@nano133/nanoterra 0.11.0 → 0.13.0

package/dist/admin-signin/panel/passkeys.d.ts

@@ -0,0 +1,43 @@
+import type { PasskeyScheme } from "@nano133/signin/passkey";
+import type { AdminCard } from "../../admin/panel/card.js";
+import { type AdminPasskey } from "../types.js";
+export type AdminPasskeyOptions = {
+    /** The game's FROZEN passkey scheme: the same one the player sheet takes (see "/player-signin": checkScheme, schemeVector). */
+    scheme: PasskeyScheme;
+    /** The game's name: the device shows it next to a new passkey ("Coin Bees admin · 1 Nov 2026"). */
+    name: string;
+    /** The passkeys' relying party id: the game's domain. Default: the page's host name. */
+    rpId?: string;
+    /** Where the admin sign-in's routes are. Default "/api/admin-signin" (ADMIN_SIGNIN_BASE). */
+    base?: string;
+    /** The `fetch` to use (default: the page's). */
+    fetch?: typeof fetch;
+};
+/** The answer of `POST {base}/passkeys` (and of a link or a removal). */
+export type PasskeyList = {
+    passkeys: AdminPasskey[];
+    limit: number;
+    via: string;
+    canChange: boolean;
+    you: string;
+};
+/** What the owner reads when a passkey prompt fails, by the fault's code (@nano133/signin/passkey's PasskeyFault). */
+export declare function passkeyFaultText(e: unknown): string;
+/**
+ * Signs in to /admin with a linked passkey: the device asks for the passkey, the purse signs the ADMIN text, the server checks the link. Resolves with the
+ * passkey's address; throws an ApiError (the server's words) or a passkey fault (`passkeyFaultText`).
+ */
+export declare function passkeyAdminSignIn(o: AdminPasskeyOptions & {
+    turnstile?: string | null;
+    signal?: AbortSignal;
+}): Promise<{
+    address: string;
+    linkedTo: string;
+}>;
+/**
+ * The "Owner passkeys" card for /admin: the passkeys linked to the game's address, "Add a passkey" and Remove (both only with a wallet sign-in). Give it to
+ * `mountAdmin`'s `cards`; it reads the list each time the owner signs in.
+ *
+ *   mountAdmin(el, { looks, signIn: adminSignIn({ passkeys: true, scheme, name }), signOut: adminSignOut(), cards: [ownerPasskeys({ scheme, name })] });
+ */
+export declare function ownerPasskeys(options: AdminPasskeyOptions): AdminCard;

