gestalt-mobile 0.9.0 → 0.11.0

package/dist/server/server/features/auth/devices/application.js

@@ -0,0 +1,26 @@
+/*
+ * Copyright (C) 2026 Dyne.org foundation
+ * Designed by Denis Roio <jaromil@dyne.org>
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+import { deviceNickname } from '../domain/device-nickname.js';
+/** Maps a credential to deliberately non-WebAuthn management metadata. */
+export function listAuthorizedDeviceMetadata(repository, currentDeviceId) {
+    return repository.listAuthorizedDevices().map((device) => ({
+        id: device.id,
+        nickname: device.nickname,
+        createdAt: device.createdAt,
+        ...(device.lastUsedAt === undefined ? {} : { lastUsedAt: device.lastUsedAt }),
+        current: device.id === currentDeviceId,
+    }));
+}
+export function renameAuthorizedDevice(repository, id, nickname) {
+    const validated = deviceNickname(nickname);
+    const current = repository.findDevice(id);
+    if (!current)
+        return 'notFound';
+    return repository.renameDevice(id, current.version ?? 0, validated);
+}
+export function revokeAuthorizedDevice(repository, id, revokedAt) {
+    return repository.revokeDevice(id, revokedAt);
+}

package/dist/server/server/features/auth/devices/list/endpoint.js

@@ -0,0 +1,12 @@
+/*
+ * Copyright (C) 2026 Dyne.org foundation
+ * Designed by Denis Roio <jaromil@dyne.org>
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+import { authorizationSessionDevice } from '../../../../platform/http/authorization-boundary.js';
+import { listAuthorizedDeviceMetadata } from '../application.js';
+export function registerListAuthorizedDevices(app, deps) {
+    app.get('/api/auth/devices', async (request) => ({
+        devices: listAuthorizedDeviceMetadata(deps.repository, authorizationSessionDevice(request.headers.cookie, deps)),
+    }));
+}

package/dist/server/server/features/auth/devices/rename/endpoint.js

@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2026 Dyne.org foundation
+ * Designed by Denis Roio <jaromil@dyne.org>
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+import { z } from 'zod';
+import { AuthorizationDomainError } from '../../domain/errors.js';
+import { authorizedDeviceId } from '../../domain/identifiers.js';
+import { problem } from '../../../../platform/http/problem.js';
+import { renameAuthorizedDevice } from '../application.js';
+const parameters = z.object({ deviceId: z.string().min(1).max(200) }).strict();
+const requestBody = z.object({ nickname: z.string() }).strict();
+export function registerRenameAuthorizedDevice(app, deps) {
+    app.patch('/api/auth/devices/:deviceId', async (request, reply) => {
+        const params = parameters.safeParse(request.params);
+        const body = requestBody.safeParse(request.body);
+        if (!params.success || !body.success)
+            return unavailable(reply, 400, 'INVALID_DEVICE_REQUEST');
+        try {
+            const outcome = renameAuthorizedDevice(deps.repository, authorizedDeviceId(params.data.deviceId), body.data.nickname);
+            if (outcome === 'renamed')
+                return reply.code(204).send();
+            return unavailable(reply, outcome === 'stale' ? 409 : 404, 'DEVICE_NOT_AVAILABLE');
+        }
+        catch (error) {
+            if (error instanceof AuthorizationDomainError)
+                return unavailable(reply, 400, 'INVALID_DEVICE_REQUEST');
+            throw error;
+        }
+    });
+}
+function unavailable(reply, status, code) {
+    return reply
+        .code(status)
+        .type('application/problem+json')
+        .send(problem(code, status, 'The requested device is not available.'));
+}

