@bongos/core 1.21.136 → 1.21.137

package/modules/hall-ui/public/settings-passkeys.js

@@ -0,0 +1,113 @@
+// modules/hall-ui/public/settings-passkeys.js — the "Security cards" panel on
+// /builders/settings (task 1004746, ADR 0382). List, add, rename, remove the
+// signed-in builder's FIDO cards. All identity is the server's session; this file
+// only drives the ceremony the browser library performs.
+(() => {
+  'use strict';
+
+  const API = '/api/bongos';
+  const { escapeHtml, $, fmtDate } = window.OTB;
+  const toast = (msg) => window.OTB.toast(msg);
+  const api = window.BongosClient.createClient({ baseUrl: '', credentials: 'same-origin', throwOnError: false });
+  const toAuth = () => window.location.assign(`${API}/auth/web/start`);
+
+  const fail = (res) => new Error((res.data && res.data.message) || `HTTP ${res.status}`);
+
+  function rowHtml(c) {
+    const name = c.nickname || 'Unnamed card';
+    const used = c.last_used_at ? `last used ${escapeHtml(fmtDate(c.last_used_at))}` : 'never used';
+    return `<div class="sessions-row" data-id="${escapeHtml(c.credential_id)}">
+      <div class="sessions-row__main">
+        <strong>${escapeHtml(name)}</strong>
+        <span class="sessions-row__when">added ${escapeHtml(fmtDate(c.created_at))} · ${used}</span>
+      </div>
+      <button type="button" class="settings-btn settings-btn--quiet passkeys-rename">Rename</button>
+      <button type="button" class="settings-btn settings-btn--quiet passkeys-remove">Remove</button>
+    </div>`;
+  }
+
+  async function render() {
+    const res = await api.request('GET', `${API}/me/passkeys`);
+    if (res.status === 401) { toAuth(); return; }
+    if (!res.ok) throw fail(res);
+    const cards = (res.data && res.data.passkeys) || [];
+    const list = $('#passkeys-list');
+    list.innerHTML = cards.length ? cards.map(rowHtml).join('') : '<p class="settings-card__hint">No cards registered yet.</p>';
+    for (const row of list.querySelectorAll('.sessions-row')) {
+      const id = row.getAttribute('data-id');
+      row.querySelector('.passkeys-rename').addEventListener('click', () => rename(id, row));
+      row.querySelector('.passkeys-remove').addEventListener('click', () => remove(id));
+    }
+  }
+
+  async function rename(id, row) {
+    const current = row.querySelector('strong').textContent;
+    const next = window.prompt('Name this card', current === 'Unnamed card' ? '' : current);
+    if (next === null) return;
+    try {
+      const res = await api.request('POST', `${API}/me/passkeys/rename`, { body: { credential_id: id, nickname: next } });
+      if (!res.ok) throw fail(res);
+      await render();
+    } catch (err) { toast(`Could not rename that card: ${err.message}`); }
+  }
+
+  async function remove(id) {
+    if (!window.confirm('Remove this card? You can register it again later.')) return;
+    try {
+      const res = await api.request('POST', `${API}/me/passkeys/remove`, { body: { credential_id: id } });
+      if (!res.ok) throw fail(res);
+      toast('Card removed.');
+      await render();
+    } catch (err) { toast(`Could not remove that card: ${err.message}`); }
+  }
+
+  function loadBrowserLib() {
+    if (window.SimpleWebAuthnBrowser) return Promise.resolve(window.SimpleWebAuthnBrowser);
+    return new Promise((resolve, reject) => {
+      const s = document.createElement('script');
+      s.src = `${API}/me/passkeys/browser.js`;
+      s.onload = () => resolve(window.SimpleWebAuthnBrowser);
+      s.onerror = () => reject(new Error('could not load the card library'));
+      document.head.appendChild(s);
+    });
+  }
+
+  async function add() {
+    const btn = $('#passkeys-add');
+    const status = $('#passkeys-status');
+    btn.disabled = true;
+    status.textContent = 'Waiting for your card…';
+    try {
+      const lib = await loadBrowserLib();
+      if (!lib.browserSupportsWebAuthn()) throw new Error('this browser does not support security cards');
+      const opt = await api.request('POST', `${API}/me/passkeys/register/options`, { body: {} });
+      if (opt.status === 401) { toAuth(); return; }
+      if (!opt.ok) throw fail(opt);
+      const attestation = await lib.startRegistration({ optionsJSON: opt.data.options });
+      const nickname = $('#passkeys-nickname').value;
+      const ver = await api.request('POST', `${API}/me/passkeys/register/verify`, { body: { response: attestation, nickname } });
+      if (!ver.ok) throw fail(ver);
+      $('#passkeys-nickname').value = '';
+      status.textContent = '';
+      toast('Card added.');
+      await render();
+    } catch (err) {
+      status.textContent = '';
+      toast(`Could not add a card: ${err.name === 'NotAllowedError' ? 'cancelled or timed out' : err.message}`);
+    } finally {
+      btn.disabled = false;
+    }
+  }
+
+  async function setup() {
+    try {
+      await render();
+      $('#passkeys-scroll').hidden = false;
+      $('#passkeys-add').addEventListener('click', add);
+    } catch (err) {
+      toast(`Could not load your security cards: ${err.message}`);
+    }
+  }
+
+  setup();
+})();

