@openclaw/gateway-client 2026.8.1-beta.1 → 2026.8.1-beta.3

package/README.md

@@ -5,16 +5,23 @@ connection state machine used by OpenClaw's own Node and browser clients:
 challenge-based authentication, typed protocol frames, request correlation,
 timeouts, reconnect backoff, device-token handling, and event delivery.
 
-The current wire protocol is version 4. General clients must negotiate v4 with
+The current wire protocol is version 4. General clients must advertise exactly v4 with
 `minProtocol: 4` and `maxProtocol: 4`. See the
 [Gateway protocol specification](https://docs.openclaw.ai/gateway/protocol) for
 the complete handshake, authentication, role, scope, and method contracts.
+Exact node identities (`role: "node"` plus `mode: "node"`) and probe clients
+can use v3. The built-in node host starts with an exact v4 envelope, then retries
+an exact v3 envelope after a v3 Gateway rejects v4. If that legacy probe reaches
+an upgraded v4 Gateway, the client reconnects with the full v4 envelope before
+reporting readiness. Other exact node identities default to `[3, 4]`. Explicit
+bounds override these defaults; `[3, 4]` on the built-in node host selects the
+same bounded negotiation.
 
 ## Versioning
 
 Package versions follow the OpenClaw calendar release train: `YYYY.M.PATCH`,
 including the OpenClaw prerelease suffix when applicable. The package version is
-separate from the negotiated wire protocol number.
+separate from the Gateway's current wire protocol number reported in `hello-ok`.
 
 ## Install
 
@@ -37,6 +44,8 @@ client surface.
   until the event loop can process Gateway IO.
 - `@openclaw/gateway-client/timeouts` exports timeout constants and safe timer
   resolution helpers.
+- `@openclaw/gateway-client/websocket-data` converts every Node `ws` raw-data
+  shape to UTF-8 text.
 
 ## Node quickstart
 
@@ -69,7 +78,7 @@ client.stop();
 The client waits for the Gateway's `connect.challenge` event before sending its
 `connect` request. It includes the challenge nonce in device authentication and
 does not fall back to a pre-challenge handshake. `onHelloOk` fires only after the
-Gateway accepts the v4 connection, so requests should wait for that callback.
+Gateway accepts a compatible connection, so requests should wait for that callback.
 
 For remote connections, use `wss://`. Plaintext `ws://` is allowed by default
 only for loopback addresses. Authentication material and Gateway traffic must
@@ -129,6 +138,9 @@ from `@openclaw/gateway-protocol`, not from bundled implementation paths.
   the socket; `stop()` closes it and rejects pending requests.
 - A request uses `request(method, params)` after `hello-ok`. Passing
   `timeoutMs: null` creates an intentionally unbounded request.
+- Finite request deadlines reject with `GatewayProtocolRequestTimeoutError`,
+  whose `CLIENT_TIMEOUT` code, method, deadline, and send-boundary flag remain
+  distinct from authoritative Gateway response errors.
 - Device identity persistence, signing, proxy routing, TLS formatting, and
   logging stay host-owned through `GatewayClientHostDeps`.
 - Protocol changes are additive first. Incompatible changes require an explicit

