gestalt-mobile 0.12.0 → 0.13.0

package/dist/server/server/app.js

@@ -8,53 +8,25 @@ import fastifyCookie from '@fastify/cookie';
 import fastify, {} from 'fastify';
 import { registerGetHealth } from './features/health/get-health/endpoint.js';
 import { registerGetBootstrap } from './features/catalog/get-bootstrap/endpoint.js';
-import { registerGetGitSummary } from './features/git/get-summary/endpoint.js';
-import { registerPushUpstream } from './features/git/push-upstream/endpoint.js';
-import { registerRefreshGit } from './features/git/refresh/endpoint.js';
-import { registerPullRebase } from './features/git/pull-rebase/endpoint.js';
-import { registerCheckoutBranch } from './features/git/checkout-branch/endpoint.js';
-import { registerCloneRepository } from './features/git/clone-repository/endpoint.js';
-import { registerGetSession } from './features/sessions/get-session/endpoint.js';
-import { registerListSessions } from './features/sessions/list-sessions/endpoint.js';
-import { registerListRecentThreads, } from './features/sessions/list-recent-threads/endpoint.js';
-import { registerPromoteRecentThread } from './features/sessions/promote-recent-thread/endpoint.js';
-import { registerGetHistory } from './features/sessions/get-history/endpoint.js';
-import { registerStartSession } from './features/sessions/start-session/endpoint.js';
-import { registerStartTurn } from './features/sessions/start-turn/endpoint.js';
-import { registerSelectModel } from './features/sessions/select-model/endpoint.js';
-import { registerInterruptTurn } from './features/sessions/interrupt-turn/endpoint.js';
-import { registerStopSession } from './features/sessions/stop-session/endpoint.js';
-import { registerRestoreSession } from './features/sessions/restore-session/endpoint.js';
-import { registerReleaseSession } from './features/sessions/release-session/endpoint.js';
-import { registerForgetSession } from './features/sessions/forget-session/endpoint.js';
-import { registerRespondInteraction } from './features/sessions/respond-interaction/endpoint.js';
-import { stopSession } from './features/sessions/lifecycle/use-case.js';
-import { registerSessionEvents } from './features/sessions/session-events/endpoint.js';
-import { registerGetPlan } from './features/plans/get-plan/endpoint.js';
-import { registerGetWorkspacePlan } from './features/plans/get-workspace-plan/endpoint.js';
-import { registerListWorkspacePlans } from './features/plans/list-workspace-plans/endpoint.js';
-import { registerClosePlan } from './features/plans/close-plan/endpoint.js';
-import { registerGetPlanMeasurement } from './features/plans/get-measurement/endpoint.js';
+import { registerAuthRoutes } from './features/auth/register-routes.js';
+import { registerGitRoutes } from './features/git/register-routes.js';
+import { registerPlanRoutes } from './features/plans/register-routes.js';
+import { registerSessionRoutes } from './features/sessions/register-routes.js';
 import { registerProblemHandler } from './platform/http/problem-handler.js';
-import { authorizationSessionDevice, registerAuthorizationBoundary, } from './platform/http/authorization-boundary.js';
-import { registerListAvailableSkills, } from './features/skills/list-available/endpoint.js';
-import { registerListSkillProfiles, } from './features/skills/list-profiles/endpoint.js';
-import { registerReplaceSkillProfile, } from './features/skills/replace-profile/endpoint.js';
-import { registerDeleteSkillProfile, } from './features/skills/delete-profile/endpoint.js';
-import { registerRegistrationOptions } from './features/auth/register/options/endpoint.js';
-import { registerRegistrationVerification } from './features/auth/register/verify/endpoint.js';
-import { registerLoginOptions } from './features/auth/login/options/endpoint.js';
-import { registerLoginVerification } from './features/auth/login/verify/endpoint.js';
-import { registerAuthStatus, registerDisabledAuthStatus, } from './features/auth/status/endpoint.js';
-import { registerLogout } from './features/auth/logout/endpoint.js';
-import { registerListAuthorizedDevices } from './features/auth/devices/list/endpoint.js';
-import { registerRenameAuthorizedDevice } from './features/auth/devices/rename/endpoint.js';
-import { registerRevokeAuthorizedDevice } from './features/auth/devices/revoke/endpoint.js';
-import { registerCreateEnrollmentTicket } from './features/auth/enrollment-tickets/endpoint.js';
-import { registerEnrollmentTicketStatus } from './features/auth/enrollment-tickets/status/endpoint.js';
-import { registerCancelEnrollmentTicket } from './features/auth/enrollment-tickets/cancel/endpoint.js';
+import { registerAuthorizationBoundary } from './platform/http/authorization-boundary.js';
+import { registerSkillRoutes } from './features/skills/register-routes.js';
