@openclaw/gateway-client 2026.8.1-beta.1 → 2026.8.1-beta.2

package/dist/index.mjs

@@ -1,13 +1,14 @@
-import { C as buildDeviceAuthPayload, S as shouldRetryGatewayWithDeviceToken, T as normalizeDeviceMetadataForAuth, _ as GatewayProtocolRequestError, a as createSessionProjection, b as resolveGatewayConnectScopes, c as normalizeSessionProjectionRunId, d as readSessionMessageSequence, f as reconcileSessionProjectionSnapshot, g as GatewayProtocolClient, h as shouldPauseGatewayReconnect, i as resetGatewaySessionMessageSubscriptionCoordinator, l as projectLiveSessionMessage, m as reduceSessionProjectionRunEvent, n as getGatewaySessionMessageSubscriptionCoordinator, o as hasSessionProjectionAcceptedFinal, p as reduceSessionProjection, r as releaseGatewaySessionMessageSubscription, s as isLocallyOptimisticSessionMessage, t as GatewaySessionMessageSubscriptionCoordinator, u as readSessionMessageIdentity, v as GatewayBrowserDeviceAuthLifecycle, w as buildDeviceAuthPayloadV3, x as selectGatewayConnectAuth, y as buildGatewayConnectAuth } from "./session-subscriptions-D4Xv60cN.mjs";
+import { C as resolveGatewayConnectScopes, D as buildDeviceAuthPayloadV3, E as buildDeviceAuthPayload, O as normalizeDeviceMetadataForAuth, S as buildGatewayConnectAuth, T as shouldRetryGatewayWithDeviceToken, _ as GatewayProtocolRequestError, a as createSessionProjection, b as gatewayOriginScope, c as normalizeSessionProjectionRunId, d as readSessionMessageSequence, f as reconcileSessionProjectionSnapshot, g as GatewayProtocolClient, h as shouldPauseGatewayReconnect, i as resetGatewaySessionMessageSubscriptionCoordinator, l as projectLiveSessionMessage, m as reduceSessionProjectionRunEvent, n as getGatewaySessionMessageSubscriptionCoordinator, o as hasSessionProjectionAcceptedFinal, p as reduceSessionProjection, r as releaseGatewaySessionMessageSubscription, s as isLocallyOptimisticSessionMessage, t as GatewaySessionMessageSubscriptionCoordinator, u as readSessionMessageIdentity, v as GatewayProtocolRequestTimeoutError, w as selectGatewayConnectAuth, x as GatewayBrowserDeviceAuthLifecycle, y as gatewayCredentialScope } from "./session-subscriptions-uKmTyc3P.mjs";
 import { DEFAULT_GATEWAY_REQUEST_TIMEOUT_MS, DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS, MAX_CONNECT_CHALLENGE_TIMEOUT_MS, MAX_SAFE_TIMEOUT_DELAY_MS, MIN_CONNECT_CHALLENGE_TIMEOUT_MS, addSafeTimeoutDelayGraceMs, clampConnectChallengeTimeoutMs, clearGatewayConnectTimeout, getConnectChallengeTimeoutMsFromEnv, resolveConnectChallengeTimeoutMs, resolveFiniteTimeoutDelayMs, resolvePreauthHandshakeTimeoutMs, resolveSafeTimeoutDelayMs, startGatewayConnectTimeout } from "./timeouts.mjs";
+import { rawDataToString } from "./websocket-data.mjs";
 import { n as startGatewayClientWithReadinessWait, r as waitForEventLoopReady, t as startGatewayClientWhenEventLoopReady } from "./readiness-CrWxd4TI.mjs";
+import { GatewayScopeUpgrade } from "./scope-upgrade.mjs";
 import { ConnectErrorDetailCodes, formatConnectErrorMessage, readConnectErrorDetailCode } from "@openclaw/gateway-protocol/connect-error-details";
 import { GATEWAY_CLIENT_MODES, GATEWAY_CLIENT_NAMES } from "@openclaw/gateway-protocol/client-info";
 import { resolveGatewayStartupRetryAfterMs } from "@openclaw/gateway-protocol/startup-unavailable";
-import { MIN_CLIENT_PROTOCOL_VERSION, PROTOCOL_VERSION } from "@openclaw/gateway-protocol/version";
+import { MIN_CLIENT_PROTOCOL_VERSION, MIN_NODE_PROTOCOL_VERSION, MIN_PROBE_PROTOCOL_VERSION, PROTOCOL_VERSION } from "@openclaw/gateway-protocol/version";
 import { randomUUID } from "node:crypto";
 import { WebSocket } from "ws";
-import { Buffer as Buffer$1 } from "node:buffer";
 //#region \0rolldown/runtime.js
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -31,6 +32,26 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 	enumerable: true
 }) : target, mod));
 //#endregion
+//#region packages/normalization-core/src/string-coerce.ts
+/** Trims string input and returns null for non-strings or empty strings. */
+function normalizeNullableString(value) {
+	if (typeof value !== "string") return null;
+	const trimmed = value.trim();
+	return trimmed ? trimmed : null;
+}
+/** Trims string input and returns undefined for non-strings or empty strings. */
+function normalizeOptionalString(value) {
+	return normalizeNullableString(value) ?? void 0;
+}
+/** Lowercases a normalized optional string. */
+function normalizeOptionalLowercaseString(value) {
+	return normalizeOptionalString(value)?.toLowerCase();
+}
+/** Lowercases a normalized string or returns an empty string when absent. */
+function normalizeLowercaseStringOrEmpty(value) {
+	return normalizeOptionalLowercaseString(value) ?? "";
+}
+//#endregion
 //#region packages/net-policy/src/ip.ts
 var import_ipaddr = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin(((exports, module) => {
 	(function(root) {
@@ -990,13 +1011,6 @@ var import_ipaddr = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin(((exp
 		else root.ipaddr = ipaddr;
 	})(exports);
 })))(), 1);
-function normalizeOptionalString(value) {
-	if (typeof value !== "string") return;
-	return value.trim() || void 0;
-}
-function normalizeLowercaseStringOrEmpty$1(value) {
-	return typeof value === "string" ? value.trim().toLowerCase() : "";
-}
