@zaisma/game-server 1.8.0 → 1.10.0

package/bench/glass.js

@@ -6273,6 +6273,7 @@ var ERROR_CODES = {
   confirmation_needed: { httpStatus: 403, meaning: "This needs the developer's passkey on zaisma.com (turning spending on or up, or connecting a Stripe account): confirm_url is where they do it." },
   bad_monthly_budget_cents: { httpStatus: 400, meaning: "monthly_budget_cents isn't a whole number of cents of at least 100 ($1), or null for no paid hosting." },
   bad_top_up_amount: { httpStatus: 400, meaning: "amount_cents isn't a whole number of cents from 1,000 ($10) to 100,000 ($1,000)." },
+  account_not_protected: { httpStatus: 403, meaning: "The account has no passkey and no email yet, and a top-up keeps a card, so it needs one of them first: add a passkey or an email on zaisma.com/account." },
   no_top_up: { httpStatus: 404, meaning: "You have no top-up with that ID." },
   no_spending_request: { httpStatus: 404, meaning: "You have no spending request with that ID." },
   top_up_not_refundable: { httpStatus: 409, meaning: "The top-up has nothing left to refund: it's spent, refunded, or over 180 days old." },
@@ -6437,6 +6438,62 @@ var MATROSKA_HEAD_BYTES = 64 * 1024;
 var MAXIMUM_EMBEDDED_CHARACTER_COUNT = 40 * 1024 * 1024;
 var PACK_WINDOW_SIZE_BYTES = 32 * 1024 * 1024;
 
+// ../core/src/scan/textures.ts
+var digitsOf = (digits) => [...digits].map(Number);
+var TRITS = [
+  "0120012101220122012001210122012001200121012201220120012101220121012001210122012201200121012201220120012101220122012001210122012201200121012201220120012101220120012001210122012201200121012201210120012101220122012001210122012201200121012201220120012101220122",
+  "0000111022202220000111112221000000001110222022200001111122211110000011102220222000011111222122200000111022202220000111112221222000001110222022200001111122210001000011102220222000011111222111110000111022202220000111112221222100001110222022200001111122212221",
+  "0002000200022222111211121112000200020002000222221112111211120002000200020002222211121112111200020002000200022222111211121112222200020002000222221112111211121112000200020002222211121112111211120002000200022222111211121112111200020002000222221112111211122222",
+  "0000000000000000000000000000222211111111111111111111111111112222222222222222222222222222222222220000000000000000000000000000222200000000000000000000000000002222111111111111111111111111111122222222222222222222222222222222222211111111111111111111111111112222",
+  "0000000000000000000000000000222200000000000000000000000000002222000000000000000000000000000022222222222222222222222222222222222211111111111111111111111111112222111111111111111111111111111122221111111111111111111111111111222222222222222222222222222222222222"
+].map(digitsOf);
+var QUINTS = [
+  "01234044012341440123424401234344012340400123414101234242012343430123402301234123012342230123432301234001012341010123420101234301",
+  "00000444111114442222244433333444000004041111141422222424333334340000040011111411222224223333343300000400111114112222242233333433",
+  "00000004000000140000002400000034111111441111114411111144111111442222224422222244222222442222224433333344333333443333334433333344"
+].map(digitsOf);
+
+// ../core/src/scan/png.ts
+var CRC_TABLE = (() => {
+  const table2 = new Uint32Array(256);
+  for (let byteIndex = 0; byteIndex < 256; byteIndex++) {
+    let remainderCode = byteIndex;
+    for (let bitIndex = 0; bitIndex < 8; bitIndex++) remainderCode = remainderCode & 1 ? 3988292384 ^ remainderCode >>> 1 : remainderCode >>> 1;
+    table2[byteIndex] = remainderCode >>> 0;
+  }
+  return table2;
+})();
+
+// ../core/src/scan/unity.ts
+var MAXIMUM_BUNDLE_BLOCK_SIZE_BYTES = 32 * 1024 * 1024;
+var MAXIMUM_READ_INSIDE_SIZE_BYTES = 16 * 1024 * 1024;
+var READ_WINDOW_SIZE_BYTES = 8 * 1024 * 1024;
+var BLOCK_CACHE_SIZE_BYTES = 32 * 1024 * 1024;
+var UNITY_TEXTURE_FORMATS = {
+  2: "argb4444",
+  3: "rgb8",
+  4: "rgba8",
+  5: "argb8",
+  7: "rgb565",
+  10: "bc1",
+  11: "bc2",
+  12: "bc3",
+  13: "rgba4444",
+  14: "bgra8",
+  25: "bc7",
+  34: "etc1",
+  45: "etc2_rgb",
+  46: "etc2_rgba1",
+  47: "etc2_rgba8",
+  60: "etc1",
+  61: "etc2_rgba8",
+  ...Object.fromEntries([4, 5, 6, 8, 10, 12].flatMap((sidePixelCount, i) => [[48 + i, `astc_${sidePixelCount}x${sidePixelCount}`], [54 + i, `astc_${sidePixelCount}x${sidePixelCount}`]]))
+};
+
+// ../core/src/scan/godot.ts
+var GODOT_3_FILE_FORMAT_CODE = 1 << 20 | 1 << 21;
+var WINDOW_SIZE_BYTES = 8 * 1024 * 1024;
+
 // ../core/src/plans.ts
 var PLAN_LIMITS = {
   free: { maximumLargeReviewsPerDay: 5, maximumSmallReviewsPerDay: 30, maximumDailyCheckCount: 20, maximumVersionsPerDay: 20, maximumGameSizeBytes: 2 * 1024 ** 3 },
@@ -6790,6 +6847,18 @@ var REVIEW_CODES = {
     fix: `Send the background without words or logos (add_image, or add_shader for a shader); words that are part of the scene, like a sign on a building, are fine. ${COVER_GUIDE} ${IF_THE_CHECK_IS_WRONG}`,
     hasOwnMessage: true
   },
+  overlay_on_background: {
+    meaning: "Something is laid over a background instead of being part of its world, like a button, badge or sticker, so it doesn't show; the message says what.",
+    contentRule: null,
+    fix: `Send the background without it (add_image, or add_shader for a shader). ${COVER_GUIDE} ${IF_THE_CHECK_IS_WRONG}`,
+    hasOwnMessage: true
+  },
+  famous_name_on_background: {
+    meaning: "A background shows a famous character, logo or name, from a film, show, game, brand or club, so it doesn't show; the message names it.",
+    contentRule: null,
+    fix: `Send a background of your game's own world (add_image, or add_shader for a shader). Only obvious ones count. If you own it or have permission, message_zaisma with the game_slug. ${COVER_GUIDE}`,
+    hasOwnMessage: true
+  },
   // The shader check (Backgrounds in docs/DEVELOPER-API.md): a shader is drawn before anyone sees it
   shader_does_not_compile: {
     meaning: "The shader didn't compile; the message gives the first compiler error.",
@@ -6832,18 +6901,19 @@ var SOCIAL_SETTING_CHOICES = {
   who_sees_playing_now: ["nobody", "friends", "anyone"],
   who_sees_played_games: ["nobody", "friends", "anyone"],
   who_sees_online: ["nobody", "friends"],
-  who_can_send_friend_requests: ["nobody", "anyone"],
+  who_can_send_friend_requests: ["nobody", "played_with", "anyone"],
   who_sees_profile: ["friends", "anyone"]
 };
 var SOCIAL_SETTINGS = Object.keys(SOCIAL_SETTING_CHOICES);
 var SOCIAL_MODES = ["solo_focused", "friends_focused", "open_and_social"];
 var SOCIAL_MODE_SETTINGS = {
   solo_focused: { who_can_chat: "nobody", who_can_join: "friends", who_sees_playing_now: "friends", who_sees_played_games: "friends", who_sees_online: "friends", who_can_send_friend_requests: "nobody", who_sees_profile: "friends" },
-  friends_focused: { who_can_chat: "friends", who_can_join: "friends", who_sees_playing_now: "friends", who_sees_played_games: "friends", who_sees_online: "friends", who_can_send_friend_requests: "nobody", who_sees_profile: "friends" },
+  // Friends-focused keeps every way to reach the player with friends, but anyone can offer friendship (Julius, Oct 27, 2026).
