gestalt-mobile 0.10.0 → 0.12.0

package/dist/server/server/composition.js

@@ -3,7 +3,7 @@
  * Designed by Denis Roio <jaromil@dyne.org>
  * SPDX-License-Identifier: AGPL-3.0-or-later
  */
-import { randomUUID } from 'node:crypto';
+import { randomBytes, randomUUID } from 'node:crypto';
 import { existsSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { basename, dirname, join, resolve } from 'node:path';
@@ -17,6 +17,9 @@ import { CodexSessionRuntime } from './platform/codex/session-runtime.js';
 import { normalizeCodexNotification } from './platform/codex/normalizer.js';
 import { migrate } from './platform/persistence/migrate.js';
 import { openRelayDatabase } from './platform/persistence/sqlite.js';
+import { SqliteAuthorizationStore } from './platform/auth/sqlite-authorization-store.js';
+import { SimpleWebAuthnAdapter } from './platform/auth/simple-webauthn-adapter.js';
+import { authorizationSessionId, authorizedDeviceId } from './features/auth/domain/identifiers.js';
 import { SqliteSessionRepository } from './platform/persistence/sqlite-session-repository.js';
 import { SqliteEventJournal } from './platform/persistence/sqlite-event-journal.js';
 import { SqlitePendingInteractionStore } from './platform/persistence/sqlite-pending-interaction-store.js';
@@ -37,23 +40,43 @@ import { CodexSkillCatalog } from './platform/skills/codex-skill-catalog.js';
 import { CachedSkillCatalog } from './platform/skills/cached-skill-catalog.js';
 import { compileSkillOverride } from './features/skills/model/skill-profile.js';
 import { SupervisedPlanRegistry } from './features/plans/application/supervised-plan-registry.js';
+import { NativePlanAlignmentRegistry } from './features/plans/application/native-plan-alignment.js';
 import { FilesystemPlanStatusSource } from './platform/plans/filesystem-plan-status-source.js';
+import { FilesystemWorkspacePlanCatalog } from './platform/plans/filesystem-workspace-plan-catalog.js';
 import { checkpointPlanMeasurement } from './platform/plans/plan-measurement-command.js';
 import { PlanMeasurementRefresh } from './platform/plans/plan-measurement-refresh.js';
+import { createRelyingPartyConfig, } from './config.js';
 const generatedProtocolVersion = 'codex-cli 0.144.3';
 export async function composeRelayApp(options) {
+    const passkeyAuthEnabled = options.passkeyAuthEnabled ?? true;
+    const relyingParty = createRelyingPartyConfig(options.relyingParty.publicOrigin);
+    if (relyingParty.rpId !== options.relyingParty.rpId ||
+        relyingParty.rpName !== options.relyingParty.rpName)
+        throw new Error('Invalid WebAuthn relying-party configuration');
+    const authorizationRandom = options.authorizationRandomBytes ?? randomBytes;
+    const ownerHandle = passkeyAuthEnabled ? authorizationRandom(32) : undefined;
+    if (ownerHandle && ownerHandle.length !== 32)
+        throw new Error('Authorization randomness must return exactly 32 bytes');
     const root = resolve(options.root);
     const databasePath = options.dataDir
         ? join(resolve(options.dataDir), 'relay.sqlite')
         : resolveStateDatabasePath(root, process.env.XDG_STATE_HOME ?? join(homedir(), '.local', 'state'));
     const database = openRelayDatabase(databasePath);
-    migrate(database);
+    try {
+        migrate(database);
+    }
+    catch (error) {
+        database.close();
+        throw error;
+    }
     const sessions = new SqliteSessionRepository(database);
     const journal = new SqliteEventJournal(database);
     const interactions = new SqlitePendingInteractionStore(database);
     const idempotency = new SqliteIdempotencyStore(database);
     const supervisedPlans = new SupervisedPlanRegistry();
+    const nativePlanAlignment = new NativePlanAlignmentRegistry();
     const planStatusSource = new FilesystemPlanStatusSource(join(dirname(databasePath), 'plans'));
+    const workspacePlanCatalog = new FilesystemWorkspacePlanCatalog();
     const planMeasurementHelperPath = options.planMeasurementHelperPath ?? process.env.GESTALT_MOBILE_ORG_PLAN_HELPER;
     const withPendingInteractions = (session) => (session ? { ...session, pendingInteractions: interactions.list(session.id) } : null);
     const events = new SessionEventBus();
@@ -91,6 +114,8 @@ export async function composeRelayApp(options) {
     const runtime = options.startAppServers
