wiki-formant 0.29.0 → 0.30.0

package/README.md

@@ -632,9 +632,44 @@ leaves a wiki able to say what every crawler asked for and nothing about what
 its readers asked for. The queries that return zero rows are the valuable ones
 – they name a gap in the corpus in the reader's own words.
 
+## Passkeys and the stats page
+
+`wiki-formant/passkey` is the door to a site's own admin pages: a passkey and
+nothing else, no account, password or email. `createPasskeyGate({ sql, rpName })`
+returns the whole of it. `gate.route` is the sign-in route,
+`gate.signedIn(cookieValue)` is the check a page makes, and `gate.cookie` is the
+cookie's name. The two tables (`Passkey`, `PasskeyToken`) are stated as Prisma
+models at the top of `src/passkey.ts`, and every token is kept only as its hash.
+`@simplewebauthn/server` is an optional peer.
+
+There is no sign-up. The first passkey is saved from a single-use link that the
+`passkey-invite` bin prints from a machine holding `DATABASE_URL`, so the only
+way in is through someone who can already reach the database. A passkey is bound
+to the host it was saved on, so localhost needs its own.
+
+```ts
+// src/lib/admin.ts
+export const gate = createPasskeyGate({ sql, rpName: 'Caper' });
+
+// src/app/api/passkey/route.ts
+export const POST = gate.route;
+
+// src/app/stats/page.tsx
+if (!(await gate.signedIn((await cookies()).get(gate.cookie)?.value)))
+  return <PasskeyButton endpoint="/api/passkey" invite={invite} />;
+const days = statsDays((await searchParams).days); // 1, 7, 30 or 90, else 30
+return <Stats digest={await digest(sql, { days })} days={days} />;
+```
+
+`PasskeyButton` (`wiki-formant/passkey-button`) is the browser half and has its
+own subpath, because it imports the optional peer `@simplewebauthn/browser`.
+`Stats` (`wiki-formant/react-server`) renders a `digest` as one page: the
+headline figures against the window before, visitors per day, every non-empty
+ranked list, and `?days=` links between windows. It ships no JavaScript.
+
 ## Base stylesheet
 
-`wiki-formant/base.css` is the layout the package's markup does not work without, and nothing else: columns that stack until there is room, stored tab panels that show one at a time, a copy button pinned to its block's corner and visible on focus and on touch, a stored table's scroll box, and the `aria-sort` arrow as a mask over `currentColor`. No colour and no scale, so a design system's own rules override it at equal specificity.
+`wiki-formant/base.css` is the layout the package's markup does not work without, and nothing else: columns that stack until there is room, stored tab panels that show one at a time, a copy button pinned to its block's corner and visible on focus and on touch, a stored table's scroll box, the `aria-sort` arrow as a mask over `currentColor`, and the stats page's grid and bars. No colour and no scale, so a design system's own rules override it at equal specificity.
 
 ```css
 @import "wiki-formant/base.css" layer(components);
@@ -680,6 +715,12 @@ npx analytics-digest --days 30 --handle radixwiki --siblings caper.network,acuiq
 npx analytics-digest --days 7 --gap "Symptom Miss:term"   # adds an event to the search gaps
 ```
 
+`passkey-invite` prints a single-use link that saves a passkey for the page it names, good for a day (`--days n` for longer). Run it the same way:
+
+```sh
+npx passkey-invite https://caper.network/stats
+```
+
 ## Licence
 
 MIT.

