@openclaw/gateway-client 2026.9.1-beta.1 → 2026.9.1

package/README.md

@@ -25,13 +25,26 @@ separate from the Gateway's current wire protocol number reported in `hello-ok`.
 
 ## Install
 
+Use the verified stable release with exact pins:
+
 ```bash
-npm install @openclaw/gateway-client @openclaw/gateway-protocol
+npm install --save-exact @openclaw/gateway-client@2026.8.1 @openclaw/gateway-protocol@2026.8.1
 ```
 
-Node consumers use the `ws` transport included as a runtime dependency. Browser
-consumers provide their platform WebSocket through the browser-safe protocol
-client surface.
+See the canonical [installation guide](https://docs.openclaw.ai/gateway/clients#install-the-packages)
+for package/wire-version rules and recovery from reserved `0.0.0` artifacts.
+Test it with the Gateway version you deploy; the root `openclaw` CLI has its own
+package versions and dist-tags.
+
+This release declares Node.js `>=22.19.0`. Node consumers use the `ws` transport
+included as a runtime dependency. Browser consumers provide their platform
+WebSocket through the browser-safe protocol client surface.
+
+For device-authenticated Node connections, supply `deviceIdentity` (or
+`hostDeps.loadOrCreateDeviceIdentity`) and the `hostDeps.signDevicePayload` and
+`hostDeps.publicKeyRawBase64UrlFromPem` callbacks. The host also owns device-token
+storage through `GatewayClientHostDeps`; the package does not load OpenClaw's
+local identity or credentials automatically.
 
 ## Entry points
 
@@ -80,9 +93,16 @@ The client waits for the Gateway's `connect.challenge` event before sending its
 does not fall back to a pre-challenge handshake. `onHelloOk` fires only after the
 Gateway accepts a compatible connection, so requests should wait for that callback.
 
-For remote connections, use `wss://`. Plaintext `ws://` is allowed by default
-only for loopback addresses. Authentication material and Gateway traffic must
-not cross an untrusted network without transport security.
+This loopback example uses the default `gateway-client` / `backend` identity.
+It is not a device-pairing example. UI clients should declare their actual `mode`
+and supply the device-auth host callbacks described above; see
+[device identity and pairing](https://docs.openclaw.ai/gateway/protocol#device-identity-and-pairing).
+
+For remote connections, prefer `wss://`. The Node client also accepts plaintext
+`ws://` by default for loopback, private/link-local/CGNAT IP addresses, and
+`.local` or `.ts.net` hostnames. This allowlist does not provide encryption:
+authentication material and Gateway traffic must not cross an untrusted network
+without transport security.
 
 ## Browser clients
 

package/dist/browser.d.mts

@@ -1,7 +1,7 @@
-import { A as gatewayCredentialScope, C as reduceSessionProjection, D as normalizeSessionProjectionRunId, E as SessionMessageIdentity, M as buildDeviceAuthPayload, N as buildDeviceAuthPayloadV3, O as readSessionMessageIdentity, P as normalizeDeviceMetadataForAuth, S as reconcileSessionProjectionSnapshot, T as SessionMessageEnvelope, _ as SessionProjectionState, a as GatewaySessionMessageSubscriptionOptions, b as isLocallyOptimisticSessionMessage, c as resetGatewaySessionMessageSubscriptionCoordinator, d as SessionProjectionGatewayRunEvent, f as SessionProjectionRun, g as SessionProjectionSnapshotOptions, h as SessionProjectionScope, i as GatewaySessionMessageSubscriptionCoordinatorOptions, j as gatewayOriginScope, k as readSessionMessageSequence, l as SessionProjectionEntry, m as SessionProjectionRunTransition, n as GatewaySessionMessageSubscription, o as getGatewaySessionMessageSubscriptionCoordinator, p as SessionProjectionRunStatus, r as GatewaySessionMessageSubscriptionCoordinator, s as releaseGatewaySessionMessageSubscription, t as GatewaySessionMessageRequestClient, u as SessionProjectionEvent, v as createSessionProjection, w as reduceSessionProjectionRunEvent, x as projectLiveSessionMessage, y as hasSessionProjectionAcceptedFinal } from "./session-subscriptions-DNKXLO-Z.mjs";
+import { A as readSessionMessageSequence, C as reduceSessionProjection, D as normalizeSessionProjectionRunId, E as SessionMessageIdentity, F as normalizeDeviceMetadataForAuth, M as gatewayOriginScope, N as buildDeviceAuthPayload, O as readAssistantStreamSegmentIdentity, P as buildDeviceAuthPayloadV3, S as reconcileSessionProjectionSnapshot, T as SessionMessageEnvelope, _ as SessionProjectionState, a as GatewaySessionMessageSubscriptionOptions, b as isLocallyOptimisticSessionMessage, c as resetGatewaySessionMessageSubscriptionCoordinator, d as SessionProjectionGatewayRunEvent, f as SessionProjectionRun, g as SessionProjectionSnapshotOptions, h as SessionProjectionScope, i as GatewaySessionMessageSubscriptionCoordinatorOptions, j as gatewayCredentialScope, k as readSessionMessageIdentity, l as SessionProjectionEntry, m as SessionProjectionRunTransition, n as GatewaySessionMessageSubscription, o as getGatewaySessionMessageSubscriptionCoordinator, p as SessionProjectionRunStatus, r as GatewaySessionMessageSubscriptionCoordinator, s as releaseGatewaySessionMessageSubscription, t as GatewaySessionMessageRequestClient, u as SessionProjectionEvent, v as createSessionProjection, w as reduceSessionProjectionRunEvent, x as projectLiveSessionMessage, y as hasSessionProjectionAcceptedFinal } from "./session-subscriptions-D2UdeJ0u.mjs";
 import { a as GatewayBrowserDeviceTokenStore, c as resolveGatewayConnectScopes, i as GatewayBrowserDeviceTokenRecord, l as selectGatewayConnectAuth, n as GatewayBrowserDeviceAuthPlan, o as GatewayConnectAuthSelection, r as GatewayBrowserDeviceIdentity, s as buildGatewayConnectAuth, t as GatewayBrowserDeviceAuthLifecycle, u as shouldRetryGatewayWithDeviceToken } from "./browser-device-auth-DoPo-sPB.mjs";
-import { n as GatewayProtocolRequestOptions, r as GatewayProtocolRequestTimeoutError, t as GatewayProtocolRequestError } from "./protocol-request-r0jkQ1XE.mjs";
-import { a as GatewayProtocolTiming, i as GatewayProtocolSocketHandlers, n as GatewayProtocolCloseContext, o as GatewayProtocolRequestTiming, r as GatewayProtocolSocket, t as GatewayProtocolClient } from "./protocol-client-C-viHJgO.mjs";
+import { n as GatewayProtocolRequestOptions, r as GatewayProtocolRequestTimeoutError, t as GatewayProtocolRequestError } from "./protocol-request-B5gBmLgq.mjs";
+import { a as GatewayProtocolTiming, i as GatewayProtocolSocketHandlers, n as GatewayProtocolCloseContext, o as GatewayProtocolRequestTiming, r as GatewayProtocolSocket, t as GatewayProtocolClient } from "./protocol-client-DbX7wQED.mjs";
 import { DEFAULT_GATEWAY_REQUEST_TIMEOUT_MS, DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS, resolveSafeTimeoutDelayMs } from "./timeouts.mjs";
 import { ConnectParams, ErrorShape, EventFrame, HelloOk } from "@openclaw/gateway-protocol";
 export * from "@openclaw/gateway-protocol/connect-error-details";
@@ -10,7 +10,7 @@ export * from "@openclaw/gateway-protocol/gateway-error-details";
 export * from "@openclaw/gateway-protocol/startup-unavailable";
 export * from "@openclaw/gateway-protocol/version";
 //#region packages/gateway-client/src/reconnect-policy.d.ts
-declare function shouldPauseGatewayReconnect(params: {
+export declare function shouldPauseGatewayReconnect(params: {
   details?: unknown;
   deviceTokenRetryPending?: boolean;
   tokenMismatchIsTerminal?: boolean;
@@ -18,4 +18,4 @@ declare function shouldPauseGatewayReconnect(params: {
   clientVersionMismatchIsTerminal?: boolean;
 }): boolean;
 //#endregion
-export { type ConnectParams, DEFAULT_GATEWAY_REQUEST_TIMEOUT_MS, DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS, type ErrorShape, type EventFrame, GatewayBrowserDeviceAuthLifecycle, GatewayBrowserDeviceAuthPlan, GatewayBrowserDeviceIdentity, GatewayBrowserDeviceTokenRecord, GatewayBrowserDeviceTokenStore, GatewayConnectAuthSelection, GatewayProtocolClient, type GatewayProtocolCloseContext, GatewayProtocolRequestError, type GatewayProtocolRequestOptions, GatewayProtocolRequestTimeoutError, type GatewayProtocolRequestTiming, type GatewayProtocolSocket, type GatewayProtocolSocketHandlers, type GatewayProtocolTiming, GatewaySessionMessageRequestClient, GatewaySessionMessageSubscription, GatewaySessionMessageSubscriptionCoordinator, GatewaySessionMessageSubscriptionCoordinatorOptions, GatewaySessionMessageSubscriptionOptions, type HelloOk, type SessionMessageEnvelope, type SessionMessageIdentity, SessionProjectionEntry, SessionProjectionEvent, SessionProjectionGatewayRunEvent, SessionProjectionRun, SessionProjectionRunStatus, SessionProjectionRunTransition, SessionProjectionScope, SessionProjectionSnapshotOptions, SessionProjectionState, buildDeviceAuthPayload, buildDeviceAuthPayloadV3, buildGatewayConnectAuth, createSessionProjection, gatewayCredentialScope, gatewayOriginScope, getGatewaySessionMessageSubscriptionCoordinator, hasSessionProjectionAcceptedFinal, isLocallyOptimisticSessionMessage, normalizeDeviceMetadataForAuth, normalizeSessionProjectionRunId, projectLiveSessionMessage, readSessionMessageIdentity, readSessionMessageSequence, reconcileSessionProjectionSnapshot, reduceSessionProjection, reduceSessionProjectionRunEvent, releaseGatewaySessionMessageSubscription, resetGatewaySessionMessageSubscriptionCoordinator, resolveGatewayConnectScopes, resolveSafeTimeoutDelayMs, selectGatewayConnectAuth, shouldPauseGatewayReconnect, shouldRetryGatewayWithDeviceToken };
+export { type ConnectParams, DEFAULT_GATEWAY_REQUEST_TIMEOUT_MS, DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS, type ErrorShape, type EventFrame, GatewayBrowserDeviceAuthLifecycle, GatewayBrowserDeviceAuthPlan, GatewayBrowserDeviceIdentity, GatewayBrowserDeviceTokenRecord, GatewayBrowserDeviceTokenStore, GatewayConnectAuthSelection, GatewayProtocolClient, type GatewayProtocolCloseContext, GatewayProtocolRequestError, type GatewayProtocolRequestOptions, GatewayProtocolRequestTimeoutError, type GatewayProtocolRequestTiming, type GatewayProtocolSocket, type GatewayProtocolSocketHandlers, type GatewayProtocolTiming, GatewaySessionMessageRequestClient, GatewaySessionMessageSubscription, GatewaySessionMessageSubscriptionCoordinator, GatewaySessionMessageSubscriptionCoordinatorOptions, GatewaySessionMessageSubscriptionOptions, type HelloOk, type SessionMessageEnvelope, type SessionMessageIdentity, SessionProjectionEntry, SessionProjectionEvent, SessionProjectionGatewayRunEvent, SessionProjectionRun, SessionProjectionRunStatus, SessionProjectionRunTransition, SessionProjectionScope, SessionProjectionSnapshotOptions, SessionProjectionState, buildDeviceAuthPayload, buildDeviceAuthPayloadV3, buildGatewayConnectAuth, createSessionProjection, gatewayCredentialScope, gatewayOriginScope, getGatewaySessionMessageSubscriptionCoordinator, hasSessionProjectionAcceptedFinal, isLocallyOptimisticSessionMessage, normalizeDeviceMetadataForAuth, normalizeSessionProjectionRunId, projectLiveSessionMessage, readAssistantStreamSegmentIdentity, readSessionMessageIdentity, readSessionMessageSequence, reconcileSessionProjectionSnapshot, reduceSessionProjection, reduceSessionProjectionRunEvent, releaseGatewaySessionMessageSubscription, resetGatewaySessionMessageSubscriptionCoordinator, resolveGatewayConnectScopes, resolveSafeTimeoutDelayMs, selectGatewayConnectAuth, shouldRetryGatewayWithDeviceToken };

