@zaisma/game-server 1.14.0 → 1.15.0

package/bench/glass.js

@@ -6315,6 +6315,9 @@ var ERROR_CODES = {
   no_top_up: { httpStatus: 404, meaning: "You have no top-up with that ID.", messageForPeople: "You have no such top-up." },
   no_spending_request: { httpStatus: 404, meaning: "You have no spending request with that ID.", messageForPeople: "You have no such spending request." },
   top_up_not_refundable: { httpStatus: 409, meaning: "The top-up has nothing left to refund: it's spent, refunded, or over 30 days old.", messageForPeople: "This top-up has nothing left to refund: it's spent, refunded or over 30 days old." },
+  bad_refill_level_cents: { httpStatus: 400, meaning: "refill_level_cents isn't a whole number of cents from 1,000 ($10) to 1,000,000 ($10,000).", messageForPeople: "A monthly plan's level is from $10 to $10,000." },
+  already_credit_plan: { httpStatus: 409, meaning: "The developer already has a monthly credit plan, so there's nothing to start: change its level or stop it.", messageForPeople: "You already have a monthly credit plan." },
+  no_credit_plan: { httpStatus: 409, meaning: "The developer has no monthly credit plan to change or stop.", messageForPeople: "There's no monthly credit plan to change or stop." },
   already_pro: { httpStatus: 409, meaning: "The developer already has a Zaisma Pro subscription (running, cancelled until the month ends, or a renewal Stripe is retrying), so there's nothing to start.", messageForPeople: "You already have Zaisma Pro." },
   pro_not_refundable: { httpStatus: 409, meaning: "Zaisma Pro's payment can't be refunded: only the first payment, within 14 days of it, and only while it's the only one.", messageForPeople: "Only the first Zaisma Pro payment is refunded, within 14 days of it, while it's the only one." },
   not_pro: { httpStatus: 409, meaning: "There's nothing to cancel or resume: the developer has no Zaisma Pro, or it's already cancelled (or isn't cancelled).", messageForPeople: "There's no Zaisma Pro here to cancel or resume." },
@@ -7466,6 +7469,60 @@ function markSha256(kind, given) {
   return sha256Hex(new TextEncoder().encode(kind === "email" ? given.trim().toLowerCase() : given));
 }
 
+// ../core/src/standing.ts
+var STANDING_LIMITS = {
+  minimumDeveloperAccountAgeDays: 14,
+  minimumReturningPlayerCount: 20,
+  /** Different days a player's plays counted on the developer's games, for the player to be a returning one. */
+  minimumReturningPlayerCountedDayCount: 2,
+  /** A returning player's own account: this old, with plays counted on this many different days on any game. */
+  minimumPlayerAccountAgeDays: 7,
+  minimumPlayerCountedDayCount: 3,
+  /** After a version is rejected or a game taken down, the developer's powers wait this long. */
+  rulingWaitDurationDays: 30,
+  /** A new 16–17 account set to chat with anyone chats only with friends until it's this old, with plays counted on this many different days. */
+  minimumStrangerChatAccountAgeHours: 24,
+  minimumStrangerChatCountedDayCount: 2
+};
+var DAY_MS = 864e5;
+var NO_STANDING = {
+  isEstablishedDeveloper: false,
+  outsideLinksEnabled: false,
+  searchEnginesEnabled: false,
+  returningPlayerCount: 0,
+  accountAgeDays: 0,
+  lastRulingAtMs: null,
+  rulingWaitEndsAtMs: null,
+  hasCardOrStripeAccount: false,
+  isBanned: false
+};
+function rulingWaitEndsAt(lastRulingAtMs, nowMs) {
+  if (lastRulingAtMs === null) return null;
+  const endsAtMs = lastRulingAtMs + STANDING_LIMITS.rulingWaitDurationDays * DAY_MS;
+  return endsAtMs > nowMs ? endsAtMs : null;
+}
+async function standingOf(database, ownerId, nowMs) {
+  if (!ownerId) return NO_STANDING;
+  const row2 = await database.prepare(
+    `SELECT owners.is_established, owners.is_zaisma_account, owners.returning_player_count, owners.last_ruling_at_ms, owners.created_at_ms AS owner_created_at_ms,
+        owners.stripe_account_id, owners.can_take_stripe_payments, accounts.created_at_ms AS account_created_at_ms, accounts.banned_at_ms,
+        EXISTS (SELECT 1 FROM owner_cards WHERE owner_cards.owner_id = owners.id AND NOT EXISTS (SELECT 1 FROM banned_marks WHERE banned_marks.mark_kind = 'card' AND banned_marks.mark_sha256 = owner_cards.card_fingerprint_sha256)) AS has_card
+      FROM owners LEFT JOIN accounts ON accounts.id = owners.account_id WHERE owners.id = ?`
+  ).bind(ownerId).first();
+  if (!row2) return NO_STANDING;
+  const accountAgeDays = Math.max(0, Math.floor((nowMs - (row2.account_created_at_ms ?? row2.owner_created_at_ms)) / DAY_MS));
+  const rulingWaitEndsAtMs = rulingWaitEndsAt(row2.last_ruling_at_ms, nowMs);
+  const hasCardOrStripeAccount = row2.has_card === 1 || row2.stripe_account_id !== null && row2.can_take_stripe_payments === 1;
+  const isBanned = row2.banned_at_ms !== null;
+  const facts2 = { returningPlayerCount: row2.returning_player_count, accountAgeDays, lastRulingAtMs: row2.last_ruling_at_ms, rulingWaitEndsAtMs, hasCardOrStripeAccount, isBanned };
+  if (isBanned || rulingWaitEndsAtMs !== null) return { ...NO_STANDING, ...facts2 };
+  const isEstablishedDeveloper = row2.is_established === 1 || row2.is_zaisma_account === 1;
+  return { ...facts2, isEstablishedDeveloper, outsideLinksEnabled: isEstablishedDeveloper || hasCardOrStripeAccount, searchEnginesEnabled: isEstablishedDeveloper };
+}
+async function noteRuling(database, ownerId, nowMs) {
+  await database.prepare("UPDATE owners SET last_ruling_at_ms = ?, is_established = 0 WHERE id = ?").bind(nowMs, ownerId).run();
+}
+
 // ../core/src/blocks.ts
 var MAXIMUM_OTHER_PLAYER_COUNT = 100;
 
@@ -7714,6 +7771,9 @@ var SECURITY_EVENT_DESCRIPTIONS = {