         ? new CodexSessionRuntime(options.launchAppServer ?? launchCodexAppServer, undefined, (sessionId, notification) => {
             const occurredAt = new Date().toISOString();
+            if (notification.method === 'turn/plan/updated')
+                nativePlanAlignment.observe(sessionId, sessions.find(sessionId)?.threadId ?? null, notification.params);
             const normalized = normalizeCodexNotification(sessionId, 0, occurredAt, notification, sessions.find(sessionId)?.workspacePath);
             if (!normalized)
                 return;
@@ -116,6 +141,8 @@ export async function composeRelayApp(options) {
             supervisedPlans.accept(sessionId, update);
             planMeasurementRefresh?.accept(sessionId, update);
             if (update.kind === 'updated') {
+                nativePlanAlignment.replace(sessionId, update.plan);
+                void runtime?.syncThreadPlanName(sessionId, update.plan);
                 const occurredAt = new Date().toISOString();
                 const session = sessions.find(sessionId);
                 if (session) {
@@ -158,164 +185,207 @@ export async function composeRelayApp(options) {
         });
         recoverExitedSession = (sessionId) => supervisor.recover(sessionId);
     }
-    const app = await buildApp({
-        health: {
-            async read() {
-                return {
-                    status: protocol.compatible ? 'ok' : 'degraded',
-                    version: '0.1.0',
-                    codex: {
-                        installedVersion: options.installedCodexVersion,
-                        protocolVersion: generatedProtocolVersion,
-                        compatible: protocol.compatible,
+    let authorization;
+    if (passkeyAuthEnabled) {
+        try {
+            authorization = new SqliteAuthorizationStore(options.homeDirectory ?? homedir(), relyingParty);
+            authorization.initializeOwner(ownerHandle);
+        }
+        catch (error) {
+            database.close();
+            throw error;
+        }
+    }
+    let app;
+    try {
+        app = await buildApp({
+            ...(authorization ? { auth: {
+                    repository: authorization,
+                    clock: { now: options.authorizationClock ?? (() => new Date()) },
+                    random: {
+                        bytes: (length) => {
+                            const value = authorizationRandom(length);
+                            if (length !== 32 || value.length !== 32)
+                                throw new Error('Authorization randomness must return exactly 32 bytes');
+                            return value;
+                        },
                     },
-                };
-            },
-        },
-        skills: {
-            workspaces,
-            profiles: options.profiles,
-            catalog: editorSkillCatalog,
-            selections: skillProfiles,
-            listGlobalProfileNames: () => skillProfiles.listGlobalProfileNames(),
-            readGlobalProfile: (name) => skillProfiles.readGlobalProfile(name),
-            replaceGlobalProfile: (profile) => skillProfiles.replaceGlobalProfile(profile),
-            deleteGlobalProfile: (name) => skillProfiles.deleteGlobalProfile(name),
-            profilePath: (name) => skillProfiles.globalProfilePath(name),
-        },
-        logger: console,
-        staticDir: options.staticDir,
-        recentThreads,
-        bootstrap: {
-            workspaces,
-            profiles: options.profiles,
-            models,
-            sessions: {
-                list: () => sessions.list().map((session) => withPendingInteractions(session)),
-            },
-            protocolCompatible: protocol.compatible,
-        },
-        sessionRoutes: {
-            createId: randomUUID,
-            now: () => new Date().toISOString(),
-            save: saveSession,
-            find: (id) => withPendingInteractions(sessions.find(id)),
-            list: () => sessions.list().map((session) => withPendingInteractions(session)),
-            workspaces,
-            profiles: options.profiles,
-            skillProfiles,
-            skillCatalog,
-            defaultSkillProfile: options.explicitSkillProfile,
-            activate: runtime
-                ? async (session, settings) => runtime.start(session, new Date().toISOString(), settings)
