@openclaw/gateway-client 2026.8.1 → 2026.8.2

package/README.md

@@ -25,13 +25,26 @@ separate from the Gateway's current wire protocol number reported in `hello-ok`.
 
 ## Install
 
+Use the verified stable release with exact pins:
+
 ```bash
-npm install @openclaw/gateway-client @openclaw/gateway-protocol
+npm install --save-exact @openclaw/gateway-client@2026.8.1 @openclaw/gateway-protocol@2026.8.1
 ```
 
-Node consumers use the `ws` transport included as a runtime dependency. Browser
-consumers provide their platform WebSocket through the browser-safe protocol
-client surface.
+See the canonical [installation guide](https://docs.openclaw.ai/gateway/clients#install-the-packages)
+for package/wire-version rules and recovery from reserved `0.0.0` artifacts.
+Test it with the Gateway version you deploy; the root `openclaw` CLI has its own
+package versions and dist-tags.
+
+This release declares Node.js `>=22.19.0`. Node consumers use the `ws` transport
+included as a runtime dependency. Browser consumers provide their platform
+WebSocket through the browser-safe protocol client surface.
+
+For device-authenticated Node connections, supply `deviceIdentity` (or
+`hostDeps.loadOrCreateDeviceIdentity`) and the `hostDeps.signDevicePayload` and
+`hostDeps.publicKeyRawBase64UrlFromPem` callbacks. The host also owns device-token
+storage through `GatewayClientHostDeps`; the package does not load OpenClaw's
+local identity or credentials automatically.
 
 ## Entry points
 
@@ -80,9 +93,16 @@ The client waits for the Gateway's `connect.challenge` event before sending its
 does not fall back to a pre-challenge handshake. `onHelloOk` fires only after the
 Gateway accepts a compatible connection, so requests should wait for that callback.
 
-For remote connections, use `wss://`. Plaintext `ws://` is allowed by default
-only for loopback addresses. Authentication material and Gateway traffic must
-not cross an untrusted network without transport security.
+This loopback example uses the default `gateway-client` / `backend` identity.
+It is not a device-pairing example. UI clients should declare their actual `mode`
+and supply the device-auth host callbacks described above; see
+[device identity and pairing](https://docs.openclaw.ai/gateway/protocol#device-identity-and-pairing).
+
+For remote connections, prefer `wss://`. The Node client also accepts plaintext
+`ws://` by default for loopback, private/link-local/CGNAT IP addresses, and
+`.local` or `.ts.net` hostnames. This allowlist does not provide encryption:
+authentication material and Gateway traffic must not cross an untrusted network
+without transport security.
 
 ## Browser clients
 

package/dist/browser.d.mts

@@ -1,7 +1,7 @@
-import { A as gatewayCredentialScope, C as reduceSessionProjection, D as normalizeSessionProjectionRunId, E as SessionMessageIdentity, M as buildDeviceAuthPayload, N as buildDeviceAuthPayloadV3, O as readSessionMessageIdentity, P as normalizeDeviceMetadataForAuth, S as reconcileSessionProjectionSnapshot, T as SessionMessageEnvelope, _ as SessionProjectionState, a as GatewaySessionMessageSubscriptionOptions, b as isLocallyOptimisticSessionMessage, c as resetGatewaySessionMessageSubscriptionCoordinator, d as SessionProjectionGatewayRunEvent, f as SessionProjectionRun, g as SessionProjectionSnapshotOptions, h as SessionProjectionScope, i as GatewaySessionMessageSubscriptionCoordinatorOptions, j as gatewayOriginScope, k as readSessionMessageSequence, l as SessionProjectionEntry, m as SessionProjectionRunTransition, n as GatewaySessionMessageSubscription, o as getGatewaySessionMessageSubscriptionCoordinator, p as SessionProjectionRunStatus, r as GatewaySessionMessageSubscriptionCoordinator, s as releaseGatewaySessionMessageSubscription, t as GatewaySessionMessageRequestClient, u as SessionProjectionEvent, v as createSessionProjection, w as reduceSessionProjectionRunEvent, x as projectLiveSessionMessage, y as hasSessionProjectionAcceptedFinal } from "./session-subscriptions-CZOt8niS.mjs";
+import { A as gatewayCredentialScope, C as reduceSessionProjection, D as normalizeSessionProjectionRunId, E as SessionMessageIdentity, M as buildDeviceAuthPayload, N as buildDeviceAuthPayloadV3, O as readSessionMessageIdentity, P as normalizeDeviceMetadataForAuth, S as reconcileSessionProjectionSnapshot, T as SessionMessageEnvelope, _ as SessionProjectionState, a as GatewaySessionMessageSubscriptionOptions, b as isLocallyOptimisticSessionMessage, c as resetGatewaySessionMessageSubscriptionCoordinator, d as SessionProjectionGatewayRunEvent, f as SessionProjectionRun, g as SessionProjectionSnapshotOptions, h as SessionProjectionScope, i as GatewaySessionMessageSubscriptionCoordinatorOptions, j as gatewayOriginScope, k as readSessionMessageSequence, l as SessionProjectionEntry, m as SessionProjectionRunTransition, n as GatewaySessionMessageSubscription, o as getGatewaySessionMessageSubscriptionCoordinator, p as SessionProjectionRunStatus, r as GatewaySessionMessageSubscriptionCoordinator, s as releaseGatewaySessionMessageSubscription, t as GatewaySessionMessageRequestClient, u as SessionProjectionEvent, v as createSessionProjection, w as reduceSessionProjectionRunEvent, x as projectLiveSessionMessage, y as hasSessionProjectionAcceptedFinal } from "./session-subscriptions-BZp3uoLS.mjs";
 import { a as GatewayBrowserDeviceTokenStore, c as resolveGatewayConnectScopes, i as GatewayBrowserDeviceTokenRecord, l as selectGatewayConnectAuth, n as GatewayBrowserDeviceAuthPlan, o as GatewayConnectAuthSelection, r as GatewayBrowserDeviceIdentity, s as buildGatewayConnectAuth, t as GatewayBrowserDeviceAuthLifecycle, u as shouldRetryGatewayWithDeviceToken } from "./browser-device-auth-DoPo-sPB.mjs";
-import { n as GatewayProtocolRequestOptions, r as GatewayProtocolRequestTimeoutError, t as GatewayProtocolRequestError } from "./protocol-request-CcYZeK09.mjs";
-import { a as GatewayProtocolTiming, i as GatewayProtocolSocketHandlers, n as GatewayProtocolCloseContext, o as GatewayProtocolRequestTiming, r as GatewayProtocolSocket, t as GatewayProtocolClient } from "./protocol-client-BfrZgB1l.mjs";
+import { n as GatewayProtocolRequestOptions, r as GatewayProtocolRequestTimeoutError, t as GatewayProtocolRequestError } from "./protocol-request-B5gBmLgq.mjs";
+import { a as GatewayProtocolTiming, i as GatewayProtocolSocketHandlers, n as GatewayProtocolCloseContext, o as GatewayProtocolRequestTiming, r as GatewayProtocolSocket, t as GatewayProtocolClient } from "./protocol-client-DbX7wQED.mjs";
 import { DEFAULT_GATEWAY_REQUEST_TIMEOUT_MS, DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS, resolveSafeTimeoutDelayMs } from "./timeouts.mjs";
 import { ConnectParams, ErrorShape, EventFrame, HelloOk } from "@openclaw/gateway-protocol";
 export * from "@openclaw/gateway-protocol/connect-error-details";

