@openclaw/gateway-client 2026.9.8 → 2026.10.1-beta.1

package/dist/{browser-device-auth-DoPo-sPB.d.mts → browser-device-auth-_UweR4aN.d.mts}

@@ -13,13 +13,7 @@ type GatewayConnectAuthSelection = {
   storedScopes?: string[];
   usingStoredDeviceToken?: boolean;
 };
-declare function selectGatewayConnectAuth(params: {
-  token?: string;
-  bootstrapToken?: string;
-  deviceToken?: string;
-  password?: string;
-  approvalRuntimeToken?: string;
-  agentRuntimeIdentityToken?: string;
+declare function selectGatewayConnectAuth(params: NonNullable<ConnectParams["auth"]> & {
   storedToken?: string;
   storedScopes?: string[];
   pendingDeviceTokenRetry?: boolean;

package/dist/browser.d.mts

@@ -1,10 +1,10 @@
 import { A as normalizeSessionProjectionRunId, C as reduceSessionProjectionRunEvent, D as SessionMessageIdentity, E as SessionMessageEnvelope, F as gatewayOriginScope, I as mergeChatStreamMessage, L as buildDeviceAuthPayload, M as readSessionMessageIdentity, N as readSessionMessageSequence, O as SessionProjectionEntry, P as gatewayCredentialScope, R as buildDeviceAuthPayloadV3, S as SessionProjectionRunTransition, T as readSessionProjectionFinalMessageIdentity, _ as reconcileSessionProjectionSnapshot, a as GatewaySessionMessageSubscriptionOptions, b as projectSessionTerminalReplyMessage, c as resetGatewaySessionMessageSubscriptionCoordinator, d as SessionProjectionRunStatus, f as SessionProjectionScope, g as projectLiveSessionMessage, h as createSessionProjection, i as GatewaySessionMessageSubscriptionCoordinatorOptions, j as readAssistantStreamSegmentIdentity, k as isLocallyOptimisticSessionMessage, l as SessionProjectionEvent, m as SessionProjectionState, n as GatewaySessionMessageSubscription, o as getGatewaySessionMessageSubscriptionCoordinator, p as SessionProjectionSnapshotOptions, r as GatewaySessionMessageSubscriptionCoordinator, s as releaseGatewaySessionMessageSubscription, t as GatewaySessionMessageRequestClient, u as SessionProjectionRun, v as reduceSessionProjection, w as hasSessionProjectionAcceptedFinal, x as SessionProjectionGatewayRunEvent, y as isSessionProjectionErrorMessage, z as normalizeDeviceMetadataForAuth } from "./session-subscriptions-Bcq6_wtR.mjs";
-import { a as GatewayBrowserDeviceTokenStore, c as resolveGatewayConnectScopes, i as GatewayBrowserDeviceTokenRecord, l as selectGatewayConnectAuth, n as GatewayBrowserDeviceAuthPlan, o as GatewayConnectAuthSelection, r as GatewayBrowserDeviceIdentity, s as buildGatewayConnectAuth, t as GatewayBrowserDeviceAuthLifecycle, u as shouldRetryGatewayWithDeviceToken } from "./browser-device-auth-DoPo-sPB.mjs";
+import { a as GatewayBrowserDeviceTokenStore, c as resolveGatewayConnectScopes, i as GatewayBrowserDeviceTokenRecord, l as selectGatewayConnectAuth, n as GatewayBrowserDeviceAuthPlan, o as GatewayConnectAuthSelection, r as GatewayBrowserDeviceIdentity, s as buildGatewayConnectAuth, t as GatewayBrowserDeviceAuthLifecycle, u as shouldRetryGatewayWithDeviceToken } from "./browser-device-auth-_UweR4aN.mjs";
 import { i as isGatewayProtocolResponseError, n as GatewayProtocolRequestOptions, r as GatewayProtocolRequestTimeoutError, t as GatewayProtocolRequestError } from "./protocol-request-CtVhe3Bj.mjs";
 import { a as GatewayProtocolConnectAuthority, c as GatewayProtocolTiming, i as GatewayProtocolCloseContext, l as GatewayProtocolRequestTiming, o as GatewayProtocolSocket, s as GatewayProtocolSocketHandlers, t as GatewayProtocolClient } from "./protocol-client-DT451Msj.mjs";
 import { DEFAULT_GATEWAY_REQUEST_TIMEOUT_MS, DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS, resolveSafeTimeoutDelayMs } from "./timeouts.mjs";
 import { ConnectParams as ConnectParams$1, GATEWAY_SERVER_CAPS } from "@openclaw/gateway-protocol/frame-guards";
-import { ConnectParams, ErrorShape, EventFrame, HelloOk } from "@openclaw/gateway-protocol";
+import { ChannelsStatusResult, ConnectParams, ErrorShape, EventFrame, HelloOk, QuestionRecord } from "@openclaw/gateway-protocol";
 export * from "@openclaw/gateway-protocol/connect-error-details";
 export * from "@openclaw/gateway-protocol/gateway-error-details";
 export * from "@openclaw/gateway-protocol/client-info";
@@ -47,4 +47,4 @@ export declare function shouldPauseGatewayReconnect(params: {
   clientVersionMismatchIsTerminal?: boolean;
 }): boolean;
 //#endregion
