@bongos/core 1.24.96 → 1.25.1

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/bongos/package-core.js",
-  "core_version": "1.24.96",
-  "core_contract": "1.24.96",
-  "source_commit": "c971214e6127a91182508964726d83892c1139e6",
+  "core_version": "1.25.1",
+  "core_contract": "1.25.1",
+  "source_commit": "ab6188463865682dcca46f3680eb50a3227322d9",
   "source_ref": "HEAD",
-  "built_at": "2026-11-12T21:09:14.570Z",
+  "built_at": "2026-11-12T21:45:21.690Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 654,
     "agent_docs_stubbed": 32,
-    "functional_verbatim": 3985,
+    "functional_verbatim": 3989,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 4672,
-  "tree_sha256": "6149ea852a37da683a1c3d47ffad0b9a72c10d4913887680ef968cca7ae02242",
+  "file_count": 4676,
+  "tree_sha256": "bdaeb36c9c1b8bff0272eae34c82d2a800abec3856f9eeebe36a61d0f35d6b3f",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -332,12 +332,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "4ff75ca0d2adee84f957a5633719a2de60590b0b7f6c03b0138038f91adfe2a4"
+      "sha256": "ed95879a40c6624dda1681930638ce528645de0de79003c4622e8edf97a9cfec"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "ce8e19a56c11cd71d19e61fabfe4361f0bfbf4705e0e6c07e5e9dbecd277f8b0"
+      "sha256": "534f04acb46cdf1a13ebbaf15af37488b93daba3eef39ab05c827ebeeebc551f"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -347,17 +347,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "80b738abcb74d37cabb297eb0dda73be947bfe6af941410054b8294ece66f977"
+      "sha256": "d4a8ca745ce3c3aa7ee83e3b6dad2071d9bb31d82104002c0f8d62785a24fd8f"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "19fa175cadcef67ccf418470f7bdd3bd666f67e11ad85bb17bf082c66b4d49e1"
+      "sha256": "e7ce03b5c6d9c370c9fa0380911a83c17945c3eb9535252b4d396da5675149cf"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "9c2e999dedc65cf0574bb6b8bd1d5022a8c222ffcb444cd12969872db327642d"
+      "sha256": "2f6c7c1de4f5fe6abb98aec6993ef7fa212f42dcf513b33f82213578765cc952"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -2497,17 +2497,17 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "e1e8deb350c6725b9514d99cffb21dfc04cfaf6b80e45ea35aa6f5a9683fa919"
+      "sha256": "63bf723ba632d53f26bc2850623f0ce85d40fabcb65aadd693808663c5822ded"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "758e4fd2a3d52e4d3b3a1527c9c3ff1864715389600132d8f5c9457292b74ad7"
+      "sha256": "4b1c9bdd62f88e916be092ecffe6b70c90ac08fc709afa372ce992c88a2070f6"
     },
     {
       "path": "docs/architecture.md",
       "mode": "0000644",
-      "sha256": "aaf839249a8de7e210ae2f048c8f52ef7747c0fd47eef82ec1aacfa2ca6a04a1"
+      "sha256": "5d62f07bd68f7dcf24c9acf1cfb2be95df55e7d64c289844cdecab73bf1f5d49"
     },
     {
       "path": "docs/branding-contract.md",
@@ -3087,7 +3087,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "c407cd3900edf80b63e96c178fa53e015e4ba6b10aefdd1b6a7dd002387b3fba"
+      "sha256": "5cbde19ec7bd628215e624bd4e1d5396d42b25d9db77c511e93884a79a00d062"
     },
     {
       "path": "docs/modules-contract.md",