package/bin/passkey-invite.mjs

@@ -0,0 +1,43 @@
+#!/usr/bin/env node
+// bin/passkey-invite.mjs – print a single-use link that saves a passkey for a
+// site's admin pages (`wiki-formant/passkey`). The first passkey can only come
+// from here, so the only way in is through someone who holds the database URL.
+//
+// Run from the app's root, where `pg` is installed and `.env` holds
+// DATABASE_URL (read from the environment first). The link is good for a day.
+//
+//   npx passkey-invite https://caper.network/stats
+//   npx passkey-invite http://localhost:3000/stats --days 7
+import pg from 'pg';
+import { createPasskeyGate } from '../dist/passkey.js';
+
+const args = process.argv.slice(2);
+const page = args.find(a => /^https?:\/\//.test(a));
+const days = Number(args[args.indexOf('--days') + 1] ?? 1);
+
+if (!page) {
+  console.error('usage: passkey-invite <page url> [--days n]');
+  process.exit(1);
+}
+if (!process.env.DATABASE_URL) {
+  try {
+    process.loadEnvFile('.env');
+  } catch {
+    // reported below
+  }
+}
+if (!process.env.DATABASE_URL) {
+  console.error('no DATABASE_URL in the environment or ./.env');
+  process.exit(1);
+}
+
+const client = new pg.Client({ connectionString: process.env.DATABASE_URL });
+try {
+  await client.connect();
+  const sql = (query, ...values) => client.query(query, values).then(r => r.rows);
+  const url = new URL(page);
+  url.searchParams.set('invite', await createPasskeyGate({ sql, rpName: '' }).invite(args.includes('--days') ? days : 1));
+  console.log(url.href);
+} finally {
+  await client.end().catch(() => {});
+}

package/dist/base.css

@@ -116,3 +116,57 @@ pre:hover > .code-copy-btn,
   list-style: none;
 }
 .revision-diff { margin: 0.25em 0 0; }
+
+/* ---- Stats ----------------------------------------------------------------
+   `--share` is a row's value over the largest in its list, 0 to 1. Bars take
+   `currentColor` so they show before a stylesheet colours them. */
+.stats { display: grid; gap: 2rem; }
+.stats-ranges { display: flex; flex-wrap: wrap; gap: 1rem; }
+.stats-ranges a[aria-current] { text-decoration: underline; text-underline-offset: 0.3em; }
+.stats-figures {
+  display: grid;
+  grid-template-columns: repeat(auto-fit, minmax(8rem, 1fr));
+  gap: 1rem;
+  margin: 0;
+}
+.stats-figures dd { margin: 0; font-variant-numeric: tabular-nums; }
+.stats-chart {
+  display: flex;
+  align-items: flex-end;
+  gap: 2px;
+  height: 8rem;
+  margin: 0;
+  padding: 0;
+  list-style: none;
+}
+.stats-chart li {
+  flex: 1;
+  height: calc(var(--share) * 100%);
+  min-height: 1px;
+  background: currentColor;
+  opacity: 0.4;
+}
+.stats-lists {
+  display: grid;
+  grid-template-columns: repeat(auto-fit, minmax(min(100%, 18rem), 1fr));
+  gap: 2rem;
+}
+.stats-list ol { display: grid; gap: 2px; margin: 0; padding: 0; list-style: none; }
+.stats-list li {
+  position: relative;
+  display: flex;
+  justify-content: space-between;
+  gap: 1rem;
+  padding: 0.25em 0.5em;
+}
+.stats-list li::before {
+  content: '';
+  position: absolute;
+  inset: 0 auto 0 0;
+  width: calc(var(--share) * 100%);
+  background: currentColor;
+  opacity: 0.08;
+  pointer-events: none;
+}
+.stats-list li > span:first-child { min-width: 0; overflow-wrap: anywhere; }
+.stats-count { font-variant-numeric: tabular-nums; }

package/dist/passkey-button.d.ts

@@ -0,0 +1,9 @@
+export interface PasskeyButtonProps {
+    /** The route that serves `gate.route`. */
+    endpoint: string;
+    /** The invite token from the link, when there is one. */
+    invite?: string | undefined;
+    className?: string;
+    errorClassName?: string;
+}
+export declare function PasskeyButton({ endpoint, invite, className, errorClassName }: PasskeyButtonProps): import("react").JSX.Element;

