@openclaw/gateway-client 2026.8.1-beta.1 → 2026.8.1-beta.3

package/dist/{protocol-client-U142L0j3.d.mts → protocol-client-BbN-I582.d.mts}

@@ -1,23 +1,18 @@
+import { n as GatewayProtocolRequestOptions, t as GatewayProtocolRequestError } from "./protocol-request-D4mVhLxE.mjs";
 import { ErrorShape, EventFrame, HelloOk } from "@openclaw/gateway-protocol";
 
-//#region packages/gateway-client/src/protocol-request.d.ts
-type GatewayProtocolRequestOptions = {
-  timeoutMs?: number | null;
-  expectFinal?: boolean;
-  onSent?: () => void;
-  onAccepted?: (payload: unknown) => void;
-  signal?: AbortSignal;
+//#region packages/gateway-client/src/pending-request.d.ts
+type GatewayProtocolRequestTiming = {
+  id: string;
+  method: string;
+  ok: boolean;
+  durationMs: number;
+  startedAtMs: number;
+  endedAtMs: number;
+  errorCode?: string;
 };
-declare class GatewayProtocolRequestError extends Error {
-  readonly code: string;
-  readonly gatewayCode: string;
-  readonly details?: unknown;
-  readonly retryable: boolean;
-  readonly retryAfterMs?: number;
-  constructor(error: Partial<ErrorShape>);
-}
 //#endregion
-//#region packages/gateway-client/src/protocol-client.d.ts
+//#region packages/gateway-client/src/protocol-client-contract.d.ts
 type GatewayProtocolSocket = {
   isOpen: () => boolean;
   send: (data: string) => void;
@@ -70,15 +65,6 @@ type GatewayProtocolTiming<TPlan> = {
   plan?: TPlan;
   detail?: unknown;
 };
-type GatewayProtocolRequestTiming = {
-  id: string;
-  method: string;
-  ok: boolean;
-  durationMs: number;
-  startedAtMs: number;
-  endedAtMs: number;
-  errorCode?: string;
-};
 type GatewayProtocolClientOptions<TPlan> = {
   createSocket: (handlers: GatewayProtocolSocketHandlers) => GatewayProtocolSocket;
   createRequestId: () => string;
@@ -128,6 +114,8 @@ type GatewayProtocolClientOptions<TPlan> = {
   shouldRetrySocketFactoryError?: (error: Error) => boolean;
   rethrowSocketFactoryError?: (error: Error) => boolean;
 };
+//#endregion
+//#region packages/gateway-client/src/protocol-client.d.ts
 /**
  * Browser-safe gateway wire client. Environment adapters own transport and auth
  * policy; this class owns the single socket/handshake/reconnect/frame state machine.
@@ -135,7 +123,7 @@ type GatewayProtocolClientOptions<TPlan> = {
 declare class GatewayProtocolClient<TPlan> {
   private readonly opts;
   private socket;
-  private readonly pending;
+  private readonly requests;
   private readonly listeners;
   private stopped;
   private generation;
@@ -171,11 +159,8 @@ declare class GatewayProtocolClient<TPlan> {
   private handleConnectPlanError;
   private sendConnectPlan;
   private handleMessage;
-  private handleResponse;
   private handleClose;
   private handleSocketError;
-  private flushRequests;
-  private finishRequestTiming;
   private scheduleReconnect;
   private closeContext;
   private isActive;
@@ -184,4 +169,4 @@ declare class GatewayProtocolClient<TPlan> {
   private invoke;
 }
 //#endregion
-export { GatewayProtocolSocketHandlers as a, GatewayProtocolRequestOptions as c, GatewayProtocolSocket as i, GatewayProtocolCloseContext as n, GatewayProtocolTiming as o, GatewayProtocolRequestTiming as r, GatewayProtocolRequestError as s, GatewayProtocolClient as t };
+export { GatewayProtocolTiming as a, GatewayProtocolSocketHandlers as i, GatewayProtocolCloseContext as n, GatewayProtocolRequestTiming as o, GatewayProtocolSocket as r, GatewayProtocolClient as t };

