@openclaw/gateway-client 2026.8.1-beta.1 → 2026.8.1-beta.3

package/dist/index.mjs

@@ -1,1003 +1,344 @@
-import { C as buildDeviceAuthPayload, S as shouldRetryGatewayWithDeviceToken, T as normalizeDeviceMetadataForAuth, _ as GatewayProtocolRequestError, a as createSessionProjection, b as resolveGatewayConnectScopes, c as normalizeSessionProjectionRunId, d as readSessionMessageSequence, f as reconcileSessionProjectionSnapshot, g as GatewayProtocolClient, h as shouldPauseGatewayReconnect, i as resetGatewaySessionMessageSubscriptionCoordinator, l as projectLiveSessionMessage, m as reduceSessionProjectionRunEvent, n as getGatewaySessionMessageSubscriptionCoordinator, o as hasSessionProjectionAcceptedFinal, p as reduceSessionProjection, r as releaseGatewaySessionMessageSubscription, s as isLocallyOptimisticSessionMessage, t as GatewaySessionMessageSubscriptionCoordinator, u as readSessionMessageIdentity, v as GatewayBrowserDeviceAuthLifecycle, w as buildDeviceAuthPayloadV3, x as selectGatewayConnectAuth, y as buildGatewayConnectAuth } from "./session-subscriptions-D4Xv60cN.mjs";
+import { C as resolveGatewayConnectScopes, D as buildDeviceAuthPayloadV3, E as buildDeviceAuthPayload, O as normalizeDeviceMetadataForAuth, S as buildGatewayConnectAuth, T as shouldRetryGatewayWithDeviceToken, _ as GatewayProtocolRequestError, a as createSessionProjection, b as gatewayOriginScope, c as projectLiveSessionMessage, d as reduceSessionProjectionRunEvent, f as normalizeSessionProjectionRunId, g as GatewayProtocolClient, h as shouldPauseGatewayReconnect, i as resetGatewaySessionMessageSubscriptionCoordinator, l as reconcileSessionProjectionSnapshot, m as readSessionMessageSequence, n as getGatewaySessionMessageSubscriptionCoordinator, o as hasSessionProjectionAcceptedFinal, p as readSessionMessageIdentity, r as releaseGatewaySessionMessageSubscription, s as isLocallyOptimisticSessionMessage, t as GatewaySessionMessageSubscriptionCoordinator, u as reduceSessionProjection, v as GatewayProtocolRequestTimeoutError, w as selectGatewayConnectAuth, x as GatewayBrowserDeviceAuthLifecycle, y as gatewayCredentialScope } from "./session-subscriptions-OJnDJHPL.mjs";
 import { DEFAULT_GATEWAY_REQUEST_TIMEOUT_MS, DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS, MAX_CONNECT_CHALLENGE_TIMEOUT_MS, MAX_SAFE_TIMEOUT_DELAY_MS, MIN_CONNECT_CHALLENGE_TIMEOUT_MS, addSafeTimeoutDelayGraceMs, clampConnectChallengeTimeoutMs, clearGatewayConnectTimeout, getConnectChallengeTimeoutMsFromEnv, resolveConnectChallengeTimeoutMs, resolveFiniteTimeoutDelayMs, resolvePreauthHandshakeTimeoutMs, resolveSafeTimeoutDelayMs, startGatewayConnectTimeout } from "./timeouts.mjs";
+import { rawDataToString } from "./websocket-data.mjs";
 import { n as startGatewayClientWithReadinessWait, r as waitForEventLoopReady, t as startGatewayClientWhenEventLoopReady } from "./readiness-CrWxd4TI.mjs";
+import { GatewayScopeUpgrade } from "./scope-upgrade.mjs";
 import { ConnectErrorDetailCodes, formatConnectErrorMessage, readConnectErrorDetailCode } from "@openclaw/gateway-protocol/connect-error-details";
 import { GATEWAY_CLIENT_MODES, GATEWAY_CLIENT_NAMES } from "@openclaw/gateway-protocol/client-info";
 import { resolveGatewayStartupRetryAfterMs } from "@openclaw/gateway-protocol/startup-unavailable";
-import { MIN_CLIENT_PROTOCOL_VERSION, PROTOCOL_VERSION } from "@openclaw/gateway-protocol/version";
+import { MIN_CLIENT_PROTOCOL_VERSION, MIN_NODE_PROTOCOL_VERSION, MIN_PROBE_PROTOCOL_VERSION, PROTOCOL_VERSION } from "@openclaw/gateway-protocol/version";
 import { randomUUID } from "node:crypto";
 import { WebSocket } from "ws";
-import { Buffer as Buffer$1 } from "node:buffer";
-//#region \0rolldown/runtime.js
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);
-var __copyProps = (to, from, except, desc) => {
-	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
-		key = keys[i];
-		if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
-			get: ((k) => from[k]).bind(null, key),
-			enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
-		});
-	}
-	return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
-	value: mod,
-	enumerable: true
-}) : target, mod));
+import ipaddr from "ipaddr.js";
+//#region packages/normalization-core/src/string-coerce.ts
+/** Trims string input and returns null for non-strings or empty strings. */
+function normalizeNullableString(value) {
+	if (typeof value !== "string") return null;
+	const trimmed = value.trim();
+	return trimmed ? trimmed : null;
+}
+/** Trims string input and returns undefined for non-strings or empty strings. */
+function normalizeOptionalString(value) {
+	return normalizeNullableString(value) ?? void 0;
+}
+/** Lowercases a normalized optional string. */
+function normalizeOptionalLowercaseString(value) {
+	return normalizeOptionalString(value)?.toLowerCase();
+}
+/** Lowercases a normalized string or returns an empty string when absent. */
+function normalizeLowercaseStringOrEmpty(value) {
+	return normalizeOptionalLowercaseString(value) ?? "";
+}
 //#endregion
-//#region packages/net-policy/src/ip.ts
-var import_ipaddr = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin(((exports, module) => {
-	(function(root) {
-		"use strict";
-		const ipv4Part = "(0?\\d+|0x[a-f0-9]+)";
-		const ipv4Regexes = {
-			fourOctet: new RegExp(`^${ipv4Part}\\.${ipv4Part}\\.${ipv4Part}\\.${ipv4Part}$`, "i"),
-			threeOctet: new RegExp(`^${ipv4Part}\\.${ipv4Part}\\.${ipv4Part}$`, "i"),
-			twoOctet: new RegExp(`^${ipv4Part}\\.${ipv4Part}$`, "i"),
-			longValue: new RegExp(`^${ipv4Part}$`, "i")
-		};
-		const octalRegex = new RegExp(`^0[0-7]+$`, "i");
-		const hexRegex = new RegExp(`^0x[a-f0-9]+$`, "i");
-		const zoneIndex = "%[0-9a-z]{1,}";
-		const ipv6Part = "(?:[0-9a-f]+::?)+";
-		const ipv6Regexes = {
-			zoneIndex: new RegExp(zoneIndex, "i"),
-			"native": new RegExp(`^(::)?(${ipv6Part})?([0-9a-f]+)?(::)?(${zoneIndex})?$`, "i"),
-			deprecatedTransitional: new RegExp(`^(?:::)(${ipv4Part}\\.${ipv4Part}\\.${ipv4Part}\\.${ipv4Part}(${zoneIndex})?)$`, "i"),
-			transitional: new RegExp(`^((?:${ipv6Part})|(?:::)(?:${ipv6Part})?)${ipv4Part}\\.${ipv4Part}\\.${ipv4Part}\\.${ipv4Part}(${zoneIndex})?$`, "i")
-		};
-		function expandIPv6(string, parts) {
-			if (string.indexOf("::") !== string.lastIndexOf("::")) return null;
-			let colonCount = 0;
-			let lastColon = -1;
-			let zoneId = (string.match(ipv6Regexes.zoneIndex) || [])[0];
-			let replacement, replacementCount;
-			if (zoneId) {
-				zoneId = zoneId.substring(1);
-				string = string.replace(/%.+$/, "");
-			}
-			while ((lastColon = string.indexOf(":", lastColon + 1)) >= 0) colonCount++;
-			if (string.substr(0, 2) === "::") colonCount--;
-			if (string.substr(-2, 2) === "::") colonCount--;
-			if (colonCount > parts) return null;
-			replacementCount = parts - colonCount;
-			replacement = ":";
-			while (replacementCount--) replacement += "0:";
-			string = string.replace("::", replacement);
-			if (string[0] === ":") string = string.slice(1);
-			if (string[string.length - 1] === ":") string = string.slice(0, -1);
-			parts = (function() {
-				const ref = string.split(":");
-				const results = [];
-				for (let i = 0; i < ref.length; i++) results.push(parseInt(ref[i], 16));
-				return results;
-			})();
+//#region packages/net-policy/src/redact-sensitive-url.ts
+const SENSITIVE_URL_QUERY_PARAM_NAMES = /* @__PURE__ */ new Set([
+	"token",
+	"key",
+	"api_key",
+	"apikey",
+	"secret",
+	"access_token",
+	"auth_token",
+	"password",
+	"pass",
+	"passwd",
+	"auth",
+	"jwt",
+	"session",
+	"id_token",
+	"code",
+	"client_secret",
+	"app_secret",
+	"hook_token",
+	"refresh_token",
+	"signature",
+	"x_amz_signature",
+	"x_amz_security_token",
+	"private_key",
+	"credential",
+	"authorization",
+	"sig",
+	"x_api_key",
+	"x_access_token",
+	"x_auth_token"
+]);
+const URL_QUERY_NAME_SEPARATOR_RE = /[\p{C}\p{Z}\u115F\u1160\u3164\uFFA0+]/gu;
+const SUFFIXED_OR_SCOPED_TOKEN_QUERY_PARAM_RE = /(?:^|_)token(?:_[a-f0-9]{16,})?$/u;
+const TELEGRAM_BOT_TOKEN_PATH_RE = /\/bot\d{6,}(?::|%3[aA])[A-Za-z0-9_-]{20,}(?=\/|$)/giu;
+const MAX_NESTED_URL_REDACTION_DEPTH = 8;
+const URL_SCHEME_RE = /(?:^|[^a-z\d+.-])[a-z][a-z\d+.-]{0,31}:/iu;
+const SPECIAL_SCHEME_AUTHORITY_RE = /\b(?:https?|wss?|ftp):[\\/]{0,2}[^\\/?#\s]*/giu;
+const SPECIAL_SCHEME_SPILLED_USERINFO_RE = /\b(?:https?|wss?|ftp):[\\/]{0,2}[^\s]*@[^\\/?#\s]*/giu;
+const PROTOCOL_RELATIVE_AUTHORITY_RE = /[\\/]{2,}[^\\/?#\s]*/gu;
+function redactSensitiveUrlPath(value) {
+	return value.replace(TELEGRAM_BOT_TOKEN_PATH_RE, "/bot***");
+}
+function normalizeUrlQueryParamName(name) {
+	let current = name.replace(URL_QUERY_NAME_SEPARATOR_RE, "");
+	for (let depth = 0; depth <= MAX_NESTED_URL_REDACTION_DEPTH; depth += 1) {
+		let decoded;
+		try {
+			decoded = decodeURIComponent(current).replace(URL_QUERY_NAME_SEPARATOR_RE, "");
+		} catch {
 			return {
-				parts,
-				zoneId
+				value: normalizeLowercaseStringOrEmpty(current).replaceAll("-", "_"),
+				unresolvedEncoding: current.includes("%")
 			};
 		}
-		function matchCIDR(first, second, partSize, cidrBits) {
-			if (first.length !== second.length) throw new Error("ipaddr: cannot match CIDR for objects with different lengths");
-			let part = 0;
-			let shift;
-			while (cidrBits > 0) {
-				shift = partSize - cidrBits;
-				if (shift < 0) shift = 0;
-				if (first[part] >> shift !== second[part] >> shift) return false;
-				cidrBits -= partSize;
-				part += 1;
-			}
-			return true;
+		if (decoded === current) return {
+			value: normalizeLowercaseStringOrEmpty(current).replaceAll("-", "_"),
+			unresolvedEncoding: false
+		};
+		current = decoded;
+	}
+	return {
+		value: normalizeLowercaseStringOrEmpty(current).replaceAll("-", "_"),
+		unresolvedEncoding: current.includes("%")
+	};
+}
+function looksLikeNestedUrlValue(value) {
+	if (URL_SCHEME_RE.test(value)) return true;
+	const forwardAuthorityIndex = value.indexOf("//");
+	const backwardAuthorityIndex = value.indexOf("\\\\");
+	const authorityIndex = forwardAuthorityIndex < 0 ? backwardAuthorityIndex : backwardAuthorityIndex < 0 ? forwardAuthorityIndex : Math.min(forwardAuthorityIndex, backwardAuthorityIndex);
+	if (authorityIndex >= 0 && value.includes("@", authorityIndex + 2)) return true;
+	const queryIndex = value.search(/[?&]/u);
+	if (queryIndex >= 0 && value.includes("=", queryIndex + 1)) return true;
+	const fragmentIndex = value.indexOf("#");
+	if (fragmentIndex >= 0 && value.includes("=", fragmentIndex + 1)) return true;