 import_ipaddr.default.IPv4.parse("198.18.0.0");
 function stripIpv6Brackets(value) {
 	if (value.startsWith("[") && value.endsWith("]")) return value.slice(1, -1);
@@ -1026,7 +1040,7 @@ function parseCanonicalIpAddress(raw) {
 function normalizeIpAddress(raw) {
 	const parsed = parseCanonicalIpAddress(raw);
 	if (!parsed) return;
-	return normalizeLowercaseStringOrEmpty$1(normalizeIpv4MappedAddress(parsed).toString());
+	return normalizeLowercaseStringOrEmpty(normalizeIpv4MappedAddress(parsed).toString());
 }
 /** True when a canonical IP literal is loopback, including IPv4-mapped IPv6. */
 function isLoopbackIpAddress(raw) {
@@ -1035,21 +1049,8 @@ function isLoopbackIpAddress(raw) {
 	return normalizeIpv4MappedAddress(parsed).range() === "loopback";
 }
 //#endregion
-//#region packages/net-policy/src/url-protocol.ts
-function parseUrl(value) {
-	if (value instanceof URL) return value;
-	try {
-		return new URL(value);
-	} catch {
-		return null;
-	}
-}
-function isWssUrl(value) {
-	return parseUrl(value)?.protocol === "wss:";
-}
-//#endregion
 //#region packages/gateway-client/src/client-address-utils.ts
-function normalizeLowercaseStringOrEmpty(value) {
+function normalizeGatewayErrorText(value) {
 	return typeof value === "string" ? value.trim().toLowerCase() : "";
 }
 function isSensitiveUrlQueryParamName(key) {
@@ -1076,34 +1077,34 @@ function parseGatewayIpAddress(host) {
 	return normalized ? parseCanonicalIpAddress(normalized) : void 0;
 }
 //#endregion
-//#region packages/gateway-client/src/websocket-data.ts
-function rawDataToString(data) {
-	if (Array.isArray(data)) return Buffer$1.concat(data).toString("utf8");
-	return data instanceof ArrayBuffer ? Buffer$1.from(data).toString("utf8") : data.toString("utf8");
-}
-//#endregion
-//#region packages/gateway-client/src/client.ts
-const DEFAULT_HOST_DEPS = {
-	loadOrCreateDeviceIdentity: () => void 0,
-	signDevicePayload: () => {
-		throw new Error("GatewayClient device signature dependency is not configured");
-	},
-	publicKeyRawBase64UrlFromPem: () => {
-		throw new Error("GatewayClient public key dependency is not configured");
-	},
-	loadDeviceAuthToken: () => null,
-	storeDeviceAuthToken: () => {},
-	clearDeviceAuthToken: () => {},
-	beforeConnect: () => {},
-	registerGatewayLoopbackBypass: () => void 0,
-	logDebug: () => {},
-	logError: () => {},
-	redactForLog: (message) => message,
-	normalizeTlsFingerprint: normalizeFingerprint
+//#region packages/gateway-client/src/request-error.ts
+var GatewayClientRequestError = class extends GatewayProtocolRequestError {
+	constructor(error) {
+		super({
+			...error,
+			message: formatConnectErrorMessage({
+				message: error.message,
+				details: error.details
+			})
+		});
+		this.name = "GatewayClientRequestError";
+	}
 };
-function resolveHostDeps(overrides) {
-	return Object.fromEntries(Object.entries(DEFAULT_HOST_DEPS).map(([key, fallback]) => [key, overrides?.[key] ?? fallback]));
+//#endregion
+//#region packages/net-policy/src/url-protocol.ts
+function parseUrl(value) {
+	if (value instanceof URL) return value;
+	try {
+		return new URL(value);
+	} catch {
+		return null;
+	}
+}
+function isWssUrl(value) {
+	return parseUrl(value)?.protocol === "wss:";
 }
+//#endregion
+//#region packages/gateway-client/src/websocket-transport.ts
 const PRIVATE_OR_LOOPBACK_IPV4_RANGES = /* @__PURE__ */ new Set([
 	"loopback",
 	"private",
@@ -1119,19 +1120,16 @@ const PRIVATE_OR_LOOPBACK_IPV6_RANGES = /* @__PURE__ */ new Set([
 function isPrivateOrLoopbackIpAddress(address) {
 	return (address.kind() === "ipv4" ? PRIVATE_OR_LOOPBACK_IPV4_RANGES : PRIVATE_OR_LOOPBACK_IPV6_RANGES).has(address.range());
 }
-function isLoopbackHost(host) {
+function isGatewayLoopbackHost(host) {
 	const parsed = parseHostForAddressChecks(host);
-	if (!parsed) return false;
-	if (parsed.isLocalhost) return true;
-	return isLoopbackIpAddress(parsed.unbracketedHost);
+	return Boolean(parsed && (parsed.isLocalhost || isLoopbackIpAddress(parsed.unbracketedHost)));
 }
 function isPrivateOrLoopbackHost(host) {
 	const parsed = parseHostForAddressChecks(host);
 	if (!parsed) return false;
 	if (parsed.isLocalhost) return true;
 	const address = parseGatewayIpAddress(parsed.unbracketedHost);
-	if (!address) return false;
-	return isPrivateOrLoopbackIpAddress(address);
+	return Boolean(address && isPrivateOrLoopbackIpAddress(address));
 }
 function isTrustedPlaintextWebSocketHost(hostname) {
 	if (isPrivateOrLoopbackHost(hostname)) return true;
@@ -1144,7 +1142,7 @@ function isSecureWebSocketUrl(rawUrl, options) {
 		const protocol = url.protocol === "https:" ? "wss:" : url.protocol === "http:" ? "ws:" : url.protocol;
 		if (protocol === "wss:") return true;
 		if (protocol !== "ws:") return false;
-		if (isLoopbackHost(url.hostname) || isTrustedPlaintextWebSocketHost(url.hostname)) return true;
+		if (isGatewayLoopbackHost(url.hostname) || isTrustedPlaintextWebSocketHost(url.hostname)) return true;
 		if (options?.allowPrivateWs === true) {
 			const hostForIpCheck = url.hostname.startsWith("[") && url.hostname.endsWith("]") ? url.hostname.slice(1, -1) : url.hostname;
 			return isPrivateOrLoopbackHost(url.hostname) || parseGatewayIpAddress(hostForIpCheck) === void 0;
@@ -1154,37 +1152,117 @@ function isSecureWebSocketUrl(rawUrl, options) {
 		return false;
 	}
 }
