@nano133/nanoterra 0.11.0 → 0.12.0

package/dist/admin-signin/panel/passkeys.js

@@ -0,0 +1,202 @@
+// The owner's passkeys in the browser (since 0.12.0): the "Passkey" way of the admin's sign-in, and the "Owner passkeys" card for /admin (`ownerPasskeys()`,
+// a card for `mountAdmin`'s `cards`). A passkey is only a key to /admin: the money stays in the owner's wallet.
+//
+//   - Sign in: the passkey purse (the game's FROZEN scheme, the player sheet's) signs "ADMIN of <host>: sign in as <address> at <ms>"; the server lets it in
+//     only while the passkey is linked to the game's address.
+//   - Add: only with a WALLET admin session. A new passkey is made (or one the owner has is used), and it signs "Link this passkey to the ADMIN of <host>:
+//     ...": the server writes the link only with both proofs, the wallet session and this signature.
+//   - Remove: only with a wallet admin session; the passkey's admin sessions end too.
+//
+// The passkey code (@nano133/signin/passkey) and the purse's signing code (@nano133/signin/purse) are loaded only when a passkey is used: a game without
+// passkeys never loads them. The seed lives in local variables of one press only: never in storage, a log, an error text or an address.
+import { ApiError, createApi } from "../../admin/panel/api.js";
+import { h, shortAddress } from "../../admin/panel/dom.js";
+import { icon } from "../../admin/panel/icons.js";
+import { checkScheme } from "../../player-signin/scheme-check.js";
+import { ADMIN_SIGNIN_BASE, adminLinkDomain, adminPasskeyDomain } from "../types.js";
+/** What the owner reads when a passkey prompt fails, by the fault's code (@nano133/signin/passkey's PasskeyFault). */
+export function passkeyFaultText(e) {
+    const code = e?.code;
+    const name = e?.name;
+    const c = typeof code === "string" ? code : name === "NotAllowedError" || name === "AbortError" ? "cancelled" : name === "SecurityError" ? "wrong-host" : name === "NotSupportedError" ? "unsupported" : name === "InvalidStateError" ? "exists" : "failed";
+    if (c === "cancelled")
+        return "The passkey was closed. Try again.";
+    if (c === "no-prf" || c === "other-form" || c === "unsupported")
+        return "This browser or device cannot use a passkey here. Use your wallet.";
+    if (c === "not-a-purse")
+        return "That passkey is not one of this game's. Choose another one.";
+    if (c === "wrong-host")
+        return "A passkey works only on the game's own address.";
+    if (c === "exists")
+        return "This device has a passkey for this game already. Press Use a passkey I have.";
+    return "The passkey did not work. Try again.";
+}
+const dayText = (ms) => new Date(ms).toLocaleDateString("en-GB", { day: "numeric", month: "short", year: "numeric" });
+function setupOf(o) {
+    return { rpId: o.rpId ?? location.hostname, rpName: o.name, scheme: o.scheme, userName: `${o.name} admin · ${dayText(Date.now())}`, exclude: [] };
+}
+const apiOf = (o) => createApi(o.base ?? ADMIN_SIGNIN_BASE, o.fetch ?? ((...a) => fetch(...a)));
+/**
+ * Signs in to /admin with a linked passkey: the device asks for the passkey, the purse signs the ADMIN text, the server checks the link. Resolves with the
+ * passkey's address; throws an ApiError (the server's words) or a passkey fault (`passkeyFaultText`).
+ */
+export async function passkeyAdminSignIn(o) {
+    checkScheme(o.scheme);
+    const { openPasskey } = await import("@nano133/signin/passkey");
+    const p = await openPasskey(setupOf(o), o.signal);
+    const { signinBody } = await import("@nano133/signin/purse");
+    return apiOf(o).post("/passkey", { ...signinBody(adminPasskeyDomain(location.host), p.seed), ...(o.turnstile ? { turnstile: o.turnstile } : {}) });
+}
+/**
+ * The "Owner passkeys" card for /admin: the passkeys linked to the game's address, "Add a passkey" and Remove (both only with a wallet sign-in). Give it to
+ * `mountAdmin`'s `cards`; it reads the list each time the owner signs in.
+ *
+ *   mountAdmin(el, { looks, signIn: adminSignIn({ passkeys: true, scheme, name }), signOut: adminSignOut(), cards: [ownerPasskeys({ scheme, name })] });
+ */
+export function ownerPasskeys(options) {
+    checkScheme(options.scheme);
+    const api = apiOf(options);
+    let list = null;
+    let prompt = null;
+    const status = h("p", { class: "fine passkey-status", role: "status", "aria-live": "polite" });
+    const items = h("ul", { class: "signin-list passkey-list" });
+    const note = h("p", { class: "fine" });
+    const add = h("div", { class: "passkey-add" });
+    const el = h("section", { class: "admin-card owner-passkeys", "aria-labelledby": "n133-passkeys-title" }, h("h2", { id: "n133-passkeys-title" }, "Owner passkeys"), h("p", { class: "fine" }, "A passkey opens this admin page with Face ID, Touch ID or your device PIN, without your wallet. It cannot move money: your money stays in your wallet."), items, note, add, status);
+    el.hidden = true;
+    const say = (text) => (status.textContent = text);
+    const key = (text, onclick, kind = "plain") => h("button", { class: `btn${kind === "primary" ? " btn-primary" : ""}`, type: "button", onclick }, text);
+    const busy = (on) => {
+        for (const b of Array.from(el.querySelectorAll("button")))
+            b.disabled = on;
+        el.toggleAttribute("aria-busy", on);
+    };
+    const words = (e, fallback) => (e instanceof ApiError ? e.message : e && typeof e === "object" && ("code" in e || "name" in e) ? passkeyFaultText(e) : fallback);
+    function draw() {
+        if (!list)
+            return;
+        const l = list;
