@openclaw/gateway-client 2026.8.1-beta.2 → 2026.8.1

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { C as resolveGatewayConnectScopes, D as buildDeviceAuthPayloadV3, E as buildDeviceAuthPayload, O as normalizeDeviceMetadataForAuth, S as buildGatewayConnectAuth, T as shouldRetryGatewayWithDeviceToken, _ as GatewayProtocolRequestError, a as createSessionProjection, b as gatewayOriginScope, c as normalizeSessionProjectionRunId, d as readSessionMessageSequence, f as reconcileSessionProjectionSnapshot, g as GatewayProtocolClient, h as shouldPauseGatewayReconnect, i as resetGatewaySessionMessageSubscriptionCoordinator, l as projectLiveSessionMessage, m as reduceSessionProjectionRunEvent, n as getGatewaySessionMessageSubscriptionCoordinator, o as hasSessionProjectionAcceptedFinal, p as reduceSessionProjection, r as releaseGatewaySessionMessageSubscription, s as isLocallyOptimisticSessionMessage, t as GatewaySessionMessageSubscriptionCoordinator, u as readSessionMessageIdentity, v as GatewayProtocolRequestTimeoutError, w as selectGatewayConnectAuth, x as GatewayBrowserDeviceAuthLifecycle, y as gatewayCredentialScope } from "./session-subscriptions-uKmTyc3P.mjs";
+import { C as buildGatewayConnectAuth, D as buildDeviceAuthPayload, E as shouldRetryGatewayWithDeviceToken, O as buildDeviceAuthPayloadV3, S as GatewayBrowserDeviceAuthLifecycle, T as selectGatewayConnectAuth, _ as GatewayProtocolClient, a as createSessionProjection, b as gatewayCredentialScope, c as projectLiveSessionMessage, d as reduceSessionProjectionRunEvent, f as normalizeSessionProjectionRunId, g as shouldPauseGatewayReconnect, h as isRecord, i as resetGatewaySessionMessageSubscriptionCoordinator, k as normalizeDeviceMetadataForAuth, l as reconcileSessionProjectionSnapshot, m as readSessionMessageSequence, n as getGatewaySessionMessageSubscriptionCoordinator, o as hasSessionProjectionAcceptedFinal, p as readSessionMessageIdentity, r as releaseGatewaySessionMessageSubscription, s as isLocallyOptimisticSessionMessage, t as GatewaySessionMessageSubscriptionCoordinator, u as reduceSessionProjection, v as GatewayProtocolRequestError, w as resolveGatewayConnectScopes, x as gatewayOriginScope, y as GatewayProtocolRequestTimeoutError } from "./session-subscriptions-BxuNBgqH.mjs";
 import { DEFAULT_GATEWAY_REQUEST_TIMEOUT_MS, DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS, MAX_CONNECT_CHALLENGE_TIMEOUT_MS, MAX_SAFE_TIMEOUT_DELAY_MS, MIN_CONNECT_CHALLENGE_TIMEOUT_MS, addSafeTimeoutDelayGraceMs, clampConnectChallengeTimeoutMs, clearGatewayConnectTimeout, getConnectChallengeTimeoutMsFromEnv, resolveConnectChallengeTimeoutMs, resolveFiniteTimeoutDelayMs, resolvePreauthHandshakeTimeoutMs, resolveSafeTimeoutDelayMs, startGatewayConnectTimeout } from "./timeouts.mjs";
 import { rawDataToString } from "./websocket-data.mjs";
 import { n as startGatewayClientWithReadinessWait, r as waitForEventLoopReady, t as startGatewayClientWhenEventLoopReady } from "./readiness-CrWxd4TI.mjs";
@@ -9,29 +9,8 @@ import { resolveGatewayStartupRetryAfterMs } from "@openclaw/gateway-protocol/st
 import { MIN_CLIENT_PROTOCOL_VERSION, MIN_NODE_PROTOCOL_VERSION, MIN_PROBE_PROTOCOL_VERSION, PROTOCOL_VERSION } from "@openclaw/gateway-protocol/version";
 import { randomUUID } from "node:crypto";
 import { WebSocket } from "ws";
-//#region \0rolldown/runtime.js
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);
-var __copyProps = (to, from, except, desc) => {
-	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
-		key = keys[i];
-		if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
-			get: ((k) => from[k]).bind(null, key),
-			enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
-		});
-	}
-	return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
-	value: mod,
-	enumerable: true
-}) : target, mod));
-//#endregion
+import ipaddr from "ipaddr.js";
+import { TLSSocket } from "node:tls";
 //#region packages/normalization-core/src/string-coerce.ts
 /** Trims string input and returns null for non-strings or empty strings. */
 function normalizeNullableString(value) {
@@ -52,966 +31,315 @@ function normalizeLowercaseStringOrEmpty(value) {
 	return normalizeOptionalLowercaseString(value) ?? "";
 }
 //#endregion
-//#region packages/net-policy/src/ip.ts
-var import_ipaddr = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin(((exports, module) => {
-	(function(root) {
-		"use strict";
-		const ipv4Part = "(0?\\d+|0x[a-f0-9]+)";
-		const ipv4Regexes = {
-			fourOctet: new RegExp(`^${ipv4Part}\\.${ipv4Part}\\.${ipv4Part}\\.${ipv4Part}$`, "i"),
-			threeOctet: new RegExp(`^${ipv4Part}\\.${ipv4Part}\\.${ipv4Part}$`, "i"),
-			twoOctet: new RegExp(`^${ipv4Part}\\.${ipv4Part}$`, "i"),
-			longValue: new RegExp(`^${ipv4Part}$`, "i")
-		};
-		const octalRegex = new RegExp(`^0[0-7]+$`, "i");
-		const hexRegex = new RegExp(`^0x[a-f0-9]+$`, "i");
-		const zoneIndex = "%[0-9a-z]{1,}";
-		const ipv6Part = "(?:[0-9a-f]+::?)+";
-		const ipv6Regexes = {
-			zoneIndex: new RegExp(zoneIndex, "i"),
-			"native": new RegExp(`^(::)?(${ipv6Part})?([0-9a-f]+)?(::)?(${zoneIndex})?$`, "i"),
-			deprecatedTransitional: new RegExp(`^(?:::)(${ipv4Part}\\.${ipv4Part}\\.${ipv4Part}\\.${ipv4Part}(${zoneIndex})?)$`, "i"),
-			transitional: new RegExp(`^((?:${ipv6Part})|(?:::)(?:${ipv6Part})?)${ipv4Part}\\.${ipv4Part}\\.${ipv4Part}\\.${ipv4Part}(${zoneIndex})?$`, "i")
-		};
-		function expandIPv6(string, parts) {
-			if (string.indexOf("::") !== string.lastIndexOf("::")) return null;
-			let colonCount = 0;
-			let lastColon = -1;
-			let zoneId = (string.match(ipv6Regexes.zoneIndex) || [])[0];
-			let replacement, replacementCount;
-			if (zoneId) {
-				zoneId = zoneId.substring(1);
-				string = string.replace(/%.+$/, "");
-			}
-			while ((lastColon = string.indexOf(":", lastColon + 1)) >= 0) colonCount++;
-			if (string.substr(0, 2) === "::") colonCount--;
-			if (string.substr(-2, 2) === "::") colonCount--;
-			if (colonCount > parts) return null;
-			replacementCount = parts - colonCount;
-			replacement = ":";
-			while (replacementCount--) replacement += "0:";
-			string = string.replace("::", replacement);
-			if (string[0] === ":") string = string.slice(1);
-			if (string[string.length - 1] === ":") string = string.slice(0, -1);
-			parts = (function() {
-				const ref = string.split(":");
-				const results = [];
-				for (let i = 0; i < ref.length; i++) results.push(parseInt(ref[i], 16));
-				return results;
-			})();
+//#region packages/net-policy/src/redact-sensitive-url.ts
+const SENSITIVE_URL_QUERY_PARAM_NAMES = /* @__PURE__ */ new Set([
+	"token",
+	"key",
+	"api_key",
+	"apikey",
+	"secret",
+	"access_token",
+	"auth_token",
+	"password",
+	"pass",
+	"passwd",
+	"auth",
+	"jwt",
+	"session",
+	"id_token",
+	"code",
+	"client_secret",
+	"app_secret",
+	"hook_token",
+	"refresh_token",
+	"signature",
+	"x_amz_signature",
+	"x_amz_security_token",
+	"private_key",
+	"credential",
+	"authorization",
+	"sig",
+	"x_api_key",
+	"x_access_token",
+	"x_auth_token"
+]);
+const URL_QUERY_NAME_SEPARATOR_RE = /[\p{C}\p{Z}\u115F\u1160\u3164\uFFA0+]/gu;
