@bongos/core 1.21.135 → 1.21.137

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.21.135",
-  "core_contract": "1.21.135",
-  "source_commit": "92eebc078b819402dfac89117a1ea3cd6211094e",
+  "core_version": "1.21.137",
+  "core_contract": "1.21.137",
+  "source_commit": "c86eb51909d157098d89f465fc59e049fa7d1e58",
   "source_ref": "HEAD",
-  "built_at": "2026-10-15T21:47:43.041Z",
+  "built_at": "2026-10-16T01:50:11.654Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 608,
     "agent_docs_stubbed": 28,
-    "functional_verbatim": 3149,
+    "functional_verbatim": 3156,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3786,
-  "tree_sha256": "eba8be00953d70046ec4a91b870c28a7382c4a8bee2294650001d9aff411caa2",
+  "file_count": 3793,
+  "tree_sha256": "8d4bf55e04fe47b2dec6621adc95f663ff1324a9e0ed6740af8800eccc2626e1",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -317,12 +317,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "9aea69205101517f33e85bd80593333deb8a015d6c98ae55d73ddc59c3067d12"
+      "sha256": "ee07b17fb2ed804d8a4956169e4576afa890176ca1f44a667ebb87cdb32851dc"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "23208de4f2aa8f0c1c5ec2f7939e637224280c3cf520958148549e2f79c02c9d"
+      "sha256": "a7dfd9594feb6cb5a8bf5be6bdcb281db51f9e7de0873d6245b2a05f874e70b7"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -332,17 +332,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "25dd808eae862cd02ed9a494f5e0ce2ee8d31bb664f78a23c151a95dc1f0c25f"
+      "sha256": "53233758cc7bd160e1baf15fe88c507798523e26b3f3ee3f0cfc48d2b5499dbc"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "d98b7b69f7e2db071b9b10e5e039afdf95262b7196450ef56c73c0acac8717a7"
+      "sha256": "8f4d02ccf2f324ca2d7167beb2cfb145583d760196dcd6188fe50375b953440e"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "c3a776cd09ddde2c4d1d3ed8b3f90daed304c6cc8d459a688585526360c2b5e5"
+      "sha256": "b042d9d65ca78895a81da86aa2c24ed1157081eab311dd9ab2778d1ca7f6b1ed"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -2382,17 +2382,17 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "9ec7dd570500edd3705cd871886734d89780b92df6f185cdc86002288fe7aa7d"
+      "sha256": "52448aa1c68a1b98cd793977dfca8ab02eff7bbdd5947fc1a0dad979763139c7"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "319fce626080497fdf50a50064f0faa56951b1aa021e97edd6ad481d8ee5c9b9"
+      "sha256": "4e622eb1825b3b7d4206d64e58ccea51d5dfa8b486664545f0dca259319280f6"
     },
     {
       "path": "docs/architecture.md",
       "mode": "0000644",
-      "sha256": "fca9878d8501b33c0258045f61365a90e60e148c2b730b00a83a6f4f89b79b8d"
+      "sha256": "3850775c198edeece6ac5497a9f5788421a8082e21edb496a4b00a3fc7a6eb3d"
     },
     {
       "path": "docs/branding-contract.md",
@@ -2412,12 +2412,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "befe58f901848724fd48c74e38ee396b31d2f523313708dbfe90138b9f86a2b2"
+      "sha256": "bf3bea8904852c9de7ef7f176b2e563a19b690e6f16efd7e9d97be7286721643"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "26b2738a40324254a1222b3493eafceb00d77dbe07bfc9a5c882f576901040e0"
+      "sha256": "7be20a02d29a2000b6fa5266e08d67c44b4919c29c3cb9425cdc29a911086d59"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2927,7 +2927,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "820f5b58bcabe2204f9afdd3b19cc08e487d4cc27b749dedeb5748f3a43e48e0"
+      "sha256": "5ea7a7e2b29d2b955b5cd63a3e7824b8ad061869ba333d80cfcca4743a69e623"
     },
     {
       "path": "docs/modules-contract.md",
@@ -3012,12 +3012,12 @@
     {
       "path": "docs/page-inventory.json",
       "mode": "0000644",
-      "sha256": "4b5758170f88553d4b734e08d5c4563cbe7a44c97802ba208098ad0f58f7066d"
+      "sha256": "75b575a84a885a42655bb238d4d4c1176975301a63fa3a92309eb0c8800cbbe2"
     },
     {
       "path": "docs/page-readings.json",
       "mode": "0000644",
-      "sha256": "7fefba487e6aee704f8d23d876d4db7720c9c1231ab61e94f5903f060d96c424"
+      "sha256": "68ec3fef38565c648811b2f35f2c67dd6d4f00290d75bb10b13e01a5021cdac0"
     },
     {
       "path": "docs/project-context.template.md",
@@ -4164,6 +4164,11 @@
       "mode": "0000644",
       "sha256": "550884fa117e707b65f5c56faca0e4e3850905db94d3f275cad5d520aa68db03"
     },
+    {
+      "path": "migrations/core_277_passkey_foundation.sql",
+      "mode": "0000644",
+      "sha256": "52ebc3ce9c3e006ef2dfe0d85c9a97c53896f7b0d8f8fb700a1488a24c7bcb3c"
+    },
     {
       "path": "modules/agents/CLAUDE.md",
       "mode": "0000644",
@@ -6394,6 +6399,11 @@
