@nano133/nanoterra 0.8.1 → 0.9.0

package/dist/player-signin/panel/mount.js

@@ -0,0 +1,105 @@
+// The sign-in sheet of a game: `mountPlayerSignin(element, options)`. It draws no key of its own: the game's account key, the shop's "sign in
+// first" and anything else call `open()`, which resolves with the player once they are signed in, or null when the sheet closes. Plain DOM; a
+// modal sheet with a scrim: from the bottom on a phone held upright, in the middle on a wide or sideways screen. Escape, the close key and a press
+// on the scrim close it. Every key is 44 px or more.
+import { h, releaseFocus } from "../../admin/panel/dom.js";
+import { icon } from "../../admin/panel/icons.js";
+import { signInView } from "./view.js";
+let mounts = 0;
+export function mountPlayerSignin(root, options) {
+    const n = ++mounts;
+    let isOpen = false;
+    let pending = null;
+    let before = null;
+    let closing;
+    const settle = (p) => {
+        const was = pending;
+        pending = null;
+        was?.resolve(p);
+    };
+    const view = signInView({
+        ...options,
+        onSignedIn(player) {
+            options.onSignedIn?.(player);
+            settle(player);
+            closing = setTimeout(close, Math.max(0, options.closeAfterMs ?? 900));
+        },
+    });
+    const titleEl = h("h2", { class: "n133s-title", id: `n133s-title-${n}` }, options.title ?? "Sign in");
+    const closeKey = h("button", { class: "n133s-close", type: "button", "aria-label": "Close" }, icon("close", 20));
+    const scrim = h("div", { class: "n133s-scrim" });
+    const panel = h("section", { class: "n133s-panel", role: "dialog", "aria-modal": "true", "aria-labelledby": `n133s-title-${n}` }, h("header", { class: "n133s-head" }, titleEl, closeKey), h("div", { class: "n133s-body" }, view.node));
+    const wrap = h("div", { class: "n133-signin n133s-sheet", "data-open": "false" }, scrim, panel);
+    wrap.hidden = true;
+    root.append(wrap);
+    function close() {
+        if (closing)
+            clearTimeout(closing);
+        closing = undefined;
+        if (!isOpen)
+            return;
+        isOpen = false;
+        view.stop();
+        wrap.dataset.open = "false";
+        wrap.hidden = true;
+        settle(null);
+        if (options.focusAfterClose === "back" && before instanceof HTMLElement)
+            before.focus();
+        else
+            releaseFocus(wrap);
+    }
+    function open() {
+        if (isOpen && pending)
+            return pending.promise;
+        if (closing)
+            clearTimeout(closing);
+        let resolve;
+        const promise = new Promise((r) => (resolve = r));
+        pending = { promise, resolve };
+        before = document.activeElement;
+        isOpen = true;
+        view.reset();
+        wrap.hidden = false;
+        wrap.dataset.open = "true";
+        (panel.querySelector(".n133s-area button") ?? closeKey).focus({ preventScroll: true });
+        return promise;
+    }
+    closeKey.addEventListener("click", close);
+    scrim.addEventListener("click", close);
+    wrap.addEventListener("keydown", (e) => {
+        if (e.key === "Escape") {
+            e.preventDefault();
+            e.stopPropagation();
+            close();
+            return;
+        }
+        if (e.key !== "Tab")
+            return;
+        // The focus stays in the sheet while it is open.
+        const keys = Array.from(panel.querySelectorAll("button:not([disabled]), a[href], [tabindex]:not([tabindex='-1'])")).filter((el) => !el.closest("[hidden]"));
+        if (!keys.length)
+            return;
+        const first = keys[0];
+        const last = keys[keys.length - 1];
+        if (e.shiftKey && document.activeElement === first) {
+            e.preventDefault();
+            last.focus();
+        }
+        else if (!e.shiftKey && document.activeElement === last) {
+            e.preventDefault();
+            first.focus();
+        }
+    });
+    return {
+        open,
+        close,
+        get isOpen() {
+            return isOpen;
+        },
+        destroy() {
+            close();
+            view.stop();
+            wrap.remove();
+        },
+    };
+}

