@bongos/core 1.21.136 → 1.21.137

package/docs/api/openapi.json

@@ -13779,6 +13779,272 @@
         ]
       }
     },
+    "/me/passkeys": {
+      "get": {
+        "operationId": "get_me_passkeys",
+        "tags": [
+          "me"
+        ],
+        "summary": "GET /me/passkeys",
+        "description": "GET /api/bongos/me/passkeys — the caller's registered cards. rank: any-builder (own identity only).\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "src/bongos/routes/my-passkeys.js",
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetMePasskeysResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
+    "/me/passkeys/browser.js": {
+      "get": {
+        "operationId": "get_me_passkeys_browser_js",
+        "tags": [
+          "me"
+        ],
+        "summary": "GET /me/passkeys/browser.js",
+        "description": "GET /api/bongos/me/passkeys/browser.js — the vetted @simplewebauthn/browser bundle, served same-origin so the page needs no CDN and no build step. rank: any-builder (own identity only) — a vendored static file at a fixed path, served only to a signed-in builder like the rest of /me.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "src/bongos/routes/my-passkeys.js",
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
+    "/me/passkeys/register/options": {
+      "post": {
+        "operationId": "post_me_passkeys_register_options",
+        "tags": [
+          "me"
+        ],
+        "summary": "POST /me/passkeys/register/options",
+        "description": "POST /api/bongos/me/passkeys/register/options — start adding a card. rank: any-builder (own identity only).\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "src/bongos/routes/my-passkeys.js",
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "additionalProperties": true
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PostMePasskeysRegisterOptionsResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
+    "/me/passkeys/register/verify": {
+      "post": {
+        "operationId": "post_me_passkeys_register_verify",
+        "tags": [
+          "me"
+        ],
+        "summary": "POST /me/passkeys/register/verify",
+        "description": "POST /api/bongos/me/passkeys/register/verify — finish adding a card. Body: { response, nickname? } where response is the browser's attestation. rank: any-builder (own identity only).\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "src/bongos/routes/my-passkeys.js",
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostMePasskeysRegisterVerifyRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PostMePasskeysRegisterVerifyResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
+    "/me/passkeys/remove": {
+      "post": {
+        "operationId": "post_me_passkeys_remove",
+        "tags": [
+          "me"
+        ],
+        "summary": "POST /me/passkeys/remove",
+        "description": "POST /api/bongos/me/passkeys/remove — Body: { credential_id }. rank: any-builder (own identity only) — the WHERE clause is the boundary.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "src/bongos/routes/my-passkeys.js",
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostMePasskeysRemoveRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PostMePasskeysRemoveResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
+    "/me/passkeys/rename": {
+      "post": {
+        "operationId": "post_me_passkeys_rename",
+        "tags": [
+          "me"
+        ],
+        "summary": "POST /me/passkeys/rename",
+        "description": "POST /api/bongos/me/passkeys/rename — Body: { credential_id, nickname }. rank: any-builder (own identity only) — the WHERE clause is the boundary.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "src/bongos/routes/my-passkeys.js",
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostMePasskeysRenameRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PostMePasskeysRenameResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/me/profile": {
       "patch": {
         "operationId": "patch_me_profile",
@@ -27433,6 +27699,15 @@
           "count"
         ]
       },
+      "GetMePasskeysResponse": {
+        "type": "object",
+        "properties": {
+          "passkeys": {}
+        },
+        "required": [
+          "passkeys"
+        ]
+      },
       "GetMeRecentShipsResponse": {
         "type": "object",
         "properties": {
@@ -32548,6 +32823,77 @@
         },
         "additionalProperties": false
       },
+      "PostMePasskeysRegisterOptionsResponse": {
+        "type": "object",
+        "properties": {
+          "options": {}
+        },
+        "required": [
+          "options"
+        ]
+      },
+      "PostMePasskeysRegisterVerifyRequest": {
+        "type": "object",
+        "properties": {
+          "response": {},
+          "nickname": {}
+        },
+        "additionalProperties": false
+      },
+      "PostMePasskeysRegisterVerifyResponse": {
+        "type": "object",
+        "properties": {
+          "ok": {
+            "type": "boolean"
+          },
+          "credential_id": {}
+        },
+        "required": [
+          "ok",
+          "credential_id"
+        ]
+      },
+      "PostMePasskeysRemoveRequest": {
+        "type": "object",
+        "properties": {
+          "credential_id": {
+            "$ref": "#/components/schemas/StringifiableId"
+          }
+        },
+        "additionalProperties": false
+      },
+      "PostMePasskeysRemoveResponse": {
+        "type": "object",
+        "properties": {
+          "ok": {
+            "type": "boolean"
+          }
+        },
+        "required": [
+          "ok"
+        ]
+      },
+      "PostMePasskeysRenameRequest": {
+        "type": "object",
+        "properties": {
+          "credential_id": {
+            "$ref": "#/components/schemas/StringifiableId"
+          },
+          "nickname": {}
+        },
+        "additionalProperties": false
+      },
+      "PostMePasskeysRenameResponse": {
+        "type": "object",
+        "properties": {
+          "ok": {
+            "type": "boolean"
+          }
+        },
+        "required": [
+          "ok"
+        ]
+      },
       "PostMeSessionsRevokeAllResponse": {
         "type": "object",
         "properties": {
@@ -35614,9 +35960,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 558,
-  "x-schema-count": 594,
+  "x-endpoint-count": 564,
+  "x-schema-count": 602,
   "x-undocumented-bodies": 12,
-  "x-response-schemas": 390,
+  "x-response-schemas": 395,
   "x-generated-by": "scripts/gds/gen-api-docs.js"
 }

