gestalt-mobile 0.9.0 → 0.11.0

package/dist/server/server/features/sessions/restore-session/endpoint.js

@@ -4,6 +4,7 @@
  * SPDX-License-Identifier: AGPL-3.0-or-later
  */
 import { idempotencyKey } from '../../../platform/http/idempotency.js';
+import { RelaySession } from '../model/relay-session.js';
 import { canRestore } from './use-case.js';
 export function registerRestoreSession(app, deps) {
     app.post('/api/sessions/:id/restore', async (request, reply) => {
@@ -18,10 +19,29 @@ export function registerRestoreSession(app, deps) {
             return reply.code(404).send({ code: 'SESSION_NOT_FOUND' });
         if (!canRestore(session))
             return reply.code(409).send({ code: 'SESSION_CANNOT_RESTORE' });
-        const restored = await deps.restore(session);
-        deps.save(restored);
+        const recovering = RelaySession.rehydrate(session).beginRecovery(new Date().toISOString()).snapshot;
+        deps.save(recovering);
+        let restored;
+        try {
+            restored = await deps.restore(session);
+        }
+        catch {
+            // The pre-I/O recovery marker must never strand a saved session: keep
+            // its original thread and inactive state available for a later Open.
+            deps.save(session);
+            return reply.code(502).send({ code: 'RESTORE_FAILED' });
+        }
+        const response = 'session' in restored
+            ? {
+                ...restored.session,
+                ...(restored.replacementCreated
+                    ? { recovery: { historyUnavailable: true, replacementCreated: true } }
+                    : {}),
+            }
+            : restored;
+        deps.save(response);
         if (key)
-            deps.idempotency?.put(scope, key, 200, JSON.stringify(restored));
-        return reply.send(restored);
+            deps.idempotency?.put(scope, key, 200, JSON.stringify(response));
+        return reply.send(response);
     });
 }

package/dist/server/server/features/sessions/restore-session/use-case.js

@@ -4,6 +4,8 @@
  * SPDX-License-Identifier: AGPL-3.0-or-later
  */
 import { RelaySession } from '../model/relay-session.js';
+import { threadId } from '../model/value-objects.js';
+import { isMissingCodexThreadRollout } from '../../../platform/codex/json-rpc-client.js';
 export function canRestore(session) {
     return (session.threadId !== null &&
         (session.state === 'stopped' ||
@@ -15,3 +17,21 @@ export function restore(session, now) {
         throw new Error('SESSION_CANNOT_RESTORE');
     return RelaySession.rehydrate(session).beginRecovery(now).restore(now).snapshot;
 }
+/**
+ * The runtime may replace a thread only after a failed resume is confirmed to
+ * be the historical-rollout case.  This pure policy leaves persistence to the
+ * caller, so the original thread remains durable until thread/start succeeds.