package/dist/protocol-request-D4mVhLxE.d.mts

@@ -0,0 +1,32 @@
+import { ErrorShape } from "@openclaw/gateway-protocol";
+
+//#region packages/gateway-client/src/protocol-request.d.ts
+type GatewayProtocolRequestOptions = {
+  timeoutMs?: number | null;
+  expectFinal?: boolean;
+  onSent?: () => void;
+  onAccepted?: (payload: unknown) => void;
+  signal?: AbortSignal;
+};
+declare class GatewayProtocolRequestError extends Error {
+  readonly code: string;
+  readonly gatewayCode: string;
+  readonly details?: unknown;
+  readonly retryable: boolean;
+  readonly retryAfterMs?: number;
+  constructor(error: Partial<ErrorShape>);
+}
+/** A local transport deadline, distinct from a Gateway's authoritative rejection. */
+declare class GatewayProtocolRequestTimeoutError extends Error {
+  readonly code = "CLIENT_TIMEOUT";
+  readonly method: string;
+  readonly timeoutMs: number;
+  readonly requestSent: boolean;
+  constructor(params: {
+    method: string;
+    timeoutMs: number;
+    requestSent: boolean;
+  }, message?: string);
+}
+//#endregion
+export { GatewayProtocolRequestOptions as n, GatewayProtocolRequestTimeoutError as r, GatewayProtocolRequestError as t };

package/dist/{readiness-uSDrqxDM.d.mts → readiness-JllUDKLg.d.mts}

@@ -1,7 +1,12 @@
-import { c as GatewayProtocolRequestOptions, s as GatewayProtocolRequestError } from "./protocol-client-U142L0j3.mjs";
-import { ErrorShape, EventFrame, HelloOk } from "@openclaw/gateway-protocol/frame-guards";
+import { n as GatewayProtocolRequestOptions, r as GatewayProtocolRequestTimeoutError, t as GatewayProtocolRequestError } from "./protocol-request-D4mVhLxE.mjs";
+import { ConnectParams, ErrorShape, EventFrame, HelloOk } from "@openclaw/gateway-protocol/frame-guards";
 import { GatewayClientMode, GatewayClientName } from "@openclaw/gateway-protocol/client-info";
 