@@ -4444,6 +4444,11 @@
       "mode": "0000644",
       "sha256": "2d691d71a3ba7a5d18c528b64889f7df1fdd1c73616d457d4e75c07d5d08c599"
     },
+    {
+      "path": "migrations/core_298_card_step_up.sql",
+      "mode": "0000644",
+      "sha256": "996b8ba5f3f9dba3debc29edfc826bfa73fe12d985e4991bbc599f1551f6cd67"
+    },
     {
       "path": "modules/agents/CLAUDE.md",
       "mode": "0000644",
@@ -5422,7 +5427,7 @@
     {
       "path": "modules/economy/module.json",
       "mode": "0000644",
-      "sha256": "dbefdcecf678f48cc7a2608eec4500294ff2a84a250361602d424e7ef624f8fc"
+      "sha256": "2a7b1e569629692a7e6f65aa7a66c739568fd7cd9d590f83d7a55b88dba831ca"
     },
     {
       "path": "modules/economy/outflow.js",
@@ -5439,6 +5444,11 @@
       "mode": "0000644",
       "sha256": "aba4b7c50850371c0314ff3ca30ed0511f95bd70ed947d306ec13b15d9beb0c8"
     },
+    {
+      "path": "modules/economy/processor-stripe.js",
+      "mode": "0000644",
+      "sha256": "b711b1208c6d1f14d4f171bd35c0e79ed8c3ceea46403a01323771ed7c82f17f"
+    },
     {
       "path": "modules/economy/project-account.js",
       "mode": "0000644",
@@ -5457,7 +5467,7 @@
     {
       "path": "modules/economy/routes/balances.js",
       "mode": "0000644",
-      "sha256": "5c1e580b2de51efff55cbb11c646a6b65c6be5c3fc9c4d452f85c5f8c9a83057"
+      "sha256": "e012ff00a8270278813f1ca60a66ffce025e98371d961fb69ba09d053b9d7391"
     },
     {
       "path": "modules/economy/routes/cost.js",
@@ -5482,7 +5492,7 @@
     {
       "path": "modules/economy/routes/project-account.js",
       "mode": "0000644",
-      "sha256": "c4b925dc1d73080e023f05cb35a35b1e51867a9288fd519e1201dec59a773a31"
+      "sha256": "32c3e606335a96bbf8d1c5d8ff1e816f4cda21bbf836ab97e7b1fa2c4ac0c435"
     },
     {
       "path": "modules/economy/routes/reward.js",
@@ -5494,6 +5504,11 @@
       "mode": "0000644",
       "sha256": "45c9e5913328ee68277d2ae8ea42f0958fcfc2b9fb21792d82fab3c568997ba2"
     },
+    {
+      "path": "modules/economy/tests/processor_stripe.mjs",
+      "mode": "0000644",
+      "sha256": "af2153d8c05aafca1a45dd92b0e041baf27a0d81d5410c105d57c2883345d013"
+    },
     {
       "path": "modules/economy/user-balances.js",
       "mode": "0000644",
@@ -5912,7 +5927,7 @@
     {
       "path": "modules/government/routes/government.js",
       "mode": "0000644",
-      "sha256": "91fed3be33455271af665861537082345152fa3a6a27917a1cf9bd847c701561"
+      "sha256": "059293fc06bda9db0ee5c7099251a90b7f7c7a8138c9e2cf7fcef14e0308ca0e"
     },
     {
       "path": "modules/government/routes/rank-sync.js",
@@ -11277,12 +11292,12 @@
     {
       "path": "modules/render-deploy/routes/act.js",
       "mode": "0000644",
-      "sha256": "8a986f38de7fa3d62b27459d12e1d304344bb1575968a445c483f6e3ca5cf0c1"
+      "sha256": "effe2bb4bc6e20d37e61a14c5ef72d6001f38a94fe95705528d3eb48c145ad64"
     },
     {
       "path": "modules/render-deploy/routes/app.js",
       "mode": "0000644",
-      "sha256": "b66ac89fba8cf92d9e49f3e0c2c66973dca6a7c94ff111dbb6d97d5521a85673"
+      "sha256": "a93f5a07ea20ceb9ca1dcaf3c0ffb2433a736af16a8e9501dfdc02b70749596d"