-export { type ConnectParams, DEFAULT_GATEWAY_REQUEST_TIMEOUT_MS, DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS, type ErrorShape, type EventFrame, GATEWAY_SERVER_CAPS, GatewayBrowserDeviceAuthLifecycle, GatewayBrowserDeviceAuthPlan, GatewayBrowserDeviceIdentity, GatewayBrowserDeviceTokenRecord, GatewayBrowserDeviceTokenStore, GatewayConnectAuthSelection, GatewayProtocolClient, type GatewayProtocolCloseContext, type GatewayProtocolConnectAuthority, GatewayProtocolRequestError, type GatewayProtocolRequestOptions, GatewayProtocolRequestTimeoutError, type GatewayProtocolRequestTiming, type GatewayProtocolSocket, type GatewayProtocolSocketHandlers, type GatewayProtocolTiming, GatewaySessionMessageRequestClient, GatewaySessionMessageSubscription, GatewaySessionMessageSubscriptionCoordinator, GatewaySessionMessageSubscriptionCoordinatorOptions, GatewaySessionMessageSubscriptionOptions, type HelloOk, type SessionMessageEnvelope, type SessionMessageIdentity, type SessionProjectionEntry, SessionProjectionEvent, type SessionProjectionGatewayRunEvent, SessionProjectionRun, SessionProjectionRunStatus, type SessionProjectionRunTransition, SessionProjectionScope, SessionProjectionSnapshotOptions, SessionProjectionState, buildDeviceAuthPayload, buildDeviceAuthPayloadV3, buildGatewayConnectAuth, createSessionProjection, gatewayCredentialScope, gatewayOriginScope, getGatewaySessionMessageSubscriptionCoordinator, hasSessionProjectionAcceptedFinal, isGatewayProtocolResponseError, isLocallyOptimisticSessionMessage, isSessionProjectionErrorMessage, mergeChatStreamMessage, normalizeDeviceMetadataForAuth, normalizeSessionProjectionRunId, projectLiveSessionMessage, projectSessionTerminalReplyMessage, readAssistantStreamSegmentIdentity, readSessionMessageIdentity, readSessionMessageSequence, readSessionProjectionFinalMessageIdentity, reconcileSessionProjectionSnapshot, reduceSessionProjection, reduceSessionProjectionRunEvent, releaseGatewaySessionMessageSubscription, resetGatewaySessionMessageSubscriptionCoordinator, resolveGatewayConnectScopes, resolveSafeTimeoutDelayMs, selectGatewayConnectAuth, shouldRetryGatewayWithDeviceToken };
+export { type ChannelsStatusResult, type ConnectParams, DEFAULT_GATEWAY_REQUEST_TIMEOUT_MS, DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS, type ErrorShape, type EventFrame, GATEWAY_SERVER_CAPS, GatewayBrowserDeviceAuthLifecycle, GatewayBrowserDeviceAuthPlan, GatewayBrowserDeviceIdentity, GatewayBrowserDeviceTokenRecord, GatewayBrowserDeviceTokenStore, GatewayConnectAuthSelection, GatewayProtocolClient, type GatewayProtocolCloseContext, type GatewayProtocolConnectAuthority, GatewayProtocolRequestError, type GatewayProtocolRequestOptions, GatewayProtocolRequestTimeoutError, type GatewayProtocolRequestTiming, type GatewayProtocolSocket, type GatewayProtocolSocketHandlers, type GatewayProtocolTiming, GatewaySessionMessageRequestClient, GatewaySessionMessageSubscription, GatewaySessionMessageSubscriptionCoordinator, GatewaySessionMessageSubscriptionCoordinatorOptions, GatewaySessionMessageSubscriptionOptions, type HelloOk, type QuestionRecord, type SessionMessageEnvelope, type SessionMessageIdentity, type SessionProjectionEntry, SessionProjectionEvent, type SessionProjectionGatewayRunEvent, SessionProjectionRun, SessionProjectionRunStatus, type SessionProjectionRunTransition, SessionProjectionScope, SessionProjectionSnapshotOptions, SessionProjectionState, buildDeviceAuthPayload, buildDeviceAuthPayloadV3, buildGatewayConnectAuth, createSessionProjection, gatewayCredentialScope, gatewayOriginScope, getGatewaySessionMessageSubscriptionCoordinator, hasSessionProjectionAcceptedFinal, isGatewayProtocolResponseError, isLocallyOptimisticSessionMessage, isSessionProjectionErrorMessage, mergeChatStreamMessage, normalizeDeviceMetadataForAuth, normalizeSessionProjectionRunId, projectLiveSessionMessage, projectSessionTerminalReplyMessage, readAssistantStreamSegmentIdentity, readSessionMessageIdentity, readSessionMessageSequence, readSessionProjectionFinalMessageIdentity, reconcileSessionProjectionSnapshot, reduceSessionProjection, reduceSessionProjectionRunEvent, releaseGatewaySessionMessageSubscription, resetGatewaySessionMessageSubscriptionCoordinator, resolveGatewayConnectScopes, resolveSafeTimeoutDelayMs, selectGatewayConnectAuth, shouldRetryGatewayWithDeviceToken };