-const DEFAULT_GATEWAY_CLIENT_URL = "ws://127.0.0.1:18789";
-const DEFAULT_CLIENT_VERSION = "0.0.0";
-var GatewayClientRequestError = class extends GatewayProtocolRequestError {
-	constructor(error) {
-		super({
-			...error,
-			message: formatConnectErrorMessage({
-				message: error.message,
-				details: error.details
-			})
-		});
-		this.name = "GatewayClientRequestError";
+var GatewayWebSocketTransportConfigurationError = class extends Error {};
+function resolveGatewayWebSocketTransport(params) {
+	const usesTls = isWssUrl(params.url);
+	if (params.tlsFingerprint && !usesTls) throw new GatewayWebSocketTransportConfigurationError("gateway tls fingerprint requires wss:// gateway url");
+	const allowPrivateWs = (params.env ?? process.env).OPENCLAW_ALLOW_INSECURE_PRIVATE_WS === "1";
+	if (!isSecureWebSocketUrl(params.url, { allowPrivateWs })) {
+		let displayHost = params.url;
+		try {
+			displayHost = new URL(params.url).hostname || params.url;
+		} catch {}
+		throw new GatewayWebSocketTransportConfigurationError(`SECURITY ERROR: Cannot connect to "${displayHost}" over plaintext ws://. Both credentials and chat data would be exposed to network interception. Use wss:// for remote URLs. Safe defaults: keep gateway.bind=loopback and connect via SSH tunnel (ssh -N -L 18789:127.0.0.1:18789 user@gateway-host), or use Tailscale Serve/Funnel. ` + (allowPrivateWs ? "" : "Break-glass (trusted private networks only): set OPENCLAW_ALLOW_INSECURE_PRIVATE_WS=1. ") + "Run `openclaw doctor --fix` for guidance.");
+	}
+	const normalize = params.normalizeTlsFingerprint ?? normalizeFingerprint;
+	const options = { ...params.options };
+	if (usesTls && params.tlsFingerprint) {
+		options.rejectUnauthorized = false;
+		options.checkServerIdentity = (_hostValue, cert) => {
+			const fingerprintValue = typeof cert === "object" && cert && "fingerprint256" in cert ? cert.fingerprint256 ?? "" : "";
+			const fingerprint = normalize(typeof fingerprintValue === "string" ? fingerprintValue : "");
+			const expected = normalize(params.tlsFingerprint);
+			if (!expected) return;
+			if (!fingerprint) return /* @__PURE__ */ new Error("Missing server TLS fingerprint");
+			if (fingerprint !== expected) return /* @__PURE__ */ new Error("Server TLS fingerprint mismatch");
+		};
 	}
+	return {
+		options,
+		validateSocket: (socket) => {
+			if (!params.tlsFingerprint) return null;
+			const expected = normalize(params.tlsFingerprint);
+			if (!expected) return /* @__PURE__ */ new Error("gateway tls fingerprint missing");
+			const rawSocket = socket["_socket"];
+			if (!rawSocket || typeof rawSocket.getPeerCertificate !== "function") return /* @__PURE__ */ new Error("gateway tls fingerprint unavailable");
+			const cert = rawSocket.getPeerCertificate();
+			const fingerprint = normalize(cert?.fingerprint256 ?? "");
+			if (!fingerprint) return /* @__PURE__ */ new Error("gateway tls fingerprint unavailable");
+			return fingerprint === expected ? null : /* @__PURE__ */ new Error("gateway tls fingerprint mismatch");
+		}
+	};
+}
+//#endregion
+//#region packages/gateway-client/src/client.ts
+const DEFAULT_HOST_DEPS = {
+	loadOrCreateDeviceIdentity: () => void 0,
+	signDevicePayload: () => {
+		throw new Error("GatewayClient device signature dependency is not configured");
+	},
+	publicKeyRawBase64UrlFromPem: () => {
+		throw new Error("GatewayClient public key dependency is not configured");
+	},
+	loadDeviceAuthToken: () => null,
+	storeDeviceAuthToken: () => {},
+	clearDeviceAuthToken: () => {},
+	beforeConnect: () => {},
+	registerGatewayLoopbackBypass: () => void 0,
+	logDebug: () => {},
+	logError: () => {},
+	redactForLog: (message) => message,
+	normalizeTlsFingerprint: normalizeFingerprint
 };
-var GatewayClientRequestTimeoutError = class extends Error {
+function resolveHostDeps(overrides) {
+	return Object.fromEntries(Object.entries(DEFAULT_HOST_DEPS).map(([key, fallback]) => [key, overrides?.[key] ?? fallback]));
+}
+const DEFAULT_GATEWAY_CLIENT_URL = "ws://127.0.0.1:18789";
+const DEFAULT_CLIENT_VERSION = "0.0.0";
+const MAX_UPGRADE_ERROR_BODY_BYTES = 2 * 1024;
+const UPGRADE_ERROR_BODY_TIMEOUT_MS = 1e3;
+async function readUpgradeErrorBody(response) {
+	return await new Promise((resolve) => {
+		const chunks = [];
+		let totalBytes = 0;
+		let settled = false;
+		const finish = () => {
+			if (settled) return;
+			settled = true;
+			clearTimeout(timer);
+			response.off("data", onData);
+			response.off("end", finish);
+			response.off("error", finish);
+			response.off("aborted", finish);
+			resolve(Buffer.concat(chunks, totalBytes).toString("utf8").replace(/\s+/gu, " ").trim());
+		};
+		const stop = () => {
+			finish();
+			response.destroy();
+		};
+		const onData = (chunk) => {
+			const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+			const remaining = MAX_UPGRADE_ERROR_BODY_BYTES - totalBytes;
+			if (remaining > 0) {
+				const prefix = buffer.subarray(0, remaining);
+				chunks.push(prefix);
+				totalBytes += prefix.byteLength;
+			}
+			if (buffer.byteLength >= remaining) stop();
+		};
+		const timer = setTimeout(stop, UPGRADE_ERROR_BODY_TIMEOUT_MS);
+		timer.unref?.();
+		response.on("data", onData);
+		response.once("end", finish);
+		response.once("error", finish);
+		response.once("aborted", finish);
+	});
+}
