Skip to content

build(client): make @openclaw/gateway-client publishable to npm#111707

Merged
steipete merged 1 commit into
mainfrom
claude/gateway-client-publish
Jul 20, 2026
Merged

build(client): make @openclaw/gateway-client publishable to npm#111707
steipete merged 1 commit into
mainfrom
claude/gateway-client-publish

Conversation

@steipete

@steipete steipete commented Jul 20, 2026

Copy link
Copy Markdown
Contributor

What Problem This Solves

@openclaw/gateway-protocol ships to npm at the next release train (#111664), but third-party clients still have no installable reference client — openclaw-studio vendored our entire private client layer. This makes @openclaw/gateway-client publishable alongside it.

Why This Change Was Made

  • Bundled the private workspace deps into the dist instead of publishing them: @openclaw/retry was already force-bundled by the root build; @openclaw/net-policy (only 4 IP helpers used) now bundles too (tsdown.config.ts externalize predicate). Published tarball depends only on public packages: ws, ipaddr.js, @openclaw/gateway-protocol (workspace:* rewritten to exact 2026.7.2 at pack).
  • Package manifest mirrors the landed gateway-protocol treatment: calendar version, publishConfig.access: public, openclaw.release.publishToNpm: true, metadata, files whitelist, truthful sideEffects: false. New README (entry points incl. the browser-safe graph, verified Node quickstart), LICENSE, CHANGELOG, tool-generated npm-shrinkwrap.json.
  • Release train wiring follows the build(protocol): make @openclaw/gateway-protocol publishable to npm #111664 pattern exactly: CORE_PACKAGE_DIRS + per-package preflight verification (fail-closed both directions) in openclaw-npm-release.yml, VERSION_ALIGNED_PACKAGE_DIRS, release-check.ts tarball recognition, contract-test updates. The manifest-driven publish loop needed no changes; publish order is ai → gateway-protocol → gateway-client → root.
  • Unpublished-dependency risk verified safe: the shrinkwrap generator strips workspace:* deps from registry resolution (shrinkwrap pins only ipaddr.js + ws), confirmed against live npm E404 for the not-yet-published protocol package.

User Impact

No client logic changes. Next release train publishes both packages with provenance; third parties get npm install @openclaw/gateway-client @openclaw/gateway-protocol instead of vendoring private source.

Evidence

  • Client suite 52/52 green; standalone build bundles net-policy/retry (grep-proven absent from dist mjs+dts) and externalizes only declared deps; browser entry graph free of node:/ws/net-policy.
  • sync-plugin-versions --check and shrinkwrap --check green; four release-tooling test files green on Blacksmith Testbox run 29722428264 (141 tests).
  • npm pack --dry-run: 18 files, dist + docs + shrinkwrap, no src; packed manifest shows exact-version protocol dep.
  • Workflow YAML parses; autoreview clean (0.94, no findings).

@steipete
steipete requested review from a team as code owners July 20, 2026 07:04
@openclaw-barnacle openclaw-barnacle Bot added scripts Repository scripts size: M maintainer Maintainer-authored PR labels Jul 20, 2026
@github-actions github-actions Bot added the dependencies-changed PR changes dependency-related files label Jul 20, 2026
@github-actions

github-actions Bot commented Jul 20, 2026

Copy link
Copy Markdown
Contributor

Dependency Guard

This PR changes dependency-related files. Maintainers should confirm these changes are intentional.

Changed files:

  • packages/gateway-client/npm-shrinkwrap.json
  • packages/gateway-client/package.json
  • pnpm-lock.yaml

Maintainer follow-up:

  • Review whether the dependency changes are intentional.
  • Inspect resolved package deltas when lockfile, shrinkwrap, or workspace dependency policy changes are present.
  • Treat package-lock.json and npm-shrinkwrap.json diffs as security-review surfaces.
  • Run pnpm deps:changes:report -- --base-ref origin/main --markdown /tmp/dependency-changes.md --json /tmp/dependency-changes.json locally for detailed release-style evidence.

@github-actions

github-actions Bot commented Jul 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Dependency graph changes noted

This PR includes dependency graph changes. The dependency guard is informational because the PR author is a repository admin or a member of @openclaw/openclaw-secops.

  • Current SHA: c9298f217fcca26d5a3e9d903a80fb4999ad0d09
  • Trusted actor: @steipete
  • Trusted role: pull request author; openclaw-secops

Security review is still recommended before merge when the dependency graph change is intentional.

@steipete steipete self-assigned this Jul 20, 2026
@steipete
steipete force-pushed the claude/gateway-client-publish branch from 04ffcd5 to c9298f2 Compare July 20, 2026 07:08
@steipete

steipete commented Jul 20, 2026

Copy link
Copy Markdown
Contributor Author

ClawSweeper's browser-export finding is based on an incorrect diff read, so no code change is needed.

The proposed packages/gateway-client/package.json already exports ./browser to dist/browser.mjs with dist/browser.d.mts types, and the build script includes src/browser.ts. I also completed the requested packed-artifact proof on exact head c9298f217fcca26d5a3e9d903a80fb4999ad0d09:

  • pnpm pack produced the expected 18-file gateway-client tarball, including dist/browser.mjs, dist/browser.d.mts, and npm-shrinkwrap.json.
  • The packed manifest rewrote @openclaw/gateway-protocol from workspace:* to exact 2026.7.2.
  • Installing the packed protocol and client tarballs together succeeded.
  • Node successfully imported every documented entry point: package root, /browser, /readiness, and /timeouts.

That satisfies both rank-up moves: the browser API and README are already aligned, and every documented packed entry point has executable import proof.

@steipete
steipete merged commit a971188 into main Jul 20, 2026
108 checks passed
@steipete
steipete deleted the claude/gateway-client-publish branch July 20, 2026 07:23
@steipete

steipete commented Jul 20, 2026

Copy link
Copy Markdown
Contributor Author

Merged via squash.

@steipete steipete mentioned this pull request Jul 20, 2026
Merged
@github-actions github-actions Bot mentioned this pull request Jul 20, 2026
Open
github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request Jul 21, 2026
@steipete
build(client): make @openclaw/gateway-client publishable to npm (open…
a3dbde5 
…claw#111707)
This was referenced Jul 21, 2026
Merged
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@steipete steipete

Labels

dependencies-changed PR changes dependency-related files maintainer Maintainer-authored PR scripts Repository scripts size: M

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@steipete