package/dist/server/server/features/auth/devices/revoke/endpoint.js

@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2026 Dyne.org foundation
+ * Designed by Denis Roio <jaromil@dyne.org>
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+import { z } from 'zod';
+import { AuthorizationDomainError } from '../../domain/errors.js';
+import { authorizedDeviceId } from '../../domain/identifiers.js';
+import { problem } from '../../../../platform/http/problem.js';
+import { authorizationSessionDevice } from '../../../../platform/http/authorization-boundary.js';
+import { revokeAuthorizedDevice } from '../application.js';
+const parameters = z.object({ deviceId: z.string().min(1).max(200) }).strict();
+export function registerRevokeAuthorizedDevice(app, deps) {
+    app.delete('/api/auth/devices/:deviceId', async (request, reply) => {
+        const params = parameters.safeParse(request.params);
+        if (!params.success)
+            return unavailable(reply, 400, 'INVALID_DEVICE_REQUEST');
+        try {
+            const id = authorizedDeviceId(params.data.deviceId);
+            const current = authorizationSessionDevice(request.headers.cookie, deps);
+            const outcome = revokeAuthorizedDevice(deps.repository, id, deps.clock.now().toISOString());
+            if (outcome === 'finalDevice')
+                return reply
+                    .code(409)
+                    .type('application/problem+json')
+                    .send(problem('LAST_DEVICE_REQUIRED', 409, 'At least one authorized device is required.'));
+            if (outcome === 'notFound')
+                return unavailable(reply, 404, 'DEVICE_NOT_AVAILABLE');
+            if (current === id)
+                reply.clearCookie('gestalt_mobile_session', {
+                    path: '/', httpOnly: true, sameSite: 'strict',
+                    secure: deps.relyingParty.publicOrigin.startsWith('https://'),
+                });
+            return reply.code(204).send();
+        }
+        catch (error) {
+            if (error instanceof AuthorizationDomainError)
+                return unavailable(reply, 400, 'INVALID_DEVICE_REQUEST');
+            throw error;
+        }
+    });
+}
+function unavailable(reply, status, code) {
+    return reply
+        .code(status)
+        .type('application/problem+json')
+        .send(problem(code, status, 'The requested device is not available.'));
+}