+        items.replaceChildren(...l.passkeys.map((p) => {
+            const row = h("li", { class: "passkey-row" });
+            const what = h("span", { class: "passkey-what" }, icon("key", 18), h("strong", {}, h("code", { title: p.address }, shortAddress(p.address))), h("span", {}, ` · added ${dayText(p.createdAt)}`), p.address === l.you && l.via === "passkey" ? h("span", { class: "chip" }, "This passkey") : null);
+            row.append(what);
+            if (l.canChange)
+                row.append(key("Remove", () => confirmRemove(row, p.address)));
+            return row;
+        }));
+        if (!l.passkeys.length)
+            items.append(h("li", { class: "fine" }, "No passkey is linked yet."));
+        note.textContent = l.canChange ? `You can link up to ${l.limit} passkeys. Each one proves its key when you add it.` : "You signed in with a passkey. Sign in with your wallet to add or remove a passkey.";
+        showAdd();
+    }
+    function showAdd() {
+        if (!list?.canChange)
+            return add.replaceChildren();
+        const full = list.passkeys.length >= list.limit;
+        const b = key("Add a passkey", () => chooseAdd(), "primary");
+        b.disabled = full;
+        add.replaceChildren(b, full ? h("p", { class: "fine" }, `You have ${list.limit} passkeys. Remove one to add another.`) : "");
+    }
+    function chooseAdd() {
+        say("");
+        add.replaceChildren(h("p", {}, "Make a new passkey on this device, or use a passkey you have for this game."), h("div", { class: "passkey-keys" }, key("Make a new passkey", () => void makeNew(), "primary"), key("Use a passkey I have", () => void useMine()), key("Cancel", () => showAdd())));
+        add.querySelector("button")?.focus({ preventScroll: true });
+    }
+    /** Links the passkey of `seed`: it signs the LINK text, and the server writes the link with this wallet session. */
+    async function linkSeed(seed) {
+        const { signinBody } = await import("@nano133/signin/purse");
+        list = await api.post("/passkey/link", signinBody(adminLinkDomain(location.host), seed));
+        draw();
+        say("Passkey added. It opens this admin page from now on.");
+    }
+    async function makeNew() {
+        busy(true);
+        say("Making a passkey… Follow your device.");
+        prompt = new AbortController();
+        try {
+            const pk = await import("@nano133/signin/passkey");
+            const made = await pk.makePasskey(setupOf(options), prompt.signal);
+            await firstOpen(made, false);
+        }
+        catch (e) {
+            busy(false);
+            showAdd();
+            say(words(e, "The passkey was not added. Try again."));
+        }
+    }
+    /** The first use of a new passkey gives its seed. Where the browser allows one prompt per press, one more key finishes it. */
+    async function firstOpen(made, pick) {
+        busy(true);
+        say("Opening the new passkey…");
+        prompt = new AbortController();
+        const pk = await import("@nano133/signin/passkey");
+        try {
+            const p = await pk.firstUse(setupOf(options), made, prompt.signal, pick);
+            await linkSeed(p.seed);
+            busy(false);
+        }
+        catch (e) {
+            busy(false);
+            const code = e?.code;
+            if (code !== "cancelled" && code !== "failed")
+                throw e;
+            add.replaceChildren(h("p", {}, "Your passkey is made. Open it once to add it."), h("div", { class: "passkey-keys" }, key("Open the new passkey", () => void firstOpen(made, true).catch(fault), "primary"), key("Cancel", () => showAdd())));
+            say("");
+        }
+    }
+    function fault(e) {
+        busy(false);
+        showAdd();
+        say(words(e, "The passkey was not added. Try again."));
+    }
+    async function useMine() {
+        busy(true);
+        say("Waiting for your passkey…");
+        prompt = new AbortController();
+        try {
+            const pk = await import("@nano133/signin/passkey");
+            const p = await pk.openPasskey(setupOf(options), prompt.signal);
+            await linkSeed(p.seed);
+            busy(false);
+        }
+        catch (e) {
+            fault(e);
+        }
+    }
+    function confirmRemove(row, address) {
+        const keys = h("div", { class: "passkey-confirm" }, h("p", {}, "Remove this passkey? It cannot open this page any more, and its sign-ins end now."), key("Yes, remove", () => void remove(address), "primary"), key("Cancel", () => draw()));
+        row.replaceChildren(row.firstChild, keys);
+        keys.querySelector("button")?.focus({ preventScroll: true });
+    }
+    async function remove(address) {
+        busy(true);
+        say("Removing…");
+        try {
+            list = await api.post("/passkey/unlink", { address });
+            busy(false);
+            draw();
+            say("Passkey removed.");
+        }
+        catch (e) {
+            busy(false);
+            draw();
+            say(words(e, "The game's server did not answer. Nothing was changed."));
+        }
+    }
+    async function refresh() {
+        prompt?.abort();
+        prompt = null;
+        try {
+            list = await api.post("/passkeys");
+            el.hidden = false;
+            say("");
+            draw();
+        }
+        catch {
+            // No passkeys on this game (the route is off), or no session that may read them: the card does not show.
+            list = null;
+            el.hidden = true;
+        }
+    }
+    return { el, refresh };
+}