package/dist/browser.mjs

@@ -1,4 +1,4 @@
-import { C as buildGatewayConnectAuth, D as buildDeviceAuthPayload, E as shouldRetryGatewayWithDeviceToken, O as buildDeviceAuthPayloadV3, S as GatewayBrowserDeviceAuthLifecycle, T as selectGatewayConnectAuth, _ as GatewayProtocolClient, a as createSessionProjection, b as gatewayCredentialScope, c as projectLiveSessionMessage, d as reduceSessionProjectionRunEvent, f as normalizeSessionProjectionRunId, g as shouldPauseGatewayReconnect, i as resetGatewaySessionMessageSubscriptionCoordinator, k as normalizeDeviceMetadataForAuth, l as reconcileSessionProjectionSnapshot, m as readSessionMessageSequence, n as getGatewaySessionMessageSubscriptionCoordinator, o as hasSessionProjectionAcceptedFinal, p as readSessionMessageIdentity, r as releaseGatewaySessionMessageSubscription, s as isLocallyOptimisticSessionMessage, t as GatewaySessionMessageSubscriptionCoordinator, u as reduceSessionProjection, v as GatewayProtocolRequestError, w as resolveGatewayConnectScopes, x as gatewayOriginScope, y as GatewayProtocolRequestTimeoutError } from "./session-subscriptions-BxuNBgqH.mjs";
+import { A as normalizeDeviceMetadataForAuth, C as GatewayBrowserDeviceAuthLifecycle, D as shouldRetryGatewayWithDeviceToken, E as selectGatewayConnectAuth, O as buildDeviceAuthPayload, S as gatewayOriginScope, T as resolveGatewayConnectScopes, _ as GatewayProtocolClient, a as createSessionProjection, c as projectLiveSessionMessage, d as reduceSessionProjectionRunEvent, f as normalizeSessionProjectionRunId, g as shouldPauseGatewayReconnect, i as resetGatewaySessionMessageSubscriptionCoordinator, k as buildDeviceAuthPayloadV3, l as reconcileSessionProjectionSnapshot, m as readSessionMessageSequence, n as getGatewaySessionMessageSubscriptionCoordinator, o as hasSessionProjectionAcceptedFinal, p as readSessionMessageIdentity, r as releaseGatewaySessionMessageSubscription, s as isLocallyOptimisticSessionMessage, t as GatewaySessionMessageSubscriptionCoordinator, u as reduceSessionProjection, v as GatewayProtocolRequestError, w as buildGatewayConnectAuth, x as gatewayCredentialScope, y as GatewayProtocolRequestTimeoutError } from "./session-subscriptions-CwSFOFqw.mjs";
 import { DEFAULT_GATEWAY_REQUEST_TIMEOUT_MS, DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS, resolveSafeTimeoutDelayMs } from "./timeouts.mjs";
 export * from "@openclaw/gateway-protocol/connect-error-details";
 export * from "@openclaw/gateway-protocol/client-info";

