gestalt-mobile 0.12.0 → 0.14.0

package/dist/client/index.html

@@ -9,9 +9,10 @@ SPDX-License-Identifier: AGPL-3.0-or-later
   <head>
     <meta charset="UTF-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <meta name="color-scheme" content="light dark" />
     <title>Codex Relay</title>
-    <script type="module" crossorigin src="/assets/index-B7KwEjTE.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-CMs5ZzxJ.css">
+    <script type="module" crossorigin src="/assets/index-tMyOolAm.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-C5qFcFUg.css">
   </head>
   <body>
     <div id="app"></div>

package/dist/server/server/app.js

@@ -8,53 +8,25 @@ import fastifyCookie from '@fastify/cookie';
 import fastify, {} from 'fastify';
 import { registerGetHealth } from './features/health/get-health/endpoint.js';
 import { registerGetBootstrap } from './features/catalog/get-bootstrap/endpoint.js';
-import { registerGetGitSummary } from './features/git/get-summary/endpoint.js';
-import { registerPushUpstream } from './features/git/push-upstream/endpoint.js';
-import { registerRefreshGit } from './features/git/refresh/endpoint.js';
-import { registerPullRebase } from './features/git/pull-rebase/endpoint.js';
-import { registerCheckoutBranch } from './features/git/checkout-branch/endpoint.js';
-import { registerCloneRepository } from './features/git/clone-repository/endpoint.js';
-import { registerGetSession } from './features/sessions/get-session/endpoint.js';
-import { registerListSessions } from './features/sessions/list-sessions/endpoint.js';
-import { registerListRecentThreads, } from './features/sessions/list-recent-threads/endpoint.js';
-import { registerPromoteRecentThread } from './features/sessions/promote-recent-thread/endpoint.js';
-import { registerGetHistory } from './features/sessions/get-history/endpoint.js';
-import { registerStartSession } from './features/sessions/start-session/endpoint.js';
-import { registerStartTurn } from './features/sessions/start-turn/endpoint.js';
-import { registerSelectModel } from './features/sessions/select-model/endpoint.js';
-import { registerInterruptTurn } from './features/sessions/interrupt-turn/endpoint.js';
-import { registerStopSession } from './features/sessions/stop-session/endpoint.js';
-import { registerRestoreSession } from './features/sessions/restore-session/endpoint.js';
-import { registerReleaseSession } from './features/sessions/release-session/endpoint.js';
-import { registerForgetSession } from './features/sessions/forget-session/endpoint.js';
-import { registerRespondInteraction } from './features/sessions/respond-interaction/endpoint.js';
-import { stopSession } from './features/sessions/lifecycle/use-case.js';
-import { registerSessionEvents } from './features/sessions/session-events/endpoint.js';
-import { registerGetPlan } from './features/plans/get-plan/endpoint.js';
-import { registerGetWorkspacePlan } from './features/plans/get-workspace-plan/endpoint.js';
-import { registerListWorkspacePlans } from './features/plans/list-workspace-plans/endpoint.js';
-import { registerClosePlan } from './features/plans/close-plan/endpoint.js';
-import { registerGetPlanMeasurement } from './features/plans/get-measurement/endpoint.js';
+import { registerAuthRoutes } from './features/auth/register-routes.js';
+import { registerGitRoutes } from './features/git/register-routes.js';
+import { registerPlanRoutes } from './features/plans/register-routes.js';
+import { registerSessionRoutes } from './features/sessions/register-routes.js';
 import { registerProblemHandler } from './platform/http/problem-handler.js';
-import { authorizationSessionDevice, registerAuthorizationBoundary, } from './platform/http/authorization-boundary.js';