package/dist/browser.mjs

@@ -1,8 +1,8 @@
-import { C as buildGatewayConnectAuth, D as buildDeviceAuthPayload, E as shouldRetryGatewayWithDeviceToken, O as buildDeviceAuthPayloadV3, S as GatewayBrowserDeviceAuthLifecycle, T as selectGatewayConnectAuth, _ as GatewayProtocolClient, a as createSessionProjection, b as gatewayCredentialScope, c as projectLiveSessionMessage, d as reduceSessionProjectionRunEvent, f as normalizeSessionProjectionRunId, g as shouldPauseGatewayReconnect, i as resetGatewaySessionMessageSubscriptionCoordinator, k as normalizeDeviceMetadataForAuth, l as reconcileSessionProjectionSnapshot, m as readSessionMessageSequence, n as getGatewaySessionMessageSubscriptionCoordinator, o as hasSessionProjectionAcceptedFinal, p as readSessionMessageIdentity, r as releaseGatewaySessionMessageSubscription, s as isLocallyOptimisticSessionMessage, t as GatewaySessionMessageSubscriptionCoordinator, u as reduceSessionProjection, v as GatewayProtocolRequestError, w as resolveGatewayConnectScopes, x as gatewayOriginScope, y as GatewayProtocolRequestTimeoutError } from "./session-subscriptions-Uxa34zU5.mjs";
+import { A as buildDeviceAuthPayloadV3, C as gatewayOriginScope, D as selectGatewayConnectAuth, E as resolveGatewayConnectScopes, O as shouldRetryGatewayWithDeviceToken, S as gatewayCredentialScope, T as buildGatewayConnectAuth, _ as shouldPauseGatewayReconnect, a as createSessionProjection, b as GatewayProtocolRequestTimeoutError, c as projectLiveSessionMessage, d as reduceSessionProjectionRunEvent, f as normalizeSessionProjectionRunId, h as readSessionMessageSequence, i as resetGatewaySessionMessageSubscriptionCoordinator, j as normalizeDeviceMetadataForAuth, k as buildDeviceAuthPayload, l as reconcileSessionProjectionSnapshot, m as readSessionMessageIdentity, n as getGatewaySessionMessageSubscriptionCoordinator, o as hasSessionProjectionAcceptedFinal, p as readAssistantStreamSegmentIdentity, r as releaseGatewaySessionMessageSubscription, s as isLocallyOptimisticSessionMessage, t as GatewaySessionMessageSubscriptionCoordinator, u as reduceSessionProjection, v as GatewayProtocolClient, w as GatewayBrowserDeviceAuthLifecycle, y as GatewayProtocolRequestError } from "./session-subscriptions-DT0ZioFT.mjs";
 import { DEFAULT_GATEWAY_REQUEST_TIMEOUT_MS, DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS, resolveSafeTimeoutDelayMs } from "./timeouts.mjs";
 export * from "@openclaw/gateway-protocol/connect-error-details";
 export * from "@openclaw/gateway-protocol/client-info";
 export * from "@openclaw/gateway-protocol/gateway-error-details";
 export * from "@openclaw/gateway-protocol/startup-unavailable";
 export * from "@openclaw/gateway-protocol/version";
-export { DEFAULT_GATEWAY_REQUEST_TIMEOUT_MS, DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS, GatewayBrowserDeviceAuthLifecycle, GatewayProtocolClient, GatewayProtocolRequestError, GatewayProtocolRequestTimeoutError, GatewaySessionMessageSubscriptionCoordinator, buildDeviceAuthPayload, buildDeviceAuthPayloadV3, buildGatewayConnectAuth, createSessionProjection, gatewayCredentialScope, gatewayOriginScope, getGatewaySessionMessageSubscriptionCoordinator, hasSessionProjectionAcceptedFinal, isLocallyOptimisticSessionMessage, normalizeDeviceMetadataForAuth, normalizeSessionProjectionRunId, projectLiveSessionMessage, readSessionMessageIdentity, readSessionMessageSequence, reconcileSessionProjectionSnapshot, reduceSessionProjection, reduceSessionProjectionRunEvent, releaseGatewaySessionMessageSubscription, resetGatewaySessionMessageSubscriptionCoordinator, resolveGatewayConnectScopes, resolveSafeTimeoutDelayMs, selectGatewayConnectAuth, shouldPauseGatewayReconnect, shouldRetryGatewayWithDeviceToken };
+export { DEFAULT_GATEWAY_REQUEST_TIMEOUT_MS, DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS, GatewayBrowserDeviceAuthLifecycle, GatewayProtocolClient, GatewayProtocolRequestError, GatewayProtocolRequestTimeoutError, GatewaySessionMessageSubscriptionCoordinator, buildDeviceAuthPayload, buildDeviceAuthPayloadV3, buildGatewayConnectAuth, createSessionProjection, gatewayCredentialScope, gatewayOriginScope, getGatewaySessionMessageSubscriptionCoordinator, hasSessionProjectionAcceptedFinal, isLocallyOptimisticSessionMessage, normalizeDeviceMetadataForAuth, normalizeSessionProjectionRunId, projectLiveSessionMessage, readAssistantStreamSegmentIdentity, readSessionMessageIdentity, readSessionMessageSequence, reconcileSessionProjectionSnapshot, reduceSessionProjection, reduceSessionProjectionRunEvent, releaseGatewaySessionMessageSubscription, resetGatewaySessionMessageSubscriptionCoordinator, resolveGatewayConnectScopes, resolveSafeTimeoutDelayMs, selectGatewayConnectAuth, shouldPauseGatewayReconnect, shouldRetryGatewayWithDeviceToken };