+ */
+export function canRebindMissingRollout(session, error) {
+    return canRestore(session) && isMissingCodexThreadRollout(error);
+}
+export function rebindMissingRollout(session, error, replacementThreadId, now) {
+    if (!canRebindMissingRollout(session, error))
+        throw new Error('CODEX_ROLLOUT_REBIND_NOT_ALLOWED');
+    threadId(replacementThreadId);
+    return {
+        session: RelaySession.rehydrate(session).bindThread(replacementThreadId, now).snapshot,
+        historyUnavailable: true,
+        replacementCreated: true,
+    };
+}

package/dist/server/server/features/sessions/session-events/endpoint.js

@@ -13,7 +13,12 @@ export function registerSessionEvents(app, deps) {
         const url = new URL(request.url ?? '/', 'http://relay.invalid');
         const match = /^\/api\/sessions\/([^/]+)\/events$/.exec(url.pathname);
         const after = Number(url.searchParams.get('after') ?? '0');
-        if (!match || !Number.isSafeInteger(after) || after < 0 || !deps.exists(match[1])) {
+        if (!match ||
+            !Number.isSafeInteger(after) ||
+            after < 0 ||
+            (deps.publicOrigin !== undefined && request.headers.origin !== deps.publicOrigin) ||
+            (deps.authorized !== undefined && !deps.authorized(request.headers.cookie)) ||
+            !deps.exists(match[1])) {
             socket.destroy();
             return;
         }
@@ -33,7 +38,7 @@ export function registerSessionEvents(app, deps) {
             }
             replay.events.forEach(send);
             const unsubscribe = deps.subscribe(sessionId, send);
-            const removeHeartbeat = installWebSocketHeartbeat(connection);
+            const removeHeartbeat = installWebSocketHeartbeat(connection, deps.heartbeatIntervalMs ?? 25_000, () => deps.authorized?.(request.headers.cookie) ?? true);
             connection.on('close', () => {
                 removeHeartbeat();
                 unsubscribe();

package/dist/server/server/platform/auth/simple-webauthn-adapter.js

@@ -0,0 +1,75 @@
+/*
+ * Copyright (C) 2026 Dyne.org foundation
+ * Designed by Denis Roio <jaromil@dyne.org>
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+import { generateAuthenticationOptions, generateRegistrationOptions, verifyAuthenticationResponse, verifyRegistrationResponse, } from '@simplewebauthn/server';
+import { PasskeyVerificationError } from '../../features/auth/application/ports.js';
+import { webAuthnCredentialId } from '../../features/auth/domain/identifiers.js';
+const transports = new Set(['ble', 'hybrid', 'internal', 'nfc', 'usb']);
+/** Translates SimpleWebAuthn DTOs at the platform boundary. */
+export class SimpleWebAuthnAdapter {
+    async registrationOptions(input) {
+        return generateRegistrationOptions({
+            rpName: input.rpName,
+            rpID: input.rpId,
+            userName: 'local-owner',
+            userDisplayName: 'Local owner',
+            userID: new Uint8Array(input.userHandle),
+            challenge: new Uint8Array(input.challenge),
+            attestationType: 'none',
+            excludeCredentials: input.excludeCredentialIds.map((id) => ({ id })),
+            authenticatorSelection: { residentKey: 'required', requireResidentKey: true, userVerification: 'required' },
+            supportedAlgorithmIDs: [-7, -257],
+        });
+    }
+    async authenticationOptions(input) {
+        return generateAuthenticationOptions({
+            rpID: input.rpId,
+            challenge: new Uint8Array(input.challenge),
+            allowCredentials: [],
+            userVerification: 'required',
+        });
+    }
+    async verifyRegistration(input) {
+        let result;
+        try {
+            result = await verifyRegistrationResponse({
+                response: input.response,
+                expectedChallenge: Buffer.from(input.challenge).toString('base64url'),
