@bongos/core 1.21.135 → 1.21.136

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.21.135",
-  "core_contract": "1.21.135",
-  "source_commit": "92eebc078b819402dfac89117a1ea3cd6211094e",
+  "core_version": "1.21.136",
+  "core_contract": "1.21.136",
+  "source_commit": "e4b8cee4f6222b363f9b2e8aa1ceb79c6426a2eb",
   "source_ref": "HEAD",
-  "built_at": "2026-10-15T21:47:43.041Z",
+  "built_at": "2026-10-15T23:35:12.033Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 608,
     "agent_docs_stubbed": 28,
-    "functional_verbatim": 3149,
+    "functional_verbatim": 3153,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3786,
-  "tree_sha256": "eba8be00953d70046ec4a91b870c28a7382c4a8bee2294650001d9aff411caa2",
+  "file_count": 3790,
+  "tree_sha256": "2bb4525360079b817aa7bc06f384d604867c6896a6a2caa355d01487669160c2",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2392,7 +2392,7 @@
     {
       "path": "docs/architecture.md",
       "mode": "0000644",
-      "sha256": "fca9878d8501b33c0258045f61365a90e60e148c2b730b00a83a6f4f89b79b8d"
+      "sha256": "3850775c198edeece6ac5497a9f5788421a8082e21edb496a4b00a3fc7a6eb3d"
     },
     {
       "path": "docs/branding-contract.md",
@@ -2927,7 +2927,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "820f5b58bcabe2204f9afdd3b19cc08e487d4cc27b749dedeb5748f3a43e48e0"
+      "sha256": "72c0a2b3d8e44eb7ae5e0b0b9c27eb4c70055f9eb8755496c9f174db024fec57"
     },
     {
       "path": "docs/modules-contract.md",
@@ -4164,6 +4164,11 @@
       "mode": "0000644",
       "sha256": "550884fa117e707b65f5c56faca0e4e3850905db94d3f275cad5d520aa68db03"
     },
+    {
+      "path": "migrations/core_277_passkey_foundation.sql",
+      "mode": "0000644",
+      "sha256": "52ebc3ce9c3e006ef2dfe0d85c9a97c53896f7b0d8f8fb700a1488a24c7bcb3c"
+    },
     {
       "path": "modules/agents/CLAUDE.md",
       "mode": "0000644",
@@ -10522,12 +10527,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "9a1ff520eecca180a4845d8b3485c1d2045d5a04416b264ed007caf8d1903e84"
+      "sha256": "ad4055f1eef9ede69c3eda6f957baa66186ec383ac30b9f3b411302d651aae2e"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "4f1a3afb1e80fd281507467f3ce7c3c6813882e18afe9225515566ae592dac87"
+      "sha256": "af3b71b069ad704356796bf041f8a2798a07e9c20aca50aaf3758c0fb311f8ca"
     },
     {
       "path": "public-docs/index.html",
@@ -10547,7 +10552,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "e648eee9b85160b8871a678d78ba4ded897ef4e16b64d51047c796c88ecda2cd"
+      "sha256": "b170ded56d5ca6cc029de29e1ceade0100ef20de335fa810f4aa0d220012fc84"
     },
     {
       "path": "scripts/cron/style_guide_audit.sh",
@@ -11832,7 +11837,7 @@
     {
       "path": "scripts/gds/run-unit-tests.js",
       "mode": "0000644",
-      "sha256": "d6d81c3bb8017122cb6b5a46355b637f7986ec324132bcd583f0c02d2725b6d0"
+      "sha256": "213d8e4199ab429e64d0c65f4eda42a9d0cb4c64baa1424f793e223af3e66308"
     },
     {
       "path": "scripts/gds/runner-drift.js",
@@ -12689,6 +12694,11 @@
       "mode": "0000644",
       "sha256": "b2f6d65e3463052609e51d135ea560370104d0457a0e7e86bf9b7120fe1cddfb"
     },
+    {
+      "path": "src/bongos/passkeys.js",
+      "mode": "0000644",
+      "sha256": "2fe8018148a70b21515352084e3bc9047da0ee4749e27df6f68c93ba29a2368a"
+    },
     {
       "path": "src/bongos/path-match.js",
       "mode": "0000644",
@@ -12902,7 +12912,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "0ace35c177cb9560521ce1c86cb354981310dcce49e45ac31f527afb1002ff30"
+      "sha256": "5968c611fba761d24e4118debb2aeb34772640722e0306a0c61a351bf7455f0f"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -16859,6 +16869,16 @@
       "mode": "0000644",
       "sha256": "fd69c44ebf3d246ecedf527275448389cca809e231d1c6cb34e4c12bfdc38111"
     },
+    {
+      "path": "tests/passkey_foundation_db.mjs",
+      "mode": "0000644",
+      "sha256": "5ff76c608f9f7b687e6b65af6bc667bdb42a21d520425b16bf15d36ca03848d9"
+    },
+    {
+      "path": "tests/passkey_pure.mjs",
+      "mode": "0000644",
+      "sha256": "d0466c6a46c2eadd023801640d5da2d395d68cab8c8a9a46eee9b2e88e8c5182"
+    },
     {
       "path": "tests/paste_token_api_base.mjs",
       "mode": "0000644",

