@optimatist/langlangbot-connector 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Optimatist Corp
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,10 @@
+# @optimatist/langlangbot-connector
+
+TypeScript HTTP/SSE client for the LangLangBot sidecar gateway API.
+
+Used by `@optimatist/langlangbot-openclaw` and other host adapters that speak to a local
+LangLangBot sidecar over HTTPS.
+
+## License
+
+MIT — see [LICENSE](./LICENSE).

package/dist/client.d.ts

@@ -0,0 +1,163 @@
+export type GatewayEventType = "conversation_opened" | "user_message" | "assistant_delta" | "assistant_message" | "tool_call" | "cancelled" | "approval_requested" | "approval_resolved";
+export type ApprovalAction = {
+    decision: string;
+    label: string;
+    style?: string;
+};
+/**
+ * Wire/API approval kind — extensible string, not a closed union.
+ *
+ * Conventions:
+ * - OpenClaw native: `openclaw.exec`, `openclaw.plugin`
+ * - Gateway intent (Finance Gateway and future systems): manifest action id or
+ *   `intent:<gateway>:<action>`; canonical payload in `metadata` (intent_id, intent_hash, …)
+ */
+export type ApprovalKind = string;
+/** Built-in OpenClaw approval kinds (sidecar polls → exec/plugin.approval.resolve). */
+export declare const OpenClawApprovalKind: {
+    readonly Exec: "openclaw.exec";
+    readonly Plugin: "openclaw.plugin";
+};
+export type BuiltInOpenClawApprovalKind = (typeof OpenClawApprovalKind)[keyof typeof OpenClawApprovalKind];
+/** Normalize legacy aliases from early Phase 2 drafts. */
+export declare function normalizeApprovalKind(kind: string): ApprovalKind;
+export declare function isOpenClawApprovalKind(kind: string): boolean;
+export type OpenClawApprovalDecision = "allow-once" | "allow-always" | "deny";
+export declare function isOpenClawApprovalDecision(value: string): value is OpenClawApprovalDecision;
+export type ApprovalPluginEvent = {
+    type: "approval_decided";
+    approval_id: string;
+    decision: string;
+} | {
+    type: "approval_resolved";
+    approval_id: string;
+    decision?: string | null;
+};
+export type RegisterPendingApprovalInput = {
+    approvalId: string;
+    kind: ApprovalKind;
+    conversationId?: string;
+    title: string;
+    description?: string;
+    actions?: ApprovalAction[];
+    metadata?: Record<string, unknown>;
+    expiresAt: string;
+};
+export type ApprovalDecisionPoll = {
+    status: "pending" | "decided" | "resolved" | "expired";
+    decision?: OpenClawApprovalDecision;
+    decidedAt?: string;
+};
+export type PluginConnectionEndpoint = {
+    transport: string;
+    address: string;
+    port: number;
+};
+export type PluginConnectionCurrentResponse = {
+    conversation_id: string;
+    status: "observed";
+    transport: string;
+    remote_addr?: string | null;
+    observed_at: string;
+    matched_endpoint?: PluginConnectionEndpoint | null;
+    published_endpoints: PluginConnectionEndpoint[];
+} | {
+    conversation_id: string;
+    status: "unknown";
+    message: string;
+    published_endpoints: PluginConnectionEndpoint[];
+} | {
+    status: "error";
+    message: string;
+};
+export type GatewayEvent = {
+    type: "conversation_opened";
+    conversation_id: string;
+    created_at: string;
+} | {
+    type: "user_message";
+    message_id: string;
+    text: string;
+    received_at: string;
+} | {
+    type: "assistant_delta";
+    text: string;
+    created_at: string;
+} | {
+    type: "assistant_message";
+    message_id: string;
+    text: string;
+    created_at: string;
+} | {
+    type: "tool_call";
+    tool_call_id: string;
+    tool_name: string;
+    summary: string;
+    created_at: string;
+} | {
+    type: "cancelled";
+    reason?: string | null;
+    cancelled_at: string;
+} | {
+    type: "approval_requested";
+    approval_id: string;
+    kind: string;
+    title: string;
+    description?: string | null;
+    actions: ApprovalAction[];
+    expires_at: string;
+    metadata?: Record<string, unknown>;
+    created_at: string;
+} | {
+    type: "approval_resolved";
+    approval_id: string;
+    decision?: string | null;
+    resolved_at: string;
+};
+export type InboundMessage = {
+    conversationId: string;
+    messageId: string;
+    text: string;
+    receivedAt: string;
+    /** Base64 operator surface id attested by LangLangBot after ODA session.open. */
+    operatorSurfaceId?: string;
+};
+export type HealthStatus = {
+    status: string;
+    server_time?: string;
+};
+export type Unsubscribe = () => void;
+export type LanglangbotSidecarOptions = {
+    baseUrl: string;
+    pluginToken?: string;
+    /** Trust self-signed Agent cert (loopback OpenClaw plugin only). */
+    insecureTls?: boolean;
+    /** SPKI pin (`sha256/<hex>`) for Operator-style verification. */
+    tlsFingerprint?: string;
+    /** Dev only: allow `http://` base URLs. */
+    allowInsecureHttp?: boolean;
+    fetchImpl?: typeof fetch;
+};
+export declare class LanglangbotSidecar {
+    readonly baseUrl: string;