+  friends_focused: { who_can_chat: "friends", who_can_join: "friends", who_sees_playing_now: "friends", who_sees_played_games: "friends", who_sees_online: "friends", who_can_send_friend_requests: "anyone", who_sees_profile: "friends" },
   open_and_social: { who_can_chat: "anyone", who_can_join: "anyone", who_sees_playing_now: "anyone", who_sees_played_games: "anyone", who_sees_online: "friends", who_can_send_friend_requests: "anyone", who_sees_profile: "anyone" }
 };
 var AGE_LIMITS = {
-  "13-15": { who_can_chat: "friends", who_can_join: "friends", who_sees_playing_now: "friends", who_sees_played_games: "friends", who_sees_online: "friends", who_can_send_friend_requests: "nobody", who_sees_profile: "anyone" },
+  "13-15": { who_can_chat: "friends", who_can_join: "friends", who_sees_playing_now: "friends", who_sees_played_games: "friends", who_sees_online: "friends", who_can_send_friend_requests: "played_with", who_sees_profile: "anyone" },
   "16-17": { who_can_chat: "anyone", who_can_join: "friends", who_sees_playing_now: "friends", who_sees_played_games: "friends", who_sees_online: "friends", who_can_send_friend_requests: "anyone", who_sees_profile: "anyone" },
   "18+": { who_can_chat: "anyone", who_can_join: "anyone", who_sees_playing_now: "anyone", who_sees_played_games: "anyone", who_sees_online: "friends", who_can_send_friend_requests: "anyone", who_sees_profile: "anyone" }
 };
@@ -6863,7 +6933,8 @@ function defaultSocialMode(band) {
   return band === "13-15" ? "solo_focused" : "friends_focused";
 }
 function socialModeSettings(socialMode, band) {
-  return withinAgeLimits(SOCIAL_MODE_SETTINGS[socialMode], band);
+  const settings = withinAgeLimits(SOCIAL_MODE_SETTINGS[socialMode], band);
+  return band === "13-15" ? { ...settings, who_can_send_friend_requests: "nobody" } : settings;
 }
 function chatBandGroup(account) {
   if (account.who_can_chat === "nobody") return null;
@@ -8146,6 +8217,7 @@ var GAME_SERVER_OPTIONS = [
   "onRefund",
   "onTick",
   "onEnding",
+  "onEndingCancelled",
   "onRestored",
   "stateView",
   "onVersionUpdate",
@@ -14781,8 +14853,10 @@ component({
 .choice-cards { --choice-row-least: calc(var(--choice-count) * var(--size-card)); display: flex; flex-wrap: wrap; align-items: stretch; gap: var(--gap-control-stack) 0; }
 .choice-cards > .choice-card { flex: 1 1 calc((var(--choice-row-least) - 100%) * 999); }
 .choice-cards > .choice-card:not(:last-child) { margin-inline-end: max(var(--gap-control-row-boxes), min(0px, (var(--choice-row-least) - 100%) * 999)); }
-.choice-card { position: relative; display: flex; align-items: flex-start; gap: var(--gap-words-words); min-height: 76px; padding: 14px var(--pad-inside-words); cursor: pointer; -webkit-tap-highlight-color: transparent;
+.choice-card { position: relative; display: flex; align-items: flex-start; gap: var(--gap-words-words); min-height: 44px; padding: 14px var(--pad-inside-words); cursor: pointer; -webkit-tap-highlight-color: transparent;
   color: var(--muted); --face-color: var(--well); background: var(--face-color); box-shadow: var(--well-shade); clip-path: var(--cut-shape); transition: --face-color 0.2s, box-shadow 0.2s, color 0.2s; }
+/* A card with a line on what it means has room for it; one with only its name (an amount) is as tall as its name, never taller than its content. */
+.choice-card:has(.choice-text) { min-height: 76px; }
 .choice-card > :not(.cut-line):not(.choice-input) { position: relative; z-index: 2; }
 .choice-input { position: absolute; inset: 0; z-index: 3; width: 100%; height: 100%; margin: 0; opacity: 0; cursor: pointer; }
 .choice-card > .ico { flex: none; margin-top: 1px; color: var(--muted); }
@@ -16778,7 +16852,7 @@ component({
 function notice(options) {
   const isProblem = options.tone === "problem";
   const undo = options.undoAction === void 0 ? "" : html`<form class="notice-undo" method="post" action="${options.undoAction}">${textButton("Undo", { type: "submit" })}</form>`;
-  return html`<div class="notice glass ${options.tone}${options.isInPlace ? " in-place" : ""}" role="${isProblem ? "alert" : "status"}" data-notice="${options.tone}"${undo ? raw(" data-notice-undo") : ""} data-glass data-glass-corners="menu">${EDGE}${icon(isProblem ? "warning" : "check")}<span class="notice-text">${options.text}</span>${undo}${isProblem ? cutButton("Close", { type: "button", icon: "close", isLabelHidden: true, isSmall: true }) : ""}</div>`;
+  return html`<div class="notice glass ${options.tone}${options.isInPlace ? " in-place" : ""}" role="${isProblem ? "alert" : "status"}" data-notice="${options.tone}"${undo ? raw(" data-notice-undo") : ""} data-glass data-glass-corners="menu">${EDGE}${icon(isProblem ? "warning" : "check")}<span class="notice-text">${options.text}${options.link ? html` ${textLink(options.link.words, options.link.href)}` : ""}</span>${undo}${isProblem ? cutButton("Close", { type: "button", icon: "close", isLabelHidden: true, isSmall: true }) : ""}</div>`;
 }
 var STARTED_LOW_SCRIPT = `/* panes started low */(function () {
   function place(pane) {
@@ -16855,7 +16929,7 @@ ${touchReach(".notice")}
   examples: [
     { label: "Done", markup: notice({ text: "Saved", tone: "done", isInPlace: true }) },
     { label: "Done, longer", markup: notice({ text: "Version 14 is live", tone: "done", isInPlace: true }) },
-    { label: "A problem", markup: notice({ text: "Couldn't save: you're offline. Your changes are kept here.", tone: "problem", isInPlace: true }) },
+    { label: "A problem", markup: notice({ text: "Couldn't save: you're offline. Your changes are kept here.", tone: "problem", link: { words: "Try again", href: "#notice" }, isInPlace: true }) },
     { label: "Done, with Undo", markup: notice({ text: "Removed Ashen Crown from your games", tone: "done", undoAction: "#notice", isInPlace: true }) },
     { label: "Two at once", markup: html`<div class="notice-stack">${notice({ text: "Copied", tone: "done", isInPlace: true })}${notice({ text: "Couldn't reach Zaisma. Check your connection.", tone: "problem", isInPlace: true })}</div>` }
   ]
@@ -23277,7 +23351,7 @@ function securityHeaders(env2, extra = {}, hasTurnstileCheck = false, frames = [
 var PRESENCE_SCRIPT = pageScript("presence", `(()=>{if(!/(^|; )(__Host-)?zaisma_in=1/.test(document.cookie))return;let last=0,off=false;const b=document.body,KEY="zaisma:checked-in-at-ms";
 try{last=Number(sessionStorage.getItem(KEY))||0}catch{}if(last>Date.now())last=0;
 const beat=()=>{if(off||document.visibilityState!=="visible")return;last=Date.now();try{sessionStorage.setItem(KEY,String(last))}catch{}const g=b.dataset.presenceGame;
-fetch("/api/presence",{method:"POST",body:JSON.stringify(g?{game_slug:g}:{}),keepalive:true}).then(r=>{if(r.status===401)off=true}).catch(()=>{})};
+fetch("/api/presence",{method:"POST",body:JSON.stringify(g?{game_slug:g}:{}),keepalive:true}).then(r=>{if(r.status===401)off=true;else if(r.status===200)r.json().then(a=>dispatchEvent(new CustomEvent("zaisma:presence",{detail:a}))).catch(()=>{})}).catch(()=>{})};
 const start=()=>{beat();setInterval(beat,${PRESENCE_CHECK_IN_MS})};if(b.dataset.presenceGame||Date.now()-last>60000)start();else setTimeout(start,last+${PRESENCE_CHECK_IN_MS}-Date.now());document.addEventListener("visibilitychange",()=>{if(Date.now()-last>60000)beat()});
 new MutationObserver(beat).observe(b,{attributes:true,attributeFilter:["data-presence-game"]});
 addEventListener("pagehide",()=>{const g=b.dataset.presenceGame;if(g&&!off)navigator.sendBeacon("/api/presence",JSON.stringify({left_game_slug:g}))})})();`);
@@ -23873,24 +23947,63 @@ var SAVES_SCRIPT = pageScript("saves", `
   let applying = null;    // a developer's change while the game domain puts it in place under the running game
   let isRestoringCopy = false; // the game is going back to an earlier version (Zaisma.saves.restoreCopy)
   let versionId = null;   // the game version the game domain says it was served from (its last hello or save), a label on each save
+  let clockOffsetMs = 0;  // Zaisma's clock minus this device's, from the last answer's Date header
+  let retryTimer = null;  // a failed save waiting to be sent again
+  let retryDelayMs = 0;   // how long the last wait was: 30 seconds, doubling to 5 minutes
+  let isAwaitingSignIn = false; // saving paused after a 401 or another account signing in, until the player is signed in
   // A save with nothing in it, exactly as canonicalSave in packages/core/src/saves.ts writes it.