     },
     {
       "path": "modules/render-deploy/routes/history.js",
@@ -12202,12 +12217,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "697de440abc4cffd9b894fc7c7f08e8c37e1fe8c69fd6acb154e0d0a7eddacc4"
+      "sha256": "91918d6ff38e731f24ee145f1ac45ad79aeae24a1f748d538fd229dc129d517e"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "e710e107598205dc3a2306c2419cd4f71612786eb8fc1eaa22016b6874a9e027"
+      "sha256": "6d0090ccb1cf713ca96875e4acc6f4af8ab030650a847404825d78c8642c0abd"
     },
     {
       "path": "public-docs/index.html",
@@ -12227,7 +12242,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "70c359af2be71410e07c6573cd7874a6b62116723900fcd359577495299096cf"
+      "sha256": "9a01a7a0d535adb2c9804def7bf85a89ef6343277e4d71d5891168d18fac0f2c"
     },
     {
       "path": "scripts/bongos/CLAUDE.md",
@@ -12787,7 +12802,7 @@
     {
       "path": "scripts/bongos/fitness.js",
       "mode": "0000644",
-      "sha256": "a74ba947b2a57637cf58a3efc98f45835ba81b9b5e63a0bbae6df53cc80b2ca4"
+      "sha256": "f801186ca310c4eff0d218a203013d2882cfc255a6e5dbb85fa64cb2e9b1c5a4"
     },
     {
       "path": "scripts/bongos/forwarder.js",
@@ -12907,7 +12922,7 @@
     {
       "path": "scripts/bongos/government-walk.js",
       "mode": "0000644",
-      "sha256": "a6f4dac2861f6244b2456640995ab84032a94118c9ec433c204ff154c537478f"
+      "sha256": "3d628452d167bd71367f6a64ef5dd689865dd73c0d72a4ade08eb8b569de2dd9"
     },
     {
       "path": "scripts/bongos/grade-correlation-audit.js",
@@ -15922,7 +15937,7 @@
     {
       "path": "src/bongos/passkeys.js",
       "mode": "0000644",
-      "sha256": "d8fbe7d1447158d03831a8b436d65d735c041e210aa795dacde635c9dedca535"
+      "sha256": "8852ecc1dd723459f6024d765f100ac7308605b9b18472aff6a3ce9963da3589"
     },
     {
       "path": "src/bongos/path-match.js",
@@ -16022,7 +16037,7 @@
     {
       "path": "src/bongos/routes/auth.js",
       "mode": "0000644",
-      "sha256": "438f7feeb87eb85b4aaca2bf20e0304d95822a8e77c92f9c2a042a90dd0bb03d"
+      "sha256": "3ee96bc304119dc762492a32b55c840f86e68461a52ded65b7fd10f8d6c3cb5b"
     },
     {
       "path": "src/bongos/routes/backup.js",
@@ -16032,7 +16047,7 @@
     {
       "path": "src/bongos/routes/builders.js",
       "mode": "0000644",
-      "sha256": "33bbaaff52b25f0feff0aba09a21d98026cecc38daeddbae1191de3cc8e46a7b"
+      "sha256": "775ab4581124e9ccb0d4c195ade3147e65e301ca5c055fdeb3bf8fc68aa8b856"
     },
     {
       "path": "src/bongos/routes/cli-commands.js",
@@ -16082,7 +16097,7 @@
     {
       "path": "src/bongos/routes/module-payouts.js",
       "mode": "0000644",
-      "sha256": "be4700ac373654cf80861b942d6f772e5058a122c52b3de7afb6703583aafed2"
+      "sha256": "fd8f8869feb1185bd25323d32bde6829dd73a393465346fbc8e9f144d24dea4b"
     },
     {
       "path": "src/bongos/routes/modules.js",
@@ -16092,12 +16107,12 @@
     {
       "path": "src/bongos/routes/my-cash-outs.js",
       "mode": "0000644",
-      "sha256": "7437689a6c09e6270d9c9a201c2a5c7eb13866a79e8d4fec889394a8cfaafd0b"