package/modules/hall-ui/public/settings.html

@@ -171,6 +171,25 @@
               <p class="section-note">Ending a session takes effect immediately; the token stops working on its very next request.</p>
             </section>
 
+            <!-- SECURITY CARDS - register, rename and remove your FIDO hardware
+                 cards (task 1004746, ADR 0382). Rendered by settings-passkeys.js
+                 against /api/bongos/me/passkeys. -->
+            <section class="scroll" id="passkeys-scroll" aria-labelledby="passkeys-h" data-group="access" hidden>
+              <h2 id="passkeys-h" class="scroll__h">Security cards</h2>
+              <p class="scroll__lede">
+                Register a hardware security card (or a phone or laptop passkey) so it can
+                be asked for as a second check on sensitive actions. Registering a card
+                does not change how you sign in.
+              </p>
+              <div id="passkeys-list" class="sessions-list" aria-live="polite"></div>
+              <div class="settings-card">
+                <input type="text" id="passkeys-nickname" maxlength="60" placeholder="Name this card (optional)" aria-label="Card name">
+                <button type="button" class="settings-btn" id="passkeys-add">Add a card</button>
+                <span class="settings-status" id="passkeys-status" role="status" aria-live="polite"></span>
+              </div>
+              <p class="section-note">Hold the card to your reader or touch it when your browser asks. Keep more than one registered in case one is lost.</p>
+            </section>
+
             <!-- YOUR AUTOBONGOS RUNNER — which goals your own unattended runner
                  works (task 1004501). Rendered by settings-autobongos.js against
                  GET /autonomy/fence (your effective fence) and PUT
@@ -467,6 +486,7 @@
 <!-- task 1003341: the Active sessions panel. Its own file rather than more of
      settings.js, which sits close to the 1500-line size ratchet. -->
 <script src="/builders/settings-sessions.js?v=2026-08-29-sessions"></script>
+<script src="/builders/settings-passkeys.js?v=2026-10-15-passkeys"></script>
 <!-- task 1002514: the interaction-profile panel ("How Claude talks to you"), on
      the same precedent and for the same reason — settings.js is against the
      1500-line ratchet, and this panel shares nothing with the rest of the page. -->

