gestalt-mobile 0.12.0 → 0.14.0

package/dist/server/server/features/auth/register/options/endpoint.js

@@ -1,22 +1,31 @@
 import { z } from 'zod';
-import { problem } from '../../../../platform/http/problem.js';
+import { sendProblem } from '../../../../platform/http/problem-reply.js';
 import { parseEnrollmentTicketId, passkeyCeremonyId } from '../../domain/identifiers.js';
+import { CeremonyCapacityError } from '../../domain/errors.js';
+import { setAuthCookie } from '../../http/cookies.js';
 const requestSchema = z.object({ enrollmentTicket: z.string().min(1).optional() }).strict();
-const optionsResponseSchema = z.object({ options: z.object({ challenge: z.string().min(1) }).passthrough() }).strict();
+const optionsResponseSchema = z
+    .object({ options: z.object({ challenge: z.string().min(1) }).passthrough() })
+    .strict();
 const lifetimeMs = 10 * 60 * 1000;
 export function registerRegistrationOptions(app, deps) {
-    app.post('/api/auth/register/options', async (request, reply) => {
+    app.post('/api/auth/register/options', { bodyLimit: 4 * 1024 }, async (request, reply) => {
+        if (!deps.ceremonyAttempts.allow(`register:${request.ip}`, deps.clock.now()))
+            return sendProblem(reply, 'REGISTRATION_NOT_AVAILABLE', 400, 'Registration could not be completed.');
         const parsed = requestSchema.safeParse(request.body);
         if (!parsed.success)
-            return reply.code(400).type('application/problem+json').send(problem('INVALID_REGISTRATION_REQUEST', 400, 'The registration request is invalid.'));
-        const ticket = parsed.data.enrollmentTicket === undefined ? undefined : parseEnrollmentTicketId(parsed.data.enrollmentTicket);
+            return sendProblem(reply, 'INVALID_REGISTRATION_REQUEST', 400, 'The registration request is invalid.');
+        const ticket = parsed.data.enrollmentTicket === undefined
+            ? undefined
+            : parseEnrollmentTicketId(parsed.data.enrollmentTicket);
         if (ticket === null)
-            return reply.code(400).type('application/problem+json').send(problem('INVALID_REGISTRATION_REQUEST', 400, 'The registration request is invalid.'));
+            return sendProblem(reply, 'INVALID_REGISTRATION_REQUEST', 400, 'The registration request is invalid.');
         const owner = deps.repository.readOwner();
         const devices = deps.repository.listAuthorizedDevices();
         const now = deps.clock.now();
-        if (devices.length > 0 && (!ticket || !deps.repository.ticketAvailable(ticket, now.toISOString())))
-            return reply.code(403).type('application/problem+json').send(problem('ENROLLMENT_NOT_AUTHORIZED', 403, 'Registration is not authorized.'));
+        if (devices.length > 0 &&
+            (!ticket || !deps.repository.ticketAvailable(ticket, now.toISOString())))
+            return sendProblem(reply, 'ENROLLMENT_NOT_AUTHORIZED', 403, 'Registration is not authorized.');
         const ownerHandle = owner ? undefined : deps.random.bytes(32);
         if (ownerHandle && ownerHandle.length !== 32)
             throw new Error('AUTHORIZATION_RANDOMNESS_INVALID');
@@ -26,9 +35,32 @@ export function registerRegistrationOptions(app, deps) {
         if (correlation.length !== 32 || challenge.length !== 32)
             throw new Error('AUTHORIZATION_RANDOMNESS_INVALID');
         const token = passkeyCeremonyId(Buffer.from(correlation).toString('base64url'));
-        const options = optionsResponseSchema.parse({ options: await deps.webauthn.registrationOptions({ challenge, rpId: deps.relyingParty.rpId, userVerification: 'required', rpName: deps.relyingParty.rpName, userHandle: initialized.userHandle, excludeCredentialIds: devices.map((device) => device.credentialId) }) });
-        deps.repository.saveCeremony(token, { purpose: 'registration', challenge, expectedOrigin: deps.relyingParty.publicOrigin, rpId: deps.relyingParty.rpId, expiresAt: new Date(now.getTime() + lifetimeMs).toISOString(), ...(ticket ? { enrollmentTicket: ticket } : {}) });
-        reply.setCookie('gestalt_mobile_registration', token, { httpOnly: true, sameSite: 'strict', path: '/', secure: deps.relyingParty.publicOrigin.startsWith('https://'), maxAge: 600 });
+        const options = optionsResponseSchema.parse({
+            options: await deps.webauthn.registrationOptions({
+                challenge,
+                rpId: deps.relyingParty.rpId,
+                userVerification: 'required',
+                rpName: deps.relyingParty.rpName,
+                userHandle: initialized.userHandle,
+                excludeCredentialIds: devices.map((device) => device.credentialId),
+            }),
+        });
+        try {
+            deps.repository.saveCeremony(token, {
+                purpose: 'registration',
+                challenge,
+                expectedOrigin: deps.relyingParty.publicOrigin,
+                rpId: deps.relyingParty.rpId,
+                expiresAt: new Date(now.getTime() + lifetimeMs).toISOString(),
+                ...(ticket ? { enrollmentTicket: ticket } : {}),
+            }, now.toISOString());
+        }
+        catch (error) {
+            if (error instanceof CeremonyCapacityError)
+                return sendProblem(reply, 'REGISTRATION_NOT_AVAILABLE', 400, 'Registration could not be completed.');
+            throw error;
+        }
+        setAuthCookie(reply, 'gestalt_mobile_registration', token, deps.relyingParty.publicOrigin);
         return reply.send(options);
     });
 }