+      "sha256": "3f51f9f6e7079f18739653cbdb74dd87e23fc8758c1ca309c5fce01cbed2c695"
     },
     {
       "path": "src/bongos/routes/my-passkeys.js",
       "mode": "0000644",
-      "sha256": "5426ad765a0b9fb29963b1a9dac8727b4f0bed352791e34f2f766b2f45b94319"
+      "sha256": "a35d43b2450c8533b691b3ac4dc4fa62397279c24ef95698f078a4d48055a58e"
     },
     {
       "path": "src/bongos/routes/my-payouts.js",
@@ -16117,7 +16132,7 @@
     {
       "path": "src/bongos/routes/payout-approvals.js",
       "mode": "0000644",
-      "sha256": "5575f0616b45c78f57a8fa237ead916f3b04e4eae394f807603d7bf6cb53a912"
+      "sha256": "f70c1df7853ae8ddf7f73d06bb28480ac516d27ede9be0a34940de7f794d78c8"
     },
     {
       "path": "src/bongos/routes/payout-gates.js",
@@ -16169,6 +16184,11 @@
       "mode": "0000644",
       "sha256": "4805e1c822f1a55cf38fec99af788cc3654f67f9aaa2830fbf853f75583c1244"
     },
+    {
+      "path": "src/bongos/step-up.js",
+      "mode": "0000644",
+      "sha256": "1b5376c7d48788df1425ef7c9c4e530dd159a329a5515440d52b36ca53a661d5"
+    },
     {
       "path": "src/bongos/task-needs.js",
       "mode": "0000644",
@@ -16232,7 +16252,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "63a269e6861762c64af55a0c8eb8b63d8c4a1a5c71de9840bd38cdf721383886"
+      "sha256": "39c65d85a20b2b575503327d65f70039e139827031595d85ded7b9228477ff8b"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -18612,7 +18632,7 @@
     {
       "path": "tests/government_act_alone_buildings.mjs",
       "mode": "0000644",
-      "sha256": "908ae3bef013fa27ee3b2c031bd521b225be5d96cc2f57fd0ba0c41287608375"
+      "sha256": "12a31fab05c763cd26560ba507ded9a635d026b1e7ea0a8d04992061c222988c"
     },
     {
       "path": "tests/government_agent_asks.mjs",
@@ -18887,7 +18907,7 @@
     {
       "path": "tests/government_treasury.mjs",
       "mode": "0000644",
-      "sha256": "8421cd8ba68102d6ba8a85d66a34b77f5ede5f73108fb8de47fcce6f857dafcd"
+      "sha256": "c3beaf013144da2a9981115d013464c32915977e7a4227015eea1f0253a91d47"
     },
     {
       "path": "tests/government_unanimous.mjs",
@@ -20477,7 +20497,7 @@
     {
       "path": "tests/module_api.mjs",
       "mode": "0000644",
-      "sha256": "8c0260c18384394a2fc25dfe47a30cdc0a5be259690aa26bc77ca4a40d719ec7"
+      "sha256": "6dc76d0fca798b72319b14fa26e8a4405c8705c063d4b850aaeb894caf51c6dd"
     },
     {
       "path": "tests/module_api_lazy.mjs",
@@ -20742,7 +20762,7 @@
     {
       "path": "tests/my_passkeys.mjs",
       "mode": "0000644",
-      "sha256": "e530acaa045b6db562d8a6a07210efde1cec19a216f6a3a62d379e6457e0029e"
+      "sha256": "21c7c434e6dfef2810b0ea2480bffb37335d62a5b05b8b7c145168e582a116a0"
     },
     {
       "path": "tests/my_projects_surface.mjs",
@@ -21762,7 +21782,7 @@
     {
       "path": "tests/rank_change_broadcast_port.mjs",
       "mode": "0000644",
-      "sha256": "08c6f08ee3ddc33b83fb4f8b3c2562ee32e5265149ed75eab559bc1d7384d8ed"
+      "sha256": "7146017837c4bd5ca37ddb38826de1cb04124d8b8e796f1371c9c856c14c6fd8"
     },
     {
       "path": "tests/rank_floor_wiring.mjs",