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.136",
+  "version": "1.21.137",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.136",
+      "version": "1.21.137",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.136",
+  "version": "1.21.137",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9818,5 +9818,11 @@
       "id": "1004750",
       "text": "Groundwork for hardware-card sign-in: the database tables and storage code that remember registered cards and the short-lived one-time challenges. Nothing is visible to builders yet."
     }
+  ],
+  "1.21.137": [
+    {
+      "id": "1004746",
+      "text": "Builders can now register, list, rename and remove a hardware security card from Settings."
+    }
   ]
 }

package/src/bongos/passkeys.js

@@ -136,8 +136,18 @@ async function removeCredential(builderId, credentialId, { pool = defaultPool()
   return r.rowCount > 0;
 }
 
+// Rename a card. Scoped to the builder in the WHERE clause, so another builder's
+// credential id matches no row.
+async function renameCredential(builderId, credentialId, nickname, { pool = defaultPool() } = {}) {
+  const r = await pool.query(
+    'UPDATE passkey_credentials SET nickname = $3 WHERE builder_id = $1 AND credential_id = $2',
+    [builderId, credentialId, nickname],
+  );
+  return r.rowCount > 0;
+}
+
 module.exports = {
   CHALLENGE_TTL_SECONDS, MAX_CHALLENGE_TTL_SECONDS, PURPOSES, clampTtlSeconds, counterAdvances,
   createChallenge, consumeChallenge, sweepExpiredChallenges,
-  getOrCreateUserHandle, addCredential, getCredentialById, listCredentials, recordUse, removeCredential,
+  getOrCreateUserHandle, addCredential, getCredentialById, listCredentials, recordUse, removeCredential, renameCredential,
 };

