@bongos/core 1.25.13 → 1.25.15

package/package-lock.json

@@ -1,16 +1,232 @@
 {
   "name": "@bongos/core",
-  "version": "1.25.13",
+  "version": "1.25.15",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.25.13",
+      "version": "1.25.15",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",
-        "pg": "^8.20.0"
+        "pg": "^8.20.0",
+        "pino": "^9.14.0",
+        "@simplewebauthn/browser": "^13.3.0",
+        "@simplewebauthn/server": "^13.3.3"
+      }
+    },
+    "node_modules/@hexagon/base64": {
+      "version": "1.1.28",
+      "resolved": "https://registry.npmjs.org/@hexagon/base64/-/base64-1.1.28.tgz",
+      "integrity": "sha512-lhqDEAvWixy3bZ+UOYbPwUbBkwBq5C1LAJ/xPC8Oi+lL54oyakv/npbA0aU2hgCsx/1NUd4IBvV03+aUBWxerw==",
+      "license": "MIT"
+    },
+    "node_modules/@levischuck/tiny-cbor": {
+      "version": "0.2.11",
+      "resolved": "https://registry.npmjs.org/@levischuck/tiny-cbor/-/tiny-cbor-0.2.11.tgz",
+      "integrity": "sha512-llBRm4dT4Z89aRsm6u2oEZ8tfwL/2l6BwpZ7JcyieouniDECM5AqNgr/y08zalEIvW3RSK4upYyybDcmjXqAow==",
+      "license": "MIT"
+    },
+    "node_modules/@peculiar/asn1-android": {
+      "version": "2.11.0",
+      "resolved": "https://registry.npmjs.org/@peculiar/asn1-android/-/asn1-android-2.11.0.tgz",
+      "integrity": "sha512-llW/qjavL+tOxt5i9whUv4wsbsLpUwI6k/DrvKsdA/H7A/TB/6CosMFgvei28fcJ8ncD0c5lig1oBBlo4KGMCw==",
+      "license": "MIT",
+      "dependencies": {
+        "@peculiar/asn1-schema": "^2.11.0",
+        "asn1js": "^3.0.10",
+        "tslib": "^2.8.1"
+      },
+      "engines": {
+        "node": ">=14"
+      }
+    },
+    "node_modules/@peculiar/asn1-cms": {
+      "version": "2.11.0",
+      "resolved": "https://registry.npmjs.org/@peculiar/asn1-cms/-/asn1-cms-2.11.0.tgz",
+      "integrity": "sha512-SlAiDoT/Cd8qaNmbTt78gqyaEvu2fQd6ML6KWJkdjXGrgDKnHHrusVkfQUelkfinL2p665IIADb0JBixtT8W1g==",
+      "license": "MIT",
+      "dependencies": {
+        "@peculiar/asn1-schema": "^2.11.0",
+        "@peculiar/asn1-x509": "^2.11.0",
+        "@peculiar/asn1-x509-attr": "^2.11.0",
+        "asn1js": "^3.0.10",
+        "tslib": "^2.8.1"
+      },
+      "engines": {
+        "node": ">=14"
+      }
+    },
+    "node_modules/@peculiar/asn1-csr": {
+      "version": "2.11.0",
+      "resolved": "https://registry.npmjs.org/@peculiar/asn1-csr/-/asn1-csr-2.11.0.tgz",
+      "integrity": "sha512-M/ED0yJ05qMK+UADPKnIa8vhAeewOJALSxTAZB7RQ/batRHhIJZkwznCcWAbFO5saHJ1yEQ+m4lncEcG9RnQSg==",
+      "license": "MIT",
+      "dependencies": {
+        "@peculiar/asn1-schema": "^2.11.0",
+        "@peculiar/asn1-x509": "^2.11.0",
+        "asn1js": "^3.0.10",
+        "tslib": "^2.8.1"
+      },
+      "engines": {
+        "node": ">=14"
+      }
+    },
+    "node_modules/@peculiar/asn1-ecc": {
+      "version": "2.11.0",
+      "resolved": "https://registry.npmjs.org/@peculiar/asn1-ecc/-/asn1-ecc-2.11.0.tgz",
+      "integrity": "sha512-jj1alGEKev7/un+cI+exyVK9m31lmP7cCBMCZuCb0wkFQH2zmKmJzNiG4wqXFNzlcP8timHLnzf3lV3OxBpb/Q==",
+      "license": "MIT",
+      "dependencies": {
+        "@peculiar/asn1-schema": "^2.11.0",
+        "@peculiar/asn1-x509": "^2.11.0",
+        "asn1js": "^3.0.10",
+        "tslib": "^2.8.1"
+      },
+      "engines": {
+        "node": ">=14"
+      }
+    },
+    "node_modules/@peculiar/asn1-pfx": {
+      "version": "2.11.0",
