@nano133/nanoterra 0.11.0 → 0.13.0

package/dist/input/zoom.js

@@ -0,0 +1,140 @@
+// The camera's distance for a game the player walks in: the mouse wheel, a trackpad's two-finger scroll or pinch, a two-finger pinch on a touch
+// screen, and the + and − keys move one number, the camera's distance from the eyes, along ONE curve. 0 is first person; below `first` the camera
+// is in the eyes. It eases to the distance asked for (at once with reduced motion). No package: plain browser events.
+//
+// THE FEEL is nano133.com's island (app/island/zoom.ts). Each notch moves the distance in proportion to it (`0.35 + 0.14 × distance` metres a
+// notch), so a notch feels the same near and far. Every bit of a scroll counts: a dead zone and a speed limit dropped most of a quick spin in
+// Echo Island, and its wheel needed about five times the spins of the island's (Wes, 2026-11-01). Close in, the last notch goes all the way to
+// the eyes; out of the eyes, the first notch goes past the switch, so the camera never rests half inside the head.
+//
+// THE PINCH follows the same curve: the curve is a constant ratio of `distance + 2.5`, so spreading the fingers to twice their start divides it
+// by 2^PINCH.power, wherever the camera is.
+/** One notch: about one mouse-wheel click (100 px of scroll). The + and − keys move `key` notches. */
+export const ZOOM_STEP = { perPx: 0.006, perPxPinch: 0.03, linePx: 16, pagePx: 400, key: 1.2 };
+/** The curve: a notch moves `base + scale × distance` metres. */
+export const ZOOM_CURVE = { base: 0.35, scale: 0.14 };
+/** The touch pinch: twice the spread divides `distance + base/scale` by 2^power. */
+export const PINCH = { power: 1.3 };
+/** How fast the camera eases to the distance asked for (1/s). */
+export const ZOOM_EASE = 9;
+const clamp = (r, d) => Math.min(r.max, Math.max(0, d));
+/** One wheel event as notches (negative: in). A mouse notch arrives in lines or about 100 px, a trackpad in many small pixels, a pinch as a wheel with the ctrl key. */
+export function wheelNotches(e) {
+    const px = e.deltaMode === 1 ? e.deltaY * ZOOM_STEP.linePx : e.deltaMode === 2 ? e.deltaY * ZOOM_STEP.pagePx : e.deltaY;
+    return px * (e.ctrlKey ? ZOOM_STEP.perPxPinch : ZOOM_STEP.perPx);
+}
+/** The snap: close in, a move into the switch goes to the eyes; out of the eyes, a move out goes past the switch. */
+function snapped(r, from, to) {
+    if (to < from && to < r.first)
+        return 0;
+    if (to > from && from < r.first)
+        return clamp(r, Math.max(to, r.first + 1));
+    return clamp(r, to);
+}
+/** The distance after `notches` (negative: in) from `want`. */
+export function zoomedBy(r, want, notches) {
+    return snapped(r, want, want + notches * (ZOOM_CURVE.base + want * ZOOM_CURVE.scale));
+}
+/** The distance during a touch pinch: `from` at the start, the fingers `spread0` apart then and `spread` now (px). Apart brings it in. */
+export function pinchedTo(r, from, spread0, spread) {
+    if (!(spread0 > 0) || !(spread > 0))
+        return from;
+    const k = ZOOM_CURVE.base / ZOOM_CURVE.scale;
+    return snapped(r, from, (from + k) * (spread0 / spread) ** PINCH.power - k);
+}
+/**
+ * The camera's distance of one game. `read` gives the kept distance (null: none, the default `start`), and is read the first time the distance is
+ * asked for, so the server never calls it; `write` keeps a new one (on every change: put a delay in it if your storage is slow).
+ */
+export function createZoom(r, keep = {}) {
+    let want = r.start;
+    let now = r.start;
+    let loaded = false;
+    let pinchFrom = null;
+    const listeners = new Set();
+    const load = () => {
+        if (loaded)
+            return;
+        loaded = true;
+        const v = keep.read?.();
+        if (typeof v === "number" && Number.isFinite(v))
+            want = now = clamp(r, v);
+    };
+    const set = (d) => {
+        load();
+        want = clamp(r, d);
+        keep.write?.(want);
+        for (const on of listeners)
+            on();
+    };
+    const by = (notches) => {
+        load();
+        if (notches !== 0)
+            set(zoomedBy(r, want, notches));
+    };
+    return {
+        want: () => (load(), want),
+        now: () => (load(), now),
+        eyes: () => (load(), now < r.first),
+        set,
+        by,
+        wheel: (e) => by(wheelNotches(e)),
+        pinchStart(spread) {
+            load();
+            pinchFrom = { d: want, spread };
+        },
+        pinch(spread) {
+            if (pinchFrom)
+                set(pinchedTo(r, pinchFrom.d, pinchFrom.spread, spread));
+        },
+        pinchEnd() {
+            pinchFrom = null;
+        },
+        step(dt, calm) {
+            load();
+            now = calm ? want : now + (want - now) * (1 - Math.exp(-dt * ZOOM_EASE));
+            if (Math.abs(now - want) < 0.002)
+                now = want;
+            return now;
+        },
+        subscribe(on) {
+            listeners.add(on);
+            return () => void listeners.delete(on);
+        },
+    };
+}
+/**
+ * The wheel over `el` (the game's canvas: the page does not scroll or zoom there) and the + and − keys on the window (also the number pad's) move
+ * `zoom`. A key with ctrl, alt or the command key is the browser's own zoom and is left alone, and so is a key typed in a field. `skip(e)` returns true
+ * for an event the game wants to keep from the zoom (a key the player is binding, a game that is paused). Returns the function that takes the listeners away.
+ * The touch pinch is yours to wire (`pinchStart`, `pinch`, `pinchEnd`), because the fingers are also your thumb stick and your look.
+ */
+export function listenZoom(zoom, el, opts = {}, win = window) {
+    const wheel = (e) => {
+        e.preventDefault();
+        if (opts.skip?.(e))
+            return;
+        zoom.wheel(e);
+    };
+    const key = (e) => {
+        const k = e;
+        if (k.metaKey || k.altKey || k.ctrlKey || opts.skip?.(e))
+            return;
+        const t = k.target;
+        if (t && (t.isContentEditable || /^(INPUT|TEXTAREA|SELECT)$/.test(t.tagName ?? "")))
+            return;
+        if (k.code === "Equal" || k.code === "NumpadAdd")
+            zoom.by(-ZOOM_STEP.key);
+        else if (k.code === "Minus" || k.code === "NumpadSubtract")
+            zoom.by(ZOOM_STEP.key);
+    };
+    el.addEventListener("wheel", wheel, { passive: false });
+    const keys = opts.keys !== false;
+    if (keys)
+        win.addEventListener("keydown", key);
+    return () => {
+        el.removeEventListener("wheel", wheel);
+        if (keys)
+            win.removeEventListener("keydown", key);
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nano133/nanoterra",
-  "version": "0.11.0",
+  "version": "0.13.0",
   "description": "Nanoterra for a creator's game, in one package: the player's sign-in ticket, the player's character (a toon body on the island's skeleton), the looks ladder, the admin and its wallet sign-in, the friends list, an options menu, emotes, the player's sign-in (a passkey or a wallet app) and a shop that sells looks for Nano with no key on the server.",
   "type": "module",
   "main": "dist/index.js",