+const SUFFIXED_OR_SCOPED_TOKEN_QUERY_PARAM_RE = /(?:^|_)token(?:_[a-f0-9]{16,})?$/u;
+const TELEGRAM_BOT_TOKEN_PATH_RE = /\/bot\d{6,}(?::|%3[aA])[A-Za-z0-9_-]{20,}(?=\/|$)/giu;
+const MAX_NESTED_URL_REDACTION_DEPTH = 8;
+const URL_SCHEME_RE = /(?:^|[^a-z\d+.-])[a-z][a-z\d+.-]{0,31}:/iu;
+const SPECIAL_SCHEME_AUTHORITY_RE = /\b(?:https?|wss?|ftp):[\\/]{0,2}[^\\/?#\s]*/giu;
+const SPECIAL_SCHEME_SPILLED_USERINFO_RE = /\b(?:https?|wss?|ftp):[\\/]{0,2}[^\s]*@[^\\/?#\s]*/giu;
+const PROTOCOL_RELATIVE_AUTHORITY_RE = /[\\/]{2,}[^\\/?#\s]*/gu;
+function redactSensitiveUrlPath(value) {
+	return value.replace(TELEGRAM_BOT_TOKEN_PATH_RE, "/bot***");
+}
+function normalizeUrlQueryParamName(name) {
+	let current = name.replace(URL_QUERY_NAME_SEPARATOR_RE, "");
+	for (let depth = 0; depth <= MAX_NESTED_URL_REDACTION_DEPTH; depth += 1) {
+		let decoded;
+		try {
+			decoded = decodeURIComponent(current).replace(URL_QUERY_NAME_SEPARATOR_RE, "");
+		} catch {
 			return {
-				parts,
-				zoneId
+				value: normalizeLowercaseStringOrEmpty(current).replaceAll("-", "_"),
+				unresolvedEncoding: current.includes("%")
 			};
 		}
-		function matchCIDR(first, second, partSize, cidrBits) {
-			if (first.length !== second.length) throw new Error("ipaddr: cannot match CIDR for objects with different lengths");
-			let part = 0;
-			let shift;
-			while (cidrBits > 0) {
-				shift = partSize - cidrBits;
-				if (shift < 0) shift = 0;
-				if (first[part] >> shift !== second[part] >> shift) return false;
-				cidrBits -= partSize;
-				part += 1;
-			}
-			return true;
+		if (decoded === current) return {
+			value: normalizeLowercaseStringOrEmpty(current).replaceAll("-", "_"),
+			unresolvedEncoding: false
+		};
+		current = decoded;
+	}
+	return {
+		value: normalizeLowercaseStringOrEmpty(current).replaceAll("-", "_"),
+		unresolvedEncoding: current.includes("%")
+	};
+}
+function looksLikeNestedUrlValue(value) {
+	if (URL_SCHEME_RE.test(value)) return true;
+	const forwardAuthorityIndex = value.indexOf("//");
+	const backwardAuthorityIndex = value.indexOf("\\\\");
+	const authorityIndex = forwardAuthorityIndex < 0 ? backwardAuthorityIndex : backwardAuthorityIndex < 0 ? forwardAuthorityIndex : Math.min(forwardAuthorityIndex, backwardAuthorityIndex);
+	if (authorityIndex >= 0 && value.includes("@", authorityIndex + 2)) return true;
+	const queryIndex = value.search(/[?&]/u);
+	if (queryIndex >= 0 && value.includes("=", queryIndex + 1)) return true;
+	const fragmentIndex = value.indexOf("#");
+	if (fragmentIndex >= 0 && value.includes("=", fragmentIndex + 1)) return true;
+	return /%[\da-f]{2}/iu.test(value);
+}
+/** True for auth-like URL query parameter names that should be redacted. */
+function isSensitiveUrlQueryParamName$1(name) {
+	const normalized = normalizeUrlQueryParamName(name);
+	return normalized.unresolvedEncoding || SENSITIVE_URL_QUERY_PARAM_NAMES.has(normalized.value) || SUFFIXED_OR_SCOPED_TOKEN_QUERY_PARAM_RE.test(normalized.value);
+}
+function redactDirectSensitiveUrl(value) {
+	try {
+		const parsed = new URL(value);
+		let mutated = false;
+		const redactedPath = redactSensitiveUrlPath(parsed.pathname);
+		if (redactedPath !== parsed.pathname) {
+			parsed.pathname = redactedPath;
+			mutated = true;
 		}
-		function parseIntAuto(string) {
-			if (hexRegex.test(string)) return parseInt(string, 16);
-			if (string[0] === "0" && !isNaN(parseInt(string[1], 10))) {
-				if (octalRegex.test(string)) return parseInt(string, 8);
-				throw new Error(`ipaddr: cannot parse ${string} as octal`);
-			}
-			return parseInt(string, 10);
+		if (parsed.username || parsed.password) {
+			parsed.username = parsed.username ? "***" : "";
+			parsed.password = parsed.password ? "***" : "";
+			mutated = true;
 		}
-		function padPart(part, length) {
-			while (part.length < length) part = `0${part}`;
-			return part;
+		for (const key of Array.from(parsed.searchParams.keys())) if (isSensitiveUrlQueryParamName$1(key)) {
+			parsed.searchParams.set(key, "***");
+			mutated = true;
 		}
-		const ipaddr = {};
-		ipaddr.IPv4 = (function() {
-			function IPv4(octets) {
-				if (octets.length !== 4) throw new Error("ipaddr: ipv4 octet count should be 4");
-				let i, octet;
-				for (i = 0; i < octets.length; i++) {
-					octet = octets[i];
-					if (!(0 <= octet && octet <= 255)) throw new Error("ipaddr: ipv4 octet should fit in 8 bits");
-				}
-				this.octets = octets;
-			}
-			IPv4.prototype.SpecialRanges = {
-				unspecified: [[new IPv4([
-					0,
-					0,
-					0,
-					0
-				]), 8]],
-				broadcast: [[new IPv4([
-					255,
-					255,
-					255,
-					255
-				]), 32]],
-				multicast: [[new IPv4([
-					224,
-					0,
-					0,
-					0
-				]), 4]],
-				linkLocal: [[new IPv4([
-					169,
-					254,
-					0,
-					0
-				]), 16]],
-				loopback: [[new IPv4([
-					127,
-					0,
-					0,
-					0
-				]), 8]],
-				carrierGradeNat: [[new IPv4([
-					100,
-					64,
-					0,
-					0
-				]), 10]],
-				"private": [
-					[new IPv4([
-						10,
-						0,
-						0,
-						0
-					]), 8],
-					[new IPv4([
-						172,
-						16,
-						0,
-						0
-					]), 12],
-					[new IPv4([
-						192,
-						168,
-						0,
-						0
-					]), 16]
-				],
-				reserved: [
-					[new IPv4([
-						192,
-						0,
-						0,
-						0
-					]), 24],
-					[new IPv4([
-						192,
-						0,
-						2,
-						0
-					]), 24],
-					[new IPv4([
-						192,
-						88,
-						99,
-						0
-					]), 24],
-					[new IPv4([
-						198,
-						18,
-						0,
-						0
-					]), 15],
-					[new IPv4([
-						198,
-						51,
-						100,
-						0
-					]), 24],
-					[new IPv4([
-						203,
-						0,
-						113,
-						0
-					]), 24],
-					[new IPv4([
-						240,
-						0,
-						0,
-						0
-					]), 4]
-				],
-				as112: [[new IPv4([
-					192,
-					175,
-					48,
-					0
-				]), 24], [new IPv4([
-					192,
-					31,
-					196,
-					0
-				]), 24]],
-				amt: [[new IPv4([
-					192,
-					52,
-					193,
-					0
-				]), 24]]
-			};
-			IPv4.prototype.kind = function() {
-				return "ipv4";
-			};
-			IPv4.prototype.match = function(other, cidrRange) {
-				let ref;
-				if (cidrRange === void 0) {
-					ref = other;
-					other = ref[0];
-					cidrRange = ref[1];
-				}
-				if (other.kind() !== "ipv4") throw new Error("ipaddr: cannot match ipv4 address with non-ipv4 one");
-				return matchCIDR(this.octets, other.octets, 8, cidrRange);
-			};
-			IPv4.prototype.prefixLengthFromSubnetMask = function() {
-				let cidr = 0;
-				let stop = false;
-				const zerotable = {
-					0: 8,
-					128: 7,
-					192: 6,
-					224: 5,
-					240: 4,
-					248: 3,
-					252: 2,
-					254: 1,
-					255: 0
-				};
-				let i, octet, zeros;
-				for (i = 3; i >= 0; i -= 1) {
-					octet = this.octets[i];
-					if (octet in zerotable) {
-						zeros = zerotable[octet];
-						if (stop && zeros !== 0) return null;
-						if (zeros !== 8) stop = true;
-						cidr += zeros;
-					} else return null;
-				}
-				return 32 - cidr;
-			};
-			IPv4.prototype.range = function() {
-				return ipaddr.subnetMatch(this, this.SpecialRanges);
