nodeSendToSession: (sessionKey: string, event: string, payload: unknown) => void;

};

export type TrackedChatRunAbortOps = {

type TrackedChatRunAbortOps = {

chatAbortControllers: ChatAbortOps["chatAbortControllers"];

chatRunBuffers: ChatAbortOps["chatRunBuffers"];

chatRunState: {

const CONTROL_UI_OPERATOR_ROLE = "operator";

const controlUiAssistantMediaTicketSecret = randomBytes(32);

export type ControlUiRequestOptions = {

type ControlUiRequestOptions = {

basePath?: string;

config?: OpenClawConfig;

agentId?: string;

"sw.js",

]);

export type ControlUiAvatarResolution =

type ControlUiAvatarResolution =

| { kind: "none"; reason: string; source?: string | null }

| { kind: "local"; filePath: string; source?: string | null }

| { kind: "remote"; url: string; source?: string | null }

type EventLoopUtilization = ReturnType<typeof performance.eventLoopUtilization>;

type CpuUsage = ReturnType<typeof process.cpuUsage>;

export type GatewayEventLoopHealthReason = "event_loop_delay" | "event_loop_utilization" | "cpu";

type GatewayEventLoopHealthReason = "event_loop_delay" | "event_loop_utilization" | "cpu";

export type GatewayEventLoopHealth = {

degraded: boolean;

cpuCoreRatio: number;

};

export type GatewayEventLoopHealthMonitor = {

type GatewayEventLoopHealthMonitor = {

snapshot: () => GatewayEventLoopHealth | undefined;

stop: () => void;

};

approvalRuntimeToken?: string;

};

export type DeviceTokenCandidateSource = "explicit-device-token" | "shared-token-fallback";

type DeviceTokenCandidateSource = "explicit-device-token" | "shared-token-fallback";

export type ConnectAuthState = {

authResult: GatewayAuthResult;

};

type VerifyBootstrapTokenResult = { ok: boolean; reason?: string };

export type ConnectAuthDecision = {

type ConnectAuthDecision = {

authResult: GatewayAuthResult;

authOk: boolean;

authMethod: GatewayAuthResult["method"];

import type { GatewayRole } from "../../role-policy.js";

import { roleCanSkipDeviceIdentity } from "../../role-policy.js";

export type ControlUiAuthPolicy = {

type ControlUiAuthPolicy = {

isControlUi: boolean;

allowInsecureAuthConfigured: boolean;

dangerouslyDisableDeviceAuth: boolean;

);

}

export type MissingDeviceIdentityDecision =

type MissingDeviceIdentityDecision =

| { kind: "allow" }

| { kind: "reject-control-ui-insecure-auth" }

| { kind: "reject-unauthorized" }

export const BROWSER_ORIGIN_LOOPBACK_RATE_LIMIT_IP = "198.18.0.1";

export const BROWSER_ORIGIN_RATE_LIMIT_KEY_PREFIX = "browser-origin:";

export type PairingLocalityKind =

type PairingLocalityKind =

| "direct_local"

| "cli_container_local"

| "browser_container_local"

| "shared_secret_loopback_local"

| "remote";

export type HandshakeBrowserSecurityContext = {

type HandshakeBrowserSecurityContext = {

hasBrowserOriginHeader: boolean;

enforceOriginCheckForAnyClient: boolean;

rateLimitClientIp: string | undefined;

import { resolveIntegerOption } from "@openclaw/normalization-core/number-coercion";

/** Decision returned for a handshake auth log attempt. */

export type HandshakeAuthLogDecision = {

type HandshakeAuthLogDecision = {

shouldLog: boolean;

suppressedSinceLastLog: number;

};

/**

* Per-connection guard that suppresses noisy unauthorized-role retries.

*/

export type UnauthorizedFloodGuardOptions = {

type UnauthorizedFloodGuardOptions = {

closeAfter?: number;

logEvery?: number;

};

/** Decision returned after recording one unauthorized role failure. */

export type UnauthorizedFloodDecision = {

type UnauthorizedFloodDecision = {

shouldClose: boolean;

shouldLog: boolean;

count: number;