   where_used_from_turned_on: "Turned on Keep where my account is used from",
   credit_top_up_started: "Started a credit top-up",
   credit_refunded: "Refunded hosting credit",
+  credit_plan_started: "Started a monthly credit plan",
+  credit_plan_changed: "Changed the monthly credit plan's level",
+  credit_plan_stopped: "Stopped the monthly credit plan",
   pro_checkout_started: "Started Zaisma Pro",
   pro_cancelled: "Cancelled Zaisma Pro",
   pro_resumed: "Took back cancelling Zaisma Pro",
@@ -7796,6 +7856,9 @@ var ACCOUNT_EVENT_KINDS = [
   "account_data_downloaded",
   "credit_top_up_started",
   "credit_refunded",
+  "credit_plan_started",
+  "credit_plan_changed",
+  "credit_plan_stopped",
   "pro_checkout_started",
   "pro_cancelled",
   "pro_resumed",
@@ -7866,12 +7929,13 @@ var TRUSTED_LINK_DOMAINS = [
 var linksOf = (game) => JSON.parse(game.links || "[]");
 var isUnder = (host, domain) => host === domain || host.endsWith(`.${domain}`);
 var isTrustedLinkHost = (host) => TRUSTED_LINK_DOMAINS.some((domain) => isUnder(host, domain));
-function linkAudience(link) {
+function linkAudience(link, outsideLinksEnabled) {
   if (link.review_reason) return "nobody";
-  return isTrustedLinkHost(new URL(link.destination_url).hostname) ? "everyone" : "signed_in_adults";
+  if (isTrustedLinkHost(new URL(link.destination_url).hostname)) return "everyone";
+  return outsideLinksEnabled ? "signed_in_adults" : "waiting_for_standing";
 }
-function canOpenLink(link, isSignedInAdult) {
-  const audience = linkAudience(link);
+function canOpenLink(link, isSignedInAdult, outsideLinksEnabled) {
+  const audience = linkAudience(link, outsideLinksEnabled);
   return audience === "everyone" || audience === "signed_in_adults" && isSignedInAdult;
 }
 var BRAND_DOMAINS = [
@@ -8464,7 +8528,7 @@ var BROTLI_LIMITS = {
 var MAXIMUM_DATABASE_SIZE_BYTES = 10 * 1024 ** 3;
 
 // ../core/src/hosting.ts
-var DAY_MS = 24 * 36e5;
+var DAY_MS2 = 24 * 36e5;
 var USAGE_FIELDS = {
   room_play_duration_sec: "roomPlayDurationSec",
   room_awake_duration_sec: "roomAwakeDurationSec",
@@ -8686,12 +8750,12 @@ function readCron(cron) {
   return { cronTimes };
 }
 var SEARCH_DAY_COUNT = 8 * 366;
-var DAY_MS2 = 864e5;
+var DAY_MS3 = 864e5;
 function nextAtMs(cronTimes, afterMs) {
   const firstMs = Math.floor(afterMs / 6e4) * 6e4 + 6e4;
-  const firstDayMs = Math.floor(firstMs / DAY_MS2) * DAY_MS2;
+  const firstDayMs = Math.floor(firstMs / DAY_MS3) * DAY_MS3;
   for (let dayIndex = 0; dayIndex < SEARCH_DAY_COUNT; dayIndex++) {
-    const dayMs = firstDayMs + dayIndex * DAY_MS2;
+    const dayMs = firstDayMs + dayIndex * DAY_MS3;
     const date2 = new Date(dayMs);
     if (!cronTimes.months[date2.getUTCMonth() + 1]) continue;
     const isMonthDay = cronTimes.monthDays[date2.getUTCDate()];
@@ -26292,7 +26356,7 @@ var MAXIMUM_START_DELAY_DAYS = 90;
 var START_GRACE_DURATION_MS = 36e5;
 var ENDED_SHOWN_DURATION_DAYS = 30;
 var DEFAULT_LINK_LABEL = "Read more";
-var DAY_MS3 = 864e5;
+var DAY_MS4 = 864e5;
 var shownLinkLabel = (announcement) => announcement.link_url ? announcement.link_label ?? DEFAULT_LINK_LABEL : null;
 async function currentAnnouncements(env2, nowMs) {
   const { results } = await env2.DB.prepare("SELECT * FROM announcements WHERE ends_at_ms > ? AND starts_at_ms <= ? ORDER BY starts_at_ms DESC, created_at_ms DESC LIMIT 20").bind(nowMs, nowMs).all();
@@ -26304,7 +26368,7 @@ function announcementStatus(announcement, nowMs) {
 }
 async function listAnnouncements(env2) {
   const nowMs = Date.now();
-  const { results } = await env2.DB.prepare("SELECT * FROM announcements WHERE ends_at_ms > ? ORDER BY starts_at_ms DESC, created_at_ms DESC LIMIT 100").bind(nowMs - ENDED_SHOWN_DURATION_DAYS * DAY_MS3).all();
+  const { results } = await env2.DB.prepare("SELECT * FROM announcements WHERE ends_at_ms > ? ORDER BY starts_at_ms DESC, created_at_ms DESC LIMIT 100").bind(nowMs - ENDED_SHOWN_DURATION_DAYS * DAY_MS4).all();
   const [shown] = await currentAnnouncements(env2, nowMs);
   return { announcements: results, shownAnnouncementId: shown?.id ?? null, nowMs };
 }
@@ -26317,7 +26381,7 @@ function readTime(given, field) {
   const atMs = typeof given === "string" && ISO_TIME.test(given) ? Date.parse(given) : NaN;
   if (!Number.isFinite(atMs)) {
     const said = typeof given === "string" ? `"${given.slice(0, 40)}"` : `a ${typeof given}`;
-    throw new ApiError("bad_time", { message: `${field} is ${said}, not an ISO time.`, field, fix: `Give an ISO time with Z or an offset, like "${new Date(Date.now() + 7 * DAY_MS3).toISOString().slice(0, 14)}00:00Z".` });
+    throw new ApiError("bad_time", { message: `${field} is ${said}, not an ISO time.`, field, fix: `Give an ISO time with Z or an offset, like "${new Date(Date.now() + 7 * DAY_MS4).toISOString().slice(0, 14)}00:00Z".` });
   }
   return atMs;
 }
@@ -26356,11 +26420,11 @@ async function postAnnouncement(env2, toPost, actor) {
     throw new ApiError("bad_link_label", { message: `link_label is ${linkLabel.length} characters, not 1 to ${MAXIMUM_LINK_LABEL_CHARACTER_COUNT}.`, field: "link_label", fix: `Give 1 to ${MAXIMUM_LINK_LABEL_CHARACTER_COUNT} characters, like "See what's new", or leave it out for "${DEFAULT_LINK_LABEL}".` });
   }
   const startsAtMs = toPost.startsAt === void 0 ? nowMs : readTime(toPost.startsAt, "starts_at");
-  if (startsAtMs < nowMs - START_GRACE_DURATION_MS || startsAtMs > nowMs + MAXIMUM_START_DELAY_DAYS * DAY_MS3) {
+  if (startsAtMs < nowMs - START_GRACE_DURATION_MS || startsAtMs > nowMs + MAXIMUM_START_DELAY_DAYS * DAY_MS4) {