-                : undefined,
-            startTurn: runtime
-                ? async (session, text) => runtime.startTurn(session, text, new Date().toISOString())
-                : undefined,
-            onTurnStarted: (session) => planMeasurementRefresh?.refreshNow(session.id),
-            models,
-            readHistory: runtime ? (session) => runtime.readHistory(session) : undefined,
-            currentSequence: (sessionId) => journal.since(sessionId, 0).at(-1)?.sequence ?? 0,
-            interruptTurn: runtime
-                ? (session, turnId) => runtime.interruptTurn(session, turnId)
-                : undefined,
-            restore: runtime
-                ? (session) => runtime.restoreWithOutcome(session, new Date().toISOString())
-                : undefined,
-            promoteRecent: runtime
-                ? (thread) => promoteRecentThread(thread, {
-                    createId: randomUUID,
-                    now: () => new Date().toISOString(),
-                    list: () => sessions.list(),
-                    save: saveSession,
-                    restore: (session) => runtime.restore(session, new Date().toISOString()),
-                })
-                : undefined,
-            release: (session) => RelaySession.rehydrate(session).release(new Date().toISOString()).snapshot,
-            remove: (id) => sessions.remove(id),
-            idempotency,
-            close: runtime
-                ? (id) => {
-                    planMeasurementRefresh?.stop(id);
-                    return runtime.release(id);
-                }
-                : undefined,
-            replyInteraction: runtime
-                ? (sessionId, requestId, value) => runtime.resolveServerRequest(sessionId, requestId, value)
-                : undefined,
-            interactionResolved: (sessionId, requestId, occurredAt) => {
-                events.publish(journal.append(sessionId, 'interaction.resolved', { requestId }, occurredAt));
+                    identifiers: {
+                        sessionId: () => {
+                            const value = authorizationRandom(32);
+                            if (value.length !== 32)
+                                throw new Error('Authorization randomness must return exactly 32 bytes');
+                            return authorizationSessionId(Buffer.from(value).toString('base64url'));
+                        },
+                        deviceId: () => authorizedDeviceId(randomUUID()),
+                    },
+                    webauthn: options.authorizationWebauthn ?? new SimpleWebAuthnAdapter(),
+                    relyingParty,
+                } } : { passkeyAuthDisabled: true }),
+            health: {
+                async read() {
+                    return {
+                        status: protocol.compatible ? 'ok' : 'degraded',
+                        version: '0.1.0',
+                        codex: {
+                            installedVersion: options.installedCodexVersion,
+                            protocolVersion: generatedProtocolVersion,
+                            compatible: protocol.compatible,
+                        },
+                    };
+                },
             },
-        },
-        sessionEvents: {
-            exists: (id) => sessions.find(id) !== null,
-            since: (id, after) => journal.since(id, after),
-            subscribe: (id, listener) => events.subscribe(id, listener),
-        },
-        planRoutes: {
-            exists: (id) => sessions.find(id) !== null,
-            find: (id) => supervisedPlans.find(id),
-            removeStatus: (id) => planStatusSource.remove(id, supervisedPlans.identity(id) ?? undefined),
-            clear: (id) => supervisedPlans.clear(id),
-            closed: (id) => {
-                planMeasurementRefresh?.stop(id);
-                const occurredAt = new Date().toISOString();
-                events.publish(journal.append(id, 'plan.closed', {}, occurredAt));
+            skills: {
+                workspaces,
+                profiles: options.profiles,
+                catalog: editorSkillCatalog,
+                selections: skillProfiles,
+                listGlobalProfileNames: () => skillProfiles.listGlobalProfileNames(),
+                readGlobalProfile: (name) => skillProfiles.readGlobalProfile(name),