 export async function buildApp(deps) {
-    const app = fastify({ logger: false });
+    // Keep the default boundary finite even when an endpoint forgot a narrower schema.
+    const app = fastify({ logger: false, bodyLimit: 1024 * 1024 });
+    app.addHook('onSend', async (_request, reply, payload) => {
+        reply.header('Content-Security-Policy', "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self'");
+        reply.header('X-Frame-Options', 'DENY');
+        reply.header('X-Content-Type-Options', 'nosniff');
+        reply.header('Referrer-Policy', 'strict-origin-when-cross-origin');
+        // WebAuthn is same-origin; explicitly allow only this origin's ceremony calls.
+        reply.header('Permissions-Policy', 'publickey-credentials-get=(self), publickey-credentials-create=(self)');
+        return payload;
+    });
     await app.register(fastifyCookie);
     if (deps.staticDir)
         await app.register(fastifyStatic, { root: deps.staticDir });
@@ -65,190 +37,13 @@ export async function buildApp(deps) {
             publicOrigin: deps.auth.relyingParty.publicOrigin,
         });
     registerGetHealth(app, deps.health);
-    if (deps.auth) {
-        registerRegistrationOptions(app, deps.auth);
-        registerRegistrationVerification(app, deps.auth);
-        registerLoginOptions(app, deps.auth);
-        registerLoginVerification(app, deps.auth);
-        registerAuthStatus(app, deps.auth);
-        registerLogout(app, deps.auth);
-        registerListAuthorizedDevices(app, deps.auth);
-        registerRenameAuthorizedDevice(app, deps.auth);
-        registerRevokeAuthorizedDevice(app, deps.auth);
-        registerCreateEnrollmentTicket(app, deps.auth);
-        registerEnrollmentTicketStatus(app, deps.auth);
-        registerCancelEnrollmentTicket(app, deps.auth);
-    }
-    else if (deps.passkeyAuthDisabled)
-        registerDisabledAuthStatus(app);
+    registerAuthRoutes(app, deps);
     if (deps.bootstrap)
         registerGetBootstrap(app, deps.bootstrap);
-    if (deps.recentThreads)
-        registerListRecentThreads(app, {
-            ...deps.recentThreads,
-            metadata: (threadId) => {
-                const session = deps.sessionRoutes
-                    ?.list?.()
-                    .find((candidate) => candidate.threadId === threadId);
-                if (!session)
-                    return null;
-                return {
-                    ...(session.model === undefined ? {} : { model: session.model }),
-                    ...(session.effectiveSkillSelection?.selectedProfileName === undefined
-                        ? {}
-                        : { skillProfile: session.effectiveSkillSelection.selectedProfileName }),
-                    ...(session.lastOrgPlan === undefined
-                        ? {}
-                        : { orgPlanFilename: session.lastOrgPlan.filename }),
-                };
-            },
-        });
-    if (deps.sessionRoutes) {
-        registerStartSession(app, {
-            ...deps.sessionRoutes,
-            reportFailure: (operation, error) => deps.logger.error(`${operation} failed: ${safeErrorLabel(error)}`),
-        });
-        registerGetSession(app, deps.sessionRoutes.find);
-        if (deps.sessionRoutes.list)
-            registerListSessions(app, { list: deps.sessionRoutes.list });
-        if (deps.sessionRoutes.readHistory)
-            registerGetHistory(app, {
-                find: deps.sessionRoutes.find,
-                read: deps.sessionRoutes.readHistory,
-                currentSequence: deps.sessionRoutes.currentSequence ?? (() => 0),
-            });
-        if (deps.sessionRoutes.startTurn)
-            registerStartTurn(app, {
-                find: deps.sessionRoutes.find,
-                start: deps.sessionRoutes.startTurn,
-                save: deps.sessionRoutes.save,
-                onStarted: deps.sessionRoutes.onTurnStarted,
-            });
-        if (deps.sessionRoutes.models)
-            registerSelectModel(app, {
-                find: deps.sessionRoutes.find,
-                models: () => deps.sessionRoutes.models.list(),
-                now: deps.sessionRoutes.now,
-                save: deps.sessionRoutes.save,
-            });
-        if (deps.sessionRoutes.interruptTurn)
-            registerInterruptTurn(app, {
-                find: deps.sessionRoutes.find,
-                interrupt: deps.sessionRoutes.interruptTurn,
-            });
-        if (deps.sessionRoutes.restore)
-            registerRestoreSession(app, {
-                find: deps.sessionRoutes.find,
-                restore: deps.sessionRoutes.restore,
-                save: deps.sessionRoutes.save,
-                idempotency: deps.sessionRoutes.idempotency,
-            });
