@openclaw/gateway-client 2026.7.2-beta.6 → 2026.8.1-beta.1

package/README.md

@@ -88,6 +88,7 @@ The host is responsible for:
 - creating a `GatewayProtocolSocket` adapter around the browser WebSocket;
 - loading and storing browser device identity and issued device tokens;
 - signing the challenge-bound device payload;
+- using the Gateway challenge `ts` as the device proof's `signedAt` value;
 - supplying the client identity, role, scopes, and authentication selection;
 - choosing close and reconnect behavior for product-specific errors.
 

package/dist/browser.d.mts

@@ -1,6 +1,6 @@
-import { A as GatewayBrowserDeviceAuthLifecycle, B as buildDeviceAuthPayload, C as normalizeSessionProjectionRunId, D as reconcileSessionProjectionSnapshot, E as readSessionMessageSequence, F as GatewayConnectAuthSelection, H as normalizeDeviceMetadataForAuth, I as buildGatewayConnectAuth, L as resolveGatewayConnectScopes, M as GatewayBrowserDeviceIdentity, N as GatewayBrowserDeviceTokenRecord, O as reduceSessionProjection, P as GatewayBrowserDeviceTokenStore, R as selectGatewayConnectAuth, S as isLocallyOptimisticSessionMessage, T as readSessionMessageIdentity, V as buildDeviceAuthPayloadV3, _ as SessionProjectionScope, a as GatewaySessionMessageSubscriptionOptions, b as createSessionProjection, c as resetGatewaySessionMessageSubscriptionCoordinator, d as SessionProjectionEntry, f as SessionProjectionEvent, g as SessionProjectionRunTransition, h as SessionProjectionRunStatus, i as GatewaySessionMessageSubscriptionCoordinatorOptions, j as GatewayBrowserDeviceAuthPlan, k as reduceSessionProjectionRunEvent, l as SessionMessageEnvelope, m as SessionProjectionRun, n as GatewaySessionMessageSubscription, o as getGatewaySessionMessageSubscriptionCoordinator, p as SessionProjectionGatewayRunEvent, r as GatewaySessionMessageSubscriptionCoordinator, s as releaseGatewaySessionMessageSubscription, t as GatewaySessionMessageRequestClient, u as SessionMessageIdentity, v as SessionProjectionSnapshotOptions, w as projectLiveSessionMessage, x as hasSessionProjectionAcceptedFinal, y as SessionProjectionState, z as shouldRetryGatewayWithDeviceToken } from "./session-subscriptions-DrhzqL6v.mjs";
-import { a as GatewayProtocolRequestTiming, c as GatewayProtocolTiming, i as GatewayProtocolRequestOptions, n as GatewayProtocolCloseContext, o as GatewayProtocolSocket, r as GatewayProtocolRequestError, s as GatewayProtocolSocketHandlers, t as GatewayProtocolClient } from "./protocol-client-BfBHwA5H.mjs";
-import { DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS, resolveSafeTimeoutDelayMs } from "./timeouts.mjs";
+import { A as GatewayBrowserDeviceAuthLifecycle, B as buildDeviceAuthPayload, C as normalizeSessionProjectionRunId, D as reconcileSessionProjectionSnapshot, E as readSessionMessageSequence, F as GatewayConnectAuthSelection, H as normalizeDeviceMetadataForAuth, I as buildGatewayConnectAuth, L as resolveGatewayConnectScopes, M as GatewayBrowserDeviceIdentity, N as GatewayBrowserDeviceTokenRecord, O as reduceSessionProjection, P as GatewayBrowserDeviceTokenStore, R as selectGatewayConnectAuth, S as isLocallyOptimisticSessionMessage, T as readSessionMessageIdentity, V as buildDeviceAuthPayloadV3, _ as SessionProjectionScope, a as GatewaySessionMessageSubscriptionOptions, b as createSessionProjection, c as resetGatewaySessionMessageSubscriptionCoordinator, d as SessionProjectionEntry, f as SessionProjectionEvent, g as SessionProjectionRunTransition, h as SessionProjectionRunStatus, i as GatewaySessionMessageSubscriptionCoordinatorOptions, j as GatewayBrowserDeviceAuthPlan, k as reduceSessionProjectionRunEvent, l as SessionMessageEnvelope, m as SessionProjectionRun, n as GatewaySessionMessageSubscription, o as getGatewaySessionMessageSubscriptionCoordinator, p as SessionProjectionGatewayRunEvent, r as GatewaySessionMessageSubscriptionCoordinator, s as releaseGatewaySessionMessageSubscription, t as GatewaySessionMessageRequestClient, u as SessionMessageIdentity, v as SessionProjectionSnapshotOptions, w as projectLiveSessionMessage, x as hasSessionProjectionAcceptedFinal, y as SessionProjectionState, z as shouldRetryGatewayWithDeviceToken } from "./session-subscriptions-Das1PATe.mjs";
+import { a as GatewayProtocolSocketHandlers, c as GatewayProtocolRequestOptions, i as GatewayProtocolSocket, n as GatewayProtocolCloseContext, o as GatewayProtocolTiming, r as GatewayProtocolRequestTiming, s as GatewayProtocolRequestError, t as GatewayProtocolClient } from "./protocol-client-U142L0j3.mjs";
+import { DEFAULT_GATEWAY_REQUEST_TIMEOUT_MS, DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS, resolveSafeTimeoutDelayMs } from "./timeouts.mjs";
 import { ConnectParams, ErrorShape, EventFrame, HelloOk } from "@openclaw/gateway-protocol";
 export * from "@openclaw/gateway-protocol/connect-error-details";
 export * from "@openclaw/gateway-protocol/client-info";
@@ -17,4 +17,4 @@ declare function shouldPauseGatewayReconnect(params: {
   clientVersionMismatchIsTerminal?: boolean;
 }): boolean;
 //#endregion
-export { type ConnectParams, DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS, type ErrorShape, type EventFrame, GatewayBrowserDeviceAuthLifecycle, GatewayBrowserDeviceAuthPlan, GatewayBrowserDeviceIdentity, GatewayBrowserDeviceTokenRecord, GatewayBrowserDeviceTokenStore, GatewayConnectAuthSelection, GatewayProtocolClient, GatewayProtocolCloseContext, GatewayProtocolRequestError, GatewayProtocolRequestOptions, GatewayProtocolRequestTiming, GatewayProtocolSocket, GatewayProtocolSocketHandlers, GatewayProtocolTiming, GatewaySessionMessageRequestClient, GatewaySessionMessageSubscription, GatewaySessionMessageSubscriptionCoordinator, GatewaySessionMessageSubscriptionCoordinatorOptions, GatewaySessionMessageSubscriptionOptions, type HelloOk, SessionMessageEnvelope, SessionMessageIdentity, SessionProjectionEntry, SessionProjectionEvent, SessionProjectionGatewayRunEvent, SessionProjectionRun, SessionProjectionRunStatus, SessionProjectionRunTransition, SessionProjectionScope, SessionProjectionSnapshotOptions, SessionProjectionState, buildDeviceAuthPayload, buildDeviceAuthPayloadV3, buildGatewayConnectAuth, createSessionProjection, getGatewaySessionMessageSubscriptionCoordinator, hasSessionProjectionAcceptedFinal, isLocallyOptimisticSessionMessage, normalizeDeviceMetadataForAuth, normalizeSessionProjectionRunId, projectLiveSessionMessage, readSessionMessageIdentity, readSessionMessageSequence, reconcileSessionProjectionSnapshot, reduceSessionProjection, reduceSessionProjectionRunEvent, releaseGatewaySessionMessageSubscription, resetGatewaySessionMessageSubscriptionCoordinator, resolveGatewayConnectScopes, resolveSafeTimeoutDelayMs, selectGatewayConnectAuth, shouldPauseGatewayReconnect, shouldRetryGatewayWithDeviceToken };
+export { type ConnectParams, DEFAULT_GATEWAY_REQUEST_TIMEOUT_MS, DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS, type ErrorShape, type EventFrame, GatewayBrowserDeviceAuthLifecycle, GatewayBrowserDeviceAuthPlan, GatewayBrowserDeviceIdentity, GatewayBrowserDeviceTokenRecord, GatewayBrowserDeviceTokenStore, GatewayConnectAuthSelection, GatewayProtocolClient, GatewayProtocolCloseContext, GatewayProtocolRequestError, type GatewayProtocolRequestOptions, GatewayProtocolRequestTiming, GatewayProtocolSocket, GatewayProtocolSocketHandlers, GatewayProtocolTiming, GatewaySessionMessageRequestClient, GatewaySessionMessageSubscription, GatewaySessionMessageSubscriptionCoordinator, GatewaySessionMessageSubscriptionCoordinatorOptions, GatewaySessionMessageSubscriptionOptions, type HelloOk, SessionMessageEnvelope, SessionMessageIdentity, SessionProjectionEntry, SessionProjectionEvent, SessionProjectionGatewayRunEvent, SessionProjectionRun, SessionProjectionRunStatus, SessionProjectionRunTransition, SessionProjectionScope, SessionProjectionSnapshotOptions, SessionProjectionState, buildDeviceAuthPayload, buildDeviceAuthPayloadV3, buildGatewayConnectAuth, createSessionProjection, getGatewaySessionMessageSubscriptionCoordinator, hasSessionProjectionAcceptedFinal, isLocallyOptimisticSessionMessage, normalizeDeviceMetadataForAuth, normalizeSessionProjectionRunId, projectLiveSessionMessage, readSessionMessageIdentity, readSessionMessageSequence, reconcileSessionProjectionSnapshot, reduceSessionProjection, reduceSessionProjectionRunEvent, releaseGatewaySessionMessageSubscription, resetGatewaySessionMessageSubscriptionCoordinator, resolveGatewayConnectScopes, resolveSafeTimeoutDelayMs, selectGatewayConnectAuth, shouldPauseGatewayReconnect, shouldRetryGatewayWithDeviceToken };