package/docs/architecture.md

@@ -251,6 +251,16 @@ store_module_prices(id, module_key, price_cents, price_credits, set_by, set_at)
               -- in that currency, at least one must be set.
 ```
 
+Passkey foundation (migration `core_277`, task 1004750, [ADR 0382](adr/0382-a-hardware-card-is-a-passkey-step-up-an-archon-switches-on-per-builder.md) D1/D6 — storage only; the ceremonies and routes are their own tasks; code in `src/bongos/passkeys.js`):
+
+```
+passkey_credentials(id, credential_id UNIQUE, builder_id FK, public_key bytea, sign_count,
+              transports[], aaguid, nickname, created_at, last_used_at)
+passkey_user_handles(builder_id PK FK, user_handle UNIQUE, created_at)  -- opaque, never the email
+passkey_challenges(challenge PK, purpose, builder_id NULL, created_at, expires_at)
+              -- single-use (DELETEd on consume), TTL swept; builder_id NULL for sign-in
+```
+
 Module release channels (migration `core_276`, task 1003815, [ADR 0344](adr/0344-a-tester-is-a-project-that-opts-in-once.md) — which channel a published version is on; the data only, the tester-first publish, promotion gate and channel-aware install are their own tasks):
 
 ```

package/docs/module-api-changelog.md

@@ -3107,5 +3107,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.21.133 with no explicit bump. run 38810062389. (task 1002620)
   1.21.135 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.21.134 with no explicit bump. run 38812449926. (task 1002620)
+  1.21.136 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.21.135 with no explicit bump. run 38824385358. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/migrations/core_277_passkey_foundation.sql