     throw new ApiError("bad_time", { message: `starts_at ${iso(startsAtMs)} isn't from an hour ago to ${MAXIMUM_START_DELAY_DAYS} days ahead.`, field: "starts_at", fix: "Leave starts_at out to show it now, or give a time up to 90 days ahead." });
   }
   const endsAtMs = readTime(toPost.endsAt, "ends_at");
-  const latestEndAtMs = startsAtMs + MAXIMUM_ANNOUNCEMENT_DURATION_DAYS * DAY_MS3;
+  const latestEndAtMs = startsAtMs + MAXIMUM_ANNOUNCEMENT_DURATION_DAYS * DAY_MS4;
   if (endsAtMs <= startsAtMs || endsAtMs <= nowMs || endsAtMs > latestEndAtMs) {
     throw new ApiError("bad_time", {
       message: endsAtMs > latestEndAtMs ? `ends_at ${iso(endsAtMs)} is more than ${MAXIMUM_ANNOUNCEMENT_DURATION_DAYS} days after starts_at.` : `ends_at ${iso(endsAtMs)} isn't after ${endsAtMs <= nowMs ? "now" : "starts_at"}.`,
@@ -27588,6 +27652,12 @@ function encodeHeader(text4) {
   return `=?UTF-8?B?${b64}?=`;
 }
 
+// ../../apps/site/src/standing.ts
+async function noteRulingOnGame(env2, gameId, nowMs = Date.now()) {
+  const game = await env2.DB.prepare("SELECT owner_id FROM games WHERE id = ?").bind(gameId).first();
+  if (game?.owner_id) await noteRuling(env2.DB, game.owner_id, nowMs);
+}
+
 // ../../apps/site/src/upload.ts
 async function deletePrefix(bucket, prefix) {
   let cursor;
@@ -27824,7 +27894,7 @@ async function reviewPrecedentAction(env2, path, form, actor) {
 var CODE_DURATION_MIN = 10;
 var CODE_DURATION_MS = CODE_DURATION_MIN * 6e4;
 var HOUR_MS4 = 36e5;
-var DAY_MS4 = 24 * HOUR_MS4;
+var DAY_MS5 = 24 * HOUR_MS4;
 async function deliverEmail(env2, email, message2) {
   try {
     if (env2.EMAIL_OUTBOX_URL) {
@@ -27910,6 +27980,7 @@ async function stopCopy(env2, version, actor) {
   const rejectedReason = decidedReason("rejected_by_zaisma", "copyright", "A re-upload of another developer's game.");
   await saveScan(env2.DB, version.id, "rejected", null);
   await env2.DB.prepare("UPDATE versions SET review_reason = ? WHERE id = ?").bind(JSON.stringify(rejectedReason), version.id).run();
+  await noteRulingOnGame(env2, version.game_id);
   await audit(env2.DB, version.game_id, "rejected", `${version.id}: a re-upload of another developer's game`, actor, rejectedReason);
   await tellWebhooks(env2, "scan_status_changed", version.game_id, { versionId: version.id });
   const original = await gameById(env2.DB, report.matched_game.game_id);
@@ -46696,9 +46767,9 @@ function previewLinkToken(version, nowMs = Date.now()) {
 }
 
 // ../../apps/site/src/performance-check.ts
-var DAY_MS5 = 24 * 3600 * 1e3;
+var DAY_MS6 = 24 * 3600 * 1e3;
 async function dailyCheckCount(env2, ownerId, nowMs = Date.now()) {
-  const counted = await env2.DB.prepare("SELECT COUNT(*) AS check_count FROM performance_checks WHERE owner_id = ? AND queued_at_ms >= ? AND check_status != 'over_daily_limit'").bind(ownerId, nowMs - nowMs % DAY_MS5).first();
+  const counted = await env2.DB.prepare("SELECT COUNT(*) AS check_count FROM performance_checks WHERE owner_id = ? AND queued_at_ms >= ? AND check_status != 'over_daily_limit'").bind(ownerId, nowMs - nowMs % DAY_MS6).first();
   return counted?.check_count ?? 0;
 }
 async function queuePerformanceCheck(env2, version) {
@@ -46796,9 +46867,9 @@ Keep the summary and why short and plain.`;
 
 // ../../apps/site/src/security-alerts.ts
 var HOUR_MS6 = 36e5;
-var DAY_MS6 = 24 * HOUR_MS6;
+var DAY_MS7 = 24 * HOUR_MS6;
 async function securitySpikesAnswer(env2, nowMs = Date.now()) {
-  const { results } = await env2.DB.prepare("SELECT * FROM security_spikes WHERE alerted_at_ms IS NOT NULL AND last_happened_at_ms > ? ORDER BY hour_number DESC, occurrence_count DESC LIMIT 100").bind(nowMs - SECURITY_SIGNAL_KEPT_DURATION_DAYS * DAY_MS6).all();
+  const { results } = await env2.DB.prepare("SELECT * FROM security_spikes WHERE alerted_at_ms IS NOT NULL AND last_happened_at_ms > ? ORDER BY hour_number DESC, occurrence_count DESC LIMIT 100").bind(nowMs - SECURITY_SIGNAL_KEPT_DURATION_DAYS * DAY_MS7).all();
   return {
     security_spikes: results.map((row2) => ({
       spike_kind: row2.spike_kind,
@@ -46814,7 +46885,7 @@ async function blockedScriptsAnswer(env2, nowMs = Date.now()) {
   const { results } = await env2.DB.prepare(
     `SELECT violated_directive, blocked_source, page_path, SUM(occurrence_count) AS occurrence_count, MIN(first_reported_at_ms) AS first_reported_at_ms, MAX(last_reported_at_ms) AS last_reported_at_ms
      FROM blocked_scripts WHERE last_reported_at_ms > ? GROUP BY violated_directive, blocked_source, page_path ORDER BY occurrence_count DESC LIMIT 100`
-  ).bind(nowMs - 7 * DAY_MS6).all();
+  ).bind(nowMs - 7 * DAY_MS7).all();
   return {
     blocked_scripts: results.map((row2) => ({
       violated_directive: row2.violated_directive,
@@ -46828,9 +46899,9 @@ async function blockedScriptsAnswer(env2, nowMs = Date.now()) {
 }
 
 // ../../apps/site/src/device-marks.ts
-var DAY_MS7 = 864e5;
+var DAY_MS8 = 864e5;
 var MARK_DURATION_DAYS = 365;
-var MARK_DURATION_MS = MARK_DURATION_DAYS * DAY_MS7;
+var MARK_DURATION_MS = MARK_DURATION_DAYS * DAY_MS8;
 
 // ../../apps/site/src/leaked-keys.ts
 var MAXIMUM_GITHUB_BODY_SIZE_BYTES = 1024 * 1024;
@@ -47616,6 +47687,9 @@ var API_ROUTES = [
   call({ method: "POST", path: "/pro/resume", reaches: "account", access: needs("credit_access", "write"), isAccountWide: true }),
   call({ method: "POST", path: "/pro/refund", reaches: "account", access: needs("credit_access", "write"), isAccountWide: true }),
   call({ method: "POST", path: "/credit/refunds", reaches: "account", access: needs("credit_access", "write"), isAccountWide: true, body: { inputs: plainInputs("top_up_id") } }),