+    readonly pluginToken?: string;
+    private readonly fetchImpl;
+    constructor(opts: LanglangbotSidecarOptions);
+    private headers;
+    health(): Promise<HealthStatus>;
+    subscribeInbound(onMessage: (evt: InboundMessage) => void, onError?: (err: Error) => void): Unsubscribe;
+    subscribeApprovalPluginEvents(onEvent: (evt: ApprovalPluginEvent) => void, onError?: (err: Error) => void): Unsubscribe;
+    subscribeConversationEvents(conversationId: string, onEvent: (evt: GatewayEvent) => void, onError?: (err: Error) => void): Unsubscribe;
+    sendDelta(conversationId: string, text: string): Promise<void>;
+    registerApprovalPending(input: RegisterPendingApprovalInput): Promise<{
+        approval_id: string;
+        status: string;
+    }>;
+    getApprovalDecision(approvalId: string): Promise<ApprovalDecisionPoll>;
+    markApprovalResolved(approvalId: string, decision?: OpenClawApprovalDecision): Promise<void>;
+    getPluginConnectionCurrent(conversationId: string): Promise<PluginConnectionCurrentResponse>;
+    sendMessage(conversationId: string, text: string, messageId?: string): Promise<{
+        message_id: string;
+    }>;
+}
+//# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,gBAAgB,GACxB,qBAAqB,GACrB,cAAc,GACd,iBAAiB,GACjB,mBAAmB,GACnB,WAAW,GACX,WAAW,GACX,oBAAoB,GACpB,mBAAmB,CAAC;AAExB,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC;AAElC,uFAAuF;AACvF,eAAO,MAAM,oBAAoB;;;CAGvB,CAAC;AAEX,MAAM,MAAM,2BAA2B,GACrC,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,OAAO,oBAAoB,CAAC,CAAC;AAEnE,0DAA0D;AAC1D,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,CAYhE;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAM5D;AAED,MAAM,MAAM,wBAAwB,GAAG,YAAY,GAAG,cAAc,GAAG,MAAM,CAAC;AAE9E,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,MAAM,GACZ,KAAK,IAAI,wBAAwB,CAMnC;AAED,MAAM,MAAM,mBAAmB,GAC3B;IACE,IAAI,EAAE,kBAAkB,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;CAClB,GACD;IACE,IAAI,EAAE,mBAAmB,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B,CAAC;AAEN,MAAM,MAAM,4BAA4B,GAAG;IACzC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,YAAY,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,cAAc,EAAE,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC;IACvD,QAAQ,CAAC,EAAE,wBAAwB,CAAC;IACpC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,+BAA+B,GACvC;IACE,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,UAAU,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,wBAAwB,GAAG,IAAI,CAAC;IACnD,mBAAmB,EAAE,wBAAwB,EAAE,CAAC;CACjD,GACD;IACE,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,SAAS,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,mBAAmB,EAAE,wBAAwB,EAAE,CAAC;CACjD,GACD;IACE,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEN,MAAM,MAAM,YAAY,GACpB;IACE,IAAI,EAAE,qBAAqB,CAAC;IAC5B,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;CACpB,GACD;IACE,IAAI,EAAE,cAAc,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;CACrB,GACD;IACE,IAAI,EAAE,iBAAiB,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;CACpB,GACD;IACE,IAAI,EAAE,mBAAmB,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;CACpB,GACD;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;CACpB,GACD;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;CACtB,GACD;IACE,IAAI,EAAE,oBAAoB,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,UAAU,EAAE,MAAM,CAAC;CACpB,GACD;IACE,IAAI,EAAE,mBAAmB,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAEN,MAAM,MAAM,cAAc,GAAG;IAC3B,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,iFAAiF;IACjF,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC;AAQrC,MAAM,MAAM,yBAAyB,GAAG;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oEAAoE;IACpE,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,iEAAiE;IACjE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,2CAA2C;IAC3C,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B,CAAC;AAgOF,qBAAa,kBAAkB;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;gBAE7B,IAAI,EAAE,yBAAyB;IAM3C,OAAO,CAAC,OAAO;IAWT,MAAM,IAAI,OAAO,CAAC,YAAY,CAAC;IAQrC,gBAAgB,CACd,SAAS,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,IAAI,EACxC,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,KAAK,IAAI,GAC7B,WAAW;IA0Cd,6BAA6B,CAC3B,OAAO,EAAE,CAAC,GAAG,EAAE,mBAAmB,KAAK,IAAI,EAC3C,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,KAAK,IAAI,GAC7B,WAAW;IAyBd,2BAA2B,CACzB,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,CAAC,GAAG,EAAE,YAAY,KAAK,IAAI,EACpC,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,KAAK,IAAI,GAC7B,WAAW;IAyBR,SAAS,CAAC,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAc9D,uBAAuB,CAC3B,KAAK,EAAE,4BAA4B,GAClC,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAqB7C,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAoBtE,oBAAoB,CACxB,UAAU,EAAE,MAAM,EAClB,QAAQ,CAAC,EAAE,wBAAwB,GAClC,OAAO,CAAC,IAAI,CAAC;IAcV,0BAA0B,CAC9B,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,+BAA+B,CAAC;IAiBrC,WAAW,CACf,cAAc,EAAE,MAAM,EACtB,IAAI,EAAE,MAAM,EACZ,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;CAiBnC"}