-import { registerListAvailableSkills, } from './features/skills/list-available/endpoint.js';
-import { registerListSkillProfiles, } from './features/skills/list-profiles/endpoint.js';
-import { registerReplaceSkillProfile, } from './features/skills/replace-profile/endpoint.js';
-import { registerDeleteSkillProfile, } from './features/skills/delete-profile/endpoint.js';
-import { registerRegistrationOptions } from './features/auth/register/options/endpoint.js';
-import { registerRegistrationVerification } from './features/auth/register/verify/endpoint.js';
-import { registerLoginOptions } from './features/auth/login/options/endpoint.js';
-import { registerLoginVerification } from './features/auth/login/verify/endpoint.js';
-import { registerAuthStatus, registerDisabledAuthStatus, } from './features/auth/status/endpoint.js';
-import { registerLogout } from './features/auth/logout/endpoint.js';
-import { registerListAuthorizedDevices } from './features/auth/devices/list/endpoint.js';
-import { registerRenameAuthorizedDevice } from './features/auth/devices/rename/endpoint.js';
-import { registerRevokeAuthorizedDevice } from './features/auth/devices/revoke/endpoint.js';
-import { registerCreateEnrollmentTicket } from './features/auth/enrollment-tickets/endpoint.js';
-import { registerEnrollmentTicketStatus } from './features/auth/enrollment-tickets/status/endpoint.js';
-import { registerCancelEnrollmentTicket } from './features/auth/enrollment-tickets/cancel/endpoint.js';
+import { registerAuthorizationBoundary } from './platform/http/authorization-boundary.js';
+import { registerSkillRoutes } from './features/skills/register-routes.js';
 export async function buildApp(deps) {
-    const app = fastify({ logger: false });
+    // Keep the default boundary finite even when an endpoint forgot a narrower schema.
+    const app = fastify({ logger: false, bodyLimit: 1024 * 1024 });
+    app.addHook('onSend', async (_request, reply, payload) => {
+        reply.header('Content-Security-Policy', "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self'");
+        reply.header('X-Frame-Options', 'DENY');
+        reply.header('X-Content-Type-Options', 'nosniff');
+        reply.header('Referrer-Policy', 'strict-origin-when-cross-origin');
+        // WebAuthn is same-origin; explicitly allow only this origin's ceremony calls.
+        reply.header('Permissions-Policy', 'publickey-credentials-get=(self), publickey-credentials-create=(self)');
+        return payload;
+    });
     await app.register(fastifyCookie);
     if (deps.staticDir)
         await app.register(fastifyStatic, { root: deps.staticDir });
@@ -65,190 +37,13 @@ export async function buildApp(deps) {
             publicOrigin: deps.auth.relyingParty.publicOrigin,
         });
     registerGetHealth(app, deps.health);
-    if (deps.auth) {
-        registerRegistrationOptions(app, deps.auth);
-        registerRegistrationVerification(app, deps.auth);
-        registerLoginOptions(app, deps.auth);
-        registerLoginVerification(app, deps.auth);
-        registerAuthStatus(app, deps.auth);
-        registerLogout(app, deps.auth);
-        registerListAuthorizedDevices(app, deps.auth);
-        registerRenameAuthorizedDevice(app, deps.auth);
-        registerRevokeAuthorizedDevice(app, deps.auth);
-        registerCreateEnrollmentTicket(app, deps.auth);
-        registerEnrollmentTicketStatus(app, deps.auth);
-        registerCancelEnrollmentTicket(app, deps.auth);
-    }
-    else if (deps.passkeyAuthDisabled)
-        registerDisabledAuthStatus(app);
+    registerAuthRoutes(app, deps);
     if (deps.bootstrap)
         registerGetBootstrap(app, deps.bootstrap);
-    if (deps.recentThreads)
-        registerListRecentThreads(app, {
