@zaisma/game-server 1.9.0 → 1.10.0

package/bench/glass.js

@@ -6273,6 +6273,7 @@ var ERROR_CODES = {
   confirmation_needed: { httpStatus: 403, meaning: "This needs the developer's passkey on zaisma.com (turning spending on or up, or connecting a Stripe account): confirm_url is where they do it." },
   bad_monthly_budget_cents: { httpStatus: 400, meaning: "monthly_budget_cents isn't a whole number of cents of at least 100 ($1), or null for no paid hosting." },
   bad_top_up_amount: { httpStatus: 400, meaning: "amount_cents isn't a whole number of cents from 1,000 ($10) to 100,000 ($1,000)." },
+  account_not_protected: { httpStatus: 403, meaning: "The account has no passkey and no email yet, and a top-up keeps a card, so it needs one of them first: add a passkey or an email on zaisma.com/account." },
   no_top_up: { httpStatus: 404, meaning: "You have no top-up with that ID." },
   no_spending_request: { httpStatus: 404, meaning: "You have no spending request with that ID." },
   top_up_not_refundable: { httpStatus: 409, meaning: "The top-up has nothing left to refund: it's spent, refunded, or over 180 days old." },
@@ -6437,6 +6438,62 @@ var MATROSKA_HEAD_BYTES = 64 * 1024;
 var MAXIMUM_EMBEDDED_CHARACTER_COUNT = 40 * 1024 * 1024;
 var PACK_WINDOW_SIZE_BYTES = 32 * 1024 * 1024;
 
+// ../core/src/scan/textures.ts
+var digitsOf = (digits) => [...digits].map(Number);
+var TRITS = [
+  "0120012101220122012001210122012001200121012201220120012101220121012001210122012201200121012201220120012101220122012001210122012201200121012201220120012101220120012001210122012201200121012201210120012101220122012001210122012201200121012201220120012101220122",
+  "0000111022202220000111112221000000001110222022200001111122211110000011102220222000011111222122200000111022202220000111112221222000001110222022200001111122210001000011102220222000011111222111110000111022202220000111112221222100001110222022200001111122212221",
+  "0002000200022222111211121112000200020002000222221112111211120002000200020002222211121112111200020002000200022222111211121112222200020002000222221112111211121112000200020002222211121112111211120002000200022222111211121112111200020002000222221112111211122222",
+  "0000000000000000000000000000222211111111111111111111111111112222222222222222222222222222222222220000000000000000000000000000222200000000000000000000000000002222111111111111111111111111111122222222222222222222222222222222222211111111111111111111111111112222",
+  "0000000000000000000000000000222200000000000000000000000000002222000000000000000000000000000022222222222222222222222222222222222211111111111111111111111111112222111111111111111111111111111122221111111111111111111111111111222222222222222222222222222222222222"
+].map(digitsOf);
+var QUINTS = [
+  "01234044012341440123424401234344012340400123414101234242012343430123402301234123012342230123432301234001012341010123420101234301",
+  "00000444111114442222244433333444000004041111141422222424333334340000040011111411222224223333343300000400111114112222242233333433",
+  "00000004000000140000002400000034111111441111114411111144111111442222224422222244222222442222224433333344333333443333334433333344"
+].map(digitsOf);
+
+// ../core/src/scan/png.ts
+var CRC_TABLE = (() => {
+  const table2 = new Uint32Array(256);
+  for (let byteIndex = 0; byteIndex < 256; byteIndex++) {
+    let remainderCode = byteIndex;
+    for (let bitIndex = 0; bitIndex < 8; bitIndex++) remainderCode = remainderCode & 1 ? 3988292384 ^ remainderCode >>> 1 : remainderCode >>> 1;
+    table2[byteIndex] = remainderCode >>> 0;
+  }
+  return table2;