package/dist/admin-signin/panel/view.d.ts

@@ -1,3 +1,4 @@
+import type { PasskeyScheme } from "@nano133/signin/passkey";
 export type AdminSigninViewOptions = {
     /** Where the sign-in's routes are. Default "/api/admin-signin" (ADMIN_SIGNIN_BASE). */
     base?: string;
@@ -6,6 +7,17 @@ export type AdminSigninViewOptions = {
      * admin sign-in from a game sign-in in it: it is off unless the game turns it on on the server and here.
      */
     nanchat?: boolean;
+    /**
+     * Offer the owner's linked passkeys (the server's `passkeys: true`): a "Passkey" tile after the wallets. Default false. Needs `scheme` and `name`. Only a
+     * passkey that the owner linked in Settings while signed in with the wallet opens /admin.
+     */
+    passkeys?: boolean;
+    /** The game's FROZEN passkey scheme: the same one the player sheet takes. Needed with `passkeys`. */
+    scheme?: PasskeyScheme;
+    /** The game's name (the device shows it with the passkey). Needed with `passkeys`. */
+    name?: string;
+    /** The passkeys' relying party id: the game's domain. Default: the page's host name. */
+    rpId?: string;
     /** The person check (Turnstile): fills `box` and gives its token, before a start. No hook: no check. */
     personCheck?: (box: HTMLElement) => Promise<string | null | undefined>;
     /** Draws a QR code of `text` (a wallet's link), for a screen with a mouse. Default: the package's own QR code; a link too long for it is shown as a link. */