+      "resolved": "https://registry.npmjs.org/@peculiar/asn1-pfx/-/asn1-pfx-2.11.0.tgz",
+      "integrity": "sha512-ykSAWRu8KkmzU8LRpk9ZQC3zuLmBEtoSMjIv9XHVamD5W7amqreV5wttKqnvtjWOzzSJQxA/HVT8/tHwpEEGSQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@peculiar/asn1-cms": "^2.11.0",
+        "@peculiar/asn1-pkcs8": "^2.11.0",
+        "@peculiar/asn1-rsa": "^2.11.0",
+        "@peculiar/asn1-schema": "^2.11.0",
+        "asn1js": "^3.0.10",
+        "tslib": "^2.8.1"
+      },
+      "engines": {
+        "node": ">=14"
+      }
+    },
+    "node_modules/@peculiar/asn1-pkcs8": {
+      "version": "2.11.0",
+      "resolved": "https://registry.npmjs.org/@peculiar/asn1-pkcs8/-/asn1-pkcs8-2.11.0.tgz",
+      "integrity": "sha512-lragjkjQGnQ5luxC+sxoAfAO/jBiQ7hOEGlDKJUk7MC5zY3AzjB2DU0GyPUH1Sswdv10t7DurY0zylOYMLb88w==",
+      "license": "MIT",
+      "dependencies": {
+        "@peculiar/asn1-schema": "^2.11.0",
+        "@peculiar/asn1-x509": "^2.11.0",
+        "asn1js": "^3.0.10",
+        "tslib": "^2.8.1"
+      },
+      "engines": {
+        "node": ">=14"
+      }
+    },
+    "node_modules/@peculiar/asn1-pkcs9": {
+      "version": "2.11.0",
+      "resolved": "https://registry.npmjs.org/@peculiar/asn1-pkcs9/-/asn1-pkcs9-2.11.0.tgz",
+      "integrity": "sha512-gDdFjpqV0weJjgNUvueUVf4D8uVbpq+VbG0TsxLAY2QGljAkJyL9qwQ7avol9j0jaYSJ7Ey7v7RZp0M3GTcQSA==",
+      "license": "MIT",
+      "dependencies": {
+        "@peculiar/asn1-cms": "^2.11.0",
+        "@peculiar/asn1-pfx": "^2.11.0",
+        "@peculiar/asn1-pkcs8": "^2.11.0",
+        "@peculiar/asn1-schema": "^2.11.0",
+        "@peculiar/asn1-x509": "^2.11.0",
+        "@peculiar/asn1-x509-attr": "^2.11.0",
+        "asn1js": "^3.0.10",
+        "tslib": "^2.8.1"
+      },
+      "engines": {
+        "node": ">=14"
+      }
+    },
+    "node_modules/@peculiar/asn1-rsa": {
+      "version": "2.11.0",
+      "resolved": "https://registry.npmjs.org/@peculiar/asn1-rsa/-/asn1-rsa-2.11.0.tgz",
+      "integrity": "sha512-S2sBJmbfI09Kzdt9cEhE6pDNjHpVTkURs+811+PxS8AvsTLxC4woMNRhxHYaIbClkkNfAVt0tZxJdINVfUmzuA==",
+      "license": "MIT",
+      "dependencies": {
+        "@peculiar/asn1-schema": "^2.11.0",
+        "@peculiar/asn1-x509": "^2.11.0",
+        "asn1js": "^3.0.10",
+        "tslib": "^2.8.1"
+      },
+      "engines": {
+        "node": ">=14"
+      }
+    },
+    "node_modules/@peculiar/asn1-schema": {
+      "version": "2.11.0",
+      "resolved": "https://registry.npmjs.org/@peculiar/asn1-schema/-/asn1-schema-2.11.0.tgz",
+      "integrity": "sha512-8xh4avo53/vXO6UEv9yaoJ83hY581geaLTygf61NPIXP5AeIZCPjJhpTaYU23IZkG+NpLN/C9FYzWp7hphIT9A==",
+      "license": "MIT",
+      "dependencies": {
+        "@peculiar/utils": "^2.0.2",
+        "asn1js": "^3.0.10",
+        "tslib": "^2.8.1"
+      },
+      "engines": {
+        "node": ">=14"
+      }
+    },
+    "node_modules/@peculiar/asn1-x509": {
+      "version": "2.11.0",
+      "resolved": "https://registry.npmjs.org/@peculiar/asn1-x509/-/asn1-x509-2.11.0.tgz",
+      "integrity": "sha512-J1sHAwGNlk+8J+FeR1eLVc6Gq0T9f9ITc3HWyPYgJraoW6U8AJuQiWVJ3SCEpltfTdpOY7fHdHT5oKAsbK/jww==",
+      "license": "MIT",
+      "dependencies": {
+        "@peculiar/asn1-schema": "^2.11.0",
+        "@peculiar/utils": "^2.0.2",
+        "asn1js": "^3.0.10",
+        "tslib": "^2.8.1"
+      },
+      "engines": {
+        "node": ">=14"