package/dist/admin-signin/panel/passkeys.js

@@ -0,0 +1,202 @@
+// The owner's passkeys in the browser (since 0.12.0): the "Passkey" way of the admin's sign-in, and the "Owner passkeys" card for /admin (`ownerPasskeys()`,
+// a card for `mountAdmin`'s `cards`). A passkey is only a key to /admin: the money stays in the owner's wallet.
+//
+//   - Sign in: the passkey purse (the game's FROZEN scheme, the player sheet's) signs "ADMIN of <host>: sign in as <address> at <ms>"; the server lets it in
+//     only while the passkey is linked to the game's address.
+//   - Add: only with a WALLET admin session. A new passkey is made (or one the owner has is used), and it signs "Link this passkey to the ADMIN of <host>:
+//     ...": the server writes the link only with both proofs, the wallet session and this signature.
+//   - Remove: only with a wallet admin session; the passkey's admin sessions end too.
+//
+// The passkey code (@nano133/signin/passkey) and the purse's signing code (@nano133/signin/purse) are loaded only when a passkey is used: a game without
+// passkeys never loads them. The seed lives in local variables of one press only: never in storage, a log, an error text or an address.
+import { ApiError, createApi } from "../../admin/panel/api.js";
+import { h, shortAddress } from "../../admin/panel/dom.js";
+import { icon } from "../../admin/panel/icons.js";
+import { checkScheme } from "../../player-signin/scheme-check.js";
+import { ADMIN_SIGNIN_BASE, adminLinkDomain, adminPasskeyDomain } from "../types.js";
+/** What the owner reads when a passkey prompt fails, by the fault's code (@nano133/signin/passkey's PasskeyFault). */
+export function passkeyFaultText(e) {
+    const code = e?.code;
+    const name = e?.name;
+    const c = typeof code === "string" ? code : name === "NotAllowedError" || name === "AbortError" ? "cancelled" : name === "SecurityError" ? "wrong-host" : name === "NotSupportedError" ? "unsupported" : name === "InvalidStateError" ? "exists" : "failed";
+    if (c === "cancelled")
+        return "The passkey was closed. Try again.";
+    if (c === "no-prf" || c === "other-form" || c === "unsupported")
+        return "This browser or device cannot use a passkey here. Use your wallet.";
+    if (c === "not-a-purse")
+        return "That passkey is not one of this game's. Choose another one.";
+    if (c === "wrong-host")
+        return "A passkey works only on the game's own address.";
+    if (c === "exists")
+        return "This device has a passkey for this game already. Press Use a passkey I have.";
+    return "The passkey did not work. Try again.";
+}
+const dayText = (ms) => new Date(ms).toLocaleDateString("en-GB", { day: "numeric", month: "short", year: "numeric" });
+function setupOf(o) {
+    return { rpId: o.rpId ?? location.hostname, rpName: o.name, scheme: o.scheme, userName: `${o.name} admin · ${dayText(Date.now())}`, exclude: [] };
+}
+const apiOf = (o) => createApi(o.base ?? ADMIN_SIGNIN_BASE, o.fetch ?? ((...a) => fetch(...a)));
+/**
+ * Signs in to /admin with a linked passkey: the device asks for the passkey, the purse signs the ADMIN text, the server checks the link. Resolves with the
+ * passkey's address; throws an ApiError (the server's words) or a passkey fault (`passkeyFaultText`).
+ */
+export async function passkeyAdminSignIn(o) {
+    checkScheme(o.scheme);
+    const { openPasskey } = await import("@nano133/signin/passkey");
+    const p = await openPasskey(setupOf(o), o.signal);
+    const { signinBody } = await import("@nano133/signin/purse");
+    return apiOf(o).post("/passkey", { ...signinBody(adminPasskeyDomain(location.host), p.seed), ...(o.turnstile ? { turnstile: o.turnstile } : {}) });
+}
+/**
+ * The "Owner passkeys" card for /admin: the passkeys linked to the game's address, "Add a passkey" and Remove (both only with a wallet sign-in). Give it to
+ * `mountAdmin`'s `cards`; it reads the list each time the owner signs in.
+ *
+ *   mountAdmin(el, { looks, signIn: adminSignIn({ passkeys: true, scheme, name }), signOut: adminSignOut(), cards: [ownerPasskeys({ scheme, name })] });
+ */
+export function ownerPasskeys(options) {
+    checkScheme(options.scheme);
+    const api = apiOf(options);
+    let list = null;
+    let prompt = null;
+    const status = h("p", { class: "fine passkey-status", role: "status", "aria-live": "polite" });
+    const items = h("ul", { class: "signin-list passkey-list" });
+    const note = h("p", { class: "fine" });
+    const add = h("div", { class: "passkey-add" });
+    const el = h("section", { class: "admin-card owner-passkeys", "aria-labelledby": "n133-passkeys-title" }, h("h2", { id: "n133-passkeys-title" }, "Owner passkeys"), h("p", { class: "fine" }, "A passkey opens this admin page with Face ID, Touch ID or your device PIN, without your wallet. It cannot move money: your money stays in your wallet."), items, note, add, status);
+    el.hidden = true;
+    const say = (text) => (status.textContent = text);
+    const key = (text, onclick, kind = "plain") => h("button", { class: `btn${kind === "primary" ? " btn-primary" : ""}`, type: "button", onclick }, text);
+    const busy = (on) => {
+        for (const b of Array.from(el.querySelectorAll("button")))
+            b.disabled = on;
+        el.toggleAttribute("aria-busy", on);
+    };
+    const words = (e, fallback) => (e instanceof ApiError ? e.message : e && typeof e === "object" && ("code" in e || "name" in e) ? passkeyFaultText(e) : fallback);
+    function draw() {
+        if (!list)
+            return;
+        const l = list;