+//#region packages/gateway-client/src/request-error.d.ts
+declare class GatewayClientRequestError extends GatewayProtocolRequestError {
+  constructor(error: Partial<ErrorShape>);
+}
+//#endregion
 //#region packages/gateway-client/src/client.d.ts
 type DeviceIdentity = {
   deviceId: string;
@@ -50,15 +55,11 @@ type GatewayClientCloseInfo = {
   phase: "pre-hello" | "post-hello";
   socketOpened: boolean;
   transportValidated: boolean;
+  connectRequestSent?: boolean;
   transientPreHelloCleanClose: boolean;
+  connectError?: Error;
 };
-declare class GatewayClientRequestError extends GatewayProtocolRequestError {
-  constructor(error: Partial<ErrorShape>);
-}
-declare class GatewayClientRequestTimeoutError extends Error {
-  readonly method: string;
-  readonly timeoutMs: number;
-  readonly requestSent: boolean;
+declare class GatewayClientRequestTimeoutError extends GatewayProtocolRequestTimeoutError {
   constructor(params: {
     method: string;
     timeoutMs: number;
@@ -68,7 +69,8 @@ declare class GatewayClientRequestTimeoutError extends Error {
 declare function isGatewayConnectAssemblyError(value: unknown): value is Error;
 type GatewayClientOptions = {
   url?: string;
-  origin?: string;
+  origin?: string; /** Already-resolved edge-proxy auth headers (identity-aware proxy in front of the Gateway). */
+  edgeAuthHeaders?: Readonly<Record<string, string>>;
   connectChallengeTimeoutMs?: number;
   /**
    * Server-side pre-auth handshake budget. Config-derived local clients use
@@ -79,7 +81,8 @@ type GatewayClientOptions = {
   tickWatchTimeoutMs?: number;
   requestTimeoutMs?: number;
   token?: string;
-  bootstrapToken?: string;
+  bootstrapToken?: string; /** Prefer one setup credential for the first successful device-auth exchange. */
+  preferBootstrapToken?: boolean;
   deviceToken?: string;
   password?: string;
   approvalRuntimeToken?: string;
@@ -88,6 +91,7 @@ type GatewayClientOptions = {
   clientName?: GatewayClientName;
   clientDisplayName?: string;
   clientVersion?: string;
+  clientBuildId?: string;
   platform?: string;
   deviceFamily?: string;
   mode?: GatewayClientMode;
@@ -95,6 +99,8 @@ type GatewayClientOptions = {
   scopes?: string[];
   caps?: string[];
   commands?: string[];
+  computerUse?: ConnectParams["computerUse"]; /** @deprecated Compatibility for the shipped v1 node-host connect envelope. */
+  workerRuns?: ConnectParams["workerRuns"];
   permissions?: Record<string, boolean>;
   pathEnv?: string;
   env?: NodeJS.ProcessEnv;
@@ -106,7 +112,8 @@ type GatewayClientOptions = {
   onEvent?: (evt: EventFrame) => void;
   onHelloOk?: (hello: HelloOk) => void;
   onConnectError?: (err: Error) => void;
-  onReconnectPaused?: (info: GatewayReconnectPausedInfo) => void;
+  onReconnectPaused?: (info: GatewayReconnectPausedInfo) => void; /** Report retryable startup closes for clients that present connection progress. */
+  notifyOnStartupRetry?: boolean;
   onClose?: (code: number, reason: string, info?: GatewayClientCloseInfo) => void;
   onGap?: (info: {
     expected: number;
@@ -125,6 +132,9 @@ declare class GatewayClient {
   private opts;
   private deps;
   private stopped;
+  private useLegacyNodeProtocolEnvelope;
+  private nodeProtocolTransitionPending;
+  private suppressNextHelloCallback;
   private pendingDeviceTokenRetry;
   private deviceTokenRetryBudgetUsed;
   private approvalRuntimeTokenCompatibilityDisabled;
@@ -141,6 +151,8 @@ declare class GatewayClient {
   updateNodeManifest(manifest: {
     caps: string[];
     commands: string[];
+    computerUse?: ConnectParams["computerUse"]; /** @deprecated Compatibility for the shipped v1 node-host connect envelope. */
+    workerRuns?: ConnectParams["workerRuns"];
   }): void;
   start(): void;
   private createSocket;
@@ -154,6 +166,9 @@ declare class GatewayClient {
   private logDebug;
   private logError;
   private assembleConnectParams;
+  private shouldNegotiateLegacyNodeProtocol;
+  private shouldRetryWithLegacyNodeProtocol;
+  private shouldRetryWithCurrentNodeProtocol;
   private buildDeviceConnectParams;
   private handleConnectHello;
   private handleConnectRequestFailure;
@@ -167,7 +182,6 @@ declare class GatewayClient {
   private isTrustedDeviceRetryEndpoint;
   private selectConnectAuth;
   private startTickWatch;
-  private validateTlsFingerprint;
   request<T = Record<string, unknown>>(method: string, params?: unknown, opts?: GatewayClientRequestOptions): Promise<T>;
 }
 //#endregion
@@ -208,4 +222,4 @@ declare function startGatewayClientWithReadinessWait(waitForReady: EventLoopRead
 /** Starts a gateway client after the default event-loop readiness probe succeeds. */
 declare function startGatewayClientWhenEventLoopReady(client: GatewayClientStartable, options?: GatewayClientStartReadinessOptions): Promise<EventLoopReadyResult>;
 //#endregion
-export { GatewayClientRequestOptions as _, startGatewayClientWithReadinessWait as a, isGatewayConnectAssemblyError as b, waitForEventLoopReady as c, GatewayClient as d, GatewayClientCloseInfo as f, GatewayClientRequestError as g, GatewayClientOptions as h, startGatewayClientWhenEventLoopReady as i, DeviceAuthTokenRecord as l, GatewayClientHostDeps as m, GatewayClientStartReadinessOptions as n, EventLoopReadyOptions as o, GatewayClientConnectionMetadata as p, GatewayClientStartable as r, EventLoopReadyResult as s, EventLoopReadyWaiter as t, DeviceIdentity as u, GatewayClientRequestTimeoutError as v, GatewayReconnectPausedInfo as y };
+export { GatewayClientRequestTimeoutError as _, startGatewayClientWithReadinessWait as a, GatewayClientRequestError as b, waitForEventLoopReady as c, GatewayClient as d, GatewayClientCloseInfo as f, GatewayClientRequestOptions as g, GatewayClientOptions as h, startGatewayClientWhenEventLoopReady as i, DeviceAuthTokenRecord as l, GatewayClientHostDeps as m, GatewayClientStartReadinessOptions as n, EventLoopReadyOptions as o, GatewayClientConnectionMetadata as p, GatewayClientStartable as r, EventLoopReadyResult as s, EventLoopReadyWaiter as t, DeviceIdentity as u, GatewayReconnectPausedInfo as v, isGatewayConnectAssemblyError as y };