package/dist/server/server/features/auth/domain/authorization.js

@@ -0,0 +1,101 @@
+/*
+ * Copyright (C) 2026 Dyne.org foundation
+ * Designed by Denis Roio <jaromil@dyne.org>
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+import { AuthorizationDomainError } from './errors.js';
+export class LocalOwnerAuthorization {
+    ownerValue;
+    devices;
+    constructor(ownerValue, devices) {
+        this.ownerValue = ownerValue;
+        this.devices = devices;
+    }
+    static bootstrap(owner, firstDevice) {
+        const device = copyDevice(firstDevice);
+        assertUniqueDeviceIds([device]);
+        return withOutcome(new LocalOwnerAuthorization(copyOwner(owner), [device]), {
+            kind: 'firstDeviceAuthorized',
+            device: copyDevice(device),
+        });
+    }
+    static rehydrate(owner, devices) {
+        if (devices.length < 1)
+            throw new AuthorizationDomainError('AUTHORIZED_DEVICE_REQUIRED');
+        assertUniqueDeviceIds(devices);
+        assertUniqueCredentials(devices);
+        return new LocalOwnerAuthorization(copyOwner(owner), devices.map(copyDevice));
+    }
+    get owner() {
+        return copyOwner(this.ownerValue);
+    }
+    get authorizedDevices() {
+        return this.devices.map(copyDevice);
+    }
+    authorizeDevice(device) {
+        assertUniqueDeviceIds([...this.devices, device]);
+        assertUniqueCredentials([...this.devices, device]);
+        return withOutcome(new LocalOwnerAuthorization(this.ownerValue, [...this.devices, copyDevice(device)]), { kind: 'deviceAuthorized', device: copyDevice(device) });
+    }
+    renameDevice(id, nickname) {
+        const device = this.requireDevice(id);
+        const renamed = { ...device, nickname };
+        return withOutcome(new LocalOwnerAuthorization(this.ownerValue, this.devices.map((entry) => (entry.id === id ? renamed : entry))), { kind: 'deviceRenamed', device: copyDevice(renamed) });
+    }
+    recordAssertion(id, counter, usedAt) {
+        const device = this.requireDevice(id);
+        if (!Number.isInteger(counter) || counter < 0)
+            throw new AuthorizationDomainError('CREDENTIAL_COUNTER_INVALID');
+        const allowsZeroCounter = device.counter === 0 && counter === 0 && device.deviceType === 'multiDevice';
+        if (!allowsZeroCounter && counter <= device.counter)
+            throw new AuthorizationDomainError('CREDENTIAL_COUNTER_NOT_MONOTONIC');
+        const updated = { ...device, counter, lastUsedAt: usedAt };
+        return new LocalOwnerAuthorization(this.ownerValue, this.devices.map((entry) => (entry.id === id ? updated : entry)));
+    }
+    revokeDevice(id) {
+        this.requireDevice(id);
+        if (this.devices.length === 1)
+            throw new AuthorizationDomainError('AUTHORIZED_DEVICE_REQUIRED');
+        return withOutcome(new LocalOwnerAuthorization(this.ownerValue, this.devices.filter((device) => device.id !== id)), { kind: 'deviceRevoked', deviceId: id });
+    }
+    requireDevice(id) {
+        const device = this.devices.find((entry) => entry.id === id);
+        if (!device)
+            throw new AuthorizationDomainError('AUTHORIZED_DEVICE_NOT_FOUND');
+        return device;
+    }
+}
+function withOutcome(value, outcome) {
+    return Object.freeze(Object.assign(value, { outcome }));
+}
+function assertUniqueCredentials(devices) {
+    if (new Set(devices.map((device) => device.credentialId)).size !== devices.length)
+        throw new AuthorizationDomainError('CREDENTIAL_ALREADY_AUTHORIZED');
+}
+function assertUniqueDeviceIds(devices) {
+    if (new Set(devices.map((device) => device.id)).size !== devices.length)
+        throw new AuthorizationDomainError('AUTHORIZED_DEVICE_ID_ALREADY_AUTHORIZED');
+}
+function copyOwner(owner) {
+    if (owner.userHandle.length < 1)
+        throw new AuthorizationDomainError('LOCAL_OWNER_HANDLE_INVALID');
+    return Object.freeze({ ...owner, userHandle: new Uint8Array(owner.userHandle) });
+}
+function copyDevice(device) {
+    if (!Number.isInteger(device.counter) || device.counter < 0)
+        throw new AuthorizationDomainError('CREDENTIAL_COUNTER_INVALID');
+    if (device.version !== undefined && (!Number.isInteger(device.version) || device.version < 0))
+        throw new AuthorizationDomainError('AUTHORIZED_DEVICE_VERSION_INVALID');
+    if (device.publicKey.length < 1)
+        throw new AuthorizationDomainError('CREDENTIAL_PUBLIC_KEY_INVALID');
+    if (Number.isNaN(Date.parse(device.createdAt)))
+        throw new AuthorizationDomainError('AUTHORIZED_DEVICE_TIMESTAMP_INVALID');
+    if (device.lastUsedAt && Number.isNaN(Date.parse(device.lastUsedAt)))
+        throw new AuthorizationDomainError('AUTHORIZED_DEVICE_TIMESTAMP_INVALID');
+    return Object.freeze({
+        ...device,
+        version: device.version ?? 0,
+        publicKey: new Uint8Array(device.publicKey),
+        transports: Object.freeze([...device.transports]),
+    });
+}

package/dist/server/server/features/auth/domain/device-nickname.js

@@ -0,0 +1,13 @@
+/*
+ * Copyright (C) 2026 Dyne.org foundation
+ * Designed by Denis Roio <jaromil@dyne.org>
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+import { AuthorizationDomainError } from './errors.js';
+export function deviceNickname(value) {
+    const normalized = Array.from(value.trim()).join('');
+    const length = Array.from(normalized).length;
+    if (length < 1 || length > 64)
+        throw new AuthorizationDomainError('DEVICE_NICKNAME_INVALID');
+    return normalized;
+}

package/dist/server/server/features/auth/domain/errors.js

@@ -0,0 +1,7 @@
+/*
+ * Copyright (C) 2026 Dyne.org foundation
+ * Designed by Denis Roio <jaromil@dyne.org>
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+export class AuthorizationDomainError extends Error {
+}