package/dist/browser.mjs

@@ -1,8 +1,8 @@
-import { C as buildDeviceAuthPayload, S as shouldRetryGatewayWithDeviceToken, T as normalizeDeviceMetadataForAuth, _ as GatewayProtocolRequestError, a as createSessionProjection, b as resolveGatewayConnectScopes, c as normalizeSessionProjectionRunId, d as readSessionMessageSequence, f as reconcileSessionProjectionSnapshot, g as GatewayProtocolClient, h as shouldPauseGatewayReconnect, i as resetGatewaySessionMessageSubscriptionCoordinator, l as projectLiveSessionMessage, m as reduceSessionProjectionRunEvent, n as getGatewaySessionMessageSubscriptionCoordinator, o as hasSessionProjectionAcceptedFinal, p as reduceSessionProjection, r as releaseGatewaySessionMessageSubscription, s as isLocallyOptimisticSessionMessage, t as GatewaySessionMessageSubscriptionCoordinator, u as readSessionMessageIdentity, v as GatewayBrowserDeviceAuthLifecycle, w as buildDeviceAuthPayloadV3, x as selectGatewayConnectAuth, y as buildGatewayConnectAuth } from "./session-subscriptions-BV7MxYiL.mjs";
-import { DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS, resolveSafeTimeoutDelayMs } from "./timeouts.mjs";
+import { C as buildDeviceAuthPayload, S as shouldRetryGatewayWithDeviceToken, T as normalizeDeviceMetadataForAuth, _ as GatewayProtocolRequestError, a as createSessionProjection, b as resolveGatewayConnectScopes, c as normalizeSessionProjectionRunId, d as readSessionMessageSequence, f as reconcileSessionProjectionSnapshot, g as GatewayProtocolClient, h as shouldPauseGatewayReconnect, i as resetGatewaySessionMessageSubscriptionCoordinator, l as projectLiveSessionMessage, m as reduceSessionProjectionRunEvent, n as getGatewaySessionMessageSubscriptionCoordinator, o as hasSessionProjectionAcceptedFinal, p as reduceSessionProjection, r as releaseGatewaySessionMessageSubscription, s as isLocallyOptimisticSessionMessage, t as GatewaySessionMessageSubscriptionCoordinator, u as readSessionMessageIdentity, v as GatewayBrowserDeviceAuthLifecycle, w as buildDeviceAuthPayloadV3, x as selectGatewayConnectAuth, y as buildGatewayConnectAuth } from "./session-subscriptions-D4Xv60cN.mjs";
+import { DEFAULT_GATEWAY_REQUEST_TIMEOUT_MS, DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS, resolveSafeTimeoutDelayMs } from "./timeouts.mjs";
 export * from "@openclaw/gateway-protocol/connect-error-details";
 export * from "@openclaw/gateway-protocol/client-info";
 export * from "@openclaw/gateway-protocol/gateway-error-details";
 export * from "@openclaw/gateway-protocol/startup-unavailable";
 export * from "@openclaw/gateway-protocol/version";
-export { DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS, GatewayBrowserDeviceAuthLifecycle, GatewayProtocolClient, GatewayProtocolRequestError, GatewaySessionMessageSubscriptionCoordinator, buildDeviceAuthPayload, buildDeviceAuthPayloadV3, buildGatewayConnectAuth, createSessionProjection, getGatewaySessionMessageSubscriptionCoordinator, hasSessionProjectionAcceptedFinal, isLocallyOptimisticSessionMessage, normalizeDeviceMetadataForAuth, normalizeSessionProjectionRunId, projectLiveSessionMessage, readSessionMessageIdentity, readSessionMessageSequence, reconcileSessionProjectionSnapshot, reduceSessionProjection, reduceSessionProjectionRunEvent, releaseGatewaySessionMessageSubscription, resetGatewaySessionMessageSubscriptionCoordinator, resolveGatewayConnectScopes, resolveSafeTimeoutDelayMs, selectGatewayConnectAuth, shouldPauseGatewayReconnect, shouldRetryGatewayWithDeviceToken };
+export { DEFAULT_GATEWAY_REQUEST_TIMEOUT_MS, DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS, GatewayBrowserDeviceAuthLifecycle, GatewayProtocolClient, GatewayProtocolRequestError, GatewaySessionMessageSubscriptionCoordinator, buildDeviceAuthPayload, buildDeviceAuthPayloadV3, buildGatewayConnectAuth, createSessionProjection, getGatewaySessionMessageSubscriptionCoordinator, hasSessionProjectionAcceptedFinal, isLocallyOptimisticSessionMessage, normalizeDeviceMetadataForAuth, normalizeSessionProjectionRunId, projectLiveSessionMessage, readSessionMessageIdentity, readSessionMessageSequence, reconcileSessionProjectionSnapshot, reduceSessionProjection, reduceSessionProjectionRunEvent, releaseGatewaySessionMessageSubscription, resetGatewaySessionMessageSubscriptionCoordinator, resolveGatewayConnectScopes, resolveSafeTimeoutDelayMs, selectGatewayConnectAuth, shouldPauseGatewayReconnect, shouldRetryGatewayWithDeviceToken };

