@nano133/nanoterra 0.11.0 → 0.12.0

package/CHANGELOG.md

@@ -1,5 +1,31 @@
 # Changelog
 
+## 0.12.0 (2026-11-01)
+
+- **A passkey for the owner (`createAdminSignin({ passkeys: true })`): the owner's LINKED passkeys open /admin.** A passkey is only a key to /admin; the money stays
+  in the owner's wallet. A link counts only when both sides prove their key: `POST /api/admin-signin/passkey/link` needs a live **wallet** admin session of the
+  owner AND the passkey's own signature of "Link this passkey to the ADMIN of <host>: sign in as <address> at <ms>". A linked passkey then signs "ADMIN of <host>:
+  sign in as ..." at `POST /api/admin-signin/passkey` (the person check and the start limit, like `start`) and gets a new admin session (`via: "passkey"`, one day,
+  the admin cookie, a row of the sign-in list). Never the host alone: a player's passkey signature never opens /admin. Each signature counts once (the admin's own
+  table) within 5 minutes. At most 10 passkeys per owner (`ADMIN_PASSKEY_LIMIT`); a passkey's session can list them (`POST /passkeys`) but not add or remove one;
+  `POST /passkey/unlink` (wallet only) removes a link and ends that passkey's sessions. Off by default: no route, and no passkey session opens /admin.
+- **`session(request)` reads the link on every request** with the CURRENT owner: a "passkey" session comes back as `{ address, createdAt, via: "passkey", linkedTo:
+  owner }` only while its link exists, else as no session (401). A removed link, a new owner address, or the passkeys turned off end its access at the next request.
+- **The guard's ONE new rule (Wes, 2026-11-01):** `AdminSession` has an optional `linkedTo`; check 3 accepts `via: "passkey"` only when `linkedTo` is a text, and
+  check 4 then compares `linkedTo` with the owner (exact text) instead of the address. Every other `via` is refused as before; a wallet session is judged by its
+  address (its `linkedTo` is not read). "DO NOT LOOSEN" stays. The grid test proves the kit is at least as strict as the starter for every input except a
+  "passkey" session with `linkedTo === owner`.
+- Stores: optional passkey methods on `AdminSigninStore` (`createSession`, `linkPasskey` → "linked" | "exists" | "full", `unlinkPasskey`, `passkeys`, `linked`,
+  `useOnce`; `clean` drops used signatures); memory, D1 and Firestore have them, and `adminSigninStoreConformance(make, { passkeys })` has four new cases. **D1
+  migration** for a game with the tables already (the starter: `migrations/0009_admin_passkeys.sql`): `admin_passkeys (owner, address, created_at, PRIMARY KEY
+  (owner, address))` and `admin_once (key PRIMARY KEY, until)`, now at the end of `/admin-signin/d1.sql`. Without it the wallet sign-in and `clean()` work as before.
+  Firestore: `admin_passkeys/{owner}` (one document per owner) and `admin_once/{key}` (TTL on `deleteAt`).
+- The panel: `adminSignIn({ passkeys: true, scheme, name })` adds a **Passkey** tile after the wallets; `ownerPasskeys({ scheme, name })` is the **Owner passkeys**
+  card (the list, Add a passkey and Remove, both only with a wallet session) for the new `mountAdmin` option `cards` (cards of the game's own in Settings,
+  `{ el, refresh? }`, `AdminCard`). The passkey code and the purse load only when a passkey is used. The admin icons have a `key`.
+- Sizes (gzip, size test): `/admin-signin` 6.9 kB (ceiling 7.3 kB), `/admin-signin/d1` 1.9 kB (1.95 kB), `/admin-signin/firestore` 2.2 kB (2.3 kB),
+  `/admin-signin/panel` 9.3 kB (9.7 kB).
+
 ## 0.11.0 (2026-11-01)
 
 - **New path `@nano133/nanoterra/admin-signin`: the admin's wallet sign-in, on one fixed route in every game, `/api/admin-signin`.** The game starter's admin

package/README.md

@@ -74,9 +74,9 @@ Each path loads only what it needs. A page that reads a ticket loads no Three.js
 | `@nano133/nanoterra/admin/d1`, `/admin/firestore` | the admin store for D1 (the starter's tables) or Firestore (a small interface, no Firebase dependency): `createD1Store`, `createFirestoreStore` (since 0.2.0) | no | 1.5 kB each |
 | `@nano133/nanoterra/admin/panel` | the admin page, drawn in the browser into one element, and its stylesheet `@nano133/nanoterra/admin/style.css` (since 0.2.0) | no | 18.9 kB with the tabbed layout (10.6 kB on 0.3.0, 8.5 kB on 0.2.0) + 5.9 kB of CSS (minified) |
 | `@nano133/nanoterra/admin/conformance` | test cases that a game runs against its own admin (a dev dependency in practice; since 0.2.0) | no | n/a |
-| `@nano133/nanoterra/admin-signin` | the admin's wallet sign-in on one fixed route, `/api/admin-signin`: the routes, `session(request)` for the admin handler, "Sign out everywhere", the sign-in list, a memory store (server code; it needs `@nano133/signin`; since 0.11.0) | no | 5.5 kB without `@nano133/signin` |
-| `@nano133/nanoterra/admin-signin/d1`, `/admin-signin/firestore` | its store on D1 (the starter's own tables; a new game adds `/admin-signin/d1.sql`) or Firestore (a small interface, no Firebase dependency) (since 0.11.0) | no | 1.4 kB, 1.7 kB |
-| `@nano133/nanoterra/admin-signin/panel` | the admin's sign-in in the browser, for `mountAdmin`'s `signIn` and `signOut`: `adminSignIn()`, `adminSignOut()`, with its own QR code; its stylesheet `@nano133/nanoterra/admin-signin/style.css` is the player sheet's (since 0.11.0) | no | 6.8 kB |
+| `@nano133/nanoterra/admin-signin` | the admin's wallet sign-in on one fixed route, `/api/admin-signin`: the routes, `session(request)` for the admin handler, "Sign out everywhere", the sign-in list, a memory store, and (since 0.12.0, `passkeys: true`) the owner's linked passkeys (server code; it needs `@nano133/signin`; since 0.11.0) | no | 6.9 kB without `@nano133/signin` |
+| `@nano133/nanoterra/admin-signin/d1`, `/admin-signin/firestore` | its store on D1 (the starter's own tables; a new game adds `/admin-signin/d1.sql`) or Firestore (a small interface, no Firebase dependency) (since 0.11.0) | no | 1.9 kB, 2.2 kB |
+| `@nano133/nanoterra/admin-signin/panel` | the admin's sign-in in the browser, for `mountAdmin`'s `signIn` and `signOut`: `adminSignIn()`, `adminSignOut()`, with its own QR code, and (since 0.12.0) the Passkey tile and the `ownerPasskeys()` card (the passkey code loads only at a passkey's use); its stylesheet `@nano133/nanoterra/admin-signin/style.css` is the player sheet's (since 0.11.0) | no | 9.3 kB |
 | `@nano133/nanoterra/admin-signin/conformance` | the store's rules as test cases, for a store a game writes itself (since 0.11.0) | no | n/a |
 | `@nano133/nanoterra/friends` | the game's own friends list: the handler, the rules, a memory store (server code; since 0.6.0) | no | 3.7 kB |
 | `@nano133/nanoterra/friends/d1`, `/friends/firestore` | the friends store for D1 (with the migration `/friends/d1.sql`) or Firestore (a small interface, no Firebase dependency): `createD1Friends`, `createFirestoreFriends` (since 0.6.0) | no | 3.0 kB each |
@@ -629,10 +629,9 @@ store.signOutEverywhere = signin.signOutEverywhere`, see "The admin's sign-in"),
 