package/src/admin/guard.ts

@@ -4,13 +4,22 @@
 // DO NOT LOOSEN THIS. It is the game starter's `adminGuard` (src/worker/admin.ts), with the same five checks in the same order, and it may only
 // refuse MORE than the starter does, never less (a test runs both over a grid of inputs and proves it). Deny by default: anything this function
 // does not understand is a refusal, and a fault inside it is a refusal too.
+// The ONE rule Wes approved on 2026-11-01 (the owner's linked passkey): a "passkey" session opens /admin only with `linkedTo` === the owner (checks 3 and 4).
 
 /** An admin login a game has found for this request: the address that signed, when the login was made (ms), and how it was made. */
 export type AdminSession = {
   address: string;
   createdAt: number;
-  /** "wallet" is a signature made with the address's key. Anything else (a sign-in from Nanoterra names an address but proves no key) never opens /admin. */
+  /**
+   * "wallet" is a signature made with the address's key. "passkey" is a signature by a passkey that the owner linked: it counts only with `linkedTo`.
+   * Anything else (a sign-in from Nanoterra names an address but proves no key) never opens /admin.
+   */
   via: string;
+  /**
+   * For a "passkey" session only: the owner address its link points to, set by the sign-in only after it read the link on THIS request. The guard compares
+   * it with the owner instead of `address` (the passkey's own). A session of any other `via` is judged by its `address`; this field is not read.
+   */
+  linkedTo?: string;
 };
 