package/dist/index.d.mts

@@ -1,4 +1,4 @@
-import { A as GatewayBrowserDeviceAuthLifecycle, B as buildDeviceAuthPayload, C as normalizeSessionProjectionRunId, D as reconcileSessionProjectionSnapshot, E as readSessionMessageSequence, F as GatewayConnectAuthSelection, H as normalizeDeviceMetadataForAuth, I as buildGatewayConnectAuth, L as resolveGatewayConnectScopes, M as GatewayBrowserDeviceIdentity, N as GatewayBrowserDeviceTokenRecord, O as reduceSessionProjection, P as GatewayBrowserDeviceTokenStore, R as selectGatewayConnectAuth, S as isLocallyOptimisticSessionMessage, T as readSessionMessageIdentity, V as buildDeviceAuthPayloadV3, _ as SessionProjectionScope, a as GatewaySessionMessageSubscriptionOptions, b as createSessionProjection, c as resetGatewaySessionMessageSubscriptionCoordinator, d as SessionProjectionEntry, f as SessionProjectionEvent, g as SessionProjectionRunTransition, h as SessionProjectionRunStatus, i as GatewaySessionMessageSubscriptionCoordinatorOptions, j as GatewayBrowserDeviceAuthPlan, k as reduceSessionProjectionRunEvent, l as SessionMessageEnvelope, m as SessionProjectionRun, n as GatewaySessionMessageSubscription, o as getGatewaySessionMessageSubscriptionCoordinator, p as SessionProjectionGatewayRunEvent, r as GatewaySessionMessageSubscriptionCoordinator, s as releaseGatewaySessionMessageSubscription, t as GatewaySessionMessageRequestClient, u as SessionMessageIdentity, v as SessionProjectionSnapshotOptions, w as projectLiveSessionMessage, x as hasSessionProjectionAcceptedFinal, y as SessionProjectionState, z as shouldRetryGatewayWithDeviceToken } from "./session-subscriptions-DrhzqL6v.mjs";
+import { A as GatewayBrowserDeviceAuthLifecycle, B as buildDeviceAuthPayload, C as normalizeSessionProjectionRunId, D as reconcileSessionProjectionSnapshot, E as readSessionMessageSequence, F as GatewayConnectAuthSelection, H as normalizeDeviceMetadataForAuth, I as buildGatewayConnectAuth, L as resolveGatewayConnectScopes, M as GatewayBrowserDeviceIdentity, N as GatewayBrowserDeviceTokenRecord, O as reduceSessionProjection, P as GatewayBrowserDeviceTokenStore, R as selectGatewayConnectAuth, S as isLocallyOptimisticSessionMessage, T as readSessionMessageIdentity, V as buildDeviceAuthPayloadV3, _ as SessionProjectionScope, a as GatewaySessionMessageSubscriptionOptions, b as createSessionProjection, c as resetGatewaySessionMessageSubscriptionCoordinator, d as SessionProjectionEntry, f as SessionProjectionEvent, g as SessionProjectionRunTransition, h as SessionProjectionRunStatus, i as GatewaySessionMessageSubscriptionCoordinatorOptions, j as GatewayBrowserDeviceAuthPlan, k as reduceSessionProjectionRunEvent, l as SessionMessageEnvelope, m as SessionProjectionRun, n as GatewaySessionMessageSubscription, o as getGatewaySessionMessageSubscriptionCoordinator, p as SessionProjectionGatewayRunEvent, r as GatewaySessionMessageSubscriptionCoordinator, s as releaseGatewaySessionMessageSubscription, t as GatewaySessionMessageRequestClient, u as SessionMessageIdentity, v as SessionProjectionSnapshotOptions, w as projectLiveSessionMessage, x as hasSessionProjectionAcceptedFinal, y as SessionProjectionState, z as shouldRetryGatewayWithDeviceToken } from "./session-subscriptions-Das1PATe.mjs";
 import { DEFAULT_GATEWAY_REQUEST_TIMEOUT_MS, DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS, MAX_CONNECT_CHALLENGE_TIMEOUT_MS, MAX_SAFE_TIMEOUT_DELAY_MS, MIN_CONNECT_CHALLENGE_TIMEOUT_MS, addSafeTimeoutDelayGraceMs, clampConnectChallengeTimeoutMs, clearGatewayConnectTimeout, getConnectChallengeTimeoutMsFromEnv, resolveConnectChallengeTimeoutMs, resolveFiniteTimeoutDelayMs, resolvePreauthHandshakeTimeoutMs, resolveSafeTimeoutDelayMs, startGatewayConnectTimeout } from "./timeouts.mjs";
-import { _ as GatewayClientRequestOptions, a as startGatewayClientWithReadinessWait, c as waitForEventLoopReady, d as GatewayClient, f as GatewayClientCloseInfo, g as GatewayClientRequestError, h as GatewayClientOptions, i as startGatewayClientWhenEventLoopReady, l as DeviceAuthTokenRecord, m as GatewayClientHostDeps, n as GatewayClientStartReadinessOptions, o as EventLoopReadyOptions, p as GatewayClientConnectionMetadata, r as GatewayClientStartable, s as EventLoopReadyResult, t as EventLoopReadyWaiter, u as DeviceIdentity, v as GatewayReconnectPausedInfo, y as isGatewayConnectAssemblyError } from "./readiness-BJT_oUZE.mjs";