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 697 operations across 85 resource groups
+- 699 operations across 85 resource groups
 
 ## Use it from your project
 

package/clients/bongos-client/bongos-client.global.js

@@ -905,6 +905,10 @@ function createClient(opts = {}) {
       patchMeModelAllocation: (args) => request("PATCH", "/me/model-allocation", { hasBody: true }, args),
       // GET /me/passkeys — rank: any-builder — GET /me/passkeys
       getMePasskeys: (args) => request("GET", "/me/passkeys", { hasBody: false }, args),
+      // POST /me/passkeys/authenticate/options — rank: any-builder — POST /me/passkeys/authenticate/options
+      postMePasskeysAuthenticateOptions: (args) => request("POST", "/me/passkeys/authenticate/options", { hasBody: true }, args),
+      // POST /me/passkeys/authenticate/verify — rank: any-builder — POST /me/passkeys/authenticate/verify
+      postMePasskeysAuthenticateVerify: (args) => request("POST", "/me/passkeys/authenticate/verify", { hasBody: true }, args),
       // GET /me/passkeys/browser.js — rank: any-builder — GET /me/passkeys/browser.js
       getMePasskeysBrowserJs: (args) => request("GET", "/me/passkeys/browser.js", { hasBody: false }, args),
       // POST /me/passkeys/register/options — rank: any-builder — POST /me/passkeys/register/options

package/clients/bongos-client/index.cjs

@@ -904,6 +904,10 @@ function createClient(opts = {}) {
       patchMeModelAllocation: (args) => request("PATCH", "/me/model-allocation", { hasBody: true }, args),
       // GET /me/passkeys — rank: any-builder — GET /me/passkeys
       getMePasskeys: (args) => request("GET", "/me/passkeys", { hasBody: false }, args),
+      // POST /me/passkeys/authenticate/options — rank: any-builder — POST /me/passkeys/authenticate/options
+      postMePasskeysAuthenticateOptions: (args) => request("POST", "/me/passkeys/authenticate/options", { hasBody: true }, args),
+      // POST /me/passkeys/authenticate/verify — rank: any-builder — POST /me/passkeys/authenticate/verify
+      postMePasskeysAuthenticateVerify: (args) => request("POST", "/me/passkeys/authenticate/verify", { hasBody: true }, args),
       // GET /me/passkeys/browser.js — rank: any-builder — GET /me/passkeys/browser.js
       getMePasskeysBrowserJs: (args) => request("GET", "/me/passkeys/browser.js", { hasBody: false }, args),
       // POST /me/passkeys/register/options — rank: any-builder — POST /me/passkeys/register/options