package/dist/readiness.d.mts

@@ -1,2 +1,2 @@
-import { a as startGatewayClientWithReadinessWait, i as startGatewayClientWhenEventLoopReady, n as GatewayClientStartReadinessOptions, r as GatewayClientStartable, t as EventLoopReadyWaiter } from "./readiness-uSDrqxDM.mjs";
+import { a as startGatewayClientWithReadinessWait, i as startGatewayClientWhenEventLoopReady, n as GatewayClientStartReadinessOptions, r as GatewayClientStartable, t as EventLoopReadyWaiter } from "./readiness-JllUDKLg.mjs";
 export { EventLoopReadyWaiter, GatewayClientStartReadinessOptions, GatewayClientStartable, startGatewayClientWhenEventLoopReady, startGatewayClientWithReadinessWait };

package/dist/scope-upgrade.d.mts

@@ -0,0 +1,38 @@
+import { a as GatewayBrowserDeviceTokenStore } from "./browser-device-auth-Dz6H7eXy.mjs";
+import { n as GatewayProtocolRequestOptions } from "./protocol-request-D4mVhLxE.mjs";
+
+//#region packages/gateway-client/src/scope-upgrade.d.ts
+type ScopeUpgradeBinding = {
+  clientId: string;
+  deviceId: string;
+  role: string;
+};
+type ScopeUpgradeOutcome = {
+  status: "approved";
+  requestId: string;
+  scopes: string[];
+} | {
+  status: "rejected" | "expired";
+  requestId: string;
+};
+type ScopeUpgradeOptions = {
+  binding: ScopeUpgradeBinding;
+  scopes: readonly string[];
+  onPending?: (requestId: string) => void;
+};
+type UpgradeRequester = (method: string, params?: unknown, options?: GatewayProtocolRequestOptions) => Promise<unknown>;
+/** Runs one browser device scope upgrade and owns rotated-token persistence. */
+declare class GatewayScopeUpgrade {
+  private readonly deps;
+  private active?;
+  constructor(deps: {
+    request: UpgradeRequester;
+    tokenStore: GatewayBrowserDeviceTokenStore;
+    reconnect: () => void;
+  });
+  requestScopeUpgrade(options: ScopeUpgradeOptions): Promise<ScopeUpgradeOutcome>;
+  cancelScopeUpgrade(): void;
+  private runUpgrade;
+}
+//#endregion
+export { GatewayScopeUpgrade, ScopeUpgradeBinding, ScopeUpgradeOptions, ScopeUpgradeOutcome };

package/dist/scope-upgrade.mjs

@@ -0,0 +1,73 @@
+//#region packages/gateway-client/src/scope-upgrade.ts
+function readRequestId(value) {
+	const requestId = value && typeof value === "object" && "requestId" in value ? value.requestId : void 0;
+	if (typeof requestId !== "string" || !requestId.trim()) throw new Error("gateway returned an invalid scope upgrade request id");
+	return requestId;
+}
+function readUpgradeResult(value, requestId) {
+	if (!value || typeof value !== "object") throw new Error("gateway returned an invalid scope upgrade result");
+	const result = value;
+	if (result.requestId !== requestId) throw new Error("gateway returned a mismatched scope upgrade result");
+	if (result.status === "rejected" || result.status === "expired") return {
+		status: result.status,
+		requestId
+	};
+	const deviceToken = result.status === "approved" && typeof result.deviceToken === "string" ? result.deviceToken.trim() : "";
+	const rawScopes = result.status === "approved" && Array.isArray(result.scopes) ? result.scopes : [];
+	if (!deviceToken || rawScopes.length === 0 || rawScopes.some((scope) => typeof scope !== "string" || !scope.trim())) throw new Error("gateway returned invalid approved scope upgrade credentials");
+	return {
+		status: "approved",
+		requestId,
+		deviceToken,
+		scopes: rawScopes
+	};
+}
+/** Runs one browser device scope upgrade and owns rotated-token persistence. */
+var GatewayScopeUpgrade = class {
+	constructor(deps) {
+		this.deps = deps;
+	}
+	requestScopeUpgrade(options) {
+		if (this.active) {
+			if (this.active.requestId) options.onPending?.(this.active.requestId);
+			return this.active.promise;
+		}
+		const operation = { controller: new AbortController() };
+		const promise = this.runUpgrade(operation, options).finally(() => {
+			if (this.active === operation) this.active = void 0;
+		});
+		operation.promise = promise;
+		this.active = operation;
+		return promise;
+	}
+	cancelScopeUpgrade() {
+		const operation = this.active;
+		this.active = void 0;
+		operation?.controller.abort();
+	}
+	async runUpgrade(operation, options) {
+		const requestId = readRequestId(await this.deps.request("device.scopes.requestUpgrade", { scopes: [...options.scopes] }, { signal: operation.controller.signal }));
+		operation.requestId = requestId;
+		options.onPending?.(requestId);
+		const result = readUpgradeResult(await this.deps.request("device.scopes.waitUpgrade", { requestId }, {
+			timeoutMs: null,
+			signal: operation.controller.signal
+		}), requestId);
+		if (result.status !== "approved") return result;
+		await this.deps.tokenStore.store({
+			clientId: options.binding.clientId,
+			deviceId: options.binding.deviceId,
+			role: options.binding.role,
+			token: result.deviceToken,
+			scopes: result.scopes
+		});
+		this.deps.reconnect();
+		return {
+			status: "approved",
+			requestId,
+			scopes: result.scopes
+		};
+	}
+};
+//#endregion
+export { GatewayScopeUpgrade };