+        items.replaceChildren(...l.passkeys.map((p) => {
+            const row = h("li", { class: "passkey-row" });
+            const what = h("span", { class: "passkey-what" }, icon("key", 18), h("strong", {}, h("code", { title: p.address }, shortAddress(p.address))), h("span", {}, ` · added ${dayText(p.createdAt)}`), p.address === l.you && l.via === "passkey" ? h("span", { class: "chip" }, "This passkey") : null);
+            row.append(what);
+            if (l.canChange)
+                row.append(key("Remove", () => confirmRemove(row, p.address)));
+            return row;
+        }));
+        if (!l.passkeys.length)
+            items.append(h("li", { class: "fine" }, "No passkey is linked yet."));
+        note.textContent = l.canChange ? `You can link up to ${l.limit} passkeys. Each one proves its key when you add it.` : "You signed in with a passkey. Sign in with your wallet to add or remove a passkey.";
+        showAdd();
+    }
+    function showAdd() {
+        if (!list?.canChange)
+            return add.replaceChildren();
+        const full = list.passkeys.length >= list.limit;
+        const b = key("Add a passkey", () => chooseAdd(), "primary");
+        b.disabled = full;
+        add.replaceChildren(b, full ? h("p", { class: "fine" }, `You have ${list.limit} passkeys. Remove one to add another.`) : "");
+    }
+    function chooseAdd() {
+        say("");
+        add.replaceChildren(h("p", {}, "Make a new passkey on this device, or use a passkey you have for this game."), h("div", { class: "passkey-keys" }, key("Make a new passkey", () => void makeNew(), "primary"), key("Use a passkey I have", () => void useMine()), key("Cancel", () => showAdd())));
+        add.querySelector("button")?.focus({ preventScroll: true });
+    }
+    /** Links the passkey of `seed`: it signs the LINK text, and the server writes the link with this wallet session. */
+    async function linkSeed(seed) {
+        const { signinBody } = await import("@nano133/signin/purse");
+        list = await api.post("/passkey/link", signinBody(adminLinkDomain(location.host), seed));
+        draw();
+        say("Passkey added. It opens this admin page from now on.");
+    }
+    async function makeNew() {
+        busy(true);
+        say("Making a passkey… Follow your device.");
+        prompt = new AbortController();
+        try {
+            const pk = await import("@nano133/signin/passkey");
+            const made = await pk.makePasskey(setupOf(options), prompt.signal);
+            await firstOpen(made, false);
+        }
+        catch (e) {
+            busy(false);
+            showAdd();
+            say(words(e, "The passkey was not added. Try again."));
+        }
+    }
+    /** The first use of a new passkey gives its seed. Where the browser allows one prompt per press, one more key finishes it. */
+    async function firstOpen(made, pick) {
+        busy(true);
+        say("Opening the new passkey…");
+        prompt = new AbortController();
+        const pk = await import("@nano133/signin/passkey");
+        try {
+            const p = await pk.firstUse(setupOf(options), made, prompt.signal, pick);
+            await linkSeed(p.seed);
+            busy(false);
+        }
+        catch (e) {
+            busy(false);
+            const code = e?.code;
+            if (code !== "cancelled" && code !== "failed")
+                throw e;
+            add.replaceChildren(h("p", {}, "Your passkey is made. Open it once to add it."), h("div", { class: "passkey-keys" }, key("Open the new passkey", () => void firstOpen(made, true).catch(fault), "primary"), key("Cancel", () => showAdd())));
+            say("");
+        }
+    }
+    function fault(e) {
+        busy(false);
+        showAdd();
+        say(words(e, "The passkey was not added. Try again."));
+    }
+    async function useMine() {
+        busy(true);
+        say("Waiting for your passkey…");
+        prompt = new AbortController();
+        try {
+            const pk = await import("@nano133/signin/passkey");
+            const p = await pk.openPasskey(setupOf(options), prompt.signal);
+            await linkSeed(p.seed);
+            busy(false);
+        }
+        catch (e) {
+            fault(e);
+        }
+    }
+    function confirmRemove(row, address) {
+        const keys = h("div", { class: "passkey-confirm" }, h("p", {}, "Remove this passkey? It cannot open this page any more, and its sign-ins end now."), key("Yes, remove", () => void remove(address), "primary"), key("Cancel", () => draw()));
+        row.replaceChildren(row.firstChild, keys);
+        keys.querySelector("button")?.focus({ preventScroll: true });
+    }
+    async function remove(address) {
+        busy(true);
+        say("Removing…");
+        try {
+            list = await api.post("/passkey/unlink", { address });
+            busy(false);
+            draw();
+            say("Passkey removed.");
+        }
+        catch (e) {
+            busy(false);
+            draw();
+            say(words(e, "The game's server did not answer. Nothing was changed."));
+        }
+    }
+    async function refresh() {
+        prompt?.abort();
+        prompt = null;
+        try {
+            list = await api.post("/passkeys");
+            el.hidden = false;
+            say("");
+            draw();
+        }
+        catch {
+            // No passkeys on this game (the route is off), or no session that may read them: the card does not show.
+            list = null;
+            el.hidden = true;
+        }
+    }
+    return { el, refresh };
+}