+                replaceGlobalProfile: (profile) => skillProfiles.replaceGlobalProfile(profile),
+                deleteGlobalProfile: (name) => skillProfiles.deleteGlobalProfile(name),
+                profilePath: (name) => skillProfiles.globalProfilePath(name),
             },
-        },
-        ...(runtime
-            ? {
-                planMeasurementRoutes: {
-                    exists: (id) => sessions.find(id) !== null,
-                    authorize: (id, authorization) => runtime.authorizePlanMeasurement(id, authorization),
-                    read: async (id) => {
-                        const session = sessions.find(id);
-                        if (!session)
-                            throw new Error('CODEX_SESSION_NOT_RUNNING');
-                        return runtime.readPlanMeasurement(session);
-                    },
+            logger: console,
+            staticDir: options.staticDir,
+            recentThreads,
+            bootstrap: {
+                workspaces,
+                profiles: options.profiles,
+                models,
+                sessions: {
+                    list: () => sessions.list().map((session) => withPendingInteractions(session)),
                 },
-            }
-            : {}),
-        interactions: {
-            resolve: (sessionId, requestId, resolvedAt) => interactions.resolve(sessionId, requestId, resolvedAt),
-            validate: (sessionId, requestId, value) => {
-                const interaction = interactions.find(sessionId, requestId);
-                if (!interaction)
-                    return false;
-                if (interaction.kind === 'quiz')
-                    return isValidQuizInteractionResponse(interaction.payload, value);
-                return isValidInteractionResponse(interaction.kind, value);
+                protocolCompatible: protocol.compatible,
             },
-        },
-        gitSummary: {
-            workspaces,
-            inspect: async (path) => {
-                const summary = await gitSummaries.inspect(path);
-                const fetchedAt = gitFetches.lastSuccessfulAt(path);
-                return { ...summary, fetchedAt: fetchedAt ? new Date(fetchedAt).toISOString() : null };
+            sessionRoutes: {
+                createId: randomUUID,
+                now: () => new Date().toISOString(),
+                save: saveSession,
+                find: (id) => withPendingInteractions(sessions.find(id)),
+                list: () => sessions.list().map((session) => withPendingInteractions(session)),
+                workspaces,
+                profiles: options.profiles,
+                skillProfiles,
+                skillCatalog,
+                defaultSkillProfile: options.explicitSkillProfile,
+                activate: runtime
+                    ? async (session, settings) => runtime.start(session, new Date().toISOString(), settings)
+                    : undefined,
+                startTurn: runtime
+                    ? async (session, text) => runtime.startTurn(session, text, new Date().toISOString())
+                    : undefined,
+                onTurnStarted: (session) => planMeasurementRefresh?.refreshNow(session.id),
+                models,
+                readHistory: runtime ? (session) => runtime.readHistory(session) : undefined,
+                currentSequence: (sessionId) => journal.since(sessionId, 0).at(-1)?.sequence ?? 0,
+                interruptTurn: runtime
+                    ? (session, turnId) => runtime.interruptTurn(session, turnId)
+                    : undefined,
+                restore: runtime
+                    ? (session) => runtime.restoreWithOutcome(session, new Date().toISOString())
+                    : undefined,
+                promoteRecent: runtime
+                    ? (thread) => promoteRecentThread(thread, {
+                        createId: randomUUID,
+                        now: () => new Date().toISOString(),
+                        list: () => sessions.list(),
+                        save: saveSession,
+                        restore: (session) => runtime.restore(session, new Date().toISOString()),
+                    })
+                    : undefined,
+                release: (session) => RelaySession.rehydrate(session).release(new Date().toISOString()).snapshot,
+                remove: (id) => sessions.remove(id),