       "mode": "0000644",
       "sha256": "ec4a94fece6d4fb7528578c96fdb94c8eba13c8786d885b317f0fa3c5152b1bf"
     },
+    {
+      "path": "modules/hall-ui/public/settings-passkeys.js",
+      "mode": "0000644",
+      "sha256": "a094270cfc795b3aff50ea03622efe80ea23e52f83f6dd166309f00ce4f9c1fe"
+    },
     {
       "path": "modules/hall-ui/public/settings-render.js",
       "mode": "0000644",
@@ -6427,7 +6437,7 @@
     {
       "path": "modules/hall-ui/public/settings.html",
       "mode": "0000644",
-      "sha256": "39f79955b028f47de130ae71ae8bc79588b85e2be67cbda3aed55e3dae42477c"
+      "sha256": "9ed15b3ba3cd4a3ccee2c9f1f7591a8d27def5c9ec68f36089b77580a5fae3bb"
     },
     {
       "path": "modules/hall-ui/public/settings.js",
@@ -10522,12 +10532,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "9a1ff520eecca180a4845d8b3485c1d2045d5a04416b264ed007caf8d1903e84"
+      "sha256": "5d3f851dfffdd8dbe16087aac434d8a61c1ea2b787fea127e96826403dab0d88"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "4f1a3afb1e80fd281507467f3ce7c3c6813882e18afe9225515566ae592dac87"
+      "sha256": "829d826c6156f982b406a867b1da02ebe7ec434bf891b9983673611665d7adba"
     },
     {
       "path": "public-docs/index.html",
@@ -10547,7 +10557,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "e648eee9b85160b8871a678d78ba4ded897ef4e16b64d51047c796c88ecda2cd"
+      "sha256": "4897187dcf8923c5d1844383a8d40b2c936539fc95ed163bb5317626445a740f"
     },
     {
       "path": "scripts/cron/style_guide_audit.sh",
@@ -11832,7 +11842,7 @@
     {
       "path": "scripts/gds/run-unit-tests.js",
       "mode": "0000644",
-      "sha256": "d6d81c3bb8017122cb6b5a46355b637f7986ec324132bcd583f0c02d2725b6d0"
+      "sha256": "213d8e4199ab429e64d0c65f4eda42a9d0cb4c64baa1424f793e223af3e66308"
     },
     {
       "path": "scripts/gds/runner-drift.js",
@@ -12689,6 +12699,11 @@
       "mode": "0000644",
       "sha256": "b2f6d65e3463052609e51d135ea560370104d0457a0e7e86bf9b7120fe1cddfb"
     },
+    {
+      "path": "src/bongos/passkeys.js",
+      "mode": "0000644",
+      "sha256": "d8fbe7d1447158d03831a8b436d65d735c041e210aa795dacde635c9dedca535"
+    },
     {
       "path": "src/bongos/path-match.js",
       "mode": "0000644",
@@ -12742,7 +12757,7 @@
     {
       "path": "src/bongos/routes.js",
       "mode": "0000644",
-      "sha256": "489a9014b647733ae684149f1e0ada33161438ac7dee81cc7129eaab3251fa32"
+      "sha256": "8cecddccbfd2faca667de9f8a98f303f46340350adeb41ab3568c067a321bad5"
     },
     {
       "path": "src/bongos/routes/CLAUDE.md",
@@ -12824,6 +12839,11 @@
       "mode": "0000644",
       "sha256": "e6b1b25371695b4aa959f5fdcece31869e827221f0205d1797c8332628d7b6a2"
     },
+    {
+      "path": "src/bongos/routes/my-passkeys.js",
+      "mode": "0000644",
+      "sha256": "5426ad765a0b9fb29963b1a9dac8727b4f0bed352791e34f2f766b2f45b94319"
+    },
     {
       "path": "src/bongos/routes/my-sessions.js",
       "mode": "0000644",
@@ -12902,7 +12922,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "0ace35c177cb9560521ce1c86cb354981310dcce49e45ac31f527afb1002ff30"
+      "sha256": "625f9f01ac46bee06958b614342e87158b4051716ac67e0a3b4f35117f9a300a"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -16619,6 +16639,11 @@
       "mode": "0000644",
       "sha256": "0406212bd27e4b878b27414625071b646e4e023af1694f8fc2449fdc61be243c"
     },
+    {
+      "path": "tests/my_passkeys.mjs",
+      "mode": "0000644",
+      "sha256": "e530acaa045b6db562d8a6a07210efde1cec19a216f6a3a62d379e6457e0029e"
+    },
     {
       "path": "tests/my_projects_surface.mjs",
       "mode": "0000644",
@@ -16787,7 +16812,7 @@
     {
       "path": "tests/own_scope_guard.mjs",
       "mode": "0000644",
-      "sha256": "cdd964e66b9ebe74c504a3916eb3a10b36497af4f5b94924534d2d73f136801a"
+      "sha256": "09e2712e2d94175cef859f31ad46ebb38f34ef445bca3a623ef87fd0b5ffc971"
     },
     {
       "path": "tests/own_session_revoke.mjs",
@@ -16859,6 +16884,16 @@
       "mode": "0000644",
       "sha256": "fd69c44ebf3d246ecedf527275448389cca809e231d1c6cb34e4c12bfdc38111"
     },
+    {
+      "path": "tests/passkey_foundation_db.mjs",
+      "mode": "0000644",
+      "sha256": "5ff76c608f9f7b687e6b65af6bc667bdb42a21d520425b16bf15d36ca03848d9"
+    },
+    {
+      "path": "tests/passkey_pure.mjs",
+      "mode": "0000644",
+      "sha256": "d0466c6a46c2eadd023801640d5da2d395d68cab8c8a9a46eee9b2e88e8c5182"
+    },
     {
       "path": "tests/paste_token_api_base.mjs",
       "mode": "0000644",