+      }
+    },
+    "node_modules/@peculiar/asn1-x509-attr": {
+      "version": "2.11.0",
+      "resolved": "https://registry.npmjs.org/@peculiar/asn1-x509-attr/-/asn1-x509-attr-2.11.0.tgz",
+      "integrity": "sha512-Fgvnd9REmLxEj/4cbDP54dNUNUXkzUksXLqEHqs1mHBuSRjSTCUSPM/WQIZYSvrdG7ND9CX1AQtPoIBekhgQSA==",
+      "license": "MIT",
+      "dependencies": {
+        "@peculiar/asn1-schema": "^2.11.0",
+        "@peculiar/asn1-x509": "^2.11.0",
+        "asn1js": "^3.0.10",
+        "tslib": "^2.8.1"
+      },
+      "engines": {
+        "node": ">=14"
+      }
+    },
+    "node_modules/@peculiar/utils": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/@peculiar/utils/-/utils-2.0.3.tgz",
+      "integrity": "sha512-+oL3HPFRIZ1St2K50lWCXiioIgSoxzz7R1J3uF6neO2yl1sgmpgY6XXJH4BdpoDkMWznQTeYF6oWNDZLCdQ4eQ==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "^2.8.1"
+      }
+    },
+    "node_modules/@peculiar/x509": {
+      "version": "1.14.3",
+      "resolved": "https://registry.npmjs.org/@peculiar/x509/-/x509-1.14.3.tgz",
+      "integrity": "sha512-C2Xj8FZ0uHWeCXXqX5B4/gVFQmtSkiuOolzAgutjTfseNOHT3pUjljDZsTSxXFGgio54bCzVFqmEOUrIVk8RDA==",
+      "license": "MIT",
+      "dependencies": {
+        "@peculiar/asn1-cms": "^2.6.0",
+        "@peculiar/asn1-csr": "^2.6.0",
+        "@peculiar/asn1-ecc": "^2.6.0",
+        "@peculiar/asn1-pkcs9": "^2.6.0",
+        "@peculiar/asn1-rsa": "^2.6.0",
+        "@peculiar/asn1-schema": "^2.6.0",
+        "@peculiar/asn1-x509": "^2.6.0",
+        "pvtsutils": "^1.3.6",
+        "reflect-metadata": "^0.2.2",
+        "tslib": "^2.8.1",
+        "tsyringe": "^4.10.0"
+      },
+      "engines": {
+        "node": ">=20.0.0"
       }
     },
     "node_modules/@pinojs/redact": {
@@ -19,6 +235,31 @@
       "integrity": "sha512-k2ENnmBugE/rzQfEcdWHcCY+/FM3VLzH9cYEsbdsoqrvzAKRhUZeRNhAZvB8OitQJ1TBed3yqWtdjzS6wJKBwg==",
       "license": "MIT"
     },
+    "node_modules/@simplewebauthn/browser": {
+      "version": "13.3.0",
+      "resolved": "https://registry.npmjs.org/@simplewebauthn/browser/-/browser-13.3.0.tgz",
+      "integrity": "sha512-BE/UWv6FOToAdVk0EokzkqQQDOWtNydYlY6+OrmiZ5SCNmb41VehttboTetUM3T/fr6EAFYVXjz4My2wg230rQ==",
+      "license": "MIT"
+    },
+    "node_modules/@simplewebauthn/server": {
+      "version": "13.3.3",
+      "resolved": "https://registry.npmjs.org/@simplewebauthn/server/-/server-13.3.3.tgz",
+      "integrity": "sha512-LelX/lcy5cjc15A86i/aNxHhB5eU7dd20QsbP0VLAf9e38+SLlsnqCCyecx3xqfGofhmX05h1J9fKRYWxw+luA==",
+      "license": "MIT",
+      "dependencies": {
+        "@hexagon/base64": "^1.1.27",
+        "@levischuck/tiny-cbor": "^0.2.2",
+        "@peculiar/asn1-android": "^2.6.0",
+        "@peculiar/asn1-ecc": "^2.6.1",
+        "@peculiar/asn1-rsa": "^2.6.1",
+        "@peculiar/asn1-schema": "^2.6.0",
+        "@peculiar/asn1-x509": "^2.6.1",
+        "@peculiar/x509": "^1.14.3"
+      },
+      "engines": {
+        "node": ">=20.0.0"
+      }
+    },
     "node_modules/accepts": {
       "version": "1.3.8",
       "resolved": "https://registry.npmjs.org/accepts/-/accepts-1.3.8.tgz",
@@ -38,6 +279,20 @@
       "integrity": "sha512-PCVAQswWemu6UdxsDFFX/+gVeYqKAod3D3UVm91jHwynguOwAvYPhx8nNlM++NqRcK6CxxpUafjmhIdKiHibqg==",
       "license": "MIT"
     },
+    "node_modules/asn1js": {
+      "version": "3.0.10",