 export type AdminAccessInput = {
@@ -75,10 +84,15 @@ function decide(input: AdminAccessInput): AdminAccess {
   if (!session || typeof session !== "object") return refuse(401, "Sign in with your Nano address.");
   const { address, createdAt, via } = session;
   if (typeof address !== "string" || typeof via !== "string" || typeof createdAt !== "number") return refuse(401, "Sign in with your Nano address.");
-  // 3. It was made with a wallet signature. A sign-in from Nanoterra names an address but proves no key.
-  if (via !== "wallet") return refuse(403, "Sign in with your Nano wallet to open this page.", { reason: "nanoterra" });
-  // 4. It is the owner's address (the same text, no other form).
-  if (address !== owner) return refuse(403, "Only the game's own address can open this page.", { reason: "other_address", signedInAs: address });
+  // 3. It was made with a wallet signature, or (the one rule of 2026-11-01) by a passkey whose link the sign-in read on this request. A sign-in from
+  //    Nanoterra names an address but proves no key.
+  let linkedTo: unknown;
+  if (via === "passkey") {
+    linkedTo = session.linkedTo;
+    if (typeof linkedTo !== "string") return refuse(403, "Sign in with your Nano wallet to open this page.", { reason: "nanoterra" });
+  } else if (via !== "wallet") return refuse(403, "Sign in with your Nano wallet to open this page.", { reason: "nanoterra" });
+  // 4. It is the owner's address (the same text, no other form): a wallet's own address, or the address a passkey's link points to.
+  if ((via === "passkey" ? linkedTo : address) !== owner) return refuse(403, "Only the game's own address can open this page.", { reason: "other_address", signedInAs: address });
   // 5. It is not older than the limit (one day at most), and not from the future.
   const age = now - createdAt;
   if (!(age >= -CLOCK_SKEW_MS && age <= max)) return refuse(401, "Sign in again: an admin sign-in counts for one day.");

package/src/admin/panel/card.ts

@@ -0,0 +1,5 @@
+// A card of the game's own for the admin panel's Settings tab (`mountAdmin`'s `cards`). Its own file, so a card made elsewhere (the owner's passkeys, in
+// "@nano133/nanoterra/admin-signin/panel") names the type without reaching the whole panel.
+
+/** A card of the game's own in the Settings tab: its element, made once, and what to do each time the owner signs in (read its data again). */
+export type AdminCard = { el: HTMLElement; refresh?: () => void | Promise<void> };

package/src/admin/panel/icons.ts

@@ -35,6 +35,7 @@ const SHAPES = {
   gear: [["path", { d: "M19.23 9.65 21.77 9.86V14.14L19.23 14.35 18.77 15.45 20.42 17.39 17.39 20.42 15.45 18.77 14.35 19.23 14.14 21.77H9.86L9.65 19.23 8.55 18.77 6.61 20.42 3.58 17.39 5.23 15.45 4.77 14.35 2.23 14.14V9.86L4.77 9.65 5.23 8.55 3.58 6.61 6.61 3.58 8.55 5.23 9.65 4.77 9.86 2.23H14.14L14.35 4.77 15.45 5.23 17.39 3.58 20.42 6.61 18.77 8.55Z" }], ["circle", { cx: 12, cy: 12, r: 3.2 }]],
   sparkle: [["path", { d: "M12 3v4M12 17v4M3 12h4M17 12h4M6 6l2.5 2.5M15.5 15.5 18 18M6 18l2.5-2.5M15.5 8.5 18 6" }]],
   smile: [["circle", { cx: 12, cy: 12, r: 9 }], ["path", { d: "M8.2 14.2a4.6 4.6 0 0 0 7.6 0" }], ["path", { d: "M9 9.6h.01M15 9.6h.01", "stroke-width": 2.6 }]],
+  key: [["path", { d: "M14.5 9.5a4.5 4.5 0 1 1-1.3-3.2" }], ["path", { d: "M13.2 6.3 21 6.3M18 6.3v3M21 6.3v2.2" }], ["circle", { cx: 10, cy: 9.5, r: 1.4, fill: "currentColor", stroke: "none" }]],
 } satisfies Record<string, Shape[]>;
 
 export type IconName = keyof typeof SHAPES;

package/src/admin/panel/index.ts

@@ -7,7 +7,7 @@
 // The server part is "@nano133/nanoterra/admin" (the guard and the handler): it must not load this one.
 