package/dist/server/server/features/auth/domain/identifiers.js

@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2026 Dyne.org foundation
+ * Designed by Denis Roio <jaromil@dyne.org>
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+import { AuthorizationDomainError } from './errors.js';
+export function localOwnerId(value) {
+    return opaqueId(value, 'LOCAL_OWNER_ID_INVALID');
+}
+export function authorizedDeviceId(value) {
+    return opaqueId(value, 'AUTHORIZED_DEVICE_ID_INVALID');
+}
+export function webAuthnCredentialId(value) {
+    return opaqueId(value, 'CREDENTIAL_ID_INVALID');
+}
+export function passkeyCeremonyId(value) {
+    return opaqueId(value, 'PASSKEY_CEREMONY_ID_INVALID');
+}
+export function enrollmentTicketId(value) {
+    const parsed = parseEnrollmentTicketId(value);
+    if (parsed === null)
+        throw new AuthorizationDomainError('ENROLLMENT_TICKET_ID_INVALID');
+    return parsed;
+}
+export function authorizationSessionId(value) {
+    const parsed = parseAuthorizationSessionId(value);
+    if (parsed === null)
+        throw new AuthorizationDomainError('AUTHORIZATION_SESSION_ID_INVALID');
+    return parsed;
+}
+export function parseEnrollmentTicketId(value) {
+    return opaqueIdOrNull(value);
+}
+export function parseAuthorizationSessionId(value) {
+    return opaqueIdOrNull(value);
+}
+function opaqueId(value, code) {
+    const parsed = opaqueIdOrNull(value);
+    if (parsed === null)
+        throw new AuthorizationDomainError(code);
+    return parsed;
+}
+function opaqueIdOrNull(value) {
+    return typeof value === 'string' && value.length > 0 && value.trim() === value ? value : null;
+}

package/dist/server/server/features/auth/enrollment-tickets/cancel/endpoint.js

@@ -0,0 +1,14 @@
+import { z } from 'zod';
+import { parseAuthorizationSessionId } from '../../domain/identifiers.js';
+const responseSchema = z.object({ status: z.enum(['none', 'used', 'expired']) }).strict();
+export function registerCancelEnrollmentTicket(app, deps) {
+    app.delete('/api/auth/enrollment-tickets/current', async (request, reply) => {
+        const rawSession = request.cookies.gestalt_mobile_session;
+        const session = parseAuthorizationSessionId(rawSession);
+        const now = deps.clock.now().toISOString();
+        if (session === null || deps.repository.sessionDevice(session, now) === null)
+            return reply.code(401).send();
+        deps.repository.cancelEnrollmentTicket(session, now);
+        return reply.send(responseSchema.parse({ status: deps.repository.enrollmentTicketStatus(session, now) }));
+    });
+}

package/dist/server/server/features/auth/enrollment-tickets/endpoint.js

@@ -0,0 +1,17 @@
+import { enrollmentTicketId, parseAuthorizationSessionId } from '../domain/identifiers.js';
+const lifetimeMs = 10 * 60 * 1000;
+export function registerCreateEnrollmentTicket(app, deps) {
+    app.post('/api/auth/enrollment-tickets', async (request, reply) => {
+        const rawSession = request.cookies.gestalt_mobile_session;
+        const session = parseAuthorizationSessionId(rawSession);
+        if (session === null || deps.repository.sessionDevice(session, deps.clock.now().toISOString()) === null)
+            return reply.code(401).send();
+        const entropy = deps.random.bytes(32);
+        if (entropy.length < 32)
+            throw new Error('AUTHORIZATION_RANDOMNESS_INVALID');
+        const ticket = enrollmentTicketId(Buffer.from(entropy).toString('base64url'));
+        const expiresAt = new Date(deps.clock.now().getTime() + lifetimeMs).toISOString();
+        deps.repository.issueEnrollmentTicket(ticket, session, expiresAt);
+        return reply.code(201).send({ ticket, url: `${deps.relyingParty.publicOrigin.replace(/\/$/, '')}/#enroll=${ticket}`, expiresAt });
+    });
+}

package/dist/server/server/features/auth/enrollment-tickets/status/endpoint.js

@@ -0,0 +1,13 @@
+import { z } from 'zod';
+import { parseAuthorizationSessionId } from '../../domain/identifiers.js';
+const responseSchema = z.object({ status: z.enum(['none', 'pending', 'used', 'expired']) }).strict();
+export function registerEnrollmentTicketStatus(app, deps) {
+    app.get('/api/auth/enrollment-tickets/current', async (request, reply) => {
+        const rawSession = request.cookies.gestalt_mobile_session;
+        const session = parseAuthorizationSessionId(rawSession);
+        const now = deps.clock.now().toISOString();
+        if (session === null || deps.repository.sessionDevice(session, now) === null)
+            return reply.code(401).send();
+        return reply.send(responseSchema.parse({ status: deps.repository.enrollmentTicketStatus(session, now) }));
+    });
+}