package/dist/passkey-button.js

@@ -0,0 +1,36 @@
+'use client';
+import { jsx as _jsx, Fragment as _Fragment, jsxs as _jsxs } from "react/jsx-runtime";
+// passkey-button.tsx – the browser half of `wiki-formant/passkey`.
+//
+// Its own subpath because it imports `@simplewebauthn/browser`, an optional
+// peer that only an app with a passkey door installs. With an invite it saves a
+// new passkey; without one it signs in with a saved one. Either way, success
+// reloads the page without the invite, and the server sees the new cookie.
+import { startAuthentication, startRegistration } from '@simplewebauthn/browser';
+import { useState } from 'react';
+async function post(endpoint, body) {
+    const res = await fetch(endpoint, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body) });
+    if (!res.ok)
+        throw new Error((await res.json().catch(() => null))?.error ?? 'Sign-in failed.');
+    return res.status === 204 ? null : res.json();
+}
+export function PasskeyButton({ endpoint, invite, className, errorClassName }) {
+    const [busy, setBusy] = useState(false);
+    const [error, setError] = useState(null);
+    async function go() {
+        setBusy(true);
+        setError(null);
+        try {
+            const optionsJSON = await post(endpoint, { invite });
+            const response = invite ? await startRegistration({ optionsJSON }) : await startAuthentication({ optionsJSON });
+            await post(endpoint, { invite, response });
+            location.replace(location.pathname + location.search.replace(/([?&])invite=[^&]*&?/, '$1').replace(/[?&]$/, ''));
+        }
+        catch (e) {
+            // A prompt the person closed throws NotAllowedError, which needs no message.
+            setError(e instanceof Error && e.name !== 'NotAllowedError' ? e.message : null);
+            setBusy(false);
+        }
+    }
+    return (_jsxs(_Fragment, { children: [_jsx("button", { type: "button", className: className, onClick: go, disabled: busy, children: invite ? 'Save a passkey' : 'Sign in with a passkey' }), error && (_jsx("p", { role: "alert", className: errorClassName, children: error }))] }));
+}

package/dist/passkey.d.ts

@@ -0,0 +1,27 @@
+import type { Sql } from './analytics.js';
+export type { Sql };
+export interface PasskeyGateOptions {
+    sql: Sql;
+    /** The name the browser shows when it offers to save the passkey. */
+    rpName: string;
+    /** Default `passkey_session`. */
+    cookie?: string;
+    /** How long a sign-in lasts. Default 90 days. */
+    sessionDays?: number;
+}
+export interface PasskeyGate {
+    /** The session cookie's name, for the app to read it with. */
+    cookie: string;
+    /** Whether a session cookie's value is a live session. */
+    signedIn(session: string | undefined): Promise<boolean>;
+    /** A single-use invite token, good for `days`. The bin turns it into a link. */
+    invite(days?: number): Promise<string>;
+    /**
+     * The whole sign-in route: `export const POST = gate.route`. The body is
+     * `{ invite?, response? }`: without `response` it answers with the options
+     * for the browser's prompt, with one it verifies it and sets the cookie. An
+     * invite turns the prompt into saving a new passkey.
+     */
+    route(request: Request): Promise<Response>;
+}
+export declare function createPasskeyGate({ sql, rpName, cookie, sessionDays }: PasskeyGateOptions): PasskeyGate;