+                expectedOrigin: input.expectedOrigin,
+                expectedRPID: input.rpId,
+                requireUserVerification: true,
+                supportedAlgorithmIDs: [-7, -257],
+            });
+        }
+        catch {
+            throw new PasskeyVerificationError('PASSKEY_VERIFICATION_FAILED');
+        }
+        if (!result.verified || !result.registrationInfo?.userVerified)
+            throw new PasskeyVerificationError('PASSKEY_VERIFICATION_FAILED');
+        const credential = result.registrationInfo.credential;
+        return {
+            credentialId: webAuthnCredentialId(credential.id),
+            publicKey: new Uint8Array(credential.publicKey),
+            counter: credential.counter,
+            userVerified: result.registrationInfo.userVerified,
+            transports: (credential.transports ?? []).filter((value) => transports.has(value)),
+            deviceType: result.registrationInfo.credentialDeviceType,
+            backedUp: result.registrationInfo.credentialBackedUp,
+        };
+    }
+    async verifyAuthentication(input) {
+        const value = input;
+        let result;
+        try {
+            result = await verifyAuthenticationResponse({ response: value.response, expectedChallenge: Buffer.from(value.challenge).toString('base64url'), expectedOrigin: value.expectedOrigin, expectedRPID: value.rpId, requireUserVerification: true, credential: { id: value.credential.id, publicKey: new Uint8Array(value.credential.publicKey), counter: value.credential.counter, transports: [...value.credential.transports] } });
+        }
+        catch {
+            throw new PasskeyVerificationError('PASSKEY_VERIFICATION_FAILED');
+        }
+        if (!result.verified || !result.authenticationInfo?.userVerified)
+            throw new PasskeyVerificationError('PASSKEY_VERIFICATION_FAILED');
+        return { credentialId: webAuthnCredentialId(value.response.id), counter: result.authenticationInfo.newCounter, userVerified: result.authenticationInfo.userVerified };
+    }
+}

package/dist/server/server/platform/auth/sqlite-authorization-store.js

@@ -0,0 +1,478 @@
+/*
+ * Copyright (C) 2026 Dyne.org foundation
+ * Designed by Denis Roio <jaromil@dyne.org>
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+import { createHash } from 'node:crypto';
+import { mkdirSync, chmodSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { DatabaseSync } from 'node:sqlite';
+import { authorizedDeviceId, localOwnerId, passkeyCeremonyId, webAuthnCredentialId, } from '../../features/auth/domain/identifiers.js';
+import { deviceNickname } from '../../features/auth/domain/device-nickname.js';
+const OWNER_ID = localOwnerId('local-owner');
+const SCHEMA_VERSION = 1;
+const SQLITE_BUSY_TIMEOUT_MS = 5_000;
+const SQLITE_STARTUP_BUSY_TIMEOUT_MS = 250;
+const STARTUP_LOCK_DEADLINE_MS = 2_000;
+const STARTUP_LOCK_RETRY_DELAY_MS = 25;
+const startupLockWaiter = new Int32Array(new SharedArrayBuffer(Int32Array.BYTES_PER_ELEMENT));
+export function authorizationDatabasePath(homeDirectory) {
+    return join(resolve(homeDirectory), '.codex-gestalt', 'gestalt-mobile', 'auth.sqlite');
+}
+/** SQLite adapter for the auth bounded context. No SQLite types escape this file. */
+export class SqliteAuthorizationStore {
+    path;
+    db;
+    relyingParty;
+    constructor(homeDirectory, relyingParty) {
+        this.path = authorizationDatabasePath(homeDirectory);
+        const parent = dirname(this.path);
+        mkdirSync(parent, { recursive: true, mode: 0o700 });
+        chmodSync(parent, 0o700);
+        this.relyingParty = relyingParty;
+        this.db = new DatabaseSync(this.path);
+        try {
+            // journal_mode can take an exclusive lock. Install the bounded busy handler first so
+            // simultaneous first opens wait for the winner instead of failing during startup.