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 558 operations across 76 resource groups
+- 564 operations across 76 resource groups
 
 ## Use it from your project
 

package/clients/bongos-client/bongos-client.global.js

@@ -749,6 +749,18 @@ function createClient(opts = {}) {
       getMeModelAllocation: (args) => request("GET", "/me/model-allocation", { hasBody: false }, args),
       // PATCH /me/model-allocation — rank: any-builder — PATCH /me/model-allocation
       patchMeModelAllocation: (args) => request("PATCH", "/me/model-allocation", { hasBody: true }, args),
+      // GET /me/passkeys — rank: any-builder — GET /me/passkeys
+      getMePasskeys: (args) => request("GET", "/me/passkeys", { hasBody: false }, args),
+      // GET /me/passkeys/browser.js — rank: any-builder — GET /me/passkeys/browser.js
+      getMePasskeysBrowserJs: (args) => request("GET", "/me/passkeys/browser.js", { hasBody: false }, args),
+      // POST /me/passkeys/register/options — rank: any-builder — POST /me/passkeys/register/options
+      postMePasskeysRegisterOptions: (args) => request("POST", "/me/passkeys/register/options", { hasBody: true }, args),
+      // POST /me/passkeys/register/verify — rank: any-builder — POST /me/passkeys/register/verify
+      postMePasskeysRegisterVerify: (args) => request("POST", "/me/passkeys/register/verify", { hasBody: true }, args),
+      // POST /me/passkeys/remove — rank: any-builder — POST /me/passkeys/remove
+      postMePasskeysRemove: (args) => request("POST", "/me/passkeys/remove", { hasBody: true }, args),
+      // POST /me/passkeys/rename — rank: any-builder — POST /me/passkeys/rename
+      postMePasskeysRename: (args) => request("POST", "/me/passkeys/rename", { hasBody: true }, args),
       // PATCH /me/profile — rank: any-builder — PATCH /me/profile
       patchMeProfile: (args) => request("PATCH", "/me/profile", { hasBody: true }, args),
       // GET /me/profile-nudge — rank: any-builder — GET /me/profile-nudge