-            ...deps.recentThreads,
-            metadata: (threadId) => {
-                const session = deps.sessionRoutes
-                    ?.list?.()
-                    .find((candidate) => candidate.threadId === threadId);
-                if (!session)
-                    return null;
-                return {
-                    ...(session.model === undefined ? {} : { model: session.model }),
-                    ...(session.effectiveSkillSelection?.selectedProfileName === undefined
-                        ? {}
-                        : { skillProfile: session.effectiveSkillSelection.selectedProfileName }),
-                    ...(session.lastOrgPlan === undefined
-                        ? {}
-                        : { orgPlanFilename: session.lastOrgPlan.filename }),
-                };
-            },
-        });
-    if (deps.sessionRoutes) {
-        registerStartSession(app, {
-            ...deps.sessionRoutes,
-            reportFailure: (operation, error) => deps.logger.error(`${operation} failed: ${safeErrorLabel(error)}`),
-        });
-        registerGetSession(app, deps.sessionRoutes.find);
-        if (deps.sessionRoutes.list)
-            registerListSessions(app, { list: deps.sessionRoutes.list });
-        if (deps.sessionRoutes.readHistory)
-            registerGetHistory(app, {
-                find: deps.sessionRoutes.find,
-                read: deps.sessionRoutes.readHistory,
-                currentSequence: deps.sessionRoutes.currentSequence ?? (() => 0),
-            });
-        if (deps.sessionRoutes.startTurn)
-            registerStartTurn(app, {
-                find: deps.sessionRoutes.find,
-                start: deps.sessionRoutes.startTurn,
-                save: deps.sessionRoutes.save,
-                onStarted: deps.sessionRoutes.onTurnStarted,
-            });
-        if (deps.sessionRoutes.models)
-            registerSelectModel(app, {
-                find: deps.sessionRoutes.find,
-                models: () => deps.sessionRoutes.models.list(),
-                now: deps.sessionRoutes.now,
-                save: deps.sessionRoutes.save,
-            });
-        if (deps.sessionRoutes.interruptTurn)
-            registerInterruptTurn(app, {
-                find: deps.sessionRoutes.find,
-                interrupt: deps.sessionRoutes.interruptTurn,
-            });
-        if (deps.sessionRoutes.restore)
-            registerRestoreSession(app, {
-                find: deps.sessionRoutes.find,
-                restore: deps.sessionRoutes.restore,
-                save: deps.sessionRoutes.save,
-                idempotency: deps.sessionRoutes.idempotency,
-            });
-        if (deps.recentThreads && deps.sessionRoutes.promoteRecent)
-            registerPromoteRecentThread(app, {
-                list: () => deps.recentThreads.list(),
-                promote: deps.sessionRoutes.promoteRecent,
-            });
-        if (deps.sessionRoutes.release && deps.sessionRoutes.close)
-            registerReleaseSession(app, {
-                find: deps.sessionRoutes.find,
-                release: deps.sessionRoutes.release,
-                save: deps.sessionRoutes.save,
-                close: deps.sessionRoutes.close,
-                idempotency: deps.sessionRoutes.idempotency,
-            });
-        if (deps.sessionRoutes.remove && deps.sessionRoutes.close)
-            registerForgetSession(app, {
-                find: deps.sessionRoutes.find,
-                close: deps.sessionRoutes.close,
-                remove: deps.sessionRoutes.remove,
-            });
-        if (deps.sessionRoutes.close)
-            registerStopSession(app, {
-                find: deps.sessionRoutes.find,