-export { DEFAULT_GATEWAY_REQUEST_TIMEOUT_MS, DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS, DeviceAuthTokenRecord, DeviceIdentity, EventLoopReadyOptions, EventLoopReadyResult, EventLoopReadyWaiter, GatewayBrowserDeviceAuthLifecycle, GatewayBrowserDeviceAuthPlan, GatewayBrowserDeviceIdentity, GatewayBrowserDeviceTokenRecord, GatewayBrowserDeviceTokenStore, GatewayClient, GatewayClientCloseInfo, GatewayClientConnectionMetadata, GatewayClientHostDeps, GatewayClientOptions, GatewayClientRequestError, GatewayClientRequestOptions, GatewayClientStartReadinessOptions, GatewayClientStartable, GatewayConnectAuthSelection, GatewayReconnectPausedInfo, GatewaySessionMessageRequestClient, GatewaySessionMessageSubscription, GatewaySessionMessageSubscriptionCoordinator, GatewaySessionMessageSubscriptionCoordinatorOptions, GatewaySessionMessageSubscriptionOptions, MAX_CONNECT_CHALLENGE_TIMEOUT_MS, MAX_SAFE_TIMEOUT_DELAY_MS, MIN_CONNECT_CHALLENGE_TIMEOUT_MS, SessionMessageEnvelope, SessionMessageIdentity, SessionProjectionEntry, SessionProjectionEvent, SessionProjectionGatewayRunEvent, SessionProjectionRun, SessionProjectionRunStatus, SessionProjectionRunTransition, SessionProjectionScope, SessionProjectionSnapshotOptions, SessionProjectionState, addSafeTimeoutDelayGraceMs, buildDeviceAuthPayload, buildDeviceAuthPayloadV3, buildGatewayConnectAuth, clampConnectChallengeTimeoutMs, clearGatewayConnectTimeout, createSessionProjection, getConnectChallengeTimeoutMsFromEnv, getGatewaySessionMessageSubscriptionCoordinator, hasSessionProjectionAcceptedFinal, isGatewayConnectAssemblyError, isLocallyOptimisticSessionMessage, normalizeDeviceMetadataForAuth, normalizeSessionProjectionRunId, projectLiveSessionMessage, readSessionMessageIdentity, readSessionMessageSequence, reconcileSessionProjectionSnapshot, reduceSessionProjection, reduceSessionProjectionRunEvent, releaseGatewaySessionMessageSubscription, resetGatewaySessionMessageSubscriptionCoordinator, resolveConnectChallengeTimeoutMs, resolveFiniteTimeoutDelayMs, resolveGatewayConnectScopes, resolvePreauthHandshakeTimeoutMs, resolveSafeTimeoutDelayMs, selectGatewayConnectAuth, shouldRetryGatewayWithDeviceToken, startGatewayClientWhenEventLoopReady, startGatewayClientWithReadinessWait, startGatewayConnectTimeout, waitForEventLoopReady };
+import { _ as GatewayClientRequestOptions, a as startGatewayClientWithReadinessWait, b as isGatewayConnectAssemblyError, c as waitForEventLoopReady, d as GatewayClient, f as GatewayClientCloseInfo, g as GatewayClientRequestError, h as GatewayClientOptions, i as startGatewayClientWhenEventLoopReady, l as DeviceAuthTokenRecord, m as GatewayClientHostDeps, n as GatewayClientStartReadinessOptions, o as EventLoopReadyOptions, p as GatewayClientConnectionMetadata, r as GatewayClientStartable, s as EventLoopReadyResult, t as EventLoopReadyWaiter, u as DeviceIdentity, v as GatewayClientRequestTimeoutError, y as GatewayReconnectPausedInfo } from "./readiness-uSDrqxDM.mjs";
+export { DEFAULT_GATEWAY_REQUEST_TIMEOUT_MS, DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS, DeviceAuthTokenRecord, DeviceIdentity, EventLoopReadyOptions, EventLoopReadyResult, EventLoopReadyWaiter, GatewayBrowserDeviceAuthLifecycle, GatewayBrowserDeviceAuthPlan, GatewayBrowserDeviceIdentity, GatewayBrowserDeviceTokenRecord, GatewayBrowserDeviceTokenStore, GatewayClient, GatewayClientCloseInfo, GatewayClientConnectionMetadata, GatewayClientHostDeps, GatewayClientOptions, GatewayClientRequestError, GatewayClientRequestOptions, GatewayClientRequestTimeoutError, GatewayClientStartReadinessOptions, GatewayClientStartable, GatewayConnectAuthSelection, GatewayReconnectPausedInfo, GatewaySessionMessageRequestClient, GatewaySessionMessageSubscription, GatewaySessionMessageSubscriptionCoordinator, GatewaySessionMessageSubscriptionCoordinatorOptions, GatewaySessionMessageSubscriptionOptions, MAX_CONNECT_CHALLENGE_TIMEOUT_MS, MAX_SAFE_TIMEOUT_DELAY_MS, MIN_CONNECT_CHALLENGE_TIMEOUT_MS, SessionMessageEnvelope, SessionMessageIdentity, SessionProjectionEntry, SessionProjectionEvent, SessionProjectionGatewayRunEvent, SessionProjectionRun, SessionProjectionRunStatus, SessionProjectionRunTransition, SessionProjectionScope, SessionProjectionSnapshotOptions, SessionProjectionState, addSafeTimeoutDelayGraceMs, buildDeviceAuthPayload, buildDeviceAuthPayloadV3, buildGatewayConnectAuth, clampConnectChallengeTimeoutMs, clearGatewayConnectTimeout, createSessionProjection, getConnectChallengeTimeoutMsFromEnv, getGatewaySessionMessageSubscriptionCoordinator, hasSessionProjectionAcceptedFinal, isGatewayConnectAssemblyError, isLocallyOptimisticSessionMessage, normalizeDeviceMetadataForAuth, normalizeSessionProjectionRunId, projectLiveSessionMessage, readSessionMessageIdentity, readSessionMessageSequence, reconcileSessionProjectionSnapshot, reduceSessionProjection, reduceSessionProjectionRunEvent, releaseGatewaySessionMessageSubscription, resetGatewaySessionMessageSubscriptionCoordinator, resolveConnectChallengeTimeoutMs, resolveFiniteTimeoutDelayMs, resolveGatewayConnectScopes, resolvePreauthHandshakeTimeoutMs, resolveSafeTimeoutDelayMs, selectGatewayConnectAuth, shouldRetryGatewayWithDeviceToken, startGatewayClientWhenEventLoopReady, startGatewayClientWithReadinessWait, startGatewayConnectTimeout, waitForEventLoopReady };