package/dist/client.js

@@ -0,0 +1,411 @@
+/** Built-in OpenClaw approval kinds (sidecar polls → exec/plugin.approval.resolve). */
+export const OpenClawApprovalKind = {
+    Exec: "openclaw.exec",
+    Plugin: "openclaw.plugin",
+};
+/** Normalize legacy aliases from early Phase 2 drafts. */
+export function normalizeApprovalKind(kind) {
+    const trimmed = kind.trim();
+    switch (trimmed) {
+        case "exec":
+        case "openclaw_exec":
+            return OpenClawApprovalKind.Exec;
+        case "plugin":
+        case "openclaw_plugin":
+            return OpenClawApprovalKind.Plugin;
+        default:
+            return trimmed;
+    }
+}
+export function isOpenClawApprovalKind(kind) {
+    const normalized = normalizeApprovalKind(kind);
+    return (normalized === OpenClawApprovalKind.Exec ||
+        normalized === OpenClawApprovalKind.Plugin);
+}
+export function isOpenClawApprovalDecision(value) {
+    return (value === "allow-once" ||
+        value === "allow-always" ||
+        value === "deny");
+}
+import { assertHttpsBaseUrl } from "./endpoint-url.js";
+import { createInsecureTlsFetch, createPinnedTlsFetch, } from "./tls-pin.js";
+function normalizeBaseUrl(baseUrl) {
+    return baseUrl.replace(/\/+$/, "");
+}
+function createFetchImpl(opts) {
+    const base = normalizeBaseUrl(opts.baseUrl);
+    if (!opts.allowInsecureHttp && !base.startsWith("https://")) {
+        if (base.startsWith("http://")) {
+            throw new Error("sidecar baseUrl must use https:// (set allowInsecureHttp for dev only)");
+        }
+        assertHttpsBaseUrl(base);
+    }
+    if (opts.tlsFingerprint) {
+        return createPinnedTlsFetch({
+            tlsFingerprint: opts.tlsFingerprint,
+            insecureTls: opts.insecureTls,
+        });
+    }
+    if (opts.insecureTls) {
+        return createInsecureTlsFetch();
+    }
+    return fetch;
+}
+function parseGatewayEvent(raw) {
+    if (!raw || typeof raw !== "object") {
+        return null;
+    }
+    const event = raw;
+    const type = event.type;
+    if (typeof type !== "string") {
+        return null;
+    }
+    switch (type) {
+        case "conversation_opened":
+            return {
+                type,
+                conversation_id: String(event.conversation_id),
+                created_at: String(event.created_at),
+            };
+        case "user_message":
+            return {
+                type,
+                message_id: String(event.message_id),
+                text: String(event.text),
+                received_at: String(event.received_at),
+            };
+        case "assistant_delta":
+            return {
+                type,
+                text: String(event.text),
+                created_at: String(event.created_at),
+            };
+        case "assistant_message":
+            return {
+                type,
+                message_id: String(event.message_id),
+                text: String(event.text),
+                created_at: String(event.created_at),
+            };
+        case "tool_call":
+            return {
+                type,
+                tool_call_id: String(event.tool_call_id),
+                tool_name: String(event.tool_name),
+                summary: String(event.summary),
+                created_at: String(event.created_at),
+            };
+        case "cancelled":
+            return {
+                type,
+                reason: event.reason == null ? null : String(event.reason),
+                cancelled_at: String(event.cancelled_at),
+            };
+        case "approval_requested":
+            return {
+                type,
+                approval_id: String(event.approval_id),
+                kind: String(event.kind),
+                title: String(event.title),
+                description: event.description == null ? undefined : String(event.description),
+                actions: Array.isArray(event.actions)
+                    ? event.actions
+                    : [],
+                expires_at: String(event.expires_at),
+                metadata: event.metadata && typeof event.metadata === "object"
+                    ? event.metadata
+                    : undefined,
+                created_at: String(event.created_at),
+            };
+        case "approval_resolved":
+            return {
+                type,
+                approval_id: String(event.approval_id),
+                decision: event.decision == null ? undefined : String(event.decision),
+                resolved_at: String(event.resolved_at),
+            };
+        default:
+            return null;
+    }
+}
+function parseApprovalPluginEvent(raw) {
+    if (!raw || typeof raw !== "object") {
+        return null;
+    }
+    const event = raw;
+    const type = event.type;
+    if (type === "approval_decided") {
+        const approvalId = event.approval_id;
+        const decision = event.decision;
+        if (typeof approvalId !== "string" || typeof decision !== "string") {