-                stop: (session) => stopSession(session, deps.sessionRoutes.now()),
-                save: deps.sessionRoutes.save,
-                close: deps.sessionRoutes.close,
-                idempotency: deps.sessionRoutes.idempotency,
-            });
-        if (deps.sessionRoutes.replyInteraction && deps.interactions)
-            registerRespondInteraction(app, {
-                exists: (id) => deps.sessionRoutes.find(id) !== null,
-                resolve: (sessionId, requestId, resolvedAt) => deps.interactions.resolve(sessionId, requestId, resolvedAt),
-                validate: deps.interactions.validate,
-                reply: deps.sessionRoutes.replyInteraction,
-                resolved: deps.sessionRoutes.interactionResolved,
-                now: deps.sessionRoutes.now,
-            });
-    }
-    if (deps.sessionEvents)
-        registerSessionEvents(app, {
-            ...deps.sessionEvents,
-            ...(deps.auth
-                ? {
-                    publicOrigin: deps.auth.relyingParty.publicOrigin,
-                    authorized: (cookieHeader) => authorizationSessionDevice(cookieHeader, deps.auth) !== null,
-                }
-                : {}),
-        });
-    if (deps.planRoutes) {
-        registerGetPlan(app, deps.planRoutes);
-        registerClosePlan(app, deps.planRoutes);
-    }
-    if (deps.workspacePlanRoutes) {
-        registerListWorkspacePlans(app, deps.workspacePlanRoutes);
-        registerGetWorkspacePlan(app, deps.workspacePlanRoutes);
-    }
-    if (deps.planMeasurementRoutes)
-        registerGetPlanMeasurement(app, deps.planMeasurementRoutes);
-    if (deps.gitSummary)
-        registerGetGitSummary(app, {
-            workspaces: deps.gitSummary.workspaces,
-            inspect: deps.gitSummary.inspect,
-        });
-    if (deps.gitSummary)
-        registerPushUpstream(app, {
-            workspaces: deps.gitSummary.workspaces,
-            inspect: deps.gitSummary.inspectForPush ?? deps.gitSummary.inspect,
-            push: deps.gitSummary.push,
-            idempotency: deps.gitSummary.idempotency,
-        });
-    if (deps.gitSummary)
-        registerRefreshGit(app, {
-            workspaces: deps.gitSummary.workspaces,
-            refresh: deps.gitSummary.refresh,
-            idempotency: deps.gitSummary.idempotency,
-        });
-    if (deps.gitSummary?.pull && deps.gitSummary.checkout) {
-        registerPullRebase(app, {
-            workspaces: deps.gitSummary.workspaces,
-            pull: deps.gitSummary.pull,
-        });
-        registerCheckoutBranch(app, {
-            workspaces: deps.gitSummary.workspaces,
-            checkout: deps.gitSummary.checkout,
-        });
-    }
-    if (deps.gitSummary?.clone)
-        registerCloneRepository(app, {
-            workspaces: deps.gitSummary.workspaces,
-            clone: deps.gitSummary.clone,
-        });
-    if (deps.skills) {
-        registerListAvailableSkills(app, deps.skills);
-        registerListSkillProfiles(app, deps.skills);
-        registerReplaceSkillProfile(app, deps.skills);
-        registerDeleteSkillProfile(app, deps.skills);
-    }
+    registerSessionRoutes(app, deps);
+    registerPlanRoutes(app, deps);
+    registerGitRoutes(app, deps);
+    registerSkillRoutes(app, deps);
     registerProblemHandler(app, Boolean(deps.staticDir));
     return app;
 }
-function safeErrorLabel(error) {
-    if (typeof error === 'object' && error !== null && 'code' in error) {
-        const code = error.code;
-        if (typeof code === 'string' && /^[A-Z0-9_]+$/.test(code))
-            return code;
-    }
-    if (error instanceof Error && /^[A-Z0-9_]+$/.test(error.message))
-        return error.message;
-    return error instanceof Error ? error.name : 'UNKNOWN_ERROR';
-}