package/dist/player-signin/panel/view.d.ts

@@ -0,0 +1,45 @@
+import { type PasskeyScheme } from "@nano133/signin/passkey";
+import { type Way } from "../types.js";
+export type SignedIn = {
+    address: string;
+    via: "wallet" | "passkey";
+};
+export type PlayerSigninViewOptions = {
+    /** The game's name: the device shows it next to the passkey ("Coin Bees · 1 Nov 2026"). */
+    name: string;
+    /** The game's FROZEN passkey scheme (see "/player-signin": checkScheme, schemeVector). Needed while the passkey is offered. */
+    scheme?: PasskeyScheme;
+    /** Offer the passkey. Default: on, except on a preview address (`*.workers.dev`, see `previewHost`): a passkey made there is lost when the game
+     *  moves to its own domain. `true` offers it there too. */
+    passkey?: boolean;
+    /** The passkeys' relying party id: the game's domain. Default: the page's host name. The passkey is offered on this host and its subdomains only. */
+    rpId?: string;
+    /** The wallet apps, in the sheet's order. Default: Berry Wallet, NanChat, Nautilus. */
+    ways?: readonly Way[];
+    /** Where the handler's routes are. Default "/api/signin". */
+    base?: string;
+    /** Show "Keep a spare key" after a new passkey. Default true. */
+    spareKey?: boolean;
+    /** The person check (Turnstile): fills `box` and gives its token, before a wallet start and a passkey sign-in. No hook: no check. */
+    personCheck?: (box: HTMLElement) => Promise<string | null | undefined>;
+    /** Draws a QR code of `text` (a wallet's link), for a screen with a mouse. No hook: the link is shown as a link. */
+    qr?: (text: string) => HTMLElement;
+    /** The player signed in. */
+    onSignedIn?: (player: SignedIn) => void;
+    /** The `fetch` to use (default: the page's). */
+    fetch?: typeof fetch;
+    /** A touch screen (one key that opens the app) or not (a QR code). Default: `(pointer: coarse)`. */
+    touch?: boolean;
+};
+export type PlayerSigninView = {
+    node: HTMLElement;
+    /** Ends the waiting and any device prompt (the sheet closed). */
+    stop(): void;
+    /** Starts again at the ways (the sheet opens again). */
+    reset(): void;
+};
+/** True when the page's host may ask for a passkey of `rpId`: the same host, or a subdomain of it. An IP address never may. */
+export declare function hostFits(hostname: string, rpId: string): boolean;
+/** The passkey's name in the device's list: the game and the day it was made (the account does not exist yet). */
+export declare const passkeyName: (game: string, now?: Date) => string;
+export declare function signInView(options: PlayerSigninViewOptions): PlayerSigninView;