package/dist/admin-signin/panel/view.js

@@ -5,11 +5,16 @@
 //
 // Plain DOM, no framework, no package. The tiles show letters, not logos: no wallet's licence clearly allows its logo. Phone first: text 16 px, every
 // key and tile 48 px or more each way. It uses the player sheet's stylesheet ("@nano133/nanoterra/admin-signin/style.css" is the same file).
+//
+// With `passkeys: true` (and the game's frozen `scheme` and `name`), a "Passkey" tile comes after the wallets: a passkey that the owner linked in Settings
+// ("Owner passkeys", ./passkeys.ts) opens /admin. A passkey that is not linked is refused by the server.
 import { ApiError, createApi } from "../../admin/panel/api.js";
 import { h, shortAddress } from "../../admin/panel/dom.js";
 import { icon } from "../../admin/panel/icons.js";
+import { checkScheme } from "../../player-signin/scheme-check.js";
 import { qrSvg } from "../../shop/panel/qr.js";
 import { ADMIN_SIGNIN_BASE } from "../types.js";
+import { passkeyAdminSignIn, passkeyFaultText } from "./passkeys.js";
 /** The wallets, in every list's order: Berry Wallet first. */
 const WALLETS = [
     { way: "berry", name: "Berry Wallet", mark: "B" },
@@ -25,6 +30,13 @@ export function adminSigninView(options = {}) {
     const base = options.base ?? ADMIN_SIGNIN_BASE;
     const api = createApi(base, options.fetch ?? ((...a) => fetch(...a)));
     const wallets = WALLETS.filter((w) => w.way !== "nanchat" || options.nanchat === true);
+    const passkeysOn = options.passkeys === true;
+    if (passkeysOn) {
+        checkScheme(options.scheme);
+        if (typeof options.name !== "string" || !options.name.trim())
+            throw new Error("passkeys: true needs the game's name");
+    }
+    let prompt = null;
     const touch = () => options.touch ?? (typeof matchMedia === "function" && matchMedia("(pointer: coarse)").matches);
     let stopped = false;
     let timer;
@@ -41,11 +53,46 @@ export function adminSigninView(options = {}) {
         if (timer)
             clearTimeout(timer);
         timer = undefined;
+        prompt?.abort();
+        prompt = null;
     }
     function showTiles() {
         stopWaiting();
         const tiles = wallets.map((w) => h("button", { class: "n133s-tile", type: "button", "data-way": w.way, onclick: () => void choose(w.way) }, h("span", { class: "n133s-mark", "aria-hidden": "true" }, w.mark), h("span", { class: "n133s-name" }, w.name)));
-        area.replaceChildren(h("p", { class: "n133s-or" }, "Choose your wallet"), h("div", { class: "n133s-tiles", "data-count": String(tiles.length) }, ...tiles));
+        // The owner's linked passkey comes after the wallets: a wallet makes the first admin login, and only it links a passkey.
+        if (passkeysOn)
+            tiles.push(h("button", { class: "n133s-tile", type: "button", "data-way": "passkey", onclick: () => showPasskey() }, h("span", { class: "n133s-mark", "aria-hidden": "true" }, icon("key", 24)), h("span", { class: "n133s-name" }, "Passkey")));
+        area.replaceChildren(h("p", { class: "n133s-or" }, passkeysOn ? "Choose your wallet or your passkey" : "Choose your wallet"), h("div", { class: "n133s-tiles", "data-count": String(tiles.length) }, ...tiles));
+    }
+    // ---- the owner's linked passkey ----
+    function showPasskey(words = "") {
+        stopWaiting();
+        current = null;
+        const back = h("button", { class: "n133s-back", type: "button", onclick: () => showTiles() }, icon("back", 18), h("span", {}, "Back"));
+        area.replaceChildren(back, h("h3", { class: "n133s-step", tabindex: "-1" }, "Passkey"), h("p", { class: "n133s-text" }, "Use a passkey that you linked to the game's address in Settings. Your device asks for Face ID, Touch ID or its PIN."), h("div", { class: "n133s-keys" }, key("Use my passkey", () => void usePasskey(), "primary")), h("p", { class: "n133s-fine" }, "No passkey yet? Sign in with your wallet, then add one in Settings, Owner passkeys."));
+        say(words);
+        focusFirst();
+    }
+    async function usePasskey() {
+        stopWaiting();
+        for (const b of Array.from(area.querySelectorAll("button")))
+            b.disabled = true;
+        say("Waiting for your passkey…");
+        prompt = new AbortController();
+        try {
+            const turnstile = options.personCheck ? await options.personCheck(check) : undefined;
+            const r = await passkeyAdminSignIn({ scheme: options.scheme, name: options.name, rpId: options.rpId, base, fetch: options.fetch, turnstile, signal: prompt.signal });
+            if (stopped)
+                return;
+            area.replaceChildren(h("p", { class: "n133s-done" }, icon("check", 22), h("span", {}, `Signed in with your passkey ${shortAddress(r.address)}`)));
+            say("");
+            options.onSignedIn?.(r.address);
+        }
+        catch (e) {
+            if (stopped)
+                return;
+            showPasskey(e instanceof ApiError ? e.message : passkeyFaultText(e));
+        }
     }
     async function choose(way) {
         if (current?.way === way && Date.now() < current.expiresAt)