package/dist/server/server/features/auth/login/options/endpoint.js

@@ -0,0 +1,44 @@
+import { z } from 'zod';
+import { problem } from '../../../../platform/http/problem.js';
+import { passkeyCeremonyId } from '../../domain/identifiers.js';
+const lifetimeMs = 10 * 60 * 1000;
+const responseSchema = z
+    .object({ options: z.object({ challenge: z.string().min(1) }).passthrough() })
+    .strict();
+export function registerLoginOptions(app, deps) {
+    app.post('/api/auth/login/options', async (_request, reply) => {
+        if (deps.repository.listAuthorizedDevices().length === 0)
+            return reply
+                .code(400)
+                .type('application/problem+json')
+                .send(problem('AUTHENTICATION_FAILED', 400, 'Authentication could not be completed.'));
+        const correlation = deps.random.bytes(32);
+        const challenge = deps.random.bytes(32);
+        if (correlation.length !== 32 || challenge.length !== 32)
+            throw new Error('AUTHORIZATION_RANDOMNESS_INVALID');
+        const now = deps.clock.now();
+        const options = responseSchema.parse({
+            options: await deps.webauthn.authenticationOptions({
+                challenge,
+                rpId: deps.relyingParty.rpId,
+                userVerification: 'required',
+            }),
+        });
+        const token = passkeyCeremonyId(Buffer.from(correlation).toString('base64url'));
+        deps.repository.saveCeremony(token, {
+            purpose: 'authentication',
+            challenge,
+            expectedOrigin: deps.relyingParty.publicOrigin,
+            rpId: deps.relyingParty.rpId,
+            expiresAt: new Date(now.getTime() + lifetimeMs).toISOString(),
+        });
+        reply.setCookie('gestalt_mobile_login', token, {
+            httpOnly: true,
+            sameSite: 'strict',
+            path: '/',
+            secure: deps.relyingParty.publicOrigin.startsWith('https://'),
+            maxAge: 600,
+        });
+        return reply.send(options);
+    });
+}

package/dist/server/server/features/auth/login/verify/endpoint.js

@@ -0,0 +1,88 @@
+import { z } from 'zod';
+import { problem } from '../../../../platform/http/problem.js';
+import { PasskeyVerificationError, } from '../../application/ports.js';
+import { passkeyCeremonyId, webAuthnCredentialId } from '../../domain/identifiers.js';
+const responseSchema = z
+    .object({
+    id: z.string().min(1),
+    rawId: z.string().min(1),
+    type: z.literal('public-key'),
+    response: z
+        .object({
+        clientDataJSON: z.string().min(1),
+        authenticatorData: z.string().min(1),
+        signature: z.string().min(1),
+        userHandle: z.string().nullable().optional(),
+    })
+        .strict(),
+    authenticatorAttachment: z.enum(['platform', 'cross-platform']).optional(),
+    clientExtensionResults: z.record(z.string(), z.unknown()),
+})
+    .strict();
+const requestSchema = z.object({ response: responseSchema }).strict();
+const lifetimeMs = 30 * 24 * 60 * 60 * 1000;
+export function registerLoginVerification(app, deps) {
+    app.post('/api/auth/login/verify', async (request, reply) => {
+        const parsed = requestSchema.safeParse(request.body);
+        const token = request.cookies.gestalt_mobile_login;
+        const fail = () => reply
+            .code(400)
+            .type('application/problem+json')
+            .send(problem('AUTHENTICATION_FAILED', 400, 'Authentication could not be completed.'));
+        if (!parsed.success || typeof token !== 'string')
+            return fail();
+        const now = deps.clock.now();
+        const ceremony = deps.repository.readCeremony(passkeyCeremonyId(token), now.toISOString());
+        if (!ceremony || ceremony.purpose !== 'authentication')
+            return fail();
+        const device = deps.repository.findDeviceByCredentialId(webAuthnCredentialId(parsed.data.response.id));
+        if (!device)
+            return fail();
+        try {
+            const verified = await deps.webauthn.verifyAuthentication({
+                response: parsed.data.response,
+                challenge: ceremony.challenge,
+                expectedOrigin: ceremony.expectedOrigin,
+                rpId: ceremony.rpId,
+                credential: {
+                    id: device.credentialId,
+                    publicKey: device.publicKey,
+                    counter: device.counter,
+                    transports: device.transports,
+                },
+            });
+            if (!verified.userVerified || verified.credentialId !== device.credentialId)
+                throw new PasskeyVerificationError('PASSKEY_VERIFICATION_FAILED');
+            const session = deps.identifiers.sessionId();
+            if (Buffer.from(session, 'base64url').length !== 32)
+                throw new Error('AUTHORIZATION_RANDOMNESS_INVALID');
+            const authenticated = deps.repository.completeAuthentication({
+                ceremony: passkeyCeremonyId(token),
+                now: now.toISOString(),
+                device,
+                nextCounter: verified.counter,
+                session: {
+                    id: session,
+                    deviceId: device.id,
+                    expiresAt: new Date(now.getTime() + lifetimeMs).toISOString(),
+                },
+            });
+            if (!authenticated)
+                return fail();
+            reply.setCookie('gestalt_mobile_session', session, {
+                httpOnly: true,
+                sameSite: 'strict',
+                path: '/',
+                secure: deps.relyingParty.publicOrigin.startsWith('https://'),
+                maxAge: 2592000,
+            });
+            reply.clearCookie('gestalt_mobile_login', { path: '/' });
+            return reply.send({ status: 'authenticated' });
+        }
+        catch (error) {
+            if (error instanceof PasskeyVerificationError)
+                return fail();
+            throw error;
+        }
+    });
+}