package/dist/index.d.mts

@@ -1,16 +1,17 @@
-import { A as gatewayCredentialScope, C as reduceSessionProjection, D as normalizeSessionProjectionRunId, E as SessionMessageIdentity, M as buildDeviceAuthPayload, N as buildDeviceAuthPayloadV3, O as readSessionMessageIdentity, P as normalizeDeviceMetadataForAuth, S as reconcileSessionProjectionSnapshot, T as SessionMessageEnvelope, _ as SessionProjectionState, a as GatewaySessionMessageSubscriptionOptions, b as isLocallyOptimisticSessionMessage, c as resetGatewaySessionMessageSubscriptionCoordinator, d as SessionProjectionGatewayRunEvent, f as SessionProjectionRun, g as SessionProjectionSnapshotOptions, h as SessionProjectionScope, i as GatewaySessionMessageSubscriptionCoordinatorOptions, j as gatewayOriginScope, k as readSessionMessageSequence, l as SessionProjectionEntry, m as SessionProjectionRunTransition, n as GatewaySessionMessageSubscription, o as getGatewaySessionMessageSubscriptionCoordinator, p as SessionProjectionRunStatus, r as GatewaySessionMessageSubscriptionCoordinator, s as releaseGatewaySessionMessageSubscription, t as GatewaySessionMessageRequestClient, u as SessionProjectionEvent, v as createSessionProjection, w as reduceSessionProjectionRunEvent, x as projectLiveSessionMessage, y as hasSessionProjectionAcceptedFinal } from "./session-subscriptions-DNKXLO-Z.mjs";
+import { A as readSessionMessageSequence, C as reduceSessionProjection, D as normalizeSessionProjectionRunId, E as SessionMessageIdentity, F as normalizeDeviceMetadataForAuth, M as gatewayOriginScope, N as buildDeviceAuthPayload, O as readAssistantStreamSegmentIdentity, P as buildDeviceAuthPayloadV3, S as reconcileSessionProjectionSnapshot, T as SessionMessageEnvelope, _ as SessionProjectionState, a as GatewaySessionMessageSubscriptionOptions, b as isLocallyOptimisticSessionMessage, c as resetGatewaySessionMessageSubscriptionCoordinator, d as SessionProjectionGatewayRunEvent, f as SessionProjectionRun, g as SessionProjectionSnapshotOptions, h as SessionProjectionScope, i as GatewaySessionMessageSubscriptionCoordinatorOptions, j as gatewayCredentialScope, k as readSessionMessageIdentity, l as SessionProjectionEntry, m as SessionProjectionRunTransition, n as GatewaySessionMessageSubscription, o as getGatewaySessionMessageSubscriptionCoordinator, p as SessionProjectionRunStatus, r as GatewaySessionMessageSubscriptionCoordinator, s as releaseGatewaySessionMessageSubscription, t as GatewaySessionMessageRequestClient, u as SessionProjectionEvent, v as createSessionProjection, w as reduceSessionProjectionRunEvent, x as projectLiveSessionMessage, y as hasSessionProjectionAcceptedFinal } from "./session-subscriptions-D2UdeJ0u.mjs";
 import { a as GatewayBrowserDeviceTokenStore, c as resolveGatewayConnectScopes, i as GatewayBrowserDeviceTokenRecord, l as selectGatewayConnectAuth, n as GatewayBrowserDeviceAuthPlan, o as GatewayConnectAuthSelection, r as GatewayBrowserDeviceIdentity, s as buildGatewayConnectAuth, t as GatewayBrowserDeviceAuthLifecycle, u as shouldRetryGatewayWithDeviceToken } from "./browser-device-auth-DoPo-sPB.mjs";
+import { i as isGatewayProtocolResponseError } from "./protocol-request-B5gBmLgq.mjs";
 import { DEFAULT_GATEWAY_REQUEST_TIMEOUT_MS, DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS, MAX_CONNECT_CHALLENGE_TIMEOUT_MS, MAX_SAFE_TIMEOUT_DELAY_MS, MIN_CONNECT_CHALLENGE_TIMEOUT_MS, addSafeTimeoutDelayGraceMs, clampConnectChallengeTimeoutMs, clearGatewayConnectTimeout, getConnectChallengeTimeoutMsFromEnv, resolveConnectChallengeTimeoutMs, resolveFiniteTimeoutDelayMs, resolvePreauthHandshakeTimeoutMs, resolveSafeTimeoutDelayMs, startGatewayConnectTimeout } from "./timeouts.mjs";
-import { _ as GatewayClientRequestTimeoutError, a as startGatewayClientWithReadinessWait, b as GatewayClientRequestError, c as waitForEventLoopReady, d as GatewayClient, f as GatewayClientCloseInfo, g as GatewayClientRequestOptions, h as GatewayClientOptions, i as startGatewayClientWhenEventLoopReady, l as DeviceAuthTokenRecord, m as GatewayClientHostDeps, n as GatewayClientStartReadinessOptions, o as EventLoopReadyOptions, p as GatewayClientConnectionMetadata, r as GatewayClientStartable, s as EventLoopReadyResult, t as EventLoopReadyWaiter, u as DeviceIdentity, v as GatewayReconnectPausedInfo, y as isGatewayConnectAssemblyError } from "./readiness-CJ1QsCtR.mjs";
+import { _ as GatewayClientRequestTimeoutError, a as startGatewayClientWithReadinessWait, b as GatewayClientRequestError, c as waitForEventLoopReady, d as GatewayClient, f as GatewayClientCloseInfo, g as GatewayClientRequestOptions, h as GatewayClientOptions, i as startGatewayClientWhenEventLoopReady, l as DeviceAuthTokenRecord, m as GatewayClientHostDeps, n as GatewayClientStartReadinessOptions, o as EventLoopReadyOptions, p as GatewayClientConnectionMetadata, r as GatewayClientStartable, s as EventLoopReadyResult, t as EventLoopReadyWaiter, u as DeviceIdentity, v as GatewayReconnectPausedInfo, y as isGatewayConnectAssemblyError } from "./readiness-5KjCokrl.mjs";
 import { GatewayScopeUpgrade, ScopeUpgradeBinding, ScopeUpgradeOptions, ScopeUpgradeOutcome } from "./scope-upgrade.mjs";
 //#region packages/gateway-client/src/cloudflare-access.d.ts
-declare const CF_ACCESS_CLIENT_ID_HEADER = "CF-Access-Client-Id";
-declare const CF_ACCESS_CLIENT_SECRET_HEADER = "CF-Access-Client-Secret";
-type CloudflareAccessCredentials = Readonly<{
+export declare const CF_ACCESS_CLIENT_ID_HEADER = "CF-Access-Client-Id";
+export declare const CF_ACCESS_CLIENT_SECRET_HEADER = "CF-Access-Client-Secret";
+export type CloudflareAccessCredentials = Readonly<{
   clientId: string;
   clientSecret: string;
 }>;
 /** Build only the two headers Cloudflare Access defines for service-token auth. */
-declare function buildCloudflareAccessHeaders(credentials: CloudflareAccessCredentials): Record<string, string>;
+export declare function buildCloudflareAccessHeaders(credentials: CloudflareAccessCredentials): Record<string, string>;
 //#endregion
-export { CF_ACCESS_CLIENT_ID_HEADER, CF_ACCESS_CLIENT_SECRET_HEADER, CloudflareAccessCredentials, DEFAULT_GATEWAY_REQUEST_TIMEOUT_MS, DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS, DeviceAuthTokenRecord, DeviceIdentity, EventLoopReadyOptions, EventLoopReadyResult, EventLoopReadyWaiter, GatewayBrowserDeviceAuthLifecycle, GatewayBrowserDeviceAuthPlan, GatewayBrowserDeviceIdentity, GatewayBrowserDeviceTokenRecord, GatewayBrowserDeviceTokenStore, GatewayClient, GatewayClientCloseInfo, GatewayClientConnectionMetadata, GatewayClientHostDeps, GatewayClientOptions, GatewayClientRequestError, GatewayClientRequestOptions, GatewayClientRequestTimeoutError, GatewayClientStartReadinessOptions, GatewayClientStartable, GatewayConnectAuthSelection, GatewayReconnectPausedInfo, GatewayScopeUpgrade, GatewaySessionMessageRequestClient, GatewaySessionMessageSubscription, GatewaySessionMessageSubscriptionCoordinator, GatewaySessionMessageSubscriptionCoordinatorOptions, GatewaySessionMessageSubscriptionOptions, MAX_CONNECT_CHALLENGE_TIMEOUT_MS, MAX_SAFE_TIMEOUT_DELAY_MS, MIN_CONNECT_CHALLENGE_TIMEOUT_MS, ScopeUpgradeBinding, ScopeUpgradeOptions, ScopeUpgradeOutcome, type SessionMessageEnvelope, type SessionMessageIdentity, SessionProjectionEntry, SessionProjectionEvent, SessionProjectionGatewayRunEvent, SessionProjectionRun, SessionProjectionRunStatus, SessionProjectionRunTransition, SessionProjectionScope, SessionProjectionSnapshotOptions, SessionProjectionState, addSafeTimeoutDelayGraceMs, buildCloudflareAccessHeaders, buildDeviceAuthPayload, buildDeviceAuthPayloadV3, buildGatewayConnectAuth, clampConnectChallengeTimeoutMs, clearGatewayConnectTimeout, createSessionProjection, gatewayCredentialScope, gatewayOriginScope, getConnectChallengeTimeoutMsFromEnv, getGatewaySessionMessageSubscriptionCoordinator, hasSessionProjectionAcceptedFinal, isGatewayConnectAssemblyError, isLocallyOptimisticSessionMessage, normalizeDeviceMetadataForAuth, normalizeSessionProjectionRunId, projectLiveSessionMessage, readSessionMessageIdentity, readSessionMessageSequence, reconcileSessionProjectionSnapshot, reduceSessionProjection, reduceSessionProjectionRunEvent, releaseGatewaySessionMessageSubscription, resetGatewaySessionMessageSubscriptionCoordinator, resolveConnectChallengeTimeoutMs, resolveFiniteTimeoutDelayMs, resolveGatewayConnectScopes, resolvePreauthHandshakeTimeoutMs, resolveSafeTimeoutDelayMs, selectGatewayConnectAuth, shouldRetryGatewayWithDeviceToken, startGatewayClientWhenEventLoopReady, startGatewayClientWithReadinessWait, startGatewayConnectTimeout, waitForEventLoopReady };
+export { DEFAULT_GATEWAY_REQUEST_TIMEOUT_MS, DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS, DeviceAuthTokenRecord, DeviceIdentity, EventLoopReadyOptions, EventLoopReadyResult, EventLoopReadyWaiter, GatewayBrowserDeviceAuthLifecycle, GatewayBrowserDeviceAuthPlan, GatewayBrowserDeviceIdentity, GatewayBrowserDeviceTokenRecord, GatewayBrowserDeviceTokenStore, GatewayClient, GatewayClientCloseInfo, GatewayClientConnectionMetadata, GatewayClientHostDeps, GatewayClientOptions, GatewayClientRequestError, GatewayClientRequestOptions, GatewayClientRequestTimeoutError, GatewayClientStartReadinessOptions, GatewayClientStartable, GatewayConnectAuthSelection, GatewayReconnectPausedInfo, GatewayScopeUpgrade, GatewaySessionMessageRequestClient, GatewaySessionMessageSubscription, GatewaySessionMessageSubscriptionCoordinator, GatewaySessionMessageSubscriptionCoordinatorOptions, GatewaySessionMessageSubscriptionOptions, MAX_CONNECT_CHALLENGE_TIMEOUT_MS, MAX_SAFE_TIMEOUT_DELAY_MS, MIN_CONNECT_CHALLENGE_TIMEOUT_MS, ScopeUpgradeBinding, ScopeUpgradeOptions, ScopeUpgradeOutcome, type SessionMessageEnvelope, type SessionMessageIdentity, SessionProjectionEntry, SessionProjectionEvent, SessionProjectionGatewayRunEvent, SessionProjectionRun, SessionProjectionRunStatus, SessionProjectionRunTransition, SessionProjectionScope, SessionProjectionSnapshotOptions, SessionProjectionState, addSafeTimeoutDelayGraceMs, buildDeviceAuthPayload, buildDeviceAuthPayloadV3, buildGatewayConnectAuth, clampConnectChallengeTimeoutMs, clearGatewayConnectTimeout, createSessionProjection, gatewayCredentialScope, gatewayOriginScope, getConnectChallengeTimeoutMsFromEnv, getGatewaySessionMessageSubscriptionCoordinator, hasSessionProjectionAcceptedFinal, isGatewayConnectAssemblyError, isGatewayProtocolResponseError, isLocallyOptimisticSessionMessage, normalizeDeviceMetadataForAuth, normalizeSessionProjectionRunId, projectLiveSessionMessage, readAssistantStreamSegmentIdentity, readSessionMessageIdentity, readSessionMessageSequence, reconcileSessionProjectionSnapshot, reduceSessionProjection, reduceSessionProjectionRunEvent, releaseGatewaySessionMessageSubscription, resetGatewaySessionMessageSubscriptionCoordinator, resolveConnectChallengeTimeoutMs, resolveFiniteTimeoutDelayMs, resolveGatewayConnectScopes, resolvePreauthHandshakeTimeoutMs, resolveSafeTimeoutDelayMs, selectGatewayConnectAuth, shouldRetryGatewayWithDeviceToken, startGatewayClientWhenEventLoopReady, startGatewayClientWithReadinessWait, startGatewayConnectTimeout, waitForEventLoopReady };