package/clients/bongos-client/index.cjs

@@ -748,6 +748,18 @@ function createClient(opts = {}) {
       getMeModelAllocation: (args) => request("GET", "/me/model-allocation", { hasBody: false }, args),
       // PATCH /me/model-allocation — rank: any-builder — PATCH /me/model-allocation
       patchMeModelAllocation: (args) => request("PATCH", "/me/model-allocation", { hasBody: true }, args),
+      // GET /me/passkeys — rank: any-builder — GET /me/passkeys
+      getMePasskeys: (args) => request("GET", "/me/passkeys", { hasBody: false }, args),
+      // GET /me/passkeys/browser.js — rank: any-builder — GET /me/passkeys/browser.js
+      getMePasskeysBrowserJs: (args) => request("GET", "/me/passkeys/browser.js", { hasBody: false }, args),
+      // POST /me/passkeys/register/options — rank: any-builder — POST /me/passkeys/register/options
+      postMePasskeysRegisterOptions: (args) => request("POST", "/me/passkeys/register/options", { hasBody: true }, args),
+      // POST /me/passkeys/register/verify — rank: any-builder — POST /me/passkeys/register/verify
+      postMePasskeysRegisterVerify: (args) => request("POST", "/me/passkeys/register/verify", { hasBody: true }, args),
+      // POST /me/passkeys/remove — rank: any-builder — POST /me/passkeys/remove
+      postMePasskeysRemove: (args) => request("POST", "/me/passkeys/remove", { hasBody: true }, args),
+      // POST /me/passkeys/rename — rank: any-builder — POST /me/passkeys/rename
+      postMePasskeysRename: (args) => request("POST", "/me/passkeys/rename", { hasBody: true }, args),
       // PATCH /me/profile — rank: any-builder — PATCH /me/profile
       patchMeProfile: (args) => request("PATCH", "/me/profile", { hasBody: true }, args),
       // GET /me/profile-nudge — rank: any-builder — GET /me/profile-nudge