package/dist/server/server/features/auth/logout/endpoint.js

@@ -0,0 +1,16 @@
+import { parseAuthorizationSessionId } from '../domain/identifiers.js';
+export function registerLogout(app, deps) {
+    app.post('/api/auth/logout', async (request, reply) => {
+        const token = request.cookies.gestalt_mobile_session;
+        const session = parseAuthorizationSessionId(token);
+        if (session !== null)
+            deps.repository.revokeSession(session, deps.clock.now().toISOString());
+        reply.clearCookie('gestalt_mobile_session', {
+            path: '/',
+            httpOnly: true,
+            sameSite: 'strict',
+            secure: deps.relyingParty.publicOrigin.startsWith('https://'),
+        });
+        return reply.code(204).send();
+    });
+}

package/dist/server/server/features/auth/register/options/endpoint.js

@@ -0,0 +1,34 @@
+import { z } from 'zod';
+import { problem } from '../../../../platform/http/problem.js';
+import { parseEnrollmentTicketId, passkeyCeremonyId } from '../../domain/identifiers.js';
+const requestSchema = z.object({ enrollmentTicket: z.string().min(1).optional() }).strict();
+const optionsResponseSchema = z.object({ options: z.object({ challenge: z.string().min(1) }).passthrough() }).strict();
+const lifetimeMs = 10 * 60 * 1000;
+export function registerRegistrationOptions(app, deps) {
+    app.post('/api/auth/register/options', async (request, reply) => {
+        const parsed = requestSchema.safeParse(request.body);
+        if (!parsed.success)
+            return reply.code(400).type('application/problem+json').send(problem('INVALID_REGISTRATION_REQUEST', 400, 'The registration request is invalid.'));
+        const ticket = parsed.data.enrollmentTicket === undefined ? undefined : parseEnrollmentTicketId(parsed.data.enrollmentTicket);
+        if (ticket === null)
+            return reply.code(400).type('application/problem+json').send(problem('INVALID_REGISTRATION_REQUEST', 400, 'The registration request is invalid.'));
+        const owner = deps.repository.readOwner();
+        const devices = deps.repository.listAuthorizedDevices();
+        const now = deps.clock.now();
+        if (devices.length > 0 && (!ticket || !deps.repository.ticketAvailable(ticket, now.toISOString())))
+            return reply.code(403).type('application/problem+json').send(problem('ENROLLMENT_NOT_AUTHORIZED', 403, 'Registration is not authorized.'));
+        const ownerHandle = owner ? undefined : deps.random.bytes(32);
+        if (ownerHandle && ownerHandle.length !== 32)
+            throw new Error('AUTHORIZATION_RANDOMNESS_INVALID');
+        const initialized = owner ?? deps.repository.initializeOwner(ownerHandle);
+        const correlation = deps.random.bytes(32);
+        const challenge = deps.random.bytes(32);
+        if (correlation.length !== 32 || challenge.length !== 32)
+            throw new Error('AUTHORIZATION_RANDOMNESS_INVALID');
+        const token = passkeyCeremonyId(Buffer.from(correlation).toString('base64url'));
+        const options = optionsResponseSchema.parse({ options: await deps.webauthn.registrationOptions({ challenge, rpId: deps.relyingParty.rpId, userVerification: 'required', rpName: deps.relyingParty.rpName, userHandle: initialized.userHandle, excludeCredentialIds: devices.map((device) => device.credentialId) }) });
+        deps.repository.saveCeremony(token, { purpose: 'registration', challenge, expectedOrigin: deps.relyingParty.publicOrigin, rpId: deps.relyingParty.rpId, expiresAt: new Date(now.getTime() + lifetimeMs).toISOString(), ...(ticket ? { enrollmentTicket: ticket } : {}) });
+        reply.setCookie('gestalt_mobile_registration', token, { httpOnly: true, sameSite: 'strict', path: '/', secure: deps.relyingParty.publicOrigin.startsWith('https://'), maxAge: 600 });
+        return reply.send(options);
+    });
+}