-        if (deps.recentThreads && deps.sessionRoutes.promoteRecent)
-            registerPromoteRecentThread(app, {
-                list: () => deps.recentThreads.list(),
-                promote: deps.sessionRoutes.promoteRecent,
-            });
-        if (deps.sessionRoutes.release && deps.sessionRoutes.close)
-            registerReleaseSession(app, {
-                find: deps.sessionRoutes.find,
-                release: deps.sessionRoutes.release,
-                save: deps.sessionRoutes.save,
-                close: deps.sessionRoutes.close,
-                idempotency: deps.sessionRoutes.idempotency,
-            });
-        if (deps.sessionRoutes.remove && deps.sessionRoutes.close)
-            registerForgetSession(app, {
-                find: deps.sessionRoutes.find,
-                close: deps.sessionRoutes.close,
-                remove: deps.sessionRoutes.remove,
-            });
-        if (deps.sessionRoutes.close)
-            registerStopSession(app, {
-                find: deps.sessionRoutes.find,
-                stop: (session) => stopSession(session, deps.sessionRoutes.now()),
-                save: deps.sessionRoutes.save,
-                close: deps.sessionRoutes.close,
-                idempotency: deps.sessionRoutes.idempotency,
-            });
-        if (deps.sessionRoutes.replyInteraction && deps.interactions)
-            registerRespondInteraction(app, {
-                exists: (id) => deps.sessionRoutes.find(id) !== null,
-                resolve: (sessionId, requestId, resolvedAt) => deps.interactions.resolve(sessionId, requestId, resolvedAt),
-                validate: deps.interactions.validate,
-                reply: deps.sessionRoutes.replyInteraction,
-                resolved: deps.sessionRoutes.interactionResolved,
-                now: deps.sessionRoutes.now,
-            });
-    }
-    if (deps.sessionEvents)
-        registerSessionEvents(app, {
-            ...deps.sessionEvents,
-            ...(deps.auth
-                ? {
-                    publicOrigin: deps.auth.relyingParty.publicOrigin,
-                    authorized: (cookieHeader) => authorizationSessionDevice(cookieHeader, deps.auth) !== null,
-                }
-                : {}),
-        });
-    if (deps.planRoutes) {
-        registerGetPlan(app, deps.planRoutes);
-        registerClosePlan(app, deps.planRoutes);
-    }
-    if (deps.workspacePlanRoutes) {
-        registerListWorkspacePlans(app, deps.workspacePlanRoutes);
-        registerGetWorkspacePlan(app, deps.workspacePlanRoutes);
-    }
-    if (deps.planMeasurementRoutes)
-        registerGetPlanMeasurement(app, deps.planMeasurementRoutes);
-    if (deps.gitSummary)
-        registerGetGitSummary(app, {
-            workspaces: deps.gitSummary.workspaces,
-            inspect: deps.gitSummary.inspect,
-        });
-    if (deps.gitSummary)
-        registerPushUpstream(app, {
-            workspaces: deps.gitSummary.workspaces,
-            inspect: deps.gitSummary.inspectForPush ?? deps.gitSummary.inspect,
-            push: deps.gitSummary.push,
-            idempotency: deps.gitSummary.idempotency,
-        });
-    if (deps.gitSummary)
-        registerRefreshGit(app, {
-            workspaces: deps.gitSummary.workspaces,
-            refresh: deps.gitSummary.refresh,
-            idempotency: deps.gitSummary.idempotency,
-        });
-    if (deps.gitSummary?.pull && deps.gitSummary.checkout) {
-        registerPullRebase(app, {
-            workspaces: deps.gitSummary.workspaces,
-            pull: deps.gitSummary.pull,
-        });
-        registerCheckoutBranch(app, {
-            workspaces: deps.gitSummary.workspaces,
-            checkout: deps.gitSummary.checkout,
-        });
-    }
-    if (deps.gitSummary?.clone)
-        registerCloneRepository(app, {
-            workspaces: deps.gitSummary.workspaces,
-            clone: deps.gitSummary.clone,
-        });
-    if (deps.skills) {
-        registerListAvailableSkills(app, deps.skills);
-        registerListSkillProfiles(app, deps.skills);
-        registerReplaceSkillProfile(app, deps.skills);
-        registerDeleteSkillProfile(app, deps.skills);
-    }
+    registerSessionRoutes(app, deps);
+    registerPlanRoutes(app, deps);
+    registerGitRoutes(app, deps);
+    registerSkillRoutes(app, deps);
     registerProblemHandler(app, Boolean(deps.staticDir));
     return app;
 }
-function safeErrorLabel(error) {
-    if (typeof error === 'object' && error !== null && 'code' in error) {
-        const code = error.code;
-        if (typeof code === 'string' && /^[A-Z0-9_]+$/.test(code))
-            return code;
-    }
-    if (error instanceof Error && /^[A-Z0-9_]+$/.test(error.message))
-        return error.message;
-    return error instanceof Error ? error.name : 'UNKNOWN_ERROR';
-}