   const EMPTY_SAVE_TEXT = ${JSON.stringify(EMPTY_SAVE_TEXT)};
 
   // A save as one text, the same as canonicalSave on the server: all three keys in this order, localStorage keys sorted.
   const canonical = (save) => {
+    if (!save || !save.local_storage_items) return null;
     const items = {};
     Object.keys(save.local_storage_items).sort().forEach((k) => Object.defineProperty(items, k, { value: save.local_storage_items[k], enumerable: true, writable: true, configurable: true }));
     return JSON.stringify({ save_format_version_number: 1, local_storage_items: items, indexeddb_databases: save.indexeddb_databases });
   };
   const sha = async (text) => Array.from(new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(text))), (b) => b.toString(16).padStart(2, "0")).join("");
+  // Which save of an account this device last had: { version_number, sha256, slug, marked_at_ms }, per account tag.
   const marker = (tag, value) => {
     try {
       if (value === undefined) return JSON.parse(localStorage.getItem("zaisma:save:" + tag) || "null");
-      localStorage.setItem("zaisma:save:" + tag, JSON.stringify(value));
+      localStorage.setItem("zaisma:save:" + tag, JSON.stringify({ ...value, slug: SAVES.slug, marked_at_ms: serverNow() }));
+    } catch { return null; }
+  };
+  // Every account's marker for this game in this browser, with its tag (markers from before slug was kept are left out).
+  const markersHere = () => {
+    const found = [];
+    try {
+      for (let i = 0; i < localStorage.length; i++) {
+        const key = localStorage.key(i);
+        if (!key || !key.startsWith("zaisma:save:")) continue;
+        const value = JSON.parse(localStorage.getItem(key) || "null");
+        if (value && value.slug === SAVES.slug) found.push({ tag: key.slice("zaisma:save:".length), ...value });
+      }
+    } catch {}
+    return found;
+  };
+  // Another account's progress, moved aside on a shared computer until that account signs in here again: { text, played_at_ms }.
+  const asideKey = (tag) => "zaisma:unsynced:" + tag;
+  const putAside = (tag, value) => {
+    try { localStorage.setItem(asideKey(tag), JSON.stringify(value)); return true; } catch { return false; }
+  };
+  const takeAside = (tag) => {
+    try {
+      const value = JSON.parse(localStorage.getItem(asideKey(tag)) || "null");
+      localStorage.removeItem(asideKey(tag));
+      return value && typeof value.text === "string" ? value : null;
     } catch { return null; }
   };
+  // Zaisma's clock: this device's, put right by the offset each answer's Date header shows.
+  const serverNow = () => Date.now() + clockOffsetMs;
+  // Every call to the account: learns Zaisma's clock from the answer.
+  const ask = (path, init = {}) => fetch(path, { credentials: "same-origin", ...init }).then((res) => {
+    const answeredAtMs = Date.parse((res.headers && res.headers.get && res.headers.get("date")) || "");
+    if (answeredAtMs) clockOffsetMs = answeredAtMs - Date.now();
+    return res;
+  });
   const ago = (savedAt) => {
-    const m = Math.round((Date.now() - Date.parse(savedAt)) / 60000);
+    const m = Math.round((serverNow() - Date.parse(savedAt)) / 60000);
     return m < 1 ? "just now" : m < 60 ? m + " min ago" : m < 1440 ? Math.round(m / 60) + " h ago" : Math.round(m / 1440) + " days ago";
   };
   // Where progress goes, in the Keep your progress card.
@@ -23909,11 +24022,10 @@ var SAVES_SCRIPT = pageScript("saves", `
   }
   // The account's progress wins: keep this device's as an earlier version on the account, dated when this device
   // last played it (played_at; null when that isn't known). Answers the copy's ID, or null.
-  const keepDevice = (text) => {
-    if (!text || text === EMPTY_SAVE_TEXT) return Promise.resolve(null);
-    const p = played();
-    const body = { keep: true, save_json: text, version_id: versionId, played_at: p && p.played_at_ms ? new Date(p.played_at_ms).toISOString() : null };
-    return fetch(SAVES.api, { method: "PUT", body: JSON.stringify(body), credentials: "same-origin" })
+  const keepDevice = (text, playedAtMs = (played() || {}).played_at_ms) => {
+    if (!text || text === EMPTY_SAVE_TEXT || !cloud || cloud instanceof Promise) return Promise.resolve(null);
+    const body = { tag: cloud.tag, keep: true, save_json: text, version_id: versionId, played_at: playedAtMs ? new Date(playedAtMs).toISOString() : null };
+    return ask(SAVES.api, { method: "PUT", body: JSON.stringify(body) })
       .then((r) => (r.ok ? r.json() : null))
       .then((out) => (out && out.save_copy_id) || null)
       .catch(() => null);
@@ -23925,25 +24037,22 @@ var SAVES_SCRIPT = pageScript("saves", `
       localStorage.setItem(playedKey, JSON.stringify(value));
     } catch { return null; }
   };
-  // The game sent its save: if it changed, this device played just now.
+  // The game sent its save: if it changed, this device played just now (on Zaisma's clock).
   async function notePlayed(text) {
     const hash = await sha(text);
     const was = played();
     if (!was) played({ sha256: hash, played_at_ms: null });
-    else if (was.sha256 !== hash) played({ sha256: hash, played_at_ms: Date.now() });
+    else if (was.sha256 !== hash) played({ sha256: hash, played_at_ms: serverNow() });
   }
   // Whether this device's progress was played after the account's was saved. Not known: the account's wins.
-  const deviceIsNewer = (savedAt) => {
-    const p = played();
-    return Boolean(p && p.played_at_ms && savedAt && p.played_at_ms > Date.parse(savedAt));
-  };
+  const deviceIsNewer = (savedAt, playedAtMs = (played() || {}).played_at_ms) => Boolean(playedAtMs && savedAt && playedAtMs > Date.parse(savedAt));
   const tell = (msg) => frame && frame.contentWindow && frame.contentWindow.postMessage({ type: "zaisma:saves", ...msg }, SAVES.frameOrigin);
   // To the game itself (the SDK), not the game domain's saves script.
   const toGame = (msg) => frame && frame.contentWindow && frame.contentWindow.postMessage(msg, SAVES.frameOrigin);
   const copyFields = (copy) => ({ id: copy.id, savedAt: copy.saved_at, copyReason: copy.copy_reason, sizeBytes: copy.size_bytes, isCurrentSave: copy.is_current_save, versionId: copy.version_id ?? null });
   async function copyById(saveCopyId) {
     if (!saveCopyId) return null;
-    const res = await fetch(SAVES.api + "/copies", { credentials: "same-origin" }).catch(() => null);
+    const res = await ask(SAVES.api + "/copies").catch(() => null);
     const out = res && res.ok ? await res.json().catch(() => null) : null;
     const copy = out && Array.isArray(out.save_copies) ? out.save_copies.find((each) => each.id === saveCopyId) : null;
     return copy ? copyFields(copy) : null;
@@ -23964,7 +24073,7 @@ var SAVES_SCRIPT = pageScript("saves", `
   // One retry for a passing hiccup; a signed-out player or a game without saves just plays.
   async function load(retry = true) {
     try {
-      const res = await fetch(SAVES.api, { credentials: "same-origin" });
+      const res = await ask(SAVES.api);
       if (res.ok) return await res.json();
       if (res.status === 401 || res.status === 404 || !retry) return null;
     } catch { if (!retry) return null; }
@@ -23984,6 +24093,9 @@ var SAVES_SCRIPT = pageScript("saves", `
     pendingConflict = null; // A conflict from this reload comes after it (conflicted).
     if (applying) { clearTimeout(applying.timer); applying = null; }
     queued = null; // From the game as it was; the reloaded game sends its own.
+    clearTimeout(retryTimer);
+    retryTimer = null;
+    retryDelayMs = 0;
     cloud = load();
     openAt("_zaisma/restore#" + encodeURIComponent(SAVES.query));
     clearTimeout(fallback);
@@ -24094,8 +24206,8 @@ var SAVES_SCRIPT = pageScript("saves", `
     const c = await load();
     if (!c) return say("Couldn't reach your saved progress, so this visit won't save to your account.");
     cloud = c;
-    if (!c.version_number) {
-      // A new account: whatever this device has becomes the account's save.
+    if (!c.version_number || !c.save_data) {
+      // A new account (or one whose save has no data): whatever this device has becomes the account's save.
       paused = false;
       synced = null;
       welcome = true;
@@ -24108,6 +24220,10 @@ var SAVES_SCRIPT = pageScript("saves", `
       tell({ step: "sync", text: guestText });
       say("Progress saves to your account.");
       pop("Your progress now saves to your account.");
+    } else if (!guestText || guestText === EMPTY_SAVE_TEXT) {
+      // Nothing on this device: the game reopens with the account's progress.