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { C as buildDeviceAuthPayload, S as shouldRetryGatewayWithDeviceToken, T as normalizeDeviceMetadataForAuth, _ as GatewayProtocolRequestError, a as createSessionProjection, b as resolveGatewayConnectScopes, c as normalizeSessionProjectionRunId, d as readSessionMessageSequence, f as reconcileSessionProjectionSnapshot, g as GatewayProtocolClient, h as shouldPauseGatewayReconnect, i as resetGatewaySessionMessageSubscriptionCoordinator, l as projectLiveSessionMessage, m as reduceSessionProjectionRunEvent, n as getGatewaySessionMessageSubscriptionCoordinator, o as hasSessionProjectionAcceptedFinal, p as reduceSessionProjection, r as releaseGatewaySessionMessageSubscription, s as isLocallyOptimisticSessionMessage, t as GatewaySessionMessageSubscriptionCoordinator, u as readSessionMessageIdentity, v as GatewayBrowserDeviceAuthLifecycle, w as buildDeviceAuthPayloadV3, x as selectGatewayConnectAuth, y as buildGatewayConnectAuth } from "./session-subscriptions-BV7MxYiL.mjs";
+import { C as buildDeviceAuthPayload, S as shouldRetryGatewayWithDeviceToken, T as normalizeDeviceMetadataForAuth, _ as GatewayProtocolRequestError, a as createSessionProjection, b as resolveGatewayConnectScopes, c as normalizeSessionProjectionRunId, d as readSessionMessageSequence, f as reconcileSessionProjectionSnapshot, g as GatewayProtocolClient, h as shouldPauseGatewayReconnect, i as resetGatewaySessionMessageSubscriptionCoordinator, l as projectLiveSessionMessage, m as reduceSessionProjectionRunEvent, n as getGatewaySessionMessageSubscriptionCoordinator, o as hasSessionProjectionAcceptedFinal, p as reduceSessionProjection, r as releaseGatewaySessionMessageSubscription, s as isLocallyOptimisticSessionMessage, t as GatewaySessionMessageSubscriptionCoordinator, u as readSessionMessageIdentity, v as GatewayBrowserDeviceAuthLifecycle, w as buildDeviceAuthPayloadV3, x as selectGatewayConnectAuth, y as buildGatewayConnectAuth } from "./session-subscriptions-D4Xv60cN.mjs";
 import { DEFAULT_GATEWAY_REQUEST_TIMEOUT_MS, DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS, MAX_CONNECT_CHALLENGE_TIMEOUT_MS, MAX_SAFE_TIMEOUT_DELAY_MS, MIN_CONNECT_CHALLENGE_TIMEOUT_MS, addSafeTimeoutDelayGraceMs, clampConnectChallengeTimeoutMs, clearGatewayConnectTimeout, getConnectChallengeTimeoutMsFromEnv, resolveConnectChallengeTimeoutMs, resolveFiniteTimeoutDelayMs, resolvePreauthHandshakeTimeoutMs, resolveSafeTimeoutDelayMs, startGatewayConnectTimeout } from "./timeouts.mjs";
 import { n as startGatewayClientWithReadinessWait, r as waitForEventLoopReady, t as startGatewayClientWhenEventLoopReady } from "./readiness-CrWxd4TI.mjs";
 import { ConnectErrorDetailCodes, formatConnectErrorMessage, readConnectErrorDetailCode } from "@openclaw/gateway-protocol/connect-error-details";
@@ -1035,6 +1035,19 @@ function isLoopbackIpAddress(raw) {
 	return normalizeIpv4MappedAddress(parsed).range() === "loopback";
 }
 //#endregion
+//#region packages/net-policy/src/url-protocol.ts
+function parseUrl(value) {
+	if (value instanceof URL) return value;
+	try {
+		return new URL(value);
+	} catch {
+		return null;
+	}
+}
+function isWssUrl(value) {
+	return parseUrl(value)?.protocol === "wss:";
+}
+//#endregion
 //#region packages/gateway-client/src/client-address-utils.ts
 function normalizeLowercaseStringOrEmpty(value) {
 	return typeof value === "string" ? value.trim().toLowerCase() : "";
@@ -1155,6 +1168,15 @@ var GatewayClientRequestError = class extends GatewayProtocolRequestError {
 		this.name = "GatewayClientRequestError";
 	}
 };
+var GatewayClientRequestTimeoutError = class extends Error {
+	constructor(params) {
+		super(`gateway request timeout for ${params.method}`);
+		this.name = "GatewayClientRequestTimeoutError";
+		this.method = params.method;
+		this.timeoutMs = params.timeoutMs;
+		this.requestSent = params.requestSent;
+	}
+};
 var GatewayClientTransientPreHelloCloseError = class extends Error {
 	constructor() {
 		super("gateway transient pre-hello clean close");
@@ -1212,13 +1234,19 @@ var GatewayClient = class {
 			createSocket: (handlers) => this.createSocket(handlers),
 			createRequestId: randomUUID,
 			createRequestError: (error) => new GatewayClientRequestError(error),
-			createRequestTimeoutError: (method) => /* @__PURE__ */ new Error(`gateway request timeout for ${method}`),
+			createRequestTimeoutError: (method, timeoutMs, requestSent) => new GatewayClientRequestTimeoutError({
+				method,
+				timeoutMs,
+				requestSent
+			}),
 			createRequestAbortError: createGatewayRequestAbortError,
-			buildConnectPlan: ({ nonce }) => {
+			buildConnectPlan: ({ nonce, challengeTs }) => {
 				if (!nonce) throw new Error("gateway connect challenge missing nonce");
+				if (this.opts.deviceIdentity && challengeTs == null) throw new Error("gateway connect challenge timestamp invalid");
 				return this.assembleConnectParams({
 					role: this.opts.role ?? "operator",
-					nonce
+					nonce,
+					signedAtMs: challengeTs ?? Date.now()
 				});
 			},
 			buildConnectParams: (assembled) => assembled.params,