package/dist/player-signin/panel/view.js

@@ -0,0 +1,360 @@
+// The player's sign-in, ready to put in a sheet: `signInView(options)` gives { node, stop, reset }. Plain DOM, no framework, no browser dialog.
+//
+//   1. The ways: "Use a passkey" first (Face ID, Touch ID or the device PIN), then the wallet apps as tiles. A browser that reports no passkey PRF
+//      shows the passkey last, with "Not on this browser".
+//   2. The passkey: "Use my passkey" and "Make a passkey" (the main key is "Use" when this browser made or used one before). A new passkey is made,
+//      then used at once (its seed comes from a USE, never from the answer at create: @nano133/signin/passkey); where the browser allows one prompt
+//      per press, one key "Open my passkey" finishes it. A NEW account then shows "Keep a spare key" (it can be skipped, not missed). The purse signs
+//      the game's sign-in text in the page (@nano133/signin/purse, loaded only then) and the server checks it ({base}/passkey).
+//   3. A wallet app: on a touch screen one key that opens the app; with a mouse its QR code (the game's `qr` hook) for the phone. The page asks every
+//      2 seconds until the wallet has signed (5 minutes at most).
+//
+// The seed lives in local variables of one sign-in only: never in storage, a log, an error text or an address. The page remembers only the passkeys'
+// ids and the last way (./memo.ts).
+import { firstUse, makePasskey, openPasskey, PasskeyError, passkeyFault, passkeySupport } from "@nano133/signin/passkey";
+import { ApiError, createApi } from "../../admin/panel/api.js";
+import { h, shortAddress } from "../../admin/panel/dom.js";
+import { icon } from "../../admin/panel/icons.js";
+import { checkScheme } from "../scheme-check.js";
+import { previewHost } from "../host.js";
+import { WAYS } from "../types.js";
+import { readMemo, rememberLast, rememberMade, rememberOpened } from "./memo.js";
+import { faultWords } from "./words.js";
+/** The wallets, with letters, not logos: no wallet's licence clearly allows its logo. */
+const WALLETS = {
+    berry: { name: "Berry Wallet", mark: "B" },
+    nanchat: { name: "NanChat", mark: "NC" },
+    nautilus: { name: "Nautilus", mark: "N" },
+};
+const NS = "http://www.w3.org/2000/svg";
+/** A key, the passkey's mark (drawn here: the shared icons have none). */
+function keyIcon(size = 26) {
+    const svg = document.createElementNS(NS, "svg");
+    for (const [k, v] of Object.entries({ viewBox: "0 0 24 24", width: size, height: size, fill: "none", stroke: "currentColor", "stroke-width": 1.9, "stroke-linecap": "round", "stroke-linejoin": "round", "aria-hidden": "true", focusable: "false" }))
+        svg.setAttribute(k, String(v));
+    for (const d of ["M14.5 9.5a4.5 4.5 0 1 1-1.3-3.2", "M13.2 6.3 21 6.3M18 6.3v3M21 6.3v2.2"]) {
+        const p = document.createElementNS(NS, "path");
+        p.setAttribute("d", d);
+        svg.append(p);
+    }
+    const c = document.createElementNS(NS, "circle");
+    for (const [k, v] of Object.entries({ cx: 10, cy: 9.5, r: 1.4, fill: "currentColor", stroke: "none" }))
+        c.setAttribute(k, String(v));
+    svg.append(c);
+    return svg;
+}
+/** True when the page's host may ask for a passkey of `rpId`: the same host, or a subdomain of it. An IP address never may. */
+export function hostFits(hostname, rpId) {
+    if (!hostname || /^[\d.]+$/.test(hostname) || hostname.includes(":"))
+        return false;
+    return hostname === rpId || hostname.endsWith(`.${rpId}`);
+}
+/** The passkey's name in the device's list: the game and the day it was made (the account does not exist yet). */
+export const passkeyName = (game, now = new Date()) => `${game} · ${now.toLocaleDateString("en-GB", { day: "numeric", month: "short", year: "numeric" })}`;
+export function signInView(options) {
+    const base = options.base ?? "/api/signin";
+    const api = createApi("", options.fetch ?? ((...a) => fetch(...a)));
+    const ways = (options.ways ?? WAYS).filter((w) => WAYS.includes(w));
+    const rpId = options.rpId ?? location.hostname;
+    const passkeyOn = options.passkey ?? !previewHost(rpId);
+    const scheme = passkeyOn ? checkScheme(options.scheme) : null;
+    const touch = () => options.touch ?? (typeof matchMedia === "function" && matchMedia("(pointer: coarse)").matches);
+    let stopped = false;
+    let timer;
+    let prompt = null;
+    /** The wallet request that is waiting. Back keeps it: the player may have approved it already. */
+    let current = null;
+    let support = "unknown";
+    const status = h("p", { class: "n133s-status", role: "status", "aria-live": "polite" });
+    const check = h("div", { class: "n133s-check" });
+    check.hidden = true;
+    const area = h("div", { class: "n133s-area" });
+    const node = h("div", { class: "n133-signin n133s-view" }, area, check, status);