package/clients/bongos-client/index.d.ts

@@ -105,6 +105,7 @@ export interface GetMeFilterViewsResponse { page: unknown; views: unknown }
 export interface GetMeGuildEngagementsResponse { engagements: unknown; count: unknown }
 export interface GetMeGuildRequestsResponse { incoming: unknown; outgoing: unknown; owner_incoming: unknown; incoming_count: unknown; outgoing_count: unknown; owner_incoming_count: unknown }
 export interface GetMeGuildsResponse { guilds: unknown; count: unknown }
+export interface GetMePasskeysResponse { passkeys: unknown }
 export interface GetMeRecentShipsResponse { ships: unknown }
 export interface GetMeSessionsResponse { sessions: unknown }
 export interface GetMeSkillPrefsResponse { prefs: unknown; effective: unknown; defaults: unknown; known_skills: unknown; allowed_models: unknown }
@@ -431,6 +432,13 @@ export interface PostMeFilterViewsRequest { page: string; name: string; values:
 export interface PostMeFilterViewsResponse { page: unknown; view: unknown; views: unknown }
 export interface PostMeHowtoReadRequest { steps?: unknown[]; all?: boolean; how?: string }
 export interface PostMeHowtoResetRequest { steps?: unknown[]; all?: boolean }
+export interface PostMePasskeysRegisterOptionsResponse { options: unknown }
+export interface PostMePasskeysRegisterVerifyRequest { response?: unknown; nickname?: unknown }
+export interface PostMePasskeysRegisterVerifyResponse { ok: boolean; credential_id: unknown }
+export interface PostMePasskeysRemoveRequest { credential_id?: StringifiableId }
+export interface PostMePasskeysRemoveResponse { ok: boolean }
+export interface PostMePasskeysRenameRequest { credential_id?: StringifiableId; nickname?: unknown }
+export interface PostMePasskeysRenameResponse { ok: boolean }
 export interface PostMeSessionsRevokeAllResponse { ok: boolean; revoked: unknown }
 export interface PostMeSessionsRevokeRequest { session_id?: StringifiableId }
 export interface PostMeSessionsRevokeResponse { ok: boolean; revoked: unknown }
@@ -1276,6 +1284,18 @@ export interface BongosClient {
     getMeModelAllocation(args?: RequestArgs): Promise<ApiResponse>;
     /** PATCH /me/model-allocation — rank: any-builder */
     patchMeModelAllocation(args?: RequestArgs): Promise<ApiResponse>;
+    /** GET /me/passkeys — rank: any-builder */
+    getMePasskeys(args?: RequestArgs): Promise<GetMePasskeysResponse>;
+    /** GET /me/passkeys/browser.js — rank: any-builder */
+    getMePasskeysBrowserJs(args?: RequestArgs): Promise<ApiResponse>;
+    /** POST /me/passkeys/register/options — rank: any-builder */
+    postMePasskeysRegisterOptions(args?: RequestArgs): Promise<PostMePasskeysRegisterOptionsResponse>;
+    /** POST /me/passkeys/register/verify — rank: any-builder */
+    postMePasskeysRegisterVerify(args?: RequestArgs & { body?: PostMePasskeysRegisterVerifyRequest }): Promise<PostMePasskeysRegisterVerifyResponse>;
+    /** POST /me/passkeys/remove — rank: any-builder */
+    postMePasskeysRemove(args?: RequestArgs & { body?: PostMePasskeysRemoveRequest }): Promise<PostMePasskeysRemoveResponse>;
+    /** POST /me/passkeys/rename — rank: any-builder */
+    postMePasskeysRename(args?: RequestArgs & { body?: PostMePasskeysRenameRequest }): Promise<PostMePasskeysRenameResponse>;
     /** PATCH /me/profile — rank: any-builder */
     patchMeProfile(args?: RequestArgs & { body?: PatchMeProfileRequest }): Promise<PatchMeProfileResponse>;
     /** GET /me/profile-nudge — rank: any-builder */

package/clients/bongos-client/index.mjs

@@ -745,6 +745,18 @@ export function createClient(opts = {}) {
       getMeModelAllocation: (args) => request("GET", "/me/model-allocation", { hasBody: false }, args),
       // PATCH /me/model-allocation — rank: any-builder — PATCH /me/model-allocation
       patchMeModelAllocation: (args) => request("PATCH", "/me/model-allocation", { hasBody: true }, args),
+      // GET /me/passkeys — rank: any-builder — GET /me/passkeys
+      getMePasskeys: (args) => request("GET", "/me/passkeys", { hasBody: false }, args),
+      // GET /me/passkeys/browser.js — rank: any-builder — GET /me/passkeys/browser.js
+      getMePasskeysBrowserJs: (args) => request("GET", "/me/passkeys/browser.js", { hasBody: false }, args),
+      // POST /me/passkeys/register/options — rank: any-builder — POST /me/passkeys/register/options
+      postMePasskeysRegisterOptions: (args) => request("POST", "/me/passkeys/register/options", { hasBody: true }, args),
+      // POST /me/passkeys/register/verify — rank: any-builder — POST /me/passkeys/register/verify
+      postMePasskeysRegisterVerify: (args) => request("POST", "/me/passkeys/register/verify", { hasBody: true }, args),
+      // POST /me/passkeys/remove — rank: any-builder — POST /me/passkeys/remove
+      postMePasskeysRemove: (args) => request("POST", "/me/passkeys/remove", { hasBody: true }, args),
+      // POST /me/passkeys/rename — rank: any-builder — POST /me/passkeys/rename
+      postMePasskeysRename: (args) => request("POST", "/me/passkeys/rename", { hasBody: true }, args),
       // PATCH /me/profile — rank: any-builder — PATCH /me/profile
       patchMeProfile: (args) => request("PATCH", "/me/profile", { hasBody: true }, args),
       // GET /me/profile-nudge — rank: any-builder — GET /me/profile-nudge