package/dist/index.d.mts

@@ -1,7 +1,8 @@
-import { A as gatewayCredentialScope, C as reduceSessionProjection, D as normalizeSessionProjectionRunId, E as SessionMessageIdentity, M as buildDeviceAuthPayload, N as buildDeviceAuthPayloadV3, O as readSessionMessageIdentity, P as normalizeDeviceMetadataForAuth, S as reconcileSessionProjectionSnapshot, T as SessionMessageEnvelope, _ as SessionProjectionState, a as GatewaySessionMessageSubscriptionOptions, b as isLocallyOptimisticSessionMessage, c as resetGatewaySessionMessageSubscriptionCoordinator, d as SessionProjectionGatewayRunEvent, f as SessionProjectionRun, g as SessionProjectionSnapshotOptions, h as SessionProjectionScope, i as GatewaySessionMessageSubscriptionCoordinatorOptions, j as gatewayOriginScope, k as readSessionMessageSequence, l as SessionProjectionEntry, m as SessionProjectionRunTransition, n as GatewaySessionMessageSubscription, o as getGatewaySessionMessageSubscriptionCoordinator, p as SessionProjectionRunStatus, r as GatewaySessionMessageSubscriptionCoordinator, s as releaseGatewaySessionMessageSubscription, t as GatewaySessionMessageRequestClient, u as SessionProjectionEvent, v as createSessionProjection, w as reduceSessionProjectionRunEvent, x as projectLiveSessionMessage, y as hasSessionProjectionAcceptedFinal } from "./session-subscriptions-CZOt8niS.mjs";
+import { A as gatewayCredentialScope, C as reduceSessionProjection, D as normalizeSessionProjectionRunId, E as SessionMessageIdentity, M as buildDeviceAuthPayload, N as buildDeviceAuthPayloadV3, O as readSessionMessageIdentity, P as normalizeDeviceMetadataForAuth, S as reconcileSessionProjectionSnapshot, T as SessionMessageEnvelope, _ as SessionProjectionState, a as GatewaySessionMessageSubscriptionOptions, b as isLocallyOptimisticSessionMessage, c as resetGatewaySessionMessageSubscriptionCoordinator, d as SessionProjectionGatewayRunEvent, f as SessionProjectionRun, g as SessionProjectionSnapshotOptions, h as SessionProjectionScope, i as GatewaySessionMessageSubscriptionCoordinatorOptions, j as gatewayOriginScope, k as readSessionMessageSequence, l as SessionProjectionEntry, m as SessionProjectionRunTransition, n as GatewaySessionMessageSubscription, o as getGatewaySessionMessageSubscriptionCoordinator, p as SessionProjectionRunStatus, r as GatewaySessionMessageSubscriptionCoordinator, s as releaseGatewaySessionMessageSubscription, t as GatewaySessionMessageRequestClient, u as SessionProjectionEvent, v as createSessionProjection, w as reduceSessionProjectionRunEvent, x as projectLiveSessionMessage, y as hasSessionProjectionAcceptedFinal } from "./session-subscriptions-BZp3uoLS.mjs";
 import { a as GatewayBrowserDeviceTokenStore, c as resolveGatewayConnectScopes, i as GatewayBrowserDeviceTokenRecord, l as selectGatewayConnectAuth, n as GatewayBrowserDeviceAuthPlan, o as GatewayConnectAuthSelection, r as GatewayBrowserDeviceIdentity, s as buildGatewayConnectAuth, t as GatewayBrowserDeviceAuthLifecycle, u as shouldRetryGatewayWithDeviceToken } from "./browser-device-auth-DoPo-sPB.mjs";
+import { i as isGatewayProtocolResponseError } from "./protocol-request-B5gBmLgq.mjs";
 import { DEFAULT_GATEWAY_REQUEST_TIMEOUT_MS, DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS, MAX_CONNECT_CHALLENGE_TIMEOUT_MS, MAX_SAFE_TIMEOUT_DELAY_MS, MIN_CONNECT_CHALLENGE_TIMEOUT_MS, addSafeTimeoutDelayGraceMs, clampConnectChallengeTimeoutMs, clearGatewayConnectTimeout, getConnectChallengeTimeoutMsFromEnv, resolveConnectChallengeTimeoutMs, resolveFiniteTimeoutDelayMs, resolvePreauthHandshakeTimeoutMs, resolveSafeTimeoutDelayMs, startGatewayConnectTimeout } from "./timeouts.mjs";
-import { _ as GatewayClientRequestTimeoutError, a as startGatewayClientWithReadinessWait, b as GatewayClientRequestError, c as waitForEventLoopReady, d as GatewayClient, f as GatewayClientCloseInfo, g as GatewayClientRequestOptions, h as GatewayClientOptions, i as startGatewayClientWhenEventLoopReady, l as DeviceAuthTokenRecord, m as GatewayClientHostDeps, n as GatewayClientStartReadinessOptions, o as EventLoopReadyOptions, p as GatewayClientConnectionMetadata, r as GatewayClientStartable, s as EventLoopReadyResult, t as EventLoopReadyWaiter, u as DeviceIdentity, v as GatewayReconnectPausedInfo, y as isGatewayConnectAssemblyError } from "./readiness-bH1mOPOT.mjs";
+import { _ as GatewayClientRequestTimeoutError, a as startGatewayClientWithReadinessWait, b as GatewayClientRequestError, c as waitForEventLoopReady, d as GatewayClient, f as GatewayClientCloseInfo, g as GatewayClientRequestOptions, h as GatewayClientOptions, i as startGatewayClientWhenEventLoopReady, l as DeviceAuthTokenRecord, m as GatewayClientHostDeps, n as GatewayClientStartReadinessOptions, o as EventLoopReadyOptions, p as GatewayClientConnectionMetadata, r as GatewayClientStartable, s as EventLoopReadyResult, t as EventLoopReadyWaiter, u as DeviceIdentity, v as GatewayReconnectPausedInfo, y as isGatewayConnectAssemblyError } from "./readiness-5KjCokrl.mjs";
 import { GatewayScopeUpgrade, ScopeUpgradeBinding, ScopeUpgradeOptions, ScopeUpgradeOutcome } from "./scope-upgrade.mjs";
 //#region packages/gateway-client/src/cloudflare-access.d.ts
 export declare const CF_ACCESS_CLIENT_ID_HEADER = "CF-Access-Client-Id";