+      "resolved": "https://registry.npmjs.org/asn1js/-/asn1js-3.0.10.tgz",
+      "integrity": "sha512-S2s3aOytiKdFRdulw2qPE51MzjzVOisppcVv7jVFR+Kw0kxwvFrDcYA0h7Ndqbmj0HkMIXYWaoj7fli8kgx1eg==",
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "pvtsutils": "^1.3.6",
+        "pvutils": "^1.1.5",
+        "tslib": "^2.8.1"
+      },
+      "engines": {
+        "node": ">=12.0.0"
+      }
+    },
     "node_modules/atomic-sleep": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/atomic-sleep/-/atomic-sleep-1.0.0.tgz",
@@ -804,6 +1059,24 @@
         "url": "https://opencollective.com/express"
       }
     },
+    "node_modules/pvtsutils": {
+      "version": "1.3.6",
+      "resolved": "https://registry.npmjs.org/pvtsutils/-/pvtsutils-1.3.6.tgz",
+      "integrity": "sha512-PLgQXQ6H2FWCaeRak8vvk1GW462lMxB5s3Jm673N82zI4vqtVUPuZdffdZbPDFRoU8kAhItWFtPCWiPpp4/EDg==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "^2.8.1"
+      }
+    },
+    "node_modules/pvutils": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/pvutils/-/pvutils-1.2.0.tgz",
+      "integrity": "sha512-BbubeCEyTuQjVMakvJQ/Sxbc93F2pwmbsxONT/ZRrwU7Ua38d8unYTwXpTVLAKJ4BDuH9IGztCjQcd/N/39Dvg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=16.0.0"
+      }
+    },
     "node_modules/qs": {
       "version": "6.15.2",
       "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.2.tgz",
@@ -858,6 +1131,12 @@
         "node": ">= 12.13.0"
       }
     },
+    "node_modules/reflect-metadata": {
+      "version": "0.2.2",
+      "resolved": "https://registry.npmjs.org/reflect-metadata/-/reflect-metadata-0.2.2.tgz",
+      "integrity": "sha512-urBwgfrvVP/eAyXx4hluJivBKzuEbSQs9rKWCrCkbSxNv8mxPcUZKeuoF3Uy4mJl3Lwprp6yy5/39VWigZ4K6Q==",
+      "license": "Apache-2.0"
+    },
     "node_modules/safe-buffer": {
       "version": "5.2.1",
       "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz",
@@ -1061,6 +1340,30 @@
         "node": ">=0.6"
       }
     },
+    "node_modules/tslib": {
+      "version": "2.8.1",
+      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
+      "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
+      "license": "0BSD"
+    },
+    "node_modules/tsyringe": {
+      "version": "4.10.0",
+      "resolved": "https://registry.npmjs.org/tsyringe/-/tsyringe-4.10.0.tgz",
+      "integrity": "sha512-axr3IdNuVIxnaK5XGEUFTu3YmAQ6lllgrvqfEoR16g/HGnYY/6We4oWENtAnzK6/LpJ2ur9PAb80RBt7/U4ugw==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "^1.9.3"
+      },
+      "engines": {
+        "node": ">= 6.0.0"
+      }
+    },
+    "node_modules/tsyringe/node_modules/tslib": {
+      "version": "1.14.1",
+      "resolved": "https://registry.npmjs.org/tslib/-/tslib-1.14.1.tgz",
+      "integrity": "sha512-Xni35NKzjgMrwevysHTCArtLDpPvye8zV/0E4EyYn43P7/7qvQwPh9BGkHewbMulVntbigmcT7rdX3BNo9wRJg==",
+      "license": "0BSD"
+    },
     "node_modules/type-is": {
       "version": "1.6.18",
       "resolved": "https://registry.npmjs.org/type-is/-/type-is-1.6.18.tgz",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.25.13",
+  "version": "1.25.15",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",
@@ -25,7 +25,9 @@
   "dependencies": {
     "express": "^4.21.2",
     "pg": "^8.20.0",
-    "pino": "^9.14.0"
+    "pino": "^9.14.0",
+    "@simplewebauthn/browser": "^13.3.0",
+    "@simplewebauthn/server": "^13.3.3"
   },
   "overrides": {
     "undici": "^6.29.1"