+            this.db.exec(`PRAGMA busy_timeout = ${SQLITE_STARTUP_BUSY_TIMEOUT_MS}`);
+            this.initializeSchema();
+            this.db.exec(`PRAGMA busy_timeout = ${SQLITE_BUSY_TIMEOUT_MS}`);
+        }
+        catch (error) {
+            this.db.close();
+            throw error;
+        }
+    }
+    initializeSchema() {
+        const deadline = Date.now() + STARTUP_LOCK_DEADLINE_MS;
+        for (;;) {
+            try {
+                this.initializeSchemaAttempt();
+                return;
+            }
+            catch (error) {
+                const remaining = deadline - Date.now();
+                if (!isLocked(error) || remaining <= 0)
+                    throw error;
+                Atomics.wait(startupLockWaiter, 0, 0, Math.min(STARTUP_LOCK_RETRY_DELAY_MS, remaining));
+            }
+        }
+    }
+    initializeSchemaAttempt() {
+        this.db.exec('PRAGMA journal_mode = WAL;');
+        this.db.exec('PRAGMA foreign_keys = ON;');
+        this.db.exec('BEGIN IMMEDIATE');
+        try {
+            this.db
+                .exec(`CREATE TABLE IF NOT EXISTS auth_settings (singleton INTEGER PRIMARY KEY CHECK (singleton = 1), schema_version INTEGER NOT NULL, rp_id TEXT NOT NULL, user_handle BLOB NOT NULL);
+CREATE TABLE IF NOT EXISTS auth_devices (id TEXT PRIMARY KEY, credential_id TEXT NOT NULL UNIQUE, public_key BLOB NOT NULL, counter INTEGER NOT NULL, transports_json TEXT NOT NULL, device_type TEXT NOT NULL, backed_up INTEGER NOT NULL CHECK(backed_up IN (0,1)), nickname TEXT NOT NULL, created_at TEXT NOT NULL, last_used_at TEXT, version INTEGER NOT NULL DEFAULT 0);
+CREATE TABLE IF NOT EXISTS auth_ceremonies (token_hash TEXT PRIMARY KEY, purpose TEXT NOT NULL, challenge BLOB NOT NULL, expected_origin TEXT NOT NULL, rp_id TEXT NOT NULL, expires_at TEXT NOT NULL, consumed_at TEXT, ticket_hash TEXT);
+CREATE TABLE IF NOT EXISTS auth_tickets (token_hash TEXT PRIMARY KEY, expires_at TEXT NOT NULL, consumed_at TEXT, creator_session_hash TEXT);
+CREATE TABLE IF NOT EXISTS auth_sessions (token_hash TEXT PRIMARY KEY, device_id TEXT REFERENCES auth_devices(id) ON DELETE SET NULL, expires_at TEXT NOT NULL, revoked_at TEXT);`);
+            const ceremonyColumns = this.db
+                .prepare("SELECT name FROM pragma_table_info('auth_ceremonies')")
+                .all();
+            if (!ceremonyColumns.some((column) => column.name === 'ticket_hash'))
+                this.db.exec('ALTER TABLE auth_ceremonies ADD COLUMN ticket_hash TEXT');
+            const ticketColumns = this.db
+                .prepare("SELECT name FROM pragma_table_info('auth_tickets')")
+                .all();
+            if (!ticketColumns.some((column) => column.name === 'creator_session_hash'))
+                this.db.exec('ALTER TABLE auth_tickets ADD COLUMN creator_session_hash TEXT');
+            const settings = this.db
+                .prepare('SELECT rp_id FROM auth_settings WHERE singleton = 1')
+                .get();
+            if (settings && settings.rp_id !== this.relyingParty.rpId && this.deviceCount() > 0)
+                throw new Error('WebAuthn RP ID hostname changed while credentials exist');
+            this.db.exec('COMMIT');
+        }
+        catch (error) {
+            try {
+                this.db.exec('ROLLBACK');
+            }
+            catch { }
+            throw error;
+        }
+    }
+    initializeOwner(userHandle) {
+        if (userHandle.length === 0)
+            throw new Error('Local owner handle must not be empty');
+        this.db.exec('BEGIN IMMEDIATE');
+        try {
+            const current = this.db
+                .prepare('SELECT user_handle, rp_id FROM auth_settings WHERE singleton = 1')
+                .get();
+            if (!current)
+                this.db
+                    .prepare('INSERT INTO auth_settings (singleton, schema_version, rp_id, user_handle) VALUES (1, ?, ?, ?)')