package/dist/browser.mjs

@@ -1,4 +1,4 @@
-import { A as selectGatewayConnectAuth, C as isGatewayProtocolResponseError, D as GatewayBrowserDeviceAuthLifecycle, E as gatewayOriginScope, I as buildDeviceAuthPayload, L as buildDeviceAuthPayloadV3, M as mergeChatStreamMessage, N as asNullableRecord, O as buildGatewayConnectAuth, R as normalizeDeviceMetadataForAuth, S as GatewayProtocolRequestTimeoutError, T as gatewayCredentialScope, _ as readSessionMessageIdentity, a as createSessionProjection, b as GatewayProtocolClient, c as reduceSessionProjection, d as readSessionProjectionFinalMessageIdentity, f as isSessionProjectionErrorMessage, g as readAssistantStreamSegmentIdentity, h as normalizeSessionProjectionRunId, i as resetGatewaySessionMessageSubscriptionCoordinator, j as shouldRetryGatewayWithDeviceToken, k as resolveGatewayConnectScopes, l as reduceSessionProjectionRunEvent, m as isLocallyOptimisticSessionMessage, n as getGatewaySessionMessageSubscriptionCoordinator, o as projectLiveSessionMessage, p as projectSessionTerminalReplyMessage, r as releaseGatewaySessionMessageSubscription, s as reconcileSessionProjectionSnapshot, t as GatewaySessionMessageSubscriptionCoordinator, u as hasSessionProjectionAcceptedFinal, v as readSessionMessageSequence, w as resolveModelCatalogConnect, x as GatewayProtocolRequestError, y as shouldPauseGatewayReconnect } from "./session-subscriptions-LtlX9oRQ.mjs";
+import { A as resolveGatewayConnectScopes, B as buildDeviceAuthPayloadV3, C as isGatewayProtocolResponseError, D as gatewayOriginScope, E as gatewayCredentialScope, F as mergeChatStreamMessage, I as asNullableRecord, M as shouldRetryGatewayWithDeviceToken, O as GatewayBrowserDeviceAuthLifecycle, S as GatewayProtocolRequestTimeoutError, T as resolveModelCatalogConnect, V as normalizeDeviceMetadataForAuth, _ as readSessionMessageIdentity, a as createSessionProjection, b as GatewayProtocolClient, c as reduceSessionProjection, d as readSessionProjectionFinalMessageIdentity, f as isSessionProjectionErrorMessage, g as readAssistantStreamSegmentIdentity, h as normalizeSessionProjectionRunId, i as resetGatewaySessionMessageSubscriptionCoordinator, j as selectGatewayConnectAuth, k as buildGatewayConnectAuth, l as reduceSessionProjectionRunEvent, m as isLocallyOptimisticSessionMessage, n as getGatewaySessionMessageSubscriptionCoordinator, o as projectLiveSessionMessage, p as projectSessionTerminalReplyMessage, r as releaseGatewaySessionMessageSubscription, s as reconcileSessionProjectionSnapshot, t as GatewaySessionMessageSubscriptionCoordinator, u as hasSessionProjectionAcceptedFinal, v as readSessionMessageSequence, x as GatewayProtocolRequestError, y as shouldPauseGatewayReconnect, z as buildDeviceAuthPayload } from "./session-subscriptions-D5CpDUGt.mjs";
 import { DEFAULT_GATEWAY_REQUEST_TIMEOUT_MS, DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS, resolveSafeTimeoutDelayMs } from "./timeouts.mjs";
 import { GATEWAY_SERVER_CAPS } from "@openclaw/gateway-protocol/frame-guards";
 export * from "@openclaw/gateway-protocol/connect-error-details";

package/dist/index.d.mts

@@ -1,9 +1,9 @@
 import { A as normalizeSessionProjectionRunId, C as reduceSessionProjectionRunEvent, D as SessionMessageIdentity, E as SessionMessageEnvelope, F as gatewayOriginScope, I as mergeChatStreamMessage, L as buildDeviceAuthPayload, M as readSessionMessageIdentity, N as readSessionMessageSequence, O as SessionProjectionEntry, P as gatewayCredentialScope, R as buildDeviceAuthPayloadV3, S as SessionProjectionRunTransition, T as readSessionProjectionFinalMessageIdentity, _ as reconcileSessionProjectionSnapshot, a as GatewaySessionMessageSubscriptionOptions, b as projectSessionTerminalReplyMessage, c as resetGatewaySessionMessageSubscriptionCoordinator, d as SessionProjectionRunStatus, f as SessionProjectionScope, g as projectLiveSessionMessage, h as createSessionProjection, i as GatewaySessionMessageSubscriptionCoordinatorOptions, j as readAssistantStreamSegmentIdentity, k as isLocallyOptimisticSessionMessage, l as SessionProjectionEvent, m as SessionProjectionState, n as GatewaySessionMessageSubscription, o as getGatewaySessionMessageSubscriptionCoordinator, p as SessionProjectionSnapshotOptions, r as GatewaySessionMessageSubscriptionCoordinator, s as releaseGatewaySessionMessageSubscription, t as GatewaySessionMessageRequestClient, u as SessionProjectionRun, v as reduceSessionProjection, w as hasSessionProjectionAcceptedFinal, x as SessionProjectionGatewayRunEvent, y as isSessionProjectionErrorMessage, z as normalizeDeviceMetadataForAuth } from "./session-subscriptions-Bcq6_wtR.mjs";
-import { a as GatewayBrowserDeviceTokenStore, c as resolveGatewayConnectScopes, i as GatewayBrowserDeviceTokenRecord, l as selectGatewayConnectAuth, n as GatewayBrowserDeviceAuthPlan, o as GatewayConnectAuthSelection, r as GatewayBrowserDeviceIdentity, s as buildGatewayConnectAuth, t as GatewayBrowserDeviceAuthLifecycle, u as shouldRetryGatewayWithDeviceToken } from "./browser-device-auth-DoPo-sPB.mjs";
+import { a as GatewayBrowserDeviceTokenStore, c as resolveGatewayConnectScopes, i as GatewayBrowserDeviceTokenRecord, l as selectGatewayConnectAuth, n as GatewayBrowserDeviceAuthPlan, o as GatewayConnectAuthSelection, r as GatewayBrowserDeviceIdentity, s as buildGatewayConnectAuth, t as GatewayBrowserDeviceAuthLifecycle, u as shouldRetryGatewayWithDeviceToken } from "./browser-device-auth-_UweR4aN.mjs";
 import { i as isGatewayProtocolResponseError } from "./protocol-request-CtVhe3Bj.mjs";
 import { n as GatewayClientCloseInfo, r as GatewayClientConnectionMetadata } from "./protocol-client-DT451Msj.mjs";
 import { DEFAULT_GATEWAY_REQUEST_TIMEOUT_MS, DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS, MAX_CONNECT_CHALLENGE_TIMEOUT_MS, MAX_SAFE_TIMEOUT_DELAY_MS, MIN_CONNECT_CHALLENGE_TIMEOUT_MS, addSafeTimeoutDelayGraceMs, clampConnectChallengeTimeoutMs, clearGatewayConnectTimeout, getConnectChallengeTimeoutMsFromEnv, resolveConnectChallengeTimeoutMs, resolveFiniteTimeoutDelayMs, resolvePreauthHandshakeTimeoutMs, resolveSafeTimeoutDelayMs, startGatewayConnectTimeout } from "./timeouts.mjs";
-import { _ as isGatewayConnectAssemblyError, a as startGatewayClientWithReadinessWait, c as waitForEventLoopReady, d as GatewayClientHostDeps, f as GatewayClientOptions, g as GatewayClientRequestError, h as GatewayReconnectPausedInfo, i as startGatewayClientWhenEventLoopReady, l as DeviceIdentity, m as GatewayClientRequestTimeoutError, n as GatewayClientStartReadinessOptions, o as EventLoopReadyOptions, p as GatewayClientRequestOptions, r as GatewayClientStartable, s as EventLoopReadyResult, t as EventLoopReadyWaiter, u as GatewayClient, v as DeviceAuthTokenRecord } from "./readiness-Cj5C24o2.mjs";
+import { _ as isGatewayConnectAssemblyError, a as startGatewayClientWithReadinessWait, c as waitForEventLoopReady, d as GatewayClientHostDeps, f as GatewayClientOptions, g as GatewayClientRequestError, h as GatewayReconnectPausedInfo, i as startGatewayClientWhenEventLoopReady, l as DeviceIdentity, m as GatewayClientRequestTimeoutError, n as GatewayClientStartReadinessOptions, o as EventLoopReadyOptions, p as GatewayClientRequestOptions, r as GatewayClientStartable, s as EventLoopReadyResult, t as EventLoopReadyWaiter, u as GatewayClient, v as DeviceAuthTokenRecord } from "./readiness-CLaFwfd4.mjs";
 import { GatewayScopeUpgrade, ScopeUpgradeBinding, ScopeUpgradeOptions, ScopeUpgradeOutcome } from "./scope-upgrade.mjs";
 //#region packages/gateway-client/src/run-recovery-text.d.ts
 export type RecoveryRequest = (method: string, params: Record<string, unknown>, signal: AbortSignal) => Promise<unknown>;