 - **A second signature for a write.** The only server write the admin makes is the sign-in switch (and the Shelf never writes), so asking the owner to sign again for each press adds friction for
   little gain. A later version could ask for it if the admin ever writes more.
-- **An optional passkey for the admin, bound to the domain.** A passkey (WebAuthn) belongs to the domain it was made for, so a sign-in request that a stranger relays to the owner from another
-  page or link **cannot be answered with it**: the browser will not use the passkey on another domain. That is the strongest fix for the relay of an admin wallet sign-in. The wallet text names
-  the admin now, but a wallet cannot tell where a request started; a passkey can. Later, not now: the owner's wallet signature would stay as the way to make the first admin login or to
-  recover, and the passkey would be a second, optional way that cannot be relayed.
+- **An optional passkey for the admin, bound to the domain.** Built in 0.12.0: see "A passkey for the owner" under "The admin's sign-in". A passkey (WebAuthn) belongs to the domain it was
+  made for, so a sign-in request that a stranger relays to the owner from another page cannot be answered with it. The owner's wallet stays the way to make the first admin login, to link a
+  passkey and to recover.
 
 ### The panel
 
@@ -658,7 +657,8 @@ real tabs (the arrow keys, Home and End work); every tab is made once, so a draf
 A visitor who is signed out gets the game's sign-in; a wrong wallet, a Nanoterra sign-in and a missing owner address each get their own screen and see no data (a sign-out
 takes the drawn data off the page). Options: `api` (the handler's base path), `noAddressHelp`, `lookPicture(look)` (your own picture of a look for the Shelf), `repoHelp`,
 `loginsNote`, `playerPasskeys` (the game offers its players a passkey: on `*.workers.dev` the banner says that passkeys turn on with the game's own
-domain) and `fetch`.
+domain), `cards` (since 0.12.0: cards of the game's own for Settings, after Sign-ins, `{ el, refresh? }`; `refresh()` runs at each sign-in; the owner's passkeys
+card is one) and `fetch`.
 
 **The Shelf** shows the looks your game sells now in a grid of cards: a big picture on a soft tint of the look's colour, the price with its step on the ladder ("25¢ ·
 statement"), what it has sold and its share of the sales, its slots as chips; filters (All, For sale, Free, Not sold yet) and a sort (Best selling, price, name, the
@@ -783,13 +783,14 @@ minutes**, is delivered for **one more minute**, and works **once**; only the br
 **NanChat is OFF by default.** Its text must start "Login to <host>" and **cannot name the ADMIN**, so the owner who is asked to sign cannot tell an admin sign-in from a game
 sign-in. A start with `way: "nanchat"` is refused: "NanChat cannot open the admin yet. Use Berry Wallet or Nautilus." A game may turn it on with `nanchat: true` (and the
 panel's `nanchat: true`): it then signs "Login to <host>" as a player's NanChat sign-in does, with the same admin checks, and the panel says that its text cannot say ADMIN.
-**Berry Wallet is first** in every list of wallets. **No passkey opens /admin** yet.
+**Berry Wallet is first** in every list of wallets. A passkey opens /admin only when the owner linked it (`passkeys: true`, see "A passkey for the owner" below).
 
 **The two logins stay apart, on the server.** The admin login is its own cookie, `admin` (`__Host-admin` on https; HttpOnly, SameSite=Lax, **one day**), beside the player's
 `session`, so the game and /admin can have different people signed in at once. The database keeps the SHA-256 of `"admin:"` and the token (`adminKey`), and the player's
 session its plain hash: a player's token put in the admin cookie opens nothing, a player's starter copied to `starter-admin` finishes nothing, and an admin request never
 makes a player's login (the store reads only its own scope's rows). **Only the game's own address (`owner`) makes an admin login**; the guard (`adminAccess`) decides again
-on every call of /admin. `session(request)` gives `{ address, createdAt, via }` (a stored word other than `"wallet"` or `"nanoterra"` is `"unknown"`: refused).
+on every call of /admin. `session(request)` gives `{ address, createdAt, via }` (a stored word other than `"wallet"`, `"nanoterra"` or `"passkey"` is `"unknown"`: refused;
+a `"passkey"` session also carries `linkedTo`, only while its link exists: see below).
 