package/release-notes.json

@@ -11788,5 +11788,29 @@
       "id": "1005273",
       "text": "The project guide now ends with a written plan (with recommended features drawn only from what Bongos really offers), saves the chat so visitors can come back to it, moves it onto their account when they sign up, and deletes i"
     }
+  ],
+  "1.25.14": [
+    {
+      "id": "1004753",
+      "text": "Designed how a project owner can give a teammate access to help run their hosted project, without letting anyone who merely signs in act on it."
+    },
+    {
+      "id": "1005109",
+      "text": "Founders setting up a new project can now copy each setup task's prompt straight from the Genesis page, without opening the task."
+    },
+    {
+      "id": "1005269",
+      "text": "Adding a security card works again on sites that install Bongos as a package: the card libraries are now included in the released core."
+    },
+    {
+      "id": "1005279",
+      "text": "The project guide now asks whether you are starting fresh or already have something, and for an existing project plans from your own description, without ever reading your files or code."
+    }
+  ],
+  "1.25.15": [
+    {
+      "id": "1005116",
+      "text": "Founders now write their own strategy. Each setup stage can be done three ways: answer guided questions, write it freely, or get help from your own AI — and you can switch at any time without losing anything. Your answers are"
+    }
   ]
 }

package/scripts/bongos/genesis.js

@@ -0,0 +1,178 @@
+#!/usr/bin/env node
+// scripts/bongos/genesis.js — the founder's genesis answers from a terminal (task 1005116)
+//
+// WHY. Each genesis stage is the founder's to write, through one of three doors onto one
+// stored record (modules/onboarding/genesis-work.js): guided questions, an open page, or
+// their own AI session helping. This is how an AI session works a stage WITH the founder
+// — it reads what they have said, asks the stage's own questions, and records only the
+// answers the founder accepts — and how any session planning a goal or task reads what
+// the founder said (`context`). Every write goes to the server as the person signed in;
+// only the project owner may write, so a session can never author a stage on its own.
+//
+// Usage:
+//   npx bongos genesis show [stage]                       every stage, or one, with its answers
+//   npx bongos genesis context                            what the founder said, as markdown (for planning sessions)
+//   npx bongos genesis assist <stage>                     the brief for the founder's AI session (the assisted door)
+//   npx bongos genesis answer <stage> <question> "<words>" [--origin founder|assisted]
+//   npx bongos genesis answer <stage> <question> --not-sure ["why"]
+//   npx bongos genesis answer <stage> <question> --skip ["why"]
+//   npx bongos genesis clear <stage> <question>           un-answer: back to empty (not skipped)
+//   npx bongos genesis history <stage> <question>         what an answer used to say
+//   npx bongos genesis door <stage> guided|open|assisted  which way the founder is working now
+//   npx bongos genesis page <stage> "<words>" | --file <path> | --remove
+//   npx bongos genesis link <stage> <url> | --remove      the document the founder already has
+//
+// Also `node scripts/bongos/genesis.js …`.