package/dist/server/server/features/auth/register/verify/endpoint.js

@@ -1,55 +1,111 @@
 import { z } from 'zod';
 import { problem } from '../../../../platform/http/problem.js';
-import { PasskeyVerificationError } from '../../application/ports.js';
+import { PasskeyVerificationError, } from '../../application/ports.js';
 import { deviceNickname } from '../../domain/device-nickname.js';
 import { passkeyCeremonyId } from '../../domain/identifiers.js';
 import { AuthorizationDomainError } from '../../domain/errors.js';
-const registrationResponseSchema = z.object({
-    id: z.string().min(1), rawId: z.string().min(1), type: z.literal('public-key'),
-    response: z.object({ clientDataJSON: z.string().min(1), attestationObject: z.string().min(1), authenticatorData: z.string().min(1).optional(), transports: z.array(z.enum(['ble', 'hybrid', 'internal', 'nfc', 'usb', 'cable', 'smart-card'])).optional(), publicKeyAlgorithm: z.number().int().optional(), publicKey: z.string().min(1).optional() }).strict(),
-    authenticatorAttachment: z.enum(['platform', 'cross-platform']).optional(), clientExtensionResults: z.record(z.string(), z.unknown()),
-}).strict();
-const requestSchema = z.object({ response: registrationResponseSchema, nickname: z.string() }).strict();
+import { clearAuthCookie, setAuthCookie } from '../../http/cookies.js';
+const registrationResponseSchema = z
+    .object({
+    id: z.string().min(1),
+    rawId: z.string().min(1),
+    type: z.literal('public-key'),
+    response: z
+        .object({
+        clientDataJSON: z.string().min(1),
+        attestationObject: z.string().min(1),
+        authenticatorData: z.string().min(1).optional(),
+        transports: z
+            .array(z.enum(['ble', 'hybrid', 'internal', 'nfc', 'usb', 'cable', 'smart-card']))
+            .optional(),
+        publicKeyAlgorithm: z.number().int().optional(),
+        publicKey: z.string().min(1).optional(),
+    })
+        .strict(),
+    authenticatorAttachment: z.enum(['platform', 'cross-platform']).optional(),
+    clientExtensionResults: z.record(z.string(), z.unknown()),
+})
+    .strict();
+const requestSchema = z
+    .object({ response: registrationResponseSchema, nickname: z.string() })
+    .strict();
 const successSchema = z.object({ status: z.literal('authenticated') }).strict();
 const sessionLifetimeMs = 30 * 24 * 60 * 60 * 1000;
 export function registerRegistrationVerification(app, deps) {
-    app.post('/api/auth/register/verify', async (request, reply) => {
+    app.post('/api/auth/register/verify', { bodyLimit: 128 * 1024 }, async (request, reply) => {
         const parsed = requestSchema.safeParse(request.body);
         const token = request.cookies.gestalt_mobile_registration;
         if (!parsed.success || typeof token !== 'string')
-            return reply.code(400).type('application/problem+json').send(problem('INVALID_REGISTRATION_REQUEST', 400, 'The registration request is invalid.'));
+            return reply
+                .code(400)
+                .type('application/problem+json')
+                .send(problem('INVALID_REGISTRATION_REQUEST', 400, 'The registration request is invalid.'));
         let nickname;
         try {
             nickname = deviceNickname(parsed.data.nickname);
         }
         catch (error) {
             if (error instanceof AuthorizationDomainError)
-                return reply.code(400).type('application/problem+json').send(problem('INVALID_DEVICE_NICKNAME', 400, 'The device nickname is invalid.'));
+                return reply
+                    .code(400)
+                    .type('application/problem+json')
+                    .send(problem('INVALID_DEVICE_NICKNAME', 400, 'The device nickname is invalid.'));
             throw error;
         }
         const now = deps.clock.now();
         const ceremony = deps.repository.readCeremony(passkeyCeremonyId(token), now.toISOString());
         if (!ceremony || ceremony.purpose !== 'registration')
-            return reply.code(400).type('application/problem+json').send(problem('REGISTRATION_NOT_AVAILABLE', 400, 'Registration could not be completed.'));
+            return reply
+                .code(400)
+                .type('application/problem+json')