+                    .run(SCHEMA_VERSION, this.relyingParty.rpId, userHandle);
+            else if (current.rp_id !== this.relyingParty.rpId && this.deviceCount() > 0)
+                throw new Error('WebAuthn RP ID hostname changed while credentials exist');
+            else if (current.rp_id !== this.relyingParty.rpId)
+                this.db
+                    .prepare('UPDATE auth_settings SET rp_id = ? WHERE singleton = 1')
+                    .run(this.relyingParty.rpId);
+            this.db.exec('COMMIT');
+            return { id: OWNER_ID, userHandle: new Uint8Array(current?.user_handle ?? userHandle) };
+        }
+        catch (error) {
+            this.db.exec('ROLLBACK');
+            throw error;
+        }
+    }
+    readOwner() {
+        const row = this.db
+            .prepare('SELECT user_handle FROM auth_settings WHERE singleton = 1')
+            .get();
+        return row ? { id: OWNER_ID, userHandle: new Uint8Array(row.user_handle) } : null;
+    }
+    listAuthorizedDevices() {
+        return this.db.prepare('SELECT * FROM auth_devices ORDER BY created_at, id').all().map(toDevice);
+    }
+    claimFirstDevice(owner, device) {
+        if (owner.id !== OWNER_ID || !this.readOwner())
+            throw new Error('Local owner is not initialized');
+        this.db.exec('BEGIN IMMEDIATE');
+        try {
+            if (this.deviceCount()) {
+                this.db.exec('COMMIT');
+                return 'alreadyClaimed';
+            }
+            this.insertDevice(device);
+            this.db.exec('COMMIT');
+            return 'claimed';
+        }
+        catch (error) {
+            this.db.exec('ROLLBACK');
+            throw error;
+        }
+    }
+    authorizeDevice(device) {
+        this.db.exec('BEGIN IMMEDIATE');
+        try {
+            if (!this.readOwner() || !this.deviceCount()) {
+                this.db.exec('COMMIT');
+                return 'notAuthorized';
+            }
+            try {
+                this.insertDevice(device);
+            }
+            catch (error) {
+                if (String(error).includes('UNIQUE constraint failed: auth_devices.credential_id')) {
+                    this.db.exec('ROLLBACK');
+                    return 'duplicateCredential';
+                }
+                throw error;
+            }
+            this.db.exec('COMMIT');
+            return 'authorized';
+        }
+        catch (error) {
+            try {
+                this.db.exec('ROLLBACK');
+            }
+            catch { }
+            throw error;
+        }
+    }
+    findDeviceByCredentialId(id) {
+        const row = this.db.prepare('SELECT * FROM auth_devices WHERE credential_id = ?').get(id);
+        return row ? toDevice(row) : null;
+    }
+    findDevice(id) {
+        const row = this.db.prepare('SELECT * FROM auth_devices WHERE id = ?').get(id);
+        return row ? toDevice(row) : null;
+    }
+    renameDevice(id, expectedVersion, nickname) {
+        this.db.exec('BEGIN IMMEDIATE');
+        try {
+            const result = this.db
+                .prepare('UPDATE auth_devices SET nickname = ?, version = version + 1 WHERE id = ? AND version = ?')
+                .run(nickname, id, expectedVersion);
+            if (result.changes) {
+                this.db.exec('COMMIT');
+                return 'renamed';
+            }
+            const outcome = this.findDevice(id) ? 'stale' : 'notFound';
+            this.db.exec('COMMIT');
+            return outcome;
+        }
+        catch (error) {
+            this.db.exec('ROLLBACK');
+            throw error;
+        }
+    }
+    advanceCounter(id, expected, expectedVersion, next, usedAt) {
+        const zeroSynced = this.db
+            .prepare("UPDATE auth_devices SET last_used_at = ?, version = version + 1 WHERE id = ? AND counter = ? AND version = ? AND ? = 0 AND device_type = 'multiDevice'")
+            .run(usedAt, id, expected, expectedVersion, next).changes === 1;
+        return (zeroSynced ||
+            this.db
+                .prepare('UPDATE auth_devices SET counter = ?, last_used_at = ?, version = version + 1 WHERE id = ? AND counter = ? AND version = ? AND ? > counter')
+                .run(next, usedAt, id, expected, expectedVersion, next).changes === 1);
+    }
+    revokeDevice(id, revokedAt) {
+        this.db.exec('BEGIN IMMEDIATE');
+        try {
+            if (!this.findDevice(id)) {
+                this.db.exec('COMMIT');
+                return 'notFound';
+            }
+            if (this.deviceCount() < 2) {
+                this.db.exec('COMMIT');
+                return 'finalDevice';
+            }
+            this.db
+                .prepare('UPDATE auth_sessions SET revoked_at = ? WHERE device_id = ? AND revoked_at IS NULL')
+                .run(revokedAt, id);
+            this.db.prepare('DELETE FROM auth_devices WHERE id = ?').run(id);
+            this.db.exec('COMMIT');
+            return 'revoked';
+        }
+        catch (error) {
+            this.db.exec('ROLLBACK');
+            throw error;
+        }
+    }
+    saveCeremony(token, ceremony) {
+        this.db
+            .prepare('INSERT INTO auth_ceremonies (token_hash, purpose, challenge, expected_origin, rp_id, expires_at, ticket_hash) VALUES (?, ?, ?, ?, ?, ?, ?)')