package/dist/server/server/cli.js

@@ -99,7 +99,9 @@ async function listSkillProfiles(store, stdout, stderr) {
             if (!profile)
                 continue;
             stdout.write(`${profile.name}\n  ${store.globalProfilePath(name)}\n`);
-            for (const skill of [...profile.skills].filter((entry) => entry.enabled).sort((a, b) => a.name.localeCompare(b.name) || a.path.localeCompare(b.path)))
+            for (const skill of [...profile.skills]
+                .filter((entry) => entry.enabled)
+                .sort((a, b) => a.name.localeCompare(b.name) || a.path.localeCompare(b.path)))
                 stdout.write(`  ${skill.name}\t${skill.path}\n`);
         }
         catch (error) {

package/dist/server/server/composition.js

@@ -40,12 +40,11 @@ import { CodexSkillCatalog } from './platform/skills/codex-skill-catalog.js';
 import { CachedSkillCatalog } from './platform/skills/cached-skill-catalog.js';
 import { compileSkillOverride } from './features/skills/model/skill-profile.js';
 import { SupervisedPlanRegistry } from './features/plans/application/supervised-plan-registry.js';
-import { NativePlanAlignmentRegistry } from './features/plans/application/native-plan-alignment.js';
 import { FilesystemPlanStatusSource } from './platform/plans/filesystem-plan-status-source.js';
 import { FilesystemWorkspacePlanCatalog } from './platform/plans/filesystem-workspace-plan-catalog.js';
 import { checkpointPlanMeasurement } from './platform/plans/plan-measurement-command.js';
 import { PlanMeasurementRefresh } from './platform/plans/plan-measurement-refresh.js';
-import { createRelyingPartyConfig, } from './config.js';
+import { createRelyingPartyConfig } from './config.js';
 const generatedProtocolVersion = 'codex-cli 0.144.3';
 export async function composeRelayApp(options) {
     const passkeyAuthEnabled = options.passkeyAuthEnabled ?? true;
@@ -74,7 +73,6 @@ export async function composeRelayApp(options) {
     const interactions = new SqlitePendingInteractionStore(database);
     const idempotency = new SqliteIdempotencyStore(database);
     const supervisedPlans = new SupervisedPlanRegistry();
-    const nativePlanAlignment = new NativePlanAlignmentRegistry();
     const planStatusSource = new FilesystemPlanStatusSource(join(dirname(databasePath), 'plans'));
     const workspacePlanCatalog = new FilesystemWorkspacePlanCatalog();
     const planMeasurementHelperPath = options.planMeasurementHelperPath ?? process.env.GESTALT_MOBILE_ORG_PLAN_HELPER;
@@ -114,8 +112,6 @@ export async function composeRelayApp(options) {
     const runtime = options.startAppServers
         ? new CodexSessionRuntime(options.launchAppServer ?? launchCodexAppServer, undefined, (sessionId, notification) => {
             const occurredAt = new Date().toISOString();
-            if (notification.method === 'turn/plan/updated')
-                nativePlanAlignment.observe(sessionId, sessions.find(sessionId)?.threadId ?? null, notification.params);
             const normalized = normalizeCodexNotification(sessionId, 0, occurredAt, notification, sessions.find(sessionId)?.workspacePath);
             if (!normalized)
                 return;
@@ -141,7 +137,6 @@ export async function composeRelayApp(options) {
             supervisedPlans.accept(sessionId, update);
             planMeasurementRefresh?.accept(sessionId, update);
             if (update.kind === 'updated') {
-                nativePlanAlignment.replace(sessionId, update.plan);
                 void runtime?.syncThreadPlanName(sessionId, update.plan);
                 const occurredAt = new Date().toISOString();
                 const session = sessions.find(sessionId);
@@ -199,29 +194,33 @@ export async function composeRelayApp(options) {
     let app;
     try {
         app = await buildApp({
-            ...(authorization ? { auth: {
-                    repository: authorization,
-                    clock: { now: options.authorizationClock ?? (() => new Date()) },
-                    random: {
-                        bytes: (length) => {
-                            const value = authorizationRandom(length);
-                            if (length !== 32 || value.length !== 32)
-                                throw new Error('Authorization randomness must return exactly 32 bytes');
-                            return value;
+            ...(authorization
+                ? {
+                    auth: {
+                        repository: authorization,
+                        clock: { now: options.authorizationClock ?? (() => new Date()) },
+                        random: {
+                            bytes: (length) => {
+                                const value = authorizationRandom(length);
+                                if (length !== 32 || value.length !== 32)
+                                    throw new Error('Authorization randomness must return exactly 32 bytes');
+                                return value;
+                            },
                         },
-                    },
-                    identifiers: {
-                        sessionId: () => {
-                            const value = authorizationRandom(32);
-                            if (value.length !== 32)
-                                throw new Error('Authorization randomness must return exactly 32 bytes');
-                            return authorizationSessionId(Buffer.from(value).toString('base64url'));
+                        identifiers: {
+                            sessionId: () => {
+                                const value = authorizationRandom(32);
+                                if (value.length !== 32)
+                                    throw new Error('Authorization randomness must return exactly 32 bytes');
+                                return authorizationSessionId(Buffer.from(value).toString('base64url'));
+                            },
+                            deviceId: () => authorizedDeviceId(randomUUID()),
                         },
-                        deviceId: () => authorizedDeviceId(randomUUID()),
+                        webauthn: options.authorizationWebauthn ?? new SimpleWebAuthnAdapter(),
+                        relyingParty,
                     },
-                    webauthn: options.authorizationWebauthn ?? new SimpleWebAuthnAdapter(),
-                    relyingParty,
-                } } : { passkeyAuthDisabled: true }),
+                }
+                : { passkeyAuthDisabled: true }),
             health: {
                 async read() {
                     return {