package/dist/browser-device-auth-Dz6H7eXy.d.mts

@@ -0,0 +1,112 @@
+import { ConnectParams, HelloOk } from "@openclaw/gateway-protocol";
+
+//#region packages/gateway-client/src/connect-auth.d.ts
+type GatewayConnectAuthSelection = {
+  authToken?: string;
+  authBootstrapToken?: string;
+  authDeviceToken?: string;
+  authPassword?: string;
+  authApprovalRuntimeToken?: string;
+  authAgentRuntimeIdentityToken?: string;
+  signatureToken?: string;
+  resolvedDeviceToken?: string;
+  storedToken?: string;
+  storedScopes?: string[];
+  usingStoredDeviceToken?: boolean;
+};
+declare function selectGatewayConnectAuth(params: {
+  token?: string;
+  bootstrapToken?: string;
+  deviceToken?: string;
+  password?: string;
+  approvalRuntimeToken?: string;
+  agentRuntimeIdentityToken?: string;
+  storedToken?: string;
+  storedScopes?: string[];
+  pendingDeviceTokenRetry?: boolean;
+  trustedDeviceTokenRetry?: boolean;
+  preferBootstrapToken?: boolean;
+}): GatewayConnectAuthSelection;
+declare function buildGatewayConnectAuth(selected: GatewayConnectAuthSelection): ConnectParams["auth"];
+declare function resolveGatewayConnectScopes(params: {
+  requestedScopes?: string[];
+  usingStoredDeviceToken?: boolean;
+  storedScopes?: string[];
+  defaultScopes: readonly string[];
+}): string[];
+declare function shouldRetryGatewayWithDeviceToken(params: {
+  retryBudgetUsed: boolean;
+  currentDeviceToken?: string;
+  explicitToken?: string;
+  storedToken?: string;
+  trustedEndpoint: boolean;
+  canRetryWithDeviceTokenHint?: boolean;
+  errorDetails?: unknown;
+}): boolean;
+//#endregion
+//#region packages/gateway-client/src/browser-device-auth.d.ts
+type GatewayBrowserDeviceIdentity = {
+  deviceId: string;
+  publicKey: string;
+  sign: (payload: string) => Promise<string>;
+};
+type GatewayBrowserDeviceTokenRecord = {
+  token: string;
+  scopes: string[];
+};
+type MaybePromise<T> = T | Promise<T>;
+type GatewayBrowserDeviceTokenStore = {
+  load: (params: {
+    clientId: string;
+    deviceId: string;
+    role: string;
+  }) => MaybePromise<GatewayBrowserDeviceTokenRecord | null>;
+  store: (params: {
+    clientId: string;
+    deviceId: string;
+    role: string;
+    token: string;
+    scopes: string[];
+  }) => MaybePromise<void>;
+  clear: (params: {
+    clientId: string;
+    deviceId: string;
+    role: string;
+  }) => MaybePromise<void>;
+};
+type GatewayBrowserDeviceAuthPlan = {
+  clientId: string;
+  role: string;
+  identity: GatewayBrowserDeviceIdentity | null;
+  selectedAuth: GatewayConnectAuthSelection;
+  scopes: string[];
+  device?: NonNullable<ConnectParams["device"]>;
+  auth?: ConnectParams["auth"];
+};
+/** Browser-safe device pairing and issued-token lifecycle shared by first-party UI clients. */
+declare class GatewayBrowserDeviceAuthLifecycle {
+  private readonly deps;
+  constructor(deps: {
+    loadIdentity: () => Promise<GatewayBrowserDeviceIdentity | null>;
+    tokenStore: GatewayBrowserDeviceTokenStore;
+    nowMs?: () => number;
+  });
+  buildPlan(params: {
+    client: ConnectParams["client"];
+    role: string;
+    defaultScopes: readonly string[];
+    bootstrapScopes?: readonly string[];
+    token?: string;
+    bootstrapToken?: string;
+    password?: string;
+    pendingDeviceTokenRetry?: boolean;
+    trustedDeviceTokenRetry?: boolean;
+    preferBootstrapToken?: boolean;
+    nonce: string | null;
+    challengeTs?: number | null;
+  }): Promise<GatewayBrowserDeviceAuthPlan>;
+  acceptHello(hello: Pick<HelloOk, "auth">, plan: GatewayBrowserDeviceAuthPlan): Promise<void>;
+  clearStoredToken(plan: GatewayBrowserDeviceAuthPlan): Promise<void>;
+}
+//#endregion
+export { GatewayBrowserDeviceTokenStore as a, resolveGatewayConnectScopes as c, GatewayBrowserDeviceTokenRecord as i, selectGatewayConnectAuth as l, GatewayBrowserDeviceAuthPlan as n, GatewayConnectAuthSelection as o, GatewayBrowserDeviceIdentity as r, buildGatewayConnectAuth as s, GatewayBrowserDeviceAuthLifecycle as t, shouldRetryGatewayWithDeviceToken as u };