package/dist/server/server/composition.js

@@ -40,7 +40,6 @@ import { CodexSkillCatalog } from './platform/skills/codex-skill-catalog.js';
 import { CachedSkillCatalog } from './platform/skills/cached-skill-catalog.js';
 import { compileSkillOverride } from './features/skills/model/skill-profile.js';
 import { SupervisedPlanRegistry } from './features/plans/application/supervised-plan-registry.js';
-import { NativePlanAlignmentRegistry } from './features/plans/application/native-plan-alignment.js';
 import { FilesystemPlanStatusSource } from './platform/plans/filesystem-plan-status-source.js';
 import { FilesystemWorkspacePlanCatalog } from './platform/plans/filesystem-workspace-plan-catalog.js';
 import { checkpointPlanMeasurement } from './platform/plans/plan-measurement-command.js';
@@ -74,7 +73,6 @@ export async function composeRelayApp(options) {
     const interactions = new SqlitePendingInteractionStore(database);
     const idempotency = new SqliteIdempotencyStore(database);
     const supervisedPlans = new SupervisedPlanRegistry();
-    const nativePlanAlignment = new NativePlanAlignmentRegistry();
     const planStatusSource = new FilesystemPlanStatusSource(join(dirname(databasePath), 'plans'));
     const workspacePlanCatalog = new FilesystemWorkspacePlanCatalog();
     const planMeasurementHelperPath = options.planMeasurementHelperPath ?? process.env.GESTALT_MOBILE_ORG_PLAN_HELPER;
@@ -114,8 +112,6 @@ export async function composeRelayApp(options) {
     const runtime = options.startAppServers
         ? new CodexSessionRuntime(options.launchAppServer ?? launchCodexAppServer, undefined, (sessionId, notification) => {
             const occurredAt = new Date().toISOString();
-            if (notification.method === 'turn/plan/updated')
-                nativePlanAlignment.observe(sessionId, sessions.find(sessionId)?.threadId ?? null, notification.params);
             const normalized = normalizeCodexNotification(sessionId, 0, occurredAt, notification, sessions.find(sessionId)?.workspacePath);
             if (!normalized)
                 return;
@@ -141,7 +137,6 @@ export async function composeRelayApp(options) {
             supervisedPlans.accept(sessionId, update);
             planMeasurementRefresh?.accept(sessionId, update);
             if (update.kind === 'updated') {
-                nativePlanAlignment.replace(sessionId, update.plan);
                 void runtime?.syncThreadPlanName(sessionId, update.plan);
                 const occurredAt = new Date().toISOString();
                 const session = sessions.find(sessionId);

package/dist/server/server/features/auth/application/ceremony-attempts.js

@@ -0,0 +1,22 @@
+/** Process-local by design: the relay's authorization database is local state. */
+export class ExpiringCeremonyAttemptGate {
+    limit;
+    windowMs;
+    #attempts = new Map();
+    constructor(limit = 8, windowMs = 10 * 60 * 1000) {
+        this.limit = limit;
+        this.windowMs = windowMs;
+    }
+    allow(key, now) {
+        const old = this.#attempts.get(key);
+        const expires = now.getTime() + this.windowMs;
+        if (!old || old.expires <= now.getTime()) {
+            this.#attempts.set(key, { count: 1, expires });
+            return true;
+        }
+        if (old.count >= this.limit)
+            return false;
+        old.count++;
+        return true;
+    }
+}

package/dist/server/server/features/auth/domain/errors.js

@@ -5,3 +5,10 @@
  */
 export class AuthorizationDomainError extends Error {
 }
+/**
+ * A finite persistent ceremony pool prevents abandoned browser attempts from
+ * indefinitely consuming local authorization state.  Endpoints intentionally
+ * map this to their existing non-enumerating failure response.
+ */
+export class CeremonyCapacityError extends AuthorizationDomainError {
+}

package/dist/server/server/features/auth/http/cookies.js

@@ -0,0 +1,10 @@
+const seconds = { gestalt_mobile_login: 600, gestalt_mobile_registration: 600, gestalt_mobile_session: 30 * 24 * 60 * 60 };
+function options(name, origin) {
+    return { httpOnly: true, sameSite: 'strict', path: '/', secure: origin.startsWith('https://'), maxAge: seconds[name] };
+}
+export function setAuthCookie(reply, name, value, origin) {
+    reply.setCookie(name, value, options(name, origin));
+}
+export function clearAuthCookie(reply, name, origin) {
+    reply.clearCookie(name, options(name, origin));
+}