+	return /%[\da-f]{2}/iu.test(value);
+}
+/** True for auth-like URL query parameter names that should be redacted. */
+function isSensitiveUrlQueryParamName$1(name) {
+	const normalized = normalizeUrlQueryParamName(name);
+	return normalized.unresolvedEncoding || SENSITIVE_URL_QUERY_PARAM_NAMES.has(normalized.value) || SUFFIXED_OR_SCOPED_TOKEN_QUERY_PARAM_RE.test(normalized.value);
+}
+function redactDirectSensitiveUrl(value) {
+	try {
+		const parsed = new URL(value);
+		let mutated = false;
+		const redactedPath = redactSensitiveUrlPath(parsed.pathname);
+		if (redactedPath !== parsed.pathname) {
+			parsed.pathname = redactedPath;
+			mutated = true;
 		}
-		function parseIntAuto(string) {
-			if (hexRegex.test(string)) return parseInt(string, 16);
-			if (string[0] === "0" && !isNaN(parseInt(string[1], 10))) {
-				if (octalRegex.test(string)) return parseInt(string, 8);
-				throw new Error(`ipaddr: cannot parse ${string} as octal`);
-			}
-			return parseInt(string, 10);
+		if (parsed.username || parsed.password) {
+			parsed.username = parsed.username ? "***" : "";
+			parsed.password = parsed.password ? "***" : "";
+			mutated = true;
 		}
-		function padPart(part, length) {
-			while (part.length < length) part = `0${part}`;
-			return part;
+		for (const key of Array.from(parsed.searchParams.keys())) if (isSensitiveUrlQueryParamName$1(key)) {
+			parsed.searchParams.set(key, "***");
+			mutated = true;
 		}
-		const ipaddr = {};
-		ipaddr.IPv4 = (function() {
-			function IPv4(octets) {
-				if (octets.length !== 4) throw new Error("ipaddr: ipv4 octet count should be 4");
-				let i, octet;
-				for (i = 0; i < octets.length; i++) {
-					octet = octets[i];
-					if (!(0 <= octet && octet <= 255)) throw new Error("ipaddr: ipv4 octet should fit in 8 bits");
-				}
-				this.octets = octets;
-			}
-			IPv4.prototype.SpecialRanges = {
-				unspecified: [[new IPv4([
-					0,
-					0,
-					0,
-					0
-				]), 8]],
-				broadcast: [[new IPv4([
-					255,
-					255,
-					255,
-					255
-				]), 32]],
-				multicast: [[new IPv4([
-					224,
-					0,
-					0,
-					0
-				]), 4]],
-				linkLocal: [[new IPv4([
-					169,
-					254,
-					0,
-					0
-				]), 16]],
-				loopback: [[new IPv4([
-					127,
-					0,
-					0,
-					0
-				]), 8]],
-				carrierGradeNat: [[new IPv4([
-					100,
-					64,
-					0,
-					0
-				]), 10]],
-				"private": [
-					[new IPv4([
-						10,
-						0,
-						0,
-						0
-					]), 8],
-					[new IPv4([
-						172,
-						16,
-						0,
-						0
-					]), 12],
-					[new IPv4([
-						192,
-						168,
-						0,
-						0
-					]), 16]
-				],
-				reserved: [
-					[new IPv4([
-						192,
-						0,
-						0,
-						0
-					]), 24],
-					[new IPv4([
-						192,
-						0,
-						2,
-						0
-					]), 24],
-					[new IPv4([
-						192,
-						88,
-						99,
-						0
-					]), 24],
-					[new IPv4([
-						198,
-						18,
-						0,
-						0
-					]), 15],
-					[new IPv4([
-						198,
-						51,
-						100,
-						0
-					]), 24],
-					[new IPv4([
-						203,
-						0,
-						113,
-						0
-					]), 24],
-					[new IPv4([
-						240,
-						0,
-						0,
-						0
-					]), 4]
-				],
-				as112: [[new IPv4([
-					192,
-					175,
-					48,
-					0
-				]), 24], [new IPv4([
-					192,
-					31,
-					196,
-					0
-				]), 24]],
-				amt: [[new IPv4([
-					192,
-					52,
-					193,
-					0
-				]), 24]]
-			};
-			IPv4.prototype.kind = function() {
-				return "ipv4";
-			};
-			IPv4.prototype.match = function(other, cidrRange) {
-				let ref;
-				if (cidrRange === void 0) {
-					ref = other;
-					other = ref[0];
-					cidrRange = ref[1];
-				}
-				if (other.kind() !== "ipv4") throw new Error("ipaddr: cannot match ipv4 address with non-ipv4 one");
-				return matchCIDR(this.octets, other.octets, 8, cidrRange);
-			};
-			IPv4.prototype.prefixLengthFromSubnetMask = function() {
-				let cidr = 0;
-				let stop = false;
-				const zerotable = {
-					0: 8,
-					128: 7,
-					192: 6,
-					224: 5,
-					240: 4,
-					248: 3,
-					252: 2,
-					254: 1,
-					255: 0
-				};
-				let i, octet, zeros;
-				for (i = 3; i >= 0; i -= 1) {
-					octet = this.octets[i];
-					if (octet in zerotable) {
-						zeros = zerotable[octet];
-						if (stop && zeros !== 0) return null;
-						if (zeros !== 8) stop = true;
-						cidr += zeros;
-					} else return null;
-				}
-				return 32 - cidr;
-			};
-			IPv4.prototype.range = function() {
-				return ipaddr.subnetMatch(this, this.SpecialRanges);
-			};
-			IPv4.prototype.toByteArray = function() {
-				return this.octets.slice(0);
-			};
-			IPv4.prototype.toIPv4MappedAddress = function() {
-				return ipaddr.IPv6.parse(`::ffff:${this.toString()}`);
-			};
-			IPv4.prototype.toNormalizedString = function() {
-				return this.toString();
-			};
-			IPv4.prototype.toString = function() {
-				return this.octets.join(".");
-			};
-			return IPv4;
-		})();
-		ipaddr.IPv4.broadcastAddressFromCIDR = function(string) {
-			try {
-				const cidr = this.parseCIDR(string);
-				const ipInterfaceOctets = cidr[0].toByteArray();
-				const subnetMaskOctets = this.subnetMaskFromPrefixLength(cidr[1]).toByteArray();
-				const octets = [];
-				let i = 0;
-				while (i < 4) {
-					octets.push(parseInt(ipInterfaceOctets[i], 10) | parseInt(subnetMaskOctets[i], 10) ^ 255);
-					i++;
-				}
-				return new this(octets);
-			} catch (e) {
-				throw new Error("ipaddr: the address does not have IPv4 CIDR format");
-			}
-		};
-		ipaddr.IPv4.isIPv4 = function(string) {
-			return this.parser(string) !== null;
-		};
-		ipaddr.IPv4.isValid = function(string) {
-			try {
-				new this(this.parser(string));
-				return true;
-			} catch (e) {
-				return false;
-			}
-		};
-		ipaddr.IPv4.isValidCIDR = function(string) {
-			try {
-				this.parseCIDR(string);
-				return true;
-			} catch (e) {
-				return false;
-			}
-		};
-		ipaddr.IPv4.isValidFourPartDecimal = function(string) {
-			if (ipaddr.IPv4.isValid(string) && string.match(/^(0|[1-9]\d*)(\.(0|[1-9]\d*)){3}$/)) return true;
-			else return false;
-		};
-		ipaddr.IPv4.isValidCIDRFourPartDecimal = function(string) {
-			const match = string.match(/^(.+)\/(\d+)$/);
-			if (!ipaddr.IPv4.isValidCIDR(string) || !match) return false;
-			return ipaddr.IPv4.isValidFourPartDecimal(match[1]);
-		};
-		ipaddr.IPv4.networkAddressFromCIDR = function(string) {
-			let cidr, i, ipInterfaceOctets, octets, subnetMaskOctets;
-			try {
-				cidr = this.parseCIDR(string);
-				ipInterfaceOctets = cidr[0].toByteArray();
-				subnetMaskOctets = this.subnetMaskFromPrefixLength(cidr[1]).toByteArray();
-				octets = [];
-				i = 0;
-				while (i < 4) {
-					octets.push(parseInt(ipInterfaceOctets[i], 10) & parseInt(subnetMaskOctets[i], 10));
-					i++;
-				}
-				return new this(octets);
-			} catch (e) {
-				throw new Error("ipaddr: the address does not have IPv4 CIDR format");
-			}
-		};
-		ipaddr.IPv4.parse = function(string) {
-			const parts = this.parser(string);
-			if (parts === null) throw new Error("ipaddr: string is not formatted like an IPv4 Address");
-			return new this(parts);
-		};
-		ipaddr.IPv4.parseCIDR = function(string) {
-			let match;
-			if (match = string.match(/^(.+)\/(\d+)$/)) {
-				const maskLength = parseInt(match[2]);
-				if (maskLength >= 0 && maskLength <= 32) {
-					const parsed = [this.parse(match[1]), maskLength];
-					Object.defineProperty(parsed, "toString", { value: function() {
-						return this.join("/");
-					} });
-					return parsed;
-				}
-			}
-			throw new Error("ipaddr: string is not formatted like an IPv4 CIDR range");
-		};
-		ipaddr.IPv4.parser = function(string) {
-			let match, part, value;
-			if (match = string.match(ipv4Regexes.fourOctet)) return (function() {
-				const ref = match.slice(1, 6);
-				const results = [];
-				for (let i = 0; i < ref.length; i++) {
-					part = ref[i];
-					results.push(parseIntAuto(part));
-				}
-				return results;
-			})();
-			else if (match = string.match(ipv4Regexes.longValue)) {
-				value = parseIntAuto(match[1]);
-				if (value > 4294967295 || value < 0) throw new Error("ipaddr: address outside defined range");
-				return (function() {
-					const results = [];
-					let shift;
-					for (shift = 0; shift <= 24; shift += 8) results.push(value >> shift & 255);
-					return results;
-				})().reverse();
-			} else if (match = string.match(ipv4Regexes.twoOctet)) return (function() {
-				const ref = match.slice(1, 4);
-				const results = [];
-				value = parseIntAuto(ref[1]);
-				if (value > 16777215 || value < 0) throw new Error("ipaddr: address outside defined range");
-				results.push(parseIntAuto(ref[0]));
-				results.push(value >> 16 & 255);
-				results.push(value >> 8 & 255);
-				results.push(value & 255);
-				return results;
-			})();
-			else if (match = string.match(ipv4Regexes.threeOctet)) return (function() {
-				const ref = match.slice(1, 5);
-				const results = [];
-				value = parseIntAuto(ref[2]);
-				if (value > 65535 || value < 0) throw new Error("ipaddr: address outside defined range");
-				results.push(parseIntAuto(ref[0]));
-				results.push(parseIntAuto(ref[1]));
-				results.push(value >> 8 & 255);
-				results.push(value & 255);
-				return results;
-			})();
-			else return null;
-		};
-		ipaddr.IPv4.subnetMaskFromPrefixLength = function(prefix) {
-			prefix = parseInt(prefix);
-			if (prefix < 0 || prefix > 32) throw new Error("ipaddr: invalid IPv4 prefix length");
-			const octets = [
-				0,
-				0,
-				0,
-				0
-			];
-			let j = 0;
-			const filledOctetCount = Math.floor(prefix / 8);
-			while (j < filledOctetCount) {
-				octets[j] = 255;
-				j++;
+		return mutated ? parsed.toString() : value;
+	} catch {
+		return value;
+	}
+}
+function redactQueryString(value, depth) {
+	const params = new URLSearchParams(value);
+	const entries = Array.from(params.entries());
+	const redactedEntries = [];
+	const seenSensitiveKeys = /* @__PURE__ */ new Set();
+	let mutated = false;
+	for (const [key, entryValue] of entries) {
+		if (isSensitiveUrlQueryParamName$1(key)) {
+			mutated = true;
+			if (!seenSensitiveKeys.has(key)) {
+				seenSensitiveKeys.add(key);
+				redactedEntries.push([key, "***"]);
 			}
-			if (filledOctetCount < 4) octets[filledOctetCount] = Math.pow(2, prefix % 8) - 1 << 8 - prefix % 8;
-			return new this(octets);
+			continue;
+		}
+		const redactedKey = redactNestedUrlValue(key, depth + 1);
+		const redactedValue = redactNestedUrlValue(entryValue, depth + 1);