package/dist/browser.d.mts

@@ -1,5 +1,7 @@
-import { A as GatewayBrowserDeviceAuthLifecycle, B as buildDeviceAuthPayload, C as normalizeSessionProjectionRunId, D as reconcileSessionProjectionSnapshot, E as readSessionMessageSequence, F as GatewayConnectAuthSelection, H as normalizeDeviceMetadataForAuth, I as buildGatewayConnectAuth, L as resolveGatewayConnectScopes, M as GatewayBrowserDeviceIdentity, N as GatewayBrowserDeviceTokenRecord, O as reduceSessionProjection, P as GatewayBrowserDeviceTokenStore, R as selectGatewayConnectAuth, S as isLocallyOptimisticSessionMessage, T as readSessionMessageIdentity, V as buildDeviceAuthPayloadV3, _ as SessionProjectionScope, a as GatewaySessionMessageSubscriptionOptions, b as createSessionProjection, c as resetGatewaySessionMessageSubscriptionCoordinator, d as SessionProjectionEntry, f as SessionProjectionEvent, g as SessionProjectionRunTransition, h as SessionProjectionRunStatus, i as GatewaySessionMessageSubscriptionCoordinatorOptions, j as GatewayBrowserDeviceAuthPlan, k as reduceSessionProjectionRunEvent, l as SessionMessageEnvelope, m as SessionProjectionRun, n as GatewaySessionMessageSubscription, o as getGatewaySessionMessageSubscriptionCoordinator, p as SessionProjectionGatewayRunEvent, r as GatewaySessionMessageSubscriptionCoordinator, s as releaseGatewaySessionMessageSubscription, t as GatewaySessionMessageRequestClient, u as SessionMessageIdentity, v as SessionProjectionSnapshotOptions, w as projectLiveSessionMessage, x as hasSessionProjectionAcceptedFinal, y as SessionProjectionState, z as shouldRetryGatewayWithDeviceToken } from "./session-subscriptions-Das1PATe.mjs";
-import { a as GatewayProtocolSocketHandlers, c as GatewayProtocolRequestOptions, i as GatewayProtocolSocket, n as GatewayProtocolCloseContext, o as GatewayProtocolTiming, r as GatewayProtocolRequestTiming, s as GatewayProtocolRequestError, t as GatewayProtocolClient } from "./protocol-client-U142L0j3.mjs";
+import { A as gatewayCredentialScope, C as reduceSessionProjection, D as normalizeSessionProjectionRunId, E as SessionMessageIdentity, M as buildDeviceAuthPayload, N as buildDeviceAuthPayloadV3, O as readSessionMessageIdentity, P as normalizeDeviceMetadataForAuth, S as reconcileSessionProjectionSnapshot, T as SessionMessageEnvelope, _ as SessionProjectionState, a as GatewaySessionMessageSubscriptionOptions, b as isLocallyOptimisticSessionMessage, c as resetGatewaySessionMessageSubscriptionCoordinator, d as SessionProjectionGatewayRunEvent, f as SessionProjectionRun, g as SessionProjectionSnapshotOptions, h as SessionProjectionScope, i as GatewaySessionMessageSubscriptionCoordinatorOptions, j as gatewayOriginScope, k as readSessionMessageSequence, l as SessionProjectionEntry, m as SessionProjectionRunTransition, n as GatewaySessionMessageSubscription, o as getGatewaySessionMessageSubscriptionCoordinator, p as SessionProjectionRunStatus, r as GatewaySessionMessageSubscriptionCoordinator, s as releaseGatewaySessionMessageSubscription, t as GatewaySessionMessageRequestClient, u as SessionProjectionEvent, v as createSessionProjection, w as reduceSessionProjectionRunEvent, x as projectLiveSessionMessage, y as hasSessionProjectionAcceptedFinal } from "./session-subscriptions-CKF7acYN.mjs";
+import { a as GatewayBrowserDeviceTokenStore, c as resolveGatewayConnectScopes, i as GatewayBrowserDeviceTokenRecord, l as selectGatewayConnectAuth, n as GatewayBrowserDeviceAuthPlan, o as GatewayConnectAuthSelection, r as GatewayBrowserDeviceIdentity, s as buildGatewayConnectAuth, t as GatewayBrowserDeviceAuthLifecycle, u as shouldRetryGatewayWithDeviceToken } from "./browser-device-auth-Dz6H7eXy.mjs";
+import { n as GatewayProtocolRequestOptions, r as GatewayProtocolRequestTimeoutError, t as GatewayProtocolRequestError } from "./protocol-request-D4mVhLxE.mjs";
+import { a as GatewayProtocolTiming, i as GatewayProtocolSocketHandlers, n as GatewayProtocolCloseContext, o as GatewayProtocolRequestTiming, r as GatewayProtocolSocket, t as GatewayProtocolClient } from "./protocol-client-BbN-I582.mjs";