package/dist/server/server/features/auth/login/options/endpoint.js

@@ -1,17 +1,18 @@
 import { z } from 'zod';
-import { problem } from '../../../../platform/http/problem.js';
+import { sendProblem } from '../../../../platform/http/problem-reply.js';
 import { passkeyCeremonyId } from '../../domain/identifiers.js';
+import { CeremonyCapacityError } from '../../domain/errors.js';
+import { setAuthCookie } from '../../http/cookies.js';
 const lifetimeMs = 10 * 60 * 1000;
 const responseSchema = z
     .object({ options: z.object({ challenge: z.string().min(1) }).passthrough() })
     .strict();
 export function registerLoginOptions(app, deps) {
-    app.post('/api/auth/login/options', async (_request, reply) => {
+    app.post('/api/auth/login/options', { bodyLimit: 1024 }, async (request, reply) => {
+        if (!deps.ceremonyAttempts.allow(`login:${request.ip}`, deps.clock.now()))
+            return sendProblem(reply, 'AUTHENTICATION_FAILED', 400, 'Authentication could not be completed.');
         if (deps.repository.listAuthorizedDevices().length === 0)
-            return reply
-                .code(400)
-                .type('application/problem+json')
-                .send(problem('AUTHENTICATION_FAILED', 400, 'Authentication could not be completed.'));
+            return sendProblem(reply, 'AUTHENTICATION_FAILED', 400, 'Authentication could not be completed.');
         const correlation = deps.random.bytes(32);
         const challenge = deps.random.bytes(32);
         if (correlation.length !== 32 || challenge.length !== 32)
@@ -25,20 +26,21 @@ export function registerLoginOptions(app, deps) {
             }),
         });
         const token = passkeyCeremonyId(Buffer.from(correlation).toString('base64url'));
-        deps.repository.saveCeremony(token, {
-            purpose: 'authentication',
-            challenge,
-            expectedOrigin: deps.relyingParty.publicOrigin,
-            rpId: deps.relyingParty.rpId,
-            expiresAt: new Date(now.getTime() + lifetimeMs).toISOString(),
-        });
-        reply.setCookie('gestalt_mobile_login', token, {
-            httpOnly: true,
-            sameSite: 'strict',
-            path: '/',
-            secure: deps.relyingParty.publicOrigin.startsWith('https://'),
-            maxAge: 600,
-        });
+        try {
+            deps.repository.saveCeremony(token, {
+                purpose: 'authentication',
+                challenge,
+                expectedOrigin: deps.relyingParty.publicOrigin,
+                rpId: deps.relyingParty.rpId,
+                expiresAt: new Date(now.getTime() + lifetimeMs).toISOString(),
+            }, now.toISOString());
+        }
+        catch (error) {
+            if (error instanceof CeremonyCapacityError)
+                return sendProblem(reply, 'AUTHENTICATION_FAILED', 400, 'Authentication could not be completed.');
+            throw error;
+        }
+        setAuthCookie(reply, 'gestalt_mobile_login', token, deps.relyingParty.publicOrigin);
         return reply.send(options);
     });
 }

package/dist/server/server/features/auth/login/verify/endpoint.js

@@ -1,7 +1,8 @@
 import { z } from 'zod';
-import { problem } from '../../../../platform/http/problem.js';
+import { sendProblem } from '../../../../platform/http/problem-reply.js';
 import { PasskeyVerificationError, } from '../../application/ports.js';
 import { passkeyCeremonyId, webAuthnCredentialId } from '../../domain/identifiers.js';
+import { clearAuthCookie, setAuthCookie } from '../../http/cookies.js';
 const responseSchema = z
     .object({
     id: z.string().min(1),
@@ -22,13 +23,10 @@ const responseSchema = z
 const requestSchema = z.object({ response: responseSchema }).strict();
 const lifetimeMs = 30 * 24 * 60 * 60 * 1000;
 export function registerLoginVerification(app, deps) {
-    app.post('/api/auth/login/verify', async (request, reply) => {
+    app.post('/api/auth/login/verify', { bodyLimit: 64 * 1024 }, async (request, reply) => {
         const parsed = requestSchema.safeParse(request.body);
         const token = request.cookies.gestalt_mobile_login;
-        const fail = () => reply
-            .code(400)
-            .type('application/problem+json')
-            .send(problem('AUTHENTICATION_FAILED', 400, 'Authentication could not be completed.'));
+        const fail = () => sendProblem(reply, 'AUTHENTICATION_FAILED', 400, 'Authentication could not be completed.');
         if (!parsed.success || typeof token !== 'string')
             return fail();
         const now = deps.clock.now();
@@ -69,14 +67,8 @@ export function registerLoginVerification(app, deps) {
             });
             if (!authenticated)
                 return fail();
-            reply.setCookie('gestalt_mobile_session', session, {
-                httpOnly: true,
-                sameSite: 'strict',
-                path: '/',
-                secure: deps.relyingParty.publicOrigin.startsWith('https://'),
-                maxAge: 2592000,
-            });
-            reply.clearCookie('gestalt_mobile_login', { path: '/' });
+            setAuthCookie(reply, 'gestalt_mobile_session', session, deps.relyingParty.publicOrigin);
+            clearAuthCookie(reply, 'gestalt_mobile_login', deps.relyingParty.publicOrigin);
             return reply.send({ status: 'authenticated' });
         }
         catch (error) {

