gestalt-mobile 0.14.0 → 0.15.0

package/dist/client/icons/gestalt-mobile.svg

@@ -0,0 +1,10 @@
+<!--
+Copyright (C) 2026 Dyne.org foundation
+Designed by Denis Roio <jaromil@dyne.org>
+SPDX-License-Identifier: AGPL-3.0-or-later
+-->
+
+<svg xmlns="http://www.w3.org/2000/svg" width="100%" height="100%" viewBox="0 0 512 512">
+  <rect width="512" height="512" fill="#141414" />
+  <image href="../branding/p_glogo_white.svg" x="64" y="64" width="384" height="384" />
+</svg>

package/dist/client/index.html

@@ -10,9 +10,14 @@ SPDX-License-Identifier: AGPL-3.0-or-later
     <meta charset="UTF-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1" />
     <meta name="color-scheme" content="light dark" />
-    <title>Codex Relay</title>
-    <script type="module" crossorigin src="/assets/index-tMyOolAm.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-C5qFcFUg.css">
+    <meta name="theme-color" content="#141414" />
+    <meta name="application-name" content="Gestalt Mobile" />
+    <link rel="manifest" href="/manifest.webmanifest" />
+    <link rel="icon" href="/icons/gestalt-mobile-192.png" />
+    <link rel="apple-touch-icon" href="/icons/gestalt-mobile-180.png" />
+    <title>Gestalt Mobile</title>
+    <script type="module" crossorigin src="/assets/index-Dnm_kS5p.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-2L2KZzwK.css">
   </head>
   <body>
     <div id="app"></div>

package/dist/client/manifest.webmanifest

@@ -0,0 +1,32 @@
+{
+  "id": "/",
+  "name": "Gestalt Mobile",
+  "short_name": "Gestalt",
+  "description": "A mobile interface for durable Codex development sessions.",
+  "start_url": "/",
+  "scope": "/",
+  "display": "standalone",
+  "background_color": "#141414",
+  "theme_color": "#141414",
+  "categories": ["productivity", "utilities"],
+  "icons": [
+    {
+      "src": "/icons/gestalt-mobile-192.png",
+      "sizes": "192x192",
+      "type": "image/png",
+      "purpose": "any"
+    },
+    {
+      "src": "/icons/gestalt-mobile-512.png",
+      "sizes": "512x512",
+      "type": "image/png",
+      "purpose": "any"
+    },
+    {
+      "src": "/icons/gestalt-mobile-maskable-512.png",
+      "sizes": "512x512",
+      "type": "image/png",
+      "purpose": "maskable"
+    }
+  ]
+}

package/dist/client/service-worker.js

@@ -0,0 +1,9 @@
+/*
+ * Copyright (C) 2026 Dyne.org foundation
+ * Designed by Denis Roio <jaromil@dyne.org>
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+// Installability only: authenticated relay data must always remain network-fresh.
+self.addEventListener('install', () => self.skipWaiting());
+self.addEventListener('activate', (event) => event.waitUntil(self.clients.claim()));

package/dist/server/server/features/auth/application/ports.js

@@ -3,6 +3,12 @@
  * Designed by Denis Roio <jaromil@dyne.org>
  * SPDX-License-Identifier: AGPL-3.0-or-later
  */
-/** Expected proof failure; adapters must translate library-specific failures to this type. */
+/** Expected proof failure; adapters translate library details to a safe diagnostic category. */
 export class PasskeyVerificationError extends Error {
+    reason;
+    constructor(reason = 'VERIFIER_REJECTED') {
+        super('PASSKEY_VERIFICATION_FAILED');
+        this.reason = reason;
+        this.name = 'PasskeyVerificationError';
+    }
 }