 export { mountAdmin } from "./mount.js";
-export type { MountedAdmin, MountOptions } from "./mount.js";
+export type { AdminCard, MountedAdmin, MountOptions } from "./mount.js";
 export { ApiError, createApi } from "./api.js";
 export type { Api } from "./api.js";
 export { gameCard } from "./gameCard.js";

package/src/admin/panel/mount.ts

@@ -10,6 +10,7 @@ import type { AdminSummary } from "../store.js";
 import type { GameState } from "../switches.js";
 import { PASSKEY_PREVIEW_NOTE, previewHost } from "../../player-signin/host.js";
 import { ApiError, createApi, type Api } from "./api.js";
+import type { AdminCard } from "./card.js";
 import { copyKey, h, plural, shortAddress } from "./dom.js";
 import { gameCard } from "./gameCard.js";
 import { icon, type IconName } from "./icons.js";
@@ -43,10 +44,17 @@ export type MountOptions = {
   /** The game offers its players a passkey (`@nano133/nanoterra/player-signin`): on a preview address (`*.workers.dev`) the banner says that passkeys turn
    *  on with the game's own domain. */
   playerPasskeys?: boolean;
+  /**
+   * Cards of the game's own for the Settings tab, after the Sign-ins card: for example the owner's passkeys (`ownerPasskeys()` of
+   * "@nano133/nanoterra/admin-signin/panel"). Each card is made once and kept for the life of the page; its `refresh()` runs each time the owner signs in.
+   */
+  cards?: readonly AdminCard[];
   /** The `fetch` to use (default: the page's). */
   fetch?: typeof fetch;
 };
 
+export type { AdminCard };
+
 export type MountedAdmin = {
   /** Reads everything again and redraws. */
   reload(): Promise<void>;
@@ -193,6 +201,8 @@ export function mountAdmin(root: HTMLElement, options: MountOptions): MountedAdm
     const kpis = h("div", { class: "kpis", role: "group", "aria-label": "Your game in numbers" });
     const settings = h("div", { class: "settings-grid" });
     tabs.panels.settings.append(settings);
+    // The game's own cards read their data again at each sign-in (a new dashboard is built after every sign-in).
+    for (const c of options.cards ?? []) void Promise.resolve(c.refresh?.()).catch(() => undefined);
     data.replaceChildren(top, banner, kpis, tabs.bar, ...Object.values(tabs.panels));
 
     const kpi = (cls: string, mark: IconName, label: string, value: string, sub: string, open: () => void, alert = false) =>
@@ -245,7 +255,7 @@ export function mountAdmin(root: HTMLElement, options: MountOptions): MountedAdm
         orders.update(s);
         players.update(s);
         // The Game card is the same element at every redraw: moving it keeps its state.
-        settings.replaceChildren(...[game, signinsCard(s, api, () => void load(), options.loginsNote), about(s)].filter((p): p is HTMLElement => p !== null));
+        settings.replaceChildren(...[game, signinsCard(s, api, () => void load(), options.loginsNote), ...(options.cards ?? []).map((c) => c.el), about(s)].filter((p): p is HTMLElement => p !== null));
       },
     };
   }

package/src/admin/panel/style.css

@@ -1968,6 +1968,50 @@
   flex-basis: 100%;
 }
 
+/* ---- The owner's passkeys (a card from "@nano133/nanoterra/admin-signin/panel"): phone first, 16 px text, 48 px keys ---- */
+
+.n133-admin .owner-passkeys .btn {
+  min-height: 48px;
+  font-size: 16px;
+}
+
+.n133-admin .passkey-row {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  justify-content: space-between;
+  gap: 8px;
+  font-size: 16px;
+}
+
+.n133-admin .passkey-what {
+  display: inline-flex;
+  flex-wrap: wrap;
+  align-items: center;
+  gap: 6px;
+  min-width: 0;
+}
+
+.n133-admin .passkey-add,
+.n133-admin .passkey-confirm {
+  display: grid;
+  gap: 8px;
+  justify-items: start;
+}
+
+.n133-admin .passkey-confirm {
+  flex-basis: 100%;
+  padding: 12px;
+  border-radius: 12px;
+  background: var(--alarm-bg);
+}
+
+.n133-admin .passkey-keys {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 8px;
+}
+
 /* ---- Wider panels ---- */
 