package/dist/index.mjs

@@ -1,7 +1,7 @@
-import { A as selectGatewayConnectAuth, C as isGatewayProtocolResponseError, D as GatewayBrowserDeviceAuthLifecycle, E as gatewayOriginScope, F as isRecord, I as buildDeviceAuthPayload, L as buildDeviceAuthPayloadV3, M as mergeChatStreamMessage, O as buildGatewayConnectAuth, P as asRecord, R as normalizeDeviceMetadataForAuth, S as GatewayProtocolRequestTimeoutError, T as gatewayCredentialScope, _ as readSessionMessageIdentity, a as createSessionProjection, b as GatewayProtocolClient, c as reduceSessionProjection, d as readSessionProjectionFinalMessageIdentity, f as isSessionProjectionErrorMessage, g as readAssistantStreamSegmentIdentity, h as normalizeSessionProjectionRunId, i as resetGatewaySessionMessageSubscriptionCoordinator, j as shouldRetryGatewayWithDeviceToken, k as resolveGatewayConnectScopes, l as reduceSessionProjectionRunEvent, m as isLocallyOptimisticSessionMessage, n as getGatewaySessionMessageSubscriptionCoordinator, o as projectLiveSessionMessage, p as projectSessionTerminalReplyMessage, r as releaseGatewaySessionMessageSubscription, s as reconcileSessionProjectionSnapshot, t as GatewaySessionMessageSubscriptionCoordinator, u as hasSessionProjectionAcceptedFinal, v as readSessionMessageSequence, w as resolveModelCatalogConnect, x as GatewayProtocolRequestError, y as shouldPauseGatewayReconnect } from "./session-subscriptions-LtlX9oRQ.mjs";
+import { A as resolveGatewayConnectScopes, B as buildDeviceAuthPayloadV3, C as isGatewayProtocolResponseError, D as gatewayOriginScope, E as gatewayCredentialScope, F as mergeChatStreamMessage, L as asRecord, M as shouldRetryGatewayWithDeviceToken, N as normalizeLowercaseStringOrEmpty, O as GatewayBrowserDeviceAuthLifecycle, P as normalizeOptionalString, R as isRecord, S as GatewayProtocolRequestTimeoutError, T as resolveModelCatalogConnect, V as normalizeDeviceMetadataForAuth, _ as readSessionMessageIdentity, a as createSessionProjection, b as GatewayProtocolClient, c as reduceSessionProjection, d as readSessionProjectionFinalMessageIdentity, f as isSessionProjectionErrorMessage, g as readAssistantStreamSegmentIdentity, h as normalizeSessionProjectionRunId, i as resetGatewaySessionMessageSubscriptionCoordinator, j as selectGatewayConnectAuth, k as buildGatewayConnectAuth, l as reduceSessionProjectionRunEvent, m as isLocallyOptimisticSessionMessage, n as getGatewaySessionMessageSubscriptionCoordinator, o as projectLiveSessionMessage, p as projectSessionTerminalReplyMessage, r as releaseGatewaySessionMessageSubscription, s as reconcileSessionProjectionSnapshot, t as GatewaySessionMessageSubscriptionCoordinator, u as hasSessionProjectionAcceptedFinal, v as readSessionMessageSequence, w as raceWithTimeout, x as GatewayProtocolRequestError, y as shouldPauseGatewayReconnect, z as buildDeviceAuthPayload } from "./session-subscriptions-D5CpDUGt.mjs";
 import { DEFAULT_GATEWAY_REQUEST_TIMEOUT_MS, DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS, MAX_CONNECT_CHALLENGE_TIMEOUT_MS, MAX_SAFE_TIMEOUT_DELAY_MS, MIN_CONNECT_CHALLENGE_TIMEOUT_MS, addSafeTimeoutDelayGraceMs, clampConnectChallengeTimeoutMs, clearGatewayConnectTimeout, getConnectChallengeTimeoutMsFromEnv, resolveConnectChallengeTimeoutMs, resolveFiniteTimeoutDelayMs, resolvePreauthHandshakeTimeoutMs, resolveSafeTimeoutDelayMs, startGatewayConnectTimeout } from "./timeouts.mjs";
 import { rawDataToString } from "./websocket-data.mjs";
-import { n as startGatewayClientWithReadinessWait, r as waitForEventLoopReady, t as startGatewayClientWhenEventLoopReady } from "./readiness-CrWxd4TI.mjs";
+import { n as startGatewayClientWithReadinessWait, r as waitForEventLoopReady, t as startGatewayClientWhenEventLoopReady } from "./readiness-DnB0NLBq.mjs";
 import { GatewayScopeUpgrade } from "./scope-upgrade.mjs";
 import { createRequire } from "node:module";
 import { ConnectErrorDetailCodes, formatConnectErrorMessage, readConnectErrorDetailCode } from "@openclaw/gateway-protocol/connect-error-details";
@@ -13,26 +13,6 @@ import ipaddr from "ipaddr.js";
 import { isIP } from "node:net";
 import { TLSSocket, checkServerIdentity } from "node:tls";
 import path from "node:path";
-//#region packages/normalization-core/src/string-coerce.ts
-/** Trims string input and returns null for non-strings or empty strings. */
-function normalizeNullableString(value) {