+                .send(problem('REGISTRATION_NOT_AVAILABLE', 400, 'Registration could not be completed.'));
         try {
-            const verified = await deps.webauthn.verifyRegistration({ response: parsed.data.response, challenge: ceremony.challenge, expectedOrigin: ceremony.expectedOrigin, rpId: ceremony.rpId });
+            const verified = await deps.webauthn.verifyRegistration({
+                response: parsed.data.response,
+                challenge: ceremony.challenge,
+                expectedOrigin: ceremony.expectedOrigin,
+                rpId: ceremony.rpId,
+            });
             if (!verified.userVerified)
                 throw new PasskeyVerificationError('PASSKEY_VERIFICATION_FAILED');
-            const device = { id: deps.identifiers.deviceId(), credentialId: verified.credentialId, publicKey: verified.publicKey, counter: verified.counter, transports: verified.transports, deviceType: verified.deviceType, backedUp: verified.backedUp, nickname, createdAt: now.toISOString() };
+            const device = {
+                id: deps.identifiers.deviceId(),
+                credentialId: verified.credentialId,
+                publicKey: verified.publicKey,
+                counter: verified.counter,
+                transports: verified.transports,
+                deviceType: verified.deviceType,
+                backedUp: verified.backedUp,
+                nickname,
+                createdAt: now.toISOString(),
+            };
             const session = deps.identifiers.sessionId();
             if (Buffer.from(session, 'base64url').length !== 32)
                 throw new Error('AUTHORIZATION_RANDOMNESS_INVALID');
             const expiresAt = new Date(now.getTime() + sessionLifetimeMs).toISOString();
-            const outcome = deps.repository.completeRegistration({ ceremony: passkeyCeremonyId(token), now: now.toISOString(), device, session: { id: session, deviceId: device.id, expiresAt } });
+            const outcome = deps.repository.completeRegistration({
+                ceremony: passkeyCeremonyId(token),
+                now: now.toISOString(),
+                device,
+                session: { id: session, deviceId: device.id, expiresAt },
+            });
             if (outcome !== 'registered')
-                return reply.code(outcome === 'bootstrapAlreadyClaimed' ? 409 : 400).type('application/problem+json').send(problem(outcome === 'bootstrapAlreadyClaimed' ? 'BOOTSTRAP_ALREADY_CLAIMED' : 'REGISTRATION_NOT_AVAILABLE', outcome === 'bootstrapAlreadyClaimed' ? 409 : 400, 'Registration could not be completed.'));
-            reply.setCookie('gestalt_mobile_session', session, { httpOnly: true, sameSite: 'strict', path: '/', secure: deps.relyingParty.publicOrigin.startsWith('https://'), maxAge: 30 * 24 * 60 * 60 });
-            reply.clearCookie('gestalt_mobile_registration', { path: '/' });
+                return reply
+                    .code(outcome === 'bootstrapAlreadyClaimed' ? 409 : 400)
+                    .type('application/problem+json')
+                    .send(problem(outcome === 'bootstrapAlreadyClaimed'
+                    ? 'BOOTSTRAP_ALREADY_CLAIMED'
+                    : 'REGISTRATION_NOT_AVAILABLE', outcome === 'bootstrapAlreadyClaimed' ? 409 : 400, 'Registration could not be completed.'));
+            setAuthCookie(reply, 'gestalt_mobile_session', session, deps.relyingParty.publicOrigin);
+            clearAuthCookie(reply, 'gestalt_mobile_registration', deps.relyingParty.publicOrigin);
             return reply.code(201).send(successSchema.parse({ status: 'authenticated' }));
         }
         catch (error) {
             if (error instanceof PasskeyVerificationError || error instanceof AuthorizationDomainError)
-                return reply.code(400).type('application/problem+json').send(problem('REGISTRATION_VERIFICATION_FAILED', 400, 'Registration could not be completed.'));
+                return reply
+                    .code(400)
+                    .type('application/problem+json')
+                    .send(problem('REGISTRATION_VERIFICATION_FAILED', 400, 'Registration could not be completed.'));
             throw error;
         }
     });