package/dist/admin-signin/panel/view.d.ts

@@ -1,3 +1,4 @@
+import type { PasskeyScheme } from "@nano133/signin/passkey";
 export type AdminSigninViewOptions = {
     /** Where the sign-in's routes are. Default "/api/admin-signin" (ADMIN_SIGNIN_BASE). */
     base?: string;
@@ -6,6 +7,17 @@ export type AdminSigninViewOptions = {
      * admin sign-in from a game sign-in in it: it is off unless the game turns it on on the server and here.
      */
     nanchat?: boolean;
+    /**
+     * Offer the owner's linked passkeys (the server's `passkeys: true`): a "Passkey" tile after the wallets. Default false. Needs `scheme` and `name`. Only a
+     * passkey that the owner linked in Settings while signed in with the wallet opens /admin.
+     */
+    passkeys?: boolean;
+    /** The game's FROZEN passkey scheme: the same one the player sheet takes. Needed with `passkeys`. */
+    scheme?: PasskeyScheme;
+    /** The game's name (the device shows it with the passkey). Needed with `passkeys`. */
+    name?: string;
+    /** The passkeys' relying party id: the game's domain. Default: the page's host name. */
+    rpId?: string;
     /** The person check (Turnstile): fills `box` and gives its token, before a start. No hook: no check. */
     personCheck?: (box: HTMLElement) => Promise<string | null | undefined>;
     /** Draws a QR code of `text` (a wallet's link), for a screen with a mouse. Default: the package's own QR code; a link too long for it is shown as a link. */

package/dist/admin-signin/panel/view.js

@@ -5,11 +5,16 @@
 //
 // Plain DOM, no framework, no package. The tiles show letters, not logos: no wallet's licence clearly allows its logo. Phone first: text 16 px, every
 // key and tile 48 px or more each way. It uses the player sheet's stylesheet ("@nano133/nanoterra/admin-signin/style.css" is the same file).
+//
+// With `passkeys: true` (and the game's frozen `scheme` and `name`), a "Passkey" tile comes after the wallets: a passkey that the owner linked in Settings
+// ("Owner passkeys", ./passkeys.ts) opens /admin. A passkey that is not linked is refused by the server.
 import { ApiError, createApi } from "../../admin/panel/api.js";
 import { h, shortAddress } from "../../admin/panel/dom.js";
 import { icon } from "../../admin/panel/icons.js";
+import { checkScheme } from "../../player-signin/scheme-check.js";
 import { qrSvg } from "../../shop/panel/qr.js";
 import { ADMIN_SIGNIN_BASE } from "../types.js";
+import { passkeyAdminSignIn, passkeyFaultText } from "./passkeys.js";
 /** The wallets, in every list's order: Berry Wallet first. */
 const WALLETS = [
     { way: "berry", name: "Berry Wallet", mark: "B" },
@@ -25,6 +30,13 @@ export function adminSigninView(options = {}) {
     const base = options.base ?? ADMIN_SIGNIN_BASE;
     const api = createApi(base, options.fetch ?? ((...a) => fetch(...a)));
     const wallets = WALLETS.filter((w) => w.way !== "nanchat" || options.nanchat === true);
+    const passkeysOn = options.passkeys === true;
+    if (passkeysOn) {
+        checkScheme(options.scheme);
+        if (typeof options.name !== "string" || !options.name.trim())
+            throw new Error("passkeys: true needs the game's name");
+    }
+    let prompt = null;
     const touch = () => options.touch ?? (typeof matchMedia === "function" && matchMedia("(pointer: coarse)").matches);