-			};
-			IPv4.prototype.toByteArray = function() {
-				return this.octets.slice(0);
-			};
-			IPv4.prototype.toIPv4MappedAddress = function() {
-				return ipaddr.IPv6.parse(`::ffff:${this.toString()}`);
-			};
-			IPv4.prototype.toNormalizedString = function() {
-				return this.toString();
-			};
-			IPv4.prototype.toString = function() {
-				return this.octets.join(".");
-			};
-			return IPv4;
-		})();
-		ipaddr.IPv4.broadcastAddressFromCIDR = function(string) {
-			try {
-				const cidr = this.parseCIDR(string);
-				const ipInterfaceOctets = cidr[0].toByteArray();
-				const subnetMaskOctets = this.subnetMaskFromPrefixLength(cidr[1]).toByteArray();
-				const octets = [];
-				let i = 0;
-				while (i < 4) {
-					octets.push(parseInt(ipInterfaceOctets[i], 10) | parseInt(subnetMaskOctets[i], 10) ^ 255);
-					i++;
-				}
-				return new this(octets);
-			} catch (e) {
-				throw new Error("ipaddr: the address does not have IPv4 CIDR format");
-			}
-		};
-		ipaddr.IPv4.isIPv4 = function(string) {
-			return this.parser(string) !== null;
-		};
-		ipaddr.IPv4.isValid = function(string) {
-			try {
-				new this(this.parser(string));
-				return true;
-			} catch (e) {
-				return false;
-			}
-		};
-		ipaddr.IPv4.isValidCIDR = function(string) {
-			try {
-				this.parseCIDR(string);
-				return true;
-			} catch (e) {
-				return false;
-			}
-		};
-		ipaddr.IPv4.isValidFourPartDecimal = function(string) {
-			if (ipaddr.IPv4.isValid(string) && string.match(/^(0|[1-9]\d*)(\.(0|[1-9]\d*)){3}$/)) return true;
-			else return false;
-		};
-		ipaddr.IPv4.isValidCIDRFourPartDecimal = function(string) {
-			const match = string.match(/^(.+)\/(\d+)$/);
-			if (!ipaddr.IPv4.isValidCIDR(string) || !match) return false;
-			return ipaddr.IPv4.isValidFourPartDecimal(match[1]);
-		};
-		ipaddr.IPv4.networkAddressFromCIDR = function(string) {
-			let cidr, i, ipInterfaceOctets, octets, subnetMaskOctets;
-			try {
-				cidr = this.parseCIDR(string);
-				ipInterfaceOctets = cidr[0].toByteArray();
-				subnetMaskOctets = this.subnetMaskFromPrefixLength(cidr[1]).toByteArray();
-				octets = [];
-				i = 0;
-				while (i < 4) {
-					octets.push(parseInt(ipInterfaceOctets[i], 10) & parseInt(subnetMaskOctets[i], 10));
-					i++;
-				}
-				return new this(octets);
-			} catch (e) {
-				throw new Error("ipaddr: the address does not have IPv4 CIDR format");
-			}
-		};
-		ipaddr.IPv4.parse = function(string) {
-			const parts = this.parser(string);
-			if (parts === null) throw new Error("ipaddr: string is not formatted like an IPv4 Address");
-			return new this(parts);
-		};
-		ipaddr.IPv4.parseCIDR = function(string) {
-			let match;
-			if (match = string.match(/^(.+)\/(\d+)$/)) {
-				const maskLength = parseInt(match[2]);
-				if (maskLength >= 0 && maskLength <= 32) {
-					const parsed = [this.parse(match[1]), maskLength];
-					Object.defineProperty(parsed, "toString", { value: function() {
-						return this.join("/");
-					} });
-					return parsed;
-				}
-			}
-			throw new Error("ipaddr: string is not formatted like an IPv4 CIDR range");
-		};
-		ipaddr.IPv4.parser = function(string) {
-			let match, part, value;
-			if (match = string.match(ipv4Regexes.fourOctet)) return (function() {
-				const ref = match.slice(1, 6);
-				const results = [];
-				for (let i = 0; i < ref.length; i++) {
-					part = ref[i];
-					results.push(parseIntAuto(part));
-				}
-				return results;
-			})();
-			else if (match = string.match(ipv4Regexes.longValue)) {
-				value = parseIntAuto(match[1]);
-				if (value > 4294967295 || value < 0) throw new Error("ipaddr: address outside defined range");
-				return (function() {
-					const results = [];
-					let shift;
-					for (shift = 0; shift <= 24; shift += 8) results.push(value >> shift & 255);
-					return results;
-				})().reverse();
-			} else if (match = string.match(ipv4Regexes.twoOctet)) return (function() {
-				const ref = match.slice(1, 4);
-				const results = [];
-				value = parseIntAuto(ref[1]);
-				if (value > 16777215 || value < 0) throw new Error("ipaddr: address outside defined range");
-				results.push(parseIntAuto(ref[0]));
-				results.push(value >> 16 & 255);
-				results.push(value >> 8 & 255);
-				results.push(value & 255);
-				return results;
-			})();
-			else if (match = string.match(ipv4Regexes.threeOctet)) return (function() {
-				const ref = match.slice(1, 5);
-				const results = [];
-				value = parseIntAuto(ref[2]);
-				if (value > 65535 || value < 0) throw new Error("ipaddr: address outside defined range");
-				results.push(parseIntAuto(ref[0]));
-				results.push(parseIntAuto(ref[1]));
-				results.push(value >> 8 & 255);
-				results.push(value & 255);
-				return results;
-			})();
-			else return null;
-		};
-		ipaddr.IPv4.subnetMaskFromPrefixLength = function(prefix) {
-			prefix = parseInt(prefix);
-			if (prefix < 0 || prefix > 32) throw new Error("ipaddr: invalid IPv4 prefix length");
-			const octets = [
-				0,
-				0,
-				0,
-				0
-			];
-			let j = 0;
-			const filledOctetCount = Math.floor(prefix / 8);
-			while (j < filledOctetCount) {
-				octets[j] = 255;
-				j++;
+		return mutated ? parsed.toString() : value;
+	} catch {
+		return value;
+	}
+}
+function redactQueryString(value, depth) {
+	const params = new URLSearchParams(value);
+	const entries = Array.from(params.entries());
+	const redactedEntries = [];
+	const seenSensitiveKeys = /* @__PURE__ */ new Set();
+	let mutated = false;
+	for (const [key, entryValue] of entries) {
+		if (isSensitiveUrlQueryParamName$1(key)) {
+			mutated = true;
+			if (!seenSensitiveKeys.has(key)) {
+				seenSensitiveKeys.add(key);
+				redactedEntries.push([key, "***"]);
 			}
-			if (filledOctetCount < 4) octets[filledOctetCount] = Math.pow(2, prefix % 8) - 1 << 8 - prefix % 8;
-			return new this(octets);
+			continue;
+		}
+		const redactedKey = redactNestedUrlValue(key, depth + 1);
+		const redactedValue = redactNestedUrlValue(entryValue, depth + 1);
+		if (redactedKey !== key || redactedValue !== entryValue) mutated = true;
+		redactedEntries.push([redactedKey, redactedValue]);
+	}
+	if (!mutated) return value;
+	const redactedParams = new URLSearchParams();
+	for (const [key, entryValue] of redactedEntries) redactedParams.append(key, entryValue);
+	return redactedParams.toString();
+}
+function redactUrlLikeFallback(value) {
+	return redactSensitiveUrlPath(redactEmbeddedUrlUserInfo(value).replace(/([?&])([^=&]+)=([^&]*)/g, (match, prefix, key) => isSensitiveUrlQueryParamName$1(key) ? `${prefix}${key}=***` : match));
+}
+function redactAuthorityUserInfo(candidate, authorityStart) {
+	const authority = candidate.slice(authorityStart);
+	const userInfoEnd = authority.lastIndexOf("@");
+	if (userInfoEnd < 0) return candidate;
+	return `${candidate.slice(0, authorityStart)}***:***@${authority.slice(userInfoEnd + 1)}`;
+}
+function redactEmbeddedUrlUserInfo(value) {
+	return value.replace(SPECIAL_SCHEME_AUTHORITY_RE, (candidate) => {
+		let authorityStart = candidate.indexOf(":") + 1;