package/dist/server/server/features/auth/logout/endpoint.js

@@ -1,16 +1,12 @@
 import { parseAuthorizationSessionId } from '../domain/identifiers.js';
+import { clearAuthCookie } from '../http/cookies.js';
 export function registerLogout(app, deps) {
     app.post('/api/auth/logout', async (request, reply) => {
         const token = request.cookies.gestalt_mobile_session;
         const session = parseAuthorizationSessionId(token);
         if (session !== null)
             deps.repository.revokeSession(session, deps.clock.now().toISOString());
-        reply.clearCookie('gestalt_mobile_session', {
-            path: '/',
-            httpOnly: true,
-            sameSite: 'strict',
-            secure: deps.relyingParty.publicOrigin.startsWith('https://'),
-        });
+        clearAuthCookie(reply, 'gestalt_mobile_session', deps.relyingParty.publicOrigin);
         return reply.code(204).send();
     });
 }

package/dist/server/server/features/auth/register/options/endpoint.js

@@ -1,22 +1,31 @@
 import { z } from 'zod';
-import { problem } from '../../../../platform/http/problem.js';
+import { sendProblem } from '../../../../platform/http/problem-reply.js';
 import { parseEnrollmentTicketId, passkeyCeremonyId } from '../../domain/identifiers.js';
+import { CeremonyCapacityError } from '../../domain/errors.js';
+import { setAuthCookie } from '../../http/cookies.js';
 const requestSchema = z.object({ enrollmentTicket: z.string().min(1).optional() }).strict();
-const optionsResponseSchema = z.object({ options: z.object({ challenge: z.string().min(1) }).passthrough() }).strict();
+const optionsResponseSchema = z
+    .object({ options: z.object({ challenge: z.string().min(1) }).passthrough() })
+    .strict();
 const lifetimeMs = 10 * 60 * 1000;
 export function registerRegistrationOptions(app, deps) {
-    app.post('/api/auth/register/options', async (request, reply) => {
+    app.post('/api/auth/register/options', { bodyLimit: 4 * 1024 }, async (request, reply) => {
+        if (!deps.ceremonyAttempts.allow(`register:${request.ip}`, deps.clock.now()))
+            return sendProblem(reply, 'REGISTRATION_NOT_AVAILABLE', 400, 'Registration could not be completed.');
         const parsed = requestSchema.safeParse(request.body);
         if (!parsed.success)
-            return reply.code(400).type('application/problem+json').send(problem('INVALID_REGISTRATION_REQUEST', 400, 'The registration request is invalid.'));
-        const ticket = parsed.data.enrollmentTicket === undefined ? undefined : parseEnrollmentTicketId(parsed.data.enrollmentTicket);
+            return sendProblem(reply, 'INVALID_REGISTRATION_REQUEST', 400, 'The registration request is invalid.');
+        const ticket = parsed.data.enrollmentTicket === undefined
+            ? undefined
+            : parseEnrollmentTicketId(parsed.data.enrollmentTicket);
         if (ticket === null)
-            return reply.code(400).type('application/problem+json').send(problem('INVALID_REGISTRATION_REQUEST', 400, 'The registration request is invalid.'));
+            return sendProblem(reply, 'INVALID_REGISTRATION_REQUEST', 400, 'The registration request is invalid.');
         const owner = deps.repository.readOwner();
         const devices = deps.repository.listAuthorizedDevices();
         const now = deps.clock.now();
-        if (devices.length > 0 && (!ticket || !deps.repository.ticketAvailable(ticket, now.toISOString())))
-            return reply.code(403).type('application/problem+json').send(problem('ENROLLMENT_NOT_AUTHORIZED', 403, 'Registration is not authorized.'));
+        if (devices.length > 0 &&
+            (!ticket || !deps.repository.ticketAvailable(ticket, now.toISOString())))
+            return sendProblem(reply, 'ENROLLMENT_NOT_AUTHORIZED', 403, 'Registration is not authorized.');
         const ownerHandle = owner ? undefined : deps.random.bytes(32);
         if (ownerHandle && ownerHandle.length !== 32)
             throw new Error('AUTHORIZATION_RANDOMNESS_INVALID');
@@ -26,9 +35,32 @@ export function registerRegistrationOptions(app, deps) {
         if (correlation.length !== 32 || challenge.length !== 32)
             throw new Error('AUTHORIZATION_RANDOMNESS_INVALID');
         const token = passkeyCeremonyId(Buffer.from(correlation).toString('base64url'));
-        const options = optionsResponseSchema.parse({ options: await deps.webauthn.registrationOptions({ challenge, rpId: deps.relyingParty.rpId, userVerification: 'required', rpName: deps.relyingParty.rpName, userHandle: initialized.userHandle, excludeCredentialIds: devices.map((device) => device.credentialId) }) });
-        deps.repository.saveCeremony(token, { purpose: 'registration', challenge, expectedOrigin: deps.relyingParty.publicOrigin, rpId: deps.relyingParty.rpId, expiresAt: new Date(now.getTime() + lifetimeMs).toISOString(), ...(ticket ? { enrollmentTicket: ticket } : {}) });
-        reply.setCookie('gestalt_mobile_registration', token, { httpOnly: true, sameSite: 'strict', path: '/', secure: deps.relyingParty.publicOrigin.startsWith('https://'), maxAge: 600 });
+        const options = optionsResponseSchema.parse({
+            options: await deps.webauthn.registrationOptions({
+                challenge,
+                rpId: deps.relyingParty.rpId,
+                userVerification: 'required',
+                rpName: deps.relyingParty.rpName,
+                userHandle: initialized.userHandle,
+                excludeCredentialIds: devices.map((device) => device.credentialId),
+            }),
+        });
+        try {
+            deps.repository.saveCeremony(token, {
+                purpose: 'registration',
+                challenge,
+                expectedOrigin: deps.relyingParty.publicOrigin,
+                rpId: deps.relyingParty.rpId,
+                expiresAt: new Date(now.getTime() + lifetimeMs).toISOString(),
+                ...(ticket ? { enrollmentTicket: ticket } : {}),
+            }, now.toISOString());
+        }
+        catch (error) {
+            if (error instanceof CeremonyCapacityError)
+                return sendProblem(reply, 'REGISTRATION_NOT_AVAILABLE', 400, 'Registration could not be completed.');
+            throw error;
+        }
+        setAuthCookie(reply, 'gestalt_mobile_registration', token, deps.relyingParty.publicOrigin);
         return reply.send(options);
     });
 }