package/dist/passkey.js

@@ -0,0 +1,130 @@
+// passkey.ts – the door to a site's own admin pages: a passkey, and nothing else.
+//
+// No account, no password, no email. Whoever holds a passkey saved for the
+// site is in. The first one is saved from an invite link that the
+// `passkey-invite` bin prints from a machine holding the database URL, and any
+// passkey after that comes from another invite. So the only way in is through
+// someone who can already reach the database.
+//
+// A passkey is bound to the host it was saved on. One saved on localhost does
+// not open the deployed site, and one saved on the site does not open localhost.
+//
+// Like analytics, the package owns the SQL and the app owns the connection. The
+// app declares the two tables in its own schema:
+//
+//   model Passkey {
+//     id         String   @id // the credential id, base64url
+//     publicKey  String       // base64url
+//     counter    Int
+//     transports String[]
+//     createdAt  DateTime @default(now()) @db.Timestamptz(3)
+//   }
+//
+//   model PasskeyToken {
+//     hash      String   @id // sha-256 of the token, base64url
+//     kind      String       // session | invite | challenge
+//     expiresAt DateTime @db.Timestamptz(3)
+//   }
+//
+// Every token is stored as its hash, so a read of the table opens nothing. A
+// challenge is spent the moment a response quotes it, and an invite the moment
+// a passkey is saved with it.
+import { generateAuthenticationOptions, generateRegistrationOptions, verifyAuthenticationResponse, verifyRegistrationResponse, } from '@simplewebauthn/server';
+import { clientKey, rateLimit, rateLimitedResponse } from './rate-limit.js';
+const MINUTE = 60_000;
+const DAY = 86_400_000;
+const CHALLENGE_MS = 5 * MINUTE;
+const b64url = (bytes) => Buffer.from(bytes).toString('base64url');
+const token = () => b64url(crypto.getRandomValues(new Uint8Array(32)));
+const hash = async (value) => b64url(new Uint8Array(await crypto.subtle.digest('SHA-256', new TextEncoder().encode(value))));
+/** Store a token's hash; the token is returned and kept nowhere else. */
+async function issue(sql, kind, ms, value = token()) {
+    await sql(`DELETE FROM "PasskeyToken" WHERE "expiresAt" < now()`);
+    await sql(`INSERT INTO "PasskeyToken" (hash, kind, "expiresAt") VALUES ($1, $2, now() + make_interval(secs => $3::int))`, await hash(value), kind, Math.round(ms / 1000));
+    return value;
+}
+/** True once for a live token of this kind; it is gone either way. */
+async function spend(sql, kind, value) {
+    const rows = (await sql(`DELETE FROM "PasskeyToken" WHERE hash = $1 AND kind = $2 RETURNING "expiresAt" > now() AS live`, await hash(value), kind));
+    return rows[0]?.live === true;
+}
+async function live(sql, kind, value) {
+    const rows = (await sql(`SELECT 1 FROM "PasskeyToken" WHERE hash = $1 AND kind = $2 AND "expiresAt" > now()`, await hash(value), kind));
+    return rows.length > 0;
+}
+/** Any request that fails is told only that it failed. */
+const refuse = (status, error) => Response.json({ error }, { status });
+export function createPasskeyGate({ sql, rpName, cookie = 'passkey_session', sessionDays = 90 }) {
+    async function session(secure) {
+        const value = await issue(sql, 'session', sessionDays * DAY);
+        const attrs = [`${cookie}=${value}`, 'Path=/', 'HttpOnly', 'SameSite=Lax', `Max-Age=${sessionDays * 86_400}`];
+        if (secure)
+            attrs.push('Secure');
+        return new Response(null, { status: 204, headers: { 'set-cookie': attrs.join('; ') } });
+    }
+    return {
+        cookie,
+        signedIn: async (value) => !!value && live(sql, 'session', value),
+        invite: (days = 1) => issue(sql, 'invite', days * DAY),
+        async route(request) {
+            const limited = rateLimit(clientKey('passkey', request.headers), { capacity: 10, refillPerSec: 0.2 });
+            if (!limited.ok)
+                return rateLimitedResponse(limited.retryAfterSec);
+            // The browser writes the page's origin into what it signs, and binds the
+            // passkey to the host, so the request's own origin is the one to expect.
+            const { origin, hostname: rpID, protocol } = new URL(request.url);
+            const body = (await request.json().catch(() => null));
+            const invite = typeof body?.invite === 'string' ? body.invite : undefined;
+            const response = body?.response;
+            const expectedChallenge = (challenge) => spend(sql, 'challenge', challenge);
+            if (!response) {
+                if (invite && !(await live(sql, 'invite', invite)))
+                    return refuse(403, 'This invite has expired.');
+                const options = invite
+                    ? await generateRegistrationOptions({
+                        rpName,
+                        rpID,
+                        userName: rpName,
+                        attestationType: 'none',
+                        // Discoverable, so signing in later asks for nothing: the device offers it.
+                        authenticatorSelection: { residentKey: 'required', userVerification: 'preferred' },
+                    })
+                    : await generateAuthenticationOptions({ rpID, userVerification: 'preferred' });
+                await issue(sql, 'challenge', CHALLENGE_MS, options.challenge);
+                return Response.json(options);
+            }
+            if (invite) {
+                const result = await verifyRegistrationResponse({
+                    response,
+                    expectedChallenge,
+                    expectedOrigin: origin,
+                    expectedRPID: rpID,
+                    requireUserVerification: false,
+                }).catch(() => null);
+                if (!result?.verified)
+                    return refuse(400, 'That passkey could not be saved.');
+                // Spent after the check, so a failed prompt leaves the invite to try again.
+                if (!(await spend(sql, 'invite', invite)))
+                    return refuse(403, 'This invite has expired.');
+                const { credential } = result.registrationInfo;
+                await sql(`INSERT INTO "Passkey" (id, "publicKey", counter, transports) VALUES ($1, $2, $3, $4::text[])`, credential.id, b64url(credential.publicKey), credential.counter, credential.transports ?? []);
+                return session(protocol === 'https:');
+            }
+            const [passkey] = (await sql(`SELECT id, "publicKey", counter, transports FROM "Passkey" WHERE id = $1`, String(response.id)));
+            if (!passkey)
+                return refuse(403, 'This passkey is not one this site knows.');
+            const result = await verifyAuthenticationResponse({
+                response,
+                expectedChallenge,
+                expectedOrigin: origin,
+                expectedRPID: rpID,
+                credential: { ...passkey, publicKey: new Uint8Array(Buffer.from(passkey.publicKey, 'base64url')) },
+                requireUserVerification: false,
+            }).catch(() => null);
+            if (!result?.verified)
+                return refuse(403, 'Sign-in failed.');
+            await sql(`UPDATE "Passkey" SET counter = $2 WHERE id = $1`, passkey.id, result.authenticationInfo.newCounter);
+            return session(protocol === 'https:');
+        },
+    };
+}