+		while (authorityStart < candidate.length && (candidate[authorityStart] === "/" || candidate[authorityStart] === "\\")) authorityStart += 1;
+		return redactAuthorityUserInfo(candidate, authorityStart);
+	}).replace(SPECIAL_SCHEME_SPILLED_USERINFO_RE, (candidate) => {
+		let authorityStart = candidate.indexOf(":") + 1;
+		while (authorityStart < candidate.length && (candidate[authorityStart] === "/" || candidate[authorityStart] === "\\")) authorityStart += 1;
+		const userInfoEnd = candidate.lastIndexOf("@");
+		const firstReservedDelimiter = candidate.slice(authorityStart).search(/[\\/?#]/u);
+		if (userInfoEnd < 0 || firstReservedDelimiter < 0) return candidate;
+		const absoluteReservedDelimiter = authorityStart + firstReservedDelimiter;
+		if (absoluteReservedDelimiter >= userInfoEnd) return candidate;
+		const credentialSeparator = candidate.indexOf(":", authorityStart);
+		if (credentialSeparator < 0 || credentialSeparator > absoluteReservedDelimiter) return candidate;
+		const authorityPrefix = candidate.slice(authorityStart, absoluteReservedDelimiter);
+		const possiblePort = candidate.slice(credentialSeparator + 1, absoluteReservedDelimiter);
+		if (/^\d+$/u.test(possiblePort) || /^\[[^\]]+\](?::\d+)?$/u.test(authorityPrefix)) return candidate;
+		return `${candidate.slice(0, authorityStart)}***:***@${candidate.slice(userInfoEnd + 1)}`;
+	}).replace(PROTOCOL_RELATIVE_AUTHORITY_RE, (candidate) => {
+		let authorityStart = 0;
+		while (authorityStart < candidate.length && (candidate[authorityStart] === "/" || candidate[authorityStart] === "\\")) authorityStart += 1;
+		return redactAuthorityUserInfo(candidate, authorityStart);
+	});
+}
+function hasUnresolvedEmbeddedUrlUserInfo(value) {
+	for (const match of value.matchAll(/(?:\b(?:https?|wss?|ftp):[\\/]{0,2}|[\\/]{2,})/giu)) {
+		const remainder = value.slice((match.index ?? 0) + match[0].length);
+		const userInfoEnd = remainder.search(/(?<!\*\*\*:\*\*\*)@/u);
+		const authorityEnd = remainder.search(/[\\/?#]/u);
+		const pathBeforeAt = remainder.slice(authorityEnd + 1, userInfoEnd);
+		if (userInfoEnd >= 0 && (authorityEnd < 0 || userInfoEnd <= authorityEnd || remainder[authorityEnd] === "/" && (pathBeforeAt.includes(":") || /^[^/?#\s]+\.[^/?#\s]+(?:[/?#]|$)/u.test(remainder.slice(userInfoEnd + 1))))) return true;
+	}
+	return false;
+}
+function redactRelativeUrlFragment(value, depth) {
+	const fragmentIndex = value.indexOf("#");
+	if (fragmentIndex < 0) return value;
+	const fragment = value.slice(fragmentIndex + 1);
+	const redactedFragment = redactFragment(fragment, depth + 1);
+	return redactedFragment === fragment ? value : `${value.slice(0, fragmentIndex + 1)}${redactedFragment}`;
+}
+function redactFragment(value, depth) {
+	if (!value) return value;
+	if (depth > MAX_NESTED_URL_REDACTION_DEPTH && looksLikeNestedUrlValue(value)) return "***";
+	const wholeUrl = redactSensitiveUrlAtDepth(value, depth);
+	if (wholeUrl.parsedWholeUrl) return redactUrlLikeFallback(wholeUrl.value);
+	const candidate = value;
+	const firstQueryDelimiter = candidate.search(/[?&]/u);
+	const firstEquals = candidate.indexOf("=");
+	if (firstEquals >= 0 && (firstQueryDelimiter < 0 || firstEquals < firstQueryDelimiter)) return redactQueryString(candidate, depth);
+	const hashRouterQueryIndex = candidate.indexOf("?");
+	if (hashRouterQueryIndex >= 0) {
+		const redactedQuery = redactQueryString(candidate.slice(hashRouterQueryIndex + 1), depth);
+		return `${redactEncodedUrlLikeString(redactUrlLikeFallback(candidate.slice(0, hashRouterQueryIndex + 1)), depth + 1)}${redactedQuery}`;
+	}
+	const fallback = redactUrlLikeFallback(candidate);
+	if (!looksLikeNestedUrlValue(fallback)) return fallback;
+	let decoded;
+	try {
+		decoded = decodeURIComponent(fallback);
+	} catch {
+		return "***";
+	}
+	if (decoded === fallback) return fallback;
+	const redactedDecoded = redactFragment(decoded, depth + 1);
+	return redactedDecoded === decoded ? fallback : encodeURIComponent(redactedDecoded);
+}
+function redactEncodedNestedUrlPath(value, depth) {
+	if (!looksLikeNestedUrlValue(value)) return value;
+	if (depth > MAX_NESTED_URL_REDACTION_DEPTH) return "***";
+	let decoded;
+	try {
+		decoded = decodeURIComponent(value);
+	} catch {
+		return "***";
+	}
+	if (decoded === value) return value;
+	const direct = redactSensitiveUrlLikeStringAtDepth(decoded, depth);
+	if (direct.value !== decoded || hasUnresolvedEmbeddedUrlUserInfo(decoded)) return direct.value !== decoded ? direct.value : "***";
+	if (direct.parsedWholeUrl) return value;
+	const nested = redactEncodedNestedUrlPath(decoded, depth + 1);
+	return nested === decoded ? value : nested;
+}
+function redactSensitiveUrlAtDepth(value, depth) {
+	try {
+		const directRedaction = redactDirectSensitiveUrl(value);
+		const parsed = new URL(directRedaction);
+		if (depth > MAX_NESTED_URL_REDACTION_DEPTH) return {
+			value: "***",
+			parsedWholeUrl: true
 		};
-		ipaddr.IPv6 = (function() {
-			function IPv6(parts, zoneId) {
-				let i, part;
-				if (parts.length === 16) {
-					this.parts = [];
-					for (i = 0; i <= 14; i += 2) this.parts.push(parts[i] << 8 | parts[i + 1]);
-				} else if (parts.length === 8) this.parts = parts;
-				else throw new Error("ipaddr: ipv6 part count should be 8 or 16");
-				for (i = 0; i < this.parts.length; i++) {
-					part = this.parts[i];
-					if (!(0 <= part && part <= 65535)) throw new Error("ipaddr: ipv6 part should fit in 16 bits");
-				}
-				if (zoneId) this.zoneId = zoneId;
-			}
-			IPv6.prototype.SpecialRanges = {
-				unspecified: [new IPv6([
-					0,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0
-				]), 128],
-				linkLocal: [new IPv6([
-					65152,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0
-				]), 10],
-				multicast: [new IPv6([
-					65280,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0
-				]), 8],
-				loopback: [new IPv6([
-					0,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0,
-					1
-				]), 128],
-				uniqueLocal: [new IPv6([
-					64512,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0
-				]), 7],
-				ipv4Mapped: [new IPv6([
-					0,
-					0,
-					0,
-					0,
-					0,
-					65535,
-					0,
-					0
-				]), 96],
-				deprecatedSiteLocal: [new IPv6([
-					65216,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0
-				]), 10],
-				discard: [new IPv6([
-					256,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0
-				]), 64],
-				rfc6145: [new IPv6([
-					0,
-					0,
-					0,
-					0,
-					65535,
-					0,
-					0,
-					0
-				]), 96],
-				rfc6052: [[new IPv6([
-					100,
-					65435,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0
-				]), 96], [new IPv6([
-					100,
-					65435,
-					1,
-					0,
-					0,
-					0,
-					0,
-					0
-				]), 48]],
-				"6to4": [new IPv6([
-					8194,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0
-				]), 16],
-				teredo: [new IPv6([
-					8193,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0
-				]), 32],
-				benchmarking: [new IPv6([
-					8193,
-					2,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0
-				]), 48],
-				amt: [new IPv6([
-					8193,
