@relaymessenger/openclaw-plugin 0.4.0-staging.4 → 0.4.0

package/README.md

@@ -160,9 +160,9 @@ durable ACK and idempotent REST reply.
 ## Contract lock
 
 `contracts/relay-v1.lock.json` records the compatibility boundary used by this
-release: Relay Server
-`f91f22ea55ac0485efa181bb650998848c973c6e`, OpenAPI SHA-256
-`bbcdc6988e09feeeac1ae28cf299904b59e220ac7b5f936009845ad07645ead2`,
+candidate: Relay Server commit
+`f2f36e5284dcfb365af9759f5ee5bfa7954b6521`, OpenAPI SHA-256
+`df402b9bebcce58be2f7fa2e0a193e68896d7d34a6e4581dc4e5446a7854ab84`,
 public `ChatHandle.image_url` and `ChatHandle.about` fields with no legacy
 aliases,
 and the exact `@relaymessenger/sdk@0.3.0-staging.8` registry integrity, source
@@ -170,16 +170,15 @@ commit `1bbcb486b4a91860ee3527ce95d015883e4cc1ae`, REST operations, and WebSocke
 frames consumed by the plugin.
 
 Public CI hashes the checked-in `contracts/relay-openapi.yaml` fixture and
-requires the locked digest above. The retained private release receipt also
-sets `RELAY_SERVER_SOURCE_DIR` to an exact checkout of Server `f14c368b3954`
-and proves that the fixture bytes exactly match the locked Server commit before
-packaging. The public Relay-SDK monorepo does not require credentials for the
+requires the locked digest above. Set `RELAY_SERVER_SOURCE_DIR` to an exact
+checkout of Server `f2f36e5284dcfb365af9759f5ee5bfa7954b6521` to additionally prove
+that the fixture bytes match the committed source before packaging. The public Relay-SDK monorepo does not require credentials for the
 private Server source and does not overstate what npm metadata can attest.
 
-`contracts/relay-sdk-0.3.0-staging.8.registry.json` records immutable npm
-publication metadata and tarball digests. Validation downloads the registry
-tarball, verifies SHA-1, SHA-256, and SHA-512 integrity, checks the installed
-SDK, and compares its package metadata with exact SDK commit `1bbcb48`. The
-npm SLSA statement binds the published tarball digest to that commit through
-the trusted staging publish workflow. These are artifact compatibility and
-source-provenance checks, not a claim of a hosted Relay deployment test.
+`contracts/relay-v1.lock.json` records the exact `@relaymessenger/sdk`
+version this plugin ships against and the sha512 npm stores as that tarball's
+`dist.integrity`. Validation reads the packument, downloads the registry
+tarball, hashes it against the lock, and checks the installed SDK's version and
+types. Production publishes carry no npm attestation (Blacksmith runners), so
+the tarball bytes are the receipt. These are artifact compatibility checks,
+not a claim of a hosted Relay deployment test.

package/contracts/relay-v1.lock.json

@@ -1,22 +1,16 @@
 {
   "relayServer": {
     "repository": "RelayMessenger/Relay-Server",
-    "commit": "f91f22ea55ac0485efa181bb650998848c973c6e",
+    "commit": "f2f36e5284dcfb365af9759f5ee5bfa7954b6521",
     "openapiPath": "contracts/developer/openapi.yaml",
-    "sha256": "bbcdc6988e09feeeac1ae28cf299904b59e220ac7b5f936009845ad07645ead2"
+    "sha256": "df402b9bebcce58be2f7fa2e0a193e68896d7d34a6e4581dc4e5446a7854ab84"
   },
   "relaySdk": {
     "package": "@relaymessenger/sdk",
-    "version": "0.3.0-staging.8",
-    "integrity": "sha512-Db1gn5iQ7ZNrGHPudE4gRW+3H1w4tCluAkGAvXAxyJMBBScySa622BaKpTilmNP7vRFxzoL4tM65n8So0QY/KA==",
+    "version": "0.3.0",
+    "integrity": "sha512-RywnJ2G1ZctGMhdJ/WnnxTYZ3/k1EppAJQBN7VttT4w/vDvEkawoK4lmJoHuAftQzyQ6oCzqoVya/E2l/nt8AA==",
     "operationsSha256": "e25d720257c2dc5286dda6bd3936395c7d7f333bd3bbdc996d45c13ad49eee9a",
-    "registryReceipt": "contracts/relay-sdk-0.3.0-staging.8.registry.json",
-    "workspaceOpenapiSha256": "bbcdc6988e09feeeac1ae28cf299904b59e220ac7b5f936009845ad07645ead2",
-    "source": {
-      "repository": "RelayMessenger/Relay-SDK",
-      "commit": "1bbcb486b4a91860ee3527ce95d015883e4cc1ae",
-      "carriedOpenapiSha256": "067370af16135965ece42796ca81c7141071c8ab8b7926a3a506b35111e10b9a"
-    },
+    "workspaceOpenapiSha256": "df402b9bebcce58be2f7fa2e0a193e68896d7d34a6e4581dc4e5446a7854ab84",
     "usedOperations": [
       {
         "method": "GET",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@relaymessenger/openclaw-plugin",
-  "version": "0.4.0-staging.4",
+  "version": "0.4.0",
   "description": "Native Relay channel plugin for OpenClaw",
   "license": "MIT",
   "type": "module",
@@ -15,7 +15,6 @@
     "LICENSE",
     "README.md",
     "contracts/relay-v1.lock.json",
-    "contracts/relay-sdk-0.3.0-staging.8.registry.json",
     "openclaw.plugin.json",
     "index.ts",
     "setup-entry.ts",
@@ -38,7 +37,7 @@
     "prepack": "npm run build"
   },
   "dependencies": {
-    "@relaymessenger/sdk": "0.3.0-staging.8"
+    "@relaymessenger/sdk": "0.3.0"
   },
   "devDependencies": {
     "@types/node": "^26.0.0",