package/src/bongos/routes/my-passkeys.js

@@ -0,0 +1,249 @@
+// src/bongos/routes/my-passkeys.js — a signed-in builder's own hardware cards:
+// register one, list them, rename one, remove one (task 1004746, ADR 0382 D3/D6).
+//
+// THE INVARIANT, as in my-sessions.js: the account is ALWAYS req.builder.id, taken
+// from the session the caller presented. It is never read from the body, query or
+// path, and every store call is keyed on it, so a credential id belonging to
+// somebody else matches nothing.
+//
+// A card is a second factor added AFTER normal sign-in (D2/D3); this file only
+// registers and manages cards. Nothing here switches a requirement on.
+//
+// Registration is two steps: `register/options` mints a single-use challenge bound
+// to the builder, `register/verify` consumes it (a replay or someone else's
+// challenge finds nothing) and stores the public half of the card. The private key
+// never leaves the card.
+
+const express = require('express');
+const path = require('node:path');
+const fs = require('node:fs');
+const auth = require('../auth');
+const { validateOrRespond, publicOrigin } = require('./_helpers');
+const log = require('../logger').logger.child({ src: 'my-passkeys' });
+
+const NICKNAME_MAX = 60;
+const CREDENTIAL_ID_RE = /^[A-Za-z0-9_-]{1,1024}$/;
+const MAX_CARDS_PER_BUILDER = 10;
+
+// The RP ID and origin are configuration, set once by the owner (ADR 0382 D7):
+// PASSKEY_ORIGIN and PASSKEY_RP_ID. Request headers are attacker-influenceable and
+// origin pinning is WebAuthn's whole protection, so the request is trusted ONLY for a
+// local development host; anywhere else, unset config means refuse, not guess.
+const LOCAL_HOST_RE = /^(localhost|127\.0\.0\.1|\[::1\]|[a-z0-9-]+\.localhost)$/i;
+function relyingParty(req) {
+  const rpName = process.env.PASSKEY_RP_NAME || 'Cloud Bongos';
+  let origin = process.env.PASSKEY_ORIGIN || null;
+  let rpID = process.env.PASSKEY_RP_ID || null;
+  if (!origin) {
+    const fromReq = publicOrigin(req);
+    let host = null;
+    try { host = new URL(fromReq).hostname; } catch { host = null; }
+    if (host && LOCAL_HOST_RE.test(host)) origin = fromReq;
+  }
+  if (!rpID && origin) { try { rpID = new URL(origin).hostname.replace(/^\[|\]$/g, ''); } catch { rpID = null; } }
+  return origin && rpID ? { origin, rpID, rpName } : null;
+}
+
+// The vendored browser bundle, resolved once. The package's exports map hides its
+// package.json, so walk up from the resolved entry to the package root instead.
+let bundleFile;
+function browserBundleFile() {
+  if (bundleFile !== undefined) return bundleFile;
+  bundleFile = null;
+  try {
+    let dir = path.dirname(require.resolve('@simplewebauthn/browser'));
+    for (let i = 0; i < 6 && !fs.existsSync(path.join(dir, 'dist', 'bundle')); i++) dir = path.dirname(dir);
+    const file = path.join(dir, 'dist', 'bundle', 'index.umd.min.js');
+    if (fs.existsSync(file)) bundleFile = file;
+  } catch { /* leave null */ }
+  return bundleFile;
+}
+
+function cleanNickname(raw) {
+  if (raw === undefined || raw === null) return { value: null };
+  if (typeof raw !== 'string') return { error: 'nickname must be text' };
+  const v = raw.replace(/\s+/g, ' ').trim();
+  if (v.length > NICKNAME_MAX) return { error: `nickname must be ${NICKNAME_MAX} characters or fewer` };
+  return { value: v || null };
+}
+
+function presentCard(row) {
+  return {
+    credential_id: row.credential_id,
+    nickname: row.nickname ?? null,
+    transports: row.transports || [],
+    created_at: row.created_at,
+    last_used_at: row.last_used_at ?? null,
+  };
+}
+
+// Dependencies are injectable so the route is testable without Postgres or a real
+// authenticator; production passes none.
+module.exports = function buildMyPasskeysRouter({
+  store = require('../passkeys'),
+  webauthn = null,
+  requireBuilder = auth.requireBuilder,
+} = {}) {
+  const router = express.Router();
+  const lib = () => webauthn || require('@simplewebauthn/server');
+
+  // GET /api/bongos/me/passkeys — the caller's registered cards.
+  // rank: any-builder (own identity only).
+  router.get('/me/passkeys', requireBuilder, async (req, res) => {