@@ -0,0 +1,53 @@
+-- core_277 passkey foundation: credentials, per-builder user handle, challenge store
+-- Applied under task 1004750 (ADR 0382 D1, D6).
+--
+-- WHY. A hardware card (a WebAuthn passkey) is a second sign-in step an Archon can
+-- switch on per builder. Before any ceremony route can exist, the server needs three
+-- things to keep: the public half of each registered card, an opaque handle that
+-- stands in for the builder inside the card (never the email), and the challenges it
+-- has issued and not yet seen answered.
+--
+-- SHAPE.
+--  * passkey_credentials  one row per registered card. credential_id is the
+--    authenticator's own id (base64url) and is UNIQUE: a card can belong to one
+--    builder. sign_count is kept so a counter that goes backwards can be caught.
+--  * passkey_user_handles one random handle per builder, minted on first use.
+--  * passkey_challenges   short-lived, single-use. A row is DELETED when consumed;
+--    expires_at lets a sweep remove the ones nobody answered. builder_id is nullable
+--    because a sign-in ceremony starts before the builder is known.
+
+CREATE TABLE IF NOT EXISTS passkey_credentials (
+  id             bigserial PRIMARY KEY,
+  credential_id  text        NOT NULL UNIQUE,
+  builder_id     bigint      NOT NULL REFERENCES builders(id) ON DELETE CASCADE,
+  public_key     bytea       NOT NULL,
+  sign_count     bigint      NOT NULL DEFAULT 0,
+  transports     text[]      NOT NULL DEFAULT '{}',
+  aaguid         text,
+  nickname       text,
+  created_at     timestamptz NOT NULL DEFAULT now(),
+  last_used_at   timestamptz
+);
+
+CREATE INDEX IF NOT EXISTS idx_passkey_credentials_builder
+  ON passkey_credentials (builder_id);
+
+CREATE TABLE IF NOT EXISTS passkey_user_handles (
+  builder_id   bigint PRIMARY KEY REFERENCES builders(id) ON DELETE CASCADE,
+  user_handle  text   NOT NULL UNIQUE,
+  created_at   timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS passkey_challenges (
+  challenge   text        PRIMARY KEY,
+  purpose     text        NOT NULL CHECK (purpose IN ('register', 'authenticate')),
+  builder_id  bigint      REFERENCES builders(id) ON DELETE CASCADE,
+  created_at  timestamptz NOT NULL DEFAULT now(),
+  expires_at  timestamptz NOT NULL
+);
+
+CREATE INDEX IF NOT EXISTS idx_passkey_challenges_expires
+  ON passkey_challenges (expires_at);
+
+INSERT INTO schema_migrations (version) VALUES ('core_277_passkey_foundation')
+  ON CONFLICT (version) DO NOTHING;

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.135",
+  "version": "1.21.136",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.135",
+      "version": "1.21.136",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.135",
+  "version": "1.21.136",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9812,5 +9812,11 @@
       "id": "1003462",
       "text": "Adds an Add-a-task form to the Goals page: pick an open goal, name the task, optional description. Sends POST /tasks unchanged; the server's rank floor, goal/version and closed-goal refusals render as sentences. States that a"
     }
+  ],
+  "1.21.136": [
+    {
+      "id": "1004750",
+      "text": "Groundwork for hardware-card sign-in: the database tables and storage code that remember registered cards and the short-lived one-time challenges. Nothing is visible to builders yet."
+    }
   ]
 }

package/scripts/gds/run-unit-tests.js

@@ -232,6 +232,9 @@ const INTEGRATION = new Set([
   // admission reads' statements run on Postgres, and the hub's notice restamp and
   // listing. The DB-free sibling (application_lifecycle) interprets the same WHEREs.
   'invite_expiry_db',
+  // task 1004750 (ADR 0382 D6): passkey tables from the real migration — single-use
+  // challenges, TTL sweep, unique credential id, sign-count regression.
+  'passkey_foundation_db',
   // task 1004408: migration platform_identity_028 deletes the old hub invite's
   // pending rows before a cutoff it reads from the core_upgrades ledger. Only a real
   // engine runs the DO block, the numeric version compare and the one-shot guard.