+            .run(hash(token), ceremony.purpose, ceremony.challenge, ceremony.expectedOrigin, ceremony.rpId, ceremony.expiresAt, ceremony.enrollmentTicket ? hash(ceremony.enrollmentTicket) : null);
+    }
+    consumeCeremony(token, now) {
+        this.db.exec('BEGIN IMMEDIATE');
+        try {
+            const row = this.db
+                .prepare('UPDATE auth_ceremonies SET consumed_at = ? WHERE token_hash = ? AND consumed_at IS NULL AND expires_at > ? RETURNING purpose, challenge, expected_origin, rp_id, expires_at')
+                .get(now, hash(token), now);
+            this.db.exec('COMMIT');
+            return row
+                ? {
+                    id: passkeyCeremonyId(token),
+                    purpose: row.purpose,
+                    challenge: new Uint8Array(row.challenge),
+                    expectedOrigin: row.expected_origin,
+                    rpId: row.rp_id,
+                    expiresAt: row.expires_at,
+                }
+                : null;
+        }
+        catch (error) {
+            this.db.exec('ROLLBACK');
+            throw error;
+        }
+    }
+    readCeremony(token, now) {
+        const row = this.db
+            .prepare('SELECT purpose, challenge, expected_origin, rp_id, expires_at FROM auth_ceremonies WHERE token_hash = ? AND consumed_at IS NULL AND expires_at > ?')
+            .get(hash(token), now);
+        return row
+            ? {
+                id: passkeyCeremonyId(token),
+                purpose: row.purpose,
+                challenge: new Uint8Array(row.challenge),
+                expectedOrigin: row.expected_origin,
+                rpId: row.rp_id,
+                expiresAt: row.expires_at,
+            }
+            : null;
+    }
+    saveTicket(token, ticket) {
+        this.db
+            .prepare('INSERT INTO auth_tickets (token_hash, expires_at, consumed_at) VALUES (?, ?, NULL)')
+            .run(hash(token), ticket.expiresAt);
+    }
+    issueEnrollmentTicket(token, creatorSession, expiresAt) {
+        this.db.exec('BEGIN IMMEDIATE');
+        try {
+            const creator = hash(creatorSession);
+            this.db.prepare('DELETE FROM auth_tickets WHERE creator_session_hash = ? AND consumed_at IS NULL').run(creator);
+            this.db.prepare('INSERT INTO auth_tickets (token_hash, expires_at, consumed_at, creator_session_hash) VALUES (?, ?, NULL, ?)').run(hash(token), expiresAt, creator);
+            this.db.exec('COMMIT');
+        }
+        catch (error) {
+            this.db.exec('ROLLBACK');
+            throw error;
+        }
+    }
+    enrollmentTicketStatus(creatorSession, now) {
+        const row = this.db
+            .prepare('SELECT expires_at, consumed_at FROM auth_tickets WHERE creator_session_hash = ? ORDER BY rowid DESC LIMIT 1')
+            .get(hash(creatorSession));
+        if (!row)
+            return 'none';
+        if (row.consumed_at)
+            return 'used';
+        return row.expires_at > now ? 'pending' : 'expired';
+    }
+    cancelEnrollmentTicket(creatorSession, now) {
+        this.db.exec('BEGIN IMMEDIATE');
+        try {
+            const result = this.db
+                .prepare('DELETE FROM auth_tickets WHERE rowid = (SELECT rowid FROM auth_tickets WHERE creator_session_hash = ? AND consumed_at IS NULL AND expires_at > ? ORDER BY rowid DESC LIMIT 1)')
+                .run(hash(creatorSession), now);
+            this.db.exec('COMMIT');
+            return result.changes === 1;