+    const say = (text) => (status.textContent = text);
+    const busy = (on) => {
+        for (const b of Array.from(area.querySelectorAll("button")))
+            b.disabled = on;
+        node.toggleAttribute("aria-busy", on);
+    };
+    const key = (text, onclick, kind = "plain") => h("button", { class: `n133s-btn n133s-${kind}`, type: "button", onclick }, text);
+    const backKey = () => h("button", { class: "n133s-back", type: "button", onclick: () => showWays() }, icon("back", 18), h("span", {}, "Back"));
+    const title = (text) => h("h3", { class: "n133s-step", tabindex: "-1" }, text);
+    const focusFirst = () => (area.querySelector("h3, button:not([disabled])") ?? area).focus?.({ preventScroll: true });
+    const setup = () => ({ rpId, rpName: options.name, scheme: scheme, userName: passkeyName(options.name), exclude: readMemo(rpId).ids });
+    /** Puts these in the area (a null is left out). */
+    const fill = (...parts) => area.replaceChildren(...parts.filter((p) => p !== null));
+    const personToken = async () => (options.personCheck ? options.personCheck(check) : undefined);
+    function stopWaiting() {
+        if (timer)
+            clearTimeout(timer);
+        timer = undefined;
+        prompt?.abort();
+        prompt = null;
+    }
+    function done(player) {
+        stopWaiting();
+        current = null;
+        area.replaceChildren(h("p", { class: "n133s-done" }, icon("check", 22), h("span", {}, `Signed in as ${shortAddress(player.address)}`)));
+        say("");
+        options.onSignedIn?.(player);
+    }
+    // ---- the ways ----
+    function passkeyTile() {
+        const off = support === "no";
+        const last = readMemo(rpId).last === "passkey";
+        return h("button", { class: `n133s-pk${off ? " is-off" : ""}`, type: "button", onclick: () => showPasskey() }, h("span", { class: "n133s-pk-mark" }, keyIcon()), h("span", { class: "n133s-pk-words" }, h("strong", {}, "Use a passkey"), h("small", {}, off ? "Not on this browser" : "Face ID, Touch ID or your device PIN")), last ? h("span", { class: "n133s-last" }, "Last used") : null);
+    }
+    function walletTiles() {
+        const last = readMemo(rpId).last;
+        return h("div", { class: "n133s-tiles" }, ...ways.map((w) => h("button", { class: "n133s-tile", type: "button", onclick: () => choose(w) }, h("span", { class: "n133s-mark", "aria-hidden": "true" }, WALLETS[w].mark), h("span", { class: "n133s-name" }, WALLETS[w].name), last === w ? h("span", { class: "n133s-last" }, "Last used") : null)));
+    }
+    function showWays() {
+        stopWaiting();
+        busy(false);
+        const pk = passkeyOn ? passkeyTile() : null;
+        const first = pk && support !== "no";
+        const walletsPart = ways.length ? [h("p", { class: "n133s-or" }, pk ? "Or a wallet app" : "Choose your wallet"), walletTiles()] : [];
+        fill(h("p", { class: "n133s-lead" }, "No password and no payment."), first ? pk : null, ...walletsPart, !first && pk ? h("p", { class: "n133s-or" }, "Or a passkey") : null, !first ? pk : null);
+        say("");
+    }
+    // ---- the passkey ----
+    function showFault(e) {
+        busy(false);
+        const f = passkeyFault(e);
+        const w = faultWords(f.code, rpId);
+        if (w.next === "stay")
+            return showPasskey(w.text);
+        fill(backKey(), title(w.title), h("p", { class: "n133s-text n133s-fault", "data-fault": f.code }, w.text), ways.length ? h("p", { class: "n133s-or" }, "Sign in with a wallet app") : null, ways.length ? walletTiles() : null);
+        say("");
+        focusFirst();
+    }
+    function showPasskey(note) {
+        stopWaiting();
+        busy(false);
+        if (!scheme)
+            return showWays();
+        if (typeof window === "undefined" || !window.PublicKeyCredential)
+            return showFault({ name: "NotSupportedError" });
+        if (support === "no")
+            return showFault(new PasskeyError("no-prf"));
+        if (!hostFits(location.hostname, rpId))
+            return showFault({ name: "SecurityError" });
+        const known = readMemo(rpId).ids.length > 0;
+        const use = key("Use my passkey", () => void usePasskey(), known ? "primary" : "plain");
+        const make = key("Make a passkey", () => void makeNew(), known ? "plain" : "primary");
+        area.replaceChildren(backKey(), title("Passkey"), h("p", { class: "n133s-text" }, "Face ID, Touch ID or your device PIN. The passkey stays on your device: the game never sees it."), h("div", { class: "n133s-keys" }, known ? use : make, known ? make : use));
+        say(note ?? "");
+        focusFirst();
+    }
+    async function usePasskey() {
+        busy(true);
+        say("Waiting for your passkey…");
+        prompt = new AbortController();
+        try {