package/dist/react-server.d.ts

@@ -1,6 +1,7 @@
 import type { ComponentType, ReactNode } from 'react';
 import type { Control, FacetControlGroup, MetadataRow } from './taxonomy.js';
 import type { HistoryChange } from './history.js';
+import type { Digest } from './analytics.js';
 /**
  * The shape a router's link component has to satisfy here.
  *
@@ -267,3 +268,22 @@ export interface RevisionChangesProps {
  * are the importing stylesheet's.
  */
 export declare function RevisionChanges({ changes, label }: RevisionChangesProps): import("react").JSX.Element | null;
+export interface StatsProps {
+    /** One window's figures, from `digest` in `wiki-formant/analytics`. */
+    digest: Digest;
+    /** The window the digest covers, in days. */
+    days: number;
+    /** The windows offered as `?days=` links on the same page. */
+    ranges?: readonly number[];
+}
+/** The windows the stats page offers, in days. */
+export declare const STATS_RANGES: readonly [1, 7, 30, 90];
+/** A `?days=` value as one of `ranges`, else `fallback`: the page's only input. */
+export declare const statsDays: (param: unknown, ranges?: readonly number[], fallback?: number) => number;
+/**
+ * A site's own analytics on one page: the headline figures against the window
+ * before, visitors per day, and every ranked list the digest carries. Lists
+ * with nothing in them are left out. Bars are `currentColor` until the
+ * importing stylesheet gives them a colour.
+ */
+export declare function Stats({ digest: d, days, ranges }: StatsProps): import("react").JSX.Element;