 import { DEFAULT_GATEWAY_REQUEST_TIMEOUT_MS, DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS, resolveSafeTimeoutDelayMs } from "./timeouts.mjs";
 import { ConnectParams, ErrorShape, EventFrame, HelloOk } from "@openclaw/gateway-protocol";
 export * from "@openclaw/gateway-protocol/connect-error-details";
@@ -17,4 +19,4 @@ declare function shouldPauseGatewayReconnect(params: {
   clientVersionMismatchIsTerminal?: boolean;
 }): boolean;
 //#endregion
-export { type ConnectParams, DEFAULT_GATEWAY_REQUEST_TIMEOUT_MS, DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS, type ErrorShape, type EventFrame, GatewayBrowserDeviceAuthLifecycle, GatewayBrowserDeviceAuthPlan, GatewayBrowserDeviceIdentity, GatewayBrowserDeviceTokenRecord, GatewayBrowserDeviceTokenStore, GatewayConnectAuthSelection, GatewayProtocolClient, GatewayProtocolCloseContext, GatewayProtocolRequestError, type GatewayProtocolRequestOptions, GatewayProtocolRequestTiming, GatewayProtocolSocket, GatewayProtocolSocketHandlers, GatewayProtocolTiming, GatewaySessionMessageRequestClient, GatewaySessionMessageSubscription, GatewaySessionMessageSubscriptionCoordinator, GatewaySessionMessageSubscriptionCoordinatorOptions, GatewaySessionMessageSubscriptionOptions, type HelloOk, SessionMessageEnvelope, SessionMessageIdentity, SessionProjectionEntry, SessionProjectionEvent, SessionProjectionGatewayRunEvent, SessionProjectionRun, SessionProjectionRunStatus, SessionProjectionRunTransition, SessionProjectionScope, SessionProjectionSnapshotOptions, SessionProjectionState, buildDeviceAuthPayload, buildDeviceAuthPayloadV3, buildGatewayConnectAuth, createSessionProjection, getGatewaySessionMessageSubscriptionCoordinator, hasSessionProjectionAcceptedFinal, isLocallyOptimisticSessionMessage, normalizeDeviceMetadataForAuth, normalizeSessionProjectionRunId, projectLiveSessionMessage, readSessionMessageIdentity, readSessionMessageSequence, reconcileSessionProjectionSnapshot, reduceSessionProjection, reduceSessionProjectionRunEvent, releaseGatewaySessionMessageSubscription, resetGatewaySessionMessageSubscriptionCoordinator, resolveGatewayConnectScopes, resolveSafeTimeoutDelayMs, selectGatewayConnectAuth, shouldPauseGatewayReconnect, shouldRetryGatewayWithDeviceToken };
+export { type ConnectParams, DEFAULT_GATEWAY_REQUEST_TIMEOUT_MS, DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS, type ErrorShape, type EventFrame, GatewayBrowserDeviceAuthLifecycle, GatewayBrowserDeviceAuthPlan, GatewayBrowserDeviceIdentity, GatewayBrowserDeviceTokenRecord, GatewayBrowserDeviceTokenStore, GatewayConnectAuthSelection, GatewayProtocolClient, type GatewayProtocolCloseContext, GatewayProtocolRequestError, type GatewayProtocolRequestOptions, GatewayProtocolRequestTimeoutError, type GatewayProtocolRequestTiming, type GatewayProtocolSocket, type GatewayProtocolSocketHandlers, type GatewayProtocolTiming, GatewaySessionMessageRequestClient, GatewaySessionMessageSubscription, GatewaySessionMessageSubscriptionCoordinator, GatewaySessionMessageSubscriptionCoordinatorOptions, GatewaySessionMessageSubscriptionOptions, type HelloOk, type SessionMessageEnvelope, type SessionMessageIdentity, SessionProjectionEntry, SessionProjectionEvent, SessionProjectionGatewayRunEvent, SessionProjectionRun, SessionProjectionRunStatus, SessionProjectionRunTransition, SessionProjectionScope, SessionProjectionSnapshotOptions, SessionProjectionState, buildDeviceAuthPayload, buildDeviceAuthPayloadV3, buildGatewayConnectAuth, createSessionProjection, gatewayCredentialScope, gatewayOriginScope, getGatewaySessionMessageSubscriptionCoordinator, hasSessionProjectionAcceptedFinal, isLocallyOptimisticSessionMessage, normalizeDeviceMetadataForAuth, normalizeSessionProjectionRunId, projectLiveSessionMessage, readSessionMessageIdentity, readSessionMessageSequence, reconcileSessionProjectionSnapshot, reduceSessionProjection, reduceSessionProjectionRunEvent, releaseGatewaySessionMessageSubscription, resetGatewaySessionMessageSubscriptionCoordinator, resolveGatewayConnectScopes, resolveSafeTimeoutDelayMs, selectGatewayConnectAuth, shouldPauseGatewayReconnect, shouldRetryGatewayWithDeviceToken };