+  call({ method: "POST", path: "/credit/plan/checkout", reaches: "account", access: needs("credit_access", "write"), isAccountWide: true, body: { inputs: plainInputs("refill_level_cents") } }),
+  call({ method: "PATCH", path: "/credit/plan", reaches: "account", access: needs("credit_access", "write"), isAccountWide: true, body: { inputs: plainInputs("refill_level_cents") } }),
+  call({ method: "POST", path: "/credit/plan/stop", reaches: "account", access: needs("credit_access", "write"), isAccountWide: true }),
   call({ method: "GET", path: "/stripe-account", reaches: "account", access: needs("stripe_account_access", "read"), isAccountWide: true }),
   call({ method: "POST", path: "/stripe-account/connection-links", reaches: "account", access: needs("stripe_account_access", "write"), isAccountWide: true }),
   call({ method: "PATCH", path: "/stripe-account", reaches: "account", access: needs("stripe_account_access", "write"), isAccountWide: true, body: { inputs: plainInputs("is_stripe_tax_used") } }),
@@ -47734,6 +47808,7 @@ function findingsFor(report) {
 }
 var splitLabels = (labels) => labels ? labels.split(",") : [];
 async function gameJson(env2, game) {
+  const { outsideLinksEnabled } = await standingOf(env2.DB, game.owner_id, Date.now());
   const waitingWords = game.details_waiting_for_review ? JSON.parse(game.details_waiting_for_review) : null;
   return {
     slug: game.slug,
@@ -47763,7 +47838,7 @@ async function gameJson(env2, game) {
     minimum_player_age_years: game.minimum_player_age_years,
     game_server_allowed_hosts: allowedHostsOf(game),
     own_server_urls: ownServerUrlsOf(game),
-    links: linksOf(game).map(linkJson),
+    links: linksOf(game).map((link) => linkJson(link, outsideLinksEnabled)),
     details_waiting_for_review: waitingWords ? { title: waitingWords.title ?? null, description: waitingWords.description ?? null } : null,
     // Why the title keeps the game off Zaisma's lists ("No slop"); null when nothing does.
     title_listing_reason: reasonAnswer(game.title_listing_reason),
@@ -47780,12 +47855,12 @@ async function gameJson(env2, game) {
     updated_at: iso(game.updated_at_ms)
   };
 }
-function linkJson(link) {
+function linkJson(link, outsideLinksEnabled) {
   return {
     link_name: link.link_name,
     destination_url: link.destination_url,
     is_on_game_page: link.is_on_game_page,
-    who_can_open: linkAudience(link),
+    who_can_open: linkAudience(link, outsideLinksEnabled),
     review_reason: link.review_reason ? reviewReasonAnswer(link.review_reason) : null
   };
 }
@@ -47822,7 +47897,7 @@ async function tellWebhooks(env2, kind, gameId, parts2, waitUntil) {
     console.error("Couldn't tell webhooks", kind, gameId, error);
   }
 }
-var DAY_MS8 = 24 * 3600 * 1e3;
+var DAY_MS9 = 24 * 3600 * 1e3;
 async function sendAll(env2, webhooks, deliveries) {
   const sendToGameServer = gameServerSender(env2);
   const tries = await Promise.allSettled(deliveries.map((delivery, i) => attemptDelivery(env2.DB, webhooks[i], delivery, { sendToGameServer })));
@@ -50036,7 +50111,7 @@ function gamePageResponse(env2, view) {
     ...purchaseLabel.categories.length && refundWords ? [{ label: "Refunds", text: refundWords }] : []
   ];
   const isSignedInAdult = viewer.account?.age_band === "18+";
-  const pageLinks = linksOf(game).filter((link) => link.is_on_game_page && canOpenLink(link, isSignedInAdult));
+  const pageLinks = linksOf(game).filter((link) => link.is_on_game_page && canOpenLink(link, isSignedInAdult, view.outsideLinksEnabled));
   const gameOrigin = new URL(frameUrl).origin;
   const testerWords = tester ? `You're testing this game with a link from its developer.${isTestBuild ? ` It opens a version players don't have yet${game.multiplayer_mode !== "none" || ownServers.length ? ", so online play is off: it works only on the version players have" : ""}.` : ""}${hidden ? " It isn't public yet: anyone with this link can play, so only share it with other testers." : ""} Your progress stays in this browser.${tester.ends_at_ms ? ` The link works until ${day(tester.ends_at_ms)}.` : ""}` : "";
   const reportHref = `/g/${game.slug}/report`;
@@ -50256,7 +50331,7 @@ ${isClosed ? scriptTags(GAME_PAGE_SCRIPT, GAME_EMBEDDED_SCRIPT) : scriptTags(
     )}`
   });
   response.headers.append("Vary", "Sec-Fetch-Dest, Sec-Fetch-Site");
-  if (!view.isShownInLists || tester) response.headers.set("X-Robots-Tag", "noindex");
+  if (!view.isShownInLists || !view.searchEnginesEnabled || tester) response.headers.set("X-Robots-Tag", "noindex");
   return response;
 }
 var SECURITY_PAGE = `
@@ -51681,7 +51756,7 @@ var LINK = object({
   destination_url: url("The https address it opens; the game can add a path and query under it."),
   is_on_game_page: yes("The game page shows it too."),
   who_can_open: choice(
-    { everyone: "it's on a trusted store, payment or video site, so it opens for guests and under-18 accounts too", signed_in_adults: `it opens for signed-in adults; anyone else sees "This link can't be opened here."`, nobody: "its site is listed for malware or phishing (review_reason says so)" },
+    { everyone: "it's on a trusted store, payment or video site, so it opens for guests and under-18 accounts too", signed_in_adults: `it opens for signed-in adults; anyone else sees "This link can't be opened here."`, waiting_for_standing: "a site off the trusted list that opens for signed-in adults once your account is established, or has a card that paid Zaisma or a Stripe account (get_access's standing); until then it opens for nobody", nobody: "its site is listed for malware or phishing (review_reason says so)" },
     "Who it opens for."