+		if (redactedKey !== key || redactedValue !== entryValue) mutated = true;
+		redactedEntries.push([redactedKey, redactedValue]);
+	}
+	if (!mutated) return value;
+	const redactedParams = new URLSearchParams();
+	for (const [key, entryValue] of redactedEntries) redactedParams.append(key, entryValue);
+	return redactedParams.toString();
+}
+function redactUrlLikeFallback(value) {
+	return redactSensitiveUrlPath(redactEmbeddedUrlUserInfo(value).replace(/([?&])([^=&]+)=([^&]*)/g, (match, prefix, key) => isSensitiveUrlQueryParamName$1(key) ? `${prefix}${key}=***` : match));
+}
+function redactAuthorityUserInfo(candidate, authorityStart) {
+	const authority = candidate.slice(authorityStart);
+	const userInfoEnd = authority.lastIndexOf("@");
+	if (userInfoEnd < 0) return candidate;
+	return `${candidate.slice(0, authorityStart)}***:***@${authority.slice(userInfoEnd + 1)}`;
+}
+function redactEmbeddedUrlUserInfo(value) {
+	return value.replace(SPECIAL_SCHEME_AUTHORITY_RE, (candidate) => {
+		let authorityStart = candidate.indexOf(":") + 1;
+		while (authorityStart < candidate.length && (candidate[authorityStart] === "/" || candidate[authorityStart] === "\\")) authorityStart += 1;
+		return redactAuthorityUserInfo(candidate, authorityStart);
+	}).replace(SPECIAL_SCHEME_SPILLED_USERINFO_RE, (candidate) => {
+		let authorityStart = candidate.indexOf(":") + 1;
+		while (authorityStart < candidate.length && (candidate[authorityStart] === "/" || candidate[authorityStart] === "\\")) authorityStart += 1;
+		const userInfoEnd = candidate.lastIndexOf("@");
+		const firstReservedDelimiter = candidate.slice(authorityStart).search(/[\\/?#]/u);
+		if (userInfoEnd < 0 || firstReservedDelimiter < 0) return candidate;
+		const absoluteReservedDelimiter = authorityStart + firstReservedDelimiter;
+		if (absoluteReservedDelimiter >= userInfoEnd) return candidate;
+		const credentialSeparator = candidate.indexOf(":", authorityStart);
+		if (credentialSeparator < 0 || credentialSeparator > absoluteReservedDelimiter) return candidate;
+		const authorityPrefix = candidate.slice(authorityStart, absoluteReservedDelimiter);
+		const possiblePort = candidate.slice(credentialSeparator + 1, absoluteReservedDelimiter);
+		if (/^\d+$/u.test(possiblePort) || /^\[[^\]]+\](?::\d+)?$/u.test(authorityPrefix)) return candidate;
+		return `${candidate.slice(0, authorityStart)}***:***@${candidate.slice(userInfoEnd + 1)}`;
+	}).replace(PROTOCOL_RELATIVE_AUTHORITY_RE, (candidate) => {
+		let authorityStart = 0;
+		while (authorityStart < candidate.length && (candidate[authorityStart] === "/" || candidate[authorityStart] === "\\")) authorityStart += 1;
+		return redactAuthorityUserInfo(candidate, authorityStart);
+	});
+}
+function hasUnresolvedEmbeddedUrlUserInfo(value) {
+	for (const match of value.matchAll(/(?:\b(?:https?|wss?|ftp):[\\/]{0,2}|[\\/]{2,})/giu)) {
+		const remainder = value.slice((match.index ?? 0) + match[0].length);
+		const userInfoEnd = remainder.search(/(?<!\*\*\*:\*\*\*)@/u);
+		const authorityEnd = remainder.search(/[\\/?#]/u);
+		const pathBeforeAt = remainder.slice(authorityEnd + 1, userInfoEnd);
+		if (userInfoEnd >= 0 && (authorityEnd < 0 || userInfoEnd <= authorityEnd || remainder[authorityEnd] === "/" && (pathBeforeAt.includes(":") || /^[^/?#\s]+\.[^/?#\s]+(?:[/?#]|$)/u.test(remainder.slice(userInfoEnd + 1))))) return true;
+	}
+	return false;
+}
+function redactRelativeUrlFragment(value, depth) {
+	const fragmentIndex = value.indexOf("#");
+	if (fragmentIndex < 0) return value;
+	const fragment = value.slice(fragmentIndex + 1);
+	const redactedFragment = redactFragment(fragment, depth + 1);
+	return redactedFragment === fragment ? value : `${value.slice(0, fragmentIndex + 1)}${redactedFragment}`;
+}
+function redactFragment(value, depth) {
+	if (!value) return value;
+	if (depth > MAX_NESTED_URL_REDACTION_DEPTH && looksLikeNestedUrlValue(value)) return "***";
+	const wholeUrl = redactSensitiveUrlAtDepth(value, depth);
+	if (wholeUrl.parsedWholeUrl) return redactUrlLikeFallback(wholeUrl.value);
+	const candidate = value;
+	const firstQueryDelimiter = candidate.search(/[?&]/u);
+	const firstEquals = candidate.indexOf("=");
+	if (firstEquals >= 0 && (firstQueryDelimiter < 0 || firstEquals < firstQueryDelimiter)) return redactQueryString(candidate, depth);
+	const hashRouterQueryIndex = candidate.indexOf("?");
+	if (hashRouterQueryIndex >= 0) {
+		const redactedQuery = redactQueryString(candidate.slice(hashRouterQueryIndex + 1), depth);
+		return `${redactEncodedUrlLikeString(redactUrlLikeFallback(candidate.slice(0, hashRouterQueryIndex + 1)), depth + 1)}${redactedQuery}`;
+	}
+	const fallback = redactUrlLikeFallback(candidate);
+	if (!looksLikeNestedUrlValue(fallback)) return fallback;
+	let decoded;
+	try {
+		decoded = decodeURIComponent(fallback);
+	} catch {
+		return "***";
+	}
+	if (decoded === fallback) return fallback;
+	const redactedDecoded = redactFragment(decoded, depth + 1);
+	return redactedDecoded === decoded ? fallback : encodeURIComponent(redactedDecoded);
+}
+function redactEncodedNestedUrlPath(value, depth) {
+	if (!looksLikeNestedUrlValue(value)) return value;
+	if (depth > MAX_NESTED_URL_REDACTION_DEPTH) return "***";
+	let decoded;
+	try {
+		decoded = decodeURIComponent(value);
+	} catch {
+		return "***";
+	}
+	if (decoded === value) return value;
+	const direct = redactSensitiveUrlLikeStringAtDepth(decoded, depth);
+	if (direct.value !== decoded || hasUnresolvedEmbeddedUrlUserInfo(decoded)) return direct.value !== decoded ? direct.value : "***";
+	if (direct.parsedWholeUrl) return value;
+	const nested = redactEncodedNestedUrlPath(decoded, depth + 1);
+	return nested === decoded ? value : nested;
+}
+function redactSensitiveUrlAtDepth(value, depth) {
+	try {
+		const directRedaction = redactDirectSensitiveUrl(value);
+		const parsed = new URL(directRedaction);
+		if (depth > MAX_NESTED_URL_REDACTION_DEPTH) return {
+			value: "***",
+			parsedWholeUrl: true
 		};
-		ipaddr.IPv6 = (function() {
-			function IPv6(parts, zoneId) {
-				let i, part;
-				if (parts.length === 16) {
-					this.parts = [];
-					for (i = 0; i <= 14; i += 2) this.parts.push(parts[i] << 8 | parts[i + 1]);
-				} else if (parts.length === 8) this.parts = parts;
-				else throw new Error("ipaddr: ipv6 part count should be 8 or 16");
-				for (i = 0; i < this.parts.length; i++) {
-					part = this.parts[i];
-					if (!(0 <= part && part <= 65535)) throw new Error("ipaddr: ipv6 part should fit in 16 bits");
-				}
-				if (zoneId) this.zoneId = zoneId;
-			}
-			IPv6.prototype.SpecialRanges = {
-				unspecified: [new IPv6([
-					0,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0
-				]), 128],
-				linkLocal: [new IPv6([
-					65152,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0
-				]), 10],
-				multicast: [new IPv6([
-					65280,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0
-				]), 8],
-				loopback: [new IPv6([
-					0,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0,
-					1
-				]), 128],
-				uniqueLocal: [new IPv6([
-					64512,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0
-				]), 7],
-				ipv4Mapped: [new IPv6([
-					0,
-					0,
-					0,
-					0,
-					0,
-					65535,
-					0,
-					0
-				]), 96],
-				deprecatedSiteLocal: [new IPv6([
-					65216,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0
-				]), 10],
-				discard: [new IPv6([
-					256,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0
-				]), 64],
-				rfc6145: [new IPv6([
-					0,
-					0,
-					0,
-					0,
-					65535,
-					0,
-					0,
-					0
-				]), 96],
-				rfc6052: [[new IPv6([
-					100,
-					65435,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0
-				]), 96], [new IPv6([
-					100,
-					65435,
-					1,
-					0,
-					0,
-					0,
-					0,
-					0
-				]), 48]],
-				"6to4": [new IPv6([
-					8194,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0
-				]), 16],
-				teredo: [new IPv6([
-					8193,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0
-				]), 32],
-				benchmarking: [new IPv6([
-					8193,
-					2,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0
-				]), 48],
-				amt: [new IPv6([
-					8193,
-					3,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0
-				]), 32],
-				as112v6: [[new IPv6([
-					8193,
-					4,
-					274,
-					0,
-					0,
-					0,
-					0,
-					0
-				]), 48], [new IPv6([
-					9760,
-					79,
-					32768,
-					0,
-					0,
-					0,
-					0,
-					0
-				]), 48]],
-				deprecatedOrchid: [new IPv6([
-					8193,
-					16,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0
-				]), 28],
-				orchid2: [new IPv6([
-					8193,
-					32,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0
-				]), 28],
-				droneRemoteIdProtocolEntityTags: [new IPv6([
-					8193,
-					48,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0
-				]), 28],
-				segmentRouting: [new IPv6([
-					24320,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0
-				]), 16],
-				reserved: [
-					[new IPv6([
-						8193,
-						0,
-						0,
-						0,
-						0,
-						0,
-						0,
-						0
-					]), 23],
-					[new IPv6([
-						8193,
-						3512,
-						0,
-						0,
-						0,
-						0,
-						0,
-						0
-					]), 32],
-					[new IPv6([
-						16383,
-						0,
-						0,
-						0,
-						0,
-						0,
-						0,
-						0
-					]), 20]
-				]
-			};
-			IPv6.prototype.isIPv4MappedAddress = function() {
-				return this.range() === "ipv4Mapped";
-			};
-			IPv6.prototype.kind = function() {
-				return "ipv6";
-			};
-			IPv6.prototype.match = function(other, cidrRange) {
-				let ref;
-				if (cidrRange === void 0) {
-					ref = other;
-					other = ref[0];
-					cidrRange = ref[1];
-				}
-				if (other.kind() !== "ipv6") throw new Error("ipaddr: cannot match ipv6 address with non-ipv6 one");
-				return matchCIDR(this.parts, other.parts, 16, cidrRange);
-			};
-			IPv6.prototype.prefixLengthFromSubnetMask = function() {
-				let cidr = 0;
-				let stop = false;
-				const zerotable = {
-					0: 16,
-					32768: 15,
-					49152: 14,
-					57344: 13,
-					61440: 12,
-					63488: 11,
-					64512: 10,
-					65024: 9,
-					65280: 8,
-					65408: 7,
-					65472: 6,
-					65504: 5,
-					65520: 4,
-					65528: 3,
-					65532: 2,
-					65534: 1,
-					65535: 0
-				};
-				let part, zeros;
-				for (let i = 7; i >= 0; i -= 1) {
-					part = this.parts[i];
-					if (part in zerotable) {
-						zeros = zerotable[part];
-						if (stop && zeros !== 0) return null;
-						if (zeros !== 16) stop = true;