package/dist/server/server/features/auth/login/verify/endpoint.js

@@ -50,7 +50,7 @@ export function registerLoginVerification(app, deps) {
                 },
             });
             if (!verified.userVerified || verified.credentialId !== device.credentialId)
-                throw new PasskeyVerificationError('PASSKEY_VERIFICATION_FAILED');
+                throw new PasskeyVerificationError('USER_VERIFICATION_REQUIRED');
             const session = deps.identifiers.sessionId();
             if (Buffer.from(session, 'base64url').length !== 32)
                 throw new Error('AUTHORIZATION_RANDOMNESS_INVALID');

package/dist/server/server/features/auth/register/verify/endpoint.js

@@ -35,11 +35,20 @@ export function registerRegistrationVerification(app, deps) {
     app.post('/api/auth/register/verify', { bodyLimit: 128 * 1024 }, async (request, reply) => {
         const parsed = requestSchema.safeParse(request.body);
         const token = request.cookies.gestalt_mobile_registration;
-        if (!parsed.success || typeof token !== 'string')
+        if (!parsed.success) {
+            deps.reportVerificationFailure?.('INVALID_RESPONSE_SHAPE');
             return reply
                 .code(400)
                 .type('application/problem+json')
                 .send(problem('INVALID_REGISTRATION_REQUEST', 400, 'The registration request is invalid.'));
+        }
+        if (typeof token !== 'string') {
+            deps.reportVerificationFailure?.('MISSING_CEREMONY_COOKIE');
+            return reply
+                .code(400)
+                .type('application/problem+json')
+                .send(problem('REGISTRATION_COOKIE_MISSING', 400, 'The registration cookie is missing.'));
+        }
         let nickname;
         try {
             nickname = deviceNickname(parsed.data.nickname);
@@ -54,11 +63,13 @@ export function registerRegistrationVerification(app, deps) {
         }
         const now = deps.clock.now();
         const ceremony = deps.repository.readCeremony(passkeyCeremonyId(token), now.toISOString());
-        if (!ceremony || ceremony.purpose !== 'registration')
+        if (!ceremony || ceremony.purpose !== 'registration') {
+            deps.reportVerificationFailure?.('CEREMONY_NOT_AVAILABLE');
             return reply
                 .code(400)
                 .type('application/problem+json')
                 .send(problem('REGISTRATION_NOT_AVAILABLE', 400, 'Registration could not be completed.'));
+        }
         try {
             const verified = await deps.webauthn.verifyRegistration({
                 response: parsed.data.response,
@@ -67,7 +78,7 @@ export function registerRegistrationVerification(app, deps) {
                 rpId: ceremony.rpId,
             });
             if (!verified.userVerified)
-                throw new PasskeyVerificationError('PASSKEY_VERIFICATION_FAILED');
+                throw new PasskeyVerificationError('USER_VERIFICATION_REQUIRED');
             const device = {
                 id: deps.identifiers.deviceId(),
                 credentialId: verified.credentialId,
@@ -101,11 +112,15 @@ export function registerRegistrationVerification(app, deps) {
             return reply.code(201).send(successSchema.parse({ status: 'authenticated' }));
         }
         catch (error) {
-            if (error instanceof PasskeyVerificationError || error instanceof AuthorizationDomainError)
+            if (error instanceof PasskeyVerificationError || error instanceof AuthorizationDomainError) {
+                deps.reportVerificationFailure?.(error instanceof PasskeyVerificationError
+                    ? `WEBAUTHN_${error.reason}`
+                    : 'AUTHORIZATION_REJECTED');
                 return reply
                     .code(400)
                     .type('application/problem+json')
                     .send(problem('REGISTRATION_VERIFICATION_FAILED', 400, 'Registration could not be completed.'));
+            }
             throw error;
         }
     });