 **What it keeps.** Each admin login writes one row of the sign-in list: the time, the country of Cloudflare's country header (two letters, or none) and a short browser
 name from fixed lists ("Chrome on macOS"): no address, no IP and no browser text. A row is kept 30 days. `signOutEverywhere()` deletes every admin login and ends every admin
@@ -817,6 +818,79 @@ check every 2 seconds, and `done()` once the owner has signed in. Options: `base
 `session: adminSignin.session`, and in `admin.ts` `signIn: adminSignIn(...)`, `signOut: adminSignOut()`. The player's sign-in then needs no `sharedPaths`, and
 `src/worker/signin.ts` and `src/client/ui/signin.ts` go. Old requests started on `/api/signin` with `scope: "admin"` are 2 minutes long: none outlive the deploy.
 
+### A passkey for the owner (since 0.12.0)
+
+The owner may **link passkeys** to the game's address (at most 10, `ADMIN_PASSKEY_LIMIT`) and then open /admin with Face ID, Touch ID or the device PIN, without
+the wallet. **A passkey is only a key to /admin: the money stays in the owner's wallet.** It is off unless the game turns it on.
+
+**The security rule, in plain words.** A link counts only when each side proves its key, as nano133.com's account links do:
+
+1. **Only the owner's wallet writes a link.** `POST {base}/passkey/link` needs a live admin session made by the **wallet** of the game's own address. A passkey's
+   session cannot add a passkey, and neither can a player's login, a Nanoterra sign-in or another wallet.
+2. **The passkey proves its key** in the same call: its purse signs `Link this passkey to the ADMIN of <host>: sign in as <address> at <ms>`.
+3. **A linked passkey opens /admin** with its own signature of `ADMIN of <host>: sign in as <address> at <ms>`. It never names the host alone: a player's passkey
+   signature (`<host>: sign in as ...`) never opens /admin, a link signature is not a sign-in, and a sign-in signature links nothing. Each signature counts
+   **once** (the admin's own table) and within **5 minutes**.
+4. **The link is read on every request**, with the **current** owner address. Remove the link, or change the game's address, and the passkey's access ends at
+   the next request; a removal also deletes that passkey's admin sessions. The guard's one new rule (Wes, 2026-11-01): a session with `via: "passkey"` opens
+   /admin only with `linkedTo` equal to the owner address, and `session(request)` sets `linkedTo` only after it read the link. Every other check (the owner
+   address, one day, the clock) is the same as for the wallet.
+
+```ts
+// The Worker: the same createAdminSignin, with passkeys on
+const adminSignin = createAdminSignin({ store: createD1AdminSignin(env.DB), owner: receiveAddress(env), passkeys: true, limit, visitor, personCheck });
+
+// The admin page: the Passkey tile in the sign-in, and the "Owner passkeys" card in Settings
+import { mountAdmin } from "@nano133/nanoterra/admin/panel";
+import { adminSignIn, adminSignOut, ownerPasskeys } from "@nano133/nanoterra/admin-signin/panel";
+import { SCHEME } from "./scheme";   // the game's FROZEN passkey scheme: the same one the player sheet takes
+mountAdmin(el, {
+  looks,
+  signIn: adminSignIn({ personCheck, passkeys: true, scheme: SCHEME, name: "My Game" }),
+  signOut: adminSignOut(),
+  cards: [ownerPasskeys({ scheme: SCHEME, name: "My Game" })],
+});
+```
+
+| Route (with `passkeys: true`) | Who may call it | What it does |
+|---|---|---|
+| `POST {base}/passkey/link` `{ address, at, signature }` | a live **wallet** admin session of the owner | links the passkey that signed the link text: `{ ok, address, passkeys, limit, via, canChange, you }`; 409 `full` or `exists` |
+| `POST {base}/passkey/unlink` `{ address }` | a live **wallet** admin session of the owner | removes the link and ends that passkey's admin sessions: `{ ok, removed, passkeys, ... }` |
+| `POST {base}/passkeys` | any session the guard accepts | `{ passkeys: [{ address, createdAt }], limit, via, canChange, you }` (`canChange` only for the wallet) |
+| `POST {base}/passkey` `{ address, at, signature, turnstile? }` | the admin page | the passkey's ADMIN signature (the person check and the start limit, like `start`); 403 `not_linked` unless linked; else a new admin session `{ via: "passkey" }` of one day, the sign-in list row and the admin cookie: `{ status: "signedin", address, linkedTo }` |
+
+All four are POSTs from the game's own page (`Origin` checked) and are not routes at all while `passkeys` is off. The list, a link and a removal count 30 a minute
+per IP address; a link and a passkey sign-in also count with the starts (`limit`, 20 in 10 minutes per visitor). A refusal of a link from a passkey's session has
+`reason: "wallet_only"`. "Sign out everywhere" ends the passkeys' sessions too, and keeps the links (Remove ends one).
+
+**The panel.** `adminSignIn({ passkeys: true, scheme, name })` adds a **Passkey** tile after the wallets ("Use my passkey"). `ownerPasskeys({ scheme, name })` is
+a card for `mountAdmin`'s new `cards` option (cards of the game's own in Settings, after Sign-ins; each one's `refresh()` runs at every sign-in): the list, **Add a
+passkey** ("Make a new passkey" or "Use a passkey I have") and **Remove** (two presses), both shown only with a wallet session; a passkey's session sees "Sign in
+with your wallet to add or remove a passkey." The passkey code and the purse load only when a passkey is used. Text 16 px, keys 48 px. The passkey comes from the
+game's frozen scheme (the player sheet's), so a passkey the owner also uses to play may be linked too: its PLAYER signature still opens nothing here.
+
+**The store** needs the passkey methods (`createSession`, `linkPasskey`, `unlinkPasskey`, `passkeys`, `linked`, `useOnce`; the package's three stores have them, and
+`createAdminSignin({ passkeys: true })` refuses a store without them); `adminSigninStoreConformance(make, { passkeys: true })` proves them. **D1** keeps them in two
+new tables at the end of `d1.sql`. **A starter-shaped game adds this migration** (the starter: `migrations/0009_admin_passkeys.sql`); a game that already ran
+`d1.sql` before 0.12.0 adds the same two statements:
+
+```sql
+CREATE TABLE IF NOT EXISTS admin_passkeys (
+  owner TEXT NOT NULL,
+  address TEXT NOT NULL,
+  created_at INTEGER NOT NULL,
+  PRIMARY KEY (owner, address)
+);
+CREATE TABLE IF NOT EXISTS admin_once (
+  key TEXT PRIMARY KEY,
+  until INTEGER NOT NULL
+);
+```
+
+Without it, the wallet sign-in and `clean()` work as before (the clean-up skips the missing table); only `passkeys: true` needs it. **Firestore** keeps one document
+per owner in `admin_passkeys/{owner}` (`{ owner, passkeys: [{ address, createdAt }] }`, no `deleteAt`) and the used signatures in `admin_once/{key}` (`{ until,
+deleteAt }`: add it to the TTL policy). Other names: `createD1AdminSignin(db, { passkeys, once })`, `createFirestoreAdminSignin(db, { passkeys, once })`.
+
 ## The friends list (`/friends`; since 0.6.0)
 