-						cidr += zeros;
-					} else return null;
-				}
-				return 128 - cidr;
-			};
-			IPv6.prototype.range = function() {
-				return ipaddr.subnetMatch(this, this.SpecialRanges);
-			};
-			IPv6.prototype.toByteArray = function() {
-				let part;
-				const bytes = [];
-				const ref = this.parts;
-				for (let i = 0; i < ref.length; i++) {
-					part = ref[i];
-					bytes.push(part >> 8);
-					bytes.push(part & 255);
-				}
-				return bytes;
-			};
-			IPv6.prototype.toFixedLengthString = function() {
-				const addr = (function() {
-					const results = [];
-					for (let i = 0; i < this.parts.length; i++) results.push(padPart(this.parts[i].toString(16), 4));
-					return results;
-				}).call(this).join(":");
-				let suffix = "";
-				if (this.zoneId) suffix = `%${this.zoneId}`;
-				return addr + suffix;
-			};
-			IPv6.prototype.toIPv4Address = function() {
-				if (!this.isIPv4MappedAddress()) throw new Error("ipaddr: trying to convert a generic ipv6 address to ipv4");
-				const ref = this.parts.slice(-2);
-				const high = ref[0];
-				const low = ref[1];
-				return new ipaddr.IPv4([
-					high >> 8,
-					high & 255,
-					low >> 8,
-					low & 255
-				]);
-			};
-			IPv6.prototype.toNormalizedString = function() {
-				const addr = (function() {
-					const results = [];
-					for (let i = 0; i < this.parts.length; i++) results.push(this.parts[i].toString(16));
-					return results;
-				}).call(this).join(":");
-				let suffix = "";
-				if (this.zoneId) suffix = `%${this.zoneId}`;
-				return addr + suffix;
-			};
-			IPv6.prototype.toRFC5952String = function() {
-				const regex = /((^|:)(0(:|$)){2,})/g;
-				const string = this.toNormalizedString();
-				let bestMatchIndex = 0;
-				let bestMatchLength = -1;
-				let match;
-				while (match = regex.exec(string)) if (match[0].length > bestMatchLength) {
-					bestMatchIndex = match.index;
-					bestMatchLength = match[0].length;
-				}
-				if (bestMatchLength < 0) return string;
-				return `${string.substring(0, bestMatchIndex)}::${string.substring(bestMatchIndex + bestMatchLength)}`;
+		let mutated = directRedaction !== value;
+		const redactedNestedPath = redactEmbeddedUrlUserInfo(redactEncodedNestedUrlPath(parsed.pathname, depth + 1));
+		if (redactedNestedPath !== parsed.pathname) {
+			const originalPath = parsed.pathname;
+			parsed.pathname = redactedNestedPath;
+			if (parsed.pathname === originalPath) return {
+				value: directRedaction,
+				parsedWholeUrl: false
 			};
-			IPv6.prototype.toString = function() {
-				return this.toRFC5952String();
-			};
-			return IPv6;
-		})();
-		ipaddr.IPv6.broadcastAddressFromCIDR = function(string) {
-			try {
-				const cidr = this.parseCIDR(string);
-				const ipInterfaceOctets = cidr[0].toByteArray();
-				const subnetMaskOctets = this.subnetMaskFromPrefixLength(cidr[1]).toByteArray();
-				const octets = [];
-				let i = 0;
-				while (i < 16) {
-					octets.push(parseInt(ipInterfaceOctets[i], 10) | parseInt(subnetMaskOctets[i], 10) ^ 255);
-					i++;
-				}
-				return new this(octets);
-			} catch (e) {
-				throw new Error(`ipaddr: the address does not have IPv6 CIDR format (${e})`);
-			}
-		};
-		ipaddr.IPv6.isIPv6 = function(string) {
-			return this.parser(string) !== null;
-		};
-		ipaddr.IPv6.isValid = function(string) {
-			if (typeof string === "string" && string.indexOf(":") === -1) return false;
-			try {
-				const addr = this.parser(string);
-				new this(addr.parts, addr.zoneId);
-				return true;
-			} catch (e) {
-				return false;
-			}
-		};
-		ipaddr.IPv6.isValidCIDR = function(string) {
-			if (typeof string === "string" && string.indexOf(":") === -1) return false;
-			try {
-				this.parseCIDR(string);
-				return true;
-			} catch (e) {
-				return false;
-			}
-		};
-		ipaddr.IPv6.networkAddressFromCIDR = function(string) {
-			let cidr, i, ipInterfaceOctets, octets, subnetMaskOctets;
-			try {
-				cidr = this.parseCIDR(string);
-				ipInterfaceOctets = cidr[0].toByteArray();
-				subnetMaskOctets = this.subnetMaskFromPrefixLength(cidr[1]).toByteArray();
-				octets = [];
-				i = 0;
-				while (i < 16) {
-					octets.push(parseInt(ipInterfaceOctets[i], 10) & parseInt(subnetMaskOctets[i], 10));
-					i++;
-				}
-				return new this(octets);
-			} catch (e) {
-				throw new Error(`ipaddr: the address does not have IPv6 CIDR format (${e})`);
-			}
-		};
-		ipaddr.IPv6.parse = function(string) {
-			const addr = this.parser(string);
-			if (addr.parts === null) throw new Error("ipaddr: string is not formatted like an IPv6 Address");
-			return new this(addr.parts, addr.zoneId);
-		};
-		ipaddr.IPv6.parseCIDR = function(string) {
-			let maskLength, match, parsed;
-			if (match = string.match(/^(.+)\/(\d+)$/)) {
-				maskLength = parseInt(match[2]);
-				if (maskLength >= 0 && maskLength <= 128) {
-					parsed = [this.parse(match[1]), maskLength];
-					Object.defineProperty(parsed, "toString", { value: function() {
-						return this.join("/");
-					} });
-					return parsed;
-				}
-			}
-			throw new Error("ipaddr: string is not formatted like an IPv6 CIDR range");
-		};
-		ipaddr.IPv6.parser = function(string) {
-			let addr, i, match, octet, octets, zoneId;
-			if (match = string.match(ipv6Regexes.deprecatedTransitional)) return this.parser(`::ffff:${match[1]}`);
-			if (ipv6Regexes.native.test(string)) return expandIPv6(string, 8);
-			if (match = string.match(ipv6Regexes.transitional)) {
-				zoneId = match[6] || "";
-				addr = match[1];
-				if (!match[1].endsWith("::")) addr = addr.slice(0, -1);
-				addr = expandIPv6(addr + zoneId, 6);
-				if (addr.parts) {
-					octets = [
-						parseInt(match[2]),
-						parseInt(match[3]),
-						parseInt(match[4]),
-						parseInt(match[5])
-					];
-					for (i = 0; i < octets.length; i++) {
-						octet = octets[i];
-						if (!(0 <= octet && octet <= 255)) return null;
-					}
-					addr.parts.push(octets[0] << 8 | octets[1]);
-					addr.parts.push(octets[2] << 8 | octets[3]);
-					return {
-						parts: addr.parts,
-						zoneId: addr.zoneId
-					};
-				}
-			}
-			return null;
-		};
-		ipaddr.IPv6.subnetMaskFromPrefixLength = function(prefix) {
-			prefix = parseInt(prefix);
-			if (prefix < 0 || prefix > 128) throw new Error("ipaddr: invalid IPv6 prefix length");
-			const octets = [
-				0,
-				0,
-				0,
-				0,
-				0,
-				0,
-				0,
-				0,
-				0,
-				0,
-				0,
-				0,
-				0,
-				0,
-				0,
-				0
-			];
-			let j = 0;
-			const filledOctetCount = Math.floor(prefix / 8);
-			while (j < filledOctetCount) {
-				octets[j] = 255;
-				j++;
-			}
-			if (filledOctetCount < 16) octets[filledOctetCount] = Math.pow(2, prefix % 8) - 1 << 8 - prefix % 8;
-			return new this(octets);
-		};
-		ipaddr.fromByteArray = function(bytes) {
-			const length = bytes.length;
-			if (length === 4) return new ipaddr.IPv4(bytes);
-			else if (length === 16) return new ipaddr.IPv6(bytes);
-			else throw new Error("ipaddr: the binary input is neither an IPv6 nor IPv4 address");
-		};
-		ipaddr.isValid = function(string) {
-			return ipaddr.IPv6.isValid(string) || ipaddr.IPv4.isValid(string);
-		};
-		ipaddr.isValidCIDR = function(string) {
-			return ipaddr.IPv6.isValidCIDR(string) || ipaddr.IPv4.isValidCIDR(string);
-		};
-		ipaddr.parse = function(string) {
-			if (ipaddr.IPv6.isValid(string)) return ipaddr.IPv6.parse(string);
-			else if (ipaddr.IPv4.isValid(string)) return ipaddr.IPv4.parse(string);
-			else throw new Error("ipaddr: the address has neither IPv6 nor IPv4 format");
-		};
-		ipaddr.parseCIDR = function(string) {
-			try {
-				return ipaddr.IPv6.parseCIDR(string);
-			} catch (e) {
-				try {
-					return ipaddr.IPv4.parseCIDR(string);
-				} catch (e2) {
-					throw new Error("ipaddr: the address has neither IPv6 nor IPv4 CIDR format");
-				}
-			}
-		};
-		ipaddr.process = function(string) {
-			const addr = this.parse(string);
-			if (addr.kind() === "ipv6" && addr.isIPv4MappedAddress()) return addr.toIPv4Address();
-			else return addr;
+			mutated = true;
+		}
+		const redactedQuery = redactQueryString(parsed.search.slice(1), depth);
+		if (redactedQuery !== parsed.search.slice(1)) {
+			parsed.search = redactedQuery;
+			mutated = true;
+		}
+		const fragment = parsed.hash.slice(1);
+		const redactedHash = redactFragment(fragment, depth + 1);
+		if (redactedHash !== fragment) {
+			parsed.hash = redactedHash;
+			mutated = true;
+		}
+		return {
+			value: mutated ? parsed.toString() : value,
+			parsedWholeUrl: true
 		};
-		ipaddr.subnetMatch = function(address, rangeList, defaultName) {
-			let i, rangeName, rangeSubnets, subnet;
-			if (defaultName === void 0 || defaultName === null) defaultName = "unicast";
-			for (rangeName in rangeList) if (Object.prototype.hasOwnProperty.call(rangeList, rangeName)) {
-				rangeSubnets = rangeList[rangeName];
-				if (rangeSubnets[0] && !(rangeSubnets[0] instanceof Array)) rangeSubnets = [rangeSubnets];
-				for (i = 0; i < rangeSubnets.length; i++) {
-					subnet = rangeSubnets[i];
-					if (address.kind() === subnet[0].kind() && address.match.apply(address, subnet)) return rangeName;
-				}
-			}
-			return defaultName;
+	} catch {
+		return {
+			value,
+			parsedWholeUrl: false
 		};
-		if (typeof module !== "undefined" && module.exports) module.exports = ipaddr;
-		else root.ipaddr = ipaddr;
-	})(exports);
-})))(), 1);
-function normalizeOptionalString(value) {
-	if (typeof value !== "string") return;
-	return value.trim() || void 0;
+	}
 }
-function normalizeLowercaseStringOrEmpty$1(value) {
-	return typeof value === "string" ? value.trim().toLowerCase() : "";
+function redactSensitiveUrlLikeStringAtDepth(value, depth) {
+	const redactedUrl = redactSensitiveUrlAtDepth(value, depth);
+	if (redactedUrl.parsedWholeUrl) return redactedUrl;
+	return {
+		value: redactEncodedUrlLikeString(redactRelativeUrlFragment(redactUrlLikeFallback(redactedUrl.value), depth), depth + 1),
+		parsedWholeUrl: false
+	};
+}
+function redactEncodedUrlLikeString(value, depth) {
+	if (!looksLikeNestedUrlValue(value)) return value;
+	if (depth > MAX_NESTED_URL_REDACTION_DEPTH) return "***";
+	let decoded;
+	try {
+		decoded = decodeURIComponent(value);
+	} catch {
+		return "***";
+	}
+	if (decoded === value) return value;
+	const redactedDecoded = redactSensitiveUrlLikeStringAtDepth(decoded, depth + 1);
+	if (redactedDecoded.value !== decoded || redactedDecoded.parsedWholeUrl) return redactedDecoded.value === decoded ? value : redactedDecoded.value;