+    try {
+      const rows = await store.listCredentials(req.builder.id);
+      res.json({ passkeys: rows.map(presentCard) });
+    } catch (err) {
+      log.error({ err: err && err.message }, 'GET /me/passkeys failed');
+      res.fail('list_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  // GET /api/bongos/me/passkeys/browser.js — the vetted @simplewebauthn/browser
+  // bundle, served same-origin so the page needs no CDN and no build step.
+  // rank: any-builder (own identity only) — a vendored static file at a fixed
+  // path, served only to a signed-in builder like the rest of /me.
+  router.get('/me/passkeys/browser.js', requireBuilder, (_req, res) => {
+    const file = browserBundleFile();
+    if (!file) {
+      log.error('passkeys browser bundle missing');
+      return res.fail('bundle_missing', { status: 500, message: 'internal error' });
+    }
+    res.type('application/javascript').set('Cache-Control', 'public, max-age=3600').sendFile(file, (err) => {
+      if (err && !res.headersSent) res.fail('bundle_missing', { status: 500, message: 'internal error' });
+    });
+  });
+
+  // POST /api/bongos/me/passkeys/register/options — start adding a card.
+  // rank: any-builder (own identity only).
+  router.post('/me/passkeys/register/options', requireBuilder, async (req, res) => {
+    if (validateOrRespond(req, res, {})) return;
+    try {
+      const rp = relyingParty(req);
+      if (!rp) return res.fail('passkeys_not_configured', { status: 503, message: 'security cards are not configured on this site yet' });
+      const { rpID, rpName } = rp;
+      const existing = await store.listCredentials(req.builder.id);
+      if (existing.length >= MAX_CARDS_PER_BUILDER) {
+        return res.fail('too_many_cards', { status: 409, message: `at most ${MAX_CARDS_PER_BUILDER} cards per account — remove one first` });
+      }
+      const handle = await store.getOrCreateUserHandle(req.builder.id);
+      const { challenge } = await store.createChallenge({ purpose: 'register', builderId: req.builder.id });
+      const options = await lib().generateRegistrationOptions({
+        rpName,
+        rpID,
+        userName: req.builder.github_login || req.builder.display_name || String(req.builder.id),
+        userDisplayName: req.builder.display_name || req.builder.github_login || undefined,
+        userID: Buffer.from(handle, 'base64url'),
+        challenge: Buffer.from(challenge, 'base64url'),
+        attestationType: 'none',
+        excludeCredentials: existing.map((c) => ({ id: c.credential_id, transports: c.transports })),
+        authenticatorSelection: { residentKey: 'preferred', userVerification: 'required' },
+      });
+      res.json({ options });
+    } catch (err) {
+      log.error({ err: err && err.message }, 'register/options failed');
+      res.fail('options_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  // POST /api/bongos/me/passkeys/register/verify — finish adding a card.
+  // Body: { response, nickname? } where response is the browser's attestation.
+  // rank: any-builder (own identity only).
+  router.post('/me/passkeys/register/verify', requireBuilder, async (req, res) => {
+    if (validateOrRespond(req, res, { response: {}, nickname: {} })) return;
+    const response = req.body && req.body.response;
+    if (!response || typeof response !== 'object') {
+      return res.fail('bad_response', { status: 400, message: 'response is required' });
+    }
+    const nick = cleanNickname(req.body.nickname);
+    if (nick.error) return res.fail('bad_nickname', { status: 400, message: nick.error });
+    try {
+      const rp = relyingParty(req);
+      if (!rp) return res.fail('passkeys_not_configured', { status: 503, message: 'security cards are not configured on this site yet' });
+      const { origin, rpID } = rp;
+      let verification;
+      try {
+        verification = await lib().verifyRegistrationResponse({
+          response,
+          // The library hands back the challenge the card signed. Consuming it here
+          // is what makes it single-use and bound to THIS builder and purpose.