@@ -13,4 +14,4 @@ export type CloudflareAccessCredentials = Readonly<{
 /** Build only the two headers Cloudflare Access defines for service-token auth. */
 export declare function buildCloudflareAccessHeaders(credentials: CloudflareAccessCredentials): Record<string, string>;
 //#endregion
-export { DEFAULT_GATEWAY_REQUEST_TIMEOUT_MS, DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS, DeviceAuthTokenRecord, DeviceIdentity, EventLoopReadyOptions, EventLoopReadyResult, EventLoopReadyWaiter, GatewayBrowserDeviceAuthLifecycle, GatewayBrowserDeviceAuthPlan, GatewayBrowserDeviceIdentity, GatewayBrowserDeviceTokenRecord, GatewayBrowserDeviceTokenStore, GatewayClient, GatewayClientCloseInfo, GatewayClientConnectionMetadata, GatewayClientHostDeps, GatewayClientOptions, GatewayClientRequestError, GatewayClientRequestOptions, GatewayClientRequestTimeoutError, GatewayClientStartReadinessOptions, GatewayClientStartable, GatewayConnectAuthSelection, GatewayReconnectPausedInfo, GatewayScopeUpgrade, GatewaySessionMessageRequestClient, GatewaySessionMessageSubscription, GatewaySessionMessageSubscriptionCoordinator, GatewaySessionMessageSubscriptionCoordinatorOptions, GatewaySessionMessageSubscriptionOptions, MAX_CONNECT_CHALLENGE_TIMEOUT_MS, MAX_SAFE_TIMEOUT_DELAY_MS, MIN_CONNECT_CHALLENGE_TIMEOUT_MS, ScopeUpgradeBinding, ScopeUpgradeOptions, ScopeUpgradeOutcome, type SessionMessageEnvelope, type SessionMessageIdentity, SessionProjectionEntry, SessionProjectionEvent, SessionProjectionGatewayRunEvent, SessionProjectionRun, SessionProjectionRunStatus, SessionProjectionRunTransition, SessionProjectionScope, SessionProjectionSnapshotOptions, SessionProjectionState, addSafeTimeoutDelayGraceMs, buildDeviceAuthPayload, buildDeviceAuthPayloadV3, buildGatewayConnectAuth, clampConnectChallengeTimeoutMs, clearGatewayConnectTimeout, createSessionProjection, gatewayCredentialScope, gatewayOriginScope, getConnectChallengeTimeoutMsFromEnv, getGatewaySessionMessageSubscriptionCoordinator, hasSessionProjectionAcceptedFinal, isGatewayConnectAssemblyError, isLocallyOptimisticSessionMessage, normalizeDeviceMetadataForAuth, normalizeSessionProjectionRunId, projectLiveSessionMessage, readSessionMessageIdentity, readSessionMessageSequence, reconcileSessionProjectionSnapshot, reduceSessionProjection, reduceSessionProjectionRunEvent, releaseGatewaySessionMessageSubscription, resetGatewaySessionMessageSubscriptionCoordinator, resolveConnectChallengeTimeoutMs, resolveFiniteTimeoutDelayMs, resolveGatewayConnectScopes, resolvePreauthHandshakeTimeoutMs, resolveSafeTimeoutDelayMs, selectGatewayConnectAuth, shouldRetryGatewayWithDeviceToken, startGatewayClientWhenEventLoopReady, startGatewayClientWithReadinessWait, startGatewayConnectTimeout, waitForEventLoopReady };
+export { DEFAULT_GATEWAY_REQUEST_TIMEOUT_MS, DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS, DeviceAuthTokenRecord, DeviceIdentity, EventLoopReadyOptions, EventLoopReadyResult, EventLoopReadyWaiter, GatewayBrowserDeviceAuthLifecycle, GatewayBrowserDeviceAuthPlan, GatewayBrowserDeviceIdentity, GatewayBrowserDeviceTokenRecord, GatewayBrowserDeviceTokenStore, GatewayClient, GatewayClientCloseInfo, GatewayClientConnectionMetadata, GatewayClientHostDeps, GatewayClientOptions, GatewayClientRequestError, GatewayClientRequestOptions, GatewayClientRequestTimeoutError, GatewayClientStartReadinessOptions, GatewayClientStartable, GatewayConnectAuthSelection, GatewayReconnectPausedInfo, GatewayScopeUpgrade, GatewaySessionMessageRequestClient, GatewaySessionMessageSubscription, GatewaySessionMessageSubscriptionCoordinator, GatewaySessionMessageSubscriptionCoordinatorOptions, GatewaySessionMessageSubscriptionOptions, MAX_CONNECT_CHALLENGE_TIMEOUT_MS, MAX_SAFE_TIMEOUT_DELAY_MS, MIN_CONNECT_CHALLENGE_TIMEOUT_MS, ScopeUpgradeBinding, ScopeUpgradeOptions, ScopeUpgradeOutcome, type SessionMessageEnvelope, type SessionMessageIdentity, SessionProjectionEntry, SessionProjectionEvent, SessionProjectionGatewayRunEvent, SessionProjectionRun, SessionProjectionRunStatus, SessionProjectionRunTransition, SessionProjectionScope, SessionProjectionSnapshotOptions, SessionProjectionState, addSafeTimeoutDelayGraceMs, buildDeviceAuthPayload, buildDeviceAuthPayloadV3, buildGatewayConnectAuth, clampConnectChallengeTimeoutMs, clearGatewayConnectTimeout, createSessionProjection, gatewayCredentialScope, gatewayOriginScope, getConnectChallengeTimeoutMsFromEnv, getGatewaySessionMessageSubscriptionCoordinator, hasSessionProjectionAcceptedFinal, isGatewayConnectAssemblyError, isGatewayProtocolResponseError, isLocallyOptimisticSessionMessage, normalizeDeviceMetadataForAuth, normalizeSessionProjectionRunId, projectLiveSessionMessage, readSessionMessageIdentity, readSessionMessageSequence, reconcileSessionProjectionSnapshot, reduceSessionProjection, reduceSessionProjectionRunEvent, releaseGatewaySessionMessageSubscription, resetGatewaySessionMessageSubscriptionCoordinator, resolveConnectChallengeTimeoutMs, resolveFiniteTimeoutDelayMs, resolveGatewayConnectScopes, resolvePreauthHandshakeTimeoutMs, resolveSafeTimeoutDelayMs, selectGatewayConnectAuth, shouldRetryGatewayWithDeviceToken, startGatewayClientWhenEventLoopReady, startGatewayClientWithReadinessWait, startGatewayConnectTimeout, waitForEventLoopReady };