+            return null;
+        }
+        return { type, approval_id: approvalId, decision };
+    }
+    if (type === "approval_resolved") {
+        const approvalId = event.approval_id;
+        if (typeof approvalId !== "string") {
+            return null;
+        }
+        return {
+            type,
+            approval_id: approvalId,
+            decision: event.decision == null ? undefined : String(event.decision),
+        };
+    }
+    return null;
+}
+function startReconnectingSse(params) {
+    const controller = new AbortController();
+    void (async () => {
+        let attempt = 0;
+        while (!controller.signal.aborted) {
+            try {
+                const response = await params.connect(controller.signal);
+                if (!response.ok) {
+                    throw new Error(`${params.errorLabel}: ${response.status}`);
+                }
+                attempt = 0;
+                await consumeSse(response, (_eventName, data) => params.onData(data), controller.signal);
+            }
+            catch (err) {
+                if (controller.signal.aborted) {
+                    return;
+                }
+                const error = err instanceof Error ? err : new Error(String(err));
+                params.onError?.(error);
+                attempt += 1;
+                const delayMs = Math.min(30_000, 1_000 * attempt);
+                await new Promise((resolve) => setTimeout(resolve, delayMs));
+            }
+        }
+    })();
+    return () => controller.abort();
+}
+async function consumeSse(response, onEvent, signal) {
+    if (!response.body) {
+        throw new Error("SSE response has no body");
+    }
+    const reader = response.body.getReader();
+    const decoder = new TextDecoder();
+    let buffer = "";
+    let eventName = "message";
+    let dataLines = [];
+    const flush = () => {
+        if (dataLines.length === 0) {
+            return;
+        }
+        const payload = dataLines.length === 1 ? dataLines[0] : dataLines.join("\n");
+        onEvent(eventName, payload);
+        eventName = "message";
+        dataLines = [];
+    };
+    while (!signal?.aborted) {
+        const { done, value } = await reader.read();
+        if (done) {
+            flush();
+            break;
+        }
+        buffer += decoder.decode(value, { stream: true });
+        let newlineIndex = buffer.indexOf("\n");
+        while (newlineIndex >= 0) {
+            const line = buffer.slice(0, newlineIndex).replace(/\r$/, "");
+            buffer = buffer.slice(newlineIndex + 1);
+            if (line === "") {
+                flush();
+            }
+            else if (line.startsWith("event:")) {
+                eventName = line.slice(6).trim();
+            }
+            else if (line.startsWith("data:")) {
+                dataLines.push(line.slice(5).trimStart());
+            }
+            newlineIndex = buffer.indexOf("\n");
+        }
+    }
+}
+export class LanglangbotSidecar {
+    baseUrl;
+    pluginToken;
+    fetchImpl;
+    constructor(opts) {
+        this.baseUrl = normalizeBaseUrl(opts.baseUrl);
+        this.pluginToken = opts.pluginToken;
+        this.fetchImpl = opts.fetchImpl ?? createFetchImpl(opts);
+    }
+    headers(extra) {
+        const headers = {
+            "content-type": "application/json",
+            ...extra,
+        };
+        if (this.pluginToken) {
+            headers["x-langlangbot-plugin-token"] = this.pluginToken;
+        }
+        return headers;
+    }
+    async health() {
+        const response = await this.fetchImpl(`${this.baseUrl}/health`);
+        if (!response.ok) {
+            throw new Error(`health check failed: ${response.status}`);
+        }
+        return (await response.json());
+    }
+    subscribeInbound(onMessage, onError) {
+        return startReconnectingSse({
+            errorLabel: "inbound SSE failed",
+            onError,
+            connect: (signal) => this.fetchImpl(`${this.baseUrl}/v1/inbound/events`, {
+                headers: this.headers({ accept: "text/event-stream" }),
+                signal,
+            }),
+            onData: (data) => {
+                try {
+                    const parsed = JSON.parse(data);
+                    if (!parsed.conversation_id ||
+                        !parsed.message_id ||
+                        typeof parsed.text !== "string") {
+                        return;
+                    }
+                    onMessage({
+                        conversationId: parsed.conversation_id,
+                        messageId: parsed.message_id,
+                        text: parsed.text,
+                        receivedAt: parsed.received_at ?? new Date().toISOString(),
+                        operatorSurfaceId: parsed.operator_surface_id?.trim() || undefined,
+                    });
+                }
+                catch (err) {
+                    if (err instanceof SyntaxError) {
+                        return;
+                    }