+	return hasUnresolvedEmbeddedUrlUserInfo(decoded) ? "***" : value;
+}
+function redactNestedUrlValue(value, depth) {
+	if (!looksLikeNestedUrlValue(value)) return value;
+	if (depth > MAX_NESTED_URL_REDACTION_DEPTH) return "***";
+	const direct = redactSensitiveUrlLikeStringAtDepth(value, depth);
+	if (direct.value !== value) return direct.value;
+	if (hasUnresolvedEmbeddedUrlUserInfo(value)) return "***";
+	if (direct.parsedWholeUrl) return value;
+	let decoded;
+	try {
+		decoded = decodeURIComponent(value);
+	} catch {
+		return "***";
+	}
+	if (decoded === value || !looksLikeNestedUrlValue(decoded)) return value;
+	const redactedDecoded = redactNestedUrlValue(decoded, depth + 1);
+	return redactedDecoded === decoded ? value : encodeURIComponent(redactedDecoded);
+}
+/** Redacts sensitive URL-looking substrings even when the full value is not a valid URL. */
+function redactSensitiveUrlLikeString(value) {
+	return redactSensitiveUrlLikeStringAtDepth(value, 0).value;
 }
-import_ipaddr.default.IPv4.parse("198.18.0.0");
+ipaddr.IPv4.parse("198.18.0.0");
 function stripIpv6Brackets(value) {
 	if (value.startsWith("[") && value.endsWith("]")) return value.slice(1, -1);
 	return value;
@@ -1020,13 +361,13 @@ function normalizeIpParseInput(raw) {
 function parseCanonicalIpAddress(raw) {
 	const normalized = normalizeIpParseInput(raw);
 	if (!normalized) return;
-	return import_ipaddr.default.IPv4.isValidFourPartDecimal(normalized) || import_ipaddr.default.IPv6.isValid(normalized) ? import_ipaddr.default.parse(normalized) : void 0;
+	return ipaddr.IPv4.isValidFourPartDecimal(normalized) || ipaddr.IPv6.isValid(normalized) ? ipaddr.parse(normalized) : void 0;
 }
 /** Normalizes canonical IP literals and maps IPv4-mapped IPv6 addresses to IPv4 text. */
 function normalizeIpAddress(raw) {
 	const parsed = parseCanonicalIpAddress(raw);
 	if (!parsed) return;
-	return normalizeLowercaseStringOrEmpty$1(normalizeIpv4MappedAddress(parsed).toString());
+	return normalizeLowercaseStringOrEmpty(normalizeIpv4MappedAddress(parsed).toString());
 }
 /** True when a canonical IP literal is loopback, including IPv4-mapped IPv6. */
 function isLoopbackIpAddress(raw) {
@@ -1035,28 +376,19 @@ function isLoopbackIpAddress(raw) {
 	return normalizeIpv4MappedAddress(parsed).range() === "loopback";
 }
 //#endregion
-//#region packages/net-policy/src/url-protocol.ts
-function parseUrl(value) {
-	if (value instanceof URL) return value;
-	try {
-		return new URL(value);
-	} catch {
-		return null;
-	}
-}
-function isWssUrl(value) {
-	return parseUrl(value)?.protocol === "wss:";
-}
-//#endregion
 //#region packages/gateway-client/src/client-address-utils.ts
-function normalizeLowercaseStringOrEmpty(value) {
+function normalizeGatewayErrorText(value) {
 	return typeof value === "string" ? value.trim().toLowerCase() : "";
 }
 function isSensitiveUrlQueryParamName(key) {
 	return /(?:token|password|secret|key|auth|credential)/iu.test(key);
 }
-function normalizeFingerprint(fingerprint) {
-	return (fingerprint ?? "").replaceAll(":", "").trim().toLowerCase();
+const SHA256_HEX_FINGERPRINT = /^[a-fA-F0-9]{64}$/u;
+const SHA256_COLON_FINGERPRINT = /^(?:[a-fA-F0-9]{2}:){31}[a-fA-F0-9]{2}$/u;
+function normalizeTlsFingerprint(fingerprint) {
+	const value = (fingerprint ?? "").trim().replace(/^sha256:/iu, "");
+	if (SHA256_HEX_FINGERPRINT.test(value)) return value.toLowerCase();
+	return SHA256_COLON_FINGERPRINT.test(value) ? value.replaceAll(":", "").toLowerCase() : "";
 }
 function parseHostForAddressChecks(host) {
 	if (!host) return null;
@@ -1076,34 +408,34 @@ function parseGatewayIpAddress(host) {
 	return normalized ? parseCanonicalIpAddress(normalized) : void 0;
 }
 //#endregion
-//#region packages/gateway-client/src/websocket-data.ts
-function rawDataToString(data) {
-	if (Array.isArray(data)) return Buffer$1.concat(data).toString("utf8");
-	return data instanceof ArrayBuffer ? Buffer$1.from(data).toString("utf8") : data.toString("utf8");
-}
-//#endregion
-//#region packages/gateway-client/src/client.ts
-const DEFAULT_HOST_DEPS = {
-	loadOrCreateDeviceIdentity: () => void 0,
-	signDevicePayload: () => {
-		throw new Error("GatewayClient device signature dependency is not configured");
-	},
-	publicKeyRawBase64UrlFromPem: () => {
-		throw new Error("GatewayClient public key dependency is not configured");
-	},
-	loadDeviceAuthToken: () => null,
-	storeDeviceAuthToken: () => {},
-	clearDeviceAuthToken: () => {},
-	beforeConnect: () => {},
-	registerGatewayLoopbackBypass: () => void 0,
-	logDebug: () => {},
-	logError: () => {},
-	redactForLog: (message) => message,
-	normalizeTlsFingerprint: normalizeFingerprint
+//#region packages/gateway-client/src/request-error.ts
+var GatewayClientRequestError = class extends GatewayProtocolRequestError {
+	constructor(error) {
+		super({
+			...error,
+			message: formatConnectErrorMessage({
+				message: error.message,
+				details: error.details
+			})
+		});
+		this.name = "GatewayClientRequestError";
+	}
 };
-function resolveHostDeps(overrides) {
-	return Object.fromEntries(Object.entries(DEFAULT_HOST_DEPS).map(([key, fallback]) => [key, overrides?.[key] ?? fallback]));
+//#endregion
+//#region packages/net-policy/src/url-protocol.ts
+function parseUrl(value) {
+	if (value instanceof URL) return value;
+	try {
+		return new URL(value);
+	} catch {
+		return null;
+	}
 }
+function isWssUrl(value) {
+	return parseUrl(value)?.protocol === "wss:";
+}
+//#endregion
+//#region packages/gateway-client/src/websocket-transport.ts
 const PRIVATE_OR_LOOPBACK_IPV4_RANGES = /* @__PURE__ */ new Set([
 	"loopback",
 	"private",
@@ -1119,19 +451,16 @@ const PRIVATE_OR_LOOPBACK_IPV6_RANGES = /* @__PURE__ */ new Set([
 function isPrivateOrLoopbackIpAddress(address) {
 	return (address.kind() === "ipv4" ? PRIVATE_OR_LOOPBACK_IPV4_RANGES : PRIVATE_OR_LOOPBACK_IPV6_RANGES).has(address.range());
 }
-function isLoopbackHost(host) {
+function isGatewayLoopbackHost(host) {
 	const parsed = parseHostForAddressChecks(host);
-	if (!parsed) return false;
-	if (parsed.isLocalhost) return true;
-	return isLoopbackIpAddress(parsed.unbracketedHost);
+	return Boolean(parsed && (parsed.isLocalhost || isLoopbackIpAddress(parsed.unbracketedHost)));
 }
 function isPrivateOrLoopbackHost(host) {
 	const parsed = parseHostForAddressChecks(host);
 	if (!parsed) return false;
 	if (parsed.isLocalhost) return true;
 	const address = parseGatewayIpAddress(parsed.unbracketedHost);
-	if (!address) return false;
-	return isPrivateOrLoopbackIpAddress(address);
+	return Boolean(address && isPrivateOrLoopbackIpAddress(address));
 }
 function isTrustedPlaintextWebSocketHost(hostname) {
 	if (isPrivateOrLoopbackHost(hostname)) return true;
@@ -1144,7 +473,7 @@ function isSecureWebSocketUrl(rawUrl, options) {
 		const protocol = url.protocol === "https:" ? "wss:" : url.protocol === "http:" ? "ws:" : url.protocol;
 		if (protocol === "wss:") return true;
 		if (protocol !== "ws:") return false;
-		if (isLoopbackHost(url.hostname) || isTrustedPlaintextWebSocketHost(url.hostname)) return true;
+		if (isGatewayLoopbackHost(url.hostname) || isTrustedPlaintextWebSocketHost(url.hostname)) return true;
 		if (options?.allowPrivateWs === true) {
 			const hostForIpCheck = url.hostname.startsWith("[") && url.hostname.endsWith("]") ? url.hostname.slice(1, -1) : url.hostname;
 			return isPrivateOrLoopbackHost(url.hostname) || parseGatewayIpAddress(hostForIpCheck) === void 0;
@@ -1154,37 +483,119 @@ function isSecureWebSocketUrl(rawUrl, options) {
 		return false;
 	}
 }
-const DEFAULT_GATEWAY_CLIENT_URL = "ws://127.0.0.1:18789";
-const DEFAULT_CLIENT_VERSION = "0.0.0";
-var GatewayClientRequestError = class extends GatewayProtocolRequestError {
-	constructor(error) {
-		super({
-			...error,
-			message: formatConnectErrorMessage({
-				message: error.message,
-				details: error.details
-			})
-		});
-		this.name = "GatewayClientRequestError";
+var GatewayWebSocketTransportConfigurationError = class extends Error {};
+function resolveGatewayWebSocketTransport(params) {
+	const usesTls = isWssUrl(params.url);
+	if (params.tlsFingerprint && !usesTls) throw new GatewayWebSocketTransportConfigurationError("gateway tls fingerprint requires wss:// gateway url");
+	const allowPrivateWs = (params.env ?? process.env).OPENCLAW_ALLOW_INSECURE_PRIVATE_WS === "1";
+	if (!isSecureWebSocketUrl(params.url, { allowPrivateWs })) {
+		let displayHost = params.url;
+		try {
+			displayHost = new URL(params.url).hostname || params.url;
+		} catch {}
+		throw new GatewayWebSocketTransportConfigurationError(`SECURITY ERROR: Cannot connect to "${displayHost}" over plaintext ws://. Both credentials and chat data would be exposed to network interception. Use wss:// for remote URLs. Safe defaults: keep gateway.bind=loopback and connect via SSH tunnel (ssh -N -L 18789:127.0.0.1:18789 user@gateway-host), or use Tailscale Serve/Funnel. ` + (allowPrivateWs ? "" : "Break-glass (trusted private networks only): set OPENCLAW_ALLOW_INSECURE_PRIVATE_WS=1. ") + "Run `openclaw doctor --fix` for guidance.");
 	}
+	const normalize = params.normalizeTlsFingerprint ?? normalizeTlsFingerprint;
+	const expectedFingerprint = params.tlsFingerprint ? normalizeTlsFingerprint(params.tlsFingerprint) : void 0;
+	if (params.tlsFingerprint && !expectedFingerprint) throw new GatewayWebSocketTransportConfigurationError("gateway tls fingerprint must be a SHA-256 fingerprint");
+	const options = { ...params.options };
+	if (usesTls && expectedFingerprint) {
+		options.rejectUnauthorized = false;
+		options.checkServerIdentity = (_hostValue, cert) => {
+			const fingerprintValue = typeof cert === "object" && cert && "fingerprint256" in cert ? cert.fingerprint256 ?? "" : "";
+			const canonicalFingerprint = normalizeTlsFingerprint(typeof fingerprintValue === "string" ? fingerprintValue : "");
+			const fingerprint = canonicalFingerprint ? normalize(canonicalFingerprint) : "";
+			const expected = normalize(expectedFingerprint);
+			if (!fingerprint) return /* @__PURE__ */ new Error("Missing server TLS fingerprint");
+			if (fingerprint !== expected) return /* @__PURE__ */ new Error("Server TLS fingerprint mismatch");
+		};
+	}
+	return {
+		options,
+		validateSocket: (socket) => {
+			if (!params.tlsFingerprint) return null;
+			const expected = expectedFingerprint ? normalize(expectedFingerprint) : "";
+			if (!expected) return /* @__PURE__ */ new Error("gateway tls fingerprint missing");
+			const rawSocket = socket["_socket"];