package/dist/server/server/features/auth/application/ceremony-attempts.js

@@ -0,0 +1,22 @@
+/** Process-local by design: the relay's authorization database is local state. */
+export class ExpiringCeremonyAttemptGate {
+    limit;
+    windowMs;
+    #attempts = new Map();
+    constructor(limit = 8, windowMs = 10 * 60 * 1000) {
+        this.limit = limit;
+        this.windowMs = windowMs;
+    }
+    allow(key, now) {
+        const old = this.#attempts.get(key);
+        const expires = now.getTime() + this.windowMs;
+        if (!old || old.expires <= now.getTime()) {
+            this.#attempts.set(key, { count: 1, expires });
+            return true;
+        }
+        if (old.count >= this.limit)
+            return false;
+        old.count++;
+        return true;
+    }
+}

package/dist/server/server/features/auth/devices/revoke/endpoint.js

@@ -28,7 +28,9 @@ export function registerRevokeAuthorizedDevice(app, deps) {
                 return unavailable(reply, 404, 'DEVICE_NOT_AVAILABLE');
             if (current === id)
                 reply.clearCookie('gestalt_mobile_session', {
-                    path: '/', httpOnly: true, sameSite: 'strict',
+                    path: '/',
+                    httpOnly: true,
+                    sameSite: 'strict',
                     secure: deps.relyingParty.publicOrigin.startsWith('https://'),
                 });
             return reply.code(204).send();

package/dist/server/server/features/auth/domain/errors.js

@@ -5,3 +5,10 @@
  */
 export class AuthorizationDomainError extends Error {
 }
+/**
+ * A finite persistent ceremony pool prevents abandoned browser attempts from
+ * indefinitely consuming local authorization state.  Endpoints intentionally
+ * map this to their existing non-enumerating failure response.
+ */
+export class CeremonyCapacityError extends AuthorizationDomainError {
+}

package/dist/server/server/features/auth/enrollment-tickets/endpoint.js

@@ -4,7 +4,8 @@ export function registerCreateEnrollmentTicket(app, deps) {
     app.post('/api/auth/enrollment-tickets', async (request, reply) => {
         const rawSession = request.cookies.gestalt_mobile_session;
         const session = parseAuthorizationSessionId(rawSession);
-        if (session === null || deps.repository.sessionDevice(session, deps.clock.now().toISOString()) === null)
+        if (session === null ||
+            deps.repository.sessionDevice(session, deps.clock.now().toISOString()) === null)
             return reply.code(401).send();
         const entropy = deps.random.bytes(32);
         if (entropy.length < 32)
@@ -12,6 +13,10 @@ export function registerCreateEnrollmentTicket(app, deps) {
         const ticket = enrollmentTicketId(Buffer.from(entropy).toString('base64url'));
         const expiresAt = new Date(deps.clock.now().getTime() + lifetimeMs).toISOString();
         deps.repository.issueEnrollmentTicket(ticket, session, expiresAt);
-        return reply.code(201).send({ ticket, url: `${deps.relyingParty.publicOrigin.replace(/\/$/, '')}/#enroll=${ticket}`, expiresAt });
+        return reply.code(201).send({
+            ticket,
+            url: `${deps.relyingParty.publicOrigin.replace(/\/$/, '')}/#enroll=${ticket}`,
+            expiresAt,
+        });
     });
 }