 @container n133 (min-width: 560px) {

package/src/admin-signin/adapters/d1.sql

@@ -1,9 +1,11 @@
 -- The admin sign-in tables of "@nano133/nanoterra/admin-signin/d1". Add this file to the game's migrations (for example
--- migrations/0009_admin_signin.sql) and run `wrangler d1 migrations apply`. The adapter reads and writes only these three tables, and only the
+-- migrations/0009_admin_signin.sql) and run `wrangler d1 migrations apply`. The adapter reads and writes only these five tables, and only the
 -- ADMIN rows of the first two (scope = 'admin').
 --
--- The game starter has all three already (migrations 0001, 0002, 0003, 0005 and 0006): it needs NO migration, and `IF NOT EXISTS` leaves its tables and
--- rows as they are if it runs this file anyway. A game that has the player sign-in's d1.sql has the first two: this file adds `admin_logins`.
+-- The game starter has the first three already (migrations 0001, 0002, 0003, 0005 and 0006), and `IF NOT EXISTS` leaves its tables and rows as they are if
+-- it runs this file anyway. The last two (since 0.12.0) are the owner's passkeys: a game that turns them on (`createAdminSignin({ passkeys: true })`) and
+-- has the first three adds only those two (the starter: migrations/0009_admin_passkeys.sql, the two CREATE TABLE statements at the end of this file). A
+-- game that has the player sign-in's d1.sql has the first two: this file adds the other three.
 -- Times are milliseconds since 1970 (Date.now()).
 
 -- Wallet sign-in requests (the player's and the admin's: `scope` says whose). An admin request lives 2 minutes; the clean-up deletes it 2 hours after it ends.
@@ -43,3 +45,18 @@ CREATE TABLE IF NOT EXISTS admin_logins (
   browser TEXT NOT NULL                -- a short name from fixed lists: "Chrome on macOS"
 );
 CREATE INDEX IF NOT EXISTS admin_logins_by_time ON admin_logins (at);
+
+-- The owner's passkeys (since 0.12.0): each passkey linked to the game's own address, at most 10 for an owner. Only a live WALLET admin session of the owner
+-- writes a link; a link opens /admin only while it is here and its owner is the game's address NOW.
+CREATE TABLE IF NOT EXISTS admin_passkeys (
+  owner TEXT NOT NULL,                 -- the game's own address when the link was made
+  address TEXT NOT NULL,               -- the passkey purse's address
+  created_at INTEGER NOT NULL,         -- ms since 1970
+  PRIMARY KEY (owner, address)
+);
+
+-- The passkeys' used signatures (the admin's own, apart from the player's signin_once): the hash of each signed text, so one signature counts once.
+CREATE TABLE IF NOT EXISTS admin_once (
+  key TEXT PRIMARY KEY,
+  until INTEGER NOT NULL               -- ms since 1970; the clean-up deletes the row after it
+);

package/src/admin-signin/adapters/d1.ts

@@ -1,6 +1,7 @@
 // The admin sign-in's store for a game on Cloudflare D1, on the game starter's OWN tables and columns: `signin_requests` and `sessions` (their admin
 // rows, scope = 'admin') and `admin_logins`. A starter moves onto it with no migration, and every creator who is signed in to /admin stays signed in.
-// A new game adds ./d1.sql to its migrations ("@nano133/nanoterra/admin-signin/d1.sql": the same tables, `IF NOT EXISTS`).
+// A new game adds ./d1.sql to its migrations ("@nano133/nanoterra/admin-signin/d1.sql": the same tables, `IF NOT EXISTS`). The owner's passkeys (since
+// 0.12.0) use two more tables, `admin_passkeys` and `admin_once` (the end of d1.sql): only a game that turns the passkeys on needs them.
 //
 //   import { createD1AdminSignin } from "@nano133/nanoterra/admin-signin/d1";
 //   const store = createD1AdminSignin(env.DB);
@@ -11,12 +12,12 @@
 // "Sign out everywhere" is the same two statements as the admin store's (`createD1Store(db, { logins: true })`): either one may run it.
 
 import type { D1Like } from "../../admin/adapters/d1.js";
-import { ADMIN_LOGIN_KEEP_MS, ADMIN_WAYS, type AdminSessionRecord, type AdminSigninStore, type AdminWay, type RequestStoreLike, type SigninRequest } from "../types.js";
+import { ADMIN_LOGIN_KEEP_MS, ADMIN_PASSKEY_LIMIT, ADMIN_WAYS, type AdminLinkResult, type AdminSessionRecord, type AdminSigninStore, type AdminWay, type RequestStoreLike, type SigninRequest } from "../types.js";
 
 export type { D1Like, D1StatementLike } from "../../admin/adapters/d1.js";
 