package/dist/{session-subscriptions-Das1PATe.d.mts → session-subscriptions-CKF7acYN.d.mts}

@@ -1,4 +1,4 @@
-import { ConnectParams, HelloOk } from "@openclaw/gateway-protocol";
+import { n as GatewayProtocolRequestOptions } from "./protocol-request-D4mVhLxE.mjs";
 
 //#region packages/gateway-client/src/device-auth.d.ts
 declare function normalizeDeviceMetadataForAuth(value?: string | null): string;
@@ -19,117 +19,13 @@ type DeviceAuthPayloadV3Params = DeviceAuthPayloadParams & {
 declare function buildDeviceAuthPayload(params: DeviceAuthPayloadParams): string;
 declare function buildDeviceAuthPayloadV3(params: DeviceAuthPayloadV3Params): string;
 //#endregion
-//#region packages/gateway-client/src/connect-auth.d.ts
-type GatewayConnectAuthSelection = {
-  authToken?: string;
-  authBootstrapToken?: string;
-  authDeviceToken?: string;
-  authPassword?: string;
-  authApprovalRuntimeToken?: string;
-  authAgentRuntimeIdentityToken?: string;
-  signatureToken?: string;
-  resolvedDeviceToken?: string;
-  storedToken?: string;
-  storedScopes?: string[];
-  usingStoredDeviceToken?: boolean;
-};
-declare function selectGatewayConnectAuth(params: {
-  token?: string;
-  bootstrapToken?: string;
-  deviceToken?: string;
-  password?: string;
-  approvalRuntimeToken?: string;
-  agentRuntimeIdentityToken?: string;
-  storedToken?: string;
-  storedScopes?: string[];
-  pendingDeviceTokenRetry?: boolean;
-  trustedDeviceTokenRetry?: boolean;
-  preferBootstrapToken?: boolean;
-}): GatewayConnectAuthSelection;
-declare function buildGatewayConnectAuth(selected: GatewayConnectAuthSelection): ConnectParams["auth"];
-declare function resolveGatewayConnectScopes(params: {
-  requestedScopes?: string[];
-  usingStoredDeviceToken?: boolean;
-  storedScopes?: string[];
-  defaultScopes: readonly string[];
-}): string[];
-declare function shouldRetryGatewayWithDeviceToken(params: {
-  retryBudgetUsed: boolean;
-  currentDeviceToken?: string;
-  explicitToken?: string;
-  storedToken?: string;
-  trustedEndpoint: boolean;
-  canRetryWithDeviceTokenHint?: boolean;
-  errorDetails?: unknown;
-}): boolean;
+//#region packages/gateway-client/src/gateway-origin-scope.d.ts
+/** Normalizes the gateway URL scope used for origin-bound device tokens. */
+declare function gatewayOriginScope(gatewayUrl: string): string;
+/** Normalizes the gateway URL scope used for browser credential records. */
+declare function gatewayCredentialScope(gatewayUrl: string): string;
 //#endregion
-//#region packages/gateway-client/src/browser-device-auth.d.ts
-type GatewayBrowserDeviceIdentity = {
-  deviceId: string;
-  publicKey: string;
-  sign: (payload: string) => Promise<string>;
-};
-type GatewayBrowserDeviceTokenRecord = {
-  token: string;
-  scopes: string[];
-};
-type MaybePromise<T> = T | Promise<T>;
-type GatewayBrowserDeviceTokenStore = {
-  load: (params: {
-    clientId: string;
-    deviceId: string;
-    role: string;
-  }) => MaybePromise<GatewayBrowserDeviceTokenRecord | null>;
-  store: (params: {
-    clientId: string;
-    deviceId: string;
-    role: string;
-    token: string;
-    scopes: string[];
-  }) => MaybePromise<void>;
-  clear: (params: {
-    clientId: string;
-    deviceId: string;
-    role: string;
-  }) => MaybePromise<void>;
-};
-type GatewayBrowserDeviceAuthPlan = {
-  clientId: string;
-  role: string;
-  identity: GatewayBrowserDeviceIdentity | null;
-  selectedAuth: GatewayConnectAuthSelection;
-  scopes: string[];