+      forceCloud = true;
+      openThroughRestore();
     } else if (deviceIsNewer(c.saved_at)) {
       // Both have progress, and this device's was played more recently: it replaces the account's, which is kept
       // as an earlier version (the game hears the conflict once that save is stored).
@@ -24126,9 +24242,37 @@ var SAVES_SCRIPT = pageScript("saves", `
       pop("You're signed in. Your account's progress in this game is newer, so the game reloaded with it.");
     }
   }
-  addEventListener("focus", joined);
-  document.addEventListener("visibilitychange", joined);
-  try { new BroadcastChannel("zaisma").onmessage = (e) => e.data === "signed-in" && joined(); } catch {}
+  // Saving paused after a 401 or another account signing in: once the account answers again, the game reopens
+  // through the restore page as whoever is signed in now, which checks whose progress is on this device.
+  async function signedInAgain() {
+    if (!isAwaitingSignIn || guest || !signedIn()) return;
+    const res = await ask(SAVES.api + "?version").catch(() => null);
+    if (!isAwaitingSignIn || !res || !res.ok) return;
+    isAwaitingSignIn = false;
+    openThroughRestore();
+  }
+  function awaitSignIn(isOtherAccount) {
+    paused = true;
+    queued = null;
+    tell({ step: "pause" });
+    isAwaitingSignIn = true;
+    if (isOtherAccount) signedInAgain();
+    else say("Sign in again to keep saving to your account.");
+  }
+  const heardSignIn = () => { joined(); signedInAgain(); };
+  addEventListener("focus", heardSignIn);
+  document.addEventListener("visibilitychange", heardSignIn);
+  try { new BroadcastChannel("zaisma").onmessage = (e) => e.data === "signed-in" && heardSignIn(); } catch {}
+
+  // Whose this device's progress is, when it isn't this account's (tag): another account's synced save (isSynced),
+  // or progress never synced, which belongs to the account that played here last. Null: this account's, or no one's.
+  function progressOwner(localHash, tag) {
+    const markers = markersHere();
+    const synced = markers.find((each) => each.tag !== tag && each.sha256 === localHash);
+    if (synced) return { tag: synced.tag, isSynced: true };
+    const last = markers.reduce((newest, each) => (!newest || (each.marked_at_ms || 0) > (newest.marked_at_ms || 0) ? each : newest), null);
+    return last && last.tag !== tag ? { tag: last.tag, isSynced: false } : null;
+  }
 
   async function restore(text, broken) {
     clearTimeout(fallback);
@@ -24143,63 +24287,98 @@ var SAVES_SCRIPT = pageScript("saves", `
       say("Couldn't reach your saved progress, so this visit won't save to your account.");
       return tell({ step: "restore", action: "keep" });
     }
-    const localHash = await sha(text);
-    const empty = text === EMPTY_SAVE_TEXT;
+    // An answer without its data counts as no save on the account; the next save still starts from its version.
+    const hasCloudSave = Boolean(c.version_number && c.save_data);
+    let localHash = await sha(text);
     // The first time this page sees this device's save: from now on a change to it counts as playing.
     if (!played()) played({ sha256: localHash, played_at_ms: null });
     // A marker from before version_number and sha256 matches neither, so the most recently played wins.
     const mark = marker(c.tag);
+    // A shared computer: progress here that's another account's stays that account's, and this account starts from its own.
+    let deviceText = text;
+    let isStorageOthers = false;
+    if (text !== EMPTY_SAVE_TEXT && localHash !== c.sha256 && !(mark && mark.sha256 === localHash)) {
+      const owner = progressOwner(localHash, c.tag);
+      if (owner) {
+        if (!owner.isSynced && !putAside(owner.tag, { text, played_at_ms: (played() || {}).played_at_ms || null })) {
+          say("Another account's progress is on this device, so this visit won't save to your account.");
+          return tell({ step: "restore", action: "keep" });
+        }
+        isStorageOthers = true;
+        deviceText = EMPTY_SAVE_TEXT;
+      }
+    }
+    // This account's own progress, moved aside while another account played here: it's this device's progress again.
+    const aside = takeAside(c.tag);
+    let devicePlayedAtMs = (played() || {}).played_at_ms;
+    if (aside) {
+      deviceText = aside.text;
+      devicePlayedAtMs = aside.played_at_ms;
+      localHash = await sha(aside.text);
+    }
+    const empty = deviceText === EMPTY_SAVE_TEXT;
     let use;
-    if (forceCloud && c.version_number) {
+    if (forceCloud && hasCloudSave) {
       use = "cloud";
       // This device's progress since its last save (the account keeps one copy of each progress).
       // Unchanged since it last synced, it was the account's own save, so there's nothing to keep; nor when it was kept before the reload.
-      if (!empty && localHash !== c.sha256 && !(mark && mark.sha256 === localHash) && text !== keptBeforeReload) keepDevice(text);
+      if (!empty && localHash !== c.sha256 && !(mark && mark.sha256 === localHash) && deviceText !== keptBeforeReload) keepDevice(deviceText, devicePlayedAtMs);
     }
-    else if (!c.version_number) use = "local";
+    else if (!hasCloudSave) use = "local";
     else if (empty || localHash === c.sha256) use = "cloud";
     else if (mark && mark.version_number === c.version_number) use = "local";
     else if (mark && mark.sha256 === localHash) use = "cloud";
     else {
       // Both played on since they last matched: the progress played most recently wins, the other is kept.
-      use = deviceIsNewer(c.saved_at) ? "local" : "cloud";
-      if (use === "cloud") conflicted("account", keepDevice(text));
+      use = deviceIsNewer(c.saved_at, devicePlayedAtMs) ? "local" : "cloud";
+      if (use === "cloud") conflicted("account", keepDevice(deviceText, devicePlayedAtMs));
       else replacing = true; // The game hears the conflict once its save replaced the account's (store).
     }
     forceCloud = false;
     keptBeforeReload = null;
-    if (use === "cloud" && c.version_number) {
-      restoring = c;
-      tell({ step: "restore", action: "use-cloud", data: c.save_data });
+    // What goes in the game's storage: the account's save, this account's moved-aside progress, or nothing in place of another's.
+    const putting = use === "cloud" && hasCloudSave ? { saveData: c.save_data } : aside && !empty ? { saveData: JSON.parse(deviceText), isDeviceProgress: true, aside } : isStorageOthers ? { saveData: JSON.parse(EMPTY_SAVE_TEXT) } : null;
+    if (putting) {
+      restoring = { c, ...putting };
+      tell({ step: "restore", action: "use-cloud", data: putting.saveData });
     } else {
       paused = false;
       // Keep this device's save; the game sends it as soon as it starts.
-      synced = empty && !c.version_number ? text : null;
+      synced = empty && !hasCloudSave ? text : null;
       tell({ step: "restore", action: "keep" });
       say("Progress saves to your account.");
     }
   }
 
-  // The game domain put the account's save in place (or couldn't). Only then does saving start.
+  // The game domain put a save in place (or couldn't). Only then does saving start.
   function restored(ok) {
-    const c = restoring;
+    const r = restoring;
     restoring = null;
+    if (!r) return;
     if (!ok) {
+      if (r.aside) putAside(r.c.tag, r.aside);
       say("Couldn't put your account's progress on this device, so this visit won't save to your account.");
       return;
     }
-    synced = canonical(c.save_data);
-    marker(c.tag, { version_number: c.version_number, sha256: c.sha256 });
-    played({ sha256: c.sha256, played_at_ms: Date.parse(c.saved_at) || null });
+    const c = r.c;
+    const isAccountSave = r.saveData === c.save_data;
+    // This account's own moved-aside progress back in place: the game sends it, and it saves from the account's version.
+    synced = r.isDeviceProgress ? null : canonical(r.saveData);
     paused = false;
-    say("Progress saves to your account. Last saved " + ago(c.saved_at) + ".");
+    if (isAccountSave) {
+      marker(c.tag, { version_number: c.version_number, sha256: c.sha256 });
+      played({ sha256: c.sha256, played_at_ms: Date.parse(c.saved_at) || null });
+    } else {
+      sha(canonical(r.saveData)).then((hash) => played({ sha256: hash, played_at_ms: r.isDeviceProgress ? r.aside.played_at_ms || null : null }));
+    }
+    say(isAccountSave ? "Progress saves to your account. Last saved " + ago(c.saved_at) + "." : "Progress saves to your account.");
   }
 
   async function store(text) {
     if (paused) return;
-    if (saving) { queued = text; return; }
-    const body = JSON.stringify({ base_version_number: cloud.version_number, save_json: text, version_id: versionId, ...(replacing ? { replace: true } : {}) });
-    saving = fetch(SAVES.api, { method: "PUT", body, credentials: "same-origin", keepalive: body.length < 60000 }).catch(() => null);
+    if (saving || retryTimer) { queued = text; return; }
+    const body = JSON.stringify({ tag: cloud.tag, base_version_number: cloud.version_number, save_json: text, version_id: versionId, ...(replacing ? { replace: true } : {}) });
+    saving = ask(SAVES.api, { method: "PUT", body, keepalive: body.length < 60000 }).catch(() => null);
     const opened = openCount;
     const res = await saving;
     saving = null;
@@ -24208,9 +24387,13 @@ var SAVES_SCRIPT = pageScript("saves", `
     // Going back to an earlier version: a save that went through still moved the account on; anything else waits for that.
     if (isRestoringCopy && !(res && res.ok)) return;
     const out = res ? await res.json().catch(() => ({})) : {};
-    if (res && res.ok) {
-      if (replacing) conflicted("this_device", Promise.resolve(out.kept_save_copy_id));
+    // A 409 for exactly this save: it landed before (its answer was lost), so it's saved.