 /** The tables' names. Default: the game starter's. A game with other names changes d1.sql to match. */
-export type D1AdminSigninTables = { requests?: string; sessions?: string; logins?: string };
+export type D1AdminSigninTables = { requests?: string; sessions?: string; logins?: string; passkeys?: string; once?: string };
 
 type Row = { id: string; rid: string | null; starter: string; status: string; expires_at: number; nonce: string | null; issued_at: number | null; label: string | null; account: string | null };
 
@@ -34,8 +35,17 @@ const toRequest = (r: Row): SigninRequest => ({
 const NAME = /^[A-Za-z_][A-Za-z0-9_]{0,62}$/;
 const changes = (res: unknown): number => Number((res as { meta?: { changes?: number } } | undefined)?.meta?.changes ?? 0);
 
-export function createD1AdminSignin(db: D1Like, tables: D1AdminSigninTables = {}): AdminSigninStore {
-  const T = { requests: tables.requests ?? "signin_requests", sessions: tables.sessions ?? "sessions", logins: tables.logins ?? "admin_logins" };
+/** True for D1's (and SQLite's) "no such table": a game that has not added the passkeys' tables. */
+const noTable = (e: unknown) => /no such table/i.test(String((e as { message?: unknown } | null)?.message ?? e));
+
+export function createD1AdminSignin(db: D1Like, tables: D1AdminSigninTables = {}): Required<AdminSigninStore> {
+  const T = {
+    requests: tables.requests ?? "signin_requests",
+    sessions: tables.sessions ?? "sessions",
+    logins: tables.logins ?? "admin_logins",
+    passkeys: tables.passkeys ?? "admin_passkeys",
+    once: tables.once ?? "admin_once",
+  };
   for (const n of Object.values(T)) if (!NAME.test(n)) throw new Error(`not a table name: ${n}`);
   const COLS = "id, rid, starter, status, expires_at, nonce, issued_at, label, account";
 
@@ -112,6 +122,49 @@ export function createD1AdminSignin(db: D1Like, tables: D1AdminSigninTables = {}
         db.prepare(`DELETE FROM ${T.sessions} WHERE expires_at < ? AND scope = 'admin'`).bind(now),
         db.prepare(`DELETE FROM ${T.logins} WHERE at < ?`).bind(now - ADMIN_LOGIN_KEEP_MS),
       ]);
+      // The used passkey signatures, on their own: a game without the passkeys' tables (they came in 0.12.0) still cleans the rest.
+      try {
+        await db.prepare(`DELETE FROM ${T.once} WHERE until <= ?`).bind(now).run();
+      } catch (e) {
+        if (!noTable(e)) throw e;
+      }
+    },
+    async createSession(s) {
+      await db.prepare(`INSERT INTO ${T.sessions} (id_hash, address, created_at, expires_at, via, scope) VALUES (?, ?, ?, ?, ?, 'admin')`).bind(s.idHash, s.address, s.createdAt, s.expiresAt, s.via).run();
+    },
+    async linkPasskey(owner, address, at): Promise<AdminLinkResult> {
+      // ONE statement holds the limit: the row is written only while the owner has fewer than the limit, and never twice.
+      const res = await db
+        .prepare(`INSERT INTO ${T.passkeys} (owner, address, created_at) SELECT ?, ?, ? WHERE (SELECT COUNT(*) FROM ${T.passkeys} WHERE owner = ?) < ? ON CONFLICT (owner, address) DO NOTHING`)
+        .bind(owner, address, at, owner, ADMIN_PASSKEY_LIMIT)
+        .run();
+      if (changes(res) === 1) return "linked";
+      const had = await db.prepare(`SELECT 1 AS one FROM ${T.passkeys} WHERE owner = ? AND address = ?`).bind(owner, address).first<{ one: number }>();
+      return had ? "exists" : "full";
+    },
+    async unlinkPasskey(owner, address) {
+      // The link, and the passkey's admin sessions with it.
+      const done = await db.batch([
+        db.prepare(`DELETE FROM ${T.passkeys} WHERE owner = ? AND address = ?`).bind(owner, address),
+        db.prepare(`DELETE FROM ${T.sessions} WHERE scope = 'admin' AND via = 'passkey' AND address = ?`).bind(address),
+      ]);
+      return changes(done[0]) > 0;
+    },
+    async passkeys(owner) {
+      const rows = (await db.prepare(`SELECT address, created_at FROM ${T.passkeys} WHERE owner = ? ORDER BY created_at, address`).bind(owner).all<{ address: string; created_at: number }>()).results;
+      return rows.map((r) => ({ address: String(r.address), createdAt: Number(r.created_at) }));
+    },
+    async linked(owner, address) {
+      return (await db.prepare(`SELECT 1 AS one FROM ${T.passkeys} WHERE owner = ? AND address = ?`).bind(owner, address).first<{ one: number }>()) !== null;
+    },
+    async useOnce(key, ttlMs) {
+      const now = Date.now();
+      // A row past its time may be taken again (its signature's window is long over); a live one may not.
+      const res = await db
+        .prepare(`INSERT INTO ${T.once} (key, until) VALUES (?, ?) ON CONFLICT (key) DO UPDATE SET until = excluded.until WHERE ${T.once}.until <= ?`)
+        .bind(key, now + ttlMs, now)
+        .run();
+      return changes(res) === 1;
     },
   };
 }

