or `contactMobile`. The person must relay the phrase back via `confirm_identity_verification`.",
+				parameters: _sinclair_typebox.Type.Object({
+					claimedIdentityId: _sinclair_typebox.Type.String({ description: "Identity being claimed" }),
+					requestingIdentityId: _sinclair_typebox.Type.String({ description: "Identity of the person making the claim" }),
+					requestingProvider: _sinclair_typebox.Type.String({ description: "Provider the requester is on (discord, slack, chat, etc.)" }),
+					requestingPlatformId: _sinclair_typebox.Type.String({ description: "Requester's provider-specific user ID" }),
+					contactEmail: _sinclair_typebox.Type.Optional(_sinclair_typebox.Type.String({ description: "Email to verify (mutually exclusive with contactMobile)" })),
+					contactMobile: _sinclair_typebox.Type.Optional(_sinclair_typebox.Type.String({ description: "E.164 mobile to verify (mutually exclusive with contactEmail)" })),
+					preferredChannel: _sinclair_typebox.Type.Optional(_sinclair_typebox.Type.String({ description: "When neither contactEmail nor contactMobile is provided, pick which existing verified contact to deliver to: 'mobile' or 'email'" }))
+				}),
+				handler: (params) => {
+					const contactEmail = params.contactEmail;
+					const contactMobile = params.contactMobile;
+					if (contactEmail && contactMobile) return Promise.resolve({ error: "Specify exactly one of contactEmail or contactMobile, not both" });
+					const contact = contactEmail ? {
+						channel: "email",
+						value: contactEmail
+					} : contactMobile ? {
+						channel: "mobile",
+						value: contactMobile
+					} : void 0;
+					return client.requestIdentityVerification({
+						claimedIdentityId: params.claimedIdentityId,
+						requestingIdentityId: params.requestingIdentityId,
+						requestingProvider: params.requestingProvider,
+						requestingPlatformId: params.requestingPlatformId,
+						preferredChannel: params.preferredChannel,
+						contact
+					});
+				}
+			}),
+			defineTool({
+				name: "confirm_identity_verification",
+				description: "Confirm a verification by submitting the phrase the user received. Returns `{ verified, identityId, action }` where `action` is 'merged' (the verified contact already lived on another identity, which is now the survivor) or 'contact_verified' (the contact was attached to the claimed identity).",
+				parameters: _sinclair_typebox.Type.Object({
+					claimedIdentityId: _sinclair_typebox.Type.String({ description: "Identity being claimed (matches request)" }),
+					verificationId: _sinclair_typebox.Type.String({ description: "Verification ID returned from request_identity_verification" }),
+					phrase: _sinclair_typebox.Type.String({ description: "Three-word phrase the person received via mobile or email" })
+				}),
+				handler: (params) => client.confirmIdentityVerification({
+					claimedIdentityId: params.claimedIdentityId,
+					verificationId: params.verificationId,
+					phrase: params.phrase
+				})
+			})
+		];
+		for (const tool of tools) api.registerTool(tool);
+		log.info(`Registered ${String(tools.length)} identity tools`);
+		api.on("message_received", async (...args) => {
+			const event = args[0];
+			const ctx = args[1];
+			const provider = ctx.channelId ?? "unknown";
+			const senderId = event.metadata?.UserId ?? event.from;
+			if (!senderId) return;
+			const cacheKey = ctx.conversationId ?? `${provider}:${senderId}`;
+			const cached = getCachedResolve(cacheKey);
+			if (cached) {
+				if (cached.identityId == null) return {
+					block: true,
+					blockReason: "Identity: identity not provisioned for this channel"
+				};
+				if (!cached.accessAllowed) return {
+					block: true,
+					blockReason: "Identity: access denied for this sender"
+				};
+				return;
+			}
+			try {
+				const r = await client.resolveIdentity({
+					provider,
+					platformId: senderId
+				});
+				setCachedResolve(cacheKey, {
+					identityId: r.identityId,
+					accessAllowed: r.accessAllowed,
+					status: r.status
+				});
+				if (r.identityId == null) {
+					log.warn(`Identity not provisioned for ${provider}:${senderId} — blocking inbound message`);
+					return {
+						block: true,
+						blockReason: "Identity: identity not provisioned for this channel"
+					};
+				}
+				if (!r.accessAllowed) return {
+					block: true,
+					blockReason: "Identity: access denied for this sender"
+				};
+				log.info(`Identity resolved: ${senderId} → ${r.identityId} (${r.status})`);
+			} catch (e) {
+				log.error(`Identity resolution failed for ${senderId}: ${e.message}`);
+				return {
+					block: true,
+					blockReason: "Identity: identity service unavailable — access denied (fail-closed)"
+				};
+			}
+		}, { priority: 100 });
+		const beforeToolCallStub = (event, ctx) => {
+			return Promise.resolve(void 0);
+		};
+		api.on("before_tool_call", (...args) => beforeToolCallStub(args[0], args[1]), { priority: 100 });
+		log.info("Alfe Identity plugin activated");
+	}
+};
+//#endregion
+module.exports = plugin;