+var GatewayClientRequestTimeoutError = class extends GatewayProtocolRequestTimeoutError {
 	constructor(params) {
-		super(`gateway request timeout for ${params.method}`);
+		super(params, `gateway request timeout for ${params.method}`);
 		this.name = "GatewayClientRequestTimeoutError";
-		this.method = params.method;
-		this.timeoutMs = params.timeoutMs;
-		this.requestSent = params.requestSent;
-	}
-};
-var GatewayClientTransientPreHelloCloseError = class extends Error {
-	constructor() {
-		super("gateway transient pre-hello clean close");
-		this.name = "GatewayClientTransientPreHelloCloseError";
 	}
 };
-var GatewayClientSocketFactoryConfigurationError = class extends Error {};
-var GatewayClientTransportPolicyError = class extends GatewayClientSocketFactoryConfigurationError {};
+var GatewayClientTransportPolicyError = class extends GatewayWebSocketTransportConfigurationError {};
 const GATEWAY_CONNECT_ASSEMBLY_ERROR = Symbol("gateway.connectAssemblyError");
 function markGatewayConnectAssemblyError(error) {
 	Object.defineProperty(error, GATEWAY_CONNECT_ASSEMBLY_ERROR, {
@@ -1206,10 +1284,20 @@ function formatGatewayClientErrorForLog(err) {
 const FORCE_STOP_TERMINATE_GRACE_MS = 250;
 const STOP_AND_WAIT_TIMEOUT_MS = 1e3;
 const MAX_SUPPRESSED_TRANSIENT_PRE_HELLO_CLEAN_CLOSES = 1;
+function resolveLegacyNodePlatform(platform) {
+	switch (platform) {
+		case "macos": return "darwin";
+		case "windows": return "win32";
+		default: return;
+	}
+}
 var GatewayClient = class {
 	constructor(opts) {
 		this.ws = null;
 		this.stopped = false;
+		this.useLegacyNodeProtocolEnvelope = false;
+		this.nodeProtocolTransitionPending = false;
+		this.suppressNextHelloCallback = false;
 		this.pendingDeviceTokenRetry = false;
 		this.deviceTokenRetryBudgetUsed = false;
 		this.approvalRuntimeTokenCompatibilityDisabled = false;
@@ -1225,7 +1313,7 @@ var GatewayClient = class {
 			...opts,
 			deviceIdentity: opts.deviceIdentity === null ? void 0 : opts.deviceIdentity ?? this.deps.loadOrCreateDeviceIdentity()
 		};
-		this.requestTimeoutMs = typeof opts.requestTimeoutMs === "number" && Number.isFinite(opts.requestTimeoutMs) ? resolveSafeTimeoutDelayMs(opts.requestTimeoutMs, { minMs: 0 }) : DEFAULT_GATEWAY_REQUEST_TIMEOUT_MS;
+		this.requestTimeoutMs = typeof opts.requestTimeoutMs === "number" && Number.isFinite(opts.requestTimeoutMs) ? opts.requestTimeoutMs : DEFAULT_GATEWAY_REQUEST_TIMEOUT_MS;
 		const connectChallengeTimeoutMs = resolveConnectChallengeTimeoutMs(this.opts.connectChallengeTimeoutMs, {
 			env: this.opts.env,
 			configuredTimeoutMs: this.opts.preauthHandshakeTimeoutMs
@@ -1264,7 +1352,13 @@ var GatewayClient = class {
 				};
 			},
 			onConnectHello: (hello, context) => this.handleConnectHello(hello, context.plan),
-			onHello: (hello) => this.opts.onHelloOk?.(hello),
+			onHello: (hello) => {
+				if (this.suppressNextHelloCallback) {
+					this.suppressNextHelloCallback = false;
+					return;
+				}
+				this.opts.onHelloOk?.(hello);
+			},
 			onConnectFailure: (error, context) => this.handleConnectRequestFailure(error, context.plan),
 			resolveClose: (context) => this.resolveClose(context),
 			onClose: (context, decision) => {
@@ -1294,7 +1388,7 @@ var GatewayClient = class {
 				maxMs: 3e4
 			},
 			requestTimeoutMs: this.requestTimeoutMs,
-			shouldRetrySocketFactoryError: (error) => !(error instanceof GatewayClientSocketFactoryConfigurationError) && !(error instanceof SyntaxError) && !(error instanceof TypeError) && !(error instanceof RangeError),
+			shouldRetrySocketFactoryError: (error) => !(error instanceof GatewayWebSocketTransportConfigurationError) && !(error instanceof SyntaxError) && !(error instanceof TypeError) && !(error instanceof RangeError),
 			rethrowSocketFactoryError: (error) => error instanceof GatewayClientTransportPolicyError
 		});
 	}
@@ -1310,7 +1404,9 @@ var GatewayClient = class {
 		this.opts = {
 			...this.opts,
 			caps: [...manifest.caps],
-			commands: [...manifest.commands]
+			commands: [...manifest.commands],
+			computerUse: manifest.computerUse === void 0 ? void 0 : structuredClone(manifest.computerUse),
+			workerRuns: manifest.workerRuns ? structuredClone(manifest.workerRuns) : void 0
 		};
 		if (!this.stopped) this.protocol.closeSocket(1012, "node manifest changed");
 	}
@@ -1320,36 +1416,22 @@ var GatewayClient = class {
 	}
 	createSocket(handlers) {
 		const url = this.opts.url ?? DEFAULT_GATEWAY_CLIENT_URL;
-		const usesTls = isWssUrl(url);
-		if (this.opts.tlsFingerprint && !usesTls) throw new GatewayClientSocketFactoryConfigurationError("gateway tls fingerprint requires wss:// gateway url");
-		const allowPrivateWs = (this.opts.env ?? process.env).OPENCLAW_ALLOW_INSECURE_PRIVATE_WS === "1";
-		if (!isSecureWebSocketUrl(url, { allowPrivateWs })) {
-			let displayHost = url;
-			try {
-				displayHost = new URL(url).hostname || url;
-			} catch {}
-			throw new GatewayClientSocketFactoryConfigurationError(`SECURITY ERROR: Cannot connect to "${displayHost}" over plaintext ws://. Both credentials and chat data would be exposed to network interception. Use wss:// for remote URLs. Safe defaults: keep gateway.bind=loopback and connect via SSH tunnel (ssh -N -L 18789:127.0.0.1:18789 user@gateway-host), or use Tailscale Serve/Funnel. ` + (allowPrivateWs ? "" : "Break-glass (trusted private networks only): set OPENCLAW_ALLOW_INSECURE_PRIVATE_WS=1. ") + "Run `openclaw doctor --fix` for guidance.");