   ),
   review_reason: nullable(reviewReason2("Why it opens for nobody; null when it opens."))
@@ -51982,7 +52057,7 @@ var ACCESS = object({
       sign_in_app_access: choice(AREA_ACCESS_CHOICES.sign_in_app_access, "Sign-in apps; none for keys limited to some games."),
       webhook_access: choice(AREA_ACCESS_CHOICES.webhook_access, "Webhooks; none for keys limited to some games."),
       stripe_account_access: choice(AREA_ACCESS_CHOICES.stripe_account_access, "The developer's connected Stripe account for the buy sheet; none for keys limited to some games. read: the connection. write: also ask for a link to connect (the developer connects with their passkey on zaisma.com), turn Stripe Tax on or off, and disconnect."),
-      credit_access: choice(AREA_ACCESS_CHOICES.credit_access, "Hosting credit; none for keys limited to some games. read: balance, top-ups and spending. write: also start a top-up, refund one, and turn spending off or down (on or up needs the developer's passkey on zaisma.com). Also Zaisma Pro: read the plan; write: start, cancel or resume it.")
+      credit_access: choice(AREA_ACCESS_CHOICES.credit_access, "Hosting credit; none for keys limited to some games. read: balance, top-ups and spending. write: also start a top-up, refund one, and turn spending off or down (on or up needs the developer's passkey on zaisma.com). Also the monthly credit plan: write starts it, changes its level (higher needs the passkey) and stops it. And Zaisma Pro: read the plan; write: start, cancel or resume it.")
     },
     "What the key may do in each area."
   ),
@@ -51997,6 +52072,22 @@ var NEXT = list(
   }),
   "The calls that usually follow; empty when nothing does."
 );
+var STANDING = object(
+  {
+    is_established_developer: yes("Whether the account is established: 14 days old, 20 different returning players on its games, and nothing ruled against it in 30 days. Zaisma's own accounts are established from the start."),
+    outside_links_enabled: yes("Whether the games' links to sites outside the trusted list open (for signed-in adults): once established, or at once with a card that paid Zaisma or a Stripe account that can take payments. Until then those links answer who_can_open waiting_for_standing."),
+    search_engines_enabled: yes("Whether search engines find the games (the sitemap, and no noindex on their pages): only once established. Zaisma's own lists show listed games from the first day either way."),
+    returning_player_count: countOf("Different players who came back to your games on 2 days or more, each with an account at least 7 days old that played on 3 days, as the daily count last counted them. Your own account never counts."),
+    minimum_returning_player_count: countOf("Returning players needed to be established: 20."),
+    account_age_days: countOf("Whole days since the account was made."),
+    minimum_account_age_days: countOf("Days old the account must be to be established: 14."),
+    has_card_or_stripe_account: yes("Whether a card paid Zaisma (a top-up or Zaisma Pro) on this account, or its Stripe account can take payments: either opens links to other sites at once."),
+    last_ruling_at: nullable(isoTime("When Zaisma last rejected one of your versions or took a game down; null when never.")),
+    ruling_wait_ends_at: nullable(isoTime("While the 30 days after the last ruling run, when they end: until then links to other sites and search engines are closed. null when there's no wait.")),
+    message_for_people: text2("What's open and what opens next, in a sentence or two, to show the developer.")
+  },
+  "What the account has earned, and what each power needs. Nobody else sees it."
+);
 var ERROR_FIELDS = object({
   code: text2("Stable, one problem per code; docs/DEVELOPER-API.md lists every code."),
   message: text2("What happened."),
@@ -52140,11 +52231,22 @@ var HOSTING_USE = object(
   },
   "This month (UTC) on the game's one hosting meter: the free allowance as a percentage, what used it, and what credit paid past it."
 );
+var CREDIT_PLAN = object(
+  {
+    refill_level_cents: countOf("What credit is filled back to on the 1st of every month (UTC), in cents (4000 is $40)."),
+    plan_status: choice({ running: "Stripe is paid; the next 1st refills", payment_failing: "the card was declined, and Stripe is trying again over the next days" }),
+    next_payment_at: isoTime("The next 1st, 00:00 UTC, when the refill is paid."),
+    next_payment_cents: countOf("What the next 1st pays at today's balance: the level minus the balance, 0 when that's under $1 or the balance is at or over the level. Sales tax or VAT comes on top on Stripe's side."),
+    started_at: isoTime()
+  },
+  "The monthly credit plan (start_credit_plan); null with none."
+);
 var CREDIT_ENTRY_KIND = choice({ top_up: "credit bought", hosting_charge: "a game's hosting past its free allowance, one entry per game per day", refund: "credit refunded to its card", written_off: "what a game used past its budget, your credit, or its free hosting while it had no budget, which Zaisma took on: never charged" });
 var CREDIT = object({
   credit: object({
     balance_cents: countOf("What's left to spend, in cents. Never below 0."),
     is_credit_low: yes("Whether the balance is under 20% of what there was right after the last top-up: add credit. Each game with a budget shows a credit_low alert meanwhile."),
+    credit_plan: nullable(CREDIT_PLAN),
     top_ups: list(
       object({
         id: idOf("top_up"),
@@ -52162,17 +52264,16 @@ var CREDIT = object({
     )
   })
 });
-var SPENDING_CHANGE_FIELDS = {
-  monthly_budget_cents: nullable(countOf("A game's monthly budget; null: no paid hosting."))