package/dist/server/server/features/auth/register-routes.js

@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2026 Dyne.org foundation
+ * Designed by Denis Roio <jaromil@dyne.org>
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+import { ExpiringCeremonyAttemptGate } from './application/ceremony-attempts.js';
+import { registerListAuthorizedDevices } from './devices/list/endpoint.js';
+import { registerRenameAuthorizedDevice } from './devices/rename/endpoint.js';
+import { registerRevokeAuthorizedDevice } from './devices/revoke/endpoint.js';
+import { registerCancelEnrollmentTicket } from './enrollment-tickets/cancel/endpoint.js';
+import { registerCreateEnrollmentTicket } from './enrollment-tickets/endpoint.js';
+import { registerEnrollmentTicketStatus } from './enrollment-tickets/status/endpoint.js';
+import { registerLoginOptions } from './login/options/endpoint.js';
+import { registerLoginVerification } from './login/verify/endpoint.js';
+import { registerLogout } from './logout/endpoint.js';
+import { registerRegistrationOptions } from './register/options/endpoint.js';
+import { registerRegistrationVerification } from './register/verify/endpoint.js';
+import { registerAuthStatus, registerDisabledAuthStatus } from './status/endpoint.js';
+/** Registers the complete passkey surface; authorization hooks are composed by app.ts first. */
+export function registerAuthRoutes(app, deps) {
+    if (deps.auth) {
+        const auth = {
+            ...deps.auth,
+            ceremonyAttempts: deps.auth.ceremonyAttempts ?? new ExpiringCeremonyAttemptGate(),
+        };
+        registerRegistrationOptions(app, auth);
+        registerRegistrationVerification(app, deps.auth);
+        registerLoginOptions(app, auth);
+        registerLoginVerification(app, deps.auth);
+        registerAuthStatus(app, deps.auth);
+        registerLogout(app, deps.auth);
+        registerListAuthorizedDevices(app, deps.auth);
+        registerRenameAuthorizedDevice(app, deps.auth);
+        registerRevokeAuthorizedDevice(app, deps.auth);
+        registerCreateEnrollmentTicket(app, deps.auth);
+        registerEnrollmentTicketStatus(app, deps.auth);
+        registerCancelEnrollmentTicket(app, deps.auth);
+    }
+    else if (deps.passkeyAuthDisabled)
+        registerDisabledAuthStatus(app);
+}

package/dist/server/server/features/git/checkout-branch/endpoint.js

@@ -7,7 +7,7 @@ import { z } from 'zod';
 import { resolveRepositoryTarget } from '../application/repository-target.js';
 const requestSchema = z.object({ branch: z.string().min(1) });
 export function registerCheckoutBranch(app, deps) {
-    app.post('/api/git/repositories/:workspaceId/checkout', async (request, reply) => {
+    app.post('/api/git/repositories/:workspaceId/checkout', { bodyLimit: 8 * 1024 }, async (request, reply) => {
         const target = await resolveRepositoryTarget(deps.workspaces, request.params.workspaceId);
         if (!target.ok)
             return reply.code(target.statusCode).send({ code: target.code });

package/dist/server/server/features/git/clone-repository/endpoint.js

@@ -10,7 +10,7 @@ const requestSchema = z.object({
     workspaceId: z.string().trim().min(1),
 });
 export function registerCloneRepository(app, deps) {
-    app.post('/api/git/clone', async (request, reply) => {
+    app.post('/api/git/clone', { bodyLimit: 8 * 1024 }, async (request, reply) => {
         const parsed = requestSchema.safeParse(request.body);
         if (!parsed.success)
             return reply.code(400).send({ code: 'INVALID_CLONE_ADDRESS' });

