{"_id":"@aip-sdk/openclaw-plugin","name":"@aip-sdk/openclaw-plugin","dist-tags":{"latest":"0.1.0"},"versions":{"0.1.0":{"name":"@aip-sdk/openclaw-plugin","version":"0.1.0","description":"Native OpenClaw plugin for AIP delegation verification","type":"module","main":"dist/index.js","types":"dist/index.d.ts","openclaw":{"extensions":["aip-guard"],"compatibility":">=2026.4.0"},"scripts":{"build":"tsup src/index.ts --format esm --dts","test":"vitest run"},"dependencies":{"@aip-sdk/core":"^0.1.0","@aip-sdk/token":"^0.1.0","aip-openclaw":"^0.1.0"},"peerDependencies":{"openclaw":">=2026.4.0"},"devDependencies":{"typescript":"^5.5.0","tsup":"^8.0.0","vitest":"^2.0.0"},"license":"Apache-2.0","_id":"@aip-sdk/openclaw-plugin@0.1.0","gitHead":"359bf6577b8abd7fec45be0d0603c6167660520b","_nodeVersion":"23.7.0","_npmVersion":"10.9.2","dist":{"integrity":"sha512-Rk2Vc6VINY0Wd3G+Go3v20TjUq18pymVGHeSkuVYMoAuvDVJ0M9TlTAAOCkXoBv0WR2N3qTAhDsQMRkGxgcEGQ==","shasum":"939d94f6576770153d140866e76fe4d724ac07b8","tarball":"https://registry.npmjs.org/@aip-sdk/openclaw-plugin/-/openclaw-plugin-0.1.0.tgz","fileCount":5,"unpackedSize":9348,"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEUCIGn2Kar+IHFrfeppgp+xOLqeha2kMsXEjMGLmQcSfWwRAiEAm/jdGiF8sPCLJV+4y1uBSx4xRqglOaCP6oCuVOV/tak="}]},"_npmUser":{"name":"justsunilp","email":"prakashsunil@proton.me"},"directories":{},"maintainers":[{"name":"justsunilp","email":"prakashsunil@proton.me"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/openclaw-plugin_0.1.0_1777170232502_0.22504620451334012"},"_hasShrinkwrap":false}},"time":{"created":"2026-04-26T02:23:52.383Z","0.1.0":"2026-04-26T02:23:52.642Z","modified":"2026-04-26T02:23:52.866Z"},"maintainers":[{"name":"justsunilp","email":"prakashsunil@proton.me"}],"description":"Native OpenClaw plugin for AIP delegation verification","license":"Apache-2.0","readme":"# @aip-sdk/openclaw-plugin\n\nNative OpenClaw plugin that hooks into `before_tool_call` to verify AIP delegation tokens and enforce capability policies on every tool execution.\n\n## Install\n\n```bash\nopenclaw plugins install clawhub:@aip-sdk/openclaw-plugin\n```\n\nOr via npm:\n\n```bash\nnpm install @aip-sdk/openclaw-plugin\n```\n\n## Configure\n\nIn your OpenClaw config:\n\n```json\n{\n  \"plugins\": {\n    \"enabled\": [\"aip-guard\"],\n    \"entries\": {\n      \"aip-guard\": {\n        \"config\": {\n          \"trustKeys\": [\"z6MkYourEd25519PublicKey...\"],\n          \"unsignedSkills\": \"warn\",\n          \"auditLog\": \"./aip-audit.jsonl\"\n        }\n      }\n    }\n  }\n}\n```\n\n## What it does\n\nEvery tool call passes through AIP Guard before execution:\n\n1. **Extract** the AIP token from `X-AIP-Token` header or A2A metadata\n2. **Verify** the Ed25519 signature against configured trust keys\n3. **Check scope** against the token's capability list\n4. **Allow or block** with a JSONL audit log entry\n\n## Policy modes\n\n| `unsignedSkills` | No token present | Effect |\n|-----------------|-----------------|--------|\n| `\"allow\"` | Pass through silently | No enforcement |\n| `\"warn\"` (default) | Log warning, allow | Visibility without disruption |\n| `\"block\"` | Block tool call | Full enforcement |\n\n## Audit log\n\nEvery decision is logged as JSONL:\n\n```json\n{\"ts\":\"2026-04-26T02:19:28Z\",\"decision\":\"deny\",\"tool\":\"delete_all\",\"subject\":\"aip:key:ed25519:z...\",\"reason\":\"scope_insufficient: tool:delete_all not in token scope [tool:search]\"}\n```\n","readmeFilename":"README.md","_rev":"1-2fd1664131a1a7cb40811203b01d3251"}