+    const isSavedBefore = res && res.status === 409 && out.error !== "account_changed" && out.sha256 && out.sha256 === (await sha(text));
+    if (opened !== openCount) return;
+    if (res && (res.ok || isSavedBefore)) {
+      if (replacing && res.ok) conflicted("this_device", Promise.resolve(out.kept_save_copy_id));
       replacing = false;
+      retryDelayMs = 0;
       cloud.version_number = out.version_number;
       cloud.sha256 = out.sha256;
       synced = text;
@@ -24218,17 +24401,23 @@ var SAVES_SCRIPT = pageScript("saves", `
       say("Progress saves to your account. Last saved just now.");
       if (welcome) pop("Your progress now saves to your account.");
       welcome = false;
+    } else if (res && res.status === 409 && out.error === "account_changed") {
+      // Another account signed in on this browser: this page's progress never goes to it.
+      return awaitSignIn(true);
     } else if (res && res.status === 409) {
       paused = true;
       tell({ step: "pause" });
+      // The newest progress this device has; a save waiting behind this one is from before whatever happens next.
+      const newest = queued ?? text;
+      queued = null;
       // The developer's change always wins, and so does another device's progress played after this device's:
       // reload the game with it, keeping this device's progress. Otherwise this device's, played just now, replaces it.
       // A developer's change is never a conflict, and a game that listens for it takes it in place.
       if (out.changed_by_kind === "developer" && listening.has("developerChange")) {
-        takeDeveloperChange(text);
+        takeDeveloperChange(newest);
       } else if (out.changed_by_kind === "developer" || !deviceIsNewer(out.saved_at)) {
-        const keeping = keepDevice(text);
-        keptBeforeReload = text;
+        const keeping = keepDevice(newest);
+        keptBeforeReload = newest;
         forceCloud = true;
         openThroughRestore();
         if (out.changed_by_kind !== "developer") conflicted("account", keeping);
@@ -24243,14 +24432,27 @@ var SAVES_SCRIPT = pageScript("saves", `
       overLimit();
       return;
     } else if (res && res.status === 401) {
+      return awaitSignIn(false);
+    } else if (res && res.status === 404) {
+      // The game stopped saving to accounts (or isn't live): nothing more goes for this visit.
       paused = true;
+      queued = null;
       tell({ step: "pause" });
-      say("Sign in again to keep saving to your account.");
+      say("This game doesn't save to your account right now, so its progress stays on this device.");
       return;
     } else {
-      // Let the game send this save again on its next check.
+      // Offline, too often or Zaisma had a problem: send the newest save again later, waiting longer each time.
+      queued = queued ?? text;
+      retryDelayMs = Math.min(retryDelayMs ? retryDelayMs * 2 : 30000, 300000);
+      const retryAfterMs = res && res.status === 429 ? Number((res.headers && res.headers.get && res.headers.get("retry-after")) || 0) * 1000 : 0;
       say("Couldn't save to your account. Trying again soon.");
-      tell({ step: "sync", text: synced });
+      retryTimer = setTimeout(() => {
+        retryTimer = null;
+        const next = queued;
+        queued = null;
+        if (next !== null && opened === openCount) store(next);
+      }, Math.max(retryDelayMs, retryAfterMs || 0));
+      return;
     }
     if (queued !== null) { const next = queued; queued = null; store(next); }
   }
@@ -24260,7 +24462,7 @@ var SAVES_SCRIPT = pageScript("saves", `
   // asked for, so this costs one small read.
   document.addEventListener("visibilitychange", async () => {
     if (guest || paused || saving || document.visibilityState !== "visible" || !cloud || cloud instanceof Promise) return;
-    const res = await fetch(SAVES.api + "?version", { credentials: "same-origin" }).catch(() => null);
+    const res = await ask(SAVES.api + "?version").catch(() => null);
     const out = res && res.ok ? await res.json().catch(() => null) : null;
     if (!out || out.version_number === cloud.version_number || paused || saving) return;
     if (out.changed_by_kind !== "developer" && deviceIsNewer(out.saved_at)) return;
@@ -24277,6 +24479,7 @@ var SAVES_SCRIPT = pageScript("saves", `
   // text is this device's progress since its last save, kept as an earlier version (null: nothing to keep).
   async function takeDeveloperChange(text) {
     const opened = openCount;
+    queued = null;
     const keeping = keepDevice(text);
     const reload = () => {
       keptBeforeReload = text;
@@ -24293,6 +24496,7 @@ var SAVES_SCRIPT = pageScript("saves", `
     const taking = applying;
     if (!taking) return;
     applying = null;
+    queued = null; // From the game before the change: the game sends its own after it.
     clearTimeout(taking.timer);
     if (!ok) return taking.reload();
     const c = taking.c;
@@ -24330,7 +24534,7 @@ var SAVES_SCRIPT = pageScript("saves", `
     reply({ status: "asking" });
     if (guest || !signedIn()) return fail("account_needed", "Earlier versions are kept for players signed in to Zaisma: a guest's progress stays in this browser. Ask the player to sign in first (Zaisma.player.signIn).");
     if (m.request === "list_copies") {
-      const res = await fetch(SAVES.api + "/copies", { credentials: "same-origin" }).catch(() => null);
+      const res = await ask(SAVES.api + "/copies").catch(() => null);
       const out = res && res.ok ? await res.json().catch(() => null) : null;
       if (!out || !Array.isArray(out.save_copies)) return failed();
       return reply({ answer: out.save_copies.map(copyFields) });
@@ -24339,7 +24543,7 @@ var SAVES_SCRIPT = pageScript("saves", `
     const copyPath = SAVES.api + "/copies/" + m.saveCopyId;
     const noCopy = () => fail("no_save_copy", "The player has no earlier version " + m.saveCopyId + " in this game: Zaisma.saves.listCopies() lists the ones kept.");
     if (m.request === "get_copy") {
-      const res = await fetch(copyPath, { credentials: "same-origin" }).catch(() => null);
+      const res = await ask(copyPath).catch(() => null);
       if (res && res.status === 404) return noCopy();
       const out = res && res.ok ? await res.json().catch(() => null) : null;
       if (!out || !out.save_copy) return failed();
@@ -24351,7 +24555,7 @@ var SAVES_SCRIPT = pageScript("saves", `
     isRestoringCopy = true;
     queued = null;
     tell({ step: "pause" });
-    const res = await fetch(copyPath + "/restore", { method: "POST", credentials: "same-origin" }).catch(() => null);
+    const res = await ask(copyPath + "/restore", { method: "POST", body: JSON.stringify({ tag: cloud && !(cloud instanceof Promise) ? cloud.tag : null }) }).catch(() => null);
     isRestoringCopy = false;
     if (res && res.ok) {
       reply({ answer: null });
@@ -24360,6 +24564,11 @@ var SAVES_SCRIPT = pageScript("saves", `
       openThroughRestore();
       return;
     }
+    // Another account signed in on this browser: the game reopens as that account.