-};
+var BUDGET_CHANGE = object({ monthly_budget_cents: nullable(countOf("A game's monthly budget; null: no paid hosting.")) }, "game_budget's");
+var PLAN_LEVEL_CHANGE = object({ refill_level_cents: nullable(countOf("The monthly credit plan's level; null: no plan.")) }, "credit_plan_refill_level's");
 var SPENDING_REQUEST = object({
   spending_request: object({
     id: idOf("spending_request"),
-    request_kind: choice({ game_budget: "a game's monthly budget" }),
-    game_slug: nullable(text2("The game; null once it's deleted.")),
+    request_kind: choice({ game_budget: "a game's monthly budget", credit_plan_refill_level: "the monthly credit plan's level" }),
+    game_slug: nullable(text2("The game; null once it's deleted, and for the credit plan's level.")),
     game_title: nullable(text2()),
-    requested_change: object(SPENDING_CHANGE_FIELDS, "The budget asked for."),
-    current_setting: object(SPENDING_CHANGE_FIELDS, "The same fields as they are now."),
+    requested_change: { anyOf: [BUDGET_CHANGE, PLAN_LEVEL_CHANGE], description: "The change asked for: monthly_budget_cents for a game's budget, refill_level_cents for the credit plan's level." },
+    current_setting: { anyOf: [BUDGET_CHANGE, PLAN_LEVEL_CHANGE], description: "The same field as it is now." },
     request_status: choice({ waiting: "the developer hasn't answered", approved: "approved: the change is made", declined: "the developer declined", expired: "a day passed without an answer" }),
     created_at: isoTime(),
     expires_at: isoTime("A day after it was asked."),
@@ -52212,6 +52313,12 @@ var PRO_CHECKOUT = object({
   expires_at: isoTime("When the page stops taking payment."),
   next_steps: NEXT
 });
+var CREDIT_PLAN_CHECKOUT = object({
+  checkout_url: url("Stripe's page where the developer pays. Only a person can pay there."),
+  expires_at: isoTime("When the page stops taking payment."),
+  next_steps: NEXT
+});
+var CREDIT_CHANGED = object({ ...CREDIT.properties, next_steps: NEXT });
 var TOP_UP_CHECKOUT = object({
   checkout_url: url("Stripe's page where the developer pays. Only a person can pay there."),
   expires_at: isoTime("When the page stops taking payment."),
@@ -53374,6 +53481,11 @@ var BLOCKED_SCRIPT_LIST = object({
     "The last 7 days, most reported first, up to 100. Browser extensions' reports aren't kept."
   )
 });
+var ZAISMA_ACCOUNT_CHANGED = object({
+  username: text2(),
+  is_zaisma_account: yes("Whether it's one of Zaisma's own accounts now, established from the start (links to other sites and search engines open)."),
+  next_steps: NEXT
+});
 var CAN_PUBLISH_CHANGED = object({
   username: text2(),
   can_publish: yes("Whether the account can make, upload and publish games now."),
@@ -53565,7 +53677,7 @@ var details = {
       required: ["link_name", "destination_url", "is_on_game_page"],
       additionalProperties: false
     },
-    description: `The game's registered links: the sites it opens with Zaisma.links.open(link_name), like its store, Patreon, Steam page or Discord, behind Zaisma's "You're leaving Zaisma" card over the game; the game can open no other sites. The whole list each time, up to 20; [] for none. The game can add a path and query under a link's address: Zaisma.links.open("store", { path: "/buy", queryParameters: { item: "sword" } }). Signed-in adults open any link; guests and under-18 accounts only links on trusted store, payment and video sites (itch.io, Steam, Patreon, Ko-fi, Gumroad, PayPal, Stripe payment links, hosted Bitcoin pages, YouTube and others), never chat apps or social networks like Discord or Instagram: get_game's who_can_open says which, and anyone a link doesn't open for sees "This link can't be opened here." (the game hears "stayed"). No link shorteners, IP addresses or user names in addresses. Every site is checked against Cloudflare's malware and phishing list when added and every day; a listed one opens for nobody, with a review_reason. Live at once, with no approval.`,
+    description: `The game's registered links: the sites it opens with Zaisma.links.open(link_name), like its store, Patreon, Steam page or Discord, behind Zaisma's "You're leaving Zaisma" card over the game; the game can open no other sites. The whole list each time, up to 20; [] for none. The game can add a path and query under a link's address: Zaisma.links.open("store", { path: "/buy", queryParameters: { item: "sword" } }). Signed-in adults open any link once the account's standing opens links to other sites (established, or a card that paid Zaisma or a Stripe account: get_access's standing; until then who_can_open says waiting_for_standing and the link is kept); guests and under-18 accounts only links on trusted store, payment and video sites (itch.io, Steam, Patreon, Ko-fi, Gumroad, PayPal, Stripe payment links, hosted Bitcoin pages, YouTube and others), never chat apps or social networks like Discord or Instagram: get_game's who_can_open says which, and anyone a link doesn't open for sees "This link can't be opened here." (the game hears "stayed"). No link shorteners, IP addresses or user names in addresses. Every site is checked against Cloudflare's malware and phishing list when added and every day; a listed one opens for nobody, with a review_reason. Live at once, with no approval.`,
     examples: [[{ link_name: "store", destination_url: "https://kit.itch.io/sky-hopper", is_on_game_page: true }], [{ link_name: "patreon", destination_url: "https://www.patreon.com/kit", is_on_game_page: true }, { link_name: "discord", destination_url: "https://discord.gg/skyhopper", is_on_game_page: false }]]
   },
   glass_tint_color: {
@@ -54055,7 +54167,7 @@ Not: { "name": "Zaisma Login" } (name the app the way players know your site)`,
   {
     name: "get_credit",
     title: "My hosting credit",
-    description: "The developer's hosting credit: the balance (in cents, never in dollars), whether it's low (is_credit_low: under 20% of what there was after the last top-up), the last 30 days' top-ups with what each still refunds, each game's budget and what credit paid for it this month, and the last 90 days' entries. Every game gets free hosting each month on one meter (get_stats' hosting_use_this_month, a percentage); past it, only a game with a budget (update_game, monthly_budget_cents) draws from credit, never past its budget. Credit never expires and is never paid out.",
+    description: "The developer's hosting credit: the balance (in cents, never in dollars), whether it's low (is_credit_low: under 20% of what there was after the last top-up), the monthly credit plan (credit_plan: its level, whether the card pays, and what the next 1st pays at today's balance; null with none), the last 30 days' top-ups with what each still refunds, each game's budget and what credit paid for it this month, and the last 90 days' entries. Every game gets free hosting each month on one meter (get_stats' hosting_use_this_month, a percentage); past it, only a game with a budget (update_game, monthly_budget_cents) draws from credit, never past its budget. Credit never expires and is never paid out.",
     inputSchema: object2({}),
     outputSchema: CREDIT,
     annotations: read,
@@ -54064,7 +54176,7 @@ Not: { "name": "Zaisma Login" } (name the app the way players know your site)`,
   {
     name: "get_spending_request",
     title: "A spending request's answer",