package/src/admin-signin/adapters/firestore.ts

@@ -9,15 +9,18 @@
 //   signin_requests/{key}   { id, way, starter, status, expiresAt, nonce?, issuedAt?, label?, account?, delivered, scope: "admin", deleteAt }
 //   sessions/{idHash}       { address, createdAt, expiresAt, via, scope: "admin", deleteAt }
 //   admin_logins/{id}       { at, country, browser, deleteAt }
-// Times are ms numbers; `deleteAt` is a Date (a Timestamp in Firestore): set a TTL policy on `deleteAt` for each collection. `{key}` is the request's id;
-// `{idHash}` the SHA-256 of "admin:" and the session's token. Every change that reads first is a transaction. Indexes: Firestore's own single-field
-// indexes are enough (`id`, `scope`, `expiresAt`, `at`).
+//   admin_passkeys/{owner}  { owner, passkeys: [{ address, createdAt }] }      (since 0.12.0: the owner's linked passkeys, at most 10; no deleteAt)
+//   admin_once/{key}        { until, deleteAt }                                (since 0.12.0: the passkeys' used signatures)
+// Times are ms numbers; `deleteAt` is a Date (a Timestamp in Firestore): set a TTL policy on `deleteAt` for each collection that has it. `{key}` is the
+// request's id; `{idHash}` the SHA-256 of "admin:" and the session's token. Every change that reads first is a transaction (the owner's passkeys are ONE
+// document, so a link holds the limit in its transaction). Indexes: Firestore's own single-field indexes are enough (`id`, `scope`, `expiresAt`, `at`,
+// `address`, `until`).
 //
 // The admin store for Firestore (`createFirestoreStore`) has no sign-in list and no "Sign out everywhere": give it this sign-in's,
 // `store.recentLogins = signin.recentLogins` and `store.signOutEverywhere = signin.signOutEverywhere`.
 
 import type { AdminLogin } from "../../admin/store.js";
-import { ADMIN_LOGIN_KEEP_MS, ADMIN_WAYS, type AdminSessionRecord, type AdminSigninStore, type AdminWay, type RequestStoreLike, type SigninRequest } from "../types.js";
+import { ADMIN_LOGIN_KEEP_MS, ADMIN_PASSKEY_LIMIT, ADMIN_WAYS, type AdminPasskey, type AdminSessionRecord, type AdminSigninStore, type AdminWay, type RequestStoreLike, type SigninRequest } from "../types.js";
 
 export type AdminSigninDocSnap = { exists: boolean; data(): Record<string, unknown> | undefined };
 export interface AdminSigninDocRef {
@@ -76,10 +79,24 @@ function requestOf(d: Record<string, unknown> | undefined, key: string, way: Adm
   };
 }
 