+})();
+
+// ../core/src/scan/unity.ts
+var MAXIMUM_BUNDLE_BLOCK_SIZE_BYTES = 32 * 1024 * 1024;
+var MAXIMUM_READ_INSIDE_SIZE_BYTES = 16 * 1024 * 1024;
+var READ_WINDOW_SIZE_BYTES = 8 * 1024 * 1024;
+var BLOCK_CACHE_SIZE_BYTES = 32 * 1024 * 1024;
+var UNITY_TEXTURE_FORMATS = {
+  2: "argb4444",
+  3: "rgb8",
+  4: "rgba8",
+  5: "argb8",
+  7: "rgb565",
+  10: "bc1",
+  11: "bc2",
+  12: "bc3",
+  13: "rgba4444",
+  14: "bgra8",
+  25: "bc7",
+  34: "etc1",
+  45: "etc2_rgb",
+  46: "etc2_rgba1",
+  47: "etc2_rgba8",
+  60: "etc1",
+  61: "etc2_rgba8",
+  ...Object.fromEntries([4, 5, 6, 8, 10, 12].flatMap((sidePixelCount, i) => [[48 + i, `astc_${sidePixelCount}x${sidePixelCount}`], [54 + i, `astc_${sidePixelCount}x${sidePixelCount}`]]))
+};
+
+// ../core/src/scan/godot.ts
+var GODOT_3_FILE_FORMAT_CODE = 1 << 20 | 1 << 21;
+var WINDOW_SIZE_BYTES = 8 * 1024 * 1024;
+
 // ../core/src/plans.ts
 var PLAN_LIMITS = {
   free: { maximumLargeReviewsPerDay: 5, maximumSmallReviewsPerDay: 30, maximumDailyCheckCount: 20, maximumVersionsPerDay: 20, maximumGameSizeBytes: 2 * 1024 ** 3 },
@@ -6790,6 +6847,18 @@ var REVIEW_CODES = {
     fix: `Send the background without words or logos (add_image, or add_shader for a shader); words that are part of the scene, like a sign on a building, are fine. ${COVER_GUIDE} ${IF_THE_CHECK_IS_WRONG}`,
     hasOwnMessage: true
   },
+  overlay_on_background: {
+    meaning: "Something is laid over a background instead of being part of its world, like a button, badge or sticker, so it doesn't show; the message says what.",
+    contentRule: null,
+    fix: `Send the background without it (add_image, or add_shader for a shader). ${COVER_GUIDE} ${IF_THE_CHECK_IS_WRONG}`,
+    hasOwnMessage: true
+  },
+  famous_name_on_background: {
+    meaning: "A background shows a famous character, logo or name, from a film, show, game, brand or club, so it doesn't show; the message names it.",
+    contentRule: null,
+    fix: `Send a background of your game's own world (add_image, or add_shader for a shader). Only obvious ones count. If you own it or have permission, message_zaisma with the game_slug. ${COVER_GUIDE}`,
+    hasOwnMessage: true
+  },
   // The shader check (Backgrounds in docs/DEVELOPER-API.md): a shader is drawn before anyone sees it
   shader_does_not_compile: {
     meaning: "The shader didn't compile; the message gives the first compiler error.",
@@ -6832,18 +6901,19 @@ var SOCIAL_SETTING_CHOICES = {
   who_sees_playing_now: ["nobody", "friends", "anyone"],
   who_sees_played_games: ["nobody", "friends", "anyone"],
   who_sees_online: ["nobody", "friends"],
-  who_can_send_friend_requests: ["nobody", "anyone"],
+  who_can_send_friend_requests: ["nobody", "played_with", "anyone"],
   who_sees_profile: ["friends", "anyone"]
 };
 var SOCIAL_SETTINGS = Object.keys(SOCIAL_SETTING_CHOICES);
 var SOCIAL_MODES = ["solo_focused", "friends_focused", "open_and_social"];
 var SOCIAL_MODE_SETTINGS = {
   solo_focused: { who_can_chat: "nobody", who_can_join: "friends", who_sees_playing_now: "friends", who_sees_played_games: "friends", who_sees_online: "friends", who_can_send_friend_requests: "nobody", who_sees_profile: "friends" },
-  friends_focused: { who_can_chat: "friends", who_can_join: "friends", who_sees_playing_now: "friends", who_sees_played_games: "friends", who_sees_online: "friends", who_can_send_friend_requests: "nobody", who_sees_profile: "friends" },
+  // Friends-focused keeps every way to reach the player with friends, but anyone can offer friendship (Julius, Oct 27, 2026).