package/dist/server/server/features/git/register-routes.js

@@ -0,0 +1,34 @@
+/*
+ * Copyright (C) 2026 Dyne.org foundation
+ * Designed by Denis Roio <jaromil@dyne.org>
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+import { registerCheckoutBranch } from './checkout-branch/endpoint.js';
+import { registerCloneRepository } from './clone-repository/endpoint.js';
+import { registerGetGitSummary } from './get-summary/endpoint.js';
+import { registerPullRebase } from './pull-rebase/endpoint.js';
+import { registerPushUpstream } from './push-upstream/endpoint.js';
+import { registerRefreshGit } from './refresh/endpoint.js';
+export function registerGitRoutes(app, deps) {
+    const git = deps.gitSummary;
+    if (!git)
+        return;
+    registerGetGitSummary(app, { workspaces: git.workspaces, inspect: git.inspect });
+    registerPushUpstream(app, {
+        workspaces: git.workspaces,
+        inspect: git.inspectForPush ?? git.inspect,
+        push: git.push,
+        idempotency: git.idempotency,
+    });
+    registerRefreshGit(app, {
+        workspaces: git.workspaces,
+        refresh: git.refresh,
+        idempotency: git.idempotency,
+    });
+    if (git.pull && git.checkout) {
+        registerPullRebase(app, { workspaces: git.workspaces, pull: git.pull });
+        registerCheckoutBranch(app, { workspaces: git.workspaces, checkout: git.checkout });
+    }
+    if (git.clone)
+        registerCloneRepository(app, { workspaces: git.workspaces, clone: git.clone });
+}

package/dist/server/server/features/plans/application/measurement-snapshot.js

@@ -19,7 +19,7 @@ export function weeklyRateLimitWindow(windows) {
         Number.isFinite(window.usedPercent) &&
         window.usedPercent >= 0 &&
         window.usedPercent <= 100);
-    return valid.reduce((weekly, window) => (!weekly || window.durationSeconds > weekly.durationSeconds ? window : weekly), null);
+    return valid.reduce((weekly, window) => !weekly || window.durationSeconds > weekly.durationSeconds ? window : weekly, null);
 }
 export function weeklyRemainingPercent(windows) {
     const weekly = weeklyRateLimitWindow(windows);

package/dist/server/server/features/plans/get-measurement/endpoint.js

@@ -6,9 +6,7 @@
 export function registerGetPlanMeasurement(app, deps) {
     app.get('/api/sessions/:id/plan-measurement', async (request, reply) => {
         const id = request.params.id;
-        const authorization = typeof request.headers.authorization === 'string'
-            ? request.headers.authorization
-            : undefined;
+        const authorization = typeof request.headers.authorization === 'string' ? request.headers.authorization : undefined;
         if (!deps.exists(id) || !deps.authorize(id, authorization))
             return reply.code(404).send({ code: 'SESSION_NOT_FOUND' });
         try {

package/dist/server/server/features/plans/register-routes.js

@@ -0,0 +1,22 @@
+/*
+ * Copyright (C) 2026 Dyne.org foundation
+ * Designed by Denis Roio <jaromil@dyne.org>
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+import { registerClosePlan } from './close-plan/endpoint.js';
+import { registerGetPlanMeasurement } from './get-measurement/endpoint.js';
+import { registerGetPlan } from './get-plan/endpoint.js';
+import { registerGetWorkspacePlan } from './get-workspace-plan/endpoint.js';
+import { registerListWorkspacePlans } from './list-workspace-plans/endpoint.js';
+export function registerPlanRoutes(app, deps) {
+    if (deps.planRoutes) {
+        registerGetPlan(app, deps.planRoutes);
+        registerClosePlan(app, deps.planRoutes);
+    }
+    if (deps.workspacePlanRoutes) {
+        registerListWorkspacePlans(app, deps.workspacePlanRoutes);
+        registerGetWorkspacePlan(app, deps.workspacePlanRoutes);
+    }
+    if (deps.planMeasurementRoutes)
+        registerGetPlanMeasurement(app, deps.planMeasurementRoutes);
+}