package/src/bongos/passkeys.js

@@ -0,0 +1,143 @@
+// src/bongos/passkeys.js — passkey (WebAuthn) storage: credentials, the opaque user
+// handle, and the single-use challenge store (task 1004750, ADR 0382 D1/D6).
+//
+// This file is the foundation only: it keeps and hands back state. The registration
+// and sign-in ceremonies, and the routes that drive them, are their own tasks and
+// build on these functions with @simplewebauthn/server.
+//
+// A challenge is single-use: consumeChallenge DELETEs the row and returns it, so a
+// replay finds nothing. A challenge past its TTL is refused even before the sweep
+// has removed it.
+'use strict';
+
+const crypto = require('node:crypto');
+
+const CHALLENGE_TTL_SECONDS = 300;
+const MAX_CHALLENGE_TTL_SECONDS = 600;
+const PURPOSES = Object.freeze(['register', 'authenticate']);
+
+function defaultPool() { return require('./pool').pool; }
+
+function randomToken(bytes) { return crypto.randomBytes(bytes).toString('base64url'); }
+
+// A TTL is a positive whole number of seconds no longer than the ceiling, so a caller
+// forwarding an untrusted value cannot mint a long-lived (or already-dead) challenge.
+function clampTtlSeconds(ttl) {
+  const n = Math.floor(Number(ttl));
+  if (!Number.isFinite(n) || n <= 0) return CHALLENGE_TTL_SECONDS;
+  return Math.min(n, MAX_CHALLENGE_TTL_SECONDS);
+}
+
+// The clone check. A counter that does not advance is suspect, unless the card
+// does not keep one at all (stored and reported both zero).
+function counterAdvances(stored, reported) {
+  if (stored === 0 && reported === 0) return true;
+  return reported > stored;
+}
+
+// Mint and store a challenge. Returns { challenge, expiresAt }.
+async function createChallenge({ purpose, builderId = null, ttlSeconds = CHALLENGE_TTL_SECONDS, pool = defaultPool() } = {}) {
+  if (!PURPOSES.includes(purpose)) throw new Error(`passkeys: bad challenge purpose ${JSON.stringify(purpose)}`);
+  const challenge = randomToken(32);
+  // Housekeeping rides on issuing: expired rows are removed here, so the table is
+  // swept by use and needs no separate scheduler.
+  await sweepExpiredChallenges({ pool });
+  const { rows } = await pool.query(
+    `INSERT INTO passkey_challenges (challenge, purpose, builder_id, expires_at)
+     VALUES ($1, $2, $3, now() + make_interval(secs => $4::int))
+     RETURNING expires_at`,
+    [challenge, purpose, builderId, String(clampTtlSeconds(ttlSeconds))],
+  );
+  return { challenge, expiresAt: rows[0].expires_at };
+}
+
+// Take a challenge: delete it and return { purpose, builderId } if it was live, else
+// null. Pass expectPurpose (and expectBuilderId for a signed-in registration) and a
+// challenge issued for something else is refused. It is still spent: a wrong-purpose
+// presentation burns it rather than leaving it to be tried again.
+async function consumeChallenge(challenge, { expectPurpose = null, expectBuilderId = null, pool = defaultPool() } = {}) {
+  if (typeof challenge !== 'string' || !challenge) return null;
+  const { rows } = await pool.query(
+    `DELETE FROM passkey_challenges WHERE challenge = $1
+     RETURNING purpose, builder_id, (expires_at > now()) AS live`,
+    [challenge],
+  );
+  const r = rows[0];
+  if (!r || !r.live) return null;
+  if (expectPurpose != null && r.purpose !== expectPurpose) return null;
+  if (expectBuilderId != null && String(r.builder_id) !== String(expectBuilderId)) return null;