package/dist/server/server/features/auth/register/verify/endpoint.js

@@ -4,6 +4,7 @@ import { PasskeyVerificationError } from '../../application/ports.js';
 import { deviceNickname } from '../../domain/device-nickname.js';
 import { passkeyCeremonyId } from '../../domain/identifiers.js';
 import { AuthorizationDomainError } from '../../domain/errors.js';
+import { clearAuthCookie, setAuthCookie } from '../../http/cookies.js';
 const registrationResponseSchema = z.object({
     id: z.string().min(1), rawId: z.string().min(1), type: z.literal('public-key'),
     response: z.object({ clientDataJSON: z.string().min(1), attestationObject: z.string().min(1), authenticatorData: z.string().min(1).optional(), transports: z.array(z.enum(['ble', 'hybrid', 'internal', 'nfc', 'usb', 'cable', 'smart-card'])).optional(), publicKeyAlgorithm: z.number().int().optional(), publicKey: z.string().min(1).optional() }).strict(),
@@ -13,7 +14,7 @@ const requestSchema = z.object({ response: registrationResponseSchema, nickname:
 const successSchema = z.object({ status: z.literal('authenticated') }).strict();
 const sessionLifetimeMs = 30 * 24 * 60 * 60 * 1000;
 export function registerRegistrationVerification(app, deps) {
-    app.post('/api/auth/register/verify', async (request, reply) => {
+    app.post('/api/auth/register/verify', { bodyLimit: 128 * 1024 }, async (request, reply) => {
         const parsed = requestSchema.safeParse(request.body);
         const token = request.cookies.gestalt_mobile_registration;
         if (!parsed.success || typeof token !== 'string')
@@ -43,8 +44,8 @@ export function registerRegistrationVerification(app, deps) {
             const outcome = deps.repository.completeRegistration({ ceremony: passkeyCeremonyId(token), now: now.toISOString(), device, session: { id: session, deviceId: device.id, expiresAt } });
             if (outcome !== 'registered')
                 return reply.code(outcome === 'bootstrapAlreadyClaimed' ? 409 : 400).type('application/problem+json').send(problem(outcome === 'bootstrapAlreadyClaimed' ? 'BOOTSTRAP_ALREADY_CLAIMED' : 'REGISTRATION_NOT_AVAILABLE', outcome === 'bootstrapAlreadyClaimed' ? 409 : 400, 'Registration could not be completed.'));
-            reply.setCookie('gestalt_mobile_session', session, { httpOnly: true, sameSite: 'strict', path: '/', secure: deps.relyingParty.publicOrigin.startsWith('https://'), maxAge: 30 * 24 * 60 * 60 });
-            reply.clearCookie('gestalt_mobile_registration', { path: '/' });
+            setAuthCookie(reply, 'gestalt_mobile_session', session, deps.relyingParty.publicOrigin);
+            clearAuthCookie(reply, 'gestalt_mobile_registration', deps.relyingParty.publicOrigin);
             return reply.code(201).send(successSchema.parse({ status: 'authenticated' }));
         }
         catch (error) {