package/dist/server/server/features/auth/register/verify/endpoint.js

@@ -0,0 +1,56 @@
+import { z } from 'zod';
+import { problem } from '../../../../platform/http/problem.js';
+import { PasskeyVerificationError } from '../../application/ports.js';
+import { deviceNickname } from '../../domain/device-nickname.js';
+import { passkeyCeremonyId } from '../../domain/identifiers.js';
+import { AuthorizationDomainError } from '../../domain/errors.js';
+const registrationResponseSchema = z.object({
+    id: z.string().min(1), rawId: z.string().min(1), type: z.literal('public-key'),
+    response: z.object({ clientDataJSON: z.string().min(1), attestationObject: z.string().min(1), authenticatorData: z.string().min(1).optional(), transports: z.array(z.enum(['ble', 'hybrid', 'internal', 'nfc', 'usb', 'cable', 'smart-card'])).optional(), publicKeyAlgorithm: z.number().int().optional(), publicKey: z.string().min(1).optional() }).strict(),
+    authenticatorAttachment: z.enum(['platform', 'cross-platform']).optional(), clientExtensionResults: z.record(z.string(), z.unknown()),
+}).strict();
+const requestSchema = z.object({ response: registrationResponseSchema, nickname: z.string() }).strict();
+const successSchema = z.object({ status: z.literal('authenticated') }).strict();
+const sessionLifetimeMs = 30 * 24 * 60 * 60 * 1000;
+export function registerRegistrationVerification(app, deps) {
+    app.post('/api/auth/register/verify', async (request, reply) => {
+        const parsed = requestSchema.safeParse(request.body);
+        const token = request.cookies.gestalt_mobile_registration;
+        if (!parsed.success || typeof token !== 'string')
+            return reply.code(400).type('application/problem+json').send(problem('INVALID_REGISTRATION_REQUEST', 400, 'The registration request is invalid.'));
+        let nickname;
+        try {
+            nickname = deviceNickname(parsed.data.nickname);
+        }
+        catch (error) {
+            if (error instanceof AuthorizationDomainError)
+                return reply.code(400).type('application/problem+json').send(problem('INVALID_DEVICE_NICKNAME', 400, 'The device nickname is invalid.'));
+            throw error;
+        }
+        const now = deps.clock.now();
+        const ceremony = deps.repository.readCeremony(passkeyCeremonyId(token), now.toISOString());
+        if (!ceremony || ceremony.purpose !== 'registration')
+            return reply.code(400).type('application/problem+json').send(problem('REGISTRATION_NOT_AVAILABLE', 400, 'Registration could not be completed.'));
+        try {
+            const verified = await deps.webauthn.verifyRegistration({ response: parsed.data.response, challenge: ceremony.challenge, expectedOrigin: ceremony.expectedOrigin, rpId: ceremony.rpId });
+            if (!verified.userVerified)
+                throw new PasskeyVerificationError('PASSKEY_VERIFICATION_FAILED');
+            const device = { id: deps.identifiers.deviceId(), credentialId: verified.credentialId, publicKey: verified.publicKey, counter: verified.counter, transports: verified.transports, deviceType: verified.deviceType, backedUp: verified.backedUp, nickname, createdAt: now.toISOString() };
+            const session = deps.identifiers.sessionId();
+            if (Buffer.from(session, 'base64url').length !== 32)
+                throw new Error('AUTHORIZATION_RANDOMNESS_INVALID');
+            const expiresAt = new Date(now.getTime() + sessionLifetimeMs).toISOString();
+            const outcome = deps.repository.completeRegistration({ ceremony: passkeyCeremonyId(token), now: now.toISOString(), device, session: { id: session, deviceId: device.id, expiresAt } });
+            if (outcome !== 'registered')
+                return reply.code(outcome === 'bootstrapAlreadyClaimed' ? 409 : 400).type('application/problem+json').send(problem(outcome === 'bootstrapAlreadyClaimed' ? 'BOOTSTRAP_ALREADY_CLAIMED' : 'REGISTRATION_NOT_AVAILABLE', outcome === 'bootstrapAlreadyClaimed' ? 409 : 400, 'Registration could not be completed.'));
+            reply.setCookie('gestalt_mobile_session', session, { httpOnly: true, sameSite: 'strict', path: '/', secure: deps.relyingParty.publicOrigin.startsWith('https://'), maxAge: 30 * 24 * 60 * 60 });
+            reply.clearCookie('gestalt_mobile_registration', { path: '/' });
+            return reply.code(201).send(successSchema.parse({ status: 'authenticated' }));
+        }
+        catch (error) {
+            if (error instanceof PasskeyVerificationError || error instanceof AuthorizationDomainError)
+                return reply.code(400).type('application/problem+json').send(problem('REGISTRATION_VERIFICATION_FAILED', 400, 'Registration could not be completed.'));
+            throw error;
+        }
+    });
+}