-		}
+		const handshakeTimeoutMs = resolvePreauthHandshakeTimeoutMs({
+			env: this.opts.env,
+			configuredTimeoutMs: this.opts.preauthHandshakeTimeoutMs
+		});
+		const transport = resolveGatewayWebSocketTransport({
+			url,
+			tlsFingerprint: this.opts.tlsFingerprint,
+			env: this.opts.env,
+			normalizeTlsFingerprint: this.deps.normalizeTlsFingerprint,
+			options: {
+				maxPayload: 25 * 1024 * 1024,
+				handshakeTimeout: handshakeTimeoutMs,
+				...this.opts.origin ? { origin: this.opts.origin } : {}
+			}
+		});
 		this.deps.beforeConnect();
-		const wsOptions = {
-			maxPayload: 25 * 1024 * 1024,
-			handshakeTimeout: resolvePreauthHandshakeTimeoutMs({
-				env: this.opts.env,
-				configuredTimeoutMs: this.opts.preauthHandshakeTimeoutMs
-			}),
-			...this.opts.origin ? { origin: this.opts.origin } : {}
-		};
-		if (usesTls && this.opts.tlsFingerprint) {
-			wsOptions.rejectUnauthorized = false;
-			wsOptions.checkServerIdentity = (_hostValue, cert) => {
-				const fingerprintValue = typeof cert === "object" && cert && "fingerprint256" in cert ? cert.fingerprint256 ?? "" : "";
-				const fingerprint = this.deps.normalizeTlsFingerprint(typeof fingerprintValue === "string" ? fingerprintValue : "");
-				const expected = this.deps.normalizeTlsFingerprint(this.opts.tlsFingerprint ?? "");
-				if (!expected) return;
-				if (!fingerprint) return /* @__PURE__ */ new Error("Missing server TLS fingerprint");
-				if (fingerprint !== expected) return /* @__PURE__ */ new Error("Server TLS fingerprint mismatch");
-			};
-		}
 		let ws;
 		let unregisterGatewayLoopbackBypass;
 		try {
@@ -1358,7 +1440,7 @@ var GatewayClient = class {
 			throw new GatewayClientTransportPolicyError(error instanceof Error ? error.message : String(error));
 		}
 		try {
-			ws = new WebSocket(url, wsOptions);
+			ws = new WebSocket(url, transport.options);
 			ws.binaryType = "nodebuffer";
 		} catch (error) {
 			throw error instanceof Error ? error : new Error(String(error));
@@ -1367,15 +1449,14 @@ var GatewayClient = class {
 		}
 		this.ws = ws;
 		this.transportValidated = false;
+		let upgradeError;
 		ws.on("open", () => {
 			handlers.open();
-			if (usesTls && this.opts.tlsFingerprint) {
-				const tlsError = this.validateTlsFingerprint();
-				if (tlsError) {
-					handlers.error(tlsError);
-					ws.close(1008, tlsError.message);
-					return;
-				}
+			const tlsError = transport.validateSocket(ws);
+			if (tlsError) {
+				handlers.error(tlsError);
+				ws.close(1008, tlsError.message);
+				return;
 			}
 			this.transportValidated = true;
 		});
@@ -1386,7 +1467,25 @@ var GatewayClient = class {
 			this.resolvePendingStop(ws);
 			handlers.close(code, reasonText);
 		});
+		ws.on("unexpected-response", (request, response) => {
+			readUpgradeErrorBody(response).then((body) => {
+				const statusCode = response.statusCode;
+				upgradeError = new GatewayClientRequestError({
+					code: "UNAVAILABLE",
+					message: `gateway rejected websocket upgrade (HTTP ${statusCode ?? "unknown"})${body ? `: ${body}` : ""}`,
+					retryable: true,
+					details: {
+						reason: "websocket-upgrade-rejected",
+						...statusCode === void 0 ? {} : { httpStatus: statusCode }
+					}
+				});
+				handlers.error(upgradeError);
+				request.destroy();
+				ws.close();
+			});
+		});
 		ws.on("error", (err) => {
+			if (upgradeError) return;
 			this.logDebug(`gateway client error: ${formatGatewayClientErrorForLog(err)}`);
 			handlers.error(err instanceof Error ? err : new Error(String(err)));
 		});
@@ -1486,22 +1585,34 @@ var GatewayClient = class {
 			storedScopes,
 			defaultScopes: ["operator.admin"]
 		});
-		const platform = this.opts.platform ?? process.platform;
+		const clientMode = this.opts.mode ?? GATEWAY_CLIENT_MODES.BACKEND;
+		const clientId = this.opts.clientName ?? GATEWAY_CLIENT_NAMES.GATEWAY_CLIENT;
+		const isBuiltInNodeHost = role === "node" && clientMode === GATEWAY_CLIENT_MODES.NODE && clientId === GATEWAY_CLIENT_NAMES.NODE_HOST;
+		const negotiatesNodeProtocol = this.shouldNegotiateLegacyNodeProtocol();
+		const useLegacyNodeProtocolEnvelope = isBuiltInNodeHost && (this.useLegacyNodeProtocolEnvelope || this.opts.maxProtocol === MIN_NODE_PROTOCOL_VERSION && (this.opts.minProtocol ?? MIN_NODE_PROTOCOL_VERSION) <= MIN_NODE_PROTOCOL_VERSION);
+		const minProtocol = useLegacyNodeProtocolEnvelope ? MIN_NODE_PROTOCOL_VERSION : negotiatesNodeProtocol ? PROTOCOL_VERSION : this.opts.minProtocol ?? (clientMode === GATEWAY_CLIENT_MODES.PROBE ? MIN_PROBE_PROTOCOL_VERSION : role === "node" && clientMode === GATEWAY_CLIENT_MODES.NODE ? MIN_NODE_PROTOCOL_VERSION : MIN_CLIENT_PROTOCOL_VERSION);
+		const maxProtocol = useLegacyNodeProtocolEnvelope ? MIN_NODE_PROTOCOL_VERSION : negotiatesNodeProtocol ? PROTOCOL_VERSION : this.opts.maxProtocol ?? PROTOCOL_VERSION;
+		const configuredPlatform = this.opts.platform ?? process.platform;
+		const platform = useLegacyNodeProtocolEnvelope ? resolveLegacyNodePlatform(configuredPlatform) ?? configuredPlatform : configuredPlatform;
+		const deviceFamily = useLegacyNodeProtocolEnvelope ? void 0 : this.opts.deviceFamily;
 		return {
 			params: {