+                idempotency,
+                close: runtime
+                    ? (id) => {
+                        planMeasurementRefresh?.stop(id);
+                        return runtime.release(id);
+                    }
+                    : undefined,
+                replyInteraction: runtime
+                    ? (sessionId, requestId, value) => runtime.resolveServerRequest(sessionId, requestId, value)
+                    : undefined,
+                interactionResolved: (sessionId, requestId, occurredAt) => {
+                    events.publish(journal.append(sessionId, 'interaction.resolved', { requestId }, occurredAt));
+                },
             },
-            inspectForPush: inspectGit,
-            push: async (path, upstream) => {
-                await pushUpstream(path, upstream);
-                gitSummaries.invalidate(path);
+            sessionEvents: {
+                exists: (id) => sessions.find(id) !== null,
+                since: (id, after) => journal.since(id, after),
+                subscribe: (id, listener) => events.subscribe(id, listener),
             },
-            refresh: async (path) => {
-                await gitFetches.refresh(path);
-                gitSummaries.invalidate(path);
+            planRoutes: {
+                exists: (id) => sessions.find(id) !== null,
+                find: (id) => supervisedPlans.find(id),
+                removeStatus: (id) => planStatusSource.remove(id, supervisedPlans.identity(id) ?? undefined),
+                clear: (id) => supervisedPlans.clear(id),
+                closed: (id) => {
+                    planMeasurementRefresh?.stop(id);
+                    const occurredAt = new Date().toISOString();
+                    events.publish(journal.append(id, 'plan.closed', {}, occurredAt));
+                },
             },
-            pull: async (path) => {
-                await pullRebase(path);
-                gitSummaries.invalidate(path);
+            workspacePlanRoutes: { workspaces, plans: workspacePlanCatalog },
+            ...(runtime
+                ? {
+                    planMeasurementRoutes: {
+                        exists: (id) => sessions.find(id) !== null,
+                        authorize: (id, authorization) => runtime.authorizePlanMeasurement(id, authorization),
+                        read: async (id) => {
+                            const session = sessions.find(id);
+                            if (!session)
+                                throw new Error('CODEX_SESSION_NOT_RUNNING');
+                            return runtime.readPlanMeasurement(session);
+                        },
+                    },
+                }
+                : {}),
+            interactions: {
+                resolve: (sessionId, requestId, resolvedAt) => interactions.resolve(sessionId, requestId, resolvedAt),
+                validate: (sessionId, requestId, value) => {
+                    const interaction = interactions.find(sessionId, requestId);
+                    if (!interaction)
+                        return false;
+                    if (interaction.kind === 'quiz')
+                        return isValidQuizInteractionResponse(interaction.payload, value);
+                    return isValidInteractionResponse(interaction.kind, value);
+                },
             },
-            checkout: async (path, branch) => {
-                await checkoutBranch(path, branch);
-                gitSummaries.invalidate(path);
+            gitSummary: {
+                workspaces,
+                inspect: async (path) => {
+                    const summary = await gitSummaries.inspect(path);
+                    const fetchedAt = gitFetches.lastSuccessfulAt(path);
+                    return { ...summary, fetchedAt: fetchedAt ? new Date(fetchedAt).toISOString() : null };
+                },
+                inspectForPush: inspectGit,
+                push: async (path, upstream) => {
+                    await pushUpstream(path, upstream);
+                    gitSummaries.invalidate(path);
+                },
+                refresh: async (path) => {
+                    await gitFetches.refresh(path);
+                    gitSummaries.invalidate(path);
+                },
+                pull: async (path) => {
+                    await pullRebase(path);