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { C as buildGatewayConnectAuth, D as buildDeviceAuthPayload, E as shouldRetryGatewayWithDeviceToken, O as buildDeviceAuthPayloadV3, S as GatewayBrowserDeviceAuthLifecycle, T as selectGatewayConnectAuth, _ as GatewayProtocolClient, a as createSessionProjection, b as gatewayCredentialScope, c as projectLiveSessionMessage, d as reduceSessionProjectionRunEvent, f as normalizeSessionProjectionRunId, g as shouldPauseGatewayReconnect, h as isRecord, i as resetGatewaySessionMessageSubscriptionCoordinator, k as normalizeDeviceMetadataForAuth, l as reconcileSessionProjectionSnapshot, m as readSessionMessageSequence, n as getGatewaySessionMessageSubscriptionCoordinator, o as hasSessionProjectionAcceptedFinal, p as readSessionMessageIdentity, r as releaseGatewaySessionMessageSubscription, s as isLocallyOptimisticSessionMessage, t as GatewaySessionMessageSubscriptionCoordinator, u as reduceSessionProjection, v as GatewayProtocolRequestError, w as resolveGatewayConnectScopes, x as gatewayOriginScope, y as GatewayProtocolRequestTimeoutError } from "./session-subscriptions-Uxa34zU5.mjs";
+import { A as buildDeviceAuthPayloadV3, C as gatewayOriginScope, D as selectGatewayConnectAuth, E as resolveGatewayConnectScopes, O as shouldRetryGatewayWithDeviceToken, S as gatewayCredentialScope, T as buildGatewayConnectAuth, _ as shouldPauseGatewayReconnect, a as createSessionProjection, b as GatewayProtocolRequestTimeoutError, c as projectLiveSessionMessage, d as reduceSessionProjectionRunEvent, f as normalizeSessionProjectionRunId, g as isRecord, h as readSessionMessageSequence, i as resetGatewaySessionMessageSubscriptionCoordinator, j as normalizeDeviceMetadataForAuth, k as buildDeviceAuthPayload, l as reconcileSessionProjectionSnapshot, m as readSessionMessageIdentity, n as getGatewaySessionMessageSubscriptionCoordinator, o as hasSessionProjectionAcceptedFinal, p as readAssistantStreamSegmentIdentity, r as releaseGatewaySessionMessageSubscription, s as isLocallyOptimisticSessionMessage, t as GatewaySessionMessageSubscriptionCoordinator, u as reduceSessionProjection, v as GatewayProtocolClient, w as GatewayBrowserDeviceAuthLifecycle, x as isGatewayProtocolResponseError, y as GatewayProtocolRequestError } from "./session-subscriptions-DT0ZioFT.mjs";
 import { DEFAULT_GATEWAY_REQUEST_TIMEOUT_MS, DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS, MAX_CONNECT_CHALLENGE_TIMEOUT_MS, MAX_SAFE_TIMEOUT_DELAY_MS, MIN_CONNECT_CHALLENGE_TIMEOUT_MS, addSafeTimeoutDelayGraceMs, clampConnectChallengeTimeoutMs, clearGatewayConnectTimeout, getConnectChallengeTimeoutMsFromEnv, resolveConnectChallengeTimeoutMs, resolveFiniteTimeoutDelayMs, resolvePreauthHandshakeTimeoutMs, resolveSafeTimeoutDelayMs, startGatewayConnectTimeout } from "./timeouts.mjs";
 import { rawDataToString } from "./websocket-data.mjs";
 import { n as startGatewayClientWithReadinessWait, r as waitForEventLoopReady, t as startGatewayClientWhenEventLoopReady } from "./readiness-CrWxd4TI.mjs";
@@ -10,6 +10,7 @@ import { MIN_CLIENT_PROTOCOL_VERSION, MIN_NODE_PROTOCOL_VERSION, MIN_PROBE_PROTO
 import { randomUUID } from "node:crypto";
 import { WebSocket } from "ws";
 import ipaddr from "ipaddr.js";
+import { TLSSocket } from "node:tls";
 //#region packages/normalization-core/src/string-coerce.ts
 /** Trims string input and returns null for non-strings or empty strings. */
 function normalizeNullableString(value) {
@@ -484,6 +485,7 @@ function isSecureWebSocketUrl(rawUrl, options) {
 	}
 }
 var GatewayWebSocketTransportConfigurationError = class extends Error {};
+var GatewayWebSocketTlsPinError = class extends Error {};
 function resolveGatewayWebSocketTransport(params) {
 	const usesTls = isWssUrl(params.url);
 	if (params.tlsFingerprint && !usesTls) throw new GatewayWebSocketTransportConfigurationError("gateway tls fingerprint requires wss:// gateway url");
@@ -499,30 +501,37 @@ function resolveGatewayWebSocketTransport(params) {
 	const expectedFingerprint = params.tlsFingerprint ? normalizeTlsFingerprint(params.tlsFingerprint) : void 0;
 	if (params.tlsFingerprint && !expectedFingerprint) throw new GatewayWebSocketTransportConfigurationError("gateway tls fingerprint must be a SHA-256 fingerprint");
 	const options = { ...params.options };
-	if (usesTls && expectedFingerprint) {
-		options.rejectUnauthorized = false;
-		options.checkServerIdentity = (_hostValue, cert) => {
-			const fingerprintValue = typeof cert === "object" && cert && "fingerprint256" in cert ? cert.fingerprint256 ?? "" : "";
-			const canonicalFingerprint = normalizeTlsFingerprint(typeof fingerprintValue === "string" ? fingerprintValue : "");
-			const fingerprint = canonicalFingerprint ? normalize(canonicalFingerprint) : "";
-			const expected = normalize(expectedFingerprint);
-			if (!fingerprint) return /* @__PURE__ */ new Error("Missing server TLS fingerprint");
-			if (fingerprint !== expected) return /* @__PURE__ */ new Error("Server TLS fingerprint mismatch");
-		};
-	}
-	return {
-		options,
-		validateSocket: (socket) => {
-			if (!params.tlsFingerprint) return null;
-			const expected = expectedFingerprint ? normalize(expectedFingerprint) : "";
-			if (!expected) return /* @__PURE__ */ new Error("gateway tls fingerprint missing");
-			const rawSocket = socket["_socket"];
-			if (!rawSocket || typeof rawSocket.getPeerCertificate !== "function") return /* @__PURE__ */ new Error("gateway tls fingerprint unavailable");
-			const canonicalFingerprint = normalizeTlsFingerprint(rawSocket.getPeerCertificate()?.fingerprint256 ?? "");
-			const fingerprint = canonicalFingerprint ? normalize(canonicalFingerprint) : "";
-			if (!fingerprint) return /* @__PURE__ */ new Error("gateway tls fingerprint unavailable");
-			return fingerprint === expected ? null : /* @__PURE__ */ new Error("gateway tls fingerprint mismatch");
-		}
+	if (usesTls && expectedFingerprint) applyGatewayWebSocketTlsPin(options, expectedFingerprint, normalize);
+	return { options };
+}
+function applyGatewayWebSocketTlsPin(options, expectedFingerprint, normalize = normalizeTlsFingerprint) {
+	options.rejectUnauthorized = false;
+	const headers = { ...options.headers };
+	const deferredHeaders = Object.entries(headers).filter(([key]) => key.toLowerCase() === "expect");
+	for (const [key] of deferredHeaders) delete headers[key];
+	options.headers = headers;
+	options.finishRequest = (request) => {
+		request.once("socket", (socket) => {
+			if (!(socket instanceof TLSSocket)) {
+				request.destroy(new GatewayWebSocketTlsPinError("gateway tls fingerprint unavailable"));
+				return;
+			}
+			const validatePin = () => {
+				if (request.destroyed) return;
+				const canonicalFingerprint = normalizeTlsFingerprint(socket.getPeerCertificate()?.fingerprint256);
+				const fingerprint = canonicalFingerprint ? normalize(canonicalFingerprint) : "";
+				if (!fingerprint || fingerprint !== normalize(expectedFingerprint)) {
+					request.destroy(new GatewayWebSocketTlsPinError(fingerprint ? "gateway tls fingerprint mismatch" : "gateway tls fingerprint unavailable"));
+					return;
+				}
+				for (const [key, value] of deferredHeaders) if (value !== void 0) request.setHeader(key, value);
+				request.end();
+			};
+			if (socket.secureConnecting) {
+				socket.once("secureConnect", validatePin);
+				request.once("close", () => socket.off("secureConnect", validatePin));
+			} else validatePin();
+		});
 	};
 }
 //#endregion
@@ -550,7 +559,7 @@ function resolveHostDeps(overrides) {
 }
 const DEFAULT_GATEWAY_CLIENT_URL = "ws://127.0.0.1:18789";
 const DEFAULT_CLIENT_VERSION = "0.0.0";
-const MAX_UPGRADE_ERROR_BODY_BYTES = 2 * 1024;
+const MAX_UPGRADE_ERROR_BODY_BYTES = 2048;
 const UPGRADE_ERROR_BODY_TIMEOUT_MS = 1e3;
 async function readUpgradeErrorBody(response) {
 	return await new Promise((resolve) => {
@@ -767,7 +776,7 @@ var GatewayClient = class {
 			env: this.opts.env,
 			normalizeTlsFingerprint: this.deps.normalizeTlsFingerprint,
 			options: {
-				maxPayload: 25 * 1024 * 1024,
+				maxPayload: 26214400,
 				handshakeTimeout: handshakeTimeoutMs,
 				...this.opts.origin ? { origin: this.opts.origin } : {},
 				...edgeAuthHeaders ? {
@@ -796,14 +805,8 @@ var GatewayClient = class {
 		this.transportValidated = false;
 		let upgradeError;
 		ws.on("open", () => {
-			handlers.open();
-			const tlsError = transport.validateSocket(ws);
-			if (tlsError) {
-				handlers.error(tlsError);
-				ws.close(1008, tlsError.message);
-				return;
-			}
 			this.transportValidated = true;
+			handlers.open();
 		});
 		ws.on("message", (data) => handlers.message(rawDataToString(data)));
 		ws.on("close", (code, reason) => {
@@ -1340,4 +1343,4 @@ function buildCloudflareAccessHeaders(credentials) {
 	};
 }
 //#endregion
-export { CF_ACCESS_CLIENT_ID_HEADER, CF_ACCESS_CLIENT_SECRET_HEADER, DEFAULT_GATEWAY_REQUEST_TIMEOUT_MS, DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS, GatewayBrowserDeviceAuthLifecycle, GatewayClient, GatewayClientRequestError, GatewayClientRequestTimeoutError, GatewayScopeUpgrade, GatewaySessionMessageSubscriptionCoordinator, MAX_CONNECT_CHALLENGE_TIMEOUT_MS, MAX_SAFE_TIMEOUT_DELAY_MS, MIN_CONNECT_CHALLENGE_TIMEOUT_MS, addSafeTimeoutDelayGraceMs, buildCloudflareAccessHeaders, buildDeviceAuthPayload, buildDeviceAuthPayloadV3, buildGatewayConnectAuth, clampConnectChallengeTimeoutMs, clearGatewayConnectTimeout, createSessionProjection, gatewayCredentialScope, gatewayOriginScope, getConnectChallengeTimeoutMsFromEnv, getGatewaySessionMessageSubscriptionCoordinator, hasSessionProjectionAcceptedFinal, isGatewayConnectAssemblyError, isLocallyOptimisticSessionMessage, normalizeDeviceMetadataForAuth, normalizeSessionProjectionRunId, projectLiveSessionMessage, readSessionMessageIdentity, readSessionMessageSequence, reconcileSessionProjectionSnapshot, reduceSessionProjection, reduceSessionProjectionRunEvent, releaseGatewaySessionMessageSubscription, resetGatewaySessionMessageSubscriptionCoordinator, resolveConnectChallengeTimeoutMs, resolveFiniteTimeoutDelayMs, resolveGatewayConnectScopes, resolvePreauthHandshakeTimeoutMs, resolveSafeTimeoutDelayMs, selectGatewayConnectAuth, shouldRetryGatewayWithDeviceToken, startGatewayClientWhenEventLoopReady, startGatewayClientWithReadinessWait, startGatewayConnectTimeout, waitForEventLoopReady };
+export { CF_ACCESS_CLIENT_ID_HEADER, CF_ACCESS_CLIENT_SECRET_HEADER, DEFAULT_GATEWAY_REQUEST_TIMEOUT_MS, DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS, GatewayBrowserDeviceAuthLifecycle, GatewayClient, GatewayClientRequestError, GatewayClientRequestTimeoutError, GatewayScopeUpgrade, GatewaySessionMessageSubscriptionCoordinator, MAX_CONNECT_CHALLENGE_TIMEOUT_MS, MAX_SAFE_TIMEOUT_DELAY_MS, MIN_CONNECT_CHALLENGE_TIMEOUT_MS, addSafeTimeoutDelayGraceMs, buildCloudflareAccessHeaders, buildDeviceAuthPayload, buildDeviceAuthPayloadV3, buildGatewayConnectAuth, clampConnectChallengeTimeoutMs, clearGatewayConnectTimeout, createSessionProjection, gatewayCredentialScope, gatewayOriginScope, getConnectChallengeTimeoutMsFromEnv, getGatewaySessionMessageSubscriptionCoordinator, hasSessionProjectionAcceptedFinal, isGatewayConnectAssemblyError, isGatewayProtocolResponseError, isLocallyOptimisticSessionMessage, normalizeDeviceMetadataForAuth, normalizeSessionProjectionRunId, projectLiveSessionMessage, readAssistantStreamSegmentIdentity, readSessionMessageIdentity, readSessionMessageSequence, reconcileSessionProjectionSnapshot, reduceSessionProjection, reduceSessionProjectionRunEvent, releaseGatewaySessionMessageSubscription, resetGatewaySessionMessageSubscriptionCoordinator, resolveConnectChallengeTimeoutMs, resolveFiniteTimeoutDelayMs, resolveGatewayConnectScopes, resolvePreauthHandshakeTimeoutMs, resolveSafeTimeoutDelayMs, selectGatewayConnectAuth, shouldRetryGatewayWithDeviceToken, startGatewayClientWhenEventLoopReady, startGatewayClientWithReadinessWait, startGatewayConnectTimeout, waitForEventLoopReady };