@@ -1292,7 +1320,8 @@ var GatewayClient = class {
 	}
 	createSocket(handlers) {
 		const url = this.opts.url ?? DEFAULT_GATEWAY_CLIENT_URL;
-		if (this.opts.tlsFingerprint && !url.startsWith("wss://")) throw new GatewayClientSocketFactoryConfigurationError("gateway tls fingerprint requires wss:// gateway url");
+		const usesTls = isWssUrl(url);
+		if (this.opts.tlsFingerprint && !usesTls) throw new GatewayClientSocketFactoryConfigurationError("gateway tls fingerprint requires wss:// gateway url");
 		const allowPrivateWs = (this.opts.env ?? process.env).OPENCLAW_ALLOW_INSECURE_PRIVATE_WS === "1";
 		if (!isSecureWebSocketUrl(url, { allowPrivateWs })) {
 			let displayHost = url;
@@ -1310,7 +1339,7 @@ var GatewayClient = class {
 			}),
 			...this.opts.origin ? { origin: this.opts.origin } : {}
 		};
-		if (url.startsWith("wss://") && this.opts.tlsFingerprint) {
+		if (usesTls && this.opts.tlsFingerprint) {
 			wsOptions.rejectUnauthorized = false;
 			wsOptions.checkServerIdentity = (_hostValue, cert) => {
 				const fingerprintValue = typeof cert === "object" && cert && "fingerprint256" in cert ? cert.fingerprint256 ?? "" : "";
@@ -1340,7 +1369,7 @@ var GatewayClient = class {
 		this.transportValidated = false;
 		ws.on("open", () => {
 			handlers.open();
-			if (url.startsWith("wss://") && this.opts.tlsFingerprint) {
+			if (usesTls && this.opts.tlsFingerprint) {
 				const tlsError = this.validateTlsFingerprint();
 				if (tlsError) {
 					handlers.error(tlsError);
@@ -1446,12 +1475,11 @@ var GatewayClient = class {
 		this.deps.logError(this.deps.redactForLog(message));
 	}
 	assembleConnectParams(params) {
-		const { role, nonce } = params;
+		const { role, nonce, signedAtMs } = params;
 		const selectedAuth = this.selectConnectAuth(role);
 		const { authDeviceToken, authApprovalRuntimeToken, authAgentRuntimeIdentityToken, signatureToken, resolvedDeviceToken, storedToken, storedScopes, usingStoredDeviceToken } = selectedAuth;
 		if (this.pendingDeviceTokenRetry && authDeviceToken) this.pendingDeviceTokenRetry = false;
 		const auth = buildGatewayConnectAuth(selectedAuth);
-		const signedAtMs = Date.now();
 		const scopes = resolveGatewayConnectScopes({
 			requestedScopes: this.opts.scopes,
 			usingStoredDeviceToken,
@@ -1780,4 +1808,4 @@ function createGatewayRequestAbortError(method) {
 	return err;
 }
 //#endregion
-export { DEFAULT_GATEWAY_REQUEST_TIMEOUT_MS, DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS, GatewayBrowserDeviceAuthLifecycle, GatewayClient, GatewayClientRequestError, GatewaySessionMessageSubscriptionCoordinator, MAX_CONNECT_CHALLENGE_TIMEOUT_MS, MAX_SAFE_TIMEOUT_DELAY_MS, MIN_CONNECT_CHALLENGE_TIMEOUT_MS, addSafeTimeoutDelayGraceMs, buildDeviceAuthPayload, buildDeviceAuthPayloadV3, buildGatewayConnectAuth, clampConnectChallengeTimeoutMs, clearGatewayConnectTimeout, createSessionProjection, getConnectChallengeTimeoutMsFromEnv, getGatewaySessionMessageSubscriptionCoordinator, hasSessionProjectionAcceptedFinal, isGatewayConnectAssemblyError, isLocallyOptimisticSessionMessage, normalizeDeviceMetadataForAuth, normalizeSessionProjectionRunId, projectLiveSessionMessage, readSessionMessageIdentity, readSessionMessageSequence, reconcileSessionProjectionSnapshot, reduceSessionProjection, reduceSessionProjectionRunEvent, releaseGatewaySessionMessageSubscription, resetGatewaySessionMessageSubscriptionCoordinator, resolveConnectChallengeTimeoutMs, resolveFiniteTimeoutDelayMs, resolveGatewayConnectScopes, resolvePreauthHandshakeTimeoutMs, resolveSafeTimeoutDelayMs, selectGatewayConnectAuth, shouldRetryGatewayWithDeviceToken, startGatewayClientWhenEventLoopReady, startGatewayClientWithReadinessWait, startGatewayConnectTimeout, waitForEventLoopReady };
+export { DEFAULT_GATEWAY_REQUEST_TIMEOUT_MS, DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS, GatewayBrowserDeviceAuthLifecycle, GatewayClient, GatewayClientRequestError, GatewayClientRequestTimeoutError, GatewaySessionMessageSubscriptionCoordinator, MAX_CONNECT_CHALLENGE_TIMEOUT_MS, MAX_SAFE_TIMEOUT_DELAY_MS, MIN_CONNECT_CHALLENGE_TIMEOUT_MS, addSafeTimeoutDelayGraceMs, buildDeviceAuthPayload, buildDeviceAuthPayloadV3, buildGatewayConnectAuth, clampConnectChallengeTimeoutMs, clearGatewayConnectTimeout, createSessionProjection, getConnectChallengeTimeoutMsFromEnv, getGatewaySessionMessageSubscriptionCoordinator, hasSessionProjectionAcceptedFinal, isGatewayConnectAssemblyError, isLocallyOptimisticSessionMessage, normalizeDeviceMetadataForAuth, normalizeSessionProjectionRunId, projectLiveSessionMessage, readSessionMessageIdentity, readSessionMessageSequence, reconcileSessionProjectionSnapshot, reduceSessionProjection, reduceSessionProjectionRunEvent, releaseGatewaySessionMessageSubscription, resetGatewaySessionMessageSubscriptionCoordinator, resolveConnectChallengeTimeoutMs, resolveFiniteTimeoutDelayMs, resolveGatewayConnectScopes, resolvePreauthHandshakeTimeoutMs, resolveSafeTimeoutDelayMs, selectGatewayConnectAuth, shouldRetryGatewayWithDeviceToken, startGatewayClientWhenEventLoopReady, startGatewayClientWithReadinessWait, startGatewayConnectTimeout, waitForEventLoopReady };