+                    throw err;
+                }
+            },
+        });
+    }
+    subscribeApprovalPluginEvents(onEvent, onError) {
+        return startReconnectingSse({
+            errorLabel: "approval plugin SSE failed",
+            onError,
+            connect: (signal) => this.fetchImpl(`${this.baseUrl}/v1/approvals/plugin/events`, {
+                headers: this.headers({ accept: "text/event-stream" }),
+                signal,
+            }),
+            onData: (data) => {
+                try {
+                    const parsed = parseApprovalPluginEvent(JSON.parse(data));
+                    if (parsed) {
+                        onEvent(parsed);
+                    }
+                }
+                catch (err) {
+                    if (err instanceof SyntaxError) {
+                        return;
+                    }
+                    throw err;
+                }
+            },
+        });
+    }
+    subscribeConversationEvents(conversationId, onEvent, onError) {
+        return startReconnectingSse({
+            errorLabel: "conversation SSE failed",
+            onError,
+            connect: (signal) => this.fetchImpl(`${this.baseUrl}/v1/conversations/${conversationId}/events`, {
+                headers: this.headers({ accept: "text/event-stream" }),
+                signal,
+            }),
+            onData: (data) => {
+                try {
+                    const parsed = parseGatewayEvent(JSON.parse(data));
+                    if (parsed) {
+                        onEvent(parsed);
+                    }
+                }
+                catch (err) {
+                    if (err instanceof SyntaxError) {
+                        return;
+                    }
+                    throw err;
+                }
+            },
+        });
+    }
+    async sendDelta(conversationId, text) {
+        const response = await this.fetchImpl(`${this.baseUrl}/v1/conversations/${conversationId}/outbound/delta`, {
+            method: "POST",
+            headers: this.headers(),
+            body: JSON.stringify({ text }),
+        });
+        if (!response.ok) {
+            throw new Error(`sendDelta failed: ${response.status}`);
+        }
+    }
+    async registerApprovalPending(input) {
+        const response = await this.fetchImpl(`${this.baseUrl}/v1/approvals/pending`, {
+            method: "POST",
+            headers: this.headers(),
+            body: JSON.stringify({
+                approval_id: input.approvalId,
+                kind: normalizeApprovalKind(input.kind),
+                conversation_id: input.conversationId,
+                title: input.title,
+                description: input.description,
+                actions: input.actions,
+                metadata: input.metadata ?? {},
+                expires_at: input.expiresAt,
+            }),
+        });
+        if (!response.ok) {
+            throw new Error(`registerApprovalPending failed: ${response.status}`);
+        }
+        return (await response.json());
+    }
+    async getApprovalDecision(approvalId) {
+        const response = await this.fetchImpl(`${this.baseUrl}/v1/approvals/${encodeURIComponent(approvalId)}/decision`, { headers: this.headers() });
+        if (!response.ok) {
+            throw new Error(`getApprovalDecision failed: ${response.status}`);
+        }
+        const body = (await response.json());
+        return {
+            status: body.status,
+            decision: body.decision,
+            decidedAt: body.decided_at,
+        };
+    }
+    async markApprovalResolved(approvalId, decision) {
+        const response = await this.fetchImpl(`${this.baseUrl}/v1/approvals/${encodeURIComponent(approvalId)}/resolved`, {
+            method: "POST",
+            headers: this.headers(),
+            body: JSON.stringify({ decision }),
+        });
+        if (!response.ok) {
+            throw new Error(`markApprovalResolved failed: ${response.status}`);
+        }
+    }
+    async getPluginConnectionCurrent(conversationId) {
+        const params = new URLSearchParams({ conversation_id: conversationId });
+        const response = await this.fetchImpl(`${this.baseUrl}/v1/plugin/connection/current?${params}`, {
+            method: "GET",
+            headers: this.headers(),
+        });
+        if (!response.ok) {
+            throw new Error(`getPluginConnectionCurrent failed: ${response.status}`);
+        }
+        return response.json();
+    }
+    async sendMessage(conversationId, text, messageId) {
+        const response = await this.fetchImpl(`${this.baseUrl}/v1/conversations/${conversationId}/outbound/message`, {
+            method: "POST",
+            headers: this.headers(),
+            body: JSON.stringify({
+                text,
+                message_id: messageId,
+            }),
+        });
+        if (!response.ok) {
+            throw new Error(`sendMessage failed: ${response.status}`);
+        }
+        return (await response.json());
+    }
+}