package/dist/browser.mjs

@@ -1,8 +1,8 @@
-import { C as buildDeviceAuthPayload, S as shouldRetryGatewayWithDeviceToken, T as normalizeDeviceMetadataForAuth, _ as GatewayProtocolRequestError, a as createSessionProjection, b as resolveGatewayConnectScopes, c as normalizeSessionProjectionRunId, d as readSessionMessageSequence, f as reconcileSessionProjectionSnapshot, g as GatewayProtocolClient, h as shouldPauseGatewayReconnect, i as resetGatewaySessionMessageSubscriptionCoordinator, l as projectLiveSessionMessage, m as reduceSessionProjectionRunEvent, n as getGatewaySessionMessageSubscriptionCoordinator, o as hasSessionProjectionAcceptedFinal, p as reduceSessionProjection, r as releaseGatewaySessionMessageSubscription, s as isLocallyOptimisticSessionMessage, t as GatewaySessionMessageSubscriptionCoordinator, u as readSessionMessageIdentity, v as GatewayBrowserDeviceAuthLifecycle, w as buildDeviceAuthPayloadV3, x as selectGatewayConnectAuth, y as buildGatewayConnectAuth } from "./session-subscriptions-D4Xv60cN.mjs";
+import { C as resolveGatewayConnectScopes, D as buildDeviceAuthPayloadV3, E as buildDeviceAuthPayload, O as normalizeDeviceMetadataForAuth, S as buildGatewayConnectAuth, T as shouldRetryGatewayWithDeviceToken, _ as GatewayProtocolRequestError, a as createSessionProjection, b as gatewayOriginScope, c as projectLiveSessionMessage, d as reduceSessionProjectionRunEvent, f as normalizeSessionProjectionRunId, g as GatewayProtocolClient, h as shouldPauseGatewayReconnect, i as resetGatewaySessionMessageSubscriptionCoordinator, l as reconcileSessionProjectionSnapshot, m as readSessionMessageSequence, n as getGatewaySessionMessageSubscriptionCoordinator, o as hasSessionProjectionAcceptedFinal, p as readSessionMessageIdentity, r as releaseGatewaySessionMessageSubscription, s as isLocallyOptimisticSessionMessage, t as GatewaySessionMessageSubscriptionCoordinator, u as reduceSessionProjection, v as GatewayProtocolRequestTimeoutError, w as selectGatewayConnectAuth, x as GatewayBrowserDeviceAuthLifecycle, y as gatewayCredentialScope } from "./session-subscriptions-OJnDJHPL.mjs";
 import { DEFAULT_GATEWAY_REQUEST_TIMEOUT_MS, DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS, resolveSafeTimeoutDelayMs } from "./timeouts.mjs";
 export * from "@openclaw/gateway-protocol/connect-error-details";
 export * from "@openclaw/gateway-protocol/client-info";
 export * from "@openclaw/gateway-protocol/gateway-error-details";
 export * from "@openclaw/gateway-protocol/startup-unavailable";
 export * from "@openclaw/gateway-protocol/version";
-export { DEFAULT_GATEWAY_REQUEST_TIMEOUT_MS, DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS, GatewayBrowserDeviceAuthLifecycle, GatewayProtocolClient, GatewayProtocolRequestError, GatewaySessionMessageSubscriptionCoordinator, buildDeviceAuthPayload, buildDeviceAuthPayloadV3, buildGatewayConnectAuth, createSessionProjection, getGatewaySessionMessageSubscriptionCoordinator, hasSessionProjectionAcceptedFinal, isLocallyOptimisticSessionMessage, normalizeDeviceMetadataForAuth, normalizeSessionProjectionRunId, projectLiveSessionMessage, readSessionMessageIdentity, readSessionMessageSequence, reconcileSessionProjectionSnapshot, reduceSessionProjection, reduceSessionProjectionRunEvent, releaseGatewaySessionMessageSubscription, resetGatewaySessionMessageSubscriptionCoordinator, resolveGatewayConnectScopes, resolveSafeTimeoutDelayMs, selectGatewayConnectAuth, shouldPauseGatewayReconnect, shouldRetryGatewayWithDeviceToken };
+export { DEFAULT_GATEWAY_REQUEST_TIMEOUT_MS, DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS, GatewayBrowserDeviceAuthLifecycle, GatewayProtocolClient, GatewayProtocolRequestError, GatewayProtocolRequestTimeoutError, GatewaySessionMessageSubscriptionCoordinator, buildDeviceAuthPayload, buildDeviceAuthPayloadV3, buildGatewayConnectAuth, createSessionProjection, gatewayCredentialScope, gatewayOriginScope, getGatewaySessionMessageSubscriptionCoordinator, hasSessionProjectionAcceptedFinal, isLocallyOptimisticSessionMessage, normalizeDeviceMetadataForAuth, normalizeSessionProjectionRunId, projectLiveSessionMessage, readSessionMessageIdentity, readSessionMessageSequence, reconcileSessionProjectionSnapshot, reduceSessionProjection, reduceSessionProjectionRunEvent, releaseGatewaySessionMessageSubscription, resetGatewaySessionMessageSubscriptionCoordinator, resolveGatewayConnectScopes, resolveSafeTimeoutDelayMs, selectGatewayConnectAuth, shouldPauseGatewayReconnect, shouldRetryGatewayWithDeviceToken };