package/dist/{protocol-client-C-viHJgO.d.mts → protocol-client-DbX7wQED.d.mts}

@@ -1,4 +1,4 @@
-import { n as GatewayProtocolRequestOptions, t as GatewayProtocolRequestError } from "./protocol-request-r0jkQ1XE.mjs";
+import { n as GatewayProtocolRequestOptions, t as GatewayProtocolRequestError } from "./protocol-request-B5gBmLgq.mjs";
 import { ErrorShape, EventFrame, HelloOk } from "@openclaw/gateway-protocol";
 //#region packages/gateway-client/src/pending-request.d.ts
 type GatewayProtocolRequestTiming = {

package/dist/{protocol-request-r0jkQ1XE.d.mts → protocol-request-B5gBmLgq.d.mts}

@@ -1,5 +1,7 @@
 import { ErrorShape } from "@openclaw/gateway-protocol";
 //#region packages/gateway-client/src/protocol-request.d.ts
+/** Distinguishes correlated Gateway responses from locally constructed transport errors. */
+declare function isGatewayProtocolResponseError(error: unknown): error is GatewayProtocolRequestError;
 type GatewayProtocolRequestOptions = {
   timeoutMs?: number | null;
   expectFinal?: boolean;
@@ -13,6 +15,7 @@ declare class GatewayProtocolRequestError extends Error {
   readonly details?: unknown;
   readonly retryable: boolean;
   readonly retryAfterMs?: number;
+  readonly responsePayload?: unknown;
   constructor(error: Partial<ErrorShape>);
 }
 /** A local transport deadline, distinct from a Gateway's authoritative rejection. */
@@ -28,4 +31,4 @@ declare class GatewayProtocolRequestTimeoutError extends Error {
   }, message?: string);
 }
 //#endregion
-export { GatewayProtocolRequestOptions as n, GatewayProtocolRequestTimeoutError as r, GatewayProtocolRequestError as t };
+export { isGatewayProtocolResponseError as i, GatewayProtocolRequestOptions as n, GatewayProtocolRequestTimeoutError as r, GatewayProtocolRequestError as t };

package/dist/{readiness-CJ1QsCtR.d.mts → readiness-5KjCokrl.d.mts}

@@ -1,5 +1,5 @@
-import { n as GatewayProtocolRequestOptions, r as GatewayProtocolRequestTimeoutError, t as GatewayProtocolRequestError } from "./protocol-request-r0jkQ1XE.mjs";
-import "./protocol-client-C-viHJgO.mjs";
+import { n as GatewayProtocolRequestOptions, r as GatewayProtocolRequestTimeoutError, t as GatewayProtocolRequestError } from "./protocol-request-B5gBmLgq.mjs";
+import "./protocol-client-DbX7wQED.mjs";
 import { ConnectParams, ErrorShape, EventFrame, HelloOk } from "@openclaw/gateway-protocol/frame-guards";
 import { GatewayClientMode, GatewayClientName } from "@openclaw/gateway-protocol/client-info";
 //#region packages/gateway-client/src/request-error.d.ts

package/dist/readiness.d.mts

@@ -1,2 +1,2 @@
-import { a as startGatewayClientWithReadinessWait, i as startGatewayClientWhenEventLoopReady, n as GatewayClientStartReadinessOptions, r as GatewayClientStartable, t as EventLoopReadyWaiter } from "./readiness-CJ1QsCtR.mjs";
+import { a as startGatewayClientWithReadinessWait, i as startGatewayClientWhenEventLoopReady, n as GatewayClientStartReadinessOptions, r as GatewayClientStartable, t as EventLoopReadyWaiter } from "./readiness-5KjCokrl.mjs";
 export { EventLoopReadyWaiter, GatewayClientStartReadinessOptions, GatewayClientStartable, startGatewayClientWhenEventLoopReady, startGatewayClientWithReadinessWait };