package/dist/server/server/features/auth/status/endpoint.js

@@ -0,0 +1,24 @@
+import { parseAuthorizationSessionId } from '../domain/identifiers.js';
+export function registerAuthStatus(app, deps) {
+    app.get('/api/auth/status', async (request) => {
+        const token = request.cookies.gestalt_mobile_session;
+        const session = parseAuthorizationSessionId(token);
+        const authenticated = session !== null &&
+            deps.repository.sessionDevice(session, deps.clock.now().toISOString()) !== null;
+        return {
+            status: authenticated
+                ? 'authenticated'
+                : deps.repository.listAuthorizedDevices().length
+                    ? 'locked'
+                    : 'bootstrap',
+            publicOrigin: deps.relyingParty.publicOrigin,
+        };
+    });
+}
+export function registerDisabledAuthStatus(app) {
+    app.get('/api/auth/status', async () => ({
+        status: 'authenticated',
+        publicOrigin: '',
+        passkeyAuthEnabled: false,
+    }));
+}

package/dist/server/server/features/sessions/get-history/endpoint.js

@@ -9,7 +9,29 @@ export function registerGetHistory(app, deps) {
         const session = deps.find(request.params.id);
         if (!session)
             return reply.code(404).send({ code: 'SESSION_NOT_FOUND' });
-        const history = await deps.read(session);
+        let history;
+        try {
+            history = await deps.read(session);
+        }
+        catch (error) {
+            if (error instanceof Error && error.message === 'CODEX_SESSION_NOT_RUNNING')
+                return reply.code(409).type('application/problem+json').send({
+                    type: 'urn:gestalt-mobile:error:session-history-unavailable',
+                    title: 'Session history unavailable',
+                    status: 409,
+                    detail: 'GET /api/sessions/:id/history requires an active Codex session process. Open the session to restore it, then retry.',
+                    code: 'SESSION_HISTORY_UNAVAILABLE',
+                    retryable: true,
+                });
+            return reply.code(502).type('application/problem+json').send({
+                type: 'urn:gestalt-mobile:error:session-history-read-failed',
+                title: 'Session history read failed',
+                status: 502,
+                detail: 'GET /api/sessions/:id/history reached the relay, but Codex could not read this session history. The Codex process may have stopped during recovery; open the session again and inspect the running relay output if it persists.',
+                code: 'SESSION_HISTORY_READ_FAILED',
+                retryable: true,
+            });
+        }
         const items = toChatItems(history.turns);
         return reply.send({
             items,