package/dist/react-server.js

@@ -225,3 +225,58 @@ export function RevisionChanges({ changes, label = type => type }) {
         return null;
     return (_jsx("ul", { className: "revision-changes", children: changes.map((c, i) => (_jsxs("li", { className: "revision-change", "data-action": c.action, children: [_jsx("span", { className: "revision-change-action", children: ACTION_LABEL[c.action] }), ` – ${label(c.type)} at ${blockLocation(c.path)}`, c.leafDiff && (_jsx("p", { className: "revision-diff", children: c.leafDiff.map(([op, text], j) => op === -1 ? _jsx("del", { children: text }, j) : op === 1 ? _jsx("ins", { children: text }, j) : _jsx("span", { children: text }, j)) }))] }, i))) }));
 }
+/** The windows the stats page offers, in days. */
+export const STATS_RANGES = [1, 7, 30, 90];
+/** A `?days=` value as one of `ranges`, else `fallback`: the page's only input. */
+export const statsDays = (param, ranges = STATS_RANGES, fallback = 30) => ranges.find(n => String(n) === param) ?? fallback;
+const count = (n) => n.toLocaleString('en');
+const regions = new Intl.DisplayNames(['en'], { type: 'region' });
+const country = (code) => {
+    try {
+        return regions.of(code) ?? code;
+    }
+    catch {
+        return code;
+    }
+};
+const duration = (s) => (s < 60 ? `${s}s` : `${Math.floor(s / 60)}m ${s % 60}s`);
+/** Unsigned at zero, so no change never reads as growth. */
+const change = (now, before) => {
+    if (!before)
+        return null;
+    const pct = Math.round((100 * (now - before)) / before);
+    return pct > 0 ? `+${pct}%` : `${pct}%`;
+};
+function StatsList({ title, rows, label = v => v }) {
+    if (!rows.length)
+        return null;
+    const max = Math.max(...rows.map(([, n]) => n));
+    return (_jsxs("section", { className: "stats-list", children: [_jsx("h2", { children: title }), _jsx("ol", { children: rows.map(([v, n]) => (_jsxs("li", { style: { '--share': n / max }, children: [_jsx("span", { children: label(v) }), _jsx("span", { className: "stats-count", children: count(n) })] }, v))) })] }));
+}
+/**
+ * A site's own analytics on one page: the headline figures against the window
+ * before, visitors per day, and every ranked list the digest carries. Lists
+ * with nothing in them are left out. Bars are `currentColor` until the
+ * importing stylesheet gives them a colour.
+ */
+export function Stats({ digest: d, days, ranges = STATS_RANGES }) {
+    const byDay = new Map(d.by_day.map(r => [r.date, r.visitors]));
+    // A rolling window of n days touches n + 1 UTC dates, the first of them in part.
+    const now = Date.now();
+    const series = Array.from({ length: days + 1 }, (_, i) => {
+        const date = new Date(now - (days - i) * 86_400_000).toISOString().slice(0, 10);
+        return [date, byDay.get(date) ?? 0];
+    });
+    const peak = Math.max(1, ...series.map(([, n]) => n));
+    const figures = [
+        ['Visitors', count(d.visitors), change(d.visitors, d.previous_visitors)],
+        ['Page views', count(d.pageviews), null],
+        ['Bounce rate', d.bounce_rate == null ? '–' : `${d.bounce_rate}%`, null],
+        ['Visit length', d.visit_duration == null ? '–' : duration(d.visit_duration), null],
+        ['With agents', count(d.visitors_incl_agents), null],
+    ];
+    if (d.follow_clicks)
+        figures.push(['Clicks to X', count(d.follow_clicks.events), null]);
+    const rows = (list, k, m) => list.map(r => [r[k], r[m]]);