+  return { purpose: r.purpose, builderId: r.builder_id == null ? null : String(r.builder_id) };
+}
+
+// Remove every challenge past its TTL. Returns the number removed.
+async function sweepExpiredChallenges({ pool = defaultPool() } = {}) {
+  const r = await pool.query('DELETE FROM passkey_challenges WHERE expires_at <= now()');
+  return r.rowCount;
+}
+
+// The builder's opaque WebAuthn user handle, minted on first use. Never the email.
+async function getOrCreateUserHandle(builderId, { pool = defaultPool() } = {}) {
+  const { rows } = await pool.query(
+    `INSERT INTO passkey_user_handles (builder_id, user_handle) VALUES ($1, $2)
+     ON CONFLICT (builder_id) DO UPDATE SET builder_id = EXCLUDED.builder_id
+     RETURNING user_handle`,
+    [builderId, randomToken(32)],
+  );
+  return rows[0].user_handle;
+}
+
+async function addCredential({ builderId, credentialId, publicKey, signCount = 0, transports = [], aaguid = null, nickname = null }, { pool = defaultPool() } = {}) {
+  const { rows } = await pool.query(
+    `INSERT INTO passkey_credentials (credential_id, builder_id, public_key, sign_count, transports, aaguid, nickname)
+     VALUES ($1, $2, $3, $4, $5, $6, $7) RETURNING id, created_at`,
+    [credentialId, builderId, Buffer.from(publicKey), signCount, transports, aaguid, nickname],
+  );
+  return rows[0];
+}
+
+async function getCredentialById(credentialId, { pool = defaultPool() } = {}) {
+  const { rows } = await pool.query(
+    `SELECT id, credential_id, builder_id, public_key, sign_count, transports, aaguid, nickname, created_at, last_used_at
+       FROM passkey_credentials WHERE credential_id = $1`,
+    [credentialId],
+  );
+  return rows[0] || null;
+}
+
+async function listCredentials(builderId, { pool = defaultPool() } = {}) {
+  const { rows } = await pool.query(
+    `SELECT id, credential_id, transports, aaguid, nickname, created_at, last_used_at
+       FROM passkey_credentials WHERE builder_id = $1 ORDER BY created_at, id`,
+    [builderId],
+  );
+  return rows;
+}
+
+// Record a successful use. One guarded UPDATE both checks and writes, so two
+// concurrent assertions carrying the same counter cannot both pass and the stored
+// counter can never be lowered. A counter that does not advance (unless the card keeps
+// none) is a possible clone: nothing is written and the reason says why.
+async function recordUse(credentialId, newSignCount, { pool = defaultPool() } = {}) {
+  const r = await pool.query(
+    `UPDATE passkey_credentials SET sign_count = $2, last_used_at = now()
+      WHERE credential_id = $1 AND (($2 = 0 AND sign_count = 0) OR $2 > sign_count)`,
+    [credentialId, newSignCount],
+  );
+  if (r.rowCount > 0) return { ok: true };
+  const cred = await getCredentialById(credentialId, { pool });
+  return { ok: false, reason: cred ? 'sign_count_regressed' : 'unknown_credential' };
+}
+
+async function removeCredential(builderId, credentialId, { pool = defaultPool() } = {}) {
+  const r = await pool.query(
+    'DELETE FROM passkey_credentials WHERE builder_id = $1 AND credential_id = $2',
+    [builderId, credentialId],
+  );
+  return r.rowCount > 0;
+}
+
+module.exports = {
+  CHALLENGE_TTL_SECONDS, MAX_CHALLENGE_TTL_SECONDS, PURPOSES, clampTtlSeconds, counterAdvances,
+  createChallenge, consumeChallenge, sweepExpiredChallenges,
+  getOrCreateUserHandle, addCredential, getCredentialById, listCredentials, recordUse, removeCredential,
+};