package/dist/endpoint-url.d.ts

@@ -0,0 +1,15 @@
+export declare const HTTPS_SCHEME = "https";
+export declare const TLS_FINGERPRINT_PREFIX = "sha256/";
+export type DirectEndpointLike = {
+    address: string;
+    port: number;
+    scheme?: string;
+    tls_fingerprint?: string;
+};
+/** Reject plaintext HTTP endpoints (production Operator policy). */
+export declare function assertHttpsEndpoint(endpoint: DirectEndpointLike): void;
+export declare function validateTlsFingerprint(fingerprint: string | undefined): void;
+export declare function buildDirectEndpointUrl(endpoint: DirectEndpointLike): string;
+/** Reject plaintext HTTP base URLs (Operator / production policy). */
+export declare function assertHttpsBaseUrl(baseUrl: string): void;
+//# sourceMappingURL=endpoint-url.d.ts.map

package/dist/endpoint-url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoint-url.d.ts","sourceRoot":"","sources":["../src/endpoint-url.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,YAAY,UAAU,CAAC;AACpC,eAAO,MAAM,sBAAsB,YAAY,CAAC;AAGhD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,oEAAoE;AACpE,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CAQtE;AAED,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,MAAM,GAAG,SAAS,GAC9B,IAAI,CAYN;AAED,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,MAAM,CAG3E;AAED,sEAAsE;AACtE,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAYxD"}

package/dist/endpoint-url.js

@@ -0,0 +1,41 @@
+export const HTTPS_SCHEME = "https";
+export const TLS_FINGERPRINT_PREFIX = "sha256/";
+const TLS_FINGERPRINT_HEX_RE = /^[0-9a-fA-F]{64}$/;
+/** Reject plaintext HTTP endpoints (production Operator policy). */
+export function assertHttpsEndpoint(endpoint) {
+    const scheme = endpoint.scheme?.trim().toLowerCase();
+    if (scheme !== HTTPS_SCHEME) {
+        throw new Error(`direct endpoint must use scheme=https (got ${scheme ?? "missing"})`);
+    }
+    validateTlsFingerprint(endpoint.tls_fingerprint);
+}
+export function validateTlsFingerprint(fingerprint) {
+    const trimmed = fingerprint?.trim();
+    if (!trimmed) {
+        throw new Error("tls_fingerprint is required");
+    }
+    if (!trimmed.startsWith(TLS_FINGERPRINT_PREFIX)) {
+        throw new Error("tls_fingerprint must start with sha256/");
+    }
+    const hex = trimmed.slice(TLS_FINGERPRINT_PREFIX.length);
+    if (!TLS_FINGERPRINT_HEX_RE.test(hex)) {
+        throw new Error("tls_fingerprint must be sha256/ followed by 64 hex chars");
+    }
+}
+export function buildDirectEndpointUrl(endpoint) {
+    assertHttpsEndpoint(endpoint);
+    return `${HTTPS_SCHEME}://${endpoint.address}:${endpoint.port}`;
+}
+/** Reject plaintext HTTP base URLs (Operator / production policy). */
+export function assertHttpsBaseUrl(baseUrl) {
+    let parsed;
+    try {
+        parsed = new URL(baseUrl);
+    }
+    catch {
+        throw new Error(`invalid base URL: ${baseUrl}`);
+    }
+    if (parsed.protocol !== `${HTTPS_SCHEME}:`) {
+        throw new Error(`base URL must use scheme=https (got ${parsed.protocol.replace(":", "")})`);
+    }
+}

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+export { LanglangbotSidecar, type ApprovalAction, type ApprovalDecisionPoll, type ApprovalPluginEvent, type ApprovalKind, isOpenClawApprovalDecision, type BuiltInOpenClawApprovalKind, OpenClawApprovalKind, isOpenClawApprovalKind, normalizeApprovalKind, type GatewayEvent, type GatewayEventType, type HealthStatus, type InboundMessage, type LanglangbotSidecarOptions, type OpenClawApprovalDecision, type PluginConnectionCurrentResponse, type PluginConnectionEndpoint, type RegisterPendingApprovalInput, type Unsubscribe, } from "./client.js";
+export { HTTPS_SCHEME, TLS_FINGERPRINT_PREFIX, assertHttpsBaseUrl, assertHttpsEndpoint, buildDirectEndpointUrl, validateTlsFingerprint, type DirectEndpointLike, } from "./endpoint-url.js";
+export { TlsTrustStore, createDirectAgentFetch, createInsecureTlsFetch, createPinnedTlsFetch, fingerprintsMatch, normalizeTlsFingerprint, spkiFingerprintFromCertDer, undiciFetchWithAgent, type DirectAgentClientOptions, type PinnedTlsFetchOptions, } from "./tls-pin.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,YAAY,EACjB,0BAA0B,EAC1B,KAAK,2BAA2B,EAChC,oBAAoB,EACpB,sBAAsB,EACtB,qBAAqB,EACrB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,EAC7B,KAAK,+BAA+B,EACpC,KAAK,wBAAwB,EAC7B,KAAK,4BAA4B,EACjC,KAAK,WAAW,GACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,YAAY,EACZ,sBAAsB,EACtB,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,kBAAkB,GACxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,aAAa,EACb,sBAAsB,EACtB,sBAAsB,EACtB,oBAAoB,EACpB,iBAAiB,EACjB,uBAAuB,EACvB,0BAA0B,EAC1B,oBAAoB,EACpB,KAAK,wBAAwB,EAC7B,KAAK,qBAAqB,GAC3B,MAAM,cAAc,CAAC"}