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { C as buildGatewayConnectAuth, D as buildDeviceAuthPayload, E as shouldRetryGatewayWithDeviceToken, O as buildDeviceAuthPayloadV3, S as GatewayBrowserDeviceAuthLifecycle, T as selectGatewayConnectAuth, _ as GatewayProtocolClient, a as createSessionProjection, b as gatewayCredentialScope, c as projectLiveSessionMessage, d as reduceSessionProjectionRunEvent, f as normalizeSessionProjectionRunId, g as shouldPauseGatewayReconnect, h as isRecord, i as resetGatewaySessionMessageSubscriptionCoordinator, k as normalizeDeviceMetadataForAuth, l as reconcileSessionProjectionSnapshot, m as readSessionMessageSequence, n as getGatewaySessionMessageSubscriptionCoordinator, o as hasSessionProjectionAcceptedFinal, p as readSessionMessageIdentity, r as releaseGatewaySessionMessageSubscription, s as isLocallyOptimisticSessionMessage, t as GatewaySessionMessageSubscriptionCoordinator, u as reduceSessionProjection, v as GatewayProtocolRequestError, w as resolveGatewayConnectScopes, x as gatewayOriginScope, y as GatewayProtocolRequestTimeoutError } from "./session-subscriptions-BxuNBgqH.mjs";
+import { A as normalizeDeviceMetadataForAuth, C as GatewayBrowserDeviceAuthLifecycle, D as shouldRetryGatewayWithDeviceToken, E as selectGatewayConnectAuth, O as buildDeviceAuthPayload, S as gatewayOriginScope, T as resolveGatewayConnectScopes, _ as GatewayProtocolClient, a as createSessionProjection, b as isGatewayProtocolResponseError, c as projectLiveSessionMessage, d as reduceSessionProjectionRunEvent, f as normalizeSessionProjectionRunId, g as shouldPauseGatewayReconnect, h as isRecord, i as resetGatewaySessionMessageSubscriptionCoordinator, k as buildDeviceAuthPayloadV3, l as reconcileSessionProjectionSnapshot, m as readSessionMessageSequence, n as getGatewaySessionMessageSubscriptionCoordinator, o as hasSessionProjectionAcceptedFinal, p as readSessionMessageIdentity, r as releaseGatewaySessionMessageSubscription, s as isLocallyOptimisticSessionMessage, t as GatewaySessionMessageSubscriptionCoordinator, u as reduceSessionProjection, v as GatewayProtocolRequestError, w as buildGatewayConnectAuth, x as gatewayCredentialScope, y as GatewayProtocolRequestTimeoutError } from "./session-subscriptions-CwSFOFqw.mjs";
 import { DEFAULT_GATEWAY_REQUEST_TIMEOUT_MS, DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS, MAX_CONNECT_CHALLENGE_TIMEOUT_MS, MAX_SAFE_TIMEOUT_DELAY_MS, MIN_CONNECT_CHALLENGE_TIMEOUT_MS, addSafeTimeoutDelayGraceMs, clampConnectChallengeTimeoutMs, clearGatewayConnectTimeout, getConnectChallengeTimeoutMsFromEnv, resolveConnectChallengeTimeoutMs, resolveFiniteTimeoutDelayMs, resolvePreauthHandshakeTimeoutMs, resolveSafeTimeoutDelayMs, startGatewayConnectTimeout } from "./timeouts.mjs";
 import { rawDataToString } from "./websocket-data.mjs";
 import { n as startGatewayClientWithReadinessWait, r as waitForEventLoopReady, t as startGatewayClientWhenEventLoopReady } from "./readiness-CrWxd4TI.mjs";
@@ -559,7 +559,7 @@ function resolveHostDeps(overrides) {
 }
 const DEFAULT_GATEWAY_CLIENT_URL = "ws://127.0.0.1:18789";
 const DEFAULT_CLIENT_VERSION = "0.0.0";
-const MAX_UPGRADE_ERROR_BODY_BYTES = 2 * 1024;
+const MAX_UPGRADE_ERROR_BODY_BYTES = 2048;
 const UPGRADE_ERROR_BODY_TIMEOUT_MS = 1e3;
 async function readUpgradeErrorBody(response) {
 	return await new Promise((resolve) => {
@@ -776,7 +776,7 @@ var GatewayClient = class {
 			env: this.opts.env,
 			normalizeTlsFingerprint: this.deps.normalizeTlsFingerprint,