+'use strict';
+
+const fs = require('node:fs');
+const { apiCall, requireSession, errCode, cliExit } = require('./cli-lib');
+
+const USAGE = 'usage: npx bongos genesis show [stage] | context | assist <stage> | answer <stage> <question> "<words>" [--origin founder|assisted] | answer <stage> <question> --not-sure|--skip ["why"] | clear <stage> <question> | history <stage> <question> | door <stage> guided|open|assisted | page <stage> "<words>"|--file <path>|--remove | link <stage> <url>|--remove';
+
+const STATE_LABEL = { answered: '', not_sure: '[not sure yet] ', skipped: '[skipped] ' };
+const ORIGIN_LABEL = { assisted: ' (with AI help)', carried_over: ' (carried over — confirm or edit)' };
+
+// Pure: one stage as the founder reads it.
+function formatStage(s) {
+  const out = [`${s.stage[0].toUpperCase()}${s.stage.slice(1)} — working ${s.door}` +
+    (s.adopted ? ` · ${s.counts.answered} answered, ${s.counts.not_sure} not sure, ${s.counts.skipped} skipped, ${s.counts.empty} empty` : '')];
+  for (const q of s.questions) {
+    out.push(`  ${q.id}: ${q.ask}`);
+    if (!q.answer) { out.push('    (empty)'); continue; }
+    const a = q.answer;
+    const words = a.text ? a.text.replace(/\n/g, '\n    ') : '';
+    out.push(`    ${STATE_LABEL[a.state] || ''}${words}${ORIGIN_LABEL[a.origin] || ''}`.trimEnd());
+  }
+  if (s.page) out.push('  Page:', `    ${s.page.replace(/\n/g, '\n    ')}`);
+  if (s.link) out.push(`  Link: ${s.link}`);
+  return out.join('\n');
+}
+
+// Pure: parse `answer` arguments into the PUT body, or { error }.
+function parseAnswer(rest) {
+  const args = [...rest];
+  const body = {};
+  const take = (flag) => {
+    const i = args.indexOf(flag);
+    if (i < 0) return undefined;
+    const next = args[i + 1];
+    const val = next != null && !String(next).startsWith('--') ? next : '';
+    args.splice(i, val === '' && (next == null || String(next).startsWith('--')) ? 1 : 2);
+    return val;
+  };
+  const origin = take('--origin');
+  const notSure = take('--not-sure');
+  const skip = take('--skip');
+  if (notSure !== undefined && skip !== undefined) return { error: 'choose one of --not-sure or --skip' };
+  if (origin !== undefined) body.origin = origin;
+  if (notSure !== undefined) { body.state = 'not_sure'; if (notSure) body.text = notSure; }
+  else if (skip !== undefined) { body.state = 'skipped'; if (skip) body.text = skip; }
+  else {
+    const words = args.join(' ').trim();
+    if (!words) return { error: 'give the answer in quotes, or --not-sure / --skip' };
+    body.state = 'answered';
+    body.text = words;
+  }
+  return { body };
+}
+
+async function call(method, path, body, what) {
+  const r = await apiCall(method, `/api/bongos${path}`, body);
+  if (!r.ok) console.error(`Could not ${what} (${r.status}${errCode(r.data) ? `: ${errCode(r.data)}` : ''}).`);
+  return r.ok ? r.data : null;
+}
+
+const enc = encodeURIComponent;
+
+async function main(argv) {
+  const [cmd, stage, ...rest] = argv;
+  if (!cmd || cmd === '--help' || cmd === '-h') { console.log(USAGE); return cmd ? 0 : 2; }
+  await requireSession();
+  if (cmd === 'show') {
+    if (stage) {
+      const d = await call('GET', `/founding/work/${enc(stage)}`, null, 'read the stage');
+      if (!d) return 1;
+      console.log(formatStage(d.work));
+      return 0;
+    }