package/dist/{protocol-client-BfBHwA5H.d.mts → protocol-client-U142L0j3.d.mts}

@@ -1,5 +1,22 @@
 import { ErrorShape, EventFrame, HelloOk } from "@openclaw/gateway-protocol";
 
+//#region packages/gateway-client/src/protocol-request.d.ts
+type GatewayProtocolRequestOptions = {
+  timeoutMs?: number | null;
+  expectFinal?: boolean;
+  onSent?: () => void;
+  onAccepted?: (payload: unknown) => void;
+  signal?: AbortSignal;
+};
+declare class GatewayProtocolRequestError extends Error {
+  readonly code: string;
+  readonly gatewayCode: string;
+  readonly details?: unknown;
+  readonly retryable: boolean;
+  readonly retryAfterMs?: number;
+  constructor(error: Partial<ErrorShape>);
+}
+//#endregion
 //#region packages/gateway-client/src/protocol-client.d.ts
 type GatewayProtocolSocket = {
   isOpen: () => boolean;
@@ -12,16 +29,10 @@ type GatewayProtocolSocketHandlers = {
   close: (code: number, reason: string) => void;
   error: (error: Error) => void;
 };
-type GatewayProtocolRequestOptions = {
-  timeoutMs?: number | null;
-  expectFinal?: boolean;
-  onSent?: () => void;
-  onAccepted?: (payload: unknown) => void;
-  signal?: AbortSignal;
-};
 type GatewayProtocolConnectContext<TPlan> = {
   generation: number;
   nonce: string | null;
+  challengeTs: number | null | undefined;
   plan: TPlan;
 };
 type GatewayProtocolCloseContext = {
@@ -72,10 +83,11 @@ type GatewayProtocolClientOptions<TPlan> = {
   createSocket: (handlers: GatewayProtocolSocketHandlers) => GatewayProtocolSocket;
   createRequestId: () => string;
   createRequestError?: (error: Partial<ErrorShape>) => GatewayProtocolRequestError;
-  createRequestTimeoutError?: (method: string, timeoutMs: number) => Error;
+  createRequestTimeoutError?: (method: string, timeoutMs: number, requestSent: boolean) => Error;
   createRequestAbortError?: (method: string) => Error;
   buildConnectPlan: (params: {
     nonce: string | null;
+    challengeTs: number | null | undefined;
     generation: number;
   }) => TPlan | Promise<TPlan>;
   buildConnectParams: (plan: TPlan) => unknown;
@@ -116,14 +128,6 @@ type GatewayProtocolClientOptions<TPlan> = {
   shouldRetrySocketFactoryError?: (error: Error) => boolean;
   rethrowSocketFactoryError?: (error: Error) => boolean;
 };
-declare class GatewayProtocolRequestError extends Error {
-  readonly code: string;
-  readonly gatewayCode: string;
-  readonly details?: unknown;
-  readonly retryable: boolean;
-  readonly retryAfterMs?: number;
-  constructor(error: Partial<ErrorShape>);
-}
 /**
  * Browser-safe gateway wire client. Environment adapters own transport and auth
  * policy; this class owns the single socket/handshake/reconnect/frame state machine.
@@ -137,6 +141,7 @@ declare class GatewayProtocolClient<TPlan> {
   private generation;
   private lastSeq;
   private connectNonce;
+  private connectChallengeTs;
   private connectSent;
   private connectRequestSent;
   private handshakeTimer;
@@ -179,4 +184,4 @@ declare class GatewayProtocolClient<TPlan> {
   private invoke;
 }
 //#endregion
-export { GatewayProtocolRequestTiming as a, GatewayProtocolTiming as c, GatewayProtocolRequestOptions as i, GatewayProtocolCloseContext as n, GatewayProtocolSocket as o, GatewayProtocolRequestError as r, GatewayProtocolSocketHandlers as s, GatewayProtocolClient as t };
+export { GatewayProtocolSocketHandlers as a, GatewayProtocolRequestOptions as c, GatewayProtocolSocket as i, GatewayProtocolCloseContext as n, GatewayProtocolTiming as o, GatewayProtocolRequestTiming as r, GatewayProtocolRequestError as s, GatewayProtocolClient as t };

package/dist/{readiness-BJT_oUZE.d.mts → readiness-uSDrqxDM.d.mts}

@@ -1,4 +1,4 @@
-import { i as GatewayProtocolRequestOptions, r as GatewayProtocolRequestError } from "./protocol-client-BfBHwA5H.mjs";
+import { c as GatewayProtocolRequestOptions, s as GatewayProtocolRequestError } from "./protocol-client-U142L0j3.mjs";
 import { ErrorShape, EventFrame, HelloOk } from "@openclaw/gateway-protocol/frame-guards";
 import { GatewayClientMode, GatewayClientName } from "@openclaw/gateway-protocol/client-info";
 
@@ -55,6 +55,16 @@ type GatewayClientCloseInfo = {
 declare class GatewayClientRequestError extends GatewayProtocolRequestError {
   constructor(error: Partial<ErrorShape>);
 }
+declare class GatewayClientRequestTimeoutError extends Error {
+  readonly method: string;
+  readonly timeoutMs: number;
+  readonly requestSent: boolean;
+  constructor(params: {
+    method: string;
+    timeoutMs: number;
+    requestSent: boolean;
+  });
+}
 declare function isGatewayConnectAssemblyError(value: unknown): value is Error;
 type GatewayClientOptions = {
   url?: string;
@@ -198,4 +208,4 @@ declare function startGatewayClientWithReadinessWait(waitForReady: EventLoopRead
 /** Starts a gateway client after the default event-loop readiness probe succeeds. */
 declare function startGatewayClientWhenEventLoopReady(client: GatewayClientStartable, options?: GatewayClientStartReadinessOptions): Promise<EventLoopReadyResult>;
 //#endregion
-export { GatewayClientRequestOptions as _, startGatewayClientWithReadinessWait as a, waitForEventLoopReady as c, GatewayClient as d, GatewayClientCloseInfo as f, GatewayClientRequestError as g, GatewayClientOptions as h, startGatewayClientWhenEventLoopReady as i, DeviceAuthTokenRecord as l, GatewayClientHostDeps as m, GatewayClientStartReadinessOptions as n, EventLoopReadyOptions as o, GatewayClientConnectionMetadata as p, GatewayClientStartable as r, EventLoopReadyResult as s, EventLoopReadyWaiter as t, DeviceIdentity as u, GatewayReconnectPausedInfo as v, isGatewayConnectAssemblyError as y };
+export { GatewayClientRequestOptions as _, startGatewayClientWithReadinessWait as a, isGatewayConnectAssemblyError as b, waitForEventLoopReady as c, GatewayClient as d, GatewayClientCloseInfo as f, GatewayClientRequestError as g, GatewayClientOptions as h, startGatewayClientWhenEventLoopReady as i, DeviceAuthTokenRecord as l, GatewayClientHostDeps as m, GatewayClientStartReadinessOptions as n, EventLoopReadyOptions as o, GatewayClientConnectionMetadata as p, GatewayClientStartable as r, EventLoopReadyResult as s, EventLoopReadyWaiter as t, DeviceIdentity as u, GatewayClientRequestTimeoutError as v, GatewayReconnectPausedInfo as y };

package/dist/readiness.d.mts

@@ -1,2 +1,2 @@
-import { a as startGatewayClientWithReadinessWait, i as startGatewayClientWhenEventLoopReady, n as GatewayClientStartReadinessOptions, r as GatewayClientStartable, t as EventLoopReadyWaiter } from "./readiness-BJT_oUZE.mjs";
+import { a as startGatewayClientWithReadinessWait, i as startGatewayClientWhenEventLoopReady, n as GatewayClientStartReadinessOptions, r as GatewayClientStartable, t as EventLoopReadyWaiter } from "./readiness-uSDrqxDM.mjs";
 export { EventLoopReadyWaiter, GatewayClientStartReadinessOptions, GatewayClientStartable, startGatewayClientWhenEventLoopReady, startGatewayClientWithReadinessWait };

package/dist/{session-subscriptions-BV7MxYiL.mjs → session-subscriptions-D4Xv60cN.mjs}