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.135'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.136'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/passkey_foundation_db.mjs

@@ -0,0 +1,90 @@
+// tests/passkey_foundation_db.mjs — task 1004750 (ADR 0382 D1, D6). Real DB.
+// The passkey tables built from the real migration in a throwaway schema, and the
+// store's rules: single-use challenges, TTL, sweep, unique credential ids, sign-count.
+// Self-skips without a reachable Postgres.
+// Run:  DATABASE_URL=... node tests/passkey_foundation_db.mjs
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+import { strict as assert } from 'node:assert';
+const require = createRequire(import.meta.url);
+const { Pool } = require('pg');
+const here = dirname(fileURLToPath(import.meta.url));
+
+const pgPool = new Pool({ connectionString: process.env.DATABASE_URL || undefined, max: 1 });
+let client;
+try { client = await pgPool.connect(); } catch (e) {
+  console.log(`passkey_foundation_db.mjs SKIPPED — no reachable Postgres (${e.code || e.message}).`);
+  await pgPool.end().catch(() => {});
+  process.exit(0);
+}
+const SCHEMA = `t1004750_${process.pid}`;
+let pass = 0;
+const ok = (c, m) => { assert.ok(c, m); pass++; console.log(`  ok - ${m}`); };
+
+try {
+  await client.query(`CREATE SCHEMA ${SCHEMA}`);
+  await client.query(`SET search_path TO ${SCHEMA}`);
+  await client.query('CREATE TABLE builders (id bigserial PRIMARY KEY)');
+  await client.query('CREATE TABLE schema_migrations (version text PRIMARY KEY)');
+  await client.query(readFileSync(join(here, '..', 'migrations', 'core_277_passkey_foundation.sql'), 'utf8'));
+  await client.query('INSERT INTO builders DEFAULT VALUES');
+  await client.query('INSERT INTO builders DEFAULT VALUES');
+
+  const pk = require('../src/bongos/passkeys.js');
+  const o = { pool: client };
+
+  const c = await pk.createChallenge({ purpose: 'register', builderId: 1, ...o });
+  ok(typeof c.challenge === 'string' && c.challenge.length >= 40, 'challenge is long random base64url');
+  const got = await pk.consumeChallenge(c.challenge, o);
+  ok(got && got.purpose === 'register' && got.builderId === '1', 'a live challenge is consumed once');
+  ok((await pk.consumeChallenge(c.challenge, o)) === null, 'a second consume (replay) finds nothing');
+
+  const expire = (ch) => client.query("UPDATE passkey_challenges SET expires_at = now() - interval '1 second' WHERE challenge = $1", [ch]);
+  const old = await pk.createChallenge({ purpose: 'authenticate', ...o });
+  await expire(old.challenge);
+  ok((await pk.consumeChallenge(old.challenge, o)) === null, 'an expired challenge is refused');
+  const stale = await pk.createChallenge({ purpose: 'authenticate', ...o });
+  await expire(stale.challenge);
+  const live = await pk.createChallenge({ purpose: 'authenticate', ...o });
+  ok((await client.query('SELECT 1 FROM passkey_challenges WHERE challenge = $1', [stale.challenge])).rowCount === 0, 'issuing a challenge sweeps expired rows');
+  const stale2 = await pk.createChallenge({ purpose: 'authenticate', ...o });
+  await expire(stale2.challenge);
+  ok((await pk.sweepExpiredChallenges(o)) === 1, 'sweep removes only expired challenges');
+  ok((await pk.consumeChallenge(live.challenge, o)) !== null, 'sweep left the live one');
+  await assert.rejects(pk.createChallenge({ purpose: 'nope', ...o }));
+  pass++; console.log('  ok - unknown purpose rejected');
+  await assert.rejects(client.query("INSERT INTO passkey_challenges (challenge, purpose, expires_at) VALUES ('x','bogus', now())"));
+  pass++; console.log('  ok - the table itself refuses an unknown purpose');
+
+  const wrong = await pk.createChallenge({ purpose: 'register', builderId: 1, ...o });
+  ok((await pk.consumeChallenge(wrong.challenge, { ...o, expectPurpose: 'authenticate' })) === null, 'a challenge for another purpose is refused');
+  ok((await pk.consumeChallenge(wrong.challenge, o)) === null, 'and it is spent by the wrong presentation');
+  const b1 = await pk.createChallenge({ purpose: 'register', builderId: 1, ...o });
+  ok((await pk.consumeChallenge(b1.challenge, { ...o, expectBuilderId: 2 })) === null, 'a challenge for another builder is refused');
+  const b2 = await pk.createChallenge({ purpose: 'register', builderId: 1, ...o });
+  ok((await pk.consumeChallenge(b2.challenge, { ...o, expectPurpose: 'register', expectBuilderId: 1 })) !== null, 'matching purpose and builder pass');
+
+  const h1 = await pk.getOrCreateUserHandle(1, o);
+  ok(h1 === await pk.getOrCreateUserHandle(1, o) && h1 !== await pk.getOrCreateUserHandle(2, o), 'user handle is stable per builder and distinct');
+
+  await pk.addCredential({ builderId: 1, credentialId: 'cred-a', publicKey: Buffer.from([1, 2, 3]), transports: ['usb'], nickname: 'card' }, o);
+  await assert.rejects(pk.addCredential({ builderId: 2, credentialId: 'cred-a', publicKey: Buffer.from([9]) }, o));
+  pass++; console.log('  ok - a credential id belongs to one builder');
+  ok((await pk.listCredentials(1, o)).length === 1 && (await pk.listCredentials(2, o)).length === 0, 'credentials listed per builder');
+
+  ok((await pk.recordUse('cred-a', 5, o)).ok, 'sign count advances');
+  ok((await pk.recordUse('cred-a', 5, o)).reason === 'sign_count_regressed', 'a non-advancing counter is refused');
+  ok((await pk.recordUse('cred-a', 3, o)).reason === 'sign_count_regressed' && Number((await pk.getCredentialById('cred-a', o)).sign_count) === 5, 'a lower counter never overwrites the stored one');
+  ok((await pk.recordUse('nope', 1, o)).reason === 'unknown_credential', 'unknown credential reported');
+  ok((await pk.getCredentialById('cred-a', o)).last_used_at != null, 'last_used_at is stamped');
+  ok(!(await pk.removeCredential(2, 'cred-a', o)), 'another builder cannot remove it');
+  ok(await pk.removeCredential(1, 'cred-a', o), 'owner removes it');
+  console.log(`passkey_foundation_db.mjs: ${pass} passed`);
+} finally {
+  await client.query('SET search_path TO public').catch(() => {});
+  await client.query(`DROP SCHEMA IF EXISTS ${SCHEMA} CASCADE`).catch(() => {});
+  client.release();
+  await pgPool.end();
+}