 A Friends key for the game, and a list behind it. The admin's **Game** card chooses which list (`friends` in the settings; Nanoterra by default):
@@ -1522,7 +1596,6 @@ counter** as they are, and the page needs no change for the server part.
 - First-person arms, swimming, climbing and the room's other moves: only idle, walk, run, jump and wave, and the emotes (`/emotes`, which sit too).
 - Shared geometry for many characters at once, and a react-three-fiber wrapper.
 - `WebGPURenderer`: the ink is a GLSL `ShaderMaterial`, so use `WebGLRenderer`.
-- A passkey for the admin: the owner's linked passkey comes in a later version. Today only a wallet signature opens /admin.
 - A creator option to accept Berry Wallet only.
 - Move money. The shop (`/shop`) reads the Nano ledger to see a payment to the creator's address; no part of the package holds a key or sends.
 

package/ai/SPEC.md

@@ -275,13 +275,20 @@ do not change what the wallet signs.
 4. **The page.** `mountAdmin(el, { looks, signIn: adminSignIn({ personCheck }), signOut: adminSignOut() })` from `@nano133/nanoterra/admin-signin/panel`, with
    `@nano133/nanoterra/admin-signin/style.css`.
 5. **NanChat stays off** unless the owner asks for it: its text cannot name the ADMIN, so the owner cannot tell an admin sign-in from a game sign-in. To turn it on, pass
-   `nanchat: true` to `createAdminSignin` AND to `adminSignIn`. No passkey opens /admin yet.
-6. **Tests.** Run `adminSigninConformance` (`@nano133/nanoterra/admin/conformance`) on the game's own chain (its player sign-in and the admin's), and `adminConformance` with
-   the admin handler and `adminSignin.session`.
+   `nanchat: true` to `createAdminSignin` AND to `adminSignIn`.
+6. **The owner's passkeys (only if the owner asks; since 0.12.0).** A passkey is only a key to /admin: the money stays in the owner's wallet. Pass `passkeys: true` to
+   `createAdminSignin`; give `adminSignIn` the same `passkeys: true` with the game's frozen `scheme` (the player sheet's) and `name`, and give `mountAdmin`
+   `cards: [ownerPasskeys({ scheme, name })]`. D1: add the two tables at the end of `@nano133/nanoterra/admin-signin/d1.sql` as a new migration (the starter:
+   `migrations/0009_admin_passkeys.sql`, `admin_passkeys` and `admin_once`); Firestore: add `admin_once` to the TTL policy. Only a WALLET admin session of the owner links
+   or removes a passkey (at most 10), each passkey proves its key when it is linked, and a passkey's login counts only while its link to the current owner address
+   exists. Never write your own passkey check for /admin, never let a passkey session link another passkey, and never give `linkedTo` to a session yourself.
+7. **Tests.** Run `adminSigninConformance` (`@nano133/nanoterra/admin/conformance`) on the game's own chain (its player sign-in and the admin's), and `adminConformance` with
+   the admin handler and `adminSignin.session`. A store of your own runs `adminSigninStoreConformance(make, { passkeys: true })` when the passkeys are on.
 
 **Check:** on the game's public https address, Berry Wallet shows "URI: https://<host>/admin" and Nautilus "ADMIN of <host>"; the owner's wallet opens /admin; another
 wallet gets "That wallet is not this game's address"; the player's login (the owner's own address too) does not open /admin; a NanChat start says "NanChat cannot open the
-admin yet."
+admin yet." With passkeys on: the owner's wallet adds a passkey in Settings, Owner passkeys; that passkey then opens /admin from the Passkey tile and cannot add
+or remove a passkey; after Remove it opens nothing.
 