package/dist/admin-signin/types.d.ts

@@ -51,15 +51,38 @@ export declare const ADMIN_SIGNIN_LIMITS: {
         readonly limit: 5;
         readonly windowMs: number;
     };
+    /** The owner's passkeys: the list, a link and a removal, per IP address (memory). A passkey's sign-in counts with the starts (`signin`, hook). */
+    readonly passkeys: {
+        readonly limit: 30;
+        readonly windowMs: 60000;
+    };
     /** The biggest body the routes read. */
     readonly bodyMax: 8192;
 };
+/** The most passkeys one owner may link. */
+export declare const ADMIN_PASSKEY_LIMIT = 10;
+/** How long a passkey's signature is kept as used (its 5-minute window, both ways, and some more). */
+export declare const ADMIN_ONCE_MS: number;
+/**
+ * What a passkey signs to OPEN /admin: `signinMessage(adminPasskeyDomain(host), address, at)`, "ADMIN of <host>: sign in as nano_... at <ms>". Never the
+ * host alone: a player's passkey signature names only the host, and it must never open /admin.
+ */
+export declare const adminPasskeyDomain: (host: string) => string;
+/** What a passkey signs to be LINKED to the owner: "Link this passkey to the ADMIN of <host>: sign in as nano_... at <ms>". It opens nothing. */
+export declare const adminLinkDomain: (host: string) => string;
+/** One passkey linked to the owner: the passkey purse's address and when it was linked (ms). */
+export type AdminPasskey = {
+    address: string;
+    createdAt: number;
+};
+/** What a link gives: "linked", "exists" (it was linked already: nothing changed) or "full" (the owner has ADMIN_PASSKEY_LIMIT already). */
+export type AdminLinkResult = "linked" | "exists" | "full";
 /** A token, a starter value: 32 random bytes as 64 hex characters. */
 export declare const TOKEN_PATTERN: RegExp;
 /**
  * An admin session as a store keeps it. `idHash` is the SHA-256 (hex) of "admin:" and the cookie's token (`adminKey`): never the token, and never the
- * plain hash a player's session has, so the SERVER keeps the two scopes apart and not only the cookies' names. `via` is "wallet" for every session this
- * sign-in makes; a store returns the word it holds.
+ * plain hash a player's session has, so the SERVER keeps the two scopes apart and not only the cookies' names. `via` is "wallet" for a wallet's session
+ * and "passkey" for a linked passkey's (its `address` is the PASSKEY's, never the owner's); a store returns the word it holds.
  */
 export type AdminSessionRecord = {
     idHash: string;
@@ -68,16 +91,28 @@ export type AdminSessionRecord = {
     expiresAt: number;
     via: string;
 };
-/** The admin session as the game reads it (`createAdminHandler`'s `session` hook). `via` is "unknown" for a stored word other than "wallet" and "nanoterra": the guard refuses it. */
+/**
+ * The admin session as the game reads it (`createAdminHandler`'s `session` hook). `via` is "unknown" for a stored word other than "wallet", "nanoterra" and
+ * "passkey": the guard refuses it. A "passkey" session carries `linkedTo`, the owner's address, only while its link to the CURRENT owner exists (read on this
+ * request); without the link the sign-in gives no session at all.
+ */
 export type AdminSigninSession = {
     address: string;
     createdAt: number;
     via: "wallet" | "nanoterra" | "unknown";
+} | {
+    address: string;
+    createdAt: number;
+    via: "passkey";
+    linkedTo: string;
 };
 /**
- * The game's database for the admin's sign-in. An adapter reads and writes ONLY its three tables or collections (requests, sessions, the sign-in list),
- * and only the ADMIN's rows of the first two (a game whose players sign in through the same tables keeps its rows apart: the `scope` column).
- * Run `adminSigninStoreConformance` on a store you write yourself.
+ * The game's database for the admin's sign-in. An adapter reads and writes ONLY its tables or collections (requests, sessions, the sign-in list, and for
+ * the owner's passkeys the links and the used signatures), and only the ADMIN's rows of the first two (a game whose players sign in through the same tables
+ * keeps its rows apart: the `scope` column). Run `adminSigninStoreConformance` on a store you write yourself.
+ *
+ * The passkey methods (`createSession` to `useOnce`) are optional: a store without them works for wallets, and `createAdminSignin({ passkeys: true })`
+ * refuses it.
  */
 export interface AdminSigninStore {
     /** The admin requests of one wallet app. */
@@ -100,6 +135,21 @@ export interface AdminSigninStore {
     recordLogin(login: AdminLogin): Promise<void>;
     /** The last sign-ins, newest first, at most `limit`, with only `at`, `country` and `browser`. */
     recentLogins(limit: number): Promise<AdminLogin[]>;
-    /** Deletes what nobody needs any more: admin requests 2 hours after they ended, admin sessions that ended, sign-in rows older than 30 days. */
+    /** Deletes what nobody needs any more: admin requests 2 hours after they ended, admin sessions that ended, sign-in rows older than 30 days, used passkey signatures past their time. */
     clean(now: number): Promise<void>;
+    /** Writes an admin session (a linked passkey's sign-in). Throws when a session with this hash exists. */
+    createSession?(session: AdminSessionRecord): Promise<void>;
+    /**
+     * Links the passkey `address` to `owner`, in ONE step that holds the limit: "linked"; "exists" when it is linked already (nothing changes); "full" when
+     * `owner` has ADMIN_PASSKEY_LIMIT links (nothing is written). Two calls at once never make more than the limit.
+     */
+    linkPasskey?(owner: string, address: string, at: number): Promise<AdminLinkResult>;
+    /** Removes the link and ends every admin session of that passkey ("passkey" sessions of `address`). True when a link was there. */
+    unlinkPasskey?(owner: string, address: string): Promise<boolean>;
+    /** The passkeys linked to `owner`, oldest first. */
+    passkeys?(owner: string): Promise<AdminPasskey[]>;
+    /** True only when `address` is linked to `owner` NOW (the exact texts). */
+    linked?(owner: string, address: string): Promise<boolean>;
+    /** Records `key` (a used passkey signature) and answers true; false when it is there and its time is not over. The admin's own table, not the player's. */
+    useOnce?(key: string, ttlMs: number): Promise<boolean>;
 }