 			options: {
-				maxPayload: 25 * 1024 * 1024,
+				maxPayload: 26214400,
 				handshakeTimeout: handshakeTimeoutMs,
 				...this.opts.origin ? { origin: this.opts.origin } : {},
 				...edgeAuthHeaders ? {
@@ -1343,4 +1343,4 @@ function buildCloudflareAccessHeaders(credentials) {
 	};
 }
 //#endregion
-export { CF_ACCESS_CLIENT_ID_HEADER, CF_ACCESS_CLIENT_SECRET_HEADER, DEFAULT_GATEWAY_REQUEST_TIMEOUT_MS, DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS, GatewayBrowserDeviceAuthLifecycle, GatewayClient, GatewayClientRequestError, GatewayClientRequestTimeoutError, GatewayScopeUpgrade, GatewaySessionMessageSubscriptionCoordinator, MAX_CONNECT_CHALLENGE_TIMEOUT_MS, MAX_SAFE_TIMEOUT_DELAY_MS, MIN_CONNECT_CHALLENGE_TIMEOUT_MS, addSafeTimeoutDelayGraceMs, buildCloudflareAccessHeaders, buildDeviceAuthPayload, buildDeviceAuthPayloadV3, buildGatewayConnectAuth, clampConnectChallengeTimeoutMs, clearGatewayConnectTimeout, createSessionProjection, gatewayCredentialScope, gatewayOriginScope, getConnectChallengeTimeoutMsFromEnv, getGatewaySessionMessageSubscriptionCoordinator, hasSessionProjectionAcceptedFinal, isGatewayConnectAssemblyError, isLocallyOptimisticSessionMessage, normalizeDeviceMetadataForAuth, normalizeSessionProjectionRunId, projectLiveSessionMessage, readSessionMessageIdentity, readSessionMessageSequence, reconcileSessionProjectionSnapshot, reduceSessionProjection, reduceSessionProjectionRunEvent, releaseGatewaySessionMessageSubscription, resetGatewaySessionMessageSubscriptionCoordinator, resolveConnectChallengeTimeoutMs, resolveFiniteTimeoutDelayMs, resolveGatewayConnectScopes, resolvePreauthHandshakeTimeoutMs, resolveSafeTimeoutDelayMs, selectGatewayConnectAuth, shouldRetryGatewayWithDeviceToken, startGatewayClientWhenEventLoopReady, startGatewayClientWithReadinessWait, startGatewayConnectTimeout, waitForEventLoopReady };
+export { CF_ACCESS_CLIENT_ID_HEADER, CF_ACCESS_CLIENT_SECRET_HEADER, DEFAULT_GATEWAY_REQUEST_TIMEOUT_MS, DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS, GatewayBrowserDeviceAuthLifecycle, GatewayClient, GatewayClientRequestError, GatewayClientRequestTimeoutError, GatewayScopeUpgrade, GatewaySessionMessageSubscriptionCoordinator, MAX_CONNECT_CHALLENGE_TIMEOUT_MS, MAX_SAFE_TIMEOUT_DELAY_MS, MIN_CONNECT_CHALLENGE_TIMEOUT_MS, addSafeTimeoutDelayGraceMs, buildCloudflareAccessHeaders, buildDeviceAuthPayload, buildDeviceAuthPayloadV3, buildGatewayConnectAuth, clampConnectChallengeTimeoutMs, clearGatewayConnectTimeout, createSessionProjection, gatewayCredentialScope, gatewayOriginScope, getConnectChallengeTimeoutMsFromEnv, getGatewaySessionMessageSubscriptionCoordinator, hasSessionProjectionAcceptedFinal, isGatewayConnectAssemblyError, isGatewayProtocolResponseError, isLocallyOptimisticSessionMessage, normalizeDeviceMetadataForAuth, normalizeSessionProjectionRunId, projectLiveSessionMessage, readSessionMessageIdentity, readSessionMessageSequence, reconcileSessionProjectionSnapshot, reduceSessionProjection, reduceSessionProjectionRunEvent, releaseGatewaySessionMessageSubscription, resetGatewaySessionMessageSubscriptionCoordinator, resolveConnectChallengeTimeoutMs, resolveFiniteTimeoutDelayMs, resolveGatewayConnectScopes, resolvePreauthHandshakeTimeoutMs, resolveSafeTimeoutDelayMs, selectGatewayConnectAuth, shouldRetryGatewayWithDeviceToken, startGatewayClientWhenEventLoopReady, startGatewayClientWithReadinessWait, startGatewayConnectTimeout, waitForEventLoopReady };