+			if (!rawSocket || typeof rawSocket.getPeerCertificate !== "function") return /* @__PURE__ */ new Error("gateway tls fingerprint unavailable");
+			const canonicalFingerprint = normalizeTlsFingerprint(rawSocket.getPeerCertificate()?.fingerprint256 ?? "");
+			const fingerprint = canonicalFingerprint ? normalize(canonicalFingerprint) : "";
+			if (!fingerprint) return /* @__PURE__ */ new Error("gateway tls fingerprint unavailable");
+			return fingerprint === expected ? null : /* @__PURE__ */ new Error("gateway tls fingerprint mismatch");
+		}
+	};
+}
+//#endregion
+//#region packages/gateway-client/src/client.ts
+const DEFAULT_HOST_DEPS = {
+	loadOrCreateDeviceIdentity: () => void 0,
+	signDevicePayload: () => {
+		throw new Error("GatewayClient device signature dependency is not configured");
+	},
+	publicKeyRawBase64UrlFromPem: () => {
+		throw new Error("GatewayClient public key dependency is not configured");
+	},
+	loadDeviceAuthToken: () => null,
+	storeDeviceAuthToken: () => {},
+	clearDeviceAuthToken: () => {},
+	beforeConnect: () => {},
+	registerGatewayLoopbackBypass: () => void 0,
+	logDebug: () => {},
+	logError: () => {},
+	redactForLog: (message) => message,
+	normalizeTlsFingerprint
 };
-var GatewayClientRequestTimeoutError = class extends Error {
+function resolveHostDeps(overrides) {
+	return Object.fromEntries(Object.entries(DEFAULT_HOST_DEPS).map(([key, fallback]) => [key, overrides?.[key] ?? fallback]));
+}
+const DEFAULT_GATEWAY_CLIENT_URL = "ws://127.0.0.1:18789";
+const DEFAULT_CLIENT_VERSION = "0.0.0";
+const MAX_UPGRADE_ERROR_BODY_BYTES = 2 * 1024;
+const UPGRADE_ERROR_BODY_TIMEOUT_MS = 1e3;
+async function readUpgradeErrorBody(response) {
+	return await new Promise((resolve) => {
+		const chunks = [];
+		let totalBytes = 0;
+		let settled = false;
+		const finish = () => {
+			if (settled) return;
+			settled = true;
+			clearTimeout(timer);
+			response.off("data", onData);
+			response.off("end", finish);
+			response.off("error", finish);
+			response.off("aborted", finish);
+			resolve(Buffer.concat(chunks, totalBytes).toString("utf8").replace(/\s+/gu, " ").trim());
+		};
+		const stop = () => {
+			finish();
+			response.destroy();
+		};
+		const onData = (chunk) => {
+			const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+			const remaining = MAX_UPGRADE_ERROR_BODY_BYTES - totalBytes;
+			if (remaining > 0) {
+				const prefix = buffer.subarray(0, remaining);
+				chunks.push(prefix);
+				totalBytes += prefix.byteLength;
+			}
+			if (buffer.byteLength >= remaining) stop();
+		};
+		const timer = setTimeout(stop, UPGRADE_ERROR_BODY_TIMEOUT_MS);
+		timer.unref?.();
+		response.on("data", onData);
+		response.once("end", finish);
+		response.once("error", finish);
+		response.once("aborted", finish);
+	});
+}
+var GatewayClientRequestTimeoutError = class extends GatewayProtocolRequestTimeoutError {
 	constructor(params) {
-		super(`gateway request timeout for ${params.method}`);
+		super(params, `gateway request timeout for ${params.method}`);
 		this.name = "GatewayClientRequestTimeoutError";
-		this.method = params.method;
-		this.timeoutMs = params.timeoutMs;
-		this.requestSent = params.requestSent;
-	}
-};
-var GatewayClientTransientPreHelloCloseError = class extends Error {
-	constructor() {
-		super("gateway transient pre-hello clean close");
-		this.name = "GatewayClientTransientPreHelloCloseError";
 	}
 };
-var GatewayClientSocketFactoryConfigurationError = class extends Error {};
-var GatewayClientTransportPolicyError = class extends GatewayClientSocketFactoryConfigurationError {};
+var GatewayClientTransportPolicyError = class extends GatewayWebSocketTransportConfigurationError {};
 const GATEWAY_CONNECT_ASSEMBLY_ERROR = Symbol("gateway.connectAssemblyError");
 function markGatewayConnectAssemblyError(error) {
 	Object.defineProperty(error, GATEWAY_CONNECT_ASSEMBLY_ERROR, {
@@ -1206,10 +617,20 @@ function formatGatewayClientErrorForLog(err) {
 const FORCE_STOP_TERMINATE_GRACE_MS = 250;
 const STOP_AND_WAIT_TIMEOUT_MS = 1e3;
 const MAX_SUPPRESSED_TRANSIENT_PRE_HELLO_CLEAN_CLOSES = 1;
+function resolveLegacyNodePlatform(platform) {
+	switch (platform) {
+		case "macos": return "darwin";
+		case "windows": return "win32";
+		default: return;
+	}
+}
 var GatewayClient = class {
 	constructor(opts) {
 		this.ws = null;
 		this.stopped = false;
+		this.useLegacyNodeProtocolEnvelope = false;
+		this.nodeProtocolTransitionPending = false;
+		this.suppressNextHelloCallback = false;
 		this.pendingDeviceTokenRetry = false;
 		this.deviceTokenRetryBudgetUsed = false;
 		this.approvalRuntimeTokenCompatibilityDisabled = false;
@@ -1225,7 +646,7 @@ var GatewayClient = class {
 			...opts,
 			deviceIdentity: opts.deviceIdentity === null ? void 0 : opts.deviceIdentity ?? this.deps.loadOrCreateDeviceIdentity()
 		};
-		this.requestTimeoutMs = typeof opts.requestTimeoutMs === "number" && Number.isFinite(opts.requestTimeoutMs) ? resolveSafeTimeoutDelayMs(opts.requestTimeoutMs, { minMs: 0 }) : DEFAULT_GATEWAY_REQUEST_TIMEOUT_MS;
+		this.requestTimeoutMs = typeof opts.requestTimeoutMs === "number" && Number.isFinite(opts.requestTimeoutMs) ? opts.requestTimeoutMs : DEFAULT_GATEWAY_REQUEST_TIMEOUT_MS;
 		const connectChallengeTimeoutMs = resolveConnectChallengeTimeoutMs(this.opts.connectChallengeTimeoutMs, {
 			env: this.opts.env,
 			configuredTimeoutMs: this.opts.preauthHandshakeTimeoutMs
@@ -1264,7 +685,13 @@ var GatewayClient = class {
 				};
 			},
 			onConnectHello: (hello, context) => this.handleConnectHello(hello, context.plan),
-			onHello: (hello) => this.opts.onHelloOk?.(hello),
+			onHello: (hello) => {
+				if (this.suppressNextHelloCallback) {
+					this.suppressNextHelloCallback = false;
+					return;
+				}
+				this.opts.onHelloOk?.(hello);
+			},
 			onConnectFailure: (error, context) => this.handleConnectRequestFailure(error, context.plan),
 			resolveClose: (context) => this.resolveClose(context),
 			onClose: (context, decision) => {
@@ -1294,7 +721,7 @@ var GatewayClient = class {
 				maxMs: 3e4
 			},
 			requestTimeoutMs: this.requestTimeoutMs,
-			shouldRetrySocketFactoryError: (error) => !(error instanceof GatewayClientSocketFactoryConfigurationError) && !(error instanceof SyntaxError) && !(error instanceof TypeError) && !(error instanceof RangeError),
+			shouldRetrySocketFactoryError: (error) => !(error instanceof GatewayWebSocketTransportConfigurationError) && !(error instanceof SyntaxError) && !(error instanceof TypeError) && !(error instanceof RangeError),
 			rethrowSocketFactoryError: (error) => error instanceof GatewayClientTransportPolicyError
 		});
 	}
@@ -1310,7 +737,9 @@ var GatewayClient = class {
 		this.opts = {
 			...this.opts,
 			caps: [...manifest.caps],
-			commands: [...manifest.commands]
+			commands: [...manifest.commands],
+			computerUse: manifest.computerUse === void 0 ? void 0 : structuredClone(manifest.computerUse),
+			workerRuns: manifest.workerRuns ? structuredClone(manifest.workerRuns) : void 0
 		};
 		if (!this.stopped) this.protocol.closeSocket(1012, "node manifest changed");
 	}
@@ -1320,36 +749,29 @@ var GatewayClient = class {
 	}
 	createSocket(handlers) {
 		const url = this.opts.url ?? DEFAULT_GATEWAY_CLIENT_URL;
-		const usesTls = isWssUrl(url);
-		if (this.opts.tlsFingerprint && !usesTls) throw new GatewayClientSocketFactoryConfigurationError("gateway tls fingerprint requires wss:// gateway url");
-		const allowPrivateWs = (this.opts.env ?? process.env).OPENCLAW_ALLOW_INSECURE_PRIVATE_WS === "1";
-		if (!isSecureWebSocketUrl(url, { allowPrivateWs })) {
-			let displayHost = url;
-			try {
-				displayHost = new URL(url).hostname || url;
-			} catch {}
-			throw new GatewayClientSocketFactoryConfigurationError(`SECURITY ERROR: Cannot connect to "${displayHost}" over plaintext ws://. Both credentials and chat data would be exposed to network interception. Use wss:// for remote URLs. Safe defaults: keep gateway.bind=loopback and connect via SSH tunnel (ssh -N -L 18789:127.0.0.1:18789 user@gateway-host), or use Tailscale Serve/Funnel. ` + (allowPrivateWs ? "" : "Break-glass (trusted private networks only): set OPENCLAW_ALLOW_INSECURE_PRIVATE_WS=1. ") + "Run `openclaw doctor --fix` for guidance.");
-		}
+		const configuredEdgeAuthHeaders = this.opts.edgeAuthHeaders;
+		const edgeAuthHeaders = configuredEdgeAuthHeaders && Object.keys(configuredEdgeAuthHeaders).length > 0 ? configuredEdgeAuthHeaders : void 0;
+		if (edgeAuthHeaders && new URL(url).protocol !== "wss:") throw new GatewayWebSocketTransportConfigurationError("edge auth headers require a wss:// Gateway URL");
+		const handshakeTimeoutMs = resolvePreauthHandshakeTimeoutMs({
+			env: this.opts.env,
+			configuredTimeoutMs: this.opts.preauthHandshakeTimeoutMs
+		});
+		const transport = resolveGatewayWebSocketTransport({
+			url,
+			tlsFingerprint: this.opts.tlsFingerprint,
+			env: this.opts.env,
+			normalizeTlsFingerprint: this.deps.normalizeTlsFingerprint,
+			options: {
+				maxPayload: 25 * 1024 * 1024,
+				handshakeTimeout: handshakeTimeoutMs,
+				...this.opts.origin ? { origin: this.opts.origin } : {},
+				...edgeAuthHeaders ? {
+					followRedirects: false,
+					headers: edgeAuthHeaders
+				} : {}
+			}
+		});
 		this.deps.beforeConnect();
-		const wsOptions = {
-			maxPayload: 25 * 1024 * 1024,
-			handshakeTimeout: resolvePreauthHandshakeTimeoutMs({
-				env: this.opts.env,
-				configuredTimeoutMs: this.opts.preauthHandshakeTimeoutMs
-			}),
-			...this.opts.origin ? { origin: this.opts.origin } : {}
-		};
-		if (usesTls && this.opts.tlsFingerprint) {
-			wsOptions.rejectUnauthorized = false;
-			wsOptions.checkServerIdentity = (_hostValue, cert) => {
-				const fingerprintValue = typeof cert === "object" && cert && "fingerprint256" in cert ? cert.fingerprint256 ?? "" : "";
-				const fingerprint = this.deps.normalizeTlsFingerprint(typeof fingerprintValue === "string" ? fingerprintValue : "");
-				const expected = this.deps.normalizeTlsFingerprint(this.opts.tlsFingerprint ?? "");
-				if (!expected) return;
-				if (!fingerprint) return /* @__PURE__ */ new Error("Missing server TLS fingerprint");
-				if (fingerprint !== expected) return /* @__PURE__ */ new Error("Server TLS fingerprint mismatch");
-			};
-		}
 		let ws;
 		let unregisterGatewayLoopbackBypass;
 		try {
@@ -1358,7 +780,7 @@ var GatewayClient = class {
 			throw new GatewayClientTransportPolicyError(error instanceof Error ? error.message : String(error));
 		}
 		try {
-			ws = new WebSocket(url, wsOptions);