package/dist/index.d.mts

@@ -1,4 +1,17 @@
-import { A as GatewayBrowserDeviceAuthLifecycle, B as buildDeviceAuthPayload, C as normalizeSessionProjectionRunId, D as reconcileSessionProjectionSnapshot, E as readSessionMessageSequence, F as GatewayConnectAuthSelection, H as normalizeDeviceMetadataForAuth, I as buildGatewayConnectAuth, L as resolveGatewayConnectScopes, M as GatewayBrowserDeviceIdentity, N as GatewayBrowserDeviceTokenRecord, O as reduceSessionProjection, P as GatewayBrowserDeviceTokenStore, R as selectGatewayConnectAuth, S as isLocallyOptimisticSessionMessage, T as readSessionMessageIdentity, V as buildDeviceAuthPayloadV3, _ as SessionProjectionScope, a as GatewaySessionMessageSubscriptionOptions, b as createSessionProjection, c as resetGatewaySessionMessageSubscriptionCoordinator, d as SessionProjectionEntry, f as SessionProjectionEvent, g as SessionProjectionRunTransition, h as SessionProjectionRunStatus, i as GatewaySessionMessageSubscriptionCoordinatorOptions, j as GatewayBrowserDeviceAuthPlan, k as reduceSessionProjectionRunEvent, l as SessionMessageEnvelope, m as SessionProjectionRun, n as GatewaySessionMessageSubscription, o as getGatewaySessionMessageSubscriptionCoordinator, p as SessionProjectionGatewayRunEvent, r as GatewaySessionMessageSubscriptionCoordinator, s as releaseGatewaySessionMessageSubscription, t as GatewaySessionMessageRequestClient, u as SessionMessageIdentity, v as SessionProjectionSnapshotOptions, w as projectLiveSessionMessage, x as hasSessionProjectionAcceptedFinal, y as SessionProjectionState, z as shouldRetryGatewayWithDeviceToken } from "./session-subscriptions-Das1PATe.mjs";
+import { A as gatewayCredentialScope, C as reduceSessionProjection, D as normalizeSessionProjectionRunId, E as SessionMessageIdentity, M as buildDeviceAuthPayload, N as buildDeviceAuthPayloadV3, O as readSessionMessageIdentity, P as normalizeDeviceMetadataForAuth, S as reconcileSessionProjectionSnapshot, T as SessionMessageEnvelope, _ as SessionProjectionState, a as GatewaySessionMessageSubscriptionOptions, b as isLocallyOptimisticSessionMessage, c as resetGatewaySessionMessageSubscriptionCoordinator, d as SessionProjectionGatewayRunEvent, f as SessionProjectionRun, g as SessionProjectionSnapshotOptions, h as SessionProjectionScope, i as GatewaySessionMessageSubscriptionCoordinatorOptions, j as gatewayOriginScope, k as readSessionMessageSequence, l as SessionProjectionEntry, m as SessionProjectionRunTransition, n as GatewaySessionMessageSubscription, o as getGatewaySessionMessageSubscriptionCoordinator, p as SessionProjectionRunStatus, r as GatewaySessionMessageSubscriptionCoordinator, s as releaseGatewaySessionMessageSubscription, t as GatewaySessionMessageRequestClient, u as SessionProjectionEvent, v as createSessionProjection, w as reduceSessionProjectionRunEvent, x as projectLiveSessionMessage, y as hasSessionProjectionAcceptedFinal } from "./session-subscriptions-CKF7acYN.mjs";
+import { a as GatewayBrowserDeviceTokenStore, c as resolveGatewayConnectScopes, i as GatewayBrowserDeviceTokenRecord, l as selectGatewayConnectAuth, n as GatewayBrowserDeviceAuthPlan, o as GatewayConnectAuthSelection, r as GatewayBrowserDeviceIdentity, s as buildGatewayConnectAuth, t as GatewayBrowserDeviceAuthLifecycle, u as shouldRetryGatewayWithDeviceToken } from "./browser-device-auth-Dz6H7eXy.mjs";
