[codex] Structure mobile DPoP failures

[juliusmarminge]

Summary

• replace the generic message-bearing mobile DPoP error and constructor wrapper with structured Schema errors for storage, key generation, and proof creation
• attach storage keys, proof request context, operation identifiers, and the exact underlying schema, parser, crypto, or signing cause
• preserve separate structured causes for malformed public keys and mismatched stored key material
• record only a shared redacted request target (scheme/host/path) plus URL length, never credentials, query parameters, or fragments

Stack dependency

• Based on [codex] Share safe URL diagnostics #3403, which provides the shared redactDpopRequestTarget helper used by this PR.

Validation

• vp test run apps/mobile/src/features/cloud/dpop.test.ts (8 tests)
• vp run lint:mobile
• vp check (passes with 20 pre-existing warnings)
• vp run typecheck

Open PR overlap

• feat(relay): enforce resource limits #2925 also touches these files as part of an unrelated broad mobile/relay feature; there is no overlap with the active Effect error-audit series.

---

Note

Medium Risk
Touches OAuth/DPoP signing and secure-store key handling, but behavior is largely preserved with safer diagnostics and stricter error typing rather than new auth flows.

Overview
Replaces the mobile cloud DPoP generic message-only error with Effect Schema tagged errors for storage, key generation, and proof signing, plus a CloudDpopError union and isCloudDpopError guard.

CloudDpopProofError now records operation, HTTP method, key thumbprint, and URL length, while requestTarget uses shared redactDpopRequestTarget (scheme/host/path only—no credentials, query, or fragment). Storage and restore paths emit CloudDpopStorageError with operation and storageKey; mismatched stored key coordinates surface on restore.

Shared dpop gains redactDpopRequestTarget (with tests). A new urlDiagnostics export provides length/protocol/hostname diagnostics for invalid URLs. Mobile tests assert structured fields, restore failures, and that proof error messages do not leak sensitive URL parts.

^{Reviewed by Cursor Bugbot for commit 3ba6a95. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Structure DPoP failures with typed error classes and redacted request context

• Introduces CloudDpopStorageError, CloudDpopKeyError, and CloudDpopProofError typed error classes in dpop.ts, each carrying structured metadata (operation, storageKey, thumbprint, etc.) instead of generic messages.
• Adds isCloudDpopError type guard and CloudDpopError union so callers can uniformly identify DPoP-related failures.
• Adds redactDpopRequestTarget in dpop.ts that strips credentials, query, and fragment from URLs before including them in error context, falling back to "<invalid-url>" for unparseable input.
• Adds getUrlDiagnostics in urlDiagnostics.ts to extract non-sensitive URL metadata (length, protocol, hostname) for error diagnostics.
• Behavioral Change: HTU normalization in createDpopProof now strips query and fragment components, which changes the normalized URL compared to the previous behavior.

^{Macroscope summarized 3ba6a95.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 29a5a17a-9fb0-49ef-9bce-c08f46370b3f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/mobile-dpop-errors

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[macroscopeapp]

Approvability

Verdict: Approved

This PR refactors error handling to use structured, typed error classes instead of a generic error class, with no changes to business logic or control flow. The redaction of sensitive URL components from error messages is a security improvement.

^{You can customize Macroscope's approvability policy. Learn more.}

Dismissing prior approval to re-evaluate 04e0d39

Dismissing prior approval to re-evaluate fb138fb

Dismissing prior approval to re-evaluate 283d96f

Dismissing prior approval to re-evaluate 22e7600

Dismissing prior approval to re-evaluate 3ba6a95