-    description: "Whether the developer has answered a raise in spending you asked for. When update_game (a game's first or higher budget) answers confirmation_needed, it also answers spending_request_id: give the developer confirm_url, where a sheet names the exact change and they approve with a passkey tap or decline. This shows request_status (waiting, approved, declined or expired after a day), the change asked for and what it is now. Approved means the change is already made.",
+    description: "Whether the developer has answered a raise in spending you asked for. When update_game (a game's first or higher budget) or change_credit_plan (a higher level) answers confirmation_needed, it also answers spending_request_id: give the developer confirm_url, where a sheet names the exact change and they approve with a passkey tap or decline. This shows request_status (waiting, approved, declined or expired after a day), the change asked for and what it is now. Approved means the change is already made.",
     inputSchema: object2({ spending_request_id: { type: "string", pattern: "^spending_request_[a-z0-9]+$", description: "From confirmation_needed's spending_request_id, like spending_request_k2m9x4\u2026" } }, ["spending_request_id"]),
     outputSchema: SPENDING_REQUEST,
     annotations: read,
@@ -54082,6 +54194,38 @@ Not: { "amount_cents": 500 } (the least is 1000, $10)`,
     annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false },
     run: (toolArguments, call3) => call3("POST", "/credit/top-ups", pick(toolArguments, ["amount_cents"]))
   },
+  {
+    name: "start_credit_plan",
+    title: "Start a monthly credit plan",
+    description: `Start the developer's monthly credit plan: credit filled back to refill_level_cents on the 1st of every month (UTC), so games with a budget never run dry. Answers Stripe's page (checkout_url), where only the developer can pay; give them the link. The first payment fills credit to the level (at most $1,000; a higher level fills to it from the next 1st); each 1st pays only what brings the balance back to the level, nothing under $1 or when the balance is at or over it. Stripe sells every payment, with sales tax or VAT on top. Each payment is a top-up, refundable for 30 days with refund_top_up. One plan at a time: already_credit_plan when there is one.
+
+Not: { "refill_level_cents": 40 } (that's 40 cents; cents, not dollars, so $40 is 4000)
+Not: { "refill_level_cents": 500 } (the least is 1000, $10)`,
+    inputSchema: { ...object2({ refill_level_cents: { type: "integer", minimum: 1e3, maximum: 1e6, description: "The level in cents: 4000 is $40. From 1000 ($10) to 1000000 ($10,000)." } }, ["refill_level_cents"]), examples: [{ refill_level_cents: 4e3 }] },
+    outputSchema: CREDIT_PLAN_CHECKOUT,
+    annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false },
+    run: (toolArguments, call3) => call3("POST", "/credit/plan/checkout", pick(toolArguments, ["refill_level_cents"]))
+  },
+  {
+    name: "change_credit_plan",
+    title: "Change the monthly credit plan",
+    description: `Set the monthly credit plan's level: what credit is filled back to on the 1st. A lower or equal level applies at once with any key that has credit_access write; a higher one spends more, so it answers confirmation_needed with confirm_url, where the developer approves it with their passkey, and spending_request_id for get_spending_request. Answers no_credit_plan with none (start_credit_plan starts one).
+
+Not: { "refill_level_cents": 60 } (cents, not dollars, so $60 is 6000)`,
+    inputSchema: { ...object2({ refill_level_cents: { type: "integer", minimum: 1e3, maximum: 1e6, description: "The new level in cents: 6000 is $60." } }, ["refill_level_cents"]), examples: [{ refill_level_cents: 6e3 }] },
+    outputSchema: CREDIT_CHANGED,
+    annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+    run: (toolArguments, call3) => call3("PATCH", "/credit/plan", pick(toolArguments, ["refill_level_cents"]))
+  },
+  {
+    name: "stop_credit_plan",
+    title: "Stop the monthly credit plan",
+    description: "Stop the monthly credit plan at once: nothing is charged again, and credit already bought stays (each payment still refunds for 30 days with refund_top_up). It holds no prepaid month, so nothing is lost by stopping. Answers no_credit_plan with none. Ask the developer first.",
+    inputSchema: object2({}),
+    outputSchema: CREDIT_CHANGED,
+    annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false },
+    run: (_, call3) => call3("POST", "/credit/plan/stop")
+  },
   {
     name: "get_stripe_account",
     title: "My Stripe account",
@@ -54507,7 +54651,7 @@ Not: { "rating": "helpful" } (like)`,
   {
     name: "get_access",
     title: "What this key can do",
-    description: "What the API key you're signed in with may do: its access_level (read, upload, publish, full or custom), what that gives in each area, the games it works on (game_slugs, null for all) and when it ends (api_key_ends_at, null for never). A call the key doesn't reach answers key_not_allowed. Keys are made only by the developer on zaisma.com/dashboard/settings, never through the MCP. can_publish says whether the account can make, upload and publish games, which until the beta only accounts Zaisma adds can. banned_at and ban_scope say whether Zaisma banned the account: a banned developer can call only get_access, list_games and export_game. plan says whether the developer has Zaisma Pro (free or pro).",
+    description: "What the API key you're signed in with may do: its access_level (read, upload, publish, full or custom), what that gives in each area, the games it works on (game_slugs, null for all) and when it ends (api_key_ends_at, null for never). A call the key doesn't reach answers key_not_allowed. Keys are made only by the developer on zaisma.com/dashboard/settings, never through the MCP. can_publish says whether the account can make, upload and publish games, which until the beta only accounts Zaisma adds can. banned_at and ban_scope say whether Zaisma banned the account: a banned developer can call only get_access, list_games and export_game. plan says whether the developer has Zaisma Pro (free or pro). standing says what the account has earned and what each power needs: links to sites outside the trusted list open once it's established (14 days old, 20 different returning players, nothing ruled against it in 30 days) or at once with a card that paid Zaisma or a Stripe account, and search engines only once it's established; tell the developer standing.message_for_people when they ask why a link doesn't open or their game isn't on search engines.",
     inputSchema: object2({}),
     outputSchema: object({
       access: ACCESS,
@@ -54515,7 +54659,9 @@ Not: { "rating": "helpful" } (like)`,
       banned_at: nullable(isoTime("When Zaisma banned this account; null when it isn't banned.")),
       ban_scope: nullable(choice({ developer: "its games are down, and only get_access, list_games and export_game work; playing still works", whole_account: "the account is closed" }, "How far the ban goes; null when it isn't banned.")),
       credit_balance_cents: nullable(countOf("The developer's hosting credit, in cents; null when the key can't read it (credit_access none, or a key limited to some games).")),
-      plan: choice({ free: "the free daily limits", pro: "Zaisma Pro: the higher daily limits" }, "The developer's plan; get_pro has its limits.")