+    if (res && res.status === 409) {
+      awaitSignIn(true);
+      return failed();
+    }
     paused = wasPaused;
     if (!wasPaused) tell({ step: "sync", text: synced });
     if (res && res.status === 404) return noCopy();
@@ -43438,7 +43647,7 @@ var PICTURE_FIELDS = {
   },
   overlay: {
     type: "string",
-    description: `Covers only ("" for screenshots): what is laid over the picture instead of being part of the scene: a button, menu, shop panel, row of rewards, badge, sticker, starburst, icon bubble, or an arrow or circle pointing at something. A few words naming each. Lighting, sparks and effects in the scene aren't overlays. "" when there's nothing.`
+    description: `Covers and backgrounds ("" for screenshots): what is laid over the picture instead of being part of the scene: a button, menu, shop panel, row of rewards, badge, sticker, starburst, icon bubble, or an arrow or circle pointing at something. A few words naming each. Lighting, sparks and effects in the scene aren't overlays. "" when there's nothing.`
   },
   fake_reward: {
     type: "string",
@@ -43446,7 +43655,7 @@ var PICTURE_FIELDS = {
   },
   famous_name: {
     type: "string",
-    description: `Covers only ("" for screenshots): a famous character, logo or name from a film, show, game, brand or sports club that a typical teenager would name at a glance, like Mario, Naruto, Goku, Lightning McQueen, the Batmobile, Pikachu, a football club's crest, the Roblox logo or Robux. Name it. Generic blocky, pixel or cartoon figures, and lookalikes nobody would name for sure, are not famous: when unsure, "". "" when there's none.`
+    description: `Covers and backgrounds ("" for screenshots): a famous character, logo or name from a film, show, game, brand or sports club that a typical teenager would name at a glance, like Mario, Naruto, Goku, Lightning McQueen, the Batmobile, Pikachu, a football club's crest, the Roblox logo or Robux. Name it. Generic blocky, pixel or cartoon figures, and lookalikes nobody would name for sure, are not famous: when unsure, "". "" when there's none.`
   },
   main_subject: {
     type: "string",
@@ -43462,7 +43671,7 @@ var PICTURE_FIELDS = {
   },
   background_text: {
     type: "string",
-    description: `Backgrounds only ("" for covers and screenshots): every word, number, symbol or logo written on the picture, the game's own name and logo included, quoted exactly or named; anything laid over it instead of being part of the scene, like a button, badge or sticker; and any famous character, logo or name a typical teenager would name at a glance. Separated by " / ". Words that are part of the scene (a sign on a building, a neon shop sign, writing on a shirt) don't count. "" when there's none.`
+    description: `Backgrounds only ("" for covers and screenshots): every word, number, symbol or logo written on the picture, the game's own name and logo included, quoted exactly or named, separated by " / ". Overlays go in overlay and famous characters, logos and names in famous_name. Words that are part of the scene (a sign on a building, a neon shop sign, writing on a shirt) don't count. "" when there's none.`
   },
   has_safety_concern: {
     type: "boolean",
@@ -43523,6 +43732,9 @@ function isLocalPreview(env2) {
   return siteHost === "localhost" || siteHost === "127.0.0.1" || siteHost.endsWith(".ts.net");
 }
 
+// ../../apps/site/src/credit-api.ts
+var PENDING_REFUND_FIRST_RETRY_MS = 5 * 6e4;
+
 // ../../apps/site/src/stripe-account-api.ts
 var CONNECT_STATE_DURATION_MS = 10 * 6e4;
 
@@ -44077,6 +44289,13 @@ function playersSheet(options) {
   const words3 = (markup) => ({ kind: "words", markup });
   const body = stack({
     items: [
+      // Friend requests waiting for the player, with Accept and Turn down (friend-requests.ts brings them).
+      {
+        kind: "block",
+        id: "players-requests",
+        isHidden: true,
+        markup: stack({ items: [words3(html`<h3>Friend requests</h3>`), { kind: "block", markup: listRows({ whenEmpty: html`<p hidden></p>`, rows: [], id: "players-requests-list", label: "Friend requests" }) }] })
+      },
       words3(html`<h3 id="players-room-title">In this room<span id="players-count"></span></h3>`),
       // While nobody's listed, the note says why (the page's script writes it): the list's empty state.
       { kind: "block", markup: listRows({ whenEmpty: html`<p id="players-note" hidden></p>`, rows: [], id: "players-list", label: "In this room" }) },
@@ -44093,6 +44312,10 @@ function playersSheet(options) {
   const playerBody = stack({
     items: [
       { kind: "control", markup: cutButton("Profile", { href: "/", id: "players-player-profile", isFullWidth: true, isHidden: true }) },
+      // Only when they take friend requests from this player (friend-requests.ts asks), with no hint why otherwise.
+      { kind: "control", markup: cutButton("Add friend", { type: "button", id: "players-player-friend", isFullWidth: true, isHidden: true }) },
+      words3(html`<p id="players-player-sent" hidden>Friend request sent.</p>`),
+      words3(html`<p id="players-player-sign-in" hidden>${textLink("Sign in", options.signInPath)} to add friends.</p>`),
       { kind: "control", markup: cutButton("Block", { type: "button", id: "players-player-block", isFullWidth: true }) },
       { kind: "control", markup: cutButton("Report", { type: "button", id: "players-player-report", isFullWidth: true }) }
     ]
@@ -44102,6 +44325,7 @@ function playersSheet(options) {
   return html`${sheet({ id: "players", title: "Players", body, closeLabel: "Close", placement: "foot" })}
 ${sheet({ id: "players-player", title: "Player", body: playerBody, closeLabel: "Close", placement: "foot" })}
 <template id="players-row">${rowTemplate}</template>
+<template id="players-request-row">${listRows({ whenEmpty: html`<p hidden></p>`, rows: [{ lead: pictureFrame("?", "md"), title: "?", action: [runButton("Accept", { ...rowButton, dataAttributes: { "request-action": "accept" } }), cutButton("Turn down", { ...rowButton, dataAttributes: { "request-action": "turn-down" } })] }] })}</template>
 ${pageData("players-data", { gameOrigin: options.gameOrigin, slug: options.slug, hasZaismaRooms: options.hasZaismaRooms, canSignIn: options.canSignIn })}
 ${scriptTags(PLAYERS_SHEET_SCRIPT)}`;
 }
@@ -44140,6 +44364,33 @@ var PLAYERS_SHEET_SCRIPT = pageScript("players-sheet", String.raw`(() => {
   }
   // A button's words: the last span in its face (cutButton).
   const wordsOf = (button) => button.querySelector(".face > span:last-child");
+  // Friend requests waiting for this player, and the ones they sent from here this session.
+  let requests = [];
+  const sentTo = new Set();
+  addEventListener("zaisma:friend-requests-waiting", (e) => { requests = e.detail && Array.isArray(e.detail.requests) ? e.detail.requests : []; if (sheet.open) render(); });
+  addEventListener("zaisma:friend-request-sent", (e) => { if (e.detail) sentTo.add(e.detail.id); });
+  // Friends now (an accept either way): the row says Friend, and the menu has nothing to add.
+  addEventListener("zaisma:friend-added", (e) => {
+    if (!e.detail) return;
+    sentTo.delete(e.detail.id);
+    const known = accounts.get(e.detail.id);
+    if (known && !known.isFriend) { known.isFriend = true; if (sheet.open) render(); }
+  });
+  function renderRequests() {
+    const list = $("players-requests-list");
+    list.textContent = "";
+    $("players-requests").hidden = !requests.length;
+    list.hidden = !requests.length;
+    requests.slice(0, 20).forEach((waiting) => {
+      const item = $("players-request-row").content.querySelector("li").cloneNode(true);
+      paint(item.querySelector(".av"), waiting.name);
+      item.querySelector(".list-row-title").textContent = waiting.name;
+      item.querySelectorAll("[data-request-action]").forEach((button) => button.addEventListener("click", () => {
+        dispatchEvent(new CustomEvent("zaisma:answer-friend-request", { detail: { id: waiting.player_id, verb: button.dataset.requestAction } }));
+      }));
+      list.appendChild(item);
+    });
+  }
 
   addEventListener("message", (e) => {
     const f = frame();
@@ -44182,6 +44433,7 @@ var PLAYERS_SHEET_SCRIPT = pageScript("players-sheet", String.raw`(() => {
   }
 
   function render() {
+    renderRequests();
     $("players-count").textContent = room ? " · " + room.players.length : "";
     const list = $("players-list");
     list.textContent = "";
@@ -44230,11 +44482,43 @@ var PLAYERS_SHEET_SCRIPT = pageScript("players-sheet", String.raw`(() => {
         profile.rel = "noopener";
       }
       $("players-player-block").hidden = isBlocked;
+      showFriendChoice(other, known, isBlocked);
       if (!playerSheet.open) playerSheet.showModal();
     });
     return item;
   }
 
+  // Add friend, Friend request sent, or Sign in to add friends: asked of Zaisma as the player's sheet opens.
+  function showFriendChoice(other, known, isBlocked) {
+    const add = $("players-player-friend"), sent = $("players-player-sent"), signIn = $("players-player-sign-in");
+    add.hidden = true;
+    sent.hidden = true;
+    signIn.hidden = !(other.kind === "account" && !isSignedIn() && CAN_SIGN_IN);
+    if (!known || known.isFriend || isBlocked || !isSignedIn()) return;
+    // Sent from here: say so at once, then ask Zaisma, which knows when it was accepted since.