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 558 endpoints across 95 route files.
+> **Generated from the live route files** — the route file is authoritative. 564 endpoints across 96 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust-boundary-server-enforced-permissions.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -489,7 +489,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | POST | `/api/bongos/llm-cache/lookup` | `metic+archon` | `cache_key`, `tokens_saved_est` | POST /llm-cache/lookup — hit/miss + atomic hit_count bump. |
 | POST | `/api/bongos/llm-cache/store` | `metic+archon` | `spec`, `result_stdout`, `result_cost_usd` | POST /llm-cache/store — upsert a freshly-produced result. |
 
-## `me` (42)
+## `me` (48)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
@@ -519,6 +519,12 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | PATCH | `/api/bongos/me/interaction` | `any-builder` | _undocumented_ | PATCH the interaction profile. |
 | GET | `/api/bongos/me/model-allocation` | `any-builder` | — |  |
 | PATCH | `/api/bongos/me/model-allocation` | `any-builder` | _undocumented_ | PATCH the model allocation. |
+| GET | `/api/bongos/me/passkeys` | `any-builder` | — | GET /api/bongos/me/passkeys — the caller's registered cards. |
+| GET | `/api/bongos/me/passkeys/browser.js` | `any-builder` | — | GET /api/bongos/me/passkeys/browser.js — the vetted @simplewebauthn/browser bundle, served same-origin so the page needs no CDN and no bu… |
+| POST | `/api/bongos/me/passkeys/register/options` | `any-builder` | validated | POST /api/bongos/me/passkeys/register/options — start adding a card. |
+| POST | `/api/bongos/me/passkeys/register/verify` | `any-builder` | `response`, `nickname` | POST /api/bongos/me/passkeys/register/verify — finish adding a card. |
+| POST | `/api/bongos/me/passkeys/remove` | `any-builder` | `credential_id` | POST /api/bongos/me/passkeys/remove — Body: { credential_id }. |
+| POST | `/api/bongos/me/passkeys/rename` | `any-builder` | `credential_id`, `nickname` | POST /api/bongos/me/passkeys/rename — Body: { credential_id, nickname }. |
 | PATCH | `/api/bongos/me/profile` | `any-builder` | `display_name`, `bio`, `links` | the caller's OWN profile fields (P02, task 1002798; spec Decision 4): bio, typed links, account display name. |
 | GET | `/api/bongos/me/profile-nudge` | `any-builder` | — | The "Complete your profile" nudge dismissal (task 1002802 / P06). |
 | PATCH | `/api/bongos/me/profile-nudge` | `any-builder` | _undocumented_ | PATCH the dismissal. |