+      plan: choice({ free: "the free daily limits", pro: "Zaisma Pro: the higher daily limits" }, "The developer's plan; get_pro has its limits."),
+      standing: STANDING,
+      next_steps: NEXT
     }),
     annotations: read,
     run: (_, call3) => call3("GET", "/access")
@@ -55359,7 +55505,7 @@ async function precedentAction(env2, path, form, actor) {
 var redirect = () => new Response(null, { status: 303, headers: { Location: "/admin/precedents" } });
 
 // ../../apps/site/src/admin-mcp.ts
-var DAY_MS9 = 864e5;
+var DAY_MS10 = 864e5;
 var read2 = { readOnlyHint: true, openWorldHint: false };
 var change = { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false };
 var object3 = (properties, required = []) => ({ type: "object", properties, required, additionalProperties: false });
@@ -55579,7 +55725,7 @@ var ADMIN_TOOLS = [
     run: async (_, { env: env2 }) => {
       const { results } = await env2.DB.prepare(
         `${QUEUE_SELECT} WHERE reports.report_status != 'open' AND reports.closed_at_ms = reports.triaged_at_ms AND reports.closed_at_ms > ? AND reports.severity_index > 0 ORDER BY reports.closed_at_ms DESC LIMIT 100`
-      ).bind(Date.now() - 7 * DAY_MS9).all();
+      ).bind(Date.now() - 7 * DAY_MS10).all();
       return {
         period_duration_days: 7,
         reports: results.map((report) => {
@@ -56187,6 +56333,29 @@ Not: { "decision": "block", "why": "\u2026" } for every country (a game breaking
       return { username: account.username, can_publish: canPublish, publishing_accounts: publishingAccountRows(await publishingAccounts(env2.DB)), next_steps: [] };
     }
   },
+  {
+    name: "set_zaisma_account",
+    title: "Mark one of Zaisma's own accounts",
+    description: "Mark an account as one of Zaisma's own (is_zaisma_account true), like the seed games' developers, by its username, or unmark it (false). Zaisma's own accounts are established from the start, so their games' links to other sites and search engines open before any players come back; a ruling or a ban still closes them. Unmarking it leaves it to the daily count. Ask the admin first.",
+    inputSchema: object3(
+      {
+        username: usernameInput,
+        is_zaisma_account: { type: "boolean", description: "true marks it as Zaisma's own; false unmarks it." }
+      },
+      ["username", "is_zaisma_account"]
+    ),
+    outputSchema: ZAISMA_ACCOUNT_CHANGED,
+    annotations: change,
+    run: async (toolArguments, { env: env2, actor }) => {
+      const account = await accountNamed(env2, toolArguments.username);
+      const isZaismaAccount = toolArguments.is_zaisma_account === true;
+      const owner = await personOwner(env2.DB, account.id);
+      const rulingWaitStartedAfterMs = Date.now() - STANDING_LIMITS.rulingWaitDurationDays * 864e5;
+      await env2.DB.prepare("UPDATE owners SET is_zaisma_account = ?1, is_established = CASE WHEN ?1 = 1 AND (last_ruling_at_ms IS NULL OR last_ruling_at_ms <= ?2) THEN 1 ELSE 0 END, standing_checked_at_ms = NULL WHERE id = ?3").bind(isZaismaAccount ? 1 : 0, rulingWaitStartedAfterMs, owner.id).run();
+      await audit(env2.DB, null, isZaismaAccount ? "zaisma-account-marked" : "zaisma-account-unmarked", `@${account.username}`, actor);
+      return { username: account.username, is_zaisma_account: isZaismaAccount, next_steps: [] };
+    }
+  },
   {
     name: "ban_account",
     title: "Ban an account",
@@ -56456,6 +56625,7 @@ function countryBlockSection(game) {
 async function takeDownGame(env2, gameId, contentRule, reason, actor) {
   const removedReason = decidedReason("taken_down", contentRule, reason);
   await setReviewStatus(env2.DB, gameId, "removed", removedReason);
+  await noteRulingOnGame(env2, gameId);
   await recordRestoreEvent(env2, { event_kind: "game_removed", at_ms: Date.now(), game_id: gameId, review_reason: removedReason });
   await closeReports(env2.DB, gameId, "actioned");
   await audit(env2.DB, gameId, "takedown", reason, actor, removedReason);
@@ -56512,6 +56682,7 @@ async function adminForm(env2, path, form, actor) {
       const rejectedReason = decidedReason("rejected_by_zaisma", pickedRule(form), reason);
       await saveScan(env2.DB, version.id, "rejected", null);
       await env2.DB.prepare("UPDATE versions SET review_reason = ? WHERE id = ?").bind(JSON.stringify(rejectedReason), version.id).run();
+      await noteRulingOnGame(env2, version.game_id);
       if (version.report_held_at_ms) await closeReports(env2.DB, version.game_id, "actioned");
       await audit(env2.DB, version.game_id, "rejected", reason ? `${version.id}: ${reason}` : version.id, actor, rejectedReason);
     }
@@ -57326,6 +57497,9 @@ async function playerPage(input) {
     updates: [],
     otherGames: [],
     liveRooms: null,
+    // The developer's own computer: their links open as an established developer's would, and no search engine is near it.
+    searchEnginesEnabled: false,
+    outsideLinksEnabled: true,
     checkedPlayerCount: 0,
     hasThreads: false,
     purchaseLabel: { categories: input.soldCategories, has_own_payments: false },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zaisma/game-server",
-  "version": "1.14.0",
+  "version": "1.15.0",
   "description": "Run your Zaisma game server: the same rooms on Zaisma or on your own server.",
   "license": "MIT",
   "homepage": "https://zaisma.com",