+    sent.hidden = !sentTo.has(other.id);
+    const asking = other.id;
+    fetch("/friends/requests/about/" + other.id)
+      .then((res) => (res.ok ? res.json() : null))
+      .then((about) => {
+        if (!about || !chosen || chosen.id !== asking) return;
+        if (about.is_friend) {
+          sentTo.delete(asking);
+          known.isFriend = true;
+          render();
+        }
+        add.hidden = !about.can_send;
+        sent.hidden = !about.has_sent;
+      })
+      .catch(() => {});
+  }
+  $("players-player-friend").addEventListener("click", () => {
+    if (!chosen) return;
+    const playerId = chosen.id;
+    closeBoth();
+    dispatchEvent(new CustomEvent("zaisma:ask-friend-request", { detail: { id: playerId } }));
+  });
+
   function closeBoth() {
     if (playerSheet.open) playerSheet.close();
     if (sheet.open) sheet.close();
@@ -44267,7 +44551,7 @@ var PLAYERS_SHEET_SCRIPT = pageScript("players-sheet", String.raw`(() => {
 
   // The bar's button opens it (SHEET_SCRIPT does too, by its aria-controls; this runs first and fills it in).
   opener.addEventListener("click", () => {
-    ["report", "block"].forEach((id) => { const other = $(id); if (other && other.open) other.close(); });
+    ["report", "block", "friend-request"].forEach((id) => { const other = $(id); if (other && other.open) other.close(); });
     render();
     loadFriends();
     if (!sheet.open) sheet.showModal();
@@ -44277,6 +44561,238 @@ var PLAYERS_SHEET_SCRIPT = pageScript("players-sheet", String.raw`(() => {
   update();
 })();`);
 
+// ../../apps/site/src/friend-requests.ts
+function friendRequestParts(options) {
+  const body = stack({
+    items: [
+      { kind: "block", markup: listRows({ whenEmpty: emptyState({ title: "Nobody picked", text: "Who you're adding shows here." }), rows: [{ lead: pictureFrame("?", "md"), title: "?" }], id: "friend-request-who" }) },
+      { kind: "words", markup: html`<p><span id="friend-request-told"></span> can accept it from their game or their friends page. Once you're friends, you can chat and join each other in games that allow it.</p>` },
+      { kind: "block", markup: html`<div id="friend-request-error" role="alert" hidden>${banner({ text: "Couldn't send it. Check your connection and try again.", icon: "warning", tone: "warning" })}</div>` }
+    ]
+  });
+  const card = playingCard({
+    id: "friend-request-card",
+    title: "Friend request",
+    body: stack({
+      items: [
+        { kind: "words", markup: html`<p><strong id="friend-request-card-name"></strong> wants to be friends.</p>` },
+        {
+          kind: "block",
+          markup: row({ widths: "fit", label: "Answer", items: [{ kind: "control", markup: runButton("Accept", { type: "button", id: "friend-request-accept" }) }, { kind: "control", markup: cutButton("Not now", { type: "button", id: "friend-request-later" }) }] })
+        }
+      ]
+    })
+  });
+  const acceptedCard = playingCard({ id: "friend-accepted-card", body: stack({ items: [{ kind: "words", markup: html`<p>You and <strong id="friend-accepted-name"></strong> are friends now.</p>` }] }) });
+  return html`${sheet({
+    id: "friend-request",
+    title: "Send a friend request?",
+    body,
+    closeLabel: "Close",
+    placement: "foot",
+    buttons: [cutButton("Cancel", { type: "submit", formMethod: "dialog" }), runButton("Send request", { type: "button", id: "friend-request-yes" })]
+  })}
+${card}
+${acceptedCard}
+${pageData("friend-request-data", { gameOrigin: options.gameOrigin, slug: options.slug })}
+${scriptTags(FRIEND_REQUEST_SCRIPT)}`;
+}
+var CARD_SHOWN_MS = 8e3;
+var NEWS_SHOWN_MS = 5e3;
+var FRIEND_REQUEST_SCRIPT = pageScript("friend-requests", String.raw`(() => {
+  const sheet = document.getElementById("friend-request");
+  const card = document.getElementById("friend-request-card");
+  const data = document.getElementById("friend-request-data");
+  if (!sheet || !card || !data) return;
+  const { gameOrigin: GAME_ORIGIN, slug: SLUG } = JSON.parse(data.textContent);
+  const PLAYER_ID = /^player_[a-z0-9]{1,40}$/;
+  const $ = (id) => document.getElementById(id);
+  const yes = $("friend-request-yes");
+  const frame = () => document.getElementById("game");
+  const tell = (message) => { const f = frame(); if (f && f.contentWindow) f.contentWindow.postMessage(message, GAME_ORIGIN); };
+  const isSignedIn = () => /(^|; )(__Host-)?zaisma_in=1/.test(document.cookie);
+  const post = (path, body) => fetch(path, { method: "POST", headers: body ? { "Content-Type": "application/json" } : {}, body: body ? JSON.stringify(body) : undefined }).catch(() => null);
+
+  // The request the sheet is asking about: { id, name }.
+  let asking = null;
+  function finish(status) {
+    if (!asking) return;
+    tell({ type: "zaisma:friend-request", playerId: asking.id, status });
+    if (status === "sent") dispatchEvent(new CustomEvent("zaisma:friend-request-sent", { detail: { id: asking.id } }));
+    asking = null;
+    if (sheet.open) sheet.close();
+  }
+  // Who it's for, as the page draws an account (accountPicture): initials in its own color, from the name.
+  function showWho(name) {
+    const who = $("friend-request-who");
+    let hue = 7;
+    for (const character of name) hue = (hue * 31 + character.codePointAt(0)) % 360;
+    const words = name.trim().split(/\s+/).filter(Boolean);
+    const letters = words.length > 1 ? [Array.from(words[0])[0], Array.from(words[1])[0]] : Array.from(words[0] || "?").slice(0, 2);
+    const picture = who.querySelector(".av");
+    picture.style.setProperty("--h", String(hue));
+    picture.textContent = letters.join("").toUpperCase();
+    who.querySelector(".list-row-title").textContent = name;
+  }
+  async function ask(playerId) {
+    // One question at a time: another while the sheet is up is a no.
+    if (asking) return tell({ type: "zaisma:friend-request", playerId, status: "cancelled" });
+    if (!isSignedIn()) return tell({ type: "zaisma:friend-request", playerId, status: "cancelled" });
+    tell({ type: "zaisma:friend-request", playerId, status: "asking" });
+    asking = { id: playerId, name: "" };
+    const about = await fetch("/friends/requests/about/" + playerId).then((res) => (res.ok ? res.json() : null)).catch(() => null);
+    if (!about || !about.player) { asking = { id: playerId }; return finish("not_taking_requests"); }
+    if (about.is_friend) return finish("already_friends");
+    // Already waiting looks the same as just sent, whatever became of it.
+    if (about.has_sent) return finish("sent");
+    if (!about.can_send) return finish("not_taking_requests");
+    asking.name = about.player.name;
+    $("friend-request-title").textContent = "Send " + asking.name + " a friend request?";
+    showWho(asking.name);
+    $("friend-request-told").textContent = asking.name;
+    $("friend-request-error").hidden = true;
+    yes.removeAttribute("aria-busy");
+    if (document.fullscreenElement) document.exitFullscreen().catch(() => {});
+    sheet.showModal();
+    yes.focus();
+  }
+  yes.addEventListener("click", async () => {
+    if (!asking || yes.getAttribute("aria-busy") === "true") return;
+    yes.setAttribute("aria-busy", "true");
+    $("friend-request-error").hidden = true;
+    const res = await post("/friends/requests", { player_id: asking.id, game_slug: SLUG });
+    yes.removeAttribute("aria-busy");
+    const answer = res ? await res.json().catch(() => null) : null;
+    // One back to someone whose request waited: friends at once, and they hear of it like an accept.
+    if (res && res.ok && answer && answer.status === "friends") {
+      dispatchEvent(new CustomEvent("zaisma:friend-added", { detail: { id: asking.id } }));
+      tell({ type: "zaisma:friend-request", playerId: asking.id, status: "accepted" });
+      waiting = waiting.filter((each) => each.player_id !== asking.id);
+      dispatchEvent(new CustomEvent("zaisma:friend-requests-waiting", { detail: { requests: waiting } }));
+    }
+    if (res && res.ok) return finish("sent");
+    const code = answer && answer.error ? answer.error.code : "";
+    if (code === "already_friends") return finish("already_friends");
+    if (code === "already_sent") return finish("sent");
+    if (code === "not_taking_requests" || code === "not_an_account") return finish("not_taking_requests");
+    const error = $("friend-request-error");
+    error.querySelector(".banner-text").textContent = answer && answer.error ? answer.error.message : "Couldn't send it. Check your connection and try again.";
+    error.hidden = false;
+  });
+  sheet.addEventListener("close", () => { finish("cancelled"); const f = frame(); if (f) f.focus(); });
+  // The game asks (Zaisma.friends.sendRequest); only its own frame.