package/dist/admin-signin/types.js

@@ -1,9 +1,13 @@
 // The ADMIN's sign-in of a game: the fixed route, the times, the limits and the store contract. (The player's sign-in is another thing:
 // "@nano133/nanoterra/player-signin".) No package and no DOM: the stores, the adapters and the browser panel read this file.
 //
-// The admin signs in with a wallet app only: Berry Wallet or Nautilus (and NanChat only when the game turns it on: its text cannot name the ADMIN). No
-// passkey. What Berry Wallet and Nautilus sign names the ADMIN, so a link that a stranger sends to the owner does not look like any sign-in. Only the game's own address makes an admin login, and only from a request that was started
-// on the admin's route; the guard (`adminAccess`) decides again on every call of /admin.
+// The admin signs in with a wallet app: Berry Wallet or Nautilus (and NanChat only when the game turns it on: its text cannot name the ADMIN). What Berry
+// Wallet and Nautilus sign names the ADMIN, so a link that a stranger sends to the owner does not look like any sign-in. Only the game's own address makes a
+// wallet admin login, and only from a request that was started on the admin's route; the guard (`adminAccess`) decides again on every call of /admin.
+//
+// Since 0.12.0, with `passkeys: true`, the owner may also LINK passkeys (at most 10): a passkey is only a key to /admin, the money stays in the owner's
+// wallet. A link is written only from a live WALLET admin session of the owner and with the passkey's own signature (both sides prove their key), and a
+// passkey's admin login counts only while its link to the CURRENT owner exists (read again on every request).
 /** The admin's sign-in route, the same in every game: a page, an AI helper and the kit's panel find it here. */
 export const ADMIN_SIGNIN_BASE = "/api/admin-signin";
 /** The page the admin signs in to: Berry Wallet signs this page's address ("URI: https://example.com/admin", with NO query). */
@@ -35,8 +39,21 @@ export const ADMIN_SIGNIN_LIMITS = {
     nanchatRoute: { limit: 120, windowMs: 60_000 },
     nanchatAll: { limit: 600, windowMs: 10 * 60_000 },
     nanchatNonce: { limit: 5, windowMs: 10 * 60_000 },
+    /** The owner's passkeys: the list, a link and a removal, per IP address (memory). A passkey's sign-in counts with the starts (`signin`, hook). */
+    passkeys: { limit: 30, windowMs: 60_000 },
     /** The biggest body the routes read. */
     bodyMax: 8192,
 };
+/** The most passkeys one owner may link. */
+export const ADMIN_PASSKEY_LIMIT = 10;
+/** How long a passkey's signature is kept as used (its 5-minute window, both ways, and some more). */
+export const ADMIN_ONCE_MS = 10 * 60_000;
+/**
+ * What a passkey signs to OPEN /admin: `signinMessage(adminPasskeyDomain(host), address, at)`, "ADMIN of <host>: sign in as nano_... at <ms>". Never the
+ * host alone: a player's passkey signature names only the host, and it must never open /admin.
+ */
+export const adminPasskeyDomain = (host) => `ADMIN of ${host}`;
+/** What a passkey signs to be LINKED to the owner: "Link this passkey to the ADMIN of <host>: sign in as nano_... at <ms>". It opens nothing. */
+export const adminLinkDomain = (host) => `Link this passkey to the ADMIN of ${host}`;
 /** A token, a starter value: 32 random bytes as 64 hex characters. */
 export const TOKEN_PATTERN = /^[0-9a-f]{64}$/;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nano133/nanoterra",
-  "version": "0.11.0",
+  "version": "0.12.0",
   "description": "Nanoterra for a creator's game, in one package: the player's sign-in ticket, the player's character (a toon body on the island's skeleton), the looks ladder, the admin and its wallet sign-in, the friends list, an options menu, emotes, the player's sign-in (a passkey or a wallet app) and a shop that sells looks for Nano with no key on the server.",
   "type": "module",
   "main": "dist/index.js",

package/src/admin/guard.ts

@@ -4,13 +4,22 @@
 // DO NOT LOOSEN THIS. It is the game starter's `adminGuard` (src/worker/admin.ts), with the same five checks in the same order, and it may only
 // refuse MORE than the starter does, never less (a test runs both over a grid of inputs and proves it). Deny by default: anything this function
 // does not understand is a refusal, and a fault inside it is a refusal too.
+// The ONE rule Wes approved on 2026-11-01 (the owner's linked passkey): a "passkey" session opens /admin only with `linkedTo` === the owner (checks 3 and 4).
 