package/dist/server/server/features/sessions/interaction/kind.js

@@ -4,5 +4,11 @@
  * SPDX-License-Identifier: AGPL-3.0-or-later
  */
 export function isInteractionKind(value) {
-    return ['commandApproval', 'fileChangeApproval', 'permissionsApproval', 'userInput', 'quiz'].includes(value);
+    return [
+        'commandApproval',
+        'fileChangeApproval',
+        'permissionsApproval',
+        'userInput',
+        'quiz',
+    ].includes(value);
 }

package/dist/server/server/features/sessions/list-recent-threads/endpoint.js

@@ -15,7 +15,9 @@ export function registerListRecentThreads(app, deps) {
                 recencyAt,
                 ...(metadata?.model === undefined ? {} : { model: metadata.model }),
                 ...(metadata?.skillProfile === undefined ? {} : { skillProfile: metadata.skillProfile }),
-                ...(metadata?.orgPlanFilename === undefined ? {} : { orgPlanFilename: metadata.orgPlanFilename }),
+                ...(metadata?.orgPlanFilename === undefined
+                    ? {}
+                    : { orgPlanFilename: metadata.orgPlanFilename }),
                 resumeCommand: buildResumeCommand({ profile, threadId: id, workspacePath: cwd }),
             };
         });

package/dist/server/server/features/sessions/model/relay-session.js

@@ -136,7 +136,9 @@ function copy(snapshot) {
         ...snapshot,
         ...(snapshot.effectiveSkillSelection === undefined
             ? {}
-            : { effectiveSkillSelection: createEffectiveSkillSelection(snapshot.effectiveSkillSelection) }),
+            : {
+                effectiveSkillSelection: createEffectiveSkillSelection(snapshot.effectiveSkillSelection),
+            }),
         pendingInteractions: snapshot.pendingInteractions.map((item) => ({ ...item })),
     };
 }

package/dist/server/server/features/sessions/promote-recent-thread/endpoint.js

@@ -9,7 +9,7 @@ const requestSchema = z.object({
     cwd: z.string().startsWith('/'),
 });
 export function registerPromoteRecentThread(app, deps) {
-    app.post('/api/sessions/recent-threads/open', async (request, reply) => {
+    app.post('/api/sessions/recent-threads/open', { bodyLimit: 8 * 1024 }, async (request, reply) => {
         const parsed = requestSchema.safeParse(request.body);
         if (!parsed.success)
             return reply.code(400).send({ code: 'INVALID_RECENT_THREAD' });