 ## 15. Do not
 

package/dist/admin/guard.d.ts

@@ -2,8 +2,16 @@
 export type AdminSession = {
     address: string;
     createdAt: number;
-    /** "wallet" is a signature made with the address's key. Anything else (a sign-in from Nanoterra names an address but proves no key) never opens /admin. */
+    /**
+     * "wallet" is a signature made with the address's key. "passkey" is a signature by a passkey that the owner linked: it counts only with `linkedTo`.
+     * Anything else (a sign-in from Nanoterra names an address but proves no key) never opens /admin.
+     */
     via: string;
+    /**
+     * For a "passkey" session only: the owner address its link points to, set by the sign-in only after it read the link on THIS request. The guard compares
+     * it with the owner instead of `address` (the passkey's own). A session of any other `via` is judged by its `address`; this field is not read.
+     */
+    linkedTo?: string;
 };
 export type AdminAccessInput = {
     /** The game's own address, in the form "nano_" and 60 characters, lowercase. A host passes null when none is set (or the example address is). */

package/dist/admin/guard.js

@@ -4,6 +4,7 @@
 // DO NOT LOOSEN THIS. It is the game starter's `adminGuard` (src/worker/admin.ts), with the same five checks in the same order, and it may only
 // refuse MORE than the starter does, never less (a test runs both over a grid of inputs and proves it). Deny by default: anything this function
 // does not understand is a refusal, and a fault inside it is a refusal too.
+// The ONE rule Wes approved on 2026-11-01 (the owner's linked passkey): a "passkey" session opens /admin only with `linkedTo` === the owner (checks 3 and 4).
 /** An admin login counts for one day; then the owner signs in again. */
 export const ADMIN_SESSION_MS = 24 * 60 * 60_000;
 /** A login made in the future by this much or more is not believed (clocks of two servers differ by seconds, not by minutes). */
@@ -43,11 +44,18 @@ function decide(input) {
     const { address, createdAt, via } = session;
     if (typeof address !== "string" || typeof via !== "string" || typeof createdAt !== "number")
         return refuse(401, "Sign in with your Nano address.");
-    // 3. It was made with a wallet signature. A sign-in from Nanoterra names an address but proves no key.
-    if (via !== "wallet")
+    // 3. It was made with a wallet signature, or (the one rule of 2026-11-01) by a passkey whose link the sign-in read on this request. A sign-in from
+    //    Nanoterra names an address but proves no key.
+    let linkedTo;
+    if (via === "passkey") {
+        linkedTo = session.linkedTo;
+        if (typeof linkedTo !== "string")
+            return refuse(403, "Sign in with your Nano wallet to open this page.", { reason: "nanoterra" });
+    }
+    else if (via !== "wallet")
         return refuse(403, "Sign in with your Nano wallet to open this page.", { reason: "nanoterra" });
-    // 4. It is the owner's address (the same text, no other form).
-    if (address !== owner)
+    // 4. It is the owner's address (the same text, no other form): a wallet's own address, or the address a passkey's link points to.
+    if ((via === "passkey" ? linkedTo : address) !== owner)
         return refuse(403, "Only the game's own address can open this page.", { reason: "other_address", signedInAs: address });
     // 5. It is not older than the limit (one day at most), and not from the future.
     const age = now - createdAt;

package/dist/admin/panel/card.d.ts

@@ -0,0 +1,5 @@
+/** A card of the game's own in the Settings tab: its element, made once, and what to do each time the owner signs in (read its data again). */
+export type AdminCard = {
+    el: HTMLElement;
+    refresh?: () => void | Promise<void>;
+};

package/dist/admin/panel/card.js

@@ -0,0 +1,3 @@
+// A card of the game's own for the admin panel's Settings tab (`mountAdmin`'s `cards`). Its own file, so a card made elsewhere (the owner's passkeys, in
+// "@nano133/nanoterra/admin-signin/panel") names the type without reaching the whole panel.
+export {};

package/dist/admin/panel/icons.d.ts

@@ -149,6 +149,15 @@ declare const SHAPES: {
         d: string;
         "stroke-width": number;
     }])[];
+    key: ([string, {
+        d: string;
+    }] | [string, {
+        cx: number;
+        cy: number;
+        r: number;
+        fill: string;
+        stroke: string;
+    }])[];
 };
 export type IconName = keyof typeof SHAPES;
 /** An icon of `size` CSS pixels (default 20). */

package/dist/admin/panel/icons.js

@@ -31,6 +31,7 @@ const SHAPES = {
     gear: [["path", { d: "M19.23 9.65 21.77 9.86V14.14L19.23 14.35 18.77 15.45 20.42 17.39 17.39 20.42 15.45 18.77 14.35 19.23 14.14 21.77H9.86L9.65 19.23 8.55 18.77 6.61 20.42 3.58 17.39 5.23 15.45 4.77 14.35 2.23 14.14V9.86L4.77 9.65 5.23 8.55 3.58 6.61 6.61 3.58 8.55 5.23 9.65 4.77 9.86 2.23H14.14L14.35 4.77 15.45 5.23 17.39 3.58 20.42 6.61 18.77 8.55Z" }], ["circle", { cx: 12, cy: 12, r: 3.2 }]],
     sparkle: [["path", { d: "M12 3v4M12 17v4M3 12h4M17 12h4M6 6l2.5 2.5M15.5 15.5 18 18M6 18l2.5-2.5M15.5 8.5 18 6" }]],
     smile: [["circle", { cx: 12, cy: 12, r: 9 }], ["path", { d: "M8.2 14.2a4.6 4.6 0 0 0 7.6 0" }], ["path", { d: "M9 9.6h.01M15 9.6h.01", "stroke-width": 2.6 }]],
+    key: [["path", { d: "M14.5 9.5a4.5 4.5 0 1 1-1.3-3.2" }], ["path", { d: "M13.2 6.3 21 6.3M18 6.3v3M21 6.3v2.2" }], ["circle", { cx: 10, cy: 9.5, r: 1.4, fill: "currentColor", stroke: "none" }]],
 };
 /** An icon of `size` CSS pixels (default 20). */
 export function icon(name, size = 20) {

package/dist/admin/panel/index.d.ts

@@ -1,5 +1,5 @@
 export { mountAdmin } from "./mount.js";
-export type { MountedAdmin, MountOptions } from "./mount.js";
+export type { AdminCard, MountedAdmin, MountOptions } from "./mount.js";
 export { ApiError, createApi } from "./api.js";
 export type { Api } from "./api.js";
 export { gameCard } from "./gameCard.js";