     let stopped = false;
     let timer;
@@ -41,11 +53,46 @@ export function adminSigninView(options = {}) {
         if (timer)
             clearTimeout(timer);
         timer = undefined;
+        prompt?.abort();
+        prompt = null;
     }
     function showTiles() {
         stopWaiting();
         const tiles = wallets.map((w) => h("button", { class: "n133s-tile", type: "button", "data-way": w.way, onclick: () => void choose(w.way) }, h("span", { class: "n133s-mark", "aria-hidden": "true" }, w.mark), h("span", { class: "n133s-name" }, w.name)));
-        area.replaceChildren(h("p", { class: "n133s-or" }, "Choose your wallet"), h("div", { class: "n133s-tiles", "data-count": String(tiles.length) }, ...tiles));
+        // The owner's linked passkey comes after the wallets: a wallet makes the first admin login, and only it links a passkey.
+        if (passkeysOn)
+            tiles.push(h("button", { class: "n133s-tile", type: "button", "data-way": "passkey", onclick: () => showPasskey() }, h("span", { class: "n133s-mark", "aria-hidden": "true" }, icon("key", 24)), h("span", { class: "n133s-name" }, "Passkey")));
+        area.replaceChildren(h("p", { class: "n133s-or" }, passkeysOn ? "Choose your wallet or your passkey" : "Choose your wallet"), h("div", { class: "n133s-tiles", "data-count": String(tiles.length) }, ...tiles));
+    }
+    // ---- the owner's linked passkey ----
+    function showPasskey(words = "") {
+        stopWaiting();
+        current = null;
+        const back = h("button", { class: "n133s-back", type: "button", onclick: () => showTiles() }, icon("back", 18), h("span", {}, "Back"));
+        area.replaceChildren(back, h("h3", { class: "n133s-step", tabindex: "-1" }, "Passkey"), h("p", { class: "n133s-text" }, "Use a passkey that you linked to the game's address in Settings. Your device asks for Face ID, Touch ID or its PIN."), h("div", { class: "n133s-keys" }, key("Use my passkey", () => void usePasskey(), "primary")), h("p", { class: "n133s-fine" }, "No passkey yet? Sign in with your wallet, then add one in Settings, Owner passkeys."));
+        say(words);
+        focusFirst();
+    }
+    async function usePasskey() {
+        stopWaiting();
+        for (const b of Array.from(area.querySelectorAll("button")))
+            b.disabled = true;
+        say("Waiting for your passkey…");
+        prompt = new AbortController();
+        try {
+            const turnstile = options.personCheck ? await options.personCheck(check) : undefined;
+            const r = await passkeyAdminSignIn({ scheme: options.scheme, name: options.name, rpId: options.rpId, base, fetch: options.fetch, turnstile, signal: prompt.signal });
+            if (stopped)
+                return;
+            area.replaceChildren(h("p", { class: "n133s-done" }, icon("check", 22), h("span", {}, `Signed in with your passkey ${shortAddress(r.address)}`)));
+            say("");
+            options.onSignedIn?.(r.address);
+        }
+        catch (e) {
+            if (stopped)
+                return;
+            showPasskey(e instanceof ApiError ? e.message : passkeyFaultText(e));
+        }
     }
     async function choose(way) {
         if (current?.way === way && Date.now() < current.expiresAt)