+          expectedChallenge: async (c) => !!(await store.consumeChallenge(c, { expectPurpose: 'register', expectBuilderId: req.builder.id })),
+          expectedOrigin: origin,
+          expectedRPID: rpID,
+          requireUserVerification: true,
+        });
+      } catch (err) {
+        log.info({ err: err && err.message }, 'register/verify refused');
+        return res.fail('verification_failed', { status: 400, message: 'the card could not be verified' });
+      }
+      if (!verification.verified || !verification.registrationInfo) {
+        return res.fail('verification_failed', { status: 400, message: 'the card could not be verified' });
+      }
+      const { credential, aaguid } = verification.registrationInfo;
+      // Same answer whoever holds it: a global lookup must not reveal that a card
+      // belongs to another account.
+      if (await store.getCredentialById(credential.id)) {
+        return res.fail('already_registered', { status: 409, message: 'that card cannot be registered' });
+      }
+      // The cap is enforced here too: a challenge minted before a removal must not
+      // let a builder end up over it.
+      if ((await store.listCredentials(req.builder.id)).length >= MAX_CARDS_PER_BUILDER) {
+        return res.fail('too_many_cards', { status: 409, message: `at most ${MAX_CARDS_PER_BUILDER} cards per account — remove one first` });
+      }
+      await store.addCredential({
+        builderId: req.builder.id,
+        credentialId: credential.id,
+        publicKey: credential.publicKey,
+        signCount: credential.counter,
+        transports: credential.transports || response.response?.transports || [],
+        aaguid: aaguid || null,
+        nickname: nick.value,
+      });
+      res.json({ ok: true, credential_id: credential.id });
+    } catch (err) {
+      log.error({ err: err && err.message }, 'register/verify failed');
+      res.fail('register_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  // POST /api/bongos/me/passkeys/rename — Body: { credential_id, nickname }.
+  // rank: any-builder (own identity only) — the WHERE clause is the boundary.
+  router.post('/me/passkeys/rename', requireBuilder, async (req, res) => {
+    if (validateOrRespond(req, res, { credential_id: {}, nickname: {} })) return;
+    const id = req.body && req.body.credential_id;
+    if (typeof id !== 'string' || !CREDENTIAL_ID_RE.test(id)) {
+      return res.fail('bad_credential_id', { status: 400, message: 'credential_id must come from GET /me/passkeys' });
+    }
+    if (req.body.nickname === undefined) return res.fail('bad_nickname', { status: 400, message: 'nickname is required (send an empty string to clear it)' });
+    const nick = cleanNickname(req.body.nickname);
+    if (nick.error) return res.fail('bad_nickname', { status: 400, message: nick.error });
+    try {
+      const ok = await store.renameCredential(req.builder.id, id, nick.value);
+      if (!ok) return res.fail('not_found', { status: 404, message: 'no such card on your account' });
+      res.json({ ok: true });
+    } catch (err) {
+      log.error({ err: err && err.message }, 'rename failed');
+      res.fail('rename_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  // POST /api/bongos/me/passkeys/remove — Body: { credential_id }.
+  // rank: any-builder (own identity only) — the WHERE clause is the boundary.
+  router.post('/me/passkeys/remove', requireBuilder, async (req, res) => {
+    if (validateOrRespond(req, res, { credential_id: {} })) return;
+    const id = req.body && req.body.credential_id;
+    if (typeof id !== 'string' || !CREDENTIAL_ID_RE.test(id)) {
+      return res.fail('bad_credential_id', { status: 400, message: 'credential_id must come from GET /me/passkeys' });
+    }
+    try {
+      const ok = await store.removeCredential(req.builder.id, id);
+      if (!ok) return res.fail('not_found', { status: 404, message: 'no such card on your account' });
+      res.json({ ok: true });
+    } catch (err) {
+      log.error({ err: err && err.message }, 'remove failed');
+      res.fail('remove_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  return router;
+};