package/clients/bongos-client/index.d.ts

@@ -502,6 +502,9 @@ export interface PostMeGuardianCosignsRequest { approval_id?: StringifiableId; r
 export interface PostMeGuardianCosignsResponse { cosigns: unknown }
 export interface PostMeHowtoReadRequest { steps?: unknown[]; all?: boolean; how?: string }
 export interface PostMeHowtoResetRequest { steps?: unknown[]; all?: boolean }
+export interface PostMePasskeysAuthenticateOptionsResponse { options: unknown }
+export interface PostMePasskeysAuthenticateVerifyRequest { response?: unknown }
+export interface PostMePasskeysAuthenticateVerifyResponse { ok: boolean; valid_for_seconds: unknown }
 export interface PostMePasskeysRegisterOptionsResponse { options: unknown }
 export interface PostMePasskeysRegisterVerifyRequest { response?: unknown; nickname?: unknown }
 export interface PostMePasskeysRegisterVerifyResponse { ok: boolean; credential_id: unknown }
@@ -1569,6 +1572,10 @@ export interface BongosClient {
     patchMeModelAllocation(args?: RequestArgs): Promise<ApiResponse>;
     /** GET /me/passkeys — rank: any-builder */
     getMePasskeys(args?: RequestArgs): Promise<GetMePasskeysResponse>;
+    /** POST /me/passkeys/authenticate/options — rank: any-builder */
+    postMePasskeysAuthenticateOptions(args?: RequestArgs): Promise<PostMePasskeysAuthenticateOptionsResponse>;
+    /** POST /me/passkeys/authenticate/verify — rank: any-builder */
+    postMePasskeysAuthenticateVerify(args?: RequestArgs & { body?: PostMePasskeysAuthenticateVerifyRequest }): Promise<PostMePasskeysAuthenticateVerifyResponse>;
     /** GET /me/passkeys/browser.js — rank: any-builder */
     getMePasskeysBrowserJs(args?: RequestArgs): Promise<ApiResponse>;
     /** POST /me/passkeys/register/options — rank: any-builder */

package/clients/bongos-client/index.mjs

@@ -901,6 +901,10 @@ export function createClient(opts = {}) {
       patchMeModelAllocation: (args) => request("PATCH", "/me/model-allocation", { hasBody: true }, args),
       // GET /me/passkeys — rank: any-builder — GET /me/passkeys
       getMePasskeys: (args) => request("GET", "/me/passkeys", { hasBody: false }, args),
+      // POST /me/passkeys/authenticate/options — rank: any-builder — POST /me/passkeys/authenticate/options
+      postMePasskeysAuthenticateOptions: (args) => request("POST", "/me/passkeys/authenticate/options", { hasBody: true }, args),
+      // POST /me/passkeys/authenticate/verify — rank: any-builder — POST /me/passkeys/authenticate/verify
+      postMePasskeysAuthenticateVerify: (args) => request("POST", "/me/passkeys/authenticate/verify", { hasBody: true }, args),
       // GET /me/passkeys/browser.js — rank: any-builder — GET /me/passkeys/browser.js
       getMePasskeysBrowserJs: (args) => request("GET", "/me/passkeys/browser.js", { hasBody: false }, args),
       // POST /me/passkeys/register/options — rank: any-builder — POST /me/passkeys/register/options