-				minProtocol: this.opts.minProtocol ?? MIN_CLIENT_PROTOCOL_VERSION,
-				maxProtocol: this.opts.maxProtocol ?? PROTOCOL_VERSION,
+				minProtocol,
+				maxProtocol,
 				client: {
-					id: this.opts.clientName ?? GATEWAY_CLIENT_NAMES.GATEWAY_CLIENT,
+					id: clientId,
 					displayName: this.opts.clientDisplayName,
 					version: this.opts.clientVersion ?? DEFAULT_CLIENT_VERSION,
+					buildId: this.opts.clientBuildId,
 					platform,
-					deviceFamily: this.opts.deviceFamily,
-					mode: this.opts.mode ?? GATEWAY_CLIENT_MODES.BACKEND,
+					deviceFamily,
+					mode: clientMode,
 					instanceId: this.opts.instanceId
 				},
 				caps: Array.isArray(this.opts.caps) ? this.opts.caps : [],
 				commands: Array.isArray(this.opts.commands) ? this.opts.commands : void 0,
+				computerUse: useLegacyNodeProtocolEnvelope ? void 0 : this.opts.computerUse,
+				workerRuns: useLegacyNodeProtocolEnvelope ? void 0 : this.opts.workerRuns,
 				permissions: this.opts.permissions && typeof this.opts.permissions === "object" ? this.opts.permissions : void 0,
 				pathEnv: this.opts.pathEnv,
 				auth,
@@ -1513,30 +1624,47 @@ var GatewayClient = class {
 					scopes,
 					signatureToken,
 					signedAtMs,
-					platform
+					platform,
+					deviceFamily,
+					clientMode
 				})
 			},
 			authApprovalRuntimeToken,
 			authAgentRuntimeIdentityToken,
 			resolvedDeviceToken,
+			storedScopes,
 			storedToken,
 			usingStoredDeviceToken
 		};
 	}
+	shouldNegotiateLegacyNodeProtocol() {
+		if (this.opts.role !== "node" || this.opts.mode !== GATEWAY_CLIENT_MODES.NODE || this.opts.clientName !== GATEWAY_CLIENT_NAMES.NODE_HOST) return false;
+		return (this.opts.minProtocol ?? MIN_NODE_PROTOCOL_VERSION) === MIN_NODE_PROTOCOL_VERSION && (this.opts.maxProtocol ?? PROTOCOL_VERSION) === PROTOCOL_VERSION;
+	}
+	shouldRetryWithLegacyNodeProtocol(error) {
+		if (this.useLegacyNodeProtocolEnvelope || !this.shouldNegotiateLegacyNodeProtocol() || !(error instanceof GatewayClientRequestError)) return false;
+		const detailCode = readConnectErrorDetailCode(error.details);
+		return error.details?.expectedProtocol === MIN_NODE_PROTOCOL_VERSION && (detailCode === ConnectErrorDetailCodes.PROTOCOL_MISMATCH || normalizeGatewayErrorText(error.message).includes("protocol mismatch"));
+	}
+	shouldRetryWithCurrentNodeProtocol(error) {
+		if (!this.useLegacyNodeProtocolEnvelope || !this.shouldNegotiateLegacyNodeProtocol() || !(error instanceof GatewayClientRequestError)) return false;
+		const detailCode = readConnectErrorDetailCode(error.details);
+		return error.details?.expectedProtocol === PROTOCOL_VERSION && (detailCode === ConnectErrorDetailCodes.PROTOCOL_MISMATCH || normalizeGatewayErrorText(error.message).includes("protocol mismatch"));
+	}
 	buildDeviceConnectParams(params) {
 		if (!this.opts.deviceIdentity) return;
-		const { nonce, role, scopes, signatureToken, signedAtMs, platform } = params;
+		const { nonce, role, scopes, signatureToken, signedAtMs, platform, deviceFamily, clientMode } = params;
 		const payload = buildDeviceAuthPayloadV3({
 			deviceId: this.opts.deviceIdentity.deviceId,
 			clientId: this.opts.clientName ?? GATEWAY_CLIENT_NAMES.GATEWAY_CLIENT,
-			clientMode: this.opts.mode ?? GATEWAY_CLIENT_MODES.BACKEND,
+			clientMode,
 			role,
 			scopes,
 			signedAtMs,
 			token: signatureToken ?? null,
 			nonce,
 			platform,
-			deviceFamily: this.opts.deviceFamily
+			deviceFamily
 		});
 		const signature = this.deps.signDevicePayload(this.opts.deviceIdentity.privateKeyPem, payload);
 		return {
@@ -1548,24 +1676,66 @@ var GatewayClient = class {
 		};
 	}
 	handleConnectHello(helloOk, assembled) {
+		const reconnectWithCurrentNodeProtocol = this.useLegacyNodeProtocolEnvelope && this.shouldNegotiateLegacyNodeProtocol() && helloOk.protocol > MIN_NODE_PROTOCOL_VERSION;
+		if (reconnectWithCurrentNodeProtocol) this.useLegacyNodeProtocolEnvelope = false;
+		this.nodeProtocolTransitionPending = false;
 		this.pendingDeviceTokenRetry = false;
 		this.deviceTokenRetryBudgetUsed = false;
 		this.suppressedTransientPreHelloCleanCloses = 0;
 		const role = this.opts.role ?? "operator";
 		const authInfo = helloOk.auth;
-		if (authInfo?.deviceToken && this.opts.deviceIdentity) this.deps.storeDeviceAuthToken({
-			deviceId: this.opts.deviceIdentity.deviceId,
-			role: authInfo.role ?? role,
-			token: authInfo.deviceToken,
-			scopes: authInfo.scopes ?? [],
-			env: this.opts.env
-		});
+		if (authInfo?.deviceToken && this.opts.deviceIdentity) {
+			const tokenRole = authInfo.role ?? role;
+			const scopes = tokenRole === role && authInfo.deviceToken === assembled.storedToken ? assembled.storedScopes ?? authInfo.scopes ?? [] : authInfo.scopes ?? [];
+			this.deps.storeDeviceAuthToken({
+				deviceId: this.opts.deviceIdentity.deviceId,
+				role: tokenRole,
+				token: authInfo.deviceToken,
+				scopes,
+				env: this.opts.env
+			});
+		}
+		if (this.opts.preferBootstrapToken) {
+			this.opts.token = void 0;
+			this.opts.bootstrapToken = void 0;
+			this.opts.password = void 0;
+			this.opts.preferBootstrapToken = false;
+		}
 		this.tickIntervalMs = typeof helloOk.policy?.tickIntervalMs === "number" ? helloOk.policy.tickIntervalMs : 3e4;
+		if (reconnectWithCurrentNodeProtocol) {
+			this.suppressNextHelloCallback = true;