-					3,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0
-				]), 32],
-				as112v6: [[new IPv6([
-					8193,
-					4,
-					274,
-					0,
-					0,
-					0,
-					0,
-					0
-				]), 48], [new IPv6([
-					9760,
-					79,
-					32768,
-					0,
-					0,
-					0,
-					0,
-					0
-				]), 48]],
-				deprecatedOrchid: [new IPv6([
-					8193,
-					16,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0
-				]), 28],
-				orchid2: [new IPv6([
-					8193,
-					32,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0
-				]), 28],
-				droneRemoteIdProtocolEntityTags: [new IPv6([
-					8193,
-					48,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0
-				]), 28],
-				segmentRouting: [new IPv6([
-					24320,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0
-				]), 16],
-				reserved: [
-					[new IPv6([
-						8193,
-						0,
-						0,
-						0,
-						0,
-						0,
-						0,
-						0
-					]), 23],
-					[new IPv6([
-						8193,
-						3512,
-						0,
-						0,
-						0,
-						0,
-						0,
-						0
-					]), 32],
-					[new IPv6([
-						16383,
-						0,
-						0,
-						0,
-						0,
-						0,
-						0,
-						0
-					]), 20]
-				]
-			};
-			IPv6.prototype.isIPv4MappedAddress = function() {
-				return this.range() === "ipv4Mapped";
+		let mutated = directRedaction !== value;
+		const redactedNestedPath = redactEmbeddedUrlUserInfo(redactEncodedNestedUrlPath(parsed.pathname, depth + 1));
+		if (redactedNestedPath !== parsed.pathname) {
+			const originalPath = parsed.pathname;
+			parsed.pathname = redactedNestedPath;
+			if (parsed.pathname === originalPath) return {
+				value: directRedaction,
+				parsedWholeUrl: false
 			};
-			IPv6.prototype.kind = function() {
-				return "ipv6";
-			};
-			IPv6.prototype.match = function(other, cidrRange) {
-				let ref;
-				if (cidrRange === void 0) {
-					ref = other;
-					other = ref[0];
-					cidrRange = ref[1];
-				}
-				if (other.kind() !== "ipv6") throw new Error("ipaddr: cannot match ipv6 address with non-ipv6 one");
-				return matchCIDR(this.parts, other.parts, 16, cidrRange);
-			};
-			IPv6.prototype.prefixLengthFromSubnetMask = function() {
-				let cidr = 0;
-				let stop = false;
-				const zerotable = {
-					0: 16,
-					32768: 15,
-					49152: 14,
-					57344: 13,
-					61440: 12,
-					63488: 11,
-					64512: 10,
-					65024: 9,
-					65280: 8,
-					65408: 7,
-					65472: 6,
-					65504: 5,
-					65520: 4,
-					65528: 3,
-					65532: 2,
-					65534: 1,
-					65535: 0
-				};
-				let part, zeros;
-				for (let i = 7; i >= 0; i -= 1) {
-					part = this.parts[i];
-					if (part in zerotable) {
-						zeros = zerotable[part];
-						if (stop && zeros !== 0) return null;
-						if (zeros !== 16) stop = true;
-						cidr += zeros;
-					} else return null;
-				}
-				return 128 - cidr;
-			};
-			IPv6.prototype.range = function() {
-				return ipaddr.subnetMatch(this, this.SpecialRanges);
-			};
-			IPv6.prototype.toByteArray = function() {
-				let part;
-				const bytes = [];
-				const ref = this.parts;
-				for (let i = 0; i < ref.length; i++) {
-					part = ref[i];
-					bytes.push(part >> 8);
-					bytes.push(part & 255);
-				}
-				return bytes;
-			};
-			IPv6.prototype.toFixedLengthString = function() {
-				const addr = (function() {
-					const results = [];
-					for (let i = 0; i < this.parts.length; i++) results.push(padPart(this.parts[i].toString(16), 4));
-					return results;
-				}).call(this).join(":");
-				let suffix = "";
-				if (this.zoneId) suffix = `%${this.zoneId}`;
-				return addr + suffix;
-			};
-			IPv6.prototype.toIPv4Address = function() {
-				if (!this.isIPv4MappedAddress()) throw new Error("ipaddr: trying to convert a generic ipv6 address to ipv4");
-				const ref = this.parts.slice(-2);
-				const high = ref[0];
-				const low = ref[1];
-				return new ipaddr.IPv4([
-					high >> 8,
-					high & 255,
-					low >> 8,
-					low & 255
-				]);
-			};
-			IPv6.prototype.toNormalizedString = function() {
-				const addr = (function() {
-					const results = [];
-					for (let i = 0; i < this.parts.length; i++) results.push(this.parts[i].toString(16));
-					return results;
-				}).call(this).join(":");
-				let suffix = "";
-				if (this.zoneId) suffix = `%${this.zoneId}`;
-				return addr + suffix;
-			};
-			IPv6.prototype.toRFC5952String = function() {
-				const regex = /((^|:)(0(:|$)){2,})/g;
-				const string = this.toNormalizedString();
-				let bestMatchIndex = 0;
-				let bestMatchLength = -1;
-				let match;
-				while (match = regex.exec(string)) if (match[0].length > bestMatchLength) {
-					bestMatchIndex = match.index;
-					bestMatchLength = match[0].length;
-				}
-				if (bestMatchLength < 0) return string;
-				return `${string.substring(0, bestMatchIndex)}::${string.substring(bestMatchIndex + bestMatchLength)}`;
-			};
-			IPv6.prototype.toString = function() {
-				return this.toRFC5952String();
-			};
-			return IPv6;
-		})();
-		ipaddr.IPv6.broadcastAddressFromCIDR = function(string) {
-			try {
-				const cidr = this.parseCIDR(string);
-				const ipInterfaceOctets = cidr[0].toByteArray();
-				const subnetMaskOctets = this.subnetMaskFromPrefixLength(cidr[1]).toByteArray();
-				const octets = [];
-				let i = 0;
-				while (i < 16) {
-					octets.push(parseInt(ipInterfaceOctets[i], 10) | parseInt(subnetMaskOctets[i], 10) ^ 255);
-					i++;
-				}
-				return new this(octets);
-			} catch (e) {
-				throw new Error(`ipaddr: the address does not have IPv6 CIDR format (${e})`);
-			}
-		};
-		ipaddr.IPv6.isIPv6 = function(string) {
-			return this.parser(string) !== null;
-		};
-		ipaddr.IPv6.isValid = function(string) {
-			if (typeof string === "string" && string.indexOf(":") === -1) return false;
-			try {
-				const addr = this.parser(string);
-				new this(addr.parts, addr.zoneId);
-				return true;
-			} catch (e) {
-				return false;
-			}
-		};
-		ipaddr.IPv6.isValidCIDR = function(string) {
-			if (typeof string === "string" && string.indexOf(":") === -1) return false;
-			try {
-				this.parseCIDR(string);
-				return true;
-			} catch (e) {
-				return false;
-			}
-		};
-		ipaddr.IPv6.networkAddressFromCIDR = function(string) {
-			let cidr, i, ipInterfaceOctets, octets, subnetMaskOctets;
-			try {
-				cidr = this.parseCIDR(string);
-				ipInterfaceOctets = cidr[0].toByteArray();
-				subnetMaskOctets = this.subnetMaskFromPrefixLength(cidr[1]).toByteArray();
-				octets = [];
-				i = 0;
-				while (i < 16) {
-					octets.push(parseInt(ipInterfaceOctets[i], 10) & parseInt(subnetMaskOctets[i], 10));
-					i++;
-				}
-				return new this(octets);
-			} catch (e) {
-				throw new Error(`ipaddr: the address does not have IPv6 CIDR format (${e})`);
-			}
-		};
-		ipaddr.IPv6.parse = function(string) {
-			const addr = this.parser(string);
-			if (addr.parts === null) throw new Error("ipaddr: string is not formatted like an IPv6 Address");
-			return new this(addr.parts, addr.zoneId);
-		};
-		ipaddr.IPv6.parseCIDR = function(string) {
-			let maskLength, match, parsed;
-			if (match = string.match(/^(.+)\/(\d+)$/)) {