package/dist/scope-upgrade.d.mts

@@ -1,12 +1,12 @@
 import { a as GatewayBrowserDeviceTokenStore } from "./browser-device-auth-DoPo-sPB.mjs";
-import { n as GatewayProtocolRequestOptions } from "./protocol-request-r0jkQ1XE.mjs";
+import { n as GatewayProtocolRequestOptions } from "./protocol-request-B5gBmLgq.mjs";
 //#region packages/gateway-client/src/scope-upgrade.d.ts
-type ScopeUpgradeBinding = {
+export type ScopeUpgradeBinding = {
   clientId: string;
   deviceId: string;
   role: string;
 };
-type ScopeUpgradeOutcome = {
+export type ScopeUpgradeOutcome = {
   status: "approved";
   requestId: string;
   scopes: string[];
@@ -14,14 +14,14 @@ type ScopeUpgradeOutcome = {
   status: "rejected" | "expired";
   requestId: string;
 };
-type ScopeUpgradeOptions = {
+export type ScopeUpgradeOptions = {
   binding: ScopeUpgradeBinding;
   scopes: readonly string[];
   onPending?: (requestId: string) => void;
 };
 type UpgradeRequester = (method: string, params?: unknown, options?: GatewayProtocolRequestOptions) => Promise<unknown>;
 /** Runs one browser device scope upgrade and owns rotated-token persistence. */
-declare class GatewayScopeUpgrade {
+export declare class GatewayScopeUpgrade {
   private readonly deps;
   private active?;
   constructor(deps: {
@@ -33,5 +33,4 @@ declare class GatewayScopeUpgrade {
   cancelScopeUpgrade(): void;
   private runUpgrade;
 }
-//#endregion
-export { GatewayScopeUpgrade, ScopeUpgradeBinding, ScopeUpgradeOptions, ScopeUpgradeOutcome };
+//#endregion

package/dist/{session-subscriptions-DNKXLO-Z.d.mts → session-subscriptions-D2UdeJ0u.d.mts}

@@ -1,4 +1,4 @@
-import { n as GatewayProtocolRequestOptions } from "./protocol-request-r0jkQ1XE.mjs";
+import { n as GatewayProtocolRequestOptions } from "./protocol-request-B5gBmLgq.mjs";
 //#region packages/gateway-client/src/device-auth.d.ts
 declare function normalizeDeviceMetadataForAuth(value?: string | null): string;
 type DeviceAuthPayloadParams = {
@@ -26,6 +26,8 @@ declare function gatewayCredentialScope(gatewayUrl: string): string;
 //#endregion
 //#region packages/gateway-client/src/session-projection-message-identity.d.ts
 type SessionMessageEnvelope = {
+  /** An unsequenced continuation follows this row; null denotes an unsequenced boundary. */
+  afterSequence?: number | null;
   messageId?: unknown;
   messageSeq?: unknown;
   clientRunId?: unknown;
@@ -37,6 +39,8 @@ type SessionMessageIdentity = {
   id: string | null;
   sequence: number | null;
   idempotencyKey: string | null;
+  /** User submission identity stays stable when a queued turn acquires a new execution run. */
+  sendId: string | null;
   runId: string | null;
   isImported: boolean;
   externalSource: string | null;
@@ -47,6 +51,11 @@ declare function readSessionMessageSequence(message: unknown, envelope?: Session
 declare function normalizeSessionProjectionRunId(value: unknown): string | null;
 /** Persisted row facts win; assistant run ownership comes from its authoritative producer. */
 declare function readSessionMessageIdentity(message: unknown, envelope?: SessionMessageEnvelope): SessionMessageIdentity | null;
+/** A commentary item's display identity is separate from the transcript row that later owns it. */
+declare function readAssistantStreamSegmentIdentity(message: unknown): {
+  itemId: string;
+  runId?: string;
+} | undefined;
 //#endregion
 //#region packages/gateway-client/src/session-projection.d.ts
 type SessionProjectionScope = {
@@ -81,6 +90,7 @@ type SessionProjectionRunTransition = {
 type SessionProjectionEntry = {
   message: unknown;
   identity: SessionMessageIdentity | null;
+  afterSequence?: number | null;
   live: boolean;
   pending: boolean;
   pendingRunId: string | null;
@@ -177,4 +187,4 @@ declare function getGatewaySessionMessageSubscriptionCoordinator(client: Gateway
 declare function resetGatewaySessionMessageSubscriptionCoordinator(client: GatewaySessionMessageRequestClient): void;
 declare function releaseGatewaySessionMessageSubscription(subscription: GatewaySessionMessageSubscription): Promise<void>;
 //#endregion
-export { gatewayCredentialScope as A, reduceSessionProjection as C, normalizeSessionProjectionRunId as D, SessionMessageIdentity as E, buildDeviceAuthPayload as M, buildDeviceAuthPayloadV3 as N, readSessionMessageIdentity as O, normalizeDeviceMetadataForAuth as P, reconcileSessionProjectionSnapshot as S, SessionMessageEnvelope as T, SessionProjectionState as _, GatewaySessionMessageSubscriptionOptions as a, isLocallyOptimisticSessionMessage as b, resetGatewaySessionMessageSubscriptionCoordinator as c, SessionProjectionGatewayRunEvent as d, SessionProjectionRun as f, SessionProjectionSnapshotOptions as g, SessionProjectionScope as h, GatewaySessionMessageSubscriptionCoordinatorOptions as i, gatewayOriginScope as j, readSessionMessageSequence as k, SessionProjectionEntry as l, SessionProjectionRunTransition as m, GatewaySessionMessageSubscription as n, getGatewaySessionMessageSubscriptionCoordinator as o, SessionProjectionRunStatus as p, GatewaySessionMessageSubscriptionCoordinator as r, releaseGatewaySessionMessageSubscription as s, GatewaySessionMessageRequestClient as t, SessionProjectionEvent as u, createSessionProjection as v, reduceSessionProjectionRunEvent as w, projectLiveSessionMessage as x, hasSessionProjectionAcceptedFinal as y };
+export { readSessionMessageSequence as A, reduceSessionProjection as C, normalizeSessionProjectionRunId as D, SessionMessageIdentity as E, normalizeDeviceMetadataForAuth as F, gatewayOriginScope as M, buildDeviceAuthPayload as N, readAssistantStreamSegmentIdentity as O, buildDeviceAuthPayloadV3 as P, reconcileSessionProjectionSnapshot as S, SessionMessageEnvelope as T, SessionProjectionState as _, GatewaySessionMessageSubscriptionOptions as a, isLocallyOptimisticSessionMessage as b, resetGatewaySessionMessageSubscriptionCoordinator as c, SessionProjectionGatewayRunEvent as d, SessionProjectionRun as f, SessionProjectionSnapshotOptions as g, SessionProjectionScope as h, GatewaySessionMessageSubscriptionCoordinatorOptions as i, gatewayCredentialScope as j, readSessionMessageIdentity as k, SessionProjectionEntry as l, SessionProjectionRunTransition as m, GatewaySessionMessageSubscription as n, getGatewaySessionMessageSubscriptionCoordinator as o, SessionProjectionRunStatus as p, GatewaySessionMessageSubscriptionCoordinator as r, releaseGatewaySessionMessageSubscription as s, GatewaySessionMessageRequestClient as t, SessionProjectionEvent as u, createSessionProjection as v, reduceSessionProjectionRunEvent as w, projectLiveSessionMessage as x, hasSessionProjectionAcceptedFinal as y };

package/dist/{session-subscriptions-Uxa34zU5.mjs → session-subscriptions-DT0ZioFT.mjs}