+			this.protocol.resetReconnectBackoff(250);
+			this.protocol.closeSocket(1012, "gateway protocol upgraded");
+			return;
+		}
 		this.lastTick = Date.now();
 		this.startTickWatch();
 	}
 	handleConnectRequestFailure(error, assembled) {
+		if (this.shouldRetryWithCurrentNodeProtocol(error)) {
+			const resetBackoff = !this.nodeProtocolTransitionPending;
+			this.useLegacyNodeProtocolEnvelope = false;
+			this.nodeProtocolTransitionPending = true;
+			if (resetBackoff) this.protocol.resetReconnectBackoff(250);
+			this.logDebug("gateway rejected protocol v3; retrying node host with protocol v4");
+			return {
+				closeCode: 1008,
+				closeReason: "connect retry"
+			};
+		}
+		if (this.shouldRetryWithLegacyNodeProtocol(error)) {
+			const resetBackoff = !this.nodeProtocolTransitionPending;
+			this.useLegacyNodeProtocolEnvelope = true;
+			this.nodeProtocolTransitionPending = true;
+			if (resetBackoff) this.protocol.resetReconnectBackoff(250);
+			this.logDebug("gateway rejected protocol v4; retrying node host with protocol v3");
+			return {
+				closeCode: 1008,
+				closeReason: "connect retry"
+			};
+		}
 		const role = this.opts.role ?? "operator";
+		const detailCode = error instanceof GatewayClientRequestError ? readConnectErrorDetailCode(error.details) : null;
 		const shouldRetryWithDeviceToken = shouldRetryGatewayWithDeviceToken({
 			retryBudgetUsed: this.deviceTokenRetryBudgetUsed,
 			currentDeviceToken: assembled.resolvedDeviceToken,
@@ -1574,7 +1744,7 @@ var GatewayClient = class {
 			trustedEndpoint: this.isTrustedDeviceRetryEndpoint(),
 			errorDetails: error instanceof GatewayClientRequestError ? error.details : void 0
 		});
-		if (this.opts.deviceIdentity && assembled.usingStoredDeviceToken && error instanceof GatewayClientRequestError && readConnectErrorDetailCode(error.details) === ConnectErrorDetailCodes.AUTH_DEVICE_TOKEN_MISMATCH) {
+		if (this.opts.deviceIdentity && assembled.usingStoredDeviceToken && detailCode === ConnectErrorDetailCodes.AUTH_DEVICE_TOKEN_MISMATCH) {
 			const deviceId = this.opts.deviceIdentity.deviceId;
 			try {
 				this.deps.clearDeviceAuthToken({
@@ -1630,7 +1800,7 @@ var GatewayClient = class {
 		}
 		this.notifyConnectError(error);
 		const message = `gateway connect failed: ${formatGatewayClientErrorForLog(error)}`;
-		if (this.opts.mode === GATEWAY_CLIENT_MODES.PROBE || isGatewayClientStoppedError(error)) this.logDebug(message);
+		if (this.opts.mode === GATEWAY_CLIENT_MODES.PROBE || isGatewayClientStoppedError(error) || detailCode === ConnectErrorDetailCodes.AUTH_RATE_LIMITED) this.logDebug(message);
 		else this.logError(message);
 		return {
 			closeCode: 1008,
@@ -1651,7 +1821,7 @@ var GatewayClient = class {
 			return {
 				retry: true,
 				notify: true,
-				pendingError: new GatewayClientTransientPreHelloCloseError()
+				pendingError: /* @__PURE__ */ new Error("gateway transient pre-hello clean close")
 			};
 		}
 		if (info.transientPreHelloCleanClose || context.connectRequestSent && !context.helloReceived && !context.connectFailure) {
@@ -1687,11 +1857,13 @@ var GatewayClient = class {
 			phase: context.helloReceived ? "post-hello" : "pre-hello",
 			socketOpened: context.socketOpened,
 			transportValidated: this.transportValidated,
-			transientPreHelloCleanClose: !context.helloReceived && context.code === 1e3 && context.reason === ""
+			connectRequestSent: context.connectRequestSent,
+			transientPreHelloCleanClose: !context.helloReceived && context.code === 1e3 && context.reason === "",
+			...context.connectFailure?.error ? { connectError: context.connectFailure.error } : {}
 		};
 	}
 	clearStaleDeviceTokenForClose(code, reason) {
-		if (code !== 1008 || !normalizeLowercaseStringOrEmpty(reason).includes("device token mismatch") || this.opts.token || this.opts.password || !this.opts.deviceIdentity) return;
+		if (code !== 1008 || !normalizeGatewayErrorText(reason).includes("device token mismatch") || this.opts.token || this.opts.password || !this.opts.deviceIdentity) return;
 		const deviceId = this.opts.deviceIdentity.deviceId;
 		const role = this.opts.role ?? "operator";
 		try {
@@ -1724,14 +1896,14 @@ var GatewayClient = class {
 		if (!params.authApprovalRuntimeToken) return false;
 		if (!(params.error instanceof GatewayClientRequestError)) return false;
 		if (params.error.gatewayCode !== "INVALID_REQUEST") return false;
-		const message = normalizeLowercaseStringOrEmpty(params.error.message);
+		const message = normalizeGatewayErrorText(params.error.message);
 		return message.includes("invalid connect params") && message.includes("approvalruntimetoken");
 	}
 	shouldFailClosedForUnsupportedAgentRuntimeIdentity(params) {
 		if (!params.authAgentRuntimeIdentityToken) return false;
 		if (!(params.error instanceof GatewayClientRequestError)) return false;
 		if (params.error.gatewayCode !== "INVALID_REQUEST") return false;
-		const message = normalizeLowercaseStringOrEmpty(params.error.message);
+		const message = normalizeGatewayErrorText(params.error.message);
 		return message.includes("invalid connect params") && message.includes("agentruntimeidentitytoken");
 	}
 	isTrustedDeviceRetryEndpoint() {
@@ -1739,7 +1911,7 @@ var GatewayClient = class {
 		try {
 			const parsed = new URL(rawUrl);