+			ws = new WebSocket(url, transport.options);
 			ws.binaryType = "nodebuffer";
 		} catch (error) {
 			throw error instanceof Error ? error : new Error(String(error));
@@ -1367,15 +789,14 @@ var GatewayClient = class {
 		}
 		this.ws = ws;
 		this.transportValidated = false;
+		let upgradeError;
 		ws.on("open", () => {
 			handlers.open();
-			if (usesTls && this.opts.tlsFingerprint) {
-				const tlsError = this.validateTlsFingerprint();
-				if (tlsError) {
-					handlers.error(tlsError);
-					ws.close(1008, tlsError.message);
-					return;
-				}
+			const tlsError = transport.validateSocket(ws);
+			if (tlsError) {
+				handlers.error(tlsError);
+				ws.close(1008, tlsError.message);
+				return;
 			}
 			this.transportValidated = true;
 		});
@@ -1386,7 +807,28 @@ var GatewayClient = class {
 			this.resolvePendingStop(ws);
 			handlers.close(code, reasonText);
 		});
+		ws.on("unexpected-response", (request, response) => {
+			readUpgradeErrorBody(response).then((body) => {
+				const statusCode = response.statusCode;
+				const rawLocation = response.headers.location;
+				const location = rawLocation ? redactSensitiveUrlLikeString(Array.isArray(rawLocation) ? rawLocation[0] ?? "" : rawLocation) : void 0;
+				upgradeError = new GatewayClientRequestError({
+					code: "UNAVAILABLE",
+					message: `gateway rejected websocket upgrade (HTTP ${statusCode ?? "unknown"})${body ? `: ${body}` : ""}`,
+					retryable: true,
+					details: {
+						reason: "websocket-upgrade-rejected",
+						...statusCode === void 0 ? {} : { httpStatus: statusCode },
+						...location ? { location } : {}
+					}
+				});
+				handlers.error(upgradeError);
+				request.destroy();
+				ws.close();
+			});
+		});
 		ws.on("error", (err) => {
+			if (upgradeError) return;
 			this.logDebug(`gateway client error: ${formatGatewayClientErrorForLog(err)}`);
 			handlers.error(err instanceof Error ? err : new Error(String(err)));
 		});
@@ -1486,22 +928,34 @@ var GatewayClient = class {
 			storedScopes,
 			defaultScopes: ["operator.admin"]
 		});
-		const platform = this.opts.platform ?? process.platform;
+		const clientMode = this.opts.mode ?? GATEWAY_CLIENT_MODES.BACKEND;
+		const clientId = this.opts.clientName ?? GATEWAY_CLIENT_NAMES.GATEWAY_CLIENT;
+		const isBuiltInNodeHost = role === "node" && clientMode === GATEWAY_CLIENT_MODES.NODE && clientId === GATEWAY_CLIENT_NAMES.NODE_HOST;
+		const negotiatesNodeProtocol = this.shouldNegotiateLegacyNodeProtocol();
+		const useLegacyNodeProtocolEnvelope = isBuiltInNodeHost && (this.useLegacyNodeProtocolEnvelope || this.opts.maxProtocol === MIN_NODE_PROTOCOL_VERSION && (this.opts.minProtocol ?? MIN_NODE_PROTOCOL_VERSION) <= MIN_NODE_PROTOCOL_VERSION);
+		const minProtocol = useLegacyNodeProtocolEnvelope ? MIN_NODE_PROTOCOL_VERSION : negotiatesNodeProtocol ? PROTOCOL_VERSION : this.opts.minProtocol ?? (clientMode === GATEWAY_CLIENT_MODES.PROBE ? MIN_PROBE_PROTOCOL_VERSION : role === "node" && clientMode === GATEWAY_CLIENT_MODES.NODE ? MIN_NODE_PROTOCOL_VERSION : MIN_CLIENT_PROTOCOL_VERSION);
+		const maxProtocol = useLegacyNodeProtocolEnvelope ? MIN_NODE_PROTOCOL_VERSION : negotiatesNodeProtocol ? PROTOCOL_VERSION : this.opts.maxProtocol ?? PROTOCOL_VERSION;
+		const configuredPlatform = this.opts.platform ?? process.platform;
+		const platform = useLegacyNodeProtocolEnvelope ? resolveLegacyNodePlatform(configuredPlatform) ?? configuredPlatform : configuredPlatform;
+		const deviceFamily = useLegacyNodeProtocolEnvelope ? void 0 : this.opts.deviceFamily;
 		return {
 			params: {
-				minProtocol: this.opts.minProtocol ?? MIN_CLIENT_PROTOCOL_VERSION,
-				maxProtocol: this.opts.maxProtocol ?? PROTOCOL_VERSION,
+				minProtocol,
+				maxProtocol,
 				client: {
-					id: this.opts.clientName ?? GATEWAY_CLIENT_NAMES.GATEWAY_CLIENT,
+					id: clientId,
 					displayName: this.opts.clientDisplayName,
 					version: this.opts.clientVersion ?? DEFAULT_CLIENT_VERSION,
+					buildId: this.opts.clientBuildId,
 					platform,
-					deviceFamily: this.opts.deviceFamily,
-					mode: this.opts.mode ?? GATEWAY_CLIENT_MODES.BACKEND,
+					deviceFamily,
+					mode: clientMode,
 					instanceId: this.opts.instanceId
 				},
 				caps: Array.isArray(this.opts.caps) ? this.opts.caps : [],
 				commands: Array.isArray(this.opts.commands) ? this.opts.commands : void 0,
+				computerUse: useLegacyNodeProtocolEnvelope ? void 0 : this.opts.computerUse,
+				workerRuns: useLegacyNodeProtocolEnvelope ? void 0 : this.opts.workerRuns,
 				permissions: this.opts.permissions && typeof this.opts.permissions === "object" ? this.opts.permissions : void 0,
 				pathEnv: this.opts.pathEnv,
 				auth,
@@ -1513,30 +967,47 @@ var GatewayClient = class {
 					scopes,
 					signatureToken,
 					signedAtMs,
-					platform
+					platform,
+					deviceFamily,
+					clientMode
 				})
 			},
 			authApprovalRuntimeToken,
 			authAgentRuntimeIdentityToken,
 			resolvedDeviceToken,
+			storedScopes,
 			storedToken,
 			usingStoredDeviceToken
 		};
 	}
+	shouldNegotiateLegacyNodeProtocol() {
+		if (this.opts.role !== "node" || this.opts.mode !== GATEWAY_CLIENT_MODES.NODE || this.opts.clientName !== GATEWAY_CLIENT_NAMES.NODE_HOST) return false;
+		return (this.opts.minProtocol ?? MIN_NODE_PROTOCOL_VERSION) === MIN_NODE_PROTOCOL_VERSION && (this.opts.maxProtocol ?? PROTOCOL_VERSION) === PROTOCOL_VERSION;
+	}
+	shouldRetryWithLegacyNodeProtocol(error) {
+		if (this.useLegacyNodeProtocolEnvelope || !this.shouldNegotiateLegacyNodeProtocol() || !(error instanceof GatewayClientRequestError)) return false;
+		const detailCode = readConnectErrorDetailCode(error.details);
+		return error.details?.expectedProtocol === MIN_NODE_PROTOCOL_VERSION && (detailCode === ConnectErrorDetailCodes.PROTOCOL_MISMATCH || normalizeGatewayErrorText(error.message).includes("protocol mismatch"));
+	}
+	shouldRetryWithCurrentNodeProtocol(error) {
+		if (!this.useLegacyNodeProtocolEnvelope || !this.shouldNegotiateLegacyNodeProtocol() || !(error instanceof GatewayClientRequestError)) return false;
+		const detailCode = readConnectErrorDetailCode(error.details);
+		return error.details?.expectedProtocol === PROTOCOL_VERSION && (detailCode === ConnectErrorDetailCodes.PROTOCOL_MISMATCH || normalizeGatewayErrorText(error.message).includes("protocol mismatch"));
+	}
 	buildDeviceConnectParams(params) {
 		if (!this.opts.deviceIdentity) return;
-		const { nonce, role, scopes, signatureToken, signedAtMs, platform } = params;
+		const { nonce, role, scopes, signatureToken, signedAtMs, platform, deviceFamily, clientMode } = params;
 		const payload = buildDeviceAuthPayloadV3({
 			deviceId: this.opts.deviceIdentity.deviceId,
 			clientId: this.opts.clientName ?? GATEWAY_CLIENT_NAMES.GATEWAY_CLIENT,
-			clientMode: this.opts.mode ?? GATEWAY_CLIENT_MODES.BACKEND,
+			clientMode,
 			role,
 			scopes,
 			signedAtMs,
 			token: signatureToken ?? null,
 			nonce,
 			platform,
-			deviceFamily: this.opts.deviceFamily
+			deviceFamily
 		});
 		const signature = this.deps.signDevicePayload(this.opts.deviceIdentity.privateKeyPem, payload);
 		return {
@@ -1548,24 +1019,67 @@ var GatewayClient = class {
 		};
 	}
 	handleConnectHello(helloOk, assembled) {
+		const reconnectWithCurrentNodeProtocol = this.useLegacyNodeProtocolEnvelope && this.shouldNegotiateLegacyNodeProtocol() && helloOk.protocol > MIN_NODE_PROTOCOL_VERSION;
+		if (reconnectWithCurrentNodeProtocol) this.useLegacyNodeProtocolEnvelope = false;
+		this.nodeProtocolTransitionPending = false;
 		this.pendingDeviceTokenRetry = false;
 		this.deviceTokenRetryBudgetUsed = false;
 		this.suppressedTransientPreHelloCleanCloses = 0;
 		const role = this.opts.role ?? "operator";
 		const authInfo = helloOk.auth;
-		if (authInfo?.deviceToken && this.opts.deviceIdentity) this.deps.storeDeviceAuthToken({
-			deviceId: this.opts.deviceIdentity.deviceId,
-			role: authInfo.role ?? role,
-			token: authInfo.deviceToken,
-			scopes: authInfo.scopes ?? [],
-			env: this.opts.env
-		});
+		if (authInfo?.deviceToken && this.opts.deviceIdentity) {
+			const tokenRole = authInfo.role ?? role;
+			const scopes = tokenRole === role && authInfo.deviceToken === assembled.storedToken ? assembled.storedScopes ?? authInfo.scopes ?? [] : authInfo.scopes ?? [];
+			this.deps.storeDeviceAuthToken({
+				deviceId: this.opts.deviceIdentity.deviceId,
+				role: tokenRole,
+				token: authInfo.deviceToken,
+				scopes,
+				env: this.opts.env
+			});
+		}
+		if (this.opts.preferBootstrapToken) {
+			this.opts.token = void 0;
+			this.opts.bootstrapToken = void 0;
+			this.opts.password = void 0;
+			this.opts.preferBootstrapToken = false;
+		}
 		this.tickIntervalMs = typeof helloOk.policy?.tickIntervalMs === "number" ? helloOk.policy.tickIntervalMs : 3e4;
+		if (reconnectWithCurrentNodeProtocol) {
+			this.suppressNextHelloCallback = true;
+			this.protocol.resetReconnectBackoff(250);
+			this.protocol.closeSocket(1012, "gateway protocol upgraded");
+			return;
+		}
 		this.lastTick = Date.now();
 		this.startTickWatch();
 	}
 	handleConnectRequestFailure(error, assembled) {
+		if (this.shouldRetryWithCurrentNodeProtocol(error)) {
+			const resetBackoff = !this.nodeProtocolTransitionPending;
+			this.useLegacyNodeProtocolEnvelope = false;
+			this.nodeProtocolTransitionPending = true;
+			if (resetBackoff) this.protocol.resetReconnectBackoff(250);
+			this.logDebug("gateway rejected protocol v3; retrying node host with protocol v4");
+			return {
+				closeCode: 1008,
+				closeReason: "connect retry"
+			};
+		}
+		if (this.shouldRetryWithLegacyNodeProtocol(error)) {
+			const resetBackoff = !this.nodeProtocolTransitionPending;
+			this.useLegacyNodeProtocolEnvelope = true;
+			this.nodeProtocolTransitionPending = true;
+			if (resetBackoff) this.protocol.resetReconnectBackoff(250);
+			this.logDebug("gateway rejected protocol v4; retrying node host with protocol v3");
+			return {
+				closeCode: 1008,
+				closeReason: "connect retry"
+			};
+		}
+		this.nodeProtocolTransitionPending = false;
 		const role = this.opts.role ?? "operator";
+		const detailCode = error instanceof GatewayClientRequestError ? readConnectErrorDetailCode(error.details) : null;
 		const shouldRetryWithDeviceToken = shouldRetryGatewayWithDeviceToken({
 			retryBudgetUsed: this.deviceTokenRetryBudgetUsed,
 			currentDeviceToken: assembled.resolvedDeviceToken,
@@ -1574,7 +1088,7 @@ var GatewayClient = class {
 			trustedEndpoint: this.isTrustedDeviceRetryEndpoint(),