+    const d = await call('GET', '/founding/work', null, 'read genesis');
+    if (!d) return 1;
+    console.log(d.stages.map(formatStage).join('\n\n'));
+    return 0;
+  }
+  if (cmd === 'context') {
+    const d = await call('GET', '/founding/context', null, 'read what the founder said');
+    if (!d) return 1;
+    console.log(d.markdown || 'The founder has not written anything in genesis yet.');
+    return 0;
+  }
+  if (!stage) { console.error(USAGE); return 2; }
+  if (cmd === 'assist') {
+    const d = await call('GET', `/founding/work/${enc(stage)}/assist`, null, 'build the brief');
+    if (!d) return 1;
+    console.log(d.prompt);
+    return 0;
+  }
+  if (cmd === 'answer') {
+    const [question, ...words] = rest;
+    if (!question) { console.error(USAGE); return 2; }
+    const p = parseAnswer(words);
+    if (p.error) { console.error(p.error); return 2; }
+    const d = await call('PUT', `/founding/work/${enc(stage)}/answers/${enc(question)}`, p.body, 'save the answer');
+    if (!d) return 1;
+    console.log(d.changed === false ? 'Unchanged — that is already the answer.' : 'Saved.');
+    console.log(formatStage(d.work));
+    return 0;
+  }
+  if (cmd === 'clear' || cmd === 'history') {
+    const [question] = rest;
+    if (!question) { console.error(USAGE); return 2; }
+    if (cmd === 'clear') {
+      const d = await call('DELETE', `/founding/work/${enc(stage)}/answers/${enc(question)}`, null, 'clear the answer');
+      if (!d) return 1;
+      console.log(d.cleared ? 'Cleared — the question is empty again.' : 'It was already empty.');
+      return 0;
+    }
+    const d = await call('GET', `/founding/work/${enc(stage)}/answers/${enc(question)}/history`, null, 'read the history');
+    if (!d) return 1;
+    if (!d.history.length) console.log('No answer has ever been saved here.');
+    for (const h of d.history) console.log(`${h.changed_at}  ${h.state}${h.text ? `: ${h.text}` : ''}`);
+    return 0;
+  }
+  if (cmd === 'door') {
+    const d = await call('PUT', `/founding/work/${enc(stage)}/door`, { door: String(rest[0] || '') }, 'switch the door');
+    if (!d) return 1;
+    console.log(`Now working ${d.work.door}. Nothing already written was lost.`);
+    return 0;
+  }
+  if (cmd === 'page') {
+    let page;
+    if (rest[0] === '--remove') page = '';
+    else if (rest[0] === '--file') {
+      if (!rest[1]) { console.error('give the file to read: --file <path>'); return 2; }
+      page = fs.readFileSync(rest[1], 'utf8');
+    } else page = rest.join(' ');
+    const d = await call('PUT', `/founding/work/${enc(stage)}/page`, { page }, 'save the page');
+    if (!d) return 1;
+    console.log(d.work.page ? 'Page saved.' : 'Page removed.');
+    return 0;
+  }
+  if (cmd === 'link') {
+    const url = rest[0] === '--remove' ? '' : String(rest[0] || '');
+    const d = await call('PUT', `/founding/work/${enc(stage)}/link`, { url }, 'save the link');
+    if (!d) return 1;
+    console.log(d.work.link ? `Linked: ${d.work.link}` : 'Link removed.');
+    return 0;
+  }
+  console.error(USAGE);
+  return 2;
+}
+
+if (require.main === module) {
+  main(process.argv.slice(2))
+    .then((code) => cliExit(code))
+    .catch((err) => { console.error('fatal:', err && err.message ? err.message : err); cliExit(1); });
+}
+
+module.exports = { main, formatStage, parseAnswer };