package/src/bongos/routes.js

@@ -28,6 +28,7 @@ const buildMeRouter = require('./routes/me');
 // task 1003341). Its own router rather than three more routes on the /me
 // aggregator or the admin pair in routes/auth.js — see that file's header.
 const buildMySessionsRouter = require('./routes/my-sessions');
+const buildMyPasskeysRouter = require('./routes/my-passkeys');
 const buildBuildersRouter = require('./routes/builders');
 // The LIFECYCLE routes (tasks · claims · versions · done-when · goals ·
 // dependencies · gate-approvals · analytics) carved into modules/lifecycle/
@@ -161,6 +162,7 @@ function buildGdsRouter() {
   router.use(buildGithubRouter());
   router.use(buildMeRouter());
   router.use(buildMySessionsRouter());
+  router.use(buildMyPasskeysRouter());
   router.use(buildBuildersRouter());
   // tasks · claims · versions · done-when · goals · dependencies · analytics now
   // mount via moduleLoader.mountModuleRoutes below (lifecycle module, BV1.R86) —

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.136'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.137'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/my_passkeys.mjs

@@ -0,0 +1,108 @@
+// tests/my_passkeys.mjs — own-scoped card registration routes (task 1004746, ADR 0382).
+// DB-free: a fake store and fake WebAuthn library behind the real router, over real HTTP.
+// Pins: list/rename/remove are keyed on the CALLER's id; register/verify hands the
+// library a challenge check that consumes via the store, bound to purpose 'register'
+// and the caller; a failed verification stores nothing.
+// Run:  node tests/my_passkeys.mjs
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+delete process.env.PASSKEY_RP_ID; delete process.env.PASSKEY_ORIGIN;
+const require = createRequire(import.meta.url);
+const express = require('express');
+const build = require('../src/bongos/routes/my-passkeys');
+
+const creds = [];
+const consumed = [];
+const store = {
+  listCredentials: async (b) => creds.filter((c) => c.builder_id === b),
+  getOrCreateUserHandle: async () => 'aGFuZGxl',
+  createChallenge: async () => ({ challenge: 'Y2hhbGw' }),
+  consumeChallenge: async (c, o) => { consumed.push([c, o]); return { purpose: 'register', builderId: o.expectBuilderId }; },
+  getCredentialById: async (id) => creds.find((c) => c.credential_id === id) || null,
+  addCredential: async (c) => { creds.push({ credential_id: c.credentialId, builder_id: c.builderId, nickname: c.nickname, transports: c.transports, created_at: 'x' }); },
+  renameCredential: async (b, id, n) => { const c = creds.find((x) => x.builder_id === b && x.credential_id === id); if (c) c.nickname = n; return !!c; },
+  removeCredential: async (b, id) => { const i = creds.findIndex((x) => x.builder_id === b && x.credential_id === id); if (i < 0) return false; creds.splice(i, 1); return true; },
+};
+let verifyOk = true;
+const webauthn = {
+  generateRegistrationOptions: async (o) => ({ rp: { id: o.rpID }, excludeCredentials: o.excludeCredentials }),
+  verifyRegistrationResponse: async (o) => {
+    assert.equal(o.requireUserVerification, true);
+    if (!(await o.expectedChallenge('Y2hhbGw'))) throw new Error('challenge');
+    if (!verifyOk) return { verified: false };
+    return { verified: true, registrationInfo: { aaguid: 'a', credential: { id: 'cred1', publicKey: new Uint8Array([1]), counter: 0, transports: ['nfc'] } } };
+  },
+};
+const app = express();
+app.use(express.json());
+app.use((req, res, next) => { res.fail = (code, { status = 400, message } = {}) => res.status(status).json({ error: code, message }); next(); });
+app.use((req, res, next) => { req.builder = { id: '7', github_login: 'me' }; next(); });
+app.use('/', build({ store, webauthn, requireBuilder: (q, r, n) => n() }));
+const server = http.createServer(app).listen(0);
+const port = server.address().port;
+const call = (method, path, body) => new Promise((resolve) => {
+  const r = http.request({ port, path, method, headers: { 'content-type': 'application/json', host: 'localhost' } }, (res) => {
+    let d = ''; res.on('data', (c) => (d += c)); res.on('end', () => { let b = null; try { b = JSON.parse(d); } catch { /* not json */ } resolve({ status: res.statusCode, body: b }); });
+  });
+  if (body) r.write(JSON.stringify(body));
+  r.end();
+});
+
+let n = 0;
+const ok = (name) => { n++; console.log(`ok - ${name}`); };
+
+let r = await call('POST', '/me/passkeys/register/options', {});