@@ -433,6 +433,11 @@ var GatewayEventListeners = class {
 };
 //#endregion
 //#region packages/gateway-client/src/protocol-request.ts
+const gatewayResponseErrors = /* @__PURE__ */ new WeakSet();
+/** Distinguishes correlated Gateway responses from locally constructed transport errors. */
+function isGatewayProtocolResponseError(error) {
+	return error instanceof Error && gatewayResponseErrors.has(error);
+}
 var GatewayProtocolRequestError = class extends Error {
 	constructor(error) {
 		super(error.message ?? "request failed");
@@ -444,6 +449,15 @@ var GatewayProtocolRequestError = class extends Error {
 		this.retryAfterMs = error.retryAfterMs;
 	}
 };
+/** Preserve response metadata after custom factories without adding it to error JSON. */
+function retainGatewayResponsePayload(error, payload) {
+	gatewayResponseErrors.add(error);
+	Object.defineProperty(error, "responsePayload", {
+		value: payload,
+		enumerable: false,
+		configurable: true
+	});
+}
 /** A local transport deadline, distinct from a Gateway's authoritative rejection. */
 var GatewayProtocolRequestTimeoutError = class extends Error {
 	constructor(params, message = `gateway request timed out after ${params.timeoutMs}ms: ${params.method}`) {
@@ -544,7 +558,7 @@ var GatewayPendingRequests = class {
 		const pending = this.pending.get(frame.id);
 		if (!pending) return;
 		const status = frame.payload?.status;
-		if (pending.expectFinal && status === "accepted") {
+		if (frame.ok && pending.expectFinal && status === "accepted") {
 			if (!pending.acceptedNotified) {
 				pending.acceptedNotified = true;
 				this.invoke("accepted", () => pending.onAccepted?.(frame.payload));
@@ -559,7 +573,9 @@ var GatewayPendingRequests = class {
 			return;
 		}
 		this.finishTiming(frame.id, pending, false, frame.error?.code);
-		pending.reject(this.opts.createRequestError?.(frame.error ?? {}) ?? new GatewayProtocolRequestError(frame.error ?? {}));
+		const error = this.opts.createRequestError?.(frame.error ?? {}) ?? new GatewayProtocolRequestError(frame.error ?? {});
+		retainGatewayResponsePayload(error, frame.payload);
+		pending.reject(error);
 	}
 	flush(error) {
 		const retired = [...this.pending];
@@ -825,7 +841,7 @@ var GatewayProtocolClient = class {
 		this.recordTiming("request-sent", generation, plan);
 		this.connectRequestSent = true;
 		this.request("connect", this.opts.buildConnectParams(plan)).then((hello) => {
-			if (!this.isActive(socket, generation)) return;
+			if (!this.isActive(socket, generation) || !socket.isOpen()) return;
 			this.helloReceived = true;
 			this.clearHandshakeTimer();
 			this.connectFailure = void 0;
@@ -986,6 +1002,7 @@ const NON_RECOVERABLE_AUTH_ERRORS = /* @__PURE__ */ new Set([
 	ConnectErrorDetailCodes.AUTH_DEVICE_TOKEN_MISMATCH,
 	ConnectErrorDetailCodes.AUTH_SCOPE_MISMATCH,
 	ConnectErrorDetailCodes.AUTH_IDENTITY_HEADER_REQUIRED,
+	ConnectErrorDetailCodes.AUTH_VERIFIED_USER_REQUIRED,
 	ConnectErrorDetailCodes.CONTROL_UI_BUILD_MISMATCH,
 	ConnectErrorDetailCodes.PAIRING_REQUIRED,
 	ConnectErrorDetailCodes.CONTROL_UI_DEVICE_IDENTITY_REQUIRED,
@@ -1044,12 +1061,14 @@ function readSessionMessageIdentity(message, envelope) {
 	const isCliAssistant = role === "assistant" && readSessionProjectionString(record.api)?.toLowerCase() === "cli";
 	const canonicalPersistedRunId = isCliAssistant && persistedRunId?.startsWith("cli-assistant:") ? readSessionProjectionString(persistedRunId.slice(14)) : persistedRunId;
 	const optimisticRunId = metadata && Object.keys(metadata).every((key) => key === "idempotencyKey") ? canonicalPersistedRunId : null;
+	const runId = role === "assistant" ? metadataRunId ?? envelopeRunId ?? (isCliAssistant || !mirroredMessage ? canonicalPersistedRunId : null) ?? optimisticRunId : metadataRunId ?? canonicalPersistedRunId ?? envelopeRunId;
 	return {
 		role,
 		id: readSessionProjectionString(metadata?.id) ?? readSessionProjectionString(envelope?.messageId),
 		sequence: readSessionMessageSequence(message, envelope),
 		idempotencyKey,
-		runId: role === "assistant" ? metadataRunId ?? envelopeRunId ?? (isCliAssistant || !mirroredMessage ? canonicalPersistedRunId : null) ?? optimisticRunId : metadataRunId ?? canonicalPersistedRunId ?? envelopeRunId,
+		sendId: role === "user" ? persistedRunId ?? runId : null,
+		runId,
 		isImported: Boolean(importedFrom || cliSessionId || externalId),
 		externalSource: importedFrom && cliSessionId && externalId ? JSON.stringify([
 			importedFrom,
@@ -1058,6 +1077,18 @@ function readSessionMessageIdentity(message, envelope) {
 		]) : null
 	};
 }
+/** A commentary item's display identity is separate from the transcript row that later owns it. */
+function readAssistantStreamSegmentIdentity(message) {
+	const record = asNullableRecord(message);
+	if (readSessionProjectionString(record?.role)?.toLowerCase() !== "assistant") return;
+	const fallback = asNullableRecord(record?.openclawStreamFallback);
+	const itemId = readSessionProjectionString(fallback?.itemId);
+	const runId = readSessionMessageIdentity(message)?.runId ?? readSessionProjectionString(record?.runId) ?? readSessionProjectionString(fallback?.runId);
+	return itemId ? {
+		itemId,
+		...runId ? { runId } : {}
+	} : void 0;
+}
 //#endregion
 //#region packages/gateway-client/src/session-projection-run-event.ts
 function readNonemptyString(value) {
@@ -1123,6 +1154,7 @@ function createEntry(message, options) {
 	return {
 		message,
 		identity,
+		afterSequence: options?.envelope?.afterSequence,
 		live: options?.live === true,
 		pending: pendingRunId !== null,
 		pendingRunId
@@ -1174,15 +1206,19 @@ function entryMatches(left, right, allowSnapshotPromotion = false) {
 	const durableEntry = left.identity?.id ? left : right.identity?.id ? right : null;
 	const provisionalEntry = durableEntry === left ? right : durableEntry === right ? left : null;
 	const durableMetadata = asNullableRecord(asNullableRecord(durableEntry?.message)?.["__openclaw"]);
-	if (durableEntry?.live && provisionalEntry?.live && durableEntry.identity?.role === "assistant" && provisionalEntry.identity?.role === "assistant" && !durableEntry.identity.isImported && !provisionalEntry.identity.isImported && !provisionalEntry.identity.id && durableEntry.identity.runId && durableEntry.identity.runId === provisionalEntry.identity.runId && (readSessionProjectionString(durableMetadata?.mirrorOrigin) === null || durableMetadata?.runTerminal === true)) return true;
+	if (durableEntry?.identity?.role === "assistant" && provisionalEntry?.identity?.role === "assistant" && !durableEntry.identity.isImported && !provisionalEntry.identity.isImported && !provisionalEntry.identity.id) {
+		const durableSegment = readAssistantStreamSegmentIdentity(durableEntry.message);
+		const provisionalSegment = readAssistantStreamSegmentIdentity(provisionalEntry.message);
+		if (provisionalEntry.identity.sequence === null && durableSegment?.runId && durableSegment.runId === provisionalSegment?.runId && durableSegment.itemId === provisionalSegment.itemId) return true;
+		if (provisionalEntry.live && provisionalEntry.identity.sequence === null && (provisionalEntry.afterSequence === void 0 || provisionalEntry.afterSequence !== null && durableEntry.identity.sequence !== null && durableEntry.identity.sequence > provisionalEntry.afterSequence) && durableEntry.identity.runId && durableEntry.identity.runId === provisionalEntry.identity.runId && (readSessionProjectionString(durableMetadata?.mirrorOrigin) === null || durableMetadata?.runTerminal === true)) return true;
+	}
 	const persisted = left.identity;
 	const observed = right.identity;
-	const persistedMetadata = asNullableRecord(asNullableRecord(left.message)?.["__openclaw"]);
-	if (allowSnapshotPromotion && right.live && persisted && observed && persisted.role === observed.role && !persisted.isImported && !observed.isImported && persisted.id && !observed.id && (persisted.sequence !== null && persisted.sequence === observed.sequence || persisted.role === "assistant" && observed.sequence === null && persisted.runId !== null && persisted.runId === observed.runId && (readSessionProjectionString(persistedMetadata?.mirrorOrigin) === null || persistedMetadata?.runTerminal === true))) return true;
+	if (allowSnapshotPromotion && right.live && persisted && observed && persisted.role === observed.role && !persisted.isImported && !observed.isImported && persisted.id && !observed.id && persisted.sequence !== null && persisted.sequence === observed.sequence) return true;
 	if (left.pending && right.pending) return Boolean(left.identity?.role === right.identity?.role && left.pendingRunId && left.pendingRunId === right.pendingRunId);
 	const pending = left.pending ? left : right.pending ? right : null;
 	const authoritative = pending === left ? right : pending === right ? left : null;
-	return Boolean(pending && authoritative && pending.identity && authoritative.identity && pending.identity.role === authoritative.identity.role && !pending.identity.isImported && !authoritative.identity.isImported && pending.pendingRunId && pending.pendingRunId === authoritative.identity.runId && (pending.identity.sequence === null || authoritative.identity.sequence === null || pending.identity.sequence === authoritative.identity.sequence));
+	return Boolean(pending && authoritative && pending.identity && authoritative.identity && pending.identity.role === authoritative.identity.role && !pending.identity.isImported && !authoritative.identity.isImported && pending.pendingRunId && pending.pendingRunId === (authoritative.identity.sendId ?? authoritative.identity.runId) && (pending.identity.sequence === null || authoritative.identity.sequence === null || pending.identity.sequence === authoritative.identity.sequence));
 }
 function withEntries(state, entries) {
 	return {
@@ -1197,10 +1233,24 @@ function insertEntry(entries, incoming, runs) {
 		const candidate = entry.identity?.sequence;
 		return candidate !== void 0 && candidate !== null && candidate > sequence;
 	});
-	if (nextIndex < 0 && incoming.identity?.role === "user" && incoming.identity.runId) {
+	if (sequence !== void 0 && sequence !== null && nextIndex < 0) nextIndex = entries.length;
+	if (incoming.identity?.role === "user" && incoming.identity.runId) {
 		const runId = incoming.identity.runId;
 		const terminalMessage = runs?.[runId]?.message;
-		nextIndex = entries.findIndex((entry) => entry.identity?.role === "assistant" && (entry.identity.runId === runId || entry.message === terminalMessage));
+		const belongsToRun = (entry) => entry.identity?.role === "assistant" && (entry.identity.runId === runId || entry.message === terminalMessage);
+		if (sequence !== void 0 && sequence !== null) {
+			const before = [];
+			const replies = [];
+			for (const entry of entries.slice(0, nextIndex)) (entry.identity?.sequence === null && belongsToRun(entry) ? replies : before).push(entry);
+			return [
+				...before,
+				incoming,
+				...replies,
+				...entries.slice(nextIndex)
+			];
+		}
+		const terminalIndex = entries.findIndex(belongsToRun);
+		if (terminalIndex >= 0 && (nextIndex < 0 || terminalIndex < nextIndex)) nextIndex = terminalIndex;
 	}
 	return nextIndex < 0 ? [...entries, incoming] : [
 		...entries.slice(0, nextIndex),
@@ -1215,12 +1265,13 @@ function projectLiveSessionMessage(state, message, envelope, scope = {}) {
 		live: true
 	});
 	if (!incoming.identity) return state;
-	const existingIndex = state.entries.findIndex((entry) => entryMatches(entry, incoming));
-	if (existingIndex < 0) return withEntries(state, insertEntry(state.entries, incoming, state.runs));
-	const existing = state.entries[existingIndex];
-	if (existing && existing.message === message && existing.live && !existing.pending) return state;
-	if (existing && !existing.pending && existing.identity?.id && !incoming.identity.id) return state;
-	if (existing?.pending && incoming.identity.sequence !== null) {
+	const matches = state.entries.filter((entry) => entryMatches(entry, incoming));
+	const existing = matches.find((entry) => sameTranscriptIdentity(entry.identity, incoming.identity)) ?? (matches.length === 1 ? matches[0] : void 0);
+	if (!existing) return withEntries(state, insertEntry(state.entries, incoming, state.runs));
+	const existingIndex = state.entries.indexOf(existing);
+	if (existing.message === message && existing.live && !existing.pending) return state;
+	if (!existing.pending && existing.identity?.id && !incoming.identity.id) return state;
+	if (incoming.identity.sequence !== null && (existing.pending || existing.identity?.sequence === null)) {
 		const sequence = incoming.identity.sequence;
 		return withEntries(state, state.entries.some(({ identity }, index) => identity?.sequence != null && (index < existingIndex ? identity.sequence > sequence : identity.sequence < sequence)) ? insertEntry(state.entries.filter((_, index) => index !== existingIndex), incoming, state.runs) : state.entries.toSpliced(existingIndex, 1, incoming));
 	}
@@ -1639,4 +1690,4 @@ function releaseGatewaySessionMessageSubscription(subscription) {
 	return sessionMessageSubscriptionOwners.get(subscription)?.coordinator.release(subscription) ?? Promise.resolve();
 }
 //#endregion
-export { buildGatewayConnectAuth as C, buildDeviceAuthPayload as D, shouldRetryGatewayWithDeviceToken as E, buildDeviceAuthPayloadV3 as O, GatewayBrowserDeviceAuthLifecycle as S, selectGatewayConnectAuth as T, GatewayProtocolClient as _, createSessionProjection as a, gatewayCredentialScope as b, projectLiveSessionMessage as c, reduceSessionProjectionRunEvent as d, normalizeSessionProjectionRunId as f, shouldPauseGatewayReconnect as g, isRecord as h, resetGatewaySessionMessageSubscriptionCoordinator as i, normalizeDeviceMetadataForAuth as k, reconcileSessionProjectionSnapshot as l, readSessionMessageSequence as m, getGatewaySessionMessageSubscriptionCoordinator as n, hasSessionProjectionAcceptedFinal as o, readSessionMessageIdentity as p, releaseGatewaySessionMessageSubscription as r, isLocallyOptimisticSessionMessage as s, GatewaySessionMessageSubscriptionCoordinator as t, reduceSessionProjection as u, GatewayProtocolRequestError as v, resolveGatewayConnectScopes as w, gatewayOriginScope as x, GatewayProtocolRequestTimeoutError as y };
+export { buildDeviceAuthPayloadV3 as A, gatewayOriginScope as C, selectGatewayConnectAuth as D, resolveGatewayConnectScopes as E, shouldRetryGatewayWithDeviceToken as O, gatewayCredentialScope as S, buildGatewayConnectAuth as T, shouldPauseGatewayReconnect as _, createSessionProjection as a, GatewayProtocolRequestTimeoutError as b, projectLiveSessionMessage as c, reduceSessionProjectionRunEvent as d, normalizeSessionProjectionRunId as f, isRecord as g, readSessionMessageSequence as h, resetGatewaySessionMessageSubscriptionCoordinator as i, normalizeDeviceMetadataForAuth as j, buildDeviceAuthPayload as k, reconcileSessionProjectionSnapshot as l, readSessionMessageIdentity as m, getGatewaySessionMessageSubscriptionCoordinator as n, hasSessionProjectionAcceptedFinal as o, readAssistantStreamSegmentIdentity as p, releaseGatewaySessionMessageSubscription as r, isLocallyOptimisticSessionMessage as s, GatewaySessionMessageSubscriptionCoordinator as t, reduceSessionProjection as u, GatewayProtocolClient as v, GatewayBrowserDeviceAuthLifecycle as w, isGatewayProtocolResponseError as x, GatewayProtocolRequestError as y };