package/dist/server/server/features/auth/register-routes.js

@@ -24,7 +24,10 @@ export function registerAuthRoutes(app, deps) {
             ceremonyAttempts: deps.auth.ceremonyAttempts ?? new ExpiringCeremonyAttemptGate(),
         };
         registerRegistrationOptions(app, auth);
-        registerRegistrationVerification(app, deps.auth);
+        registerRegistrationVerification(app, {
+            ...deps.auth,
+            reportVerificationFailure: (reason) => deps.logger.warn(`Passkey registration verification failed: ${reason}`),
+        });
         registerLoginOptions(app, auth);
         registerLoginVerification(app, deps.auth);
         registerAuthStatus(app, deps.auth);

package/dist/server/server/platform/auth/simple-webauthn-adapter.js

@@ -7,6 +7,32 @@ import { generateAuthenticationOptions, generateRegistrationOptions, verifyAuthe
 import { PasskeyVerificationError } from '../../features/auth/application/ports.js';
 import { webAuthnCredentialId } from '../../features/auth/domain/identifiers.js';
 const transports = new Set(['ble', 'hybrid', 'internal', 'nfc', 'usb']);
+function verificationFailure(error) {
+    const message = error instanceof Error ? error.message.toLowerCase() : '';
+    if (message.includes('challenge'))
+        return 'CHALLENGE_MISMATCH';
+    if (message.includes('origin'))
+        return 'ORIGIN_MISMATCH';
+    if (message.includes('rp id') || message.includes('rpid'))
+        return 'RP_ID_MISMATCH';
+    if (message.includes('user presence'))
+        return 'USER_PRESENCE_REQUIRED';
+    if (message.includes('user verification'))
+        return 'USER_VERIFICATION_REQUIRED';
+    if (message.includes('credential id') || message.includes('base64'))
+        return 'CREDENTIAL_ENCODING_INVALID';
+    if (message.includes('alg') || message.includes('cose'))
+        return 'ALGORITHM_UNSUPPORTED';
+    if (message.includes('public key') ||
+        message.includes('aaguid') ||
+        message.includes('authenticator data'))
+        return 'CREDENTIAL_MATERIAL_MISSING';
+    if (message.includes('attestation'))
+        return 'ATTESTATION_UNSUPPORTED';
+    if (message.includes('signature'))
+        return 'SIGNATURE_INVALID';
+    return 'VERIFIER_REJECTED';
+}
 /** Translates SimpleWebAuthn DTOs at the platform boundary. */
 export class SimpleWebAuthnAdapter {
     async registrationOptions(input) {
@@ -47,11 +73,11 @@ export class SimpleWebAuthnAdapter {
                 supportedAlgorithmIDs: [-7, -257],
             });
         }
-        catch {
-            throw new PasskeyVerificationError('PASSKEY_VERIFICATION_FAILED');
+        catch (error) {
+            throw new PasskeyVerificationError(verificationFailure(error));
         }
         if (!result.verified || !result.registrationInfo?.userVerified)
-            throw new PasskeyVerificationError('PASSKEY_VERIFICATION_FAILED');
+            throw new PasskeyVerificationError('VERIFIER_REJECTED');
         const credential = result.registrationInfo.credential;
         return {
             credentialId: webAuthnCredentialId(credential.id),
@@ -81,11 +107,11 @@ export class SimpleWebAuthnAdapter {
                 },
             });
         }
-        catch {
-            throw new PasskeyVerificationError('PASSKEY_VERIFICATION_FAILED');
+        catch (error) {
+            throw new PasskeyVerificationError(verificationFailure(error));
         }
         if (!result.verified || !result.authenticationInfo?.userVerified)
-            throw new PasskeyVerificationError('PASSKEY_VERIFICATION_FAILED');
+            throw new PasskeyVerificationError('VERIFIER_REJECTED');
         return {
             credentialId: webAuthnCredentialId(value.response.id),
             counter: result.authenticationInfo.newCounter,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gestalt-mobile",
-  "version": "0.14.0",
+  "version": "0.15.0",
   "description": "Mobile-first web relay for durable Codex development sessions",
   "keywords": [
     "codex",