package/dist/server/server/features/auth/enrollment-tickets/status/endpoint.js

@@ -1,6 +1,8 @@
 import { z } from 'zod';
 import { parseAuthorizationSessionId } from '../../domain/identifiers.js';
-const responseSchema = z.object({ status: z.enum(['none', 'pending', 'used', 'expired']) }).strict();
+const responseSchema = z
+    .object({ status: z.enum(['none', 'pending', 'used', 'expired']) })
+    .strict();
 export function registerEnrollmentTicketStatus(app, deps) {
     app.get('/api/auth/enrollment-tickets/current', async (request, reply) => {
         const rawSession = request.cookies.gestalt_mobile_session;

package/dist/server/server/features/auth/http/cookies.js

@@ -0,0 +1,20 @@
+const seconds = {
+    gestalt_mobile_login: 600,
+    gestalt_mobile_registration: 600,
+    gestalt_mobile_session: 30 * 24 * 60 * 60,
+};
+function options(name, origin) {
+    return {
+        httpOnly: true,
+        sameSite: 'strict',
+        path: '/',
+        secure: origin.startsWith('https://'),
+        maxAge: seconds[name],
+    };
+}
+export function setAuthCookie(reply, name, value, origin) {
+    reply.setCookie(name, value, options(name, origin));
+}
+export function clearAuthCookie(reply, name, origin) {
+    reply.clearCookie(name, options(name, origin));
+}

package/dist/server/server/features/auth/login/options/endpoint.js

@@ -1,17 +1,18 @@
 import { z } from 'zod';
-import { problem } from '../../../../platform/http/problem.js';
+import { sendProblem } from '../../../../platform/http/problem-reply.js';
 import { passkeyCeremonyId } from '../../domain/identifiers.js';
+import { CeremonyCapacityError } from '../../domain/errors.js';
+import { setAuthCookie } from '../../http/cookies.js';
 const lifetimeMs = 10 * 60 * 1000;
 const responseSchema = z
     .object({ options: z.object({ challenge: z.string().min(1) }).passthrough() })
     .strict();
 export function registerLoginOptions(app, deps) {
-    app.post('/api/auth/login/options', async (_request, reply) => {
+    app.post('/api/auth/login/options', { bodyLimit: 1024 }, async (request, reply) => {
+        if (!deps.ceremonyAttempts.allow(`login:${request.ip}`, deps.clock.now()))
+            return sendProblem(reply, 'AUTHENTICATION_FAILED', 400, 'Authentication could not be completed.');
         if (deps.repository.listAuthorizedDevices().length === 0)
-            return reply
-                .code(400)
-                .type('application/problem+json')
-                .send(problem('AUTHENTICATION_FAILED', 400, 'Authentication could not be completed.'));
+            return sendProblem(reply, 'AUTHENTICATION_FAILED', 400, 'Authentication could not be completed.');
         const correlation = deps.random.bytes(32);
         const challenge = deps.random.bytes(32);
         if (correlation.length !== 32 || challenge.length !== 32)
@@ -25,20 +26,21 @@ export function registerLoginOptions(app, deps) {
             }),
         });
         const token = passkeyCeremonyId(Buffer.from(correlation).toString('base64url'));
-        deps.repository.saveCeremony(token, {
-            purpose: 'authentication',
-            challenge,
-            expectedOrigin: deps.relyingParty.publicOrigin,
-            rpId: deps.relyingParty.rpId,
-            expiresAt: new Date(now.getTime() + lifetimeMs).toISOString(),
-        });
-        reply.setCookie('gestalt_mobile_login', token, {
-            httpOnly: true,
-            sameSite: 'strict',
-            path: '/',
-            secure: deps.relyingParty.publicOrigin.startsWith('https://'),
-            maxAge: 600,
-        });
+        try {
+            deps.repository.saveCeremony(token, {
+                purpose: 'authentication',
+                challenge,
+                expectedOrigin: deps.relyingParty.publicOrigin,
+                rpId: deps.relyingParty.rpId,
+                expiresAt: new Date(now.getTime() + lifetimeMs).toISOString(),
+            }, now.toISOString());
+        }
+        catch (error) {
+            if (error instanceof CeremonyCapacityError)
+                return sendProblem(reply, 'AUTHENTICATION_FAILED', 400, 'Authentication could not be completed.');
+            throw error;
+        }
+        setAuthCookie(reply, 'gestalt_mobile_login', token, deps.relyingParty.publicOrigin);
         return reply.send(options);
     });
 }