package/contracts/relay-sdk-0.3.0-staging.8.registry.json

@@ -1,92 +0,0 @@
-{
-  "schema": "relay-sdk-registry-receipt/v1",
-  "source": {
-    "repository": "RelayMessenger/Relay-SDK",
-    "commit": "1bbcb486b4a91860ee3527ce95d015883e4cc1ae",
-    "packageJsonPath": "packages/sdk/package.json",
-    "packageJsonSha256": "f14819a908e4a8e52dd37b33bb4eca9dabc4557e2404861f639aa5b857c8a252",
-    "contractPath": "contracts/relay-v1-openapi.yaml",
-    "contractSha256": "067370af16135965ece42796ca81c7141071c8ab8b7926a3a506b35111e10b9a"
-  },
-  "registry": {
-    "packumentUrl": "https://registry.npmjs.org/@relaymessenger%2fsdk",
-    "package": "@relaymessenger/sdk",
-    "version": "0.3.0-staging.8",
-    "publishedAt": "2026-09-03T04:57:20.074Z",
-    "repository": {
-      "type": "git",
-      "url": "git+https://github.com/RelayMessenger/Relay-SDK.git",
-      "directory": "packages/sdk"
-    },
-    "publishConfig": {
-      "access": "public",
-      "registry": "https://registry.npmjs.org/",
-      "tag": "staging"
-    },
-    "distTagsObserved": {
-      "latest": "0.3.0-staging.7",
-      "staging": "0.3.0-staging.8",
-      "mutable": true
-    },
-    "dist": {
-      "tarball": "https://registry.npmjs.org/@relaymessenger/sdk/-/sdk-0.3.0-staging.8.tgz",
-      "integrity": "sha512-Db1gn5iQ7ZNrGHPudE4gRW+3H1w4tCluAkGAvXAxyJMBBScySa622BaKpTilmNP7vRFxzoL4tM65n8So0QY/KA==",
-      "shasum": "0848b0ff709dfead87fc5e477f07e690508e0296",
-      "sha256": "a7662ffbbfce19dc67cee3e80e1f91f7730d5156efd199403f70bc73b2175059",
-      "bytes": 38558,
-      "fileCount": 37,
-      "unpackedSize": 175590,
-      "signatureMetadata": [
-        {
-          "keyid": "SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U",
-          "sig": "MEUCIQCx3Ud82JPGoZfCpgz/SqV2Y8rvBI+PISIq2X0GRybNogIgdl6SKAgkEk0Y0kRsXVQBWn6ERoJhF1aOMl0V49EYPQo="
-        }
-      ],
-      "attestations": {
-        "url": "https://registry.npmjs.org/-/npm/v1/attestations/@relaymessenger%2fsdk@0.3.0-staging.8",
-        "provenance": {
-          "predicateType": "https://slsa.dev/provenance/v1"
-        }
-      }
-    },
-    "installedArtifact": {
-      "packageJsonSha256": "f14819a908e4a8e52dd37b33bb4eca9dabc4557e2404861f639aa5b857c8a252",
-      "typesSha256": "ccde213c68bb0b4198268a59f16a438f0f168a947c19222397c002c2177239aa"
-    }
-  },
-  "provenanceBoundary": {
-    "registryGitHead": null,
-    "registryAttestations": {
-      "url": "https://registry.npmjs.org/-/npm/v1/attestations/@relaymessenger%2fsdk@0.3.0-staging.8",
-      "provenance": {
-        "predicateType": "https://slsa.dev/provenance/v1"
-      }
-    },
-    "attestationEndpoint": "https://registry.npmjs.org/-/npm/v1/attestations/@relaymessenger%2fsdk@0.3.0-staging.8",
-    "attestationEndpointObservedStatus": 200,
-    "attestationJsonSha256": "6996f583f884a4302487cb3bc8d0d982266f2559275487426d108f03883947fc",
-    "slsa": {
-      "predicateType": "https://slsa.dev/provenance/v1",
-      "subject": {
-        "name": "pkg:npm/%40relaymessenger/sdk@0.3.0-staging.8",
-        "digest": {
-          "sha512": "0dbd609f9890ed936b1873ee744e20456fb71f5c38b4296e024180bd7031c8930105273249aeb6d8168aa538a598d3fbbd1171ce82f8b4ceb99fc4a8d1063f28"
-        }
-      },
-      "workflow": {
-        "ref": "refs/heads/staging",
-        "repository": "https://github.com/RelayMessenger/Relay-SDK",
-        "path": ".github/workflows/publish-package-staging.yml"
-      },
-      "resolvedDependency": {
-        "uri": "git+https://github.com/RelayMessenger/Relay-SDK@refs/heads/staging",
-        "digest": {
-          "gitCommit": "1bbcb486b4a91860ee3527ce95d015883e4cc1ae"
-        }
-      },
-      "builder": "https://github.com/actions/runner/github-hosted",
-      "invocationId": "https://github.com/RelayMessenger/Relay-SDK/actions/runs/33716843172/attempts/1"
-    },
-    "claim": "The exact registry tarball, npm signature, and SLSA provenance are recorded. The SLSA statement binds the published tarball digest to Relay-SDK staging commit 1bbcb486b4a91860ee3527ce95d015883e4cc1ae through the trusted staging publish workflow, and the package.json bytes match that commit."
-  }
-}