-	if (typeof value !== "string") return null;
-	const trimmed = value.trim();
-	return trimmed ? trimmed : null;
-}
-/** Trims string input and returns undefined for non-strings or empty strings. */
-function normalizeOptionalString(value) {
-	return normalizeNullableString(value) ?? void 0;
-}
-/** Lowercases a normalized optional string. */
-function normalizeOptionalLowercaseString(value) {
-	return normalizeOptionalString(value)?.toLowerCase();
-}
-/** Lowercases a normalized string or returns an empty string when absent. */
-function normalizeLowercaseStringOrEmpty(value) {
-	return normalizeOptionalLowercaseString(value) ?? "";
-}
-//#endregion
 //#region packages/net-policy/src/redact-sensitive-url.ts
 const SENSITIVE_URL_QUERY_PARAM_NAMES = /* @__PURE__ */ new Set([
 	"token",
@@ -358,7 +338,8 @@ function parseCanonicalIpAddress(raw) {
 function normalizeIpAddress(raw) {
 	const parsed = parseCanonicalIpAddress(raw);
 	if (!parsed) return;
-	return normalizeLowercaseStringOrEmpty(normalizeIpv4MappedAddress(parsed).toString());
+	const normalized = normalizeIpv4MappedAddress(parsed);
+	return normalizeLowercaseStringOrEmpty(normalized.toString());
 }
 /** True when a canonical IP literal is loopback, including IPv4-mapped IPv6. */
 function isLoopbackIpAddress(raw) {
@@ -591,11 +572,8 @@ function isSecureWebSocketUrl(rawUrl, options) {
 		const protocol = url.protocol === "https:" ? "wss:" : url.protocol === "http:" ? "ws:" : url.protocol;
 		if (protocol === "wss:") return true;
 		if (protocol !== "ws:") return false;
-		if (isGatewayLoopbackHost(url.hostname) || isTrustedPlaintextWebSocketHost(url.hostname)) return true;
-		if (options?.allowPrivateWs === true) {
-			const hostForIpCheck = url.hostname.startsWith("[") && url.hostname.endsWith("]") ? url.hostname.slice(1, -1) : url.hostname;
-			return isPrivateOrLoopbackHost(url.hostname) || parseGatewayIpAddress(hostForIpCheck) === void 0;
-		}
+		if (isTrustedPlaintextWebSocketHost(url.hostname)) return true;
+		if (options?.allowPrivateWs === true) return parseGatewayIpAddress(url.hostname.startsWith("[") && url.hostname.endsWith("]") ? url.hostname.slice(1, -1) : url.hostname) === void 0;
 		return false;
 	} catch {
 		return false;
@@ -956,16 +934,11 @@ var GatewayClient = class {
 	async stopAndWait(opts) {
 		const stopPromise = this.beginStop();
 		const timeoutMs = opts?.timeoutMs === void 0 ? STOP_AND_WAIT_TIMEOUT_MS : resolveSafeTimeoutDelayMs(opts.timeoutMs);
-		let timeout = null;
 		try {
-			await Promise.race([stopPromise, new Promise((_, reject) => {
-				timeout = setTimeout(() => {
-					reject(/* @__PURE__ */ new Error(`gateway client stop timed out after ${timeoutMs}ms`));
-				}, timeoutMs);
-				timeout.unref?.();
-			})]);
+			await raceWithTimeout(Promise.resolve(stopPromise), timeoutMs, () => {
+				throw new Error(`gateway client stop timed out after ${timeoutMs}ms`);
+			}, { ref: false });
 		} finally {
-			if (timeout) clearTimeout(timeout);
 			await this.deviceAuth.drain();
 		}
 	}
@@ -1003,7 +976,6 @@ var GatewayClient = class {
 		return null;
 	}
 	createPendingStop(ws) {
-		if (this.pendingStop?.ws === ws) return this.pendingStop;
 		let resolve = () => {};
 		const promise = new Promise((done) => {
 			resolve = done;

package/dist/{readiness-Cj5C24o2.d.mts → readiness-CLaFwfd4.d.mts}

@@ -79,7 +79,7 @@ declare class GatewayClientRequestTimeoutError extends GatewayProtocolRequestTim
     requestSent: boolean;
   });
 }
-type GatewayClientOptions = GatewayWebSocketTargetOptions & {
+type GatewayClientOptions = GatewayWebSocketTargetOptions & NonNullable<ConnectParams["auth"]> & {
   origin?: string;
   /** Already-resolved edge-proxy auth headers (identity-aware proxy in front of the Gateway). */
   edgeAuthHeaders?: Readonly<Record<string, string>>;
@@ -92,14 +92,8 @@ type GatewayClientOptions = GatewayWebSocketTargetOptions & {
   tickWatchMinIntervalMs?: number;
   tickWatchTimeoutMs?: number;
   requestTimeoutMs?: number;
-  token?: string;
-  bootstrapToken?: string;
   /** Prefer one setup credential for the first successful device-auth exchange. */
   preferBootstrapToken?: boolean;
-  deviceToken?: string;
-  password?: string;
-  approvalRuntimeToken?: string;
-  agentRuntimeIdentityToken?: string;
   instanceId?: string;
   clientName?: GatewayClientName;
   clientDisplayName?: string;