package/dist/admin-signin/types.d.ts

@@ -51,15 +51,38 @@ export declare const ADMIN_SIGNIN_LIMITS: {
         readonly limit: 5;
         readonly windowMs: number;
     };
+    /** The owner's passkeys: the list, a link and a removal, per IP address (memory). A passkey's sign-in counts with the starts (`signin`, hook). */
+    readonly passkeys: {
+        readonly limit: 30;
+        readonly windowMs: 60000;
+    };
     /** The biggest body the routes read. */
     readonly bodyMax: 8192;
 };
+/** The most passkeys one owner may link. */
+export declare const ADMIN_PASSKEY_LIMIT = 10;
+/** How long a passkey's signature is kept as used (its 5-minute window, both ways, and some more). */
+export declare const ADMIN_ONCE_MS: number;
+/**
+ * What a passkey signs to OPEN /admin: `signinMessage(adminPasskeyDomain(host), address, at)`, "ADMIN of <host>: sign in as nano_... at <ms>". Never the
+ * host alone: a player's passkey signature names only the host, and it must never open /admin.
+ */
+export declare const adminPasskeyDomain: (host: string) => string;
+/** What a passkey signs to be LINKED to the owner: "Link this passkey to the ADMIN of <host>: sign in as nano_... at <ms>". It opens nothing. */
+export declare const adminLinkDomain: (host: string) => string;
+/** One passkey linked to the owner: the passkey purse's address and when it was linked (ms). */
+export type AdminPasskey = {
+    address: string;
+    createdAt: number;
+};
+/** What a link gives: "linked", "exists" (it was linked already: nothing changed) or "full" (the owner has ADMIN_PASSKEY_LIMIT already). */
+export type AdminLinkResult = "linked" | "exists" | "full";
 /** A token, a starter value: 32 random bytes as 64 hex characters. */
 export declare const TOKEN_PATTERN: RegExp;
 /**
  * An admin session as a store keeps it. `idHash` is the SHA-256 (hex) of "admin:" and the cookie's token (`adminKey`): never the token, and never the
- * plain hash a player's session has, so the SERVER keeps the two scopes apart and not only the cookies' names. `via` is "wallet" for every session this
- * sign-in makes; a store returns the word it holds.
+ * plain hash a player's session has, so the SERVER keeps the two scopes apart and not only the cookies' names. `via` is "wallet" for a wallet's session
+ * and "passkey" for a linked passkey's (its `address` is the PASSKEY's, never the owner's); a store returns the word it holds.
  */
 export type AdminSessionRecord = {
     idHash: string;
@@ -68,16 +91,28 @@ export type AdminSessionRecord = {
     expiresAt: number;
     via: string;
 };
-/** The admin session as the game reads it (`createAdminHandler`'s `session` hook). `via` is "unknown" for a stored word other than "wallet" and "nanoterra": the guard refuses it. */
+/**
+ * The admin session as the game reads it (`createAdminHandler`'s `session` hook). `via` is "unknown" for a stored word other than "wallet", "nanoterra" and
+ * "passkey": the guard refuses it. A "passkey" session carries `linkedTo`, the owner's address, only while its link to the CURRENT owner exists (read on this
+ * request); without the link the sign-in gives no session at all.
+ */
 export type AdminSigninSession = {
     address: string;
     createdAt: number;
     via: "wallet" | "nanoterra" | "unknown";
+} | {
+    address: string;
+    createdAt: number;
+    via: "passkey";
+    linkedTo: string;
 };
 /**
- * The game's database for the admin's sign-in. An adapter reads and writes ONLY its three tables or collections (requests, sessions, the sign-in list),
- * and only the ADMIN's rows of the first two (a game whose players sign in through the same tables keeps its rows apart: the `scope` column).
- * Run `adminSigninStoreConformance` on a store you write yourself.
+ * The game's database for the admin's sign-in. An adapter reads and writes ONLY its tables or collections (requests, sessions, the sign-in list, and for
+ * the owner's passkeys the links and the used signatures), and only the ADMIN's rows of the first two (a game whose players sign in through the same tables
+ * keeps its rows apart: the `scope` column). Run `adminSigninStoreConformance` on a store you write yourself.
+ *
+ * The passkey methods (`createSession` to `useOnce`) are optional: a store without them works for wallets, and `createAdminSignin({ passkeys: true })`
+ * refuses it.
  */
 export interface AdminSigninStore {
     /** The admin requests of one wallet app. */
@@ -100,6 +135,21 @@ export interface AdminSigninStore {
     recordLogin(login: AdminLogin): Promise<void>;
     /** The last sign-ins, newest first, at most `limit`, with only `at`, `country` and `browser`. */
     recentLogins(limit: number): Promise<AdminLogin[]>;
-    /** Deletes what nobody needs any more: admin requests 2 hours after they ended, admin sessions that ended, sign-in rows older than 30 days. */
+    /** Deletes what nobody needs any more: admin requests 2 hours after they ended, admin sessions that ended, sign-in rows older than 30 days, used passkey signatures past their time. */
     clean(now: number): Promise<void>;
+    /** Writes an admin session (a linked passkey's sign-in). Throws when a session with this hash exists. */
+    createSession?(session: AdminSessionRecord): Promise<void>;
+    /**
+     * Links the passkey `address` to `owner`, in ONE step that holds the limit: "linked"; "exists" when it is linked already (nothing changes); "full" when
+     * `owner` has ADMIN_PASSKEY_LIMIT links (nothing is written). Two calls at once never make more than the limit.
+     */
+    linkPasskey?(owner: string, address: string, at: number): Promise<AdminLinkResult>;
+    /** Removes the link and ends every admin session of that passkey ("passkey" sessions of `address`). True when a link was there. */
+    unlinkPasskey?(owner: string, address: string): Promise<boolean>;
+    /** The passkeys linked to `owner`, oldest first. */
+    passkeys?(owner: string): Promise<AdminPasskey[]>;
+    /** True only when `address` is linked to `owner` NOW (the exact texts). */
+    linked?(owner: string, address: string): Promise<boolean>;
+    /** Records `key` (a used passkey signature) and answers true; false when it is there and its time is not over. The admin's own table, not the player's. */
+    useOnce?(key: string, ttlMs: number): Promise<boolean>;
 }