+            const p = await openPasskey(setup(), prompt.signal);
+            if (stopped)
+                return;
+            await finish(p.seed, p.credentialId, false);
+        }
+        catch (e) {
+            if (!stopped)
+                showFault(e);
+        }
+    }
+    async function makeNew() {
+        busy(true);
+        say("Making your passkey…");
+        prompt = new AbortController();
+        let made;
+        try {
+            made = await makePasskey(setup(), prompt.signal);
+        }
+        catch (e) {
+            if (!stopped)
+                showFault(e);
+            return;
+        }
+        // Remembered now, before its first use: a closed sheet or a reload must not forget it.
+        rememberMade(rpId, made.credentialId);
+        if (stopped)
+            return;
+        await firstOpen(made, false);
+    }
+    /** The first use of a passkey just made. Where it gives nothing (a browser that allows one prompt per press, a closed sheet), one key finishes it. */
+    async function firstOpen(made, pick) {
+        busy(true);
+        say("Opening your passkey…");
+        prompt = new AbortController();
+        try {
+            const p = await firstUse(setup(), made, prompt.signal, pick);
+            if (stopped)
+                return;
+            await finish(p.seed, p.credentialId, true);
+        }
+        catch (e) {
+            if (stopped)
+                return;
+            const f = passkeyFault(e);
+            if (f.code !== "cancelled" && f.code !== "failed")
+                return showFault(f);
+            busy(false);
+            area.replaceChildren(title("Your passkey is made"), h("p", { class: "n133s-text" }, "Press the key to open it."), h("div", { class: "n133s-keys" }, key("Open my passkey", () => void firstOpen(made, true), "primary")));
+            say("");
+            focusFirst();
+        }
+    }
+    /** "Keep a spare key": the code shows only at the press, and the player goes on with Continue or Later. */
+    function spareKey(seed) {
+        return new Promise((resolve) => {
+            busy(false);
+            const code = h("p", { class: "n133s-code", translate: "no" });
+            const codeBox = h("div", { class: "n133s-codebox" }, code);
+            codeBox.hidden = true;
+            const go = key("Later", () => resolve(), "quiet");
+            const copyBtn = key("Copy the code", async () => {
+                try {
+                    await navigator.clipboard.writeText(seed);
+                    copyBtn.textContent = "Copied";
+                }
+                catch {
+                    copyBtn.textContent = "Copy failed: write it down";
+                }
+            });
+            codeBox.append(copyBtn);
+            const show = key("Show my code", () => {
+                code.textContent = seed.match(/.{1,16}/g).join("\n");
+                codeBox.hidden = false;
+                show.remove();
+                go.textContent = "Continue";
+                go.className = "n133s-btn n133s-primary";
+            }, "primary");
+            area.replaceChildren(title("Keep a spare key"), h("p", { class: "n133s-text" }, "Your looks belong to this passkey. If you lose it, this code brings them back."), codeBox, h("p", { class: "n133s-fine" }, "Keep it secret: whoever has it can sign in as you. To use it, import it as a seed in a Nano wallet such as Nautilus, then sign in with that wallet."), h("div", { class: "n133s-keys" }, show, go));
+            say("");
+            focusFirst();
+        });
+    }
+    async function finish(seed, credentialId, made) {
+        const fresh = made || readMemo(rpId).unopened.includes(credentialId);
+        if (fresh && options.spareKey !== false)
+            await spareKey(seed);
+        if (stopped)
+            return;
+        busy(true);
+        say("Signing in…");
+        try {
+            const { signinBody } = await import("@nano133/signin/purse");
+            const turnstile = await personToken();
+            const r = await api.post(`${base}/passkey`, { ...signinBody(location.host, seed), ...(turnstile ? { turnstile } : {}) });
+            rememberOpened(rpId, credentialId);
+            if (!stopped)
+                done({ address: r.address, via: "passkey" });
+        }
+        catch (e) {
+            if (!stopped)
+                showPasskey(e instanceof ApiError ? e.message : "Sign-in did not work. Try again.");
+        }
+    }
+    // ---- a wallet app ----
+    async function choose(way) {
+        if (current?.way === way && Date.now() < current.expiresAt)
+            return showWallet(current);
+        stopWaiting();
+        current = null;
+        busy(true);
+        say("Starting…");
+        try {
+            const turnstile = await personToken();