package/dist/index.js

@@ -0,0 +1,3 @@
+export { LanglangbotSidecar, isOpenClawApprovalDecision, OpenClawApprovalKind, isOpenClawApprovalKind, normalizeApprovalKind, } from "./client.js";
+export { HTTPS_SCHEME, TLS_FINGERPRINT_PREFIX, assertHttpsBaseUrl, assertHttpsEndpoint, buildDirectEndpointUrl, validateTlsFingerprint, } from "./endpoint-url.js";
+export { TlsTrustStore, createDirectAgentFetch, createInsecureTlsFetch, createPinnedTlsFetch, fingerprintsMatch, normalizeTlsFingerprint, spkiFingerprintFromCertDer, undiciFetchWithAgent, } from "./tls-pin.js";

package/dist/tls-pin.d.ts

@@ -0,0 +1,42 @@
+import { Agent } from "undici";
+import { type DirectEndpointLike } from "./endpoint-url.js";
+/** SHA-256(SPKI DER) — must match langlangbot `tls::fingerprint_from_cert_pem`. */
+export declare function spkiFingerprintFromCertDer(certDer: Buffer): string;
+export declare function normalizeTlsFingerprint(fingerprint: string): string;
+export declare function fingerprintsMatch(expected: string, observed: string): boolean;
+/** Per-surface SPKI pins established at enrollment. */
+export declare class TlsTrustStore {
+    private readonly pins;
+    pin(surfaceId: string, tlsFingerprint: string): void;
+    get(surfaceId: string): string | undefined;
+    has(surfaceId: string): boolean;
+    unpin(surfaceId: string): void;
+    /**
+     * Returns true when Makway reports a new fingerprint for a previously pinned surface.
+     * Operator must require Owner re-confirmation before accepting the new pin.
+     */
+    fingerprintChanged(surfaceId: string, tlsFingerprint: string): boolean;
+    /** Same as `pin`; name signals Owner re-confirmation after fingerprint change. */
+    confirmPin(surfaceId: string, tlsFingerprint: string): void;
+}
+export type PinnedTlsFetchOptions = {
+    tlsFingerprint: string;
+    /** Dev only — skip SPKI pin verification. */
+    insecureTls?: boolean;
+};
+export declare function undiciFetchWithAgent(agent: Agent): (input: RequestInfo | URL, init?: RequestInit) => ReturnType<typeof fetch>;
+export declare function createInsecureTlsFetch(): typeof fetch;
+export declare function createPinnedTlsFetch(opts: PinnedTlsFetchOptions): typeof fetch;
+export type DirectAgentClientOptions = {
+    endpoint: DirectEndpointLike;
+    surfaceId: string;
+    trustStore: TlsTrustStore;
+    /** Dev only. */
+    insecureTls?: boolean;
+};
+/**
+ * Operator client for a pinned HTTPS direct endpoint.
+ * Requires enrollment pin in `trustStore` unless `insecureTls` (dev).
+ */
+export declare function createDirectAgentFetch(opts: DirectAgentClientOptions): typeof fetch;
+//# sourceMappingURL=tls-pin.d.ts.map

package/dist/tls-pin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tls-pin.d.ts","sourceRoot":"","sources":["../src/tls-pin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAA+D,MAAM,QAAQ,CAAC;AAI5F,OAAO,EAGL,KAAK,kBAAkB,EACxB,MAAM,mBAAmB,CAAC;AAE3B,mFAAmF;AACnF,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAKlE;AAED,wBAAgB,uBAAuB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAOnE;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE7E;AAED,uDAAuD;AACvD,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA6B;IAElD,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,IAAI;IAIpD,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAI1C,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAI/B,KAAK,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAI9B;;;OAGG;IACH,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO;IAQtE,kFAAkF;IAClF,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,IAAI;CAG5D;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC,cAAc,EAAE,MAAM,CAAC;IACvB,6CAA6C;IAC7C,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,CAAC;AAIF,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,KAAK,GACX,CAAC,KAAK,EAAE,WAAW,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,UAAU,CAAC,OAAO,KAAK,CAAC,CAM5E;AAED,wBAAgB,sBAAsB,IAAI,OAAO,KAAK,CAGrD;AAED,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,qBAAqB,GAC1B,OAAO,KAAK,CAuBd;AAED,MAAM,MAAM,wBAAwB,GAAG;IACrC,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,aAAa,CAAC;IAC1B,gBAAgB;IAChB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,CAAC;AAEF;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,wBAAwB,GAC7B,OAAO,KAAK,CAkBd"}