package/dist/{readiness-CrWxd4TI.mjs → readiness-DnB0NLBq.mjs}

@@ -21,16 +21,13 @@ async function waitForEventLoopReady(options = {}) {
 	return await new Promise((resolve) => {
 		let settled = false;
 		let timer = null;
-		const clearTimer = () => {
+		const finish = (ready, aborted = false) => {
+			if (settled) return;
+			settled = true;
 			if (timer) {
 				clearTimeout(timer);
 				timer = null;
 			}
-		};
-		const finish = (ready, aborted = false) => {
-			if (settled) return;
-			settled = true;
-			clearTimer();
 			signal?.removeEventListener("abort", onAbort);
 			resolve({
 				ready,

package/dist/readiness.d.mts

@@ -1,2 +1,2 @@
-import { a as startGatewayClientWithReadinessWait, i as startGatewayClientWhenEventLoopReady, n as GatewayClientStartReadinessOptions, r as GatewayClientStartable, t as EventLoopReadyWaiter } from "./readiness-Cj5C24o2.mjs";
+import { a as startGatewayClientWithReadinessWait, i as startGatewayClientWhenEventLoopReady, n as GatewayClientStartReadinessOptions, r as GatewayClientStartable, t as EventLoopReadyWaiter } from "./readiness-CLaFwfd4.mjs";
 export { EventLoopReadyWaiter, GatewayClientStartReadinessOptions, GatewayClientStartable, startGatewayClientWhenEventLoopReady, startGatewayClientWithReadinessWait };

package/dist/readiness.mjs

@@ -1,3 +1,3 @@
 import "./timeouts.mjs";
-import { n as startGatewayClientWithReadinessWait, t as startGatewayClientWhenEventLoopReady } from "./readiness-CrWxd4TI.mjs";
+import { n as startGatewayClientWithReadinessWait, t as startGatewayClientWhenEventLoopReady } from "./readiness-DnB0NLBq.mjs";
 export { startGatewayClientWhenEventLoopReady, startGatewayClientWithReadinessWait };

package/dist/scope-upgrade.d.mts

@@ -1,4 +1,4 @@
-import { a as GatewayBrowserDeviceTokenStore } from "./browser-device-auth-DoPo-sPB.mjs";
+import { a as GatewayBrowserDeviceTokenStore } from "./browser-device-auth-_UweR4aN.mjs";
 import { n as GatewayProtocolRequestOptions } from "./protocol-request-CtVhe3Bj.mjs";
 //#region packages/gateway-client/src/scope-upgrade.d.ts
 export type ScopeUpgradeBinding = {

package/dist/{session-subscriptions-LtlX9oRQ.mjs → session-subscriptions-D5CpDUGt.mjs}