+            const s = await api.post(`${base}/start`, { way, ...(turnstile ? { turnstile } : {}) });
+            if (stopped)
+                return;
+            current = s;
+            rememberLast(rpId, way);
+            showWallet(s);
+            void poll(s);
+        }
+        catch (e) {
+            busy(false);
+            showWays();
+            say(e instanceof Error ? e.message : "Sign-in did not start. Try again.");
+        }
+    }
+    function showWallet(s) {
+        const name = WALLETS[s.way].name;
+        area.replaceChildren(backKey(), title(name), ...walletSteps(s, name));
+        say(`Waiting for ${name}…`);
+        focusFirst();
+    }
+    /** What the player does with the wallet: on a touch screen, one key; with a mouse, a QR code for the phone. */
+    function walletSteps(s, name) {
+        const open = (text, href, newTab = false) => h("a", { class: "n133s-btn n133s-primary", href, target: newTab ? "_blank" : undefined, rel: newTab ? "noopener" : undefined }, text);
+        const qr = (text) => {
+            if (!options.qr)
+                return h("p", { class: "n133s-fine" }, "Open this page on your phone to sign in with ", name, ".");
+            const c = options.qr(text);
+            c.setAttribute("aria-label", `QR code to sign in with ${name}`);
+            return h("div", { class: "n133s-qr" }, c);
+        };
+        const only = h("p", { class: "n133s-fine" }, `Only approve a sign-in that you started yourself, on ${location.host}.`);
+        const comeBack = h("p", { class: "n133s-fine" }, `Approve the sign-in in ${s.way === "berry" ? "your wallet" : name}, then come back to this page.`);
+        if (s.way === "nautilus") {
+            const code = h("p", { class: "n133s-text" }, "Check that Nautilus shows the code ", h("strong", { class: "n133s-signcode" }, s.code ?? ""), ".");
+            return touch() ? [code, open("Open Nautilus", s.link), comeBack] : [qr(s.link), h("p", { class: "n133s-text" }, "Scan this with Nautilus on your phone, then approve the sign-in."), code, only];
+        }
+        if (s.way === "nanchat") {
+            const here = h("p", { class: "n133s-fine" }, "On this computer: ", h("a", { href: s.link, target: "_blank", rel: "noopener" }, "open NanChat"), ".");
+            return touch() ? [open("Open NanChat", s.link, true), comeBack, only] : [qr(s.link), h("p", { class: "n133s-text" }, "Scan this with your phone's camera to open NanChat, then approve the sign-in."), only, here];
+        }
+        const other = h("a", { class: "n133s-btn n133s-plain", href: s.walletLink ?? s.link }, "Another wallet");
+        const here = h("p", { class: "n133s-fine" }, "On this computer: ", h("a", { href: s.walletLink ?? s.link }, "open a wallet"), ".");
+        return touch() ? [open("Open Berry Wallet", s.link), other, comeBack] : [qr(s.link), h("p", { class: "n133s-text" }, "Scan this with Berry Wallet on your phone, then approve the sign-in."), only, here];
+    }
+    /** The request ended without a sign-in: say why, and offer a new one. */
+    function again(s, words) {
+        current = null;
+        area.replaceChildren(backKey(), title(WALLETS[s.way].name), h("div", { class: "n133s-keys" }, key("Try again", () => void choose(s.way), "primary"), key("Choose another way", () => showWays())));
+        say(words);
+    }
+    async function poll(s) {
+        if (stopped || current !== s)
+            return;
+        if (Date.now() > s.expiresAt + 5000)
+            return again(s, "This sign-in expired.");
+        try {
+            const r = await api.post(`${base}/check`, { id: s.id, way: s.way });
+            if (stopped || current !== s)
+                return;
+            if (r.status === "signedin" && r.address)
+                return done({ address: r.address, via: "wallet" });
+            if (r.status === "elsewhere" || r.status === "used")
+                return again(s, "This sign-in was used in another browser. Start again.");
+            if (r.status === "expired")
+                return again(s, "This sign-in expired.");
+        }
+        catch (e) {
+            if (e instanceof ApiError && e.status === 429)
+                say("Too many checks. Waiting a moment…");
+        }
+        timer = setTimeout(() => void poll(s), 2000);
+    }
+    function reset() {
+        stopped = false;
+        current = null;
+        showWays();
+    }
+    showWays();
+    if (passkeyOn)
+        void passkeySupport().then((s) => {
+            support = s;
+            // Only the ways' screen depends on it: redraw it when it shows.
+            if (!stopped && area.querySelector(".n133s-pk"))
+                showWays();
+        });
+    return {
+        node,
+        stop() {
+            stopped = true;
+            stopWaiting();
+        },
+        reset,
+    };
+}