-export function createFirestoreAdminSignin(db: FirestoreAdminSigninLike, collections: { requests?: string; sessions?: string; logins?: string } = {}): AdminSigninStore {
+/** The links a passkeys document holds: only well-formed ones. */
+function linksOf(d: Record<string, unknown> | undefined): AdminPasskey[] {
+  const list = Array.isArray(d?.passkeys) ? (d.passkeys as unknown[]) : [];
+  return list.flatMap((p) => {
+    const v = p as Record<string, unknown> | null;
+    const address = text(v?.address);
+    return address !== undefined ? [{ address, createdAt: num(v?.createdAt) ?? 0 }] : [];
+  });
+}
+
+export type FirestoreAdminSigninCollections = { requests?: string; sessions?: string; logins?: string; passkeys?: string; once?: string };
+
+export function createFirestoreAdminSignin(db: FirestoreAdminSigninLike, collections: FirestoreAdminSigninCollections = {}): Required<AdminSigninStore> {
   const requestsCol = () => db.collection(collections.requests ?? "signin_requests");
   const sessionsCol = () => db.collection(collections.sessions ?? "sessions");
   const loginsCol = () => db.collection(collections.logins ?? "admin_logins");
+  const passkeysCol = () => db.collection(collections.passkeys ?? "admin_passkeys");
+  const onceCol = () => db.collection(collections.once ?? "admin_once");
 
   const sessionData = (s: AdminSessionRecord) => ({ address: s.address, createdAt: s.createdAt, expiresAt: s.expiresAt, via: s.via, scope: "admin", deleteAt: new Date(s.expiresAt) });
 
@@ -201,7 +218,57 @@ export function createFirestoreAdminSignin(db: FirestoreAdminSigninLike, collect
       const old = (await requestsCol().where("expiresAt", "<", now - 2 * 3_600_000).limit(BATCH).get()).docs.filter((d) => d.data().scope === "admin");
       const ended = (await sessionsCol().where("expiresAt", "<", now).limit(BATCH).get()).docs.filter((d) => d.data().scope === "admin");
       const logins = (await loginsCol().where("at", "<", now - ADMIN_LOGIN_KEEP_MS).limit(BATCH).get()).docs;
-      await deleteAll([...old, ...ended, ...logins]);
+      const used = (await onceCol().where("until", "<", now + 1).limit(BATCH).get()).docs;
+      await deleteAll([...old, ...ended, ...logins, ...used]);
+    },
+    async createSession(session) {
+      const ref = sessionsCol().doc(session.idHash);
+      await db.runTransaction(async (tx) => {
+        if ((await tx.get(ref)).exists) throw new Error("a session with this id exists");
+        tx.set(ref, sessionData(session));
+      });
+    },
+    async linkPasskey(owner, address, at) {
+      const ref = passkeysCol().doc(owner);
+      return db.runTransaction(async (tx) => {
+        const d = (await tx.get(ref)).data();
+        const list = d && d.owner === owner ? linksOf(d) : [];
+        if (list.some((p) => p.address === address)) return "exists" as const;
+        if (list.length >= ADMIN_PASSKEY_LIMIT) return "full" as const;
+        tx.set(ref, { owner, passkeys: [...list, { address, createdAt: at }] });
+        return "linked" as const;
+      });
+    },
+    async unlinkPasskey(owner, address) {
+      const ref = passkeysCol().doc(owner);
+      const had = await db.runTransaction(async (tx) => {
+        const d = (await tx.get(ref)).data();
+        const list = d && d.owner === owner ? linksOf(d) : [];
+        if (!list.some((p) => p.address === address)) return false;
+        tx.set(ref, { owner, passkeys: list.filter((p) => p.address !== address) });
+        return true;
+      });
+      // The passkey's admin sessions end with its link (after it: a session read in between finds no link and is refused anyway).
+      await deleteAll((await sessionsCol().where("address", "==", address).get()).docs.filter((x) => x.data().scope === "admin" && x.data().via === "passkey"));
+      return had;
+    },
+    async passkeys(owner) {
+      const d = (await passkeysCol().doc(owner).get()).data();
+      return d && d.owner === owner ? linksOf(d) : [];
+    },
+    async linked(owner, address) {
+      const d = (await passkeysCol().doc(owner).get()).data();
+      return Boolean(d && d.owner === owner && linksOf(d).some((p) => p.address === address));
+    },
+    async useOnce(key, ttlMs) {
+      const ref = onceCol().doc(key);
+      return db.runTransaction(async (tx) => {
+        const now = Date.now();
+        const d = (await tx.get(ref)).data();
+        if (d && (num(d.until) ?? Infinity) > now) return false;
+        tx.set(ref, { until: now + ttlMs, deleteAt: new Date(now + ttlMs) });
+        return true;
+      });
     },
   };
 }