+                    gitSummaries.invalidate(path);
+                },
+                checkout: async (path, branch) => {
+                    await checkoutBranch(path, branch);
+                    gitSummaries.invalidate(path);
+                },
+                clone: cloneRepository,
+                idempotency,
             },
-            clone: cloneRepository,
-            idempotency,
-        },
-    });
+        });
+    }
+    catch (error) {
+        authorization?.close();
+        database.close();
+        throw error;
+    }
     const restoreActiveSessions = async () => {
         if (!runtime)
             return;
@@ -341,6 +411,7 @@ export async function composeRelayApp(options) {
         runtime?.stopAll();
         planStatusSource.closeAll();
         database.close();
+        authorization?.close();
     });
     return app;
 }

package/dist/server/server/config.js

@@ -4,16 +4,32 @@
  * SPDX-License-Identifier: AGPL-3.0-or-later
  */
 import { resolve } from 'node:path';
+import { isIP } from 'node:net';
 export class CliUsageError extends Error {
     exitCode = 2;
 }
-const optionNames = new Set(['--cwd', '--host', '--port', '--data-dir', '--skills']);
+const optionNames = new Set([
+    '--cwd',
+    '--host',
+    '--port',
+    '--data-dir',
+    '--public-origin',
+    '--skills',
+]);
+const flagNames = new Set(['--disable-passkey-auth']);
 export function parseConfig(args, cwd = process.cwd()) {
     const values = new Map();
+    const flags = new Set();
     for (let index = 0; index < args.length; index += 1) {
         const option = args[index];
         if (!option.startsWith('--'))
             throw new CliUsageError(`Unexpected argument: ${option}`);
+        if (flagNames.has(option)) {
+            if (flags.has(option))
+                throw new CliUsageError(`Duplicate option: ${option}`);
+            flags.add(option);
+            continue;
+        }
         if (!optionNames.has(option))
             throw new CliUsageError(`Unknown option: ${option}`);
         if (values.has(option))
@@ -28,11 +44,57 @@ export function parseConfig(args, cwd = process.cwd()) {
     const port = Number(portValue);
     if (!Number.isInteger(port) || port < 1 || port > 65535)
         throw new CliUsageError(`Invalid --port: ${portValue}`);
+    const host = values.get('--host') ?? '127.0.0.1';
+    const passkeyAuthEnabled = !flags.has('--disable-passkey-auth');
+    const publicOrigin = values.has('--public-origin')
+        ? normalizePublicOrigin(values.get('--public-origin'))
+        : defaultPublicOrigin(host, port, passkeyAuthEnabled);
     return {
-        host: values.get('--host') ?? '127.0.0.1',
+        host,
         port,
+        passkeyAuthEnabled,
+        relyingParty: createRelyingPartyConfig(publicOrigin),
         root: resolve(cwd, values.get('--cwd') ?? '.'),
         dataDir: values.get('--data-dir'),
         skillsProfile: values.get('--skills'),
     };
 }
+export function normalizePublicOrigin(value) {
+    if (!/^[a-z][a-z\d+.-]*:\/\/[^/?#\s\\\\]+\/?$/i.test(value))
+        throw new CliUsageError('--public-origin must be a bare origin without a path, query, or fragment');
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new CliUsageError(`Invalid --public-origin: ${value}`);
+    }
+    if (url.username || url.password)
+        throw new CliUsageError('--public-origin must not include credentials');
+    if (url.pathname !== '/' || url.search || url.hash)
+        throw new CliUsageError('--public-origin must be a bare origin without a path, query, or fragment');
+    const hostname = url.hostname.replace(/^\[|\]$/g, '');
+    if (isIP(hostname))
+        throw new CliUsageError('--public-origin must use a hostname, not an IP address');
+    if (url.protocol === 'http:' && url.hostname === 'localhost')
+        return url.origin;
+    if (url.protocol !== 'https:')
+        throw new CliUsageError('--public-origin must use HTTPS, except for http://localhost');
+    return url.origin;
+}
+export function createRelyingPartyConfig(publicOrigin) {
+    const normalizedOrigin = normalizePublicOrigin(publicOrigin);
+    return {
+        publicOrigin: normalizedOrigin,
+        rpId: new URL(normalizedOrigin).hostname,
+        rpName: 'Gestalt Mobile',
+    };
+}
+function defaultPublicOrigin(host, port, passkeyAuthEnabled) {