package/dist/player-signin/panel/words.d.ts

@@ -0,0 +1,8 @@
+import type { PasskeyFault } from "@nano133/signin/passkey";
+/** What to do next after a fault: stay on the passkey step, or offer the wallet apps. */
+export type FaultWords = {
+    title: string;
+    text: string;
+    next: "stay" | "wallets";
+};
+export declare function faultWords(code: PasskeyFault, rpId: string): FaultWords;

package/dist/player-signin/panel/words.js

@@ -0,0 +1,26 @@
+// The sheet's words for each passkey fault, in plain English. The fault codes are @nano133/signin's (PasskeyFault). A fault never names a seed or a
+// key, and never tells the player to delete a passkey.
+export function faultWords(code, rpId) {
+    switch (code) {
+        case "cancelled":
+            return { title: "No passkey was used", text: "No passkey was used.", next: "stay" };
+        case "no-prf":
+            return { title: "Not on this device yet", text: "This device's passkeys cannot sign in to games yet. Use a wallet app, or a passkey on another device.", next: "wallets" };
+        case "unsupported":
+            return { title: "No passkeys here", text: "This browser has no passkeys. Use a wallet app.", next: "wallets" };
+        case "other-form":
+            return { title: "Not this password manager", text: "Your password manager answered in a way this game cannot read. In the device's sheet, choose its own passkeys (iCloud Keychain or Google Password Manager), or use a wallet app.", next: "wallets" };
+        case "not-a-purse":
+            return { title: "Not this game's passkey", text: "That passkey is not one of this game's. Choose another one, or make one.", next: "stay" };
+        case "wrong-host":
+            return { title: "Wrong address", text: `Passkeys for this game work only on ${rpId}.`, next: "wallets" };
+        case "exists":
+            return { title: "You have a passkey", text: "This device has your passkey already. Use it.", next: "stay" };
+        case "unstable":
+            return { title: "Not on this device", text: "This device gave two different answers for one passkey, so it cannot sign in here. Use a wallet app.", next: "wallets" };
+        case "other-passkey":
+            return { title: "Another passkey", text: "That is another passkey. Choose the one you just made: its name has today's date.", next: "stay" };
+        default:
+            return { title: "That did not work", text: "The passkey did not work. Try again.", next: "stay" };
+    }
+}