-  device?: NonNullable<ConnectParams["device"]>;
-  auth?: ConnectParams["auth"];
-};
-/** Browser-safe device pairing and issued-token lifecycle shared by first-party UI clients. */
-declare class GatewayBrowserDeviceAuthLifecycle {
-  private readonly deps;
-  constructor(deps: {
-    loadIdentity: () => Promise<GatewayBrowserDeviceIdentity | null>;
-    tokenStore: GatewayBrowserDeviceTokenStore;
-    nowMs?: () => number;
-  });
-  buildPlan(params: {
-    client: ConnectParams["client"];
-    role: string;
-    defaultScopes: readonly string[];
-    bootstrapScopes?: readonly string[];
-    token?: string;
-    bootstrapToken?: string;
-    password?: string;
-    pendingDeviceTokenRetry?: boolean;
-    trustedDeviceTokenRetry?: boolean;
-    preferBootstrapToken?: boolean;
-    nonce: string | null;
-    challengeTs?: number | null;
-  }): Promise<GatewayBrowserDeviceAuthPlan>;
-  acceptHello(hello: Pick<HelloOk, "auth">, plan: GatewayBrowserDeviceAuthPlan): Promise<void>;
-  clearStoredToken(plan: GatewayBrowserDeviceAuthPlan): Promise<void>;
-}
-//#endregion
-//#region packages/gateway-client/src/session-projection.d.ts
-/** Browser-safe identity and replay rules shared by Gateway conversation clients. */
+//#region packages/gateway-client/src/session-projection-message-identity.d.ts
 type SessionMessageEnvelope = {
   messageId?: unknown;
   messageSeq?: unknown;
@@ -146,6 +42,14 @@ type SessionMessageIdentity = {
   isImported: boolean;
   externalSource: string | null;
 };
+/** History and status markers carry transcript order even when they have no chat role. */
+declare function readSessionMessageSequence(message: unknown, envelope?: SessionMessageEnvelope): number | null;
+/** Run ownership normalizes a user-turn suffix without changing its persisted send key. */
+declare function normalizeSessionProjectionRunId(value: unknown): string | null;
+/** Persisted row facts win; assistant run ownership comes from its authoritative producer. */
+declare function readSessionMessageIdentity(message: unknown, envelope?: SessionMessageEnvelope): SessionMessageIdentity | null;
+//#endregion
+//#region packages/gateway-client/src/session-projection.d.ts
 type SessionProjectionScope = {
   sessionKey?: string;
   sessionId?: string;
@@ -227,12 +131,6 @@ type SessionProjectionEvent = ScopedSessionProjectionEvent & ({
 } | {
   type: "reconnected";
 });
-/** History and status markers carry transcript order even when they have no chat role. */
-declare function readSessionMessageSequence(message: unknown, envelope?: SessionMessageEnvelope): number | null;
-/** Run ownership normalizes a user-turn suffix without changing its persisted send key. */
-declare function normalizeSessionProjectionRunId(value: unknown): string | null;
-/** Persisted transcript facts win over envelope projections and provider-local import IDs. */
-declare function readSessionMessageIdentity(message: unknown, envelope?: SessionMessageEnvelope): SessionMessageIdentity | null;
 /** Local turns have no durable transcript metadata beyond their own optional send key. */
 declare function isLocallyOptimisticSessionMessage(message: unknown): boolean;
 declare function createSessionProjection(scope?: SessionProjectionScope, messages?: readonly unknown[]): SessionProjectionState;
@@ -248,7 +146,7 @@ declare function reduceSessionProjectionRunEvent(projection: SessionProjectionSt
 //#endregion
 //#region packages/gateway-client/src/session-subscriptions.d.ts