package/dist/admin/panel/mount.d.ts

@@ -1,4 +1,5 @@
 import type { Look } from "../../looks/look.js";
+import type { AdminCard } from "./card.js";
 import { type ThemeControl } from "./theme.js";
 export type MountOptions = {
     /** The game's looks now (its looks.json). The Shelf starts from them. */
@@ -22,9 +23,15 @@ export type MountOptions = {
     /** The game offers its players a passkey (`@nano133/nanoterra/player-signin`): on a preview address (`*.workers.dev`) the banner says that passkeys turn
      *  on with the game's own domain. */
     playerPasskeys?: boolean;
+    /**
+     * Cards of the game's own for the Settings tab, after the Sign-ins card: for example the owner's passkeys (`ownerPasskeys()` of
+     * "@nano133/nanoterra/admin-signin/panel"). Each card is made once and kept for the life of the page; its `refresh()` runs each time the owner signs in.
+     */
+    cards?: readonly AdminCard[];
     /** The `fetch` to use (default: the page's). */
     fetch?: typeof fetch;
 };
+export type { AdminCard };
 export type MountedAdmin = {
     /** Reads everything again and redraws. */
     reload(): Promise<void>;

package/dist/admin/panel/mount.js

@@ -139,6 +139,9 @@ export function mountAdmin(root, options) {
         const kpis = h("div", { class: "kpis", role: "group", "aria-label": "Your game in numbers" });
         const settings = h("div", { class: "settings-grid" });
         tabs.panels.settings.append(settings);
+        // The game's own cards read their data again at each sign-in (a new dashboard is built after every sign-in).
+        for (const c of options.cards ?? [])
+            void Promise.resolve(c.refresh?.()).catch(() => undefined);
         data.replaceChildren(top, banner, kpis, tabs.bar, ...Object.values(tabs.panels));
         const kpi = (cls, mark, label, value, sub, open, alert = false) => h("button", { class: `kpi kpi-${cls}${alert ? " is-alert" : ""}`, type: "button", onclick: open }, h("span", { class: "kpi-top" }, h("span", { class: "kpi-icon", "aria-hidden": "true" }, icon(mark, 18)), h("span", { class: "kpi-label" }, label)), h("strong", { class: "kpi-value" }, value), h("span", { class: "kpi-sub" }, sub));
         function about(s) {
@@ -176,7 +179,7 @@ export function mountAdmin(root, options) {
                 orders.update(s);
                 players.update(s);
                 // The Game card is the same element at every redraw: moving it keeps its state.
-                settings.replaceChildren(...[game, signinsCard(s, api, () => void load(), options.loginsNote), about(s)].filter((p) => p !== null));
+                settings.replaceChildren(...[game, signinsCard(s, api, () => void load(), options.loginsNote), ...(options.cards ?? []).map((c) => c.el), about(s)].filter((p) => p !== null));
             },
         };
     }

package/dist/admin-signin/adapters/d1.d.ts

@@ -6,5 +6,7 @@ export type D1AdminSigninTables = {
     requests?: string;
     sessions?: string;
     logins?: string;
+    passkeys?: string;
+    once?: string;
 };
-export declare function createD1AdminSignin(db: D1Like, tables?: D1AdminSigninTables): AdminSigninStore;
+export declare function createD1AdminSignin(db: D1Like, tables?: D1AdminSigninTables): Required<AdminSigninStore>;