package/dist/timeouts.d.mts

@@ -1,43 +1,42 @@
 //#region packages/gateway-client/src/timeouts.d.ts
 /** Maximum delay Node timers can represent without overflow warnings. */
-declare const MAX_SAFE_TIMEOUT_DELAY_MS = 2147483647;
+export declare const MAX_SAFE_TIMEOUT_DELAY_MS = 2147483647;
 /** Default server-side window for gateway preauth handshakes. */
-declare const DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS = 15000;
+export declare const DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS = 15000;
 /** Starts the browser-safe deadline that covers Gateway connect preparation and hello. */
-declare function startGatewayConnectTimeout(onTimeout: () => void): ReturnType<typeof setTimeout>;
+export declare function startGatewayConnectTimeout(onTimeout: () => void): ReturnType<typeof setTimeout>;
 /** Clears either pending Gateway handshake phase without retaining its timer. */
-declare function clearGatewayConnectTimeout(timer: ReturnType<typeof setTimeout> | null): null;
+export declare function clearGatewayConnectTimeout(timer: ReturnType<typeof setTimeout> | null): null;
 /** Default deadline for a single non-streaming Gateway request. */
-declare const DEFAULT_GATEWAY_REQUEST_TIMEOUT_MS = 30000;
+export declare const DEFAULT_GATEWAY_REQUEST_TIMEOUT_MS = 30000;
 /** Minimum client watchdog delay for connect challenge setup. */
-declare const MIN_CONNECT_CHALLENGE_TIMEOUT_MS = 250;
+export declare const MIN_CONNECT_CHALLENGE_TIMEOUT_MS = 250;
 /** Default maximum client watchdog delay, aligned with the preauth server timeout. */
-declare const MAX_CONNECT_CHALLENGE_TIMEOUT_MS = 15000;
+export declare const MAX_CONNECT_CHALLENGE_TIMEOUT_MS = 15000;
 /** Clamps arbitrary timer delays to Node's safe range and an optional floor. */
-declare function resolveSafeTimeoutDelayMs(delayMs: number, opts?: {
+export declare function resolveSafeTimeoutDelayMs(delayMs: number, opts?: {
   minMs?: number;
 }): number;
 /** Adds grace time while preserving safe timer bounds if inputs overflow or are invalid. */
-declare function addSafeTimeoutDelayGraceMs(delayMs: number, graceMs: number, opts?: {
+export declare function addSafeTimeoutDelayGraceMs(delayMs: number, graceMs: number, opts?: {
   minMs?: number;
 }): number;
 /** Resolves optional timeout values through a fallback and safe timer clamp. */
-declare function resolveFiniteTimeoutDelayMs(delayMs: number | null | undefined, fallbackMs: number, opts?: {
+export declare function resolveFiniteTimeoutDelayMs(delayMs: number | null | undefined, fallbackMs: number, opts?: {
   minMs?: number;
 }): number;
 /** Clamps connect challenge watchdog timeouts to the gateway-supported range. */
-declare function clampConnectChallengeTimeoutMs(timeoutMs: number, maxTimeoutMs?: number): number;
+export declare function clampConnectChallengeTimeoutMs(timeoutMs: number, maxTimeoutMs?: number): number;
 /** Reads the connect challenge watchdog override from the process environment. */
-declare function getConnectChallengeTimeoutMsFromEnv(env?: NodeJS.ProcessEnv): number | undefined;
+export declare function getConnectChallengeTimeoutMsFromEnv(env?: NodeJS.ProcessEnv): number | undefined;
 /** Resolves the client watchdog timeout using explicit, env, then preauth defaults. */
-declare function resolveConnectChallengeTimeoutMs(timeoutMs?: number | null, params?: {
+export declare function resolveConnectChallengeTimeoutMs(timeoutMs?: number | null, params?: {
   env?: NodeJS.ProcessEnv;
   configuredTimeoutMs?: number | null;
 }): number;
 /** Resolves the server preauth timeout from env, explicit config, or default. */
-declare function resolvePreauthHandshakeTimeoutMs(params?: {
+export declare function resolvePreauthHandshakeTimeoutMs(params?: {
   env?: NodeJS.ProcessEnv;
   configuredTimeoutMs?: number | null;
 }): number;
-//#endregion
-export { DEFAULT_GATEWAY_REQUEST_TIMEOUT_MS, DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS, MAX_CONNECT_CHALLENGE_TIMEOUT_MS, MAX_SAFE_TIMEOUT_DELAY_MS, MIN_CONNECT_CHALLENGE_TIMEOUT_MS, addSafeTimeoutDelayGraceMs, clampConnectChallengeTimeoutMs, clearGatewayConnectTimeout, getConnectChallengeTimeoutMsFromEnv, resolveConnectChallengeTimeoutMs, resolveFiniteTimeoutDelayMs, resolvePreauthHandshakeTimeoutMs, resolveSafeTimeoutDelayMs, startGatewayConnectTimeout };
+//#endregion

package/dist/websocket-data.d.mts

@@ -1,5 +1,4 @@
 import { RawData } from "ws";
 //#region packages/gateway-client/src/websocket-data.d.ts
-declare function rawDataToString(data: RawData, encoding?: BufferEncoding): string;
-//#endregion
-export { rawDataToString };
+export declare function rawDataToString(data: RawData, encoding?: BufferEncoding): string;
+//#endregion

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/gateway-client",
-  "version": "2026.9.1-beta.1",
+  "version": "2026.9.1",
   "description": "Reference WebSocket client for the OpenClaw Gateway protocol",
   "keywords": [
     "client",
@@ -62,9 +62,9 @@
     }
   },
   "dependencies": {
+    "@openclaw/gateway-protocol": "2026.9.1",
     "ipaddr.js": "2.5.0",
-    "ws": "8.21.3",
-    "@openclaw/gateway-protocol": "2026.9.1-beta.1"
+    "ws": "8.21.3"
   },
   "devDependencies": {
     "@openclaw/normalization-core": "0.0.0-private"