package/docs/api/openapi.json

@@ -16855,6 +16855,105 @@
         ]
       }
     },
+    "/me/passkeys/authenticate/options": {
+      "post": {
+        "operationId": "post_me_passkeys_authenticate_options",
+        "tags": [
+          "me"
+        ],
+        "summary": "POST /me/passkeys/authenticate/options",
+        "description": "POST /api/bongos/me/passkeys/authenticate/options — start a card check. rank: any-builder (own identity only). The challenge is bound to the caller.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "src/bongos/routes/my-passkeys.js",
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "additionalProperties": true
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PostMePasskeysAuthenticateOptionsResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
+    "/me/passkeys/authenticate/verify": {
+      "post": {
+        "operationId": "post_me_passkeys_authenticate_verify",
+        "tags": [
+          "me"
+        ],
+        "summary": "POST /me/passkeys/authenticate/verify",
+        "description": "POST /api/bongos/me/passkeys/authenticate/verify — finish a card check. Body: { response } the browser's assertion. On success the CALLER'S session row is stamped; that stamp (never anything the client sends) is the step-up proof. rank: any-builder (own identity only).\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "src/bongos/routes/my-passkeys.js",
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostMePasskeysAuthenticateVerifyRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PostMePasskeysAuthenticateVerifyResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/me/passkeys/browser.js": {
       "get": {
         "operationId": "get_me_passkeys_browser_js",
@@ -39768,6 +39867,35 @@
         },
         "additionalProperties": false
       },
+      "PostMePasskeysAuthenticateOptionsResponse": {
+        "type": "object",
+        "properties": {
+          "options": {}
+        },
+        "required": [
+          "options"
+        ]
+      },
+      "PostMePasskeysAuthenticateVerifyRequest": {
+        "type": "object",
+        "properties": {
+          "response": {}
+        },
+        "additionalProperties": false
+      },
+      "PostMePasskeysAuthenticateVerifyResponse": {
+        "type": "object",
+        "properties": {
+          "ok": {
+            "type": "boolean"
+          },
+          "valid_for_seconds": {}
+        },
+        "required": [
+          "ok",
+          "valid_for_seconds"
+        ]
+      },
       "PostMePasskeysRegisterOptionsResponse": {
         "type": "object",
         "properties": {
@@ -43609,9 +43737,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 697,
-  "x-schema-count": 731,
+  "x-endpoint-count": 699,
+  "x-schema-count": 734,
   "x-undocumented-bodies": 12,
-  "x-response-schemas": 462,
+  "x-response-schemas": 464,
   "x-generated-by": "scripts/bongos/gen-api-docs.js"
 }

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 697 endpoints across 117 route files.
+> **Generated from the live route files** — the route file is authoritative. 699 endpoints across 117 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust-boundary-server-enforced-permissions.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -568,7 +568,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | PUT | `/api/bongos/market-watch/settings/key` | `metic+archon` | `key` |  |
 | DELETE | `/api/bongos/market-watch/settings/key` | `metic+archon` | — |  |
 
-## `me` (63)
+## `me` (65)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
@@ -609,6 +609,8 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | GET | `/api/bongos/me/model-allocation` | `any-builder` | — |  |
 | PATCH | `/api/bongos/me/model-allocation` | `any-builder` | _undocumented_ | PATCH the model allocation. |
 | GET | `/api/bongos/me/passkeys` | `any-builder` | — | GET /api/bongos/me/passkeys — the caller's registered cards. |
+| POST | `/api/bongos/me/passkeys/authenticate/options` | `any-builder` | validated | POST /api/bongos/me/passkeys/authenticate/options — start a card check. |
+| POST | `/api/bongos/me/passkeys/authenticate/verify` | `any-builder` | `response` | POST /api/bongos/me/passkeys/authenticate/verify — finish a card check. |
 | GET | `/api/bongos/me/passkeys/browser.js` | `any-builder` | — | GET /api/bongos/me/passkeys/browser.js — the vetted @simplewebauthn/browser bundle, served same-origin so the page needs no CDN and no bu… |
 | POST | `/api/bongos/me/passkeys/register/options` | `any-builder` | validated | POST /api/bongos/me/passkeys/register/options — start adding a card. |
 | POST | `/api/bongos/me/passkeys/register/verify` | `any-builder` | `response`, `nickname` | POST /api/bongos/me/passkeys/register/verify — finish adding a card. |

package/docs/architecture.md

@@ -273,6 +273,8 @@ store_module_prices(id, module_key, price_cents, price_credits, set_by, set_at)
 
 Passkey foundation (migration `core_277`, task 1004750, [ADR 0382](adr/0382-a-hardware-card-is-a-passkey-step-up-an-archon-switches-on-per-builder.md) D1/D6 — storage only; the ceremonies and routes are their own tasks; code in `src/bongos/passkeys.js`):
 
