package and OpenClaw-owned npm plugin packages include `npm-shrinkwrap.json`,

npm's publishable dependency lockfile, so package installs use the reviewed

transitive dependency graph from the release instead of resolving a fresh graph

at install time. OpenClaw-owned npm plugin packages also publish with explicit

`bundledDependencies`, so their runtime dependency files are carried in the

plugin tarball instead of depending only on install-time resolution.

at install time. Suitable OpenClaw-owned npm plugin packages can also publish

with explicit `bundledDependencies`, so their runtime dependency files are

carried in the plugin tarball instead of depending only on install-time

resolution.

This is a supply-chain hardening measure:

- release installs are more reproducible;

- transitive dependency updates become visible review surfaces;

- the package tarball contains the dependency graph that release validators

checked;

- OpenClaw-owned plugin tarballs contain the dependency files from that graph;

- suitable OpenClaw-owned plugin tarballs contain the dependency files from

that graph;

- `package-lock.json` stays out of the published package, because npm does not

treat it as the publishable lock contract.

name list, removes dev-only workspace metadata from the published package

manifest, runs a script-free npm install for package-local runtime

dependencies, then packs or publishes the plugin tarball with those dependency

files included. Native-heavy packages can opt out with

`openclaw.release.bundleRuntimeDependencies: false`; those packages still ship

their shrinkwrap, but npm resolves runtime dependencies during install instead

of embedding every platform binary in the plugin tarball. The root `openclaw`

package does not bundle its full dependency tree.

files included. Native-heavy packages, including Codex and ACP runtimes, opt out

with `openclaw.release.bundleRuntimeDependencies: false`; those packages still

ship their shrinkwrap, but npm resolves runtime dependencies during install

instead of embedding every platform binary in the plugin tarball. The root

`openclaw` package does not bundle its full dependency tree.

Plugins that import `openclaw/plugin-sdk/*` declare `openclaw` as a peer

dependency. OpenClaw does not let npm install a separate registry copy of the

},

"release": {

"publishToClawHub": true,

"publishToNpm": true

"publishToNpm": true,

"bundleRuntimeDependencies": false

}

}

}