+    if (passkeyAuthEnabled && !isLoopbackHost(host))
+        throw new CliUsageError('--public-origin is required when --host is not a loopback address');
+    return `http://localhost:${port}`;
+}
+function isLoopbackHost(host) {
+    return host === 'localhost' || host === '127.0.0.1' || host === '::1' || host === '[::1]';
+}

package/dist/server/server/features/auth/application/ports.js

@@ -0,0 +1,8 @@
+/*
+ * Copyright (C) 2026 Dyne.org foundation
+ * Designed by Denis Roio <jaromil@dyne.org>
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+/** Expected proof failure; adapters must translate library-specific failures to this type. */
+export class PasskeyVerificationError extends Error {
+}

package/dist/server/server/features/auth/devices/application.js

@@ -0,0 +1,26 @@
+/*
+ * Copyright (C) 2026 Dyne.org foundation
+ * Designed by Denis Roio <jaromil@dyne.org>
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+import { deviceNickname } from '../domain/device-nickname.js';
+/** Maps a credential to deliberately non-WebAuthn management metadata. */
+export function listAuthorizedDeviceMetadata(repository, currentDeviceId) {
+    return repository.listAuthorizedDevices().map((device) => ({
+        id: device.id,
+        nickname: device.nickname,
+        createdAt: device.createdAt,
+        ...(device.lastUsedAt === undefined ? {} : { lastUsedAt: device.lastUsedAt }),
+        current: device.id === currentDeviceId,
+    }));
+}
+export function renameAuthorizedDevice(repository, id, nickname) {
+    const validated = deviceNickname(nickname);
+    const current = repository.findDevice(id);
+    if (!current)
+        return 'notFound';
+    return repository.renameDevice(id, current.version ?? 0, validated);
+}
+export function revokeAuthorizedDevice(repository, id, revokedAt) {
+    return repository.revokeDevice(id, revokedAt);
+}

package/dist/server/server/features/auth/devices/list/endpoint.js

@@ -0,0 +1,12 @@
+/*
+ * Copyright (C) 2026 Dyne.org foundation
+ * Designed by Denis Roio <jaromil@dyne.org>
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+import { authorizationSessionDevice } from '../../../../platform/http/authorization-boundary.js';
+import { listAuthorizedDeviceMetadata } from '../application.js';
+export function registerListAuthorizedDevices(app, deps) {
+    app.get('/api/auth/devices', async (request) => ({
+        devices: listAuthorizedDeviceMetadata(deps.repository, authorizationSessionDevice(request.headers.cookie, deps)),
+    }));
+}

package/dist/server/server/features/auth/devices/rename/endpoint.js

@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2026 Dyne.org foundation
+ * Designed by Denis Roio <jaromil@dyne.org>
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+import { z } from 'zod';
+import { AuthorizationDomainError } from '../../domain/errors.js';
+import { authorizedDeviceId } from '../../domain/identifiers.js';
+import { problem } from '../../../../platform/http/problem.js';
+import { renameAuthorizedDevice } from '../application.js';
+const parameters = z.object({ deviceId: z.string().min(1).max(200) }).strict();
+const requestBody = z.object({ nickname: z.string() }).strict();
+export function registerRenameAuthorizedDevice(app, deps) {
+    app.patch('/api/auth/devices/:deviceId', async (request, reply) => {
+        const params = parameters.safeParse(request.params);
+        const body = requestBody.safeParse(request.body);
+        if (!params.success || !body.success)
+            return unavailable(reply, 400, 'INVALID_DEVICE_REQUEST');
+        try {
+            const outcome = renameAuthorizedDevice(deps.repository, authorizedDeviceId(params.data.deviceId), body.data.nickname);
+            if (outcome === 'renamed')
+                return reply.code(204).send();
+            return unavailable(reply, outcome === 'stale' ? 409 : 404, 'DEVICE_NOT_AVAILABLE');
+        }
+        catch (error) {
+            if (error instanceof AuthorizationDomainError)
+                return unavailable(reply, 400, 'INVALID_DEVICE_REQUEST');
+            throw error;
+        }
+    });
+}
+function unavailable(reply, status, code) {
+    return reply
+        .code(status)
+        .type('application/problem+json')
+        .send(problem(code, status, 'The requested device is not available.'));
+}