-				maskLength = parseInt(match[2]);
-				if (maskLength >= 0 && maskLength <= 128) {
-					parsed = [this.parse(match[1]), maskLength];
-					Object.defineProperty(parsed, "toString", { value: function() {
-						return this.join("/");
-					} });
-					return parsed;
-				}
-			}
-			throw new Error("ipaddr: string is not formatted like an IPv6 CIDR range");
-		};
-		ipaddr.IPv6.parser = function(string) {
-			let addr, i, match, octet, octets, zoneId;
-			if (match = string.match(ipv6Regexes.deprecatedTransitional)) return this.parser(`::ffff:${match[1]}`);
-			if (ipv6Regexes.native.test(string)) return expandIPv6(string, 8);
-			if (match = string.match(ipv6Regexes.transitional)) {
-				zoneId = match[6] || "";
-				addr = match[1];
-				if (!match[1].endsWith("::")) addr = addr.slice(0, -1);
-				addr = expandIPv6(addr + zoneId, 6);
-				if (addr.parts) {
-					octets = [
-						parseInt(match[2]),
-						parseInt(match[3]),
-						parseInt(match[4]),
-						parseInt(match[5])
-					];
-					for (i = 0; i < octets.length; i++) {
-						octet = octets[i];
-						if (!(0 <= octet && octet <= 255)) return null;
-					}
-					addr.parts.push(octets[0] << 8 | octets[1]);
-					addr.parts.push(octets[2] << 8 | octets[3]);
-					return {
-						parts: addr.parts,
-						zoneId: addr.zoneId
-					};
-				}
-			}
-			return null;
-		};
-		ipaddr.IPv6.subnetMaskFromPrefixLength = function(prefix) {
-			prefix = parseInt(prefix);
-			if (prefix < 0 || prefix > 128) throw new Error("ipaddr: invalid IPv6 prefix length");
-			const octets = [
-				0,
-				0,
-				0,
-				0,
-				0,
-				0,
-				0,
-				0,
-				0,
-				0,
-				0,
-				0,
-				0,
-				0,
-				0,
-				0
-			];
-			let j = 0;
-			const filledOctetCount = Math.floor(prefix / 8);
-			while (j < filledOctetCount) {
-				octets[j] = 255;
-				j++;
-			}
-			if (filledOctetCount < 16) octets[filledOctetCount] = Math.pow(2, prefix % 8) - 1 << 8 - prefix % 8;
-			return new this(octets);
-		};
-		ipaddr.fromByteArray = function(bytes) {
-			const length = bytes.length;
-			if (length === 4) return new ipaddr.IPv4(bytes);
-			else if (length === 16) return new ipaddr.IPv6(bytes);
-			else throw new Error("ipaddr: the binary input is neither an IPv6 nor IPv4 address");
-		};
-		ipaddr.isValid = function(string) {
-			return ipaddr.IPv6.isValid(string) || ipaddr.IPv4.isValid(string);
-		};
-		ipaddr.isValidCIDR = function(string) {
-			return ipaddr.IPv6.isValidCIDR(string) || ipaddr.IPv4.isValidCIDR(string);
-		};
-		ipaddr.parse = function(string) {
-			if (ipaddr.IPv6.isValid(string)) return ipaddr.IPv6.parse(string);
-			else if (ipaddr.IPv4.isValid(string)) return ipaddr.IPv4.parse(string);
-			else throw new Error("ipaddr: the address has neither IPv6 nor IPv4 format");
-		};
-		ipaddr.parseCIDR = function(string) {
-			try {
-				return ipaddr.IPv6.parseCIDR(string);
-			} catch (e) {
-				try {
-					return ipaddr.IPv4.parseCIDR(string);
-				} catch (e2) {
-					throw new Error("ipaddr: the address has neither IPv6 nor IPv4 CIDR format");
-				}
-			}
-		};
-		ipaddr.process = function(string) {
-			const addr = this.parse(string);
-			if (addr.kind() === "ipv6" && addr.isIPv4MappedAddress()) return addr.toIPv4Address();
-			else return addr;
+			mutated = true;
+		}
+		const redactedQuery = redactQueryString(parsed.search.slice(1), depth);
+		if (redactedQuery !== parsed.search.slice(1)) {
+			parsed.search = redactedQuery;
+			mutated = true;
+		}
+		const fragment = parsed.hash.slice(1);
+		const redactedHash = redactFragment(fragment, depth + 1);
+		if (redactedHash !== fragment) {
+			parsed.hash = redactedHash;
+			mutated = true;
+		}
+		return {
+			value: mutated ? parsed.toString() : value,
+			parsedWholeUrl: true
 		};
-		ipaddr.subnetMatch = function(address, rangeList, defaultName) {
-			let i, rangeName, rangeSubnets, subnet;
-			if (defaultName === void 0 || defaultName === null) defaultName = "unicast";
-			for (rangeName in rangeList) if (Object.prototype.hasOwnProperty.call(rangeList, rangeName)) {
-				rangeSubnets = rangeList[rangeName];
-				if (rangeSubnets[0] && !(rangeSubnets[0] instanceof Array)) rangeSubnets = [rangeSubnets];
-				for (i = 0; i < rangeSubnets.length; i++) {
-					subnet = rangeSubnets[i];
-					if (address.kind() === subnet[0].kind() && address.match.apply(address, subnet)) return rangeName;
-				}
-			}
-			return defaultName;
+	} catch {
+		return {
+			value,
+			parsedWholeUrl: false
 		};
-		if (typeof module !== "undefined" && module.exports) module.exports = ipaddr;
-		else root.ipaddr = ipaddr;
-	})(exports);
-})))(), 1);
-import_ipaddr.default.IPv4.parse("198.18.0.0");
+	}
+}
+function redactSensitiveUrlLikeStringAtDepth(value, depth) {
+	const redactedUrl = redactSensitiveUrlAtDepth(value, depth);
+	if (redactedUrl.parsedWholeUrl) return redactedUrl;
+	return {
+		value: redactEncodedUrlLikeString(redactRelativeUrlFragment(redactUrlLikeFallback(redactedUrl.value), depth), depth + 1),
+		parsedWholeUrl: false
+	};
+}
+function redactEncodedUrlLikeString(value, depth) {
+	if (!looksLikeNestedUrlValue(value)) return value;
+	if (depth > MAX_NESTED_URL_REDACTION_DEPTH) return "***";
+	let decoded;
+	try {
+		decoded = decodeURIComponent(value);
+	} catch {
+		return "***";
+	}
+	if (decoded === value) return value;
+	const redactedDecoded = redactSensitiveUrlLikeStringAtDepth(decoded, depth + 1);
+	if (redactedDecoded.value !== decoded || redactedDecoded.parsedWholeUrl) return redactedDecoded.value === decoded ? value : redactedDecoded.value;
+	return hasUnresolvedEmbeddedUrlUserInfo(decoded) ? "***" : value;
+}
+function redactNestedUrlValue(value, depth) {
+	if (!looksLikeNestedUrlValue(value)) return value;
+	if (depth > MAX_NESTED_URL_REDACTION_DEPTH) return "***";
+	const direct = redactSensitiveUrlLikeStringAtDepth(value, depth);
+	if (direct.value !== value) return direct.value;
+	if (hasUnresolvedEmbeddedUrlUserInfo(value)) return "***";
+	if (direct.parsedWholeUrl) return value;
+	let decoded;
+	try {
+		decoded = decodeURIComponent(value);
+	} catch {
+		return "***";
+	}
+	if (decoded === value || !looksLikeNestedUrlValue(decoded)) return value;
+	const redactedDecoded = redactNestedUrlValue(decoded, depth + 1);
+	return redactedDecoded === decoded ? value : encodeURIComponent(redactedDecoded);
+}
+/** Redacts sensitive URL-looking substrings even when the full value is not a valid URL. */
+function redactSensitiveUrlLikeString(value) {
+	return redactSensitiveUrlLikeStringAtDepth(value, 0).value;
+}
+ipaddr.IPv4.parse("198.18.0.0");
 function stripIpv6Brackets(value) {
 	if (value.startsWith("[") && value.endsWith("]")) return value.slice(1, -1);
 	return value;
@@ -1034,7 +362,7 @@ function normalizeIpParseInput(raw) {
 function parseCanonicalIpAddress(raw) {
 	const normalized = normalizeIpParseInput(raw);
 	if (!normalized) return;
-	return import_ipaddr.default.IPv4.isValidFourPartDecimal(normalized) || import_ipaddr.default.IPv6.isValid(normalized) ? import_ipaddr.default.parse(normalized) : void 0;