+  friends_focused: { who_can_chat: "friends", who_can_join: "friends", who_sees_playing_now: "friends", who_sees_played_games: "friends", who_sees_online: "friends", who_can_send_friend_requests: "anyone", who_sees_profile: "friends" },
   open_and_social: { who_can_chat: "anyone", who_can_join: "anyone", who_sees_playing_now: "anyone", who_sees_played_games: "anyone", who_sees_online: "friends", who_can_send_friend_requests: "anyone", who_sees_profile: "anyone" }
 };
 var AGE_LIMITS = {
-  "13-15": { who_can_chat: "friends", who_can_join: "friends", who_sees_playing_now: "friends", who_sees_played_games: "friends", who_sees_online: "friends", who_can_send_friend_requests: "nobody", who_sees_profile: "anyone" },
+  "13-15": { who_can_chat: "friends", who_can_join: "friends", who_sees_playing_now: "friends", who_sees_played_games: "friends", who_sees_online: "friends", who_can_send_friend_requests: "played_with", who_sees_profile: "anyone" },
   "16-17": { who_can_chat: "anyone", who_can_join: "friends", who_sees_playing_now: "friends", who_sees_played_games: "friends", who_sees_online: "friends", who_can_send_friend_requests: "anyone", who_sees_profile: "anyone" },
   "18+": { who_can_chat: "anyone", who_can_join: "anyone", who_sees_playing_now: "anyone", who_sees_played_games: "anyone", who_sees_online: "friends", who_can_send_friend_requests: "anyone", who_sees_profile: "anyone" }
 };
@@ -6863,7 +6933,8 @@ function defaultSocialMode(band) {
   return band === "13-15" ? "solo_focused" : "friends_focused";
 }
 function socialModeSettings(socialMode, band) {
-  return withinAgeLimits(SOCIAL_MODE_SETTINGS[socialMode], band);
+  const settings = withinAgeLimits(SOCIAL_MODE_SETTINGS[socialMode], band);
+  return band === "13-15" ? { ...settings, who_can_send_friend_requests: "nobody" } : settings;
 }
 function chatBandGroup(account) {
   if (account.who_can_chat === "nobody") return null;
@@ -14782,8 +14853,10 @@ component({
 .choice-cards { --choice-row-least: calc(var(--choice-count) * var(--size-card)); display: flex; flex-wrap: wrap; align-items: stretch; gap: var(--gap-control-stack) 0; }
 .choice-cards > .choice-card { flex: 1 1 calc((var(--choice-row-least) - 100%) * 999); }
 .choice-cards > .choice-card:not(:last-child) { margin-inline-end: max(var(--gap-control-row-boxes), min(0px, (var(--choice-row-least) - 100%) * 999)); }
-.choice-card { position: relative; display: flex; align-items: flex-start; gap: var(--gap-words-words); min-height: 76px; padding: 14px var(--pad-inside-words); cursor: pointer; -webkit-tap-highlight-color: transparent;
+.choice-card { position: relative; display: flex; align-items: flex-start; gap: var(--gap-words-words); min-height: 44px; padding: 14px var(--pad-inside-words); cursor: pointer; -webkit-tap-highlight-color: transparent;
   color: var(--muted); --face-color: var(--well); background: var(--face-color); box-shadow: var(--well-shade); clip-path: var(--cut-shape); transition: --face-color 0.2s, box-shadow 0.2s, color 0.2s; }
+/* A card with a line on what it means has room for it; one with only its name (an amount) is as tall as its name, never taller than its content. */
+.choice-card:has(.choice-text) { min-height: 76px; }
 .choice-card > :not(.cut-line):not(.choice-input) { position: relative; z-index: 2; }
 .choice-input { position: absolute; inset: 0; z-index: 3; width: 100%; height: 100%; margin: 0; opacity: 0; cursor: pointer; }
 .choice-card > .ico { flex: none; margin-top: 1px; color: var(--muted); }
@@ -16779,7 +16852,7 @@ component({
 function notice(options) {
   const isProblem = options.tone === "problem";
   const undo = options.undoAction === void 0 ? "" : html`<form class="notice-undo" method="post" action="${options.undoAction}">${textButton("Undo", { type: "submit" })}</form>`;
-  return html`<div class="notice glass ${options.tone}${options.isInPlace ? " in-place" : ""}" role="${isProblem ? "alert" : "status"}" data-notice="${options.tone}"${undo ? raw(" data-notice-undo") : ""} data-glass data-glass-corners="menu">${EDGE}${icon(isProblem ? "warning" : "check")}<span class="notice-text">${options.text}</span>${undo}${isProblem ? cutButton("Close", { type: "button", icon: "close", isLabelHidden: true, isSmall: true }) : ""}</div>`;
+  return html`<div class="notice glass ${options.tone}${options.isInPlace ? " in-place" : ""}" role="${isProblem ? "alert" : "status"}" data-notice="${options.tone}"${undo ? raw(" data-notice-undo") : ""} data-glass data-glass-corners="menu">${EDGE}${icon(isProblem ? "warning" : "check")}<span class="notice-text">${options.text}${options.link ? html` ${textLink(options.link.words, options.link.href)}` : ""}</span>${undo}${isProblem ? cutButton("Close", { type: "button", icon: "close", isLabelHidden: true, isSmall: true }) : ""}</div>`;