package/dist/server/server/features/auth/login/verify/endpoint.js

@@ -1,7 +1,8 @@
 import { z } from 'zod';
-import { problem } from '../../../../platform/http/problem.js';
+import { sendProblem } from '../../../../platform/http/problem-reply.js';
 import { PasskeyVerificationError, } from '../../application/ports.js';
 import { passkeyCeremonyId, webAuthnCredentialId } from '../../domain/identifiers.js';
+import { clearAuthCookie, setAuthCookie } from '../../http/cookies.js';
 const responseSchema = z
     .object({
     id: z.string().min(1),
@@ -22,13 +23,10 @@ const responseSchema = z
 const requestSchema = z.object({ response: responseSchema }).strict();
 const lifetimeMs = 30 * 24 * 60 * 60 * 1000;
 export function registerLoginVerification(app, deps) {
-    app.post('/api/auth/login/verify', async (request, reply) => {
+    app.post('/api/auth/login/verify', { bodyLimit: 64 * 1024 }, async (request, reply) => {
         const parsed = requestSchema.safeParse(request.body);
         const token = request.cookies.gestalt_mobile_login;
-        const fail = () => reply
-            .code(400)
-            .type('application/problem+json')
-            .send(problem('AUTHENTICATION_FAILED', 400, 'Authentication could not be completed.'));
+        const fail = () => sendProblem(reply, 'AUTHENTICATION_FAILED', 400, 'Authentication could not be completed.');
         if (!parsed.success || typeof token !== 'string')
             return fail();
         const now = deps.clock.now();
@@ -69,14 +67,8 @@ export function registerLoginVerification(app, deps) {
             });
             if (!authenticated)
                 return fail();
-            reply.setCookie('gestalt_mobile_session', session, {
-                httpOnly: true,
-                sameSite: 'strict',
-                path: '/',
-                secure: deps.relyingParty.publicOrigin.startsWith('https://'),
-                maxAge: 2592000,
-            });
-            reply.clearCookie('gestalt_mobile_login', { path: '/' });
+            setAuthCookie(reply, 'gestalt_mobile_session', session, deps.relyingParty.publicOrigin);
+            clearAuthCookie(reply, 'gestalt_mobile_login', deps.relyingParty.publicOrigin);
             return reply.send({ status: 'authenticated' });
         }
         catch (error) {

package/dist/server/server/features/auth/logout/endpoint.js

@@ -1,16 +1,12 @@
 import { parseAuthorizationSessionId } from '../domain/identifiers.js';
+import { clearAuthCookie } from '../http/cookies.js';
 export function registerLogout(app, deps) {
     app.post('/api/auth/logout', async (request, reply) => {
         const token = request.cookies.gestalt_mobile_session;
         const session = parseAuthorizationSessionId(token);
         if (session !== null)
             deps.repository.revokeSession(session, deps.clock.now().toISOString());
-        reply.clearCookie('gestalt_mobile_session', {
-            path: '/',
-            httpOnly: true,
-            sameSite: 'strict',
-            secure: deps.relyingParty.publicOrigin.startsWith('https://'),
-        });
+        clearAuthCookie(reply, 'gestalt_mobile_session', deps.relyingParty.publicOrigin);
         return reply.code(204).send();
     });
 }