@@ -139,7 +139,8 @@ var GatewayBrowserDeviceAuthLifecycle = class {
 			scopes,
 			auth: buildGatewayConnectAuth(selectedAuth)
 		};
-		const signedAtMs = this.deps.nowMs?.() ?? Date.now();
+		const signedAtMs = params.challengeTs === void 0 ? this.deps.nowMs?.() ?? Date.now() : params.challengeTs;
+		if (typeof signedAtMs !== "number" || !Number.isSafeInteger(signedAtMs) || signedAtMs < 0) throw new Error("gateway connect challenge timestamp invalid");
 		const nonce = params.nonce ?? "";
 		const { authBootstrapToken: primary, signatureToken: signed } = selectedAuth;
 		let token = null;
@@ -403,7 +404,7 @@ var GatewayEventListeners = class {
 	}
 };
 //#endregion
-//#region packages/gateway-client/src/protocol-client.ts
+//#region packages/gateway-client/src/protocol-request.ts
 var GatewayProtocolRequestError = class extends Error {
 	constructor(error) {
 		super(error.message ?? "request failed");
@@ -415,6 +416,8 @@ var GatewayProtocolRequestError = class extends Error {
 		this.retryAfterMs = error.retryAfterMs;
 	}
 };
+//#endregion
+//#region packages/gateway-client/src/protocol-client.ts
 /**
 * Browser-safe gateway wire client. Environment adapters own transport and auth
 * policy; this class owns the single socket/handshake/reconnect/frame state machine.
@@ -485,6 +488,7 @@ var GatewayProtocolClient = class {
 		const timeoutMs = options?.timeoutMs === null ? void 0 : options?.timeoutMs ?? this.opts.requestTimeoutMs;
 		return new Promise((resolve, reject) => {
 			let timeout;
+			let requestSent = false;
 			const pending = {
 				resolve: (value) => resolve(value),
 				reject,
@@ -497,7 +501,7 @@ var GatewayProtocolClient = class {
 			};
 			const onAbort = () => {
 				this.pending.delete(id);
-				if (timeout) clearTimeout(timeout);
+				pending.cleanup?.();
 				this.finishRequestTiming(id, pending, false, "CLIENT_ABORTED");
 				reject(this.opts.createRequestAbortError?.(method) ?? /* @__PURE__ */ new Error(`gateway request aborted for ${method}`));
 			};
@@ -512,10 +516,11 @@ var GatewayProtocolClient = class {
 			pending.cleanup = cleanup;
 			if (timeoutMs !== void 0 && timeoutMs >= 0) {
 				timeout = setTimeout(() => {
+					if (this.pending.get(id) !== pending) return;
 					this.pending.delete(id);
 					options?.signal?.removeEventListener("abort", onAbort);
 					this.finishRequestTiming(id, pending, false, "CLIENT_TIMEOUT");
-					reject(this.opts.createRequestTimeoutError?.(method, timeoutMs) ?? /* @__PURE__ */ new Error(`gateway request timed out after ${timeoutMs}ms: ${method}`));
+					reject(this.opts.createRequestTimeoutError?.(method, timeoutMs, requestSent) ?? /* @__PURE__ */ new Error(`gateway request timed out after ${timeoutMs}ms: ${method}`));
 				}, timeoutMs);
 				timeout.unref?.();
 			}
@@ -528,6 +533,7 @@ var GatewayProtocolClient = class {
 					method,
 					params
 				}));
+				requestSent = true;
 				this.invoke("sent", () => options?.onSent?.());
 			} catch (error) {
 				this.pending.delete(id);
@@ -571,6 +577,7 @@ var GatewayProtocolClient = class {
 		const generation = this.generation + 1;
 		this.lastSeq = null;
 		this.connectNonce = null;
+		this.connectChallengeTs = void 0;
 		this.connectSent = this.connectRequestSent = false;
 		this.socketOpened = false;
 		this.helloReceived = false;
@@ -641,6 +648,7 @@ var GatewayProtocolClient = class {
 		try {
 			planOrPromise = this.opts.buildConnectPlan({
 				nonce: this.connectNonce,
+				challengeTs: this.connectChallengeTs,
 				generation
 			});
 		} catch (error) {
@@ -669,6 +677,7 @@ var GatewayProtocolClient = class {
 		const context = {
 			generation,
 			nonce: this.connectNonce,
+			challengeTs: this.connectChallengeTs,
 			plan
 		};
 		this.recordTiming("connect-plan-ready", generation, plan);
@@ -721,6 +730,8 @@ var GatewayProtocolClient = class {
 					return;
 				}
 				this.connectNonce = nonce;
+				const challengeTs = payload?.ts;
+				this.connectChallengeTs = typeof challengeTs === "number" && Number.isSafeInteger(challengeTs) && challengeTs >= 0 ? challengeTs : null;
 				this.recordTiming("challenge", generation);
 				this.sendConnect(socket, generation);
 				return;

package/dist/{session-subscriptions-DrhzqL6v.d.mts → session-subscriptions-Das1PATe.d.mts}

@@ -122,6 +122,7 @@ declare class GatewayBrowserDeviceAuthLifecycle {
     trustedDeviceTokenRetry?: boolean;
     preferBootstrapToken?: boolean;
     nonce: string | null;
+    challengeTs?: number | null;
   }): Promise<GatewayBrowserDeviceAuthPlan>;
   acceptHello(hello: Pick<HelloOk, "auth">, plan: GatewayBrowserDeviceAuthPlan): Promise<void>;
   clearStoredToken(plan: GatewayBrowserDeviceAuthPlan): Promise<void>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/gateway-client",
-  "version": "2026.7.2-beta.6",
+  "version": "2026.8.1-beta.1",
   "description": "Reference WebSocket client for the OpenClaw Gateway protocol",
   "keywords": [
     "client",
@@ -54,7 +54,7 @@
   "dependencies": {
     "ipaddr.js": "2.4.0",
     "ws": "8.21.1",
-    "@openclaw/gateway-protocol": "2026.7.2-beta.6"
+    "@openclaw/gateway-protocol": "2026.8.1-beta.1"
   },
   "engines": {
     "node": ">=22.19.0"