package/dist/tls-pin.js

@@ -0,0 +1,102 @@
+import { Agent, fetch as undiciFetch } from "undici";
+import { createHash, X509Certificate } from "node:crypto";
+import { TLS_FINGERPRINT_PREFIX, validateTlsFingerprint, } from "./endpoint-url.js";
+/** SHA-256(SPKI DER) — must match langlangbot `tls::fingerprint_from_cert_pem`. */
+export function spkiFingerprintFromCertDer(certDer) {
+    const x509 = new X509Certificate(certDer);
+    const spkiDer = x509.publicKey.export({ type: "spki", format: "der" });
+    const hex = createHash("sha256").update(spkiDer).digest("hex");
+    return `${TLS_FINGERPRINT_PREFIX}${hex}`;
+}
+export function normalizeTlsFingerprint(fingerprint) {
+    validateTlsFingerprint(fingerprint);
+    const hex = fingerprint
+        .trim()
+        .slice(TLS_FINGERPRINT_PREFIX.length)
+        .toLowerCase();
+    return `${TLS_FINGERPRINT_PREFIX}${hex}`;
+}
+export function fingerprintsMatch(expected, observed) {
+    return normalizeTlsFingerprint(expected) === normalizeTlsFingerprint(observed);
+}
+/** Per-surface SPKI pins established at enrollment. */
+export class TlsTrustStore {
+    pins = new Map();
+    pin(surfaceId, tlsFingerprint) {
+        this.pins.set(surfaceId, normalizeTlsFingerprint(tlsFingerprint));
+    }
+    get(surfaceId) {
+        return this.pins.get(surfaceId);
+    }
+    has(surfaceId) {
+        return this.pins.has(surfaceId);
+    }
+    unpin(surfaceId) {
+        this.pins.delete(surfaceId);
+    }
+    /**
+     * Returns true when Makway reports a new fingerprint for a previously pinned surface.
+     * Operator must require Owner re-confirmation before accepting the new pin.
+     */
+    fingerprintChanged(surfaceId, tlsFingerprint) {
+        const existing = this.pins.get(surfaceId);
+        if (!existing) {
+            return false;
+        }
+        return !fingerprintsMatch(existing, tlsFingerprint);
+    }
+    /** Same as `pin`; name signals Owner re-confirmation after fingerprint change. */
+    confirmPin(surfaceId, tlsFingerprint) {
+        this.pin(surfaceId, tlsFingerprint);
+    }
+}
+export function undiciFetchWithAgent(agent) {
+    return (input, init) => undiciFetch(input, {
+        ...init,
+        dispatcher: agent,
+    });
+}
+export function createInsecureTlsFetch() {
+    const agent = new Agent({ connect: { rejectUnauthorized: false } });
+    return undiciFetchWithAgent(agent);
+}
+export function createPinnedTlsFetch(opts) {
+    if (opts.insecureTls) {
+        return createInsecureTlsFetch();
+    }
+    const expected = normalizeTlsFingerprint(opts.tlsFingerprint);
+    const agent = new Agent({
+        connect: {
+            // CA validation disabled; SPKI pin is enforced in checkServerIdentity.
+            rejectUnauthorized: false,
+            checkServerIdentity(_host, cert) {
+                const der = cert.raw;
+                const observed = spkiFingerprintFromCertDer(der);
+                if (!fingerprintsMatch(expected, observed)) {
+                    return new Error(`TLS fingerprint mismatch: expected ${expected}, got ${observed}`);
+                }
+                return undefined;
+            },
+        },
+    });
+    return undiciFetchWithAgent(agent);
+}
+/**
+ * Operator client for a pinned HTTPS direct endpoint.
+ * Requires enrollment pin in `trustStore` unless `insecureTls` (dev).
+ */
+export function createDirectAgentFetch(opts) {
+    if (opts.insecureTls) {
+        return createInsecureTlsFetch();
+    }
+    const pinned = opts.trustStore.get(opts.surfaceId);
+    if (!pinned) {
+        throw new Error(`no TLS pin for surface ${opts.surfaceId}; complete enrollment first`);
+    }
+    const reported = opts.endpoint.tls_fingerprint;
+    if (reported && opts.trustStore.fingerprintChanged(opts.surfaceId, reported)) {
+        throw new Error(`TLS fingerprint changed for surface ${opts.surfaceId}; Owner must re-confirm`);
+    }
+    const fingerprint = reported ? normalizeTlsFingerprint(reported) : pinned;
+    return createPinnedTlsFetch({ tlsFingerprint: fingerprint });
+}

package/package.json

@@ -0,0 +1,41 @@
+{
+  "name": "@optimatist/langlangbot-connector",
+  "version": "0.1.0",
+  "description": "HTTP/SSE client for the LangLangBot gateway API",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/OptimatistOpenSource/openclaw-langlangbot.git",
+    "directory": "packages/connector"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "prepack": "npm run build"
+  },
+  "dependencies": {
+    "undici": "^7.0.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.15.0",
+    "typescript": "^5.8.3"
+  },
+  "engines": {
+    "node": ">=20"
+  }
+}