+    return (_jsxs("div", { className: "stats", children: [_jsx("nav", { className: "stats-ranges", "aria-label": "Window", children: ranges.map(n => (_jsx("a", { href: `?days=${n}`, "aria-current": n === days ? 'page' : undefined, children: n === 1 ? '24 hours' : `${n} days` }, n))) }), _jsx("dl", { className: "stats-figures", children: figures.map(([label, value, delta]) => (_jsxs("div", { children: [_jsx("dt", { children: label }), _jsxs("dd", { children: [value, delta && _jsx("small", { children: ` ${delta}` })] })] }, label))) }), _jsx("ol", { className: "stats-chart", "aria-label": "Visitors per day", children: series.map(([date, n]) => (_jsx("li", { title: `${date}: ${count(n)}`, style: { '--share': n / peak } }, date))) }), _jsxs("div", { className: "stats-lists", children: [_jsx(StatsList, { title: "Pages", rows: rows(d.top_pages, 'page', 'visitors') }), _jsx(StatsList, { title: "Entry pages", rows: rows(d.entry_pages, 'page', 'visitors') }), _jsx(StatsList, { title: "Sources", rows: rows(d.top_sources, 'source', 'visitors') }), _jsx(StatsList, { title: "From X posts", rows: rows(d.from_posts, 'page', 'visitors') }), _jsx(StatsList, { title: "Sibling sites", rows: rows(d.sibling_referrals, 'source', 'visitors') }), _jsx(StatsList, { title: "Countries", rows: rows(d.countries, 'country', 'visitors'), label: country }), _jsx(StatsList, { title: "Devices", rows: rows(d.devices, 'device', 'visitors') }), _jsx(StatsList, { title: "Agent tool calls", rows: rows(d.agent_tool_calls, 'tool', 'events') }), _jsx(StatsList, { title: "Searches that found nothing", rows: rows(d.gaps, 'query', 'events') })] })] }));
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wiki-formant",
-  "version": "0.29.0",
+  "version": "0.30.0",
   "description": "The portable half of a wiki: derived taxonomy and facet controls, a version-negotiating MCP transport, markdown twins, block rendering, a rich-text editor engine, and conditional-GET plumbing.",
   "type": "module",
   "license": "MIT",
@@ -62,6 +62,14 @@
       "types": "./dist/analytics.d.ts",
       "import": "./dist/analytics.js"
     },
+    "./passkey": {
+      "types": "./dist/passkey.d.ts",
+      "import": "./dist/passkey.js"
+    },
+    "./passkey-button": {
+      "types": "./dist/passkey-button.d.ts",
+      "import": "./dist/passkey-button.js"
+    },
     "./blocks": {
       "types": "./dist/blocks.d.ts",
       "import": "./dist/blocks.js"
@@ -175,7 +183,8 @@
   "bin": {
     "check-classes": "bin/check-classes.mjs",
     "check-pages": "bin/check-pages.mjs",
-    "analytics-digest": "bin/analytics-digest.mjs"
+    "analytics-digest": "bin/analytics-digest.mjs",
+    "passkey-invite": "bin/passkey-invite.mjs"
   },
   "files": [
     "dist",
@@ -190,6 +199,8 @@
     "prepare": "git config core.hooksPath .githooks || true"
   },
   "devDependencies": {
+    "@simplewebauthn/browser": "^14.0.0",
+    "@simplewebauthn/server": "^14.0.3",
     "@tiptap/core": "^2.10.0",
     "@tiptap/extension-code-block": "^2.10.0",
     "@tiptap/extension-image": "^2.27.3",
@@ -227,9 +238,11 @@
     "@tiptap/react": ">=2.10",
     "@tiptap/starter-kit": ">=2.10",
     "fast-diff": ">=1.3",
+    "pg": ">=8",
     "react": ">=18",
     "sanitize-html": ">=2",
-    "pg": ">=8"
+    "@simplewebauthn/server": ">=13",
+    "@simplewebauthn/browser": ">=13"
   },
   "peerDependenciesMeta": {
     "react": {
@@ -282,6 +295,12 @@
     },
     "pg": {
       "optional": true
+    },
+    "@simplewebauthn/server": {
+      "optional": true
+    },
+    "@simplewebauthn/browser": {
+      "optional": true
     }
   }
 }