+        }
+        catch (error) {
+            this.db.exec('ROLLBACK');
+            throw error;
+        }
+    }
+    consumeTicket(token, now) {
+        return this.consume('auth_tickets', token, now);
+    }
+    ticketAvailable(token, now) {
+        return Boolean(this.db
+            .prepare('SELECT 1 FROM auth_tickets t WHERE t.token_hash = ? AND t.consumed_at IS NULL AND t.expires_at > ? AND (t.creator_session_hash IS NULL OR EXISTS (SELECT 1 FROM auth_sessions s WHERE s.token_hash = t.creator_session_hash AND s.revoked_at IS NULL AND s.expires_at > ?))')
+            .get(hash(token), now, now));
+    }
+    completeRegistration(input) {
+        if (input.session.deviceId !== input.device.id)
+            throw new Error('AUTHORIZATION_SESSION_DEVICE_MISMATCH');
+        this.db.exec('BEGIN IMMEDIATE');
+        try {
+            const ceremony = this.db
+                .prepare('SELECT ticket_hash FROM auth_ceremonies WHERE token_hash = ? AND purpose = ? AND consumed_at IS NULL AND expires_at > ?')
+                .get(hash(input.ceremony), 'registration', input.now);
+            if (!ceremony) {
+                this.db.exec('COMMIT');
+                return 'ceremonyUnavailable';
+            }
+            if (ceremony.ticket_hash) {
+                const result = this.db
+                    .prepare('UPDATE auth_tickets SET consumed_at = ? WHERE token_hash = ? AND consumed_at IS NULL AND expires_at > ? AND (creator_session_hash IS NULL OR EXISTS (SELECT 1 FROM auth_sessions WHERE token_hash = auth_tickets.creator_session_hash AND revoked_at IS NULL AND expires_at > ?))')
+                    .run(input.now, ceremony.ticket_hash, input.now, input.now);
+                if (result.changes !== 1) {
+                    this.db.exec('COMMIT');
+                    return 'ticketUnavailable';
+                }
+            }
+            else if (this.deviceCount() !== 0) {
+                this.db.exec('COMMIT');
+                return 'bootstrapAlreadyClaimed';
+            }
+            try {
+                this.insertDevice(input.device);
+            }
+            catch (error) {
+                if (String(error).includes('UNIQUE constraint failed: auth_devices.credential_id')) {
+                    this.db.exec('ROLLBACK');
+                    return 'duplicateCredential';
+                }
+                throw error;
+            }
+            this.db
+                .prepare('INSERT INTO auth_sessions (token_hash, device_id, expires_at) VALUES (?, ?, ?)')
+                .run(hash(input.session.id), input.session.deviceId, input.session.expiresAt);
+            this.db
+                .prepare('UPDATE auth_ceremonies SET consumed_at = ? WHERE token_hash = ?')
+                .run(input.now, hash(input.ceremony));
+            this.db.exec('COMMIT');
+            return 'registered';
+        }
+        catch (error) {
+            try {
+                this.db.exec('ROLLBACK');
+            }
+            catch { }
+            throw error;
+        }
+    }
+    completeAuthentication(input) {
+        if (input.session.deviceId !== input.device.id)
+            throw new Error('AUTHORIZATION_SESSION_DEVICE_MISMATCH');
+        this.db.exec('BEGIN IMMEDIATE');
+        try {
+            const ceremony = this.db
+                .prepare('SELECT 1 FROM auth_ceremonies WHERE token_hash = ? AND purpose = ? AND consumed_at IS NULL AND expires_at > ?')