+  addEventListener("message", (e) => {
+    const f = frame();
+    const d = e.data;
+    if (!f || e.source !== f.contentWindow || e.origin !== GAME_ORIGIN || !d) return;
+    if (d.type === "zaisma:friend-request" && typeof d.playerId === "string" && PLAYER_ID.test(d.playerId) && !d.status) ask(d.playerId);
+    // Someone in the room sent this player one: look now.
+    if (d.type === "zaisma:friend-requests") look();
+  });
+  // Players' Add friend.
+  addEventListener("zaisma:ask-friend-request", (e) => { if (e.detail && PLAYER_ID.test(e.detail.id)) ask(e.detail.id); });
+
+  // Requests waiting for this player, newest first; the card brings each one once a tab.
+  const SHOWN_KEY = "zaisma:friend-requests-shown";
+  const shown = () => { try { return new Set(JSON.parse(sessionStorage.getItem(SHOWN_KEY) || "[]")); } catch { return new Set(); } };
+  const keepShown = (ids) => { try { sessionStorage.setItem(SHOWN_KEY, JSON.stringify([...ids].slice(-200))); } catch {} };
+  let waiting = [];
+  let showing = null;
+  let cardTimer = null;
+  let isLooking = false;
+  let hasLooked = false;
+  // The game page while its game runs (pages.ts swaps is-leaving for is-playing).
+  const isPlaying = () => document.documentElement.classList.contains("is-playing");
+  async function look() {
+    if (!isSignedIn() || isLooking) return;
+    isLooking = true;
+    hasLooked = true;
+    const answer = await fetch("/friends/requests").then((res) => (res.ok ? res.json() : null)).catch(() => null);
+    isLooking = false;
+    if (!answer || !Array.isArray(answer.requests)) return;
+    waiting = answer.requests;
+    dispatchEvent(new CustomEvent("zaisma:friend-requests-waiting", { detail: { requests: waiting } }));
+    // Requests this player sent that were accepted: Players marks them Friend, and the news shows once a tab.
+    const seen = shown();
+    (Array.isArray(answer.accepted) ? answer.accepted : []).forEach((each) => {
+      dispatchEvent(new CustomEvent("zaisma:friend-added", { detail: { id: each.player_id } }));
+      const key = "accepted:" + each.player_id + ":" + each.answered_at_ms;
+      if (seen.has(key)) return;
+      seen.add(key);
+      news.push(each.name);
+    });
+    keepShown(seen);
+    showNext();
+  }
+  // Names whose accept this player hasn't seen yet, shown one at a time.
+  const news = [];
+  const newsCard = $("friend-accepted-card");
+  let newsTimer = null;
+  function showNews() {
+    if (!newsCard || !news.length || !newsCard.hidden || !isPlaying()) return;
+    $("friend-accepted-name").textContent = news.shift();
+    newsCard.hidden = false;
+    clearTimeout(newsTimer);
+    newsTimer = setTimeout(() => { newsCard.hidden = true; setTimeout(showNews, 600); }, ${NEWS_SHOWN_MS});
+  }
+  function showNext() {
+    showNews();
+    if (showing || !isPlaying()) return;
+    const seen = shown();
+    const next = waiting.find((each) => !seen.has(each.player_id + ":" + each.created_at_ms));
+    if (!next) return;
+    seen.add(next.player_id + ":" + next.created_at_ms);
+    keepShown(seen);
+    showing = next;
+    $("friend-request-card-name").textContent = next.name;
+    card.hidden = false;
+    clearTimeout(cardTimer);
+    cardTimer = setTimeout(hideCard, ${CARD_SHOWN_MS});
+  }
+  function hideCard() {
+    clearTimeout(cardTimer);
+    card.hidden = true;
+    showing = null;
+    setTimeout(showNext, 600);
+  }
+  // A hand on the card keeps it up.
+  card.addEventListener("pointerenter", () => clearTimeout(cardTimer));
+  card.addEventListener("pointerleave", () => { if (showing) cardTimer = setTimeout(hideCard, 3000); });
+  async function answerRequest(playerId, verb) {
+    const res = await post("/friends/requests/" + playerId + "/" + verb);
+    waiting = waiting.filter((each) => each.player_id !== playerId);
+    dispatchEvent(new CustomEvent("zaisma:friend-requests-waiting", { detail: { requests: waiting } }));
+    const isAccepted = Boolean(res && res.ok) && verb === "accept";
+    // Friends now: Players marks them, and the rooms they share tell the sender's game to have their page look.
+    if (isAccepted) {
+      dispatchEvent(new CustomEvent("zaisma:friend-added", { detail: { id: playerId } }));
+      tell({ type: "zaisma:friend-request", playerId, status: "accepted" });
+    }
+    return Boolean(res && res.ok);
+  }
+  $("friend-request-accept").addEventListener("click", async () => {
+    if (!showing) return;
+    const playerId = showing.player_id;
+    hideCard();
+    await answerRequest(playerId, "accept");
+  });
+  $("friend-request-later").addEventListener("click", hideCard);
+  // Players answers from its list too.
+  addEventListener("zaisma:answer-friend-request", (e) => {
+    if (!e.detail || !PLAYER_ID.test(e.detail.id) || (e.detail.verb !== "accept" && e.detail.verb !== "turn-down")) return;
+    if (showing && showing.player_id === e.detail.id) hideCard();
+    answerRequest(e.detail.id, e.detail.verb);
+  });
+  // The presence check-in says how many wait and how many of this player's were accepted; a change means something new to look at.
+  let lastCounts = "";
+  addEventListener("zaisma:presence", (e) => {
+    const counts = e.detail ? [e.detail.waiting_friend_request_count, e.detail.accepted_friend_request_count].map((count) => (typeof count === "number" ? count : 0)) : [0, 0];
+    if (counts.join() !== lastCounts) { lastCounts = counts.join(); if (counts[0] || counts[1] || waiting.length) look(); }
+  });
+  // Once the game is running.
+  new MutationObserver(() => { if (isPlaying()) { showNext(); if (!hasLooked) look(); } }).observe(document.documentElement, { attributes: true, attributeFilter: ["class"] });
+})();`);
+
 // ../../apps/site/src/game-updates.ts
 var LIVE_VERSION_CHECK_MS = 2 * 6e4;
 function updateBarButtons() {
@@ -45703,6 +46219,7 @@ ${multiplayer ? playersSheet({ gameOrigin, slug: game.slug, title: game.title, h
 ${keepCard}
 ${saves ? playingCard({ id: "save-toast", body: stack({ items: [{ kind: "words", markup: html`<p></p>` }] }) }) : ""}
 ${signInCard}
+${isClosed || !authConfigured(env2) ? "" : friendRequestParts({ gameOrigin, slug: game.slug })}
 ${multiplayer ? stillThereCard() : ""}
 ${leavingCard(game.title)}
 ${isClosed ? "" : buySheet({ joinHref: joinHere, signInHref: signinHere, coverUrl })}
@@ -46363,6 +46880,16 @@ var USERNAME_SCRIPT = pageScript("username-check", `(() => {
     check();
   });
 })();`);
+var JOIN_TODAY_SCRIPT = pageScript("join-today", `(() => {
+  const form = document.getElementById("age-form");
+  if (!form) return;
+  const setToday = () => {
+    const now = new Date();
+    form.elements.today.value = now.getFullYear() + "-" + String(now.getMonth() + 1).padStart(2, "0") + "-" + String(now.getDate()).padStart(2, "0");
+  };
+  setToday();
+  form.addEventListener("submit", setToday);
+})();`);
 var ENTRY_SWITCH_SCRIPT = pageScript("entry-switch", `(() => {
   const sw = document.querySelector(".city-pane .tab-switch");
   const views = [...document.querySelectorAll("[data-entry-view]")];
@@ -46752,6 +47279,7 @@ function devSheetBody(name, view) {
 var AGE_BAND_WORDS = { "13-15": "13\u201315", "16-17": "16\u201317", "18+": "18+" };
 var isSocialModeAllowed = (ageBand2, socialMode) => socialModesFor(ageBand2).includes(socialMode);
 var startingSocialMode = (ageBand2) => defaultSocialMode(ageBand2);
+var takesFriendRequests = (ageBand2, socialMode) => socialModeSettings(socialMode, ageBand2).who_can_send_friend_requests !== "nobody";
 function chatOf(ageBand2, socialMode) {
   const whoCanChat = socialModeSettings(socialMode, ageBand2).who_can_chat;
   return { whoCanChat, bandGroup: chatBandGroup({ who_can_chat: whoCanChat, age_band: ageBand2 }) };
@@ -46848,5 +47376,6 @@ export {
   playerPanelHtml,
   playersPanelHtml,
   siteAsset,
-  startingSocialMode
+  startingSocialMode,
+  takesFriendRequests
 };