package/dist/player-signin/scheme-check.d.ts

@@ -0,0 +1,3 @@
+import type { PasskeyScheme } from "@nano133/signin/passkey";
+/** Throws with plain words when a scheme cannot be one: three texts of 1 to 200 characters, and a version byte from 1 to 255. */
+export declare function checkScheme(scheme: PasskeyScheme): PasskeyScheme;

package/dist/player-signin/scheme-check.js

@@ -0,0 +1,14 @@
+// The check of a passkey scheme's shape, with no package: the browser sheet and the server both use it (./scheme.ts says what a scheme is).
+/** Throws with plain words when a scheme cannot be one: three texts of 1 to 200 characters, and a version byte from 1 to 255. */
+export function checkScheme(scheme) {
+    if (!scheme || typeof scheme !== "object")
+        throw new Error("pass the game's frozen passkey scheme: { input, salt, info, versionByte }");
+    for (const k of ["input", "salt", "info"]) {
+        const v = scheme[k];
+        if (typeof v !== "string" || !v.trim() || v.length > 200)
+            throw new Error(`the scheme's ${k} must be a text of 1 to 200 characters`);
+    }
+    if (!Number.isInteger(scheme.versionByte) || scheme.versionByte < 1 || scheme.versionByte > 255)
+        throw new Error("the scheme's versionByte must be a whole number from 1 to 255");
+    return scheme;
+}

package/dist/player-signin/scheme.d.ts

@@ -0,0 +1,13 @@
+import { type PasskeyScheme } from "@nano133/signin/passkey";
+import { checkScheme } from "./scheme-check.js";
+export type { PasskeyScheme };
+export { checkScheme };
+/**
+ * One fixed vector of a scheme: the seed and the address that a PRF output gives. For the game's own test, which must never change:
+ *
+ *   assert.deepEqual(await schemeVector(SCHEME, "0102…1f20"), { seed: "A3D5…", address: "nano_14kj…" });
+ */
+export declare function schemeVector(scheme: PasskeyScheme, prfHex: string): Promise<{
+    seed: string;
+    address: string;
+}>;

package/dist/player-signin/scheme.js

@@ -0,0 +1,28 @@
+// The game's passkey SCHEME: the texts that turn a passkey's secret (its PRF output) into the player's Nano account. It is the game's own, and it is
+// FROZEN: a player's looks belong to the address these exact texts give.
+//
+//   PRF input = UTF-8 scheme.input
+//   seed      = HKDF-SHA-256(ikm = the PRF output, salt = UTF-8 scheme.salt, info = UTF-8 scheme.info, 32 bytes)
+//   account   = the seed as 64 hex characters, account 0
+//
+// Write it one time, in one file of the game, and test it with fixed vectors (`schemeVector`): a PRF output, its seed, its address. A change of one
+// character gives every player another account (and so no looks). A new scheme is a new `versionByte` with new texts, never an edit. The kit offers
+// no default on purpose: a default in a library could change under the game.
+import { seedFromPrf } from "@nano133/signin/passkey";
+import { purseAddress } from "@nano133/signin/purse";
+import { checkScheme } from "./scheme-check.js";
+export { checkScheme };
+const bytesOf = (prfHex) => {
+    if (!/^[0-9a-fA-F]{64}$/.test(prfHex))
+        throw new Error("a PRF output is 64 hex characters (32 bytes)");
+    return Uint8Array.from(prfHex.match(/../g).map((b) => parseInt(b, 16)));
+};
+/**
+ * One fixed vector of a scheme: the seed and the address that a PRF output gives. For the game's own test, which must never change:
+ *
+ *   assert.deepEqual(await schemeVector(SCHEME, "0102…1f20"), { seed: "A3D5…", address: "nano_14kj…" });
+ */
+export async function schemeVector(scheme, prfHex) {
+    const seed = await seedFromPrf(bytesOf(prfHex), checkScheme(scheme));
+    return { seed, address: purseAddress(seed) };
+}