package/dist/admin-signin/types.js

@@ -1,9 +1,13 @@
 // The ADMIN's sign-in of a game: the fixed route, the times, the limits and the store contract. (The player's sign-in is another thing:
 // "@nano133/nanoterra/player-signin".) No package and no DOM: the stores, the adapters and the browser panel read this file.
 //
-// The admin signs in with a wallet app only: Berry Wallet or Nautilus (and NanChat only when the game turns it on: its text cannot name the ADMIN). No
-// passkey. What Berry Wallet and Nautilus sign names the ADMIN, so a link that a stranger sends to the owner does not look like any sign-in. Only the game's own address makes an admin login, and only from a request that was started
-// on the admin's route; the guard (`adminAccess`) decides again on every call of /admin.
+// The admin signs in with a wallet app: Berry Wallet or Nautilus (and NanChat only when the game turns it on: its text cannot name the ADMIN). What Berry
+// Wallet and Nautilus sign names the ADMIN, so a link that a stranger sends to the owner does not look like any sign-in. Only the game's own address makes a
+// wallet admin login, and only from a request that was started on the admin's route; the guard (`adminAccess`) decides again on every call of /admin.
+//
+// Since 0.12.0, with `passkeys: true`, the owner may also LINK passkeys (at most 10): a passkey is only a key to /admin, the money stays in the owner's
+// wallet. A link is written only from a live WALLET admin session of the owner and with the passkey's own signature (both sides prove their key), and a
+// passkey's admin login counts only while its link to the CURRENT owner exists (read again on every request).
 /** The admin's sign-in route, the same in every game: a page, an AI helper and the kit's panel find it here. */
 export const ADMIN_SIGNIN_BASE = "/api/admin-signin";
 /** The page the admin signs in to: Berry Wallet signs this page's address ("URI: https://example.com/admin", with NO query). */
@@ -35,8 +39,21 @@ export const ADMIN_SIGNIN_LIMITS = {
     nanchatRoute: { limit: 120, windowMs: 60_000 },
     nanchatAll: { limit: 600, windowMs: 10 * 60_000 },
     nanchatNonce: { limit: 5, windowMs: 10 * 60_000 },
+    /** The owner's passkeys: the list, a link and a removal, per IP address (memory). A passkey's sign-in counts with the starts (`signin`, hook). */
+    passkeys: { limit: 30, windowMs: 60_000 },
     /** The biggest body the routes read. */
     bodyMax: 8192,
 };
+/** The most passkeys one owner may link. */
+export const ADMIN_PASSKEY_LIMIT = 10;
+/** How long a passkey's signature is kept as used (its 5-minute window, both ways, and some more). */
+export const ADMIN_ONCE_MS = 10 * 60_000;
+/**
+ * What a passkey signs to OPEN /admin: `signinMessage(adminPasskeyDomain(host), address, at)`, "ADMIN of <host>: sign in as nano_... at <ms>". Never the
+ * host alone: a player's passkey signature names only the host, and it must never open /admin.
+ */
+export const adminPasskeyDomain = (host) => `ADMIN of ${host}`;
+/** What a passkey signs to be LINKED to the owner: "Link this passkey to the ADMIN of <host>: sign in as nano_... at <ms>". It opens nothing. */
+export const adminLinkDomain = (host) => `Link this passkey to the ADMIN of ${host}`;
 /** A token, a starter value: 32 random bytes as 64 hex characters. */
 export const TOKEN_PATTERN = /^[0-9a-f]{64}$/;

package/dist/input/index.d.ts

@@ -1,3 +1,5 @@
+export { createZoom, listenZoom, pinchedTo, wheelNotches, zoomedBy, PINCH, ZOOM_CURVE, ZOOM_EASE, ZOOM_STEP } from "./zoom.js";
+export type { Zoom, ZoomRange } from "./zoom.js";
 type Listens = Pick<EventTarget, "addEventListener" | "removeEventListener">;
 /**
  * Calls `release` each time what is held may be wrong. In it, clear every held key, thumb stick and drag, and any jump or tool that a key press queued.
@@ -29,4 +31,3 @@ export declare function pauseWhenLeft(pause: () => void, win?: Listens, doc?: Li
     hidden?: boolean;
     hasFocus?: () => boolean;
 }): () => void;
-export {};

package/dist/input/index.js

@@ -16,6 +16,9 @@
 // calls your `pause` when the player really left (a free round stops its clock and shows a Resume key). No package: plain browser events.
 //
 // A ROUND THAT COSTS MONEY must not pause: its deadline must not move. Keep `releaseWhenLost` (the character always stops) and leave `pauseWhenLeft` out.
+//
+// The camera's distance (the wheel, a pinch, the + and − keys, one curve) is `createZoom` and `listenZoom`, in ./zoom.ts.
+export { createZoom, listenZoom, pinchedTo, wheelNotches, zoomedBy, PINCH, ZOOM_CURVE, ZOOM_EASE, ZOOM_STEP } from "./zoom.js";
 /**
  * Calls `release` each time what is held may be wrong. In it, clear every held key, thumb stick and drag, and any jump or tool that a key press queued.
  * `keysOnly`, when given, is called when a menu opens (a right click): a menu takes a keyup, but on a touch screen a long press also asks for a menu,