+Card step-up gate (migration `core_298`, task 1004747, ADR 0382 D2/D5; code in `src/bongos/step-up.js`): `builders.require_card` (default false) + `builder_sessions.card_verified_at`, stamped only by `POST /me/passkeys/authenticate/verify`. `requireCardStepUp` (also `api.requireCardStepUp` for modules) refuses 403 `card_required` when the builder's flag is on and the session has no card tap in the last 10 minutes; it fails closed. Mounted on rank set, admin session revoke (the own-session panic button stays open), render-deploy act + PUT app, treasury pots/borrow answers. The Archon switch that sets the flag is task 1004748.
+
 ```
 passkey_credentials(id, credential_id UNIQUE, builder_id FK, public_key bytea, sign_count,
               transports[], aaguid, nickname, created_at, last_used_at)
@@ -322,7 +324,7 @@ payout_tax_details(id, builder_id, status collected|incomplete, collected_by pro
               -- POST /payouts/ndas, POST /payouts/tax-details (payout.approve + web session).
 ```
 
-Builder payouts (migration `core_290`, task 1003183, [ADR 0397](adr/0397-the-payment-rail-is-stripe-connect-with-one-connected-account-per-project.md) D7 — a builder is paid for a task exactly once; `src/bongos/builder-payouts.js`, routes `GET`/`POST /payouts/builder-payouts` gated `payout.approve` plus the person's own web session for the POST; the `payout` movement is booked through the economy module's `economy.account` port in the same transaction. No processor adapter exists yet, so every payout is recorded owed and held `no_processor`):
+Builder payouts (migration `core_298`, task 1003183, [ADR 0397](adr/0397-the-payment-rail-is-stripe-connect-with-one-connected-account-per-project.md) D7 — a builder is paid for a task exactly once; `src/bongos/builder-payouts.js`, routes `GET`/`POST /payouts/builder-payouts` gated `payout.approve` plus the person's own web session for the POST; the `payout` movement is booked through the economy module's `economy.account` port in the same transaction. No processor adapter exists yet, so every payout is recorded owed and held `no_processor`):
 
 ```
 builder_payouts_owed(id, builder_id FK, task_id FK, approval_id FK payout_approvals,

package/docs/module-api-changelog.md

@@ -3440,5 +3440,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.24.94 with no explicit bump. run 43304959846. (task 1002620)
   1.24.96 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.24.95 with no explicit bump. run 43307125735. (task 1002620)
+  1.25.0 — adds `requireCardStepUp`, the hardware-card step-up gate a module mounts
+        after its permission gate (task 1004747, ADR 0382). Additive, so MINOR.
+  1.25.1 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.25.0 with no explicit bump. run 43313162829. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/migrations/core_298_card_step_up.sql

@@ -0,0 +1,16 @@
+-- core_298 card step-up: the per-builder requirement flag and the per-session proof
+-- Applied under task 1004747 (ADR 0382 D2, D4).
+--
+-- WHY. A builder who has a registered hardware card can be required to tap it before
+-- the sensitive actions (rank changes, deploy, session revoke, payouts). The server
+-- needs two things to keep: whether the requirement is on for a builder, and when a
+-- given session last proved a card.
+--
+--  * builders.require_card  default false: nothing changes for anybody until an
+--    Archon switches it on (that switch is its own task). Read fresh per request.
+--  * builder_sessions.card_verified_at  set ONLY by the card verify route, on the
+--    server-side session row. Nothing the client sends counts as proof, and a new
+--    session starts with none.
+
+ALTER TABLE builders         ADD COLUMN IF NOT EXISTS require_card boolean NOT NULL DEFAULT false;
+ALTER TABLE builder_sessions ADD COLUMN IF NOT EXISTS card_verified_at timestamptz;

package/modules/economy/module.json

@@ -8,6 +8,6 @@
   "default": true,
   "maintenance": { "status": "core-maintained" },
   "contributes": { "migrations": true, "routes": ["cost", "credits", "earnings", "leaderboard", "project-account", "balances", "reward"], "pollers": ["ledger-check"] },
-  "provides": ["reward", "economy.account"],
+  "provides": ["reward", "economy.account", "economy.processor"],
   "consumes": []
 }