package/dist/{protocol-client-BfrZgB1l.d.mts → protocol-client-DbX7wQED.d.mts}

@@ -1,4 +1,4 @@
-import { n as GatewayProtocolRequestOptions, t as GatewayProtocolRequestError } from "./protocol-request-CcYZeK09.mjs";
+import { n as GatewayProtocolRequestOptions, t as GatewayProtocolRequestError } from "./protocol-request-B5gBmLgq.mjs";
 import { ErrorShape, EventFrame, HelloOk } from "@openclaw/gateway-protocol";
 //#region packages/gateway-client/src/pending-request.d.ts
 type GatewayProtocolRequestTiming = {

package/dist/{protocol-request-CcYZeK09.d.mts → protocol-request-B5gBmLgq.d.mts}

@@ -1,5 +1,7 @@
 import { ErrorShape } from "@openclaw/gateway-protocol";
 //#region packages/gateway-client/src/protocol-request.d.ts
+/** Distinguishes correlated Gateway responses from locally constructed transport errors. */
+declare function isGatewayProtocolResponseError(error: unknown): error is GatewayProtocolRequestError;
 type GatewayProtocolRequestOptions = {
   timeoutMs?: number | null;
   expectFinal?: boolean;
@@ -29,4 +31,4 @@ declare class GatewayProtocolRequestTimeoutError extends Error {
   }, message?: string);
 }
 //#endregion
-export { GatewayProtocolRequestOptions as n, GatewayProtocolRequestTimeoutError as r, GatewayProtocolRequestError as t };
+export { isGatewayProtocolResponseError as i, GatewayProtocolRequestOptions as n, GatewayProtocolRequestTimeoutError as r, GatewayProtocolRequestError as t };

package/dist/{readiness-bH1mOPOT.d.mts → readiness-5KjCokrl.d.mts}

@@ -1,5 +1,5 @@
-import { n as GatewayProtocolRequestOptions, r as GatewayProtocolRequestTimeoutError, t as GatewayProtocolRequestError } from "./protocol-request-CcYZeK09.mjs";
-import "./protocol-client-BfrZgB1l.mjs";
+import { n as GatewayProtocolRequestOptions, r as GatewayProtocolRequestTimeoutError, t as GatewayProtocolRequestError } from "./protocol-request-B5gBmLgq.mjs";
+import "./protocol-client-DbX7wQED.mjs";
 import { ConnectParams, ErrorShape, EventFrame, HelloOk } from "@openclaw/gateway-protocol/frame-guards";
 import { GatewayClientMode, GatewayClientName } from "@openclaw/gateway-protocol/client-info";
 //#region packages/gateway-client/src/request-error.d.ts

package/dist/readiness.d.mts

@@ -1,2 +1,2 @@
-import { a as startGatewayClientWithReadinessWait, i as startGatewayClientWhenEventLoopReady, n as GatewayClientStartReadinessOptions, r as GatewayClientStartable, t as EventLoopReadyWaiter } from "./readiness-bH1mOPOT.mjs";
+import { a as startGatewayClientWithReadinessWait, i as startGatewayClientWhenEventLoopReady, n as GatewayClientStartReadinessOptions, r as GatewayClientStartable, t as EventLoopReadyWaiter } from "./readiness-5KjCokrl.mjs";
 export { EventLoopReadyWaiter, GatewayClientStartReadinessOptions, GatewayClientStartable, startGatewayClientWhenEventLoopReady, startGatewayClientWithReadinessWait };

package/dist/scope-upgrade.d.mts

@@ -1,5 +1,5 @@
 import { a as GatewayBrowserDeviceTokenStore } from "./browser-device-auth-DoPo-sPB.mjs";
-import { n as GatewayProtocolRequestOptions } from "./protocol-request-CcYZeK09.mjs";
+import { n as GatewayProtocolRequestOptions } from "./protocol-request-B5gBmLgq.mjs";
 //#region packages/gateway-client/src/scope-upgrade.d.ts
 export type ScopeUpgradeBinding = {
   clientId: string;

package/dist/{session-subscriptions-CZOt8niS.d.mts → session-subscriptions-BZp3uoLS.d.mts}

@@ -1,4 +1,4 @@
-import { n as GatewayProtocolRequestOptions } from "./protocol-request-CcYZeK09.mjs";
+import { n as GatewayProtocolRequestOptions } from "./protocol-request-B5gBmLgq.mjs";
 //#region packages/gateway-client/src/device-auth.d.ts
 declare function normalizeDeviceMetadataForAuth(value?: string | null): string;
 type DeviceAuthPayloadParams = {
@@ -37,6 +37,8 @@ type SessionMessageIdentity = {
   id: string | null;
   sequence: number | null;
   idempotencyKey: string | null;
+  /** User submission identity stays stable when a queued turn acquires a new execution run. */
+  sendId: string | null;
   runId: string | null;
   isImported: boolean;
   externalSource: string | null;

package/dist/{session-subscriptions-BxuNBgqH.mjs → session-subscriptions-CwSFOFqw.mjs}