 /** An admin login a game has found for this request: the address that signed, when the login was made (ms), and how it was made. */
 export type AdminSession = {
   address: string;
   createdAt: number;
-  /** "wallet" is a signature made with the address's key. Anything else (a sign-in from Nanoterra names an address but proves no key) never opens /admin. */
+  /**
+   * "wallet" is a signature made with the address's key. "passkey" is a signature by a passkey that the owner linked: it counts only with `linkedTo`.
+   * Anything else (a sign-in from Nanoterra names an address but proves no key) never opens /admin.
+   */
   via: string;
+  /**
+   * For a "passkey" session only: the owner address its link points to, set by the sign-in only after it read the link on THIS request. The guard compares
+   * it with the owner instead of `address` (the passkey's own). A session of any other `via` is judged by its `address`; this field is not read.
+   */
+  linkedTo?: string;
 };
 
 export type AdminAccessInput = {
@@ -75,10 +84,15 @@ function decide(input: AdminAccessInput): AdminAccess {
   if (!session || typeof session !== "object") return refuse(401, "Sign in with your Nano address.");
   const { address, createdAt, via } = session;
   if (typeof address !== "string" || typeof via !== "string" || typeof createdAt !== "number") return refuse(401, "Sign in with your Nano address.");
-  // 3. It was made with a wallet signature. A sign-in from Nanoterra names an address but proves no key.
-  if (via !== "wallet") return refuse(403, "Sign in with your Nano wallet to open this page.", { reason: "nanoterra" });
-  // 4. It is the owner's address (the same text, no other form).
-  if (address !== owner) return refuse(403, "Only the game's own address can open this page.", { reason: "other_address", signedInAs: address });
+  // 3. It was made with a wallet signature, or (the one rule of 2026-11-01) by a passkey whose link the sign-in read on this request. A sign-in from
+  //    Nanoterra names an address but proves no key.
+  let linkedTo: unknown;
+  if (via === "passkey") {
+    linkedTo = session.linkedTo;
+    if (typeof linkedTo !== "string") return refuse(403, "Sign in with your Nano wallet to open this page.", { reason: "nanoterra" });
+  } else if (via !== "wallet") return refuse(403, "Sign in with your Nano wallet to open this page.", { reason: "nanoterra" });
+  // 4. It is the owner's address (the same text, no other form): a wallet's own address, or the address a passkey's link points to.
+  if ((via === "passkey" ? linkedTo : address) !== owner) return refuse(403, "Only the game's own address can open this page.", { reason: "other_address", signedInAs: address });
   // 5. It is not older than the limit (one day at most), and not from the future.
   const age = now - createdAt;
   if (!(age >= -CLOCK_SKEW_MS && age <= max)) return refuse(401, "Sign in again: an admin sign-in counts for one day.");

package/src/admin/panel/card.ts

@@ -0,0 +1,5 @@
+// A card of the game's own for the admin panel's Settings tab (`mountAdmin`'s `cards`). Its own file, so a card made elsewhere (the owner's passkeys, in
+// "@nano133/nanoterra/admin-signin/panel") names the type without reaching the whole panel.
+
+/** A card of the game's own in the Settings tab: its element, made once, and what to do each time the owner signs in (read its data again). */
+export type AdminCard = { el: HTMLElement; refresh?: () => void | Promise<void> };

package/src/admin/panel/icons.ts

@@ -35,6 +35,7 @@ const SHAPES = {
   gear: [["path", { d: "M19.23 9.65 21.77 9.86V14.14L19.23 14.35 18.77 15.45 20.42 17.39 17.39 20.42 15.45 18.77 14.35 19.23 14.14 21.77H9.86L9.65 19.23 8.55 18.77 6.61 20.42 3.58 17.39 5.23 15.45 4.77 14.35 2.23 14.14V9.86L4.77 9.65 5.23 8.55 3.58 6.61 6.61 3.58 8.55 5.23 9.65 4.77 9.86 2.23H14.14L14.35 4.77 15.45 5.23 17.39 3.58 20.42 6.61 18.77 8.55Z" }], ["circle", { cx: 12, cy: 12, r: 3.2 }]],
   sparkle: [["path", { d: "M12 3v4M12 17v4M3 12h4M17 12h4M6 6l2.5 2.5M15.5 15.5 18 18M6 18l2.5-2.5M15.5 8.5 18 6" }]],
   smile: [["circle", { cx: 12, cy: 12, r: 9 }], ["path", { d: "M8.2 14.2a4.6 4.6 0 0 0 7.6 0" }], ["path", { d: "M9 9.6h.01M15 9.6h.01", "stroke-width": 2.6 }]],
+  key: [["path", { d: "M14.5 9.5a4.5 4.5 0 1 1-1.3-3.2" }], ["path", { d: "M13.2 6.3 21 6.3M18 6.3v3M21 6.3v2.2" }], ["circle", { cx: 10, cy: 9.5, r: 1.4, fill: "currentColor", stroke: "none" }]],
 } satisfies Record<string, Shape[]>;
 
 export type IconName = keyof typeof SHAPES;

package/src/admin/panel/index.ts

@@ -7,7 +7,7 @@
 // The server part is "@nano133/nanoterra/admin" (the guard and the handler): it must not load this one.
 