+assert.equal(r.status, 200); assert.equal(r.body.options.rp.id, 'localhost'); ok('options issues for caller');
+
+verifyOk = false;
+r = await call('POST', '/me/passkeys/register/verify', { response: { id: 'x' } });
+assert.equal(r.status, 400); assert.equal(creds.length, 0); ok('failed verification stores nothing');
+
+verifyOk = true;
+r = await call('POST', '/me/passkeys/register/verify', { response: { id: 'x' }, nickname: '  My   card ' });
+assert.equal(r.status, 200); assert.equal(creds[0].nickname, 'My card'); assert.equal(creds[0].builder_id, '7');
+assert.deepEqual(consumed.at(-1)[1], { expectPurpose: 'register', expectBuilderId: '7' }); ok('verify stores; challenge bound to caller and purpose');
+
+r = await call('POST', '/me/passkeys/register/verify', { response: { id: 'x' } });
+assert.equal(r.status, 409); ok('duplicate card refused');
+
+creds.push({ credential_id: 'other', builder_id: '9', nickname: 'theirs' });
+r = await call('POST', '/me/passkeys/remove', { credential_id: 'other' });
+assert.equal(r.status, 404); assert.equal(creds.length, 2); ok("cannot remove another builder's card");
+r = await call('POST', '/me/passkeys/rename', { credential_id: 'other', nickname: 'mine now' });
+assert.equal(r.status, 404); assert.equal(creds[1].nickname, 'theirs'); ok("cannot rename another builder's card");
+
+r = await call('GET', '/me/passkeys');
+assert.equal(r.body.passkeys.length, 1); assert.ok(!('public_key' in r.body.passkeys[0])); ok('list is own-only, no key material');
+
+r = await call('POST', '/me/passkeys/rename', { credential_id: 'cred1', nickname: 'x'.repeat(61) });
+assert.equal(r.status, 400); ok('long nickname refused');
+r = await call('POST', '/me/passkeys/rename', { credential_id: 'cred1', nickname: 'Desk' });
+assert.equal(r.status, 200); assert.equal(creds[0].nickname, 'Desk'); ok('rename');
+r = await call('POST', '/me/passkeys/remove', { credential_id: 'cred1' });
+assert.equal(r.status, 200); ok('remove');
+
+r = await call('GET', '/me/passkeys/browser.js');
+assert.equal(r.status, 200); ok('browser bundle is served');
+
+r = await call('POST', '/me/passkeys/rename', { credential_id: 'x' });
+assert.equal(r.status, 400); ok('rename without a nickname is refused');
+
+// Past the cap: options and verify both refuse.
+creds.length = 0;
+for (let i = 0; i < 10; i++) creds.push({ credential_id: 'c' + i, builder_id: '7' });
+r = await call('POST', '/me/passkeys/register/options', {});
+assert.equal(r.status, 409);
+r = await call('POST', '/me/passkeys/register/verify', { response: { id: 'x' } });
+assert.equal(r.status, 409); assert.equal(creds.length, 10); ok('card cap enforced on options and verify');
+
+// A non-local host with no configured RP is refused, not guessed.
+r = await new Promise((resolve) => {
+  const q = http.request({ port, path: '/me/passkeys/register/options', method: 'POST', headers: { 'content-type': 'application/json', host: 'evil.example', 'x-forwarded-host': 'evil.example' } }, (res) => { res.resume(); resolve({ status: res.statusCode }); });
+  q.write('{}'); q.end();
+});
+assert.equal(r.status, 503); ok('unconfigured non-local host refused');
+
+server.close();
+console.log(`${n} passed`);

package/tests/own_scope_guard.mjs

@@ -84,6 +84,11 @@ const OWN_SCOPED_SURFACES = [
     why: "the caller's OWN auth sessions — list, revoke one, sign out everywhere (task 1003341, ADR 0206). Every statement carries builder_id = req.builder.id, so a session id belonging to somebody else matches no row. Kept OUT of routes/auth.js precisely so this whole file can be held to the own-scope rule: the admin cross-builder pair next door takes its target from the body, which is what makes it admin.",
     crossOwner: [],
   },
+  {
+    file: 'src/bongos/routes/my-passkeys.js',
+    why: "the caller's OWN hardware security cards — list, register, rename, remove (task 1004746, ADR 0382). Every store call is keyed on req.builder.id; a credential id belonging to somebody else matches no row. The one ungated route serves a vendored static library file.",
+    crossOwner: [],
+  },
   {
     file: 'modules/specialities/routes/specialities.js',
     why: "role sub-specialities (task 1003855, ADR 0296). The own-scoped route here is GET /me/specialities — the CALLER's own adoptions, taken from req.builder.id with nothing read off the request. The rest of the router is /specialities/* rather than /me/*, and those are ownership-checked per row against req.builder.id after re-reading the speciality server-side, never from a client-supplied owner id.",