package/scripts/bongos/package-core.js

@@ -288,7 +288,9 @@ function isNpmStripped(pathRel) {
 // published core without it crashes MODULE_NOT_FOUND at startup (task 1003160).
 // discord.js (+ its undici requirement) is an OPTIONAL MODULE dependency, not
 // core; a consumer that enables the discord module installs it itself.
-const CORE_DEP_NAMES = ['express', 'pg', 'pino'];
+// The security-card libraries joined in task 1005269: routes/my-passkeys.js serves the browser bundle
+// and requires the server lib, and a package without them answers bundle_missing on every instance.
+const CORE_DEP_NAMES = ['express', 'pg', 'pino', '@simplewebauthn/browser', '@simplewebauthn/server'];
 
 // Pure — takes the source package.json's `dependencies`/`overrides` as plain
 // objects so this is unit-testable with no disk I/O. Throws if a required core
@@ -928,7 +930,7 @@ function main() {
   const sourcePkgLock = JSON.parse(pkgLockRaw.toString('utf8'));
   const corePkgJson = buildPackageJson({ version, sourceDeps: sourcePkgJson.dependencies, sourceOverrides: sourcePkgJson.overrides });
   const corePkgLock = prunePackageLock(sourcePkgLock, {
-    name: corePkgJson.name, version, rootRanges: { express: corePkgJson.dependencies.express, pg: corePkgJson.dependencies.pg },
+    name: corePkgJson.name, version, rootRanges: { ...corePkgJson.dependencies },
   });
   console.error(`[package-core] synthesized package.json (${Object.keys(corePkgJson.dependencies).join(', ')}) + pruned package-lock.json (${Object.keys(corePkgLock.packages).length - 1} of ${Object.keys(sourcePkgLock.packages).length - 1} locked packages kept).`);
 

package/scripts/bongos/run-unit-tests.js

@@ -375,6 +375,9 @@ const INTEGRATION = new Set([
   // the second proves the search index never widens a caller past their rank or into
   // another builder memory. Each skipped in CI before, so none had ever been gated.
   'page_notes_db', 'howto_state_db', 'search_isolation_db',
+  // task 1005116: the genesis stage-work store on the real schema (the DB-free half,
+  // genesis_work, stays in the unit lane).
+  'genesis_work_db',
 ]);
 
 // Excluded so this gate is trustworthy in a CLEAN checkout (the CI condition):

package/scripts/gds/genesis.js

@@ -0,0 +1,7 @@
+#!/usr/bin/env node
+// scripts/gds/genesis.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/genesis.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
+'use strict';
+require('../bongos/forwarder.js').forward(module, 'genesis.js');

package/src/bongos/module-scope-map.js

@@ -191,6 +191,7 @@ const MODULE_GLOBS = {
   'front-door-guide': [
     'modules/front-door-guide/', 'tests/front_door_guide.mjs',
     'tests/front_door_guide_plan.mjs', 'tests/front_door_guide_db.mjs',
+    'tests/front_door_guide_existing.mjs',
   ],
   // The /raise investor page (task 1004847, ADR 0384): hub-only.
   raise: [

package/src/module-api.js

@@ -81,7 +81,7 @@ const { sleep } = require('./sleep');
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.25.13'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.25.15'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/cutover_codemod.mjs

@@ -183,7 +183,7 @@ t('planCodemod rewrites host files, skips core files, reports unmapped', () => {
 
 t('every CORE_INTERNAL_MAP target is exported by the core package (a rewrite never outruns an export)', () => {
   const { buildPackageJson } = require('../scripts/bongos/package-core.js');
-  const pkg = buildPackageJson({ version: '0.0.0-test', sourceDeps: { express: '^4.0.0', pg: '^8.0.0', pino: '^9.0.0' } });
+  const pkg = buildPackageJson({ version: '0.0.0-test', sourceDeps: { express: '^4.0.0', pg: '^8.0.0', pino: '^9.0.0', '@simplewebauthn/browser': '^13.0.0', '@simplewebauthn/server': '^13.0.0' } });
   for (const mapped of Object.values(CORE_INTERNAL_MAP)) {
     assert.ok(pkg.exports[`./${mapped}`], `@bongos/core must export ./${mapped} (targeted by the codemod)`);
   }