@@ -100,16 +100,33 @@ function mergeChatStreamMessage(previous, payload) {
 	};
 }
 //#endregion
-//#region packages/gateway-client/src/connect-auth.ts
-function normalized(value) {
-	return typeof value === "string" ? value.trim() || void 0 : void 0;
+//#region packages/normalization-core/src/string-coerce.ts
+/** Trims string input and returns null for non-strings or empty strings. */
+function normalizeNullableString(value) {
+	if (typeof value !== "string") return null;
+	const trimmed = value.trim();
+	return trimmed ? trimmed : null;
+}
+/** Trims string input and returns undefined for non-strings or empty strings. */
+function normalizeOptionalString(value) {
+	return normalizeNullableString(value) ?? void 0;
+}
+/** Lowercases a normalized optional string. */
+function normalizeOptionalLowercaseString(value) {
+	return normalizeOptionalString(value)?.toLowerCase();
 }
+/** Lowercases a normalized string or returns an empty string when absent. */
+function normalizeLowercaseStringOrEmpty(value) {
+	return normalizeOptionalLowercaseString(value) ?? "";
+}
+//#endregion
+//#region packages/gateway-client/src/connect-auth.ts
 function selectGatewayConnectAuth(params) {
-	const authToken = normalized(params.token);
-	const bootstrapToken = normalized(params.bootstrapToken);
-	const explicitDeviceToken = normalized(params.deviceToken);
-	const authPassword = normalized(params.password);
-	const storedToken = normalized(params.storedToken);
+	const authToken = normalizeOptionalString(params.token);
+	const bootstrapToken = normalizeOptionalString(params.bootstrapToken);
+	const explicitDeviceToken = normalizeOptionalString(params.deviceToken);
+	const authPassword = normalizeOptionalString(params.password);
+	const storedToken = normalizeOptionalString(params.storedToken);
 	const stored = {
 		storedToken,
 		storedScopes: params.storedScopes
@@ -129,8 +146,8 @@ function selectGatewayConnectAuth(params) {
 		authBootstrapToken,
 		authDeviceToken: useRetryToken ? storedToken : void 0,
 		authPassword,
-		authApprovalRuntimeToken: normalized(params.approvalRuntimeToken),
-		authAgentRuntimeIdentityToken: normalized(params.agentRuntimeIdentityToken),
+		authApprovalRuntimeToken: normalizeOptionalString(params.approvalRuntimeToken),
+		authAgentRuntimeIdentityToken: normalizeOptionalString(params.agentRuntimeIdentityToken),
 		signatureToken: selectedToken ?? authBootstrapToken,
 		resolvedDeviceToken,
 		usingStoredDeviceToken,
@@ -186,7 +203,7 @@ var GatewayBrowserDeviceAuthLifecycle = class {
 			storedScopes: selectedAuth.storedScopes,
 			defaultScopes: params.defaultScopes
 		});
-		if (!identity) return {
+		const plan = {
 			clientId: params.client.id,
 			role: params.role,
 			identity,
@@ -194,6 +211,7 @@ var GatewayBrowserDeviceAuthLifecycle = class {
 			scopes,
 			auth: buildGatewayConnectAuth(selectedAuth)
 		};
+		if (!identity) return plan;
 		const signedAtMs = params.challengeTs === void 0 ? this.deps.nowMs?.() ?? Date.now() : params.challengeTs;
 		if (typeof signedAtMs !== "number" || !Number.isSafeInteger(signedAtMs) || signedAtMs < 0) throw new Error("gateway connect challenge timestamp invalid");
 		const nonce = params.nonce ?? "";
@@ -209,21 +227,14 @@ var GatewayBrowserDeviceAuthLifecycle = class {
 			platform: params.client.platform,
 			deviceFamily: params.client.deviceFamily
 		});
-		return {
-			clientId: params.client.id,
-			role: params.role,
-			identity,
-			selectedAuth,
-			scopes,
-			auth: buildGatewayConnectAuth(selectedAuth),
-			device: {
-				id: identity.deviceId,
-				publicKey: identity.publicKey,
-				signature: await identity.sign(payload),
-				signedAt: signedAtMs,
-				nonce
-			}
+		plan.device = {
+			id: identity.deviceId,
+			publicKey: identity.publicKey,
+			signature: await identity.sign(payload),
+			signedAt: signedAtMs,
+			nonce
 		};
+		return plan;
 	}
 	async acceptHello(hello, plan) {
 		const token = hello.auth?.deviceToken?.trim();
@@ -290,6 +301,30 @@ function resolveModelCatalogConnect(params) {
 //#endregion
 //#region packages/retry/src/index.ts
 const MAX_TIMER_TIMEOUT_MS = 2147e6;
+function createAbortError(message, options) {
+	const error = new Error(message, options);
+	error.name = "AbortError";
+	return error;
+}
+/** Bounds observation without cancelling work; a factory starts only after the timer is armed. */
+async function raceWithTimeout(operation, timeoutMs, onTimeout, options = {}) {
+	let timer;
+	try {
+		const deadline = new Promise((resolve, reject) => {
+			timer = setTimeout(() => {
+				try {
+					resolve(onTimeout());
+				} catch (error) {
+					reject(error);
+				}
+			}, timeoutMs);
+			if (options.ref === false) timer.unref?.();
+		});
+		return await Promise.race([typeof operation === "function" ? operation() : operation, deadline]);
+	} finally {
+		clearTimeout(timer);
+	}
+}
 function computeBackoff(policy, attempt) {
 	const base = Math.min(policy.maxMs, policy.initialMs * policy.factor ** Math.max(attempt - 1, 0));
 	const jitter = base * policy.jitter * Math.random();
@@ -311,9 +346,7 @@ async function sleepWithAbort(ms, abortSignal, options = {}) {
 			if (timer) clearTimeout(timer);
 			timer = null;
 			cleanup();
-			const error = new Error("aborted", { cause: abortSignal?.reason ?? /* @__PURE__ */ new Error("aborted") });
-			error.name = "AbortError";
-			reject(error);
+			reject(createAbortError("aborted", { cause: abortSignal?.reason ?? /* @__PURE__ */ new Error("aborted") }));
 		};
 		abortSignal?.addEventListener("abort", onAbort, { once: true });
 		if (abortSignal?.aborted) {
@@ -429,18 +462,8 @@ function createRetryRunner(runtime = {}) {
 	const createFailure = runtime.createFailure ?? ((errors) => toRetryError(errors.at(-1) ?? /* @__PURE__ */ new Error("Retry failed")));
 	return async function retryAsync(fn, attemptsOrOptions = 3, initialDelayMs = 300) {
 		const attemptErrors = [];
-		if (typeof attemptsOrOptions === "number") {
-			const attempts = resolveAttemptCount(attemptsOrOptions, DEFAULT_RETRY_CONFIG.attempts);
-			for (let index = 0; index < attempts; index += 1) try {
-				return await fn();
-			} catch (err) {
-				attemptErrors.push(err);
-				if (index === attempts - 1) break;
-				await runtimeSleep(resolveRetryDelayMs(initialDelayMs * 2 ** index));
-			}
-			throw createFailure(attemptErrors);
-		}
-		const options = attemptsOrOptions;
+		const numeric = typeof attemptsOrOptions === "number";
+		const options = typeof attemptsOrOptions === "number" ? { attempts: attemptsOrOptions } : attemptsOrOptions;
 		const resolved = resolveRetryConfig(DEFAULT_RETRY_CONFIG, options);