+                .get(hash(input.ceremony), 'authentication', input.now);
+            if (!ceremony) {
+                this.db.exec('COMMIT');
+                return false;
+            }
+            const updated = this.advanceCounter(input.device.id, input.device.counter, input.device.version ?? 0, input.nextCounter, input.now);
+            if (!updated) {
+                this.db.exec('COMMIT');
+                return false;
+            }
+            this.db
+                .prepare('INSERT INTO auth_sessions (token_hash, device_id, expires_at) VALUES (?, ?, ?)')
+                .run(hash(input.session.id), input.session.deviceId, input.session.expiresAt);
+            this.db
+                .prepare('UPDATE auth_ceremonies SET consumed_at = ? WHERE token_hash = ?')
+                .run(input.now, hash(input.ceremony));
+            this.db.exec('COMMIT');
+            return true;
+        }
+        catch (error) {
+            try {
+                this.db.exec('ROLLBACK');
+            }
+            catch { }
+            throw error;
+        }
+    }
+    saveSession(token, session) {
+        this.db
+            .prepare('INSERT INTO auth_sessions (token_hash, device_id, expires_at) VALUES (?, ?, ?)')
+            .run(hash(token), session.deviceId, session.expiresAt);
+    }
+    sessionDevice(token, now) {
+        const row = this.db
+            .prepare('SELECT device_id FROM auth_sessions WHERE token_hash = ? AND revoked_at IS NULL AND expires_at > ?')
+            .get(hash(token), now);
+        return row?.device_id ? authorizedDeviceId(row.device_id) : null;
+    }
+    revokeSession(token, now) {
+        return (this.db
+            .prepare('UPDATE auth_sessions SET revoked_at = ? WHERE token_hash = ? AND revoked_at IS NULL')
+            .run(now, hash(token)).changes === 1);
+    }
+    close() {
+        this.db.close();
+    }
+    insertDevice(device) {
+        this.db
+            .prepare('INSERT INTO auth_devices (id, credential_id, public_key, counter, transports_json, device_type, backed_up, nickname, created_at, last_used_at, version) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)')
+            .run(device.id, device.credentialId, device.publicKey, device.counter, JSON.stringify(device.transports), device.deviceType, device.backedUp ? 1 : 0, device.nickname, device.createdAt, device.lastUsedAt ?? null, device.version ?? 0);
+    }
+    consume(table, token, now) {
+        this.db.exec('BEGIN IMMEDIATE');
+        try {
+            const changes = this.db
+                .prepare(`UPDATE ${table} SET consumed_at = ? WHERE token_hash = ? AND consumed_at IS NULL AND expires_at > ?`)
+                .run(now, hash(token), now).changes;
+            this.db.exec('COMMIT');
+            return changes === 1;
+        }
+        catch (error) {
+            this.db.exec('ROLLBACK');
+            throw error;
+        }
+    }
+    deviceCount() {
+        return this.db.prepare('SELECT COUNT(*) AS count FROM auth_devices').get().count;
+    }
+}
+function toDevice(row) {
+    return {
+        id: authorizedDeviceId(row.id),
+        credentialId: webAuthnCredentialId(row.credential_id),
+        publicKey: new Uint8Array(row.public_key),
+        counter: row.counter,
+        transports: JSON.parse(row.transports_json),
+        deviceType: row.device_type,
+        backedUp: row.backed_up === 1,
+        nickname: deviceNickname(row.nickname),
+        createdAt: row.created_at,
+        ...(row.last_used_at ? { lastUsedAt: row.last_used_at } : {}),
+        version: row.version,
+    };
+}
+function hash(value) {
+    return createHash('sha256').update(value).digest('hex');
+}
+function isLocked(error) {
+    return error instanceof Error && /database is locked/i.test(error.message);
+}