 export { mountAdmin } from "./mount.js";
-export type { MountedAdmin, MountOptions } from "./mount.js";
+export type { AdminCard, MountedAdmin, MountOptions } from "./mount.js";
 export { ApiError, createApi } from "./api.js";
 export type { Api } from "./api.js";
 export { gameCard } from "./gameCard.js";

package/src/admin/panel/mount.ts

@@ -10,6 +10,7 @@ import type { AdminSummary } from "../store.js";
 import type { GameState } from "../switches.js";
 import { PASSKEY_PREVIEW_NOTE, previewHost } from "../../player-signin/host.js";
 import { ApiError, createApi, type Api } from "./api.js";
+import type { AdminCard } from "./card.js";
 import { copyKey, h, plural, shortAddress } from "./dom.js";
 import { gameCard } from "./gameCard.js";
 import { icon, type IconName } from "./icons.js";
@@ -43,10 +44,17 @@ export type MountOptions = {
   /** The game offers its players a passkey (`@nano133/nanoterra/player-signin`): on a preview address (`*.workers.dev`) the banner says that passkeys turn
    *  on with the game's own domain. */
   playerPasskeys?: boolean;
+  /**
+   * Cards of the game's own for the Settings tab, after the Sign-ins card: for example the owner's passkeys (`ownerPasskeys()` of
+   * "@nano133/nanoterra/admin-signin/panel"). Each card is made once and kept for the life of the page; its `refresh()` runs each time the owner signs in.
+   */
+  cards?: readonly AdminCard[];
   /** The `fetch` to use (default: the page's). */
   fetch?: typeof fetch;
 };
 
+export type { AdminCard };
+
 export type MountedAdmin = {
   /** Reads everything again and redraws. */
   reload(): Promise<void>;
@@ -193,6 +201,8 @@ export function mountAdmin(root: HTMLElement, options: MountOptions): MountedAdm
     const kpis = h("div", { class: "kpis", role: "group", "aria-label": "Your game in numbers" });
     const settings = h("div", { class: "settings-grid" });
     tabs.panels.settings.append(settings);
+    // The game's own cards read their data again at each sign-in (a new dashboard is built after every sign-in).
+    for (const c of options.cards ?? []) void Promise.resolve(c.refresh?.()).catch(() => undefined);
     data.replaceChildren(top, banner, kpis, tabs.bar, ...Object.values(tabs.panels));
 
     const kpi = (cls: string, mark: IconName, label: string, value: string, sub: string, open: () => void, alert = false) =>
@@ -245,7 +255,7 @@ export function mountAdmin(root: HTMLElement, options: MountOptions): MountedAdm
         orders.update(s);
         players.update(s);
         // The Game card is the same element at every redraw: moving it keeps its state.
-        settings.replaceChildren(...[game, signinsCard(s, api, () => void load(), options.loginsNote), about(s)].filter((p): p is HTMLElement => p !== null));
+        settings.replaceChildren(...[game, signinsCard(s, api, () => void load(), options.loginsNote), ...(options.cards ?? []).map((c) => c.el), about(s)].filter((p): p is HTMLElement => p !== null));
       },
     };
   }

package/src/admin/panel/style.css

@@ -1968,6 +1968,50 @@
   flex-basis: 100%;
 }
 
+/* ---- The owner's passkeys (a card from "@nano133/nanoterra/admin-signin/panel"): phone first, 16 px text, 48 px keys ---- */
+
+.n133-admin .owner-passkeys .btn {
+  min-height: 48px;
+  font-size: 16px;
+}
+
+.n133-admin .passkey-row {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  justify-content: space-between;
+  gap: 8px;
+  font-size: 16px;
+}
+
+.n133-admin .passkey-what {
+  display: inline-flex;
+  flex-wrap: wrap;
+  align-items: center;
+  gap: 6px;
+  min-width: 0;
+}
+
+.n133-admin .passkey-add,
+.n133-admin .passkey-confirm {
+  display: grid;
+  gap: 8px;
+  justify-items: start;
+}
+
+.n133-admin .passkey-confirm {
+  flex-basis: 100%;
+  padding: 12px;
+  border-radius: 12px;
+  background: var(--alarm-bg);
+}
+
+.n133-admin .passkey-keys {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 8px;
+}
+
 /* ---- Wider panels ---- */
 
 @container n133 (min-width: 560px) {