 			const protocol = parsed.protocol === "https:" ? "wss:" : parsed.protocol === "http:" ? "ws:" : parsed.protocol;
-			if (isLoopbackHost(parsed.hostname)) return true;
+			if (isGatewayLoopbackHost(parsed.hostname)) return true;
 			return protocol === "wss:" && Boolean(this.opts.tlsFingerprint?.trim());
 		} catch {
 			return false;
@@ -1754,6 +1926,7 @@ var GatewayClient = class {
 		return selectGatewayConnectAuth({
 			token: this.opts.token,
 			bootstrapToken: this.opts.bootstrapToken,
+			preferBootstrapToken: this.opts.preferBootstrapToken,
 			deviceToken: this.opts.deviceToken,
 			password: this.opts.password,
 			approvalRuntimeToken: this.approvalRuntimeTokenCompatibilityDisabled ? void 0 : this.opts.approvalRuntimeToken,
@@ -1778,21 +1951,9 @@ var GatewayClient = class {
 			if (gap > (typeof rawTimeoutMs === "number" && Number.isFinite(rawTimeoutMs) ? Math.max(1, rawTimeoutMs) : this.tickIntervalMs * 2)) this.protocol.closeSocket(4e3, "tick timeout");
 		}, interval);
 	}
-	validateTlsFingerprint() {
-		if (!this.opts.tlsFingerprint || !this.ws) return null;
-		const expected = this.deps.normalizeTlsFingerprint(this.opts.tlsFingerprint);
-		if (!expected) return /* @__PURE__ */ new Error("gateway tls fingerprint missing");
-		const socket = this.ws["_socket"];
-		if (!socket || typeof socket.getPeerCertificate !== "function") return /* @__PURE__ */ new Error("gateway tls fingerprint unavailable");
-		const cert = socket.getPeerCertificate();
-		const fingerprint = this.deps.normalizeTlsFingerprint(cert?.fingerprint256 ?? "");
-		if (!fingerprint) return /* @__PURE__ */ new Error("gateway tls fingerprint unavailable");
-		if (fingerprint !== expected) return /* @__PURE__ */ new Error("gateway tls fingerprint mismatch");
-		return null;
-	}
 	async request(method, params, opts) {
 		const expectFinal = opts?.expectFinal === true;
-		const timeoutMs = opts?.timeoutMs === null ? null : typeof opts?.timeoutMs === "number" && Number.isFinite(opts.timeoutMs) ? resolveSafeTimeoutDelayMs(opts.timeoutMs, { minMs: 0 }) : expectFinal ? null : this.requestTimeoutMs;
+		const timeoutMs = opts?.timeoutMs === null ? null : typeof opts?.timeoutMs === "number" && Number.isFinite(opts.timeoutMs) ? opts.timeoutMs : expectFinal ? null : this.requestTimeoutMs;
 		return this.protocol.request(method, params, {
 			expectFinal,
 			timeoutMs,
@@ -1808,4 +1969,4 @@ function createGatewayRequestAbortError(method) {
 	return err;
 }
 //#endregion
-export { DEFAULT_GATEWAY_REQUEST_TIMEOUT_MS, DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS, GatewayBrowserDeviceAuthLifecycle, GatewayClient, GatewayClientRequestError, GatewayClientRequestTimeoutError, GatewaySessionMessageSubscriptionCoordinator, MAX_CONNECT_CHALLENGE_TIMEOUT_MS, MAX_SAFE_TIMEOUT_DELAY_MS, MIN_CONNECT_CHALLENGE_TIMEOUT_MS, addSafeTimeoutDelayGraceMs, buildDeviceAuthPayload, buildDeviceAuthPayloadV3, buildGatewayConnectAuth, clampConnectChallengeTimeoutMs, clearGatewayConnectTimeout, createSessionProjection, getConnectChallengeTimeoutMsFromEnv, getGatewaySessionMessageSubscriptionCoordinator, hasSessionProjectionAcceptedFinal, isGatewayConnectAssemblyError, isLocallyOptimisticSessionMessage, normalizeDeviceMetadataForAuth, normalizeSessionProjectionRunId, projectLiveSessionMessage, readSessionMessageIdentity, readSessionMessageSequence, reconcileSessionProjectionSnapshot, reduceSessionProjection, reduceSessionProjectionRunEvent, releaseGatewaySessionMessageSubscription, resetGatewaySessionMessageSubscriptionCoordinator, resolveConnectChallengeTimeoutMs, resolveFiniteTimeoutDelayMs, resolveGatewayConnectScopes, resolvePreauthHandshakeTimeoutMs, resolveSafeTimeoutDelayMs, selectGatewayConnectAuth, shouldRetryGatewayWithDeviceToken, startGatewayClientWhenEventLoopReady, startGatewayClientWithReadinessWait, startGatewayConnectTimeout, waitForEventLoopReady };
+export { DEFAULT_GATEWAY_REQUEST_TIMEOUT_MS, DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS, GatewayBrowserDeviceAuthLifecycle, GatewayClient, GatewayClientRequestError, GatewayClientRequestTimeoutError, GatewayScopeUpgrade, GatewaySessionMessageSubscriptionCoordinator, MAX_CONNECT_CHALLENGE_TIMEOUT_MS, MAX_SAFE_TIMEOUT_DELAY_MS, MIN_CONNECT_CHALLENGE_TIMEOUT_MS, addSafeTimeoutDelayGraceMs, buildDeviceAuthPayload, buildDeviceAuthPayloadV3, buildGatewayConnectAuth, clampConnectChallengeTimeoutMs, clearGatewayConnectTimeout, createSessionProjection, gatewayCredentialScope, gatewayOriginScope, getConnectChallengeTimeoutMsFromEnv, getGatewaySessionMessageSubscriptionCoordinator, hasSessionProjectionAcceptedFinal, isGatewayConnectAssemblyError, isLocallyOptimisticSessionMessage, normalizeDeviceMetadataForAuth, normalizeSessionProjectionRunId, projectLiveSessionMessage, readSessionMessageIdentity, readSessionMessageSequence, reconcileSessionProjectionSnapshot, reduceSessionProjection, reduceSessionProjectionRunEvent, releaseGatewaySessionMessageSubscription, resetGatewaySessionMessageSubscriptionCoordinator, resolveConnectChallengeTimeoutMs, resolveFiniteTimeoutDelayMs, resolveGatewayConnectScopes, resolvePreauthHandshakeTimeoutMs, resolveSafeTimeoutDelayMs, selectGatewayConnectAuth, shouldRetryGatewayWithDeviceToken, startGatewayClientWhenEventLoopReady, startGatewayClientWithReadinessWait, startGatewayConnectTimeout, waitForEventLoopReady };