package/dist/input/zoom.d.ts

@@ -0,0 +1,81 @@
+/** Where the camera may be (metres from the eyes): the farthest, the default, and the switch: nearer than `first` it is in the eyes. */
+export type ZoomRange = {
+    max: number;
+    start: number;
+    first: number;
+};
+/** One notch: about one mouse-wheel click (100 px of scroll). The + and − keys move `key` notches. */
+export declare const ZOOM_STEP: {
+    readonly perPx: 0.006;
+    readonly perPxPinch: 0.03;
+    readonly linePx: 16;
+    readonly pagePx: 400;
+    readonly key: 1.2;
+};
+/** The curve: a notch moves `base + scale × distance` metres. */
+export declare const ZOOM_CURVE: {
+    readonly base: 0.35;
+    readonly scale: 0.14;
+};
+/** The touch pinch: twice the spread divides `distance + base/scale` by 2^power. */
+export declare const PINCH: {
+    readonly power: 1.3;
+};
+/** How fast the camera eases to the distance asked for (1/s). */
+export declare const ZOOM_EASE = 9;
+/** One wheel event as notches (negative: in). A mouse notch arrives in lines or about 100 px, a trackpad in many small pixels, a pinch as a wheel with the ctrl key. */
+export declare function wheelNotches(e: {
+    deltaY: number;
+    deltaMode?: number;
+    ctrlKey?: boolean;
+}): number;
+/** The distance after `notches` (negative: in) from `want`. */
+export declare function zoomedBy(r: ZoomRange, want: number, notches: number): number;
+/** The distance during a touch pinch: `from` at the start, the fingers `spread0` apart then and `spread` now (px). Apart brings it in. */
+export declare function pinchedTo(r: ZoomRange, from: number, spread0: number, spread: number): number;
+export type Zoom = {
+    /** The distance asked for (metres from the eyes). */
+    want(): number;
+    /** The distance now, as the last `step` eased it. */
+    now(): number;
+    /** True while the camera is in the eyes (the distance now below `first`). */
+    eyes(): boolean;
+    /** Asks for a distance (clamped), writes it and tells the listeners. */
+    set(d: number): void;
+    /** Moves the distance by notches (negative: in), along the curve. */
+    by(notches: number): void;
+    /** A wheel event (or one like it) moves the distance. */
+    wheel(e: {
+        deltaY: number;
+        deltaMode?: number;
+        ctrlKey?: boolean;
+    }): void;
+    /** A touch pinch starts with the fingers `spread` apart (px); `pinch` follows it; `pinchEnd` ends it. */
+    pinchStart(spread: number): void;
+    pinch(spread: number): void;
+    pinchEnd(): void;
+    /** One frame: the distance eases to the one asked for (at once when `calm`, reduced motion). Returns it. */
+    step(dt: number, calm: boolean): number;
+    /** Calls `on` when the distance asked for changes. Returns the function that stops it. */
+    subscribe(on: () => void): () => void;
+};
+/**
+ * The camera's distance of one game. `read` gives the kept distance (null: none, the default `start`), and is read the first time the distance is
+ * asked for, so the server never calls it; `write` keeps a new one (on every change: put a delay in it if your storage is slow).
+ */
+export declare function createZoom(r: ZoomRange, keep?: {
+    read?: () => number | null;
+    write?: (d: number) => void;
+}): Zoom;
+type Listens = Pick<EventTarget, "addEventListener" | "removeEventListener">;
+/**
+ * The wheel over `el` (the game's canvas: the page does not scroll or zoom there) and the + and − keys on the window (also the number pad's) move
+ * `zoom`. A key with ctrl, alt or the command key is the browser's own zoom and is left alone, and so is a key typed in a field. `skip(e)` returns true
+ * for an event the game wants to keep from the zoom (a key the player is binding, a game that is paused). Returns the function that takes the listeners away.
+ * The touch pinch is yours to wire (`pinchStart`, `pinch`, `pinchEnd`), because the fingers are also your thumb stick and your look.
+ */
+export declare function listenZoom(zoom: Zoom, el: Listens, opts?: {
+    skip?: (e: Event) => boolean;
+    keys?: boolean;
+}, win?: Listens): () => void;
+export {};