package/dist/server/server/features/auth/register-routes.js

@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2026 Dyne.org foundation
+ * Designed by Denis Roio <jaromil@dyne.org>
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+import { ExpiringCeremonyAttemptGate } from './application/ceremony-attempts.js';
+import { registerListAuthorizedDevices } from './devices/list/endpoint.js';
+import { registerRenameAuthorizedDevice } from './devices/rename/endpoint.js';
+import { registerRevokeAuthorizedDevice } from './devices/revoke/endpoint.js';
+import { registerCancelEnrollmentTicket } from './enrollment-tickets/cancel/endpoint.js';
+import { registerCreateEnrollmentTicket } from './enrollment-tickets/endpoint.js';
+import { registerEnrollmentTicketStatus } from './enrollment-tickets/status/endpoint.js';
+import { registerLoginOptions } from './login/options/endpoint.js';
+import { registerLoginVerification } from './login/verify/endpoint.js';
+import { registerLogout } from './logout/endpoint.js';
+import { registerRegistrationOptions } from './register/options/endpoint.js';
+import { registerRegistrationVerification } from './register/verify/endpoint.js';
+import { registerAuthStatus, registerDisabledAuthStatus } from './status/endpoint.js';
+/** Registers the complete passkey surface; authorization hooks are composed by app.ts first. */
+export function registerAuthRoutes(app, deps) {
+    if (deps.auth) {
+        const auth = {
+            ...deps.auth,
+            ceremonyAttempts: deps.auth.ceremonyAttempts ?? new ExpiringCeremonyAttemptGate(),
+        };
+        registerRegistrationOptions(app, auth);
+        registerRegistrationVerification(app, deps.auth);
+        registerLoginOptions(app, auth);
+        registerLoginVerification(app, deps.auth);
+        registerAuthStatus(app, deps.auth);
+        registerLogout(app, deps.auth);
+        registerListAuthorizedDevices(app, deps.auth);
+        registerRenameAuthorizedDevice(app, deps.auth);
+        registerRevokeAuthorizedDevice(app, deps.auth);
+        registerCreateEnrollmentTicket(app, deps.auth);
+        registerEnrollmentTicketStatus(app, deps.auth);
+        registerCancelEnrollmentTicket(app, deps.auth);
+    }
+    else if (deps.passkeyAuthDisabled)
+        registerDisabledAuthStatus(app);
+}

package/dist/server/server/features/git/checkout-branch/endpoint.js

@@ -7,7 +7,7 @@ import { z } from 'zod';
 import { resolveRepositoryTarget } from '../application/repository-target.js';
 const requestSchema = z.object({ branch: z.string().min(1) });
 export function registerCheckoutBranch(app, deps) {
-    app.post('/api/git/repositories/:workspaceId/checkout', async (request, reply) => {
+    app.post('/api/git/repositories/:workspaceId/checkout', { bodyLimit: 8 * 1024 }, async (request, reply) => {
         const target = await resolveRepositoryTarget(deps.workspaces, request.params.workspaceId);
         if (!target.ok)
             return reply.code(target.statusCode).send({ code: target.code });

package/dist/server/server/features/git/clone-repository/endpoint.js

@@ -10,7 +10,7 @@ const requestSchema = z.object({
     workspaceId: z.string().trim().min(1),
 });
 export function registerCloneRepository(app, deps) {
-    app.post('/api/git/clone', async (request, reply) => {
+    app.post('/api/git/clone', { bodyLimit: 8 * 1024 }, async (request, reply) => {
         const parsed = requestSchema.safeParse(request.body);
         if (!parsed.success)
             return reply.code(400).send({ code: 'INVALID_CLONE_ADDRESS' });