 type GatewaySessionMessageRequestClient = {
-  request<T = unknown>(method: string, params: Record<string, unknown>): Promise<T>;
+  request<T = unknown>(method: string, params: Record<string, unknown>, options?: GatewayProtocolRequestOptions): Promise<T>;
 };
 type GatewaySessionMessageSubscription = {
   key: string;
@@ -280,4 +178,4 @@ declare function getGatewaySessionMessageSubscriptionCoordinator(client: Gateway
 declare function resetGatewaySessionMessageSubscriptionCoordinator(client: GatewaySessionMessageRequestClient): void;
 declare function releaseGatewaySessionMessageSubscription(subscription: GatewaySessionMessageSubscription): Promise<void>;
 //#endregion
-export { GatewayBrowserDeviceAuthLifecycle as A, buildDeviceAuthPayload as B, normalizeSessionProjectionRunId as C, reconcileSessionProjectionSnapshot as D, readSessionMessageSequence as E, GatewayConnectAuthSelection as F, normalizeDeviceMetadataForAuth as H, buildGatewayConnectAuth as I, resolveGatewayConnectScopes as L, GatewayBrowserDeviceIdentity as M, GatewayBrowserDeviceTokenRecord as N, reduceSessionProjection as O, GatewayBrowserDeviceTokenStore as P, selectGatewayConnectAuth as R, isLocallyOptimisticSessionMessage as S, readSessionMessageIdentity as T, buildDeviceAuthPayloadV3 as V, SessionProjectionScope as _, GatewaySessionMessageSubscriptionOptions as a, createSessionProjection as b, resetGatewaySessionMessageSubscriptionCoordinator as c, SessionProjectionEntry as d, SessionProjectionEvent as f, SessionProjectionRunTransition as g, SessionProjectionRunStatus as h, GatewaySessionMessageSubscriptionCoordinatorOptions as i, GatewayBrowserDeviceAuthPlan as j, reduceSessionProjectionRunEvent as k, SessionMessageEnvelope as l, SessionProjectionRun as m, GatewaySessionMessageSubscription as n, getGatewaySessionMessageSubscriptionCoordinator as o, SessionProjectionGatewayRunEvent as p, GatewaySessionMessageSubscriptionCoordinator as r, releaseGatewaySessionMessageSubscription as s, GatewaySessionMessageRequestClient as t, SessionMessageIdentity as u, SessionProjectionSnapshotOptions as v, projectLiveSessionMessage as w, hasSessionProjectionAcceptedFinal as x, SessionProjectionState as y, shouldRetryGatewayWithDeviceToken as z };
+export { gatewayCredentialScope as A, reduceSessionProjection as C, normalizeSessionProjectionRunId as D, SessionMessageIdentity as E, buildDeviceAuthPayload as M, buildDeviceAuthPayloadV3 as N, readSessionMessageIdentity as O, normalizeDeviceMetadataForAuth as P, reconcileSessionProjectionSnapshot as S, SessionMessageEnvelope as T, SessionProjectionState as _, GatewaySessionMessageSubscriptionOptions as a, isLocallyOptimisticSessionMessage as b, resetGatewaySessionMessageSubscriptionCoordinator as c, SessionProjectionGatewayRunEvent as d, SessionProjectionRun as f, SessionProjectionSnapshotOptions as g, SessionProjectionScope as h, GatewaySessionMessageSubscriptionCoordinatorOptions as i, gatewayOriginScope as j, readSessionMessageSequence as k, SessionProjectionEntry as l, SessionProjectionRunTransition as m, GatewaySessionMessageSubscription as n, getGatewaySessionMessageSubscriptionCoordinator as o, SessionProjectionRunStatus as p, GatewaySessionMessageSubscriptionCoordinator as r, releaseGatewaySessionMessageSubscription as s, GatewaySessionMessageRequestClient as t, SessionProjectionEvent as u, createSessionProjection as v, reduceSessionProjectionRunEvent as w, projectLiveSessionMessage as x, hasSessionProjectionAcceptedFinal as y };