package/dist/server/server/features/sessions/register-routes.js

@@ -0,0 +1,138 @@
+/*
+ * Copyright (C) 2026 Dyne.org foundation
+ * Designed by Denis Roio <jaromil@dyne.org>
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+import { authorizationSessionDevice } from '../../platform/http/authorization-boundary.js';
+import { stopSession } from './lifecycle/use-case.js';
+import { registerForgetSession } from './forget-session/endpoint.js';
+import { registerGetHistory } from './get-history/endpoint.js';
+import { registerGetSession } from './get-session/endpoint.js';
+import { registerInterruptTurn } from './interrupt-turn/endpoint.js';
+import { registerListRecentThreads } from './list-recent-threads/endpoint.js';
+import { registerListSessions } from './list-sessions/endpoint.js';
+import { registerPromoteRecentThread } from './promote-recent-thread/endpoint.js';
+import { registerReleaseSession } from './release-session/endpoint.js';
+import { registerRestoreSession } from './restore-session/endpoint.js';
+import { registerRespondInteraction } from './respond-interaction/endpoint.js';
+import { registerSelectModel } from './select-model/endpoint.js';
+import { registerSessionEvents } from './session-events/endpoint.js';
+import { registerStartSession } from './start-session/endpoint.js';
+import { registerStartTurn } from './start-turn/endpoint.js';
+import { registerStopSession } from './stop-session/endpoint.js';
+export function registerSessionRoutes(app, deps) {
+    const sessions = deps.sessionRoutes;
+    if (deps.recentThreads) {
+        registerListRecentThreads(app, {
+            ...deps.recentThreads,
+            metadata: (threadId) => {
+                const session = sessions?.list?.().find((candidate) => candidate.threadId === threadId);
+                if (!session)
+                    return null;
+                return {
+                    ...(session.model === undefined ? {} : { model: session.model }),
+                    ...(session.effectiveSkillSelection?.selectedProfileName === undefined
+                        ? {}
+                        : { skillProfile: session.effectiveSkillSelection.selectedProfileName }),
+                    ...(session.lastOrgPlan === undefined
+                        ? {}
+                        : { orgPlanFilename: session.lastOrgPlan.filename }),
+                };
+            },
+        });
+    }
+    if (sessions) {
+        registerStartSession(app, {
+            ...sessions,
+            reportFailure: (operation, error) => deps.logger.error(`${operation} failed: ${safeErrorLabel(error)}`),
+        });
+        registerGetSession(app, sessions.find);
+        if (sessions.list)
+            registerListSessions(app, { list: sessions.list });
+        if (sessions.readHistory)
+            registerGetHistory(app, {
+                find: sessions.find,
+                read: sessions.readHistory,
+                currentSequence: sessions.currentSequence ?? (() => 0),
+            });
+        if (sessions.startTurn)
+            registerStartTurn(app, {
+                find: sessions.find,
+                start: sessions.startTurn,
+                save: sessions.save,
+                onStarted: sessions.onTurnStarted,
+            });
+        if (sessions.models)
+            registerSelectModel(app, {
+                find: sessions.find,
+                models: () => sessions.models.list(),
+                now: sessions.now,
+                save: sessions.save,
+            });
+        if (sessions.interruptTurn)
+            registerInterruptTurn(app, { find: sessions.find, interrupt: sessions.interruptTurn });
+        if (sessions.restore)
+            registerRestoreSession(app, {
+                find: sessions.find,
+                restore: sessions.restore,
+                save: sessions.save,
+                idempotency: sessions.idempotency,
+            });
+        if (deps.recentThreads && sessions.promoteRecent)
+            registerPromoteRecentThread(app, {
+                list: () => deps.recentThreads.list(),
+                promote: sessions.promoteRecent,
+            });
+        if (sessions.release && sessions.close)
+            registerReleaseSession(app, {
+                find: sessions.find,
+                release: sessions.release,
+                save: sessions.save,
+                close: sessions.close,
+                idempotency: sessions.idempotency,
+            });
+        if (sessions.remove && sessions.close)
+            registerForgetSession(app, {
+                find: sessions.find,
+                close: sessions.close,
+                remove: sessions.remove,
+            });
+        if (sessions.close)
+            registerStopSession(app, {
+                find: sessions.find,
+                stop: (session) => stopSession(session, sessions.now()),
+                save: sessions.save,
+                close: sessions.close,
+                idempotency: sessions.idempotency,
+            });
+        if (sessions.replyInteraction && deps.interactions)
+            registerRespondInteraction(app, {
+                exists: (id) => sessions.find(id) !== null,
+                resolve: (sessionId, requestId, resolvedAt) => deps.interactions.resolve(sessionId, requestId, resolvedAt),
+                validate: deps.interactions.validate,
+                reply: sessions.replyInteraction,
+                resolved: sessions.interactionResolved,
+                now: sessions.now,
+            });
+    }
+    if (deps.sessionEvents)
+        registerSessionEvents(app, {
+            ...deps.sessionEvents,
+            ...(deps.auth
+                ? {
+                    publicOrigin: deps.auth.relyingParty.publicOrigin,
+                    authorized: (cookieHeader) => authorizationSessionDevice(cookieHeader, deps.auth) !== null,
+                }
+                : {}),
+        });
+}
+function safeErrorLabel(error) {
+    if (typeof error === 'object' && error !== null && 'code' in error) {
+        const code = error.code;
+        if (typeof code === 'string' && /^[A-Z0-9_]+$/.test(code))
+            return code;
+    }
+    if (error instanceof Error && /^[A-Z0-9_]+$/.test(error.message))
+        return error.message;
+    return error instanceof Error ? error.name : 'UNKNOWN_ERROR';
+}

package/dist/server/server/features/sessions/respond-interaction/endpoint.js

@@ -4,7 +4,7 @@
  * SPDX-License-Identifier: AGPL-3.0-or-later
  */
 export function registerRespondInteraction(app, deps) {
-    app.post('/api/sessions/:id/interactions/:requestId', async (request, reply) => {
+    app.post('/api/sessions/:id/interactions/:requestId', { bodyLimit: 64 * 1024 }, async (request, reply) => {
         const { id, requestId } = request.params;
         if (!deps.exists(id))
             return reply.code(404).send({ code: 'SESSION_NOT_FOUND' });