@@ -433,6 +433,11 @@ var GatewayEventListeners = class {
 };
 //#endregion
 //#region packages/gateway-client/src/protocol-request.ts
+const gatewayResponseErrors = /* @__PURE__ */ new WeakSet();
+/** Distinguishes correlated Gateway responses from locally constructed transport errors. */
+function isGatewayProtocolResponseError(error) {
+	return error instanceof Error && gatewayResponseErrors.has(error);
+}
 var GatewayProtocolRequestError = class extends Error {
 	constructor(error) {
 		super(error.message ?? "request failed");
@@ -446,6 +451,7 @@ var GatewayProtocolRequestError = class extends Error {
 };
 /** Preserve response metadata after custom factories without adding it to error JSON. */
 function retainGatewayResponsePayload(error, payload) {
+	gatewayResponseErrors.add(error);
 	Object.defineProperty(error, "responsePayload", {
 		value: payload,
 		enumerable: false,
@@ -1054,12 +1060,14 @@ function readSessionMessageIdentity(message, envelope) {
 	const isCliAssistant = role === "assistant" && readSessionProjectionString(record.api)?.toLowerCase() === "cli";
 	const canonicalPersistedRunId = isCliAssistant && persistedRunId?.startsWith("cli-assistant:") ? readSessionProjectionString(persistedRunId.slice(14)) : persistedRunId;
 	const optimisticRunId = metadata && Object.keys(metadata).every((key) => key === "idempotencyKey") ? canonicalPersistedRunId : null;
+	const runId = role === "assistant" ? metadataRunId ?? envelopeRunId ?? (isCliAssistant || !mirroredMessage ? canonicalPersistedRunId : null) ?? optimisticRunId : metadataRunId ?? canonicalPersistedRunId ?? envelopeRunId;
 	return {
 		role,
 		id: readSessionProjectionString(metadata?.id) ?? readSessionProjectionString(envelope?.messageId),
 		sequence: readSessionMessageSequence(message, envelope),
 		idempotencyKey,
-		runId: role === "assistant" ? metadataRunId ?? envelopeRunId ?? (isCliAssistant || !mirroredMessage ? canonicalPersistedRunId : null) ?? optimisticRunId : metadataRunId ?? canonicalPersistedRunId ?? envelopeRunId,
+		sendId: role === "user" ? persistedRunId ?? runId : null,
+		runId,
 		isImported: Boolean(importedFrom || cliSessionId || externalId),
 		externalSource: importedFrom && cliSessionId && externalId ? JSON.stringify([
 			importedFrom,
@@ -1192,7 +1200,7 @@ function entryMatches(left, right, allowSnapshotPromotion = false) {
 	if (left.pending && right.pending) return Boolean(left.identity?.role === right.identity?.role && left.pendingRunId && left.pendingRunId === right.pendingRunId);
 	const pending = left.pending ? left : right.pending ? right : null;
 	const authoritative = pending === left ? right : pending === right ? left : null;
-	return Boolean(pending && authoritative && pending.identity && authoritative.identity && pending.identity.role === authoritative.identity.role && !pending.identity.isImported && !authoritative.identity.isImported && pending.pendingRunId && pending.pendingRunId === authoritative.identity.runId && (pending.identity.sequence === null || authoritative.identity.sequence === null || pending.identity.sequence === authoritative.identity.sequence));
+	return Boolean(pending && authoritative && pending.identity && authoritative.identity && pending.identity.role === authoritative.identity.role && !pending.identity.isImported && !authoritative.identity.isImported && pending.pendingRunId && pending.pendingRunId === (authoritative.identity.sendId ?? authoritative.identity.runId) && (pending.identity.sequence === null || authoritative.identity.sequence === null || pending.identity.sequence === authoritative.identity.sequence));
 }
 function withEntries(state, entries) {
 	return {
@@ -1663,4 +1671,4 @@ function releaseGatewaySessionMessageSubscription(subscription) {
 	return sessionMessageSubscriptionOwners.get(subscription)?.coordinator.release(subscription) ?? Promise.resolve();
 }
 //#endregion
-export { buildGatewayConnectAuth as C, buildDeviceAuthPayload as D, shouldRetryGatewayWithDeviceToken as E, buildDeviceAuthPayloadV3 as O, GatewayBrowserDeviceAuthLifecycle as S, selectGatewayConnectAuth as T, GatewayProtocolClient as _, createSessionProjection as a, gatewayCredentialScope as b, projectLiveSessionMessage as c, reduceSessionProjectionRunEvent as d, normalizeSessionProjectionRunId as f, shouldPauseGatewayReconnect as g, isRecord as h, resetGatewaySessionMessageSubscriptionCoordinator as i, normalizeDeviceMetadataForAuth as k, reconcileSessionProjectionSnapshot as l, readSessionMessageSequence as m, getGatewaySessionMessageSubscriptionCoordinator as n, hasSessionProjectionAcceptedFinal as o, readSessionMessageIdentity as p, releaseGatewaySessionMessageSubscription as r, isLocallyOptimisticSessionMessage as s, GatewaySessionMessageSubscriptionCoordinator as t, reduceSessionProjection as u, GatewayProtocolRequestError as v, resolveGatewayConnectScopes as w, gatewayOriginScope as x, GatewayProtocolRequestTimeoutError as y };
+export { normalizeDeviceMetadataForAuth as A, GatewayBrowserDeviceAuthLifecycle as C, shouldRetryGatewayWithDeviceToken as D, selectGatewayConnectAuth as E, buildDeviceAuthPayload as O, gatewayOriginScope as S, resolveGatewayConnectScopes as T, GatewayProtocolClient as _, createSessionProjection as a, isGatewayProtocolResponseError as b, projectLiveSessionMessage as c, reduceSessionProjectionRunEvent as d, normalizeSessionProjectionRunId as f, shouldPauseGatewayReconnect as g, isRecord as h, resetGatewaySessionMessageSubscriptionCoordinator as i, buildDeviceAuthPayloadV3 as k, reconcileSessionProjectionSnapshot as l, readSessionMessageSequence as m, getGatewaySessionMessageSubscriptionCoordinator as n, hasSessionProjectionAcceptedFinal as o, readSessionMessageIdentity as p, releaseGatewaySessionMessageSubscription as r, isLocallyOptimisticSessionMessage as s, GatewaySessionMessageSubscriptionCoordinator as t, reduceSessionProjection as u, GatewayProtocolRequestError as v, buildGatewayConnectAuth as w, gatewayCredentialScope as x, GatewayProtocolRequestTimeoutError as y };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/gateway-client",
-  "version": "2026.8.1",
+  "version": "2026.8.2",
   "description": "Reference WebSocket client for the OpenClaw Gateway protocol",
   "keywords": [
     "client",
@@ -62,7 +62,7 @@
     }
   },
   "dependencies": {
-    "@openclaw/gateway-protocol": "2026.8.1",
+    "@openclaw/gateway-protocol": "2026.8.2",
     "ipaddr.js": "2.5.0",
     "ws": "8.21.3"
   },