 import { DEFAULT_GATEWAY_REQUEST_TIMEOUT_MS, DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS, MAX_CONNECT_CHALLENGE_TIMEOUT_MS, MAX_SAFE_TIMEOUT_DELAY_MS, MIN_CONNECT_CHALLENGE_TIMEOUT_MS, addSafeTimeoutDelayGraceMs, clampConnectChallengeTimeoutMs, clearGatewayConnectTimeout, getConnectChallengeTimeoutMsFromEnv, resolveConnectChallengeTimeoutMs, resolveFiniteTimeoutDelayMs, resolvePreauthHandshakeTimeoutMs, resolveSafeTimeoutDelayMs, startGatewayConnectTimeout } from "./timeouts.mjs";
-import { _ as GatewayClientRequestOptions, a as startGatewayClientWithReadinessWait, b as isGatewayConnectAssemblyError, c as waitForEventLoopReady, d as GatewayClient, f as GatewayClientCloseInfo, g as GatewayClientRequestError, h as GatewayClientOptions, i as startGatewayClientWhenEventLoopReady, l as DeviceAuthTokenRecord, m as GatewayClientHostDeps, n as GatewayClientStartReadinessOptions, o as EventLoopReadyOptions, p as GatewayClientConnectionMetadata, r as GatewayClientStartable, s as EventLoopReadyResult, t as EventLoopReadyWaiter, u as DeviceIdentity, v as GatewayClientRequestTimeoutError, y as GatewayReconnectPausedInfo } from "./readiness-uSDrqxDM.mjs";
-export { DEFAULT_GATEWAY_REQUEST_TIMEOUT_MS, DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS, DeviceAuthTokenRecord, DeviceIdentity, EventLoopReadyOptions, EventLoopReadyResult, EventLoopReadyWaiter, GatewayBrowserDeviceAuthLifecycle, GatewayBrowserDeviceAuthPlan, GatewayBrowserDeviceIdentity, GatewayBrowserDeviceTokenRecord, GatewayBrowserDeviceTokenStore, GatewayClient, GatewayClientCloseInfo, GatewayClientConnectionMetadata, GatewayClientHostDeps, GatewayClientOptions, GatewayClientRequestError, GatewayClientRequestOptions, GatewayClientRequestTimeoutError, GatewayClientStartReadinessOptions, GatewayClientStartable, GatewayConnectAuthSelection, GatewayReconnectPausedInfo, GatewaySessionMessageRequestClient, GatewaySessionMessageSubscription, GatewaySessionMessageSubscriptionCoordinator, GatewaySessionMessageSubscriptionCoordinatorOptions, GatewaySessionMessageSubscriptionOptions, MAX_CONNECT_CHALLENGE_TIMEOUT_MS, MAX_SAFE_TIMEOUT_DELAY_MS, MIN_CONNECT_CHALLENGE_TIMEOUT_MS, SessionMessageEnvelope, SessionMessageIdentity, SessionProjectionEntry, SessionProjectionEvent, SessionProjectionGatewayRunEvent, SessionProjectionRun, SessionProjectionRunStatus, SessionProjectionRunTransition, SessionProjectionScope, SessionProjectionSnapshotOptions, SessionProjectionState, addSafeTimeoutDelayGraceMs, buildDeviceAuthPayload, buildDeviceAuthPayloadV3, buildGatewayConnectAuth, clampConnectChallengeTimeoutMs, clearGatewayConnectTimeout, createSessionProjection, getConnectChallengeTimeoutMsFromEnv, getGatewaySessionMessageSubscriptionCoordinator, hasSessionProjectionAcceptedFinal, isGatewayConnectAssemblyError, isLocallyOptimisticSessionMessage, normalizeDeviceMetadataForAuth, normalizeSessionProjectionRunId, projectLiveSessionMessage, readSessionMessageIdentity, readSessionMessageSequence, reconcileSessionProjectionSnapshot, reduceSessionProjection, reduceSessionProjectionRunEvent, releaseGatewaySessionMessageSubscription, resetGatewaySessionMessageSubscriptionCoordinator, resolveConnectChallengeTimeoutMs, resolveFiniteTimeoutDelayMs, resolveGatewayConnectScopes, resolvePreauthHandshakeTimeoutMs, resolveSafeTimeoutDelayMs, selectGatewayConnectAuth, shouldRetryGatewayWithDeviceToken, startGatewayClientWhenEventLoopReady, startGatewayClientWithReadinessWait, startGatewayConnectTimeout, waitForEventLoopReady };