package/dist/server/server/features/sessions/select-model/endpoint.js

@@ -5,7 +5,7 @@
  */
 import { RelaySession } from '../model/relay-session.js';
 export function registerSelectModel(app, deps) {
-    app.post('/api/sessions/:id/model', async (request, reply) => {
+    app.post('/api/sessions/:id/model', { bodyLimit: 4 * 1024 }, async (request, reply) => {
         const session = deps.find(request.params.id);
         if (!session)
             return reply.code(404).send({ code: 'SESSION_NOT_FOUND' });

package/dist/server/server/features/sessions/start-session/endpoint.js

@@ -9,7 +9,7 @@ import { startSession } from './use-case.js';
 import { SkillProfileError } from '../../skills/model/errors.js';
 import { problem } from '../../../platform/http/problem.js';
 export function registerStartSession(app, deps) {
-    app.post('/api/sessions', async (request, reply) => {
+    app.post('/api/sessions', { bodyLimit: 4 * 1024 }, async (request, reply) => {
         const key = idempotencyKey(request.headers);
         const prior = key ? deps.idempotency?.get('start-session', key) : null;
         if (prior)
@@ -31,7 +31,10 @@ export function registerStartSession(app, deps) {
         catch (error) {
             deps.reportFailure?.('start-session', error);
             if (error instanceof SkillProfileError)
-                return reply.code(400).type('application/problem+json').send(problem(error.code, 400, error.code === 'UNKNOWN_SKILL_PROFILE'
+                return reply
+                    .code(400)
+                    .type('application/problem+json')
+                    .send(problem(error.code, 400, error.code === 'UNKNOWN_SKILL_PROFILE'
                     ? 'The selected skill profile does not exist.'
                     : 'The selected skill profile is invalid.'));
             throw error;

package/dist/server/server/features/sessions/start-session/use-case.js

@@ -4,7 +4,7 @@
  * SPDX-License-Identifier: AGPL-3.0-or-later
  */
 import { RelaySession } from '../model/relay-session.js';
-import { DEFAULT_SESSION_MODEL, } from '../application/start-settings.js';
+import { DEFAULT_SESSION_MODEL } from '../application/start-settings.js';
 import { applySkillSelectionSnapshot, } from '../../skills/model/skill-profile.js';
 import { SkillProfileError } from '../../skills/model/errors.js';
 export async function startSession(input, deps) {

package/dist/server/server/features/sessions/start-turn/endpoint.js

@@ -4,7 +4,8 @@
  * SPDX-License-Identifier: AGPL-3.0-or-later
  */
 export function registerStartTurn(app, deps) {
-    app.post('/api/sessions/:id/turns', async (request, reply) => {
+    // Text is capped at 100,000 characters; leave room for JSON encoding only.
+    app.post('/api/sessions/:id/turns', { bodyLimit: 128 * 1024 }, async (request, reply) => {
         const session = deps.find(request.params.id);
         if (!session)
             return reply.code(404).send({ code: 'SESSION_NOT_FOUND' });

package/dist/server/server/features/skills/delete-profile/endpoint.js

@@ -12,13 +12,22 @@ export function registerDeleteSkillProfile(app, deps) {
         try {
             const name = normalizeSkillProfileName(request.params.name);
             if (!(await deps.deleteGlobalProfile(name)))
-                return reply.code(404).type('application/problem+json').send(problem('SKILL_PROFILE_NOT_FOUND', 404, 'The skill profile was not found.'));
+                return reply
+                    .code(404)
+                    .type('application/problem+json')
+                    .send(problem('SKILL_PROFILE_NOT_FOUND', 404, 'The skill profile was not found.'));
             return reply.code(204).send();
         }
         catch (error) {
             if (error instanceof SkillProfileError)
-                return reply.code(400).type('application/problem+json').send(problem('INVALID_SKILL_PROFILE', 400, 'The skill profile could not be deleted.'));
-            return reply.code(500).type('application/problem+json').send(problem('SKILL_PROFILE_PERSISTENCE_FAILED', 500, 'The skill profile could not be deleted.', true));
+                return reply
+                    .code(400)
+                    .type('application/problem+json')
+                    .send(problem('INVALID_SKILL_PROFILE', 400, 'The skill profile could not be deleted.'));
+            return reply
+                .code(500)
+                .type('application/problem+json')
+                .send(problem('SKILL_PROFILE_PERSISTENCE_FAILED', 500, 'The skill profile could not be deleted.', true));
         }
     });
 }