package/tests/passkey_pure.mjs

@@ -0,0 +1,24 @@
+// tests/passkey_pure.mjs — task 1004750 (ADR 0382 D6). DB-free: the pure rules of
+// src/bongos/passkeys.js that the required unit lane can run. The real-SQL half is
+// tests/passkey_foundation_db.mjs.
+import { createRequire } from 'node:module';
+import { strict as assert } from 'node:assert';
+const require = createRequire(import.meta.url);
+const pk = require('../src/bongos/passkeys.js');
+
+let pass = 0;
+const ok = (c, m) => { assert.ok(c, m); pass++; console.log(`  ok - ${m}`); };
+
+ok(pk.PURPOSES.includes('register') && pk.PURPOSES.includes('authenticate') && pk.PURPOSES.length === 2, 'two ceremony purposes');
+ok(pk.clampTtlSeconds(60) === 60, 'a sane TTL passes through');
+ok(pk.clampTtlSeconds(-5) === pk.CHALLENGE_TTL_SECONDS, 'a negative TTL falls back to the default');
+ok(pk.clampTtlSeconds('abc') === pk.CHALLENGE_TTL_SECONDS, 'a non-number falls back to the default');
+ok(pk.clampTtlSeconds(86400) === pk.MAX_CHALLENGE_TTL_SECONDS, 'a huge TTL is capped');
+ok(pk.counterAdvances(0, 0), 'a card with no counter is accepted');
+ok(pk.counterAdvances(5, 6), 'an advancing counter is accepted');
+ok(!pk.counterAdvances(5, 5), 'a repeated counter is refused');
+ok(!pk.counterAdvances(5, 3), 'a lower counter is refused');
+ok(!pk.counterAdvances(5, 0), 'a counter reset to zero is refused');
+await assert.rejects(pk.createChallenge({ purpose: 'bogus', pool: { query: async () => { throw new Error('should not query'); } } }));
+pass++; console.log('  ok - an unknown purpose is rejected before any query');
+console.log(`passkey_pure.mjs: ${pass} passed`);