+import { _ as GatewayClientRequestTimeoutError, a as startGatewayClientWithReadinessWait, b as GatewayClientRequestError, c as waitForEventLoopReady, d as GatewayClient, f as GatewayClientCloseInfo, g as GatewayClientRequestOptions, h as GatewayClientOptions, i as startGatewayClientWhenEventLoopReady, l as DeviceAuthTokenRecord, m as GatewayClientHostDeps, n as GatewayClientStartReadinessOptions, o as EventLoopReadyOptions, p as GatewayClientConnectionMetadata, r as GatewayClientStartable, s as EventLoopReadyResult, t as EventLoopReadyWaiter, u as DeviceIdentity, v as GatewayReconnectPausedInfo, y as isGatewayConnectAssemblyError } from "./readiness-JllUDKLg.mjs";
+import { GatewayScopeUpgrade, ScopeUpgradeBinding, ScopeUpgradeOptions, ScopeUpgradeOutcome } from "./scope-upgrade.mjs";
+
+//#region packages/gateway-client/src/cloudflare-access.d.ts
+declare const CF_ACCESS_CLIENT_ID_HEADER = "CF-Access-Client-Id";
+declare const CF_ACCESS_CLIENT_SECRET_HEADER = "CF-Access-Client-Secret";
+type CloudflareAccessCredentials = Readonly<{
+  clientId: string;
+  clientSecret: string;
+}>;
+/** Build only the two headers Cloudflare Access defines for service-token auth. */
+declare function buildCloudflareAccessHeaders(credentials: CloudflareAccessCredentials): Record<string, string>;
+//#endregion
+export { CF_ACCESS_CLIENT_ID_HEADER, CF_ACCESS_CLIENT_SECRET_HEADER, CloudflareAccessCredentials, DEFAULT_GATEWAY_REQUEST_TIMEOUT_MS, DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS, DeviceAuthTokenRecord, DeviceIdentity, EventLoopReadyOptions, EventLoopReadyResult, EventLoopReadyWaiter, GatewayBrowserDeviceAuthLifecycle, GatewayBrowserDeviceAuthPlan, GatewayBrowserDeviceIdentity, GatewayBrowserDeviceTokenRecord, GatewayBrowserDeviceTokenStore, GatewayClient, GatewayClientCloseInfo, GatewayClientConnectionMetadata, GatewayClientHostDeps, GatewayClientOptions, GatewayClientRequestError, GatewayClientRequestOptions, GatewayClientRequestTimeoutError, GatewayClientStartReadinessOptions, GatewayClientStartable, GatewayConnectAuthSelection, GatewayReconnectPausedInfo, GatewayScopeUpgrade, GatewaySessionMessageRequestClient, GatewaySessionMessageSubscription, GatewaySessionMessageSubscriptionCoordinator, GatewaySessionMessageSubscriptionCoordinatorOptions, GatewaySessionMessageSubscriptionOptions, MAX_CONNECT_CHALLENGE_TIMEOUT_MS, MAX_SAFE_TIMEOUT_DELAY_MS, MIN_CONNECT_CHALLENGE_TIMEOUT_MS, ScopeUpgradeBinding, ScopeUpgradeOptions, ScopeUpgradeOutcome, type SessionMessageEnvelope, type SessionMessageIdentity, SessionProjectionEntry, SessionProjectionEvent, SessionProjectionGatewayRunEvent, SessionProjectionRun, SessionProjectionRunStatus, SessionProjectionRunTransition, SessionProjectionScope, SessionProjectionSnapshotOptions, SessionProjectionState, addSafeTimeoutDelayGraceMs, buildCloudflareAccessHeaders, buildDeviceAuthPayload, buildDeviceAuthPayloadV3, buildGatewayConnectAuth, clampConnectChallengeTimeoutMs, clearGatewayConnectTimeout, createSessionProjection, gatewayCredentialScope, gatewayOriginScope, getConnectChallengeTimeoutMsFromEnv, getGatewaySessionMessageSubscriptionCoordinator, hasSessionProjectionAcceptedFinal, isGatewayConnectAssemblyError, isLocallyOptimisticSessionMessage, normalizeDeviceMetadataForAuth, normalizeSessionProjectionRunId, projectLiveSessionMessage, readSessionMessageIdentity, readSessionMessageSequence, reconcileSessionProjectionSnapshot, reduceSessionProjection, reduceSessionProjectionRunEvent, releaseGatewaySessionMessageSubscription, resetGatewaySessionMessageSubscriptionCoordinator, resolveConnectChallengeTimeoutMs, resolveFiniteTimeoutDelayMs, resolveGatewayConnectScopes, resolvePreauthHandshakeTimeoutMs, resolveSafeTimeoutDelayMs, selectGatewayConnectAuth, shouldRetryGatewayWithDeviceToken, startGatewayClientWhenEventLoopReady, startGatewayClientWithReadinessWait, startGatewayConnectTimeout, waitForEventLoopReady };