 		const maxAttempts = resolved.attempts;
 		const minDelayMs = resolved.minDelayMs;
@@ -454,6 +477,10 @@ function createRetryRunner(runtime = {}) {
 		} catch (err) {
 			attemptErrors.push(err);
 			if (attempt >= maxAttempts || !shouldRetry(err, attempt)) break;
+			if (numeric) {
+				await runtimeSleep(resolveRetryDelayMs(initialDelayMs * 2 ** (attempt - 1)));
+				continue;
+			}
 			const context = {
 				attempt,
 				maxAttempts,
@@ -1228,42 +1255,30 @@ function stringifyObjectValue(value, stack, normalizeString, write) {
 		return `[${serializedEntries.join(",")}]`;
 	}
 	const record = value;
-	if (normalizeString === preserveString) {
-		const fields = Object.keys(record).sort();
-		if (write) {
-			write("{");
-			let separator = "";
-			for (const key of fields) {
-				write(`${separator}${JSON.stringify(key)}:`);
-				write(stringifyStableValue(record[key], stack, normalizeString, write));
-				separator = ",";
-			}
-			write("}");
-			return "";
-		}
-		let fieldIndex = 0;
-		for (const key of fields) fields[fieldIndex++] = `${JSON.stringify(key)}:${stringifyStableValue(record[key], stack, normalizeString)}`;
-		return `{${fields.join(",")}}`;
-	}
-	const entries = Object.keys(record).map((key) => ({
+	const keys = Object.keys(record);
+	const fields = normalizeString === preserveString ? keys.sort() : keys.map((key) => ({
 		key,
 		normalizedKey: normalizeString(key)
 	})).sort((left, right) => {
 		return compareStableStrings(left.normalizedKey, right.normalizedKey) || compareStableStrings(left.key, right.key);
 	});
-	const serializedFields = [];
-	if (write) {
-		write("{");
-		let separator = "";
-		for (const { key, normalizedKey } of entries) {
-			write(`${separator}${JSON.stringify(normalizedKey)}:`);
+	write?.("{");
+	const serializedFields = normalizeString === preserveString ? keys : [];
+	let separator = "";
+	let fieldIndex = 0;
+	for (const field of fields) {
+		const key = typeof field === "string" ? field : field.key;
+		const prefix = `${JSON.stringify(typeof field === "string" ? field : field.normalizedKey)}:`;
+		if (write) {
+			write(`${separator}${prefix}`);
 			write(stringifyStableValue(record[key], stack, normalizeString, write));
 			separator = ",";
-		}
+		} else serializedFields[fieldIndex++] = `${prefix}${stringifyStableValue(record[key], stack, normalizeString)}`;
+	}
+	if (write) {
 		write("}");
 		return "";
 	}
-	for (const { key, normalizedKey } of entries) serializedFields.push(`${JSON.stringify(normalizedKey)}:${stringifyStableValue(record[key], stack, normalizeString)}`);
 	return `{${serializedFields.join(",")}}`;
 }
 function encodeBase64(value) {
@@ -1277,7 +1292,7 @@ function compareStableStrings(left, right) {
 //#endregion
 //#region packages/gateway-client/src/session-projection-message-identity.ts
 function readSessionProjectionString(value) {
-	return typeof value === "string" ? value.trim() || null : null;
+	return normalizeNullableString(value);
 }
 function readPositiveSafeInteger(value) {
 	return typeof value === "number" && Number.isSafeInteger(value) && value > 0 ? value : null;
@@ -2265,4 +2280,4 @@ function releaseGatewaySessionMessageSubscription(subscription) {
 	return sessionMessageSubscriptionOwners.get(subscription)?.coordinator.release(subscription) ?? Promise.resolve();
 }
 //#endregion
-export { selectGatewayConnectAuth as A, isGatewayProtocolResponseError as C, GatewayBrowserDeviceAuthLifecycle as D, gatewayOriginScope as E, isRecord as F, buildDeviceAuthPayload as I, buildDeviceAuthPayloadV3 as L, mergeChatStreamMessage as M, asNullableRecord as N, buildGatewayConnectAuth as O, asRecord as P, normalizeDeviceMetadataForAuth as R, GatewayProtocolRequestTimeoutError as S, gatewayCredentialScope as T, readSessionMessageIdentity as _, createSessionProjection as a, GatewayProtocolClient as b, reduceSessionProjection as c, readSessionProjectionFinalMessageIdentity as d, isSessionProjectionErrorMessage as f, readAssistantStreamSegmentIdentity as g, normalizeSessionProjectionRunId as h, resetGatewaySessionMessageSubscriptionCoordinator as i, shouldRetryGatewayWithDeviceToken as j, resolveGatewayConnectScopes as k, reduceSessionProjectionRunEvent as l, isLocallyOptimisticSessionMessage as m, getGatewaySessionMessageSubscriptionCoordinator as n, projectLiveSessionMessage as o, projectSessionTerminalReplyMessage as p, releaseGatewaySessionMessageSubscription as r, reconcileSessionProjectionSnapshot as s, GatewaySessionMessageSubscriptionCoordinator as t, hasSessionProjectionAcceptedFinal as u, readSessionMessageSequence as v, resolveModelCatalogConnect as w, GatewayProtocolRequestError as x, shouldPauseGatewayReconnect as y };
+export { resolveGatewayConnectScopes as A, buildDeviceAuthPayloadV3 as B, isGatewayProtocolResponseError as C, gatewayOriginScope as D, gatewayCredentialScope as E, mergeChatStreamMessage as F, asNullableRecord as I, asRecord as L, shouldRetryGatewayWithDeviceToken as M, normalizeLowercaseStringOrEmpty as N, GatewayBrowserDeviceAuthLifecycle as O, normalizeOptionalString as P, isRecord as R, GatewayProtocolRequestTimeoutError as S, resolveModelCatalogConnect as T, normalizeDeviceMetadataForAuth as V, readSessionMessageIdentity as _, createSessionProjection as a, GatewayProtocolClient as b, reduceSessionProjection as c, readSessionProjectionFinalMessageIdentity as d, isSessionProjectionErrorMessage as f, readAssistantStreamSegmentIdentity as g, normalizeSessionProjectionRunId as h, resetGatewaySessionMessageSubscriptionCoordinator as i, selectGatewayConnectAuth as j, buildGatewayConnectAuth as k, reduceSessionProjectionRunEvent as l, isLocallyOptimisticSessionMessage as m, getGatewaySessionMessageSubscriptionCoordinator as n, projectLiveSessionMessage as o, projectSessionTerminalReplyMessage as p, releaseGatewaySessionMessageSubscription as r, reconcileSessionProjectionSnapshot as s, GatewaySessionMessageSubscriptionCoordinator as t, hasSessionProjectionAcceptedFinal as u, readSessionMessageSequence as v, raceWithTimeout as w, GatewayProtocolRequestError as x, shouldPauseGatewayReconnect as y, buildDeviceAuthPayload as z };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/gateway-client",
-  "version": "2026.9.8",
+  "version": "2026.10.1-beta.1",
   "description": "Reference WebSocket client for the OpenClaw Gateway protocol",
   "keywords": [
     "client",
@@ -62,7 +62,7 @@
     }
   },
   "dependencies": {
-    "@openclaw/gateway-protocol": "2026.9.8",
+    "@openclaw/gateway-protocol": "2026.10.1-beta.1",
     "ipaddr.js": "2.5.0",
     "ws": "8.21.3"
   },