 			errorDetails: error instanceof GatewayClientRequestError ? error.details : void 0
 		});
-		if (this.opts.deviceIdentity && assembled.usingStoredDeviceToken && error instanceof GatewayClientRequestError && readConnectErrorDetailCode(error.details) === ConnectErrorDetailCodes.AUTH_DEVICE_TOKEN_MISMATCH) {
+		if (this.opts.deviceIdentity && assembled.usingStoredDeviceToken && detailCode === ConnectErrorDetailCodes.AUTH_DEVICE_TOKEN_MISMATCH) {
 			const deviceId = this.opts.deviceIdentity.deviceId;
 			try {
 				this.deps.clearDeviceAuthToken({
@@ -1630,7 +1144,7 @@ var GatewayClient = class {
 		}
 		this.notifyConnectError(error);
 		const message = `gateway connect failed: ${formatGatewayClientErrorForLog(error)}`;
-		if (this.opts.mode === GATEWAY_CLIENT_MODES.PROBE || isGatewayClientStoppedError(error)) this.logDebug(message);
+		if (this.opts.mode === GATEWAY_CLIENT_MODES.PROBE || isGatewayClientStoppedError(error) || detailCode === ConnectErrorDetailCodes.AUTH_RATE_LIMITED) this.logDebug(message);
 		else this.logError(message);
 		return {
 			closeCode: 1008,
@@ -1643,7 +1157,7 @@ var GatewayClient = class {
 		const details = context.connectFailure?.error instanceof GatewayClientRequestError ? context.connectFailure.error.details : void 0;
 		if (context.code === 1013 && context.connectFailure?.reconnectDelayMs !== void 0) return {
 			retry: true,
-			notify: false,
+			notify: this.opts.notifyOnStartupRetry === true,
 			reconnectDelayMs: context.connectFailure.reconnectDelayMs
 		};
 		if (info.transientPreHelloCleanClose && this.suppressedTransientPreHelloCleanCloses < MAX_SUPPRESSED_TRANSIENT_PRE_HELLO_CLEAN_CLOSES) {
@@ -1651,7 +1165,7 @@ var GatewayClient = class {
 			return {
 				retry: true,
 				notify: true,
-				pendingError: new GatewayClientTransientPreHelloCloseError()
+				pendingError: /* @__PURE__ */ new Error("gateway transient pre-hello clean close")
 			};
 		}
 		if (info.transientPreHelloCleanClose || context.connectRequestSent && !context.helloReceived && !context.connectFailure) {
@@ -1664,6 +1178,7 @@ var GatewayClient = class {
 			details,
 			deviceTokenRetryPending: this.pendingDeviceTokenRetry,
 			tokenMismatchIsTerminal: true,
+			protocolMismatchIsTerminal: !this.nodeProtocolTransitionPending,
 			clientVersionMismatchIsTerminal: true
 		})) {
 			this.notifyReconnectPaused({
@@ -1687,11 +1202,13 @@ var GatewayClient = class {
 			phase: context.helloReceived ? "post-hello" : "pre-hello",
 			socketOpened: context.socketOpened,
 			transportValidated: this.transportValidated,
-			transientPreHelloCleanClose: !context.helloReceived && context.code === 1e3 && context.reason === ""
+			connectRequestSent: context.connectRequestSent,
+			transientPreHelloCleanClose: !context.helloReceived && context.code === 1e3 && context.reason === "",
+			...context.connectFailure?.error ? { connectError: context.connectFailure.error } : {}
 		};
 	}
 	clearStaleDeviceTokenForClose(code, reason) {
-		if (code !== 1008 || !normalizeLowercaseStringOrEmpty(reason).includes("device token mismatch") || this.opts.token || this.opts.password || !this.opts.deviceIdentity) return;
+		if (code !== 1008 || !normalizeGatewayErrorText(reason).includes("device token mismatch") || this.opts.token || this.opts.password || !this.opts.deviceIdentity) return;
 		const deviceId = this.opts.deviceIdentity.deviceId;
 		const role = this.opts.role ?? "operator";
 		try {
@@ -1724,14 +1241,14 @@ var GatewayClient = class {
 		if (!params.authApprovalRuntimeToken) return false;
 		if (!(params.error instanceof GatewayClientRequestError)) return false;
 		if (params.error.gatewayCode !== "INVALID_REQUEST") return false;
-		const message = normalizeLowercaseStringOrEmpty(params.error.message);
+		const message = normalizeGatewayErrorText(params.error.message);
 		return message.includes("invalid connect params") && message.includes("approvalruntimetoken");
 	}
 	shouldFailClosedForUnsupportedAgentRuntimeIdentity(params) {
 		if (!params.authAgentRuntimeIdentityToken) return false;
 		if (!(params.error instanceof GatewayClientRequestError)) return false;
 		if (params.error.gatewayCode !== "INVALID_REQUEST") return false;
-		const message = normalizeLowercaseStringOrEmpty(params.error.message);
+		const message = normalizeGatewayErrorText(params.error.message);
 		return message.includes("invalid connect params") && message.includes("agentruntimeidentitytoken");
 	}
 	isTrustedDeviceRetryEndpoint() {
@@ -1739,7 +1256,7 @@ var GatewayClient = class {
 		try {
 			const parsed = new URL(rawUrl);
 			const protocol = parsed.protocol === "https:" ? "wss:" : parsed.protocol === "http:" ? "ws:" : parsed.protocol;
-			if (isLoopbackHost(parsed.hostname)) return true;
+			if (isGatewayLoopbackHost(parsed.hostname)) return true;
 			return protocol === "wss:" && Boolean(this.opts.tlsFingerprint?.trim());
 		} catch {
 			return false;
@@ -1754,6 +1271,7 @@ var GatewayClient = class {
 		return selectGatewayConnectAuth({
 			token: this.opts.token,
 			bootstrapToken: this.opts.bootstrapToken,
+			preferBootstrapToken: this.opts.preferBootstrapToken,
 			deviceToken: this.opts.deviceToken,
 			password: this.opts.password,
 			approvalRuntimeToken: this.approvalRuntimeTokenCompatibilityDisabled ? void 0 : this.opts.approvalRuntimeToken,
@@ -1778,21 +1296,9 @@ var GatewayClient = class {
 			if (gap > (typeof rawTimeoutMs === "number" && Number.isFinite(rawTimeoutMs) ? Math.max(1, rawTimeoutMs) : this.tickIntervalMs * 2)) this.protocol.closeSocket(4e3, "tick timeout");
 		}, interval);
 	}
-	validateTlsFingerprint() {
-		if (!this.opts.tlsFingerprint || !this.ws) return null;
-		const expected = this.deps.normalizeTlsFingerprint(this.opts.tlsFingerprint);
-		if (!expected) return /* @__PURE__ */ new Error("gateway tls fingerprint missing");
-		const socket = this.ws["_socket"];
-		if (!socket || typeof socket.getPeerCertificate !== "function") return /* @__PURE__ */ new Error("gateway tls fingerprint unavailable");
-		const cert = socket.getPeerCertificate();
-		const fingerprint = this.deps.normalizeTlsFingerprint(cert?.fingerprint256 ?? "");
-		if (!fingerprint) return /* @__PURE__ */ new Error("gateway tls fingerprint unavailable");
-		if (fingerprint !== expected) return /* @__PURE__ */ new Error("gateway tls fingerprint mismatch");
-		return null;
-	}
 	async request(method, params, opts) {
 		const expectFinal = opts?.expectFinal === true;
-		const timeoutMs = opts?.timeoutMs === null ? null : typeof opts?.timeoutMs === "number" && Number.isFinite(opts.timeoutMs) ? resolveSafeTimeoutDelayMs(opts.timeoutMs, { minMs: 0 }) : expectFinal ? null : this.requestTimeoutMs;
+		const timeoutMs = opts?.timeoutMs === null ? null : typeof opts?.timeoutMs === "number" && Number.isFinite(opts.timeoutMs) ? opts.timeoutMs : expectFinal ? null : this.requestTimeoutMs;
 		return this.protocol.request(method, params, {
 			expectFinal,
 			timeoutMs,
@@ -1808,4 +1314,15 @@ function createGatewayRequestAbortError(method) {
 	return err;
 }
 //#endregion
-export { DEFAULT_GATEWAY_REQUEST_TIMEOUT_MS, DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS, GatewayBrowserDeviceAuthLifecycle, GatewayClient, GatewayClientRequestError, GatewayClientRequestTimeoutError, GatewaySessionMessageSubscriptionCoordinator, MAX_CONNECT_CHALLENGE_TIMEOUT_MS, MAX_SAFE_TIMEOUT_DELAY_MS, MIN_CONNECT_CHALLENGE_TIMEOUT_MS, addSafeTimeoutDelayGraceMs, buildDeviceAuthPayload, buildDeviceAuthPayloadV3, buildGatewayConnectAuth, clampConnectChallengeTimeoutMs, clearGatewayConnectTimeout, createSessionProjection, getConnectChallengeTimeoutMsFromEnv, getGatewaySessionMessageSubscriptionCoordinator, hasSessionProjectionAcceptedFinal, isGatewayConnectAssemblyError, isLocallyOptimisticSessionMessage, normalizeDeviceMetadataForAuth, normalizeSessionProjectionRunId, projectLiveSessionMessage, readSessionMessageIdentity, readSessionMessageSequence, reconcileSessionProjectionSnapshot, reduceSessionProjection, reduceSessionProjectionRunEvent, releaseGatewaySessionMessageSubscription, resetGatewaySessionMessageSubscriptionCoordinator, resolveConnectChallengeTimeoutMs, resolveFiniteTimeoutDelayMs, resolveGatewayConnectScopes, resolvePreauthHandshakeTimeoutMs, resolveSafeTimeoutDelayMs, selectGatewayConnectAuth, shouldRetryGatewayWithDeviceToken, startGatewayClientWhenEventLoopReady, startGatewayClientWithReadinessWait, startGatewayConnectTimeout, waitForEventLoopReady };
+//#region packages/gateway-client/src/cloudflare-access.ts
+const CF_ACCESS_CLIENT_ID_HEADER = "CF-Access-Client-Id";
+const CF_ACCESS_CLIENT_SECRET_HEADER = "CF-Access-Client-Secret";
+/** Build only the two headers Cloudflare Access defines for service-token auth. */
+function buildCloudflareAccessHeaders(credentials) {
+	return {
+		[CF_ACCESS_CLIENT_ID_HEADER]: credentials.clientId,
+		[CF_ACCESS_CLIENT_SECRET_HEADER]: credentials.clientSecret
+	};
+}
+//#endregion
+export { CF_ACCESS_CLIENT_ID_HEADER, CF_ACCESS_CLIENT_SECRET_HEADER, DEFAULT_GATEWAY_REQUEST_TIMEOUT_MS, DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS, GatewayBrowserDeviceAuthLifecycle, GatewayClient, GatewayClientRequestError, GatewayClientRequestTimeoutError, GatewayScopeUpgrade, GatewaySessionMessageSubscriptionCoordinator, MAX_CONNECT_CHALLENGE_TIMEOUT_MS, MAX_SAFE_TIMEOUT_DELAY_MS, MIN_CONNECT_CHALLENGE_TIMEOUT_MS, addSafeTimeoutDelayGraceMs, buildCloudflareAccessHeaders, buildDeviceAuthPayload, buildDeviceAuthPayloadV3, buildGatewayConnectAuth, clampConnectChallengeTimeoutMs, clearGatewayConnectTimeout, createSessionProjection, gatewayCredentialScope, gatewayOriginScope, getConnectChallengeTimeoutMsFromEnv, getGatewaySessionMessageSubscriptionCoordinator, hasSessionProjectionAcceptedFinal, isGatewayConnectAssemblyError, isLocallyOptimisticSessionMessage, normalizeDeviceMetadataForAuth, normalizeSessionProjectionRunId, projectLiveSessionMessage, readSessionMessageIdentity, readSessionMessageSequence, reconcileSessionProjectionSnapshot, reduceSessionProjection, reduceSessionProjectionRunEvent, releaseGatewaySessionMessageSubscription, resetGatewaySessionMessageSubscriptionCoordinator, resolveConnectChallengeTimeoutMs, resolveFiniteTimeoutDelayMs, resolveGatewayConnectScopes, resolvePreauthHandshakeTimeoutMs, resolveSafeTimeoutDelayMs, selectGatewayConnectAuth, shouldRetryGatewayWithDeviceToken, startGatewayClientWhenEventLoopReady, startGatewayClientWithReadinessWait, startGatewayConnectTimeout, waitForEventLoopReady };