package/dist/admin-signin/adapters/d1.js

@@ -1,6 +1,7 @@
 // The admin sign-in's store for a game on Cloudflare D1, on the game starter's OWN tables and columns: `signin_requests` and `sessions` (their admin
 // rows, scope = 'admin') and `admin_logins`. A starter moves onto it with no migration, and every creator who is signed in to /admin stays signed in.
-// A new game adds ./d1.sql to its migrations ("@nano133/nanoterra/admin-signin/d1.sql": the same tables, `IF NOT EXISTS`).
+// A new game adds ./d1.sql to its migrations ("@nano133/nanoterra/admin-signin/d1.sql": the same tables, `IF NOT EXISTS`). The owner's passkeys (since
+// 0.12.0) use two more tables, `admin_passkeys` and `admin_once` (the end of d1.sql): only a game that turns the passkeys on needs them.
 //
 //   import { createD1AdminSignin } from "@nano133/nanoterra/admin-signin/d1";
 //   const store = createD1AdminSignin(env.DB);
@@ -9,7 +10,7 @@
 // keeps its rows, and this adapter never reads, delivers, ends or deletes one. D1 has no transaction that reads and then writes, so each change is ONE
 // statement that holds its own check, and a delivery and its session are one batch (the session is written only when the delivery changed a row).
 // "Sign out everywhere" is the same two statements as the admin store's (`createD1Store(db, { logins: true })`): either one may run it.
-import { ADMIN_LOGIN_KEEP_MS, ADMIN_WAYS } from "../types.js";
+import { ADMIN_LOGIN_KEEP_MS, ADMIN_PASSKEY_LIMIT, ADMIN_WAYS } from "../types.js";
 const toRequest = (r) => ({
     id: r.rid ?? r.id,
     starter: r.starter,
@@ -22,8 +23,16 @@ const toRequest = (r) => ({
 });
 const NAME = /^[A-Za-z_][A-Za-z0-9_]{0,62}$/;
 const changes = (res) => Number(res?.meta?.changes ?? 0);
+/** True for D1's (and SQLite's) "no such table": a game that has not added the passkeys' tables. */
+const noTable = (e) => /no such table/i.test(String(e?.message ?? e));
 export function createD1AdminSignin(db, tables = {}) {
-    const T = { requests: tables.requests ?? "signin_requests", sessions: tables.sessions ?? "sessions", logins: tables.logins ?? "admin_logins" };
+    const T = {
+        requests: tables.requests ?? "signin_requests",
+        sessions: tables.sessions ?? "sessions",
+        logins: tables.logins ?? "admin_logins",
+        passkeys: tables.passkeys ?? "admin_passkeys",
+        once: tables.once ?? "admin_once",
+    };
     for (const n of Object.values(T))
         if (!NAME.test(n))
             throw new Error(`not a table name: ${n}`);
@@ -101,6 +110,52 @@ export function createD1AdminSignin(db, tables = {}) {
                 db.prepare(`DELETE FROM ${T.sessions} WHERE expires_at < ? AND scope = 'admin'`).bind(now),
                 db.prepare(`DELETE FROM ${T.logins} WHERE at < ?`).bind(now - ADMIN_LOGIN_KEEP_MS),
             ]);
+            // The used passkey signatures, on their own: a game without the passkeys' tables (they came in 0.12.0) still cleans the rest.
+            try {
+                await db.prepare(`DELETE FROM ${T.once} WHERE until <= ?`).bind(now).run();
+            }
+            catch (e) {
+                if (!noTable(e))
+                    throw e;
+            }
+        },
+        async createSession(s) {
+            await db.prepare(`INSERT INTO ${T.sessions} (id_hash, address, created_at, expires_at, via, scope) VALUES (?, ?, ?, ?, ?, 'admin')`).bind(s.idHash, s.address, s.createdAt, s.expiresAt, s.via).run();
+        },
+        async linkPasskey(owner, address, at) {
+            // ONE statement holds the limit: the row is written only while the owner has fewer than the limit, and never twice.
+            const res = await db
+                .prepare(`INSERT INTO ${T.passkeys} (owner, address, created_at) SELECT ?, ?, ? WHERE (SELECT COUNT(*) FROM ${T.passkeys} WHERE owner = ?) < ? ON CONFLICT (owner, address) DO NOTHING`)
+                .bind(owner, address, at, owner, ADMIN_PASSKEY_LIMIT)
+                .run();
+            if (changes(res) === 1)
+                return "linked";
+            const had = await db.prepare(`SELECT 1 AS one FROM ${T.passkeys} WHERE owner = ? AND address = ?`).bind(owner, address).first();
+            return had ? "exists" : "full";
+        },
+        async unlinkPasskey(owner, address) {
+            // The link, and the passkey's admin sessions with it.
+            const done = await db.batch([
+                db.prepare(`DELETE FROM ${T.passkeys} WHERE owner = ? AND address = ?`).bind(owner, address),
+                db.prepare(`DELETE FROM ${T.sessions} WHERE scope = 'admin' AND via = 'passkey' AND address = ?`).bind(address),
+            ]);
+            return changes(done[0]) > 0;
+        },
+        async passkeys(owner) {
+            const rows = (await db.prepare(`SELECT address, created_at FROM ${T.passkeys} WHERE owner = ? ORDER BY created_at, address`).bind(owner).all()).results;
+            return rows.map((r) => ({ address: String(r.address), createdAt: Number(r.created_at) }));
+        },
+        async linked(owner, address) {
+            return (await db.prepare(`SELECT 1 AS one FROM ${T.passkeys} WHERE owner = ? AND address = ?`).bind(owner, address).first()) !== null;
+        },
+        async useOnce(key, ttlMs) {
+            const now = Date.now();
+            // A row past its time may be taken again (its signature's window is long over); a live one may not.
+            const res = await db
+                .prepare(`INSERT INTO ${T.once} (key, until) VALUES (?, ?) ON CONFLICT (key) DO UPDATE SET until = excluded.until WHERE ${T.once}.until <= ?`)
+                .bind(key, now + ttlMs, now)
+                .run();
+            return changes(res) === 1;
         },
     };
 }

package/dist/admin-signin/adapters/firestore.d.ts

@@ -42,8 +42,11 @@ export interface FirestoreAdminSigninLike {
     runTransaction<T>(fn: (tx: AdminSigninTransaction) => Promise<T>): Promise<T>;
     batch(): AdminSigninBatch;
 }
-export declare function createFirestoreAdminSignin(db: FirestoreAdminSigninLike, collections?: {
+export type FirestoreAdminSigninCollections = {
     requests?: string;
     sessions?: string;
     logins?: string;
-}): AdminSigninStore;
+    passkeys?: string;
+    once?: string;
+};
+export declare function createFirestoreAdminSignin(db: FirestoreAdminSigninLike, collections?: FirestoreAdminSigninCollections): Required<AdminSigninStore>;