+	return ipaddr.IPv4.isValidFourPartDecimal(normalized) || ipaddr.IPv6.isValid(normalized) ? ipaddr.parse(normalized) : void 0;
 }
 /** Normalizes canonical IP literals and maps IPv4-mapped IPv6 addresses to IPv4 text. */
 function normalizeIpAddress(raw) {
@@ -1056,8 +384,12 @@ function normalizeGatewayErrorText(value) {
 function isSensitiveUrlQueryParamName(key) {
 	return /(?:token|password|secret|key|auth|credential)/iu.test(key);
 }
-function normalizeFingerprint(fingerprint) {
-	return (fingerprint ?? "").replaceAll(":", "").trim().toLowerCase();
+const SHA256_HEX_FINGERPRINT = /^[a-fA-F0-9]{64}$/u;
+const SHA256_COLON_FINGERPRINT = /^(?:[a-fA-F0-9]{2}:){31}[a-fA-F0-9]{2}$/u;
+function normalizeTlsFingerprint(fingerprint) {
+	const value = (fingerprint ?? "").trim().replace(/^sha256:/iu, "");
+	if (SHA256_HEX_FINGERPRINT.test(value)) return value.toLowerCase();
+	return SHA256_COLON_FINGERPRINT.test(value) ? value.replaceAll(":", "").toLowerCase() : "";
 }
 function parseHostForAddressChecks(host) {
 	if (!host) return null;
@@ -1153,6 +485,7 @@ function isSecureWebSocketUrl(rawUrl, options) {
 	}
 }
 var GatewayWebSocketTransportConfigurationError = class extends Error {};
+var GatewayWebSocketTlsPinError = class extends Error {};
 function resolveGatewayWebSocketTransport(params) {
 	const usesTls = isWssUrl(params.url);
 	if (params.tlsFingerprint && !usesTls) throw new GatewayWebSocketTransportConfigurationError("gateway tls fingerprint requires wss:// gateway url");
@@ -1164,32 +497,41 @@ function resolveGatewayWebSocketTransport(params) {
 		} catch {}
 		throw new GatewayWebSocketTransportConfigurationError(`SECURITY ERROR: Cannot connect to "${displayHost}" over plaintext ws://. Both credentials and chat data would be exposed to network interception. Use wss:// for remote URLs. Safe defaults: keep gateway.bind=loopback and connect via SSH tunnel (ssh -N -L 18789:127.0.0.1:18789 user@gateway-host), or use Tailscale Serve/Funnel. ` + (allowPrivateWs ? "" : "Break-glass (trusted private networks only): set OPENCLAW_ALLOW_INSECURE_PRIVATE_WS=1. ") + "Run `openclaw doctor --fix` for guidance.");
 	}
-	const normalize = params.normalizeTlsFingerprint ?? normalizeFingerprint;
+	const normalize = params.normalizeTlsFingerprint ?? normalizeTlsFingerprint;
+	const expectedFingerprint = params.tlsFingerprint ? normalizeTlsFingerprint(params.tlsFingerprint) : void 0;
+	if (params.tlsFingerprint && !expectedFingerprint) throw new GatewayWebSocketTransportConfigurationError("gateway tls fingerprint must be a SHA-256 fingerprint");
 	const options = { ...params.options };
-	if (usesTls && params.tlsFingerprint) {
-		options.rejectUnauthorized = false;
-		options.checkServerIdentity = (_hostValue, cert) => {
-			const fingerprintValue = typeof cert === "object" && cert && "fingerprint256" in cert ? cert.fingerprint256 ?? "" : "";
-			const fingerprint = normalize(typeof fingerprintValue === "string" ? fingerprintValue : "");
-			const expected = normalize(params.tlsFingerprint);
-			if (!expected) return;
-			if (!fingerprint) return /* @__PURE__ */ new Error("Missing server TLS fingerprint");
-			if (fingerprint !== expected) return /* @__PURE__ */ new Error("Server TLS fingerprint mismatch");
-		};
-	}
-	return {
-		options,
-		validateSocket: (socket) => {
-			if (!params.tlsFingerprint) return null;
-			const expected = normalize(params.tlsFingerprint);
-			if (!expected) return /* @__PURE__ */ new Error("gateway tls fingerprint missing");
-			const rawSocket = socket["_socket"];
-			if (!rawSocket || typeof rawSocket.getPeerCertificate !== "function") return /* @__PURE__ */ new Error("gateway tls fingerprint unavailable");
-			const cert = rawSocket.getPeerCertificate();
-			const fingerprint = normalize(cert?.fingerprint256 ?? "");
-			if (!fingerprint) return /* @__PURE__ */ new Error("gateway tls fingerprint unavailable");
-			return fingerprint === expected ? null : /* @__PURE__ */ new Error("gateway tls fingerprint mismatch");
-		}
+	if (usesTls && expectedFingerprint) applyGatewayWebSocketTlsPin(options, expectedFingerprint, normalize);
+	return { options };
+}
+function applyGatewayWebSocketTlsPin(options, expectedFingerprint, normalize = normalizeTlsFingerprint) {
+	options.rejectUnauthorized = false;
+	const headers = { ...options.headers };
+	const deferredHeaders = Object.entries(headers).filter(([key]) => key.toLowerCase() === "expect");
+	for (const [key] of deferredHeaders) delete headers[key];
+	options.headers = headers;
+	options.finishRequest = (request) => {
+		request.once("socket", (socket) => {
+			if (!(socket instanceof TLSSocket)) {
+				request.destroy(new GatewayWebSocketTlsPinError("gateway tls fingerprint unavailable"));
+				return;
+			}
+			const validatePin = () => {
+				if (request.destroyed) return;
+				const canonicalFingerprint = normalizeTlsFingerprint(socket.getPeerCertificate()?.fingerprint256);
+				const fingerprint = canonicalFingerprint ? normalize(canonicalFingerprint) : "";
+				if (!fingerprint || fingerprint !== normalize(expectedFingerprint)) {
+					request.destroy(new GatewayWebSocketTlsPinError(fingerprint ? "gateway tls fingerprint mismatch" : "gateway tls fingerprint unavailable"));
+					return;
+				}
+				for (const [key, value] of deferredHeaders) if (value !== void 0) request.setHeader(key, value);
+				request.end();
+			};
+			if (socket.secureConnecting) {
+				socket.once("secureConnect", validatePin);
+				request.once("close", () => socket.off("secureConnect", validatePin));
+			} else validatePin();
+		});
 	};
 }
 //#endregion
@@ -1210,7 +552,7 @@ const DEFAULT_HOST_DEPS = {
 	logDebug: () => {},
 	logError: () => {},
 	redactForLog: (message) => message,
-	normalizeTlsFingerprint: normalizeFingerprint
+	normalizeTlsFingerprint
 };
 function resolveHostDeps(overrides) {
 	return Object.fromEntries(Object.entries(DEFAULT_HOST_DEPS).map(([key, fallback]) => [key, overrides?.[key] ?? fallback]));
@@ -1370,6 +712,11 @@ var GatewayClient = class {
 			},
 			notifyStoppedClose: true,
 			onConnectError: (error) => this.notifyConnectError(error),
+			onReconnectStopped: (error) => this.notifyReconnectPaused({
+				code: 1008,
+				reason: error.message,
+				detailCode: null
+			}),
 			onParseError: (error) => this.logDebug(`gateway client parse error: ${formatGatewayClientErrorForLog(error)}`),
 			onEvent: (event) => this.opts.onEvent?.(event),
 			onGap: (info) => this.opts.onGap?.(info),
@@ -1416,6 +763,9 @@ var GatewayClient = class {
 	}
 	createSocket(handlers) {
 		const url = this.opts.url ?? DEFAULT_GATEWAY_CLIENT_URL;
+		const configuredEdgeAuthHeaders = this.opts.edgeAuthHeaders;
+		const edgeAuthHeaders = configuredEdgeAuthHeaders && Object.keys(configuredEdgeAuthHeaders).length > 0 ? configuredEdgeAuthHeaders : void 0;
+		if (edgeAuthHeaders && new URL(url).protocol !== "wss:") throw new GatewayWebSocketTransportConfigurationError("edge auth headers require a wss:// Gateway URL");
 		const handshakeTimeoutMs = resolvePreauthHandshakeTimeoutMs({
 			env: this.opts.env,
 			configuredTimeoutMs: this.opts.preauthHandshakeTimeoutMs
@@ -1428,7 +778,11 @@ var GatewayClient = class {
 			options: {
 				maxPayload: 25 * 1024 * 1024,
 				handshakeTimeout: handshakeTimeoutMs,
-				...this.opts.origin ? { origin: this.opts.origin } : {}
+				...this.opts.origin ? { origin: this.opts.origin } : {},
+				...edgeAuthHeaders ? {
+					followRedirects: false,
+					headers: edgeAuthHeaders
+				} : {}
 			}
 		});
 		this.deps.beforeConnect();
@@ -1451,14 +805,8 @@ var GatewayClient = class {
 		this.transportValidated = false;
 		let upgradeError;
 		ws.on("open", () => {
-			handlers.open();
-			const tlsError = transport.validateSocket(ws);
-			if (tlsError) {
-				handlers.error(tlsError);
-				ws.close(1008, tlsError.message);
-				return;
-			}
 			this.transportValidated = true;
+			handlers.open();
 		});
 		ws.on("message", (data) => handlers.message(rawDataToString(data)));
 		ws.on("close", (code, reason) => {
@@ -1470,13 +818,26 @@ var GatewayClient = class {
 		ws.on("unexpected-response", (request, response) => {
 			readUpgradeErrorBody(response).then((body) => {
 				const statusCode = response.statusCode;
+				let gatewayError;
+				try {
+					const parsed = JSON.parse(body);
+					const parsedError = isRecord(parsed) ? parsed.error : void 0;
+					gatewayError = isRecord(parsedError) ? parsedError : void 0;
+				} catch {}
+				const rawLocation = response.headers.location;
+				const location = rawLocation ? redactSensitiveUrlLikeString(Array.isArray(rawLocation) ? rawLocation[0] ?? "" : rawLocation) : void 0;
 				upgradeError = new GatewayClientRequestError({
 					code: "UNAVAILABLE",
 					message: `gateway rejected websocket upgrade (HTTP ${statusCode ?? "unknown"})${body ? `: ${body}` : ""}`,
 					retryable: true,
 					details: {
 						reason: "websocket-upgrade-rejected",
-						...statusCode === void 0 ? {} : { httpStatus: statusCode }
+						...statusCode === void 0 ? {} : { httpStatus: statusCode },
+						...location ? { location } : {},
+						...typeof gatewayError?.type === "string" ? {
+							gatewayErrorType: gatewayError.type,
+							...typeof gatewayError.message === "string" ? { gatewayErrorMessage: gatewayError.message } : {}
+						} : {}
 					}
 				});
 				handlers.error(upgradeError);
@@ -1734,6 +1095,7 @@ var GatewayClient = class {
 				closeReason: "connect retry"
 			};
 		}
+		this.nodeProtocolTransitionPending = false;
 		const role = this.opts.role ?? "operator";
 		const detailCode = error instanceof GatewayClientRequestError ? readConnectErrorDetailCode(error.details) : null;
 		const shouldRetryWithDeviceToken = shouldRetryGatewayWithDeviceToken({
@@ -1813,7 +1175,7 @@ var GatewayClient = class {
 		const details = context.connectFailure?.error instanceof GatewayClientRequestError ? context.connectFailure.error.details : void 0;
 		if (context.code === 1013 && context.connectFailure?.reconnectDelayMs !== void 0) return {
 			retry: true,
-			notify: false,
+			notify: this.opts.notifyOnStartupRetry === true,
 			reconnectDelayMs: context.connectFailure.reconnectDelayMs
 		};
 		if (info.transientPreHelloCleanClose && this.suppressedTransientPreHelloCleanCloses < MAX_SUPPRESSED_TRANSIENT_PRE_HELLO_CLEAN_CLOSES) {
@@ -1834,6 +1196,7 @@ var GatewayClient = class {
 			details,
 			deviceTokenRetryPending: this.pendingDeviceTokenRetry,
 			tokenMismatchIsTerminal: true,
+			protocolMismatchIsTerminal: !this.nodeProtocolTransitionPending,
 			clientVersionMismatchIsTerminal: true
 		})) {
 			this.notifyReconnectPaused({
@@ -1969,4 +1332,15 @@ function createGatewayRequestAbortError(method) {
 	return err;
 }
 //#endregion
-export { DEFAULT_GATEWAY_REQUEST_TIMEOUT_MS, DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS, GatewayBrowserDeviceAuthLifecycle, GatewayClient, GatewayClientRequestError, GatewayClientRequestTimeoutError, GatewayScopeUpgrade, GatewaySessionMessageSubscriptionCoordinator, MAX_CONNECT_CHALLENGE_TIMEOUT_MS, MAX_SAFE_TIMEOUT_DELAY_MS, MIN_CONNECT_CHALLENGE_TIMEOUT_MS, addSafeTimeoutDelayGraceMs, buildDeviceAuthPayload, buildDeviceAuthPayloadV3, buildGatewayConnectAuth, clampConnectChallengeTimeoutMs, clearGatewayConnectTimeout, createSessionProjection, gatewayCredentialScope, gatewayOriginScope, getConnectChallengeTimeoutMsFromEnv, getGatewaySessionMessageSubscriptionCoordinator, hasSessionProjectionAcceptedFinal, isGatewayConnectAssemblyError, isLocallyOptimisticSessionMessage, normalizeDeviceMetadataForAuth, normalizeSessionProjectionRunId, projectLiveSessionMessage, readSessionMessageIdentity, readSessionMessageSequence, reconcileSessionProjectionSnapshot, reduceSessionProjection, reduceSessionProjectionRunEvent, releaseGatewaySessionMessageSubscription, resetGatewaySessionMessageSubscriptionCoordinator, resolveConnectChallengeTimeoutMs, resolveFiniteTimeoutDelayMs, resolveGatewayConnectScopes, resolvePreauthHandshakeTimeoutMs, resolveSafeTimeoutDelayMs, selectGatewayConnectAuth, shouldRetryGatewayWithDeviceToken, startGatewayClientWhenEventLoopReady, startGatewayClientWithReadinessWait, startGatewayConnectTimeout, waitForEventLoopReady };
+//#region packages/gateway-client/src/cloudflare-access.ts
+const CF_ACCESS_CLIENT_ID_HEADER = "CF-Access-Client-Id";
+const CF_ACCESS_CLIENT_SECRET_HEADER = "CF-Access-Client-Secret";
+/** Build only the two headers Cloudflare Access defines for service-token auth. */
+function buildCloudflareAccessHeaders(credentials) {
+	return {
+		[CF_ACCESS_CLIENT_ID_HEADER]: credentials.clientId,
+		[CF_ACCESS_CLIENT_SECRET_HEADER]: credentials.clientSecret
+	};
+}
+//#endregion
+export { CF_ACCESS_CLIENT_ID_HEADER, CF_ACCESS_CLIENT_SECRET_HEADER, DEFAULT_GATEWAY_REQUEST_TIMEOUT_MS, DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS, GatewayBrowserDeviceAuthLifecycle, GatewayClient, GatewayClientRequestError, GatewayClientRequestTimeoutError, GatewayScopeUpgrade, GatewaySessionMessageSubscriptionCoordinator, MAX_CONNECT_CHALLENGE_TIMEOUT_MS, MAX_SAFE_TIMEOUT_DELAY_MS, MIN_CONNECT_CHALLENGE_TIMEOUT_MS, addSafeTimeoutDelayGraceMs, buildCloudflareAccessHeaders, buildDeviceAuthPayload, buildDeviceAuthPayloadV3, buildGatewayConnectAuth, clampConnectChallengeTimeoutMs, clearGatewayConnectTimeout, createSessionProjection, gatewayCredentialScope, gatewayOriginScope, getConnectChallengeTimeoutMsFromEnv, getGatewaySessionMessageSubscriptionCoordinator, hasSessionProjectionAcceptedFinal, isGatewayConnectAssemblyError, isLocallyOptimisticSessionMessage, normalizeDeviceMetadataForAuth, normalizeSessionProjectionRunId, projectLiveSessionMessage, readSessionMessageIdentity, readSessionMessageSequence, reconcileSessionProjectionSnapshot, reduceSessionProjection, reduceSessionProjectionRunEvent, releaseGatewaySessionMessageSubscription, resetGatewaySessionMessageSubscriptionCoordinator, resolveConnectChallengeTimeoutMs, resolveFiniteTimeoutDelayMs, resolveGatewayConnectScopes, resolvePreauthHandshakeTimeoutMs, resolveSafeTimeoutDelayMs, selectGatewayConnectAuth, shouldRetryGatewayWithDeviceToken, startGatewayClientWhenEventLoopReady, startGatewayClientWithReadinessWait, startGatewayConnectTimeout, waitForEventLoopReady };