package/dist/admin-signin/adapters/firestore.js

@@ -9,13 +9,16 @@
 //   signin_requests/{key}   { id, way, starter, status, expiresAt, nonce?, issuedAt?, label?, account?, delivered, scope: "admin", deleteAt }
 //   sessions/{idHash}       { address, createdAt, expiresAt, via, scope: "admin", deleteAt }
 //   admin_logins/{id}       { at, country, browser, deleteAt }
-// Times are ms numbers; `deleteAt` is a Date (a Timestamp in Firestore): set a TTL policy on `deleteAt` for each collection. `{key}` is the request's id;
-// `{idHash}` the SHA-256 of "admin:" and the session's token. Every change that reads first is a transaction. Indexes: Firestore's own single-field
-// indexes are enough (`id`, `scope`, `expiresAt`, `at`).
+//   admin_passkeys/{owner}  { owner, passkeys: [{ address, createdAt }] }      (since 0.12.0: the owner's linked passkeys, at most 10; no deleteAt)
+//   admin_once/{key}        { until, deleteAt }                                (since 0.12.0: the passkeys' used signatures)
+// Times are ms numbers; `deleteAt` is a Date (a Timestamp in Firestore): set a TTL policy on `deleteAt` for each collection that has it. `{key}` is the
+// request's id; `{idHash}` the SHA-256 of "admin:" and the session's token. Every change that reads first is a transaction (the owner's passkeys are ONE
+// document, so a link holds the limit in its transaction). Indexes: Firestore's own single-field indexes are enough (`id`, `scope`, `expiresAt`, `at`,
+// `address`, `until`).
 //
 // The admin store for Firestore (`createFirestoreStore`) has no sign-in list and no "Sign out everywhere": give it this sign-in's,
 // `store.recentLogins = signin.recentLogins` and `store.signOutEverywhere = signin.signOutEverywhere`.
-import { ADMIN_LOGIN_KEEP_MS, ADMIN_WAYS } from "../types.js";
+import { ADMIN_LOGIN_KEEP_MS, ADMIN_PASSKEY_LIMIT, ADMIN_WAYS } from "../types.js";
 const DAY = 86_400_000;
 /** At most this many documents go in one batch (Firestore's limit is 500). */
 const BATCH = 400;
@@ -40,10 +43,21 @@ function requestOf(d, key, way) {
         ...(account !== undefined ? { account } : {}),
     };
 }
+/** The links a passkeys document holds: only well-formed ones. */
+function linksOf(d) {
+    const list = Array.isArray(d?.passkeys) ? d.passkeys : [];
+    return list.flatMap((p) => {
+        const v = p;
+        const address = text(v?.address);
+        return address !== undefined ? [{ address, createdAt: num(v?.createdAt) ?? 0 }] : [];
+    });
+}
 export function createFirestoreAdminSignin(db, collections = {}) {
     const requestsCol = () => db.collection(collections.requests ?? "signin_requests");
     const sessionsCol = () => db.collection(collections.sessions ?? "sessions");
     const loginsCol = () => db.collection(collections.logins ?? "admin_logins");
+    const passkeysCol = () => db.collection(collections.passkeys ?? "admin_passkeys");
+    const onceCol = () => db.collection(collections.once ?? "admin_once");
     const sessionData = (s) => ({ address: s.address, createdAt: s.createdAt, expiresAt: s.expiresAt, via: s.via, scope: "admin", deleteAt: new Date(s.expiresAt) });
     const stores = new Map();
     for (const way of ADMIN_WAYS) {
@@ -173,7 +187,62 @@ export function createFirestoreAdminSignin(db, collections = {}) {
             const old = (await requestsCol().where("expiresAt", "<", now - 2 * 3_600_000).limit(BATCH).get()).docs.filter((d) => d.data().scope === "admin");
             const ended = (await sessionsCol().where("expiresAt", "<", now).limit(BATCH).get()).docs.filter((d) => d.data().scope === "admin");
             const logins = (await loginsCol().where("at", "<", now - ADMIN_LOGIN_KEEP_MS).limit(BATCH).get()).docs;
-            await deleteAll([...old, ...ended, ...logins]);
+            const used = (await onceCol().where("until", "<", now + 1).limit(BATCH).get()).docs;
+            await deleteAll([...old, ...ended, ...logins, ...used]);
+        },
+        async createSession(session) {
+            const ref = sessionsCol().doc(session.idHash);
+            await db.runTransaction(async (tx) => {
+                if ((await tx.get(ref)).exists)
+                    throw new Error("a session with this id exists");
+                tx.set(ref, sessionData(session));
+            });
+        },
+        async linkPasskey(owner, address, at) {
+            const ref = passkeysCol().doc(owner);
+            return db.runTransaction(async (tx) => {
+                const d = (await tx.get(ref)).data();
+                const list = d && d.owner === owner ? linksOf(d) : [];
+                if (list.some((p) => p.address === address))
+                    return "exists";
+                if (list.length >= ADMIN_PASSKEY_LIMIT)
+                    return "full";
+                tx.set(ref, { owner, passkeys: [...list, { address, createdAt: at }] });
+                return "linked";
+            });
+        },
+        async unlinkPasskey(owner, address) {
+            const ref = passkeysCol().doc(owner);
+            const had = await db.runTransaction(async (tx) => {
+                const d = (await tx.get(ref)).data();
+                const list = d && d.owner === owner ? linksOf(d) : [];
+                if (!list.some((p) => p.address === address))
+                    return false;
+                tx.set(ref, { owner, passkeys: list.filter((p) => p.address !== address) });
+                return true;
+            });
+            // The passkey's admin sessions end with its link (after it: a session read in between finds no link and is refused anyway).
+            await deleteAll((await sessionsCol().where("address", "==", address).get()).docs.filter((x) => x.data().scope === "admin" && x.data().via === "passkey"));
+            return had;
+        },
+        async passkeys(owner) {
+            const d = (await passkeysCol().doc(owner).get()).data();
+            return d && d.owner === owner ? linksOf(d) : [];
+        },
+        async linked(owner, address) {
+            const d = (await passkeysCol().doc(owner).get()).data();
+            return Boolean(d && d.owner === owner && linksOf(d).some((p) => p.address === address));
+        },
+        async useOnce(key, ttlMs) {
+            const ref = onceCol().doc(key);
+            return db.runTransaction(async (tx) => {
+                const now = Date.now();
+                const d = (await tx.get(ref)).data();
+                if (d && (num(d.until) ?? Infinity) > now)
+                    return false;
+                tx.set(ref, { until: now + ttlMs, deleteAt: new Date(now + ttlMs) });
+                return true;
+            });
         },
     };
 }

package/dist/admin-signin/conformance.d.ts

@@ -8,4 +8,11 @@ export type AdminSigninConformanceCase = {
     name: string;
     run: () => Promise<void>;
 };
-export declare function adminSigninStoreConformance(make: () => Promise<AdminSigninHarness>): AdminSigninConformanceCase[];
+export type AdminSigninConformanceOptions = {
+    /**
+     * The owner's passkeys (the store's optional passkey methods). true: the cases run and the store must have them. false: no passkey case. Not set: the
+     * cases are listed, and a store with no `linkPasskey` passes them with nothing to check (a store written for 0.11.0).
+     */
+    passkeys?: boolean;
+};
+export declare function adminSigninStoreConformance(make: () => Promise<AdminSigninHarness>, options?: AdminSigninConformanceOptions): AdminSigninConformanceCase[];