 }
 var STARTED_LOW_SCRIPT = `/* panes started low */(function () {
   function place(pane) {
@@ -16856,7 +16929,7 @@ ${touchReach(".notice")}
   examples: [
     { label: "Done", markup: notice({ text: "Saved", tone: "done", isInPlace: true }) },
     { label: "Done, longer", markup: notice({ text: "Version 14 is live", tone: "done", isInPlace: true }) },
-    { label: "A problem", markup: notice({ text: "Couldn't save: you're offline. Your changes are kept here.", tone: "problem", isInPlace: true }) },
+    { label: "A problem", markup: notice({ text: "Couldn't save: you're offline. Your changes are kept here.", tone: "problem", link: { words: "Try again", href: "#notice" }, isInPlace: true }) },
     { label: "Done, with Undo", markup: notice({ text: "Removed Ashen Crown from your games", tone: "done", undoAction: "#notice", isInPlace: true }) },
     { label: "Two at once", markup: html`<div class="notice-stack">${notice({ text: "Copied", tone: "done", isInPlace: true })}${notice({ text: "Couldn't reach Zaisma. Check your connection.", tone: "problem", isInPlace: true })}</div>` }
   ]
@@ -23278,7 +23351,7 @@ function securityHeaders(env2, extra = {}, hasTurnstileCheck = false, frames = [
 var PRESENCE_SCRIPT = pageScript("presence", `(()=>{if(!/(^|; )(__Host-)?zaisma_in=1/.test(document.cookie))return;let last=0,off=false;const b=document.body,KEY="zaisma:checked-in-at-ms";
 try{last=Number(sessionStorage.getItem(KEY))||0}catch{}if(last>Date.now())last=0;
 const beat=()=>{if(off||document.visibilityState!=="visible")return;last=Date.now();try{sessionStorage.setItem(KEY,String(last))}catch{}const g=b.dataset.presenceGame;
-fetch("/api/presence",{method:"POST",body:JSON.stringify(g?{game_slug:g}:{}),keepalive:true}).then(r=>{if(r.status===401)off=true}).catch(()=>{})};
+fetch("/api/presence",{method:"POST",body:JSON.stringify(g?{game_slug:g}:{}),keepalive:true}).then(r=>{if(r.status===401)off=true;else if(r.status===200)r.json().then(a=>dispatchEvent(new CustomEvent("zaisma:presence",{detail:a}))).catch(()=>{})}).catch(()=>{})};
 const start=()=>{beat();setInterval(beat,${PRESENCE_CHECK_IN_MS})};if(b.dataset.presenceGame||Date.now()-last>60000)start();else setTimeout(start,last+${PRESENCE_CHECK_IN_MS}-Date.now());document.addEventListener("visibilitychange",()=>{if(Date.now()-last>60000)beat()});
 new MutationObserver(beat).observe(b,{attributes:true,attributeFilter:["data-presence-game"]});
 addEventListener("pagehide",()=>{const g=b.dataset.presenceGame;if(g&&!off)navigator.sendBeacon("/api/presence",JSON.stringify({left_game_slug:g}))})})();`);
@@ -43574,7 +43647,7 @@ var PICTURE_FIELDS = {
   },
   overlay: {
     type: "string",
-    description: `Covers only ("" for screenshots): what is laid over the picture instead of being part of the scene: a button, menu, shop panel, row of rewards, badge, sticker, starburst, icon bubble, or an arrow or circle pointing at something. A few words naming each. Lighting, sparks and effects in the scene aren't overlays. "" when there's nothing.`
+    description: `Covers and backgrounds ("" for screenshots): what is laid over the picture instead of being part of the scene: a button, menu, shop panel, row of rewards, badge, sticker, starburst, icon bubble, or an arrow or circle pointing at something. A few words naming each. Lighting, sparks and effects in the scene aren't overlays. "" when there's nothing.`
   },
   fake_reward: {
     type: "string",
@@ -43582,7 +43655,7 @@ var PICTURE_FIELDS = {
   },
   famous_name: {
     type: "string",
-    description: `Covers only ("" for screenshots): a famous character, logo or name from a film, show, game, brand or sports club that a typical teenager would name at a glance, like Mario, Naruto, Goku, Lightning McQueen, the Batmobile, Pikachu, a football club's crest, the Roblox logo or Robux. Name it. Generic blocky, pixel or cartoon figures, and lookalikes nobody would name for sure, are not famous: when unsure, "". "" when there's none.`
+    description: `Covers and backgrounds ("" for screenshots): a famous character, logo or name from a film, show, game, brand or sports club that a typical teenager would name at a glance, like Mario, Naruto, Goku, Lightning McQueen, the Batmobile, Pikachu, a football club's crest, the Roblox logo or Robux. Name it. Generic blocky, pixel or cartoon figures, and lookalikes nobody would name for sure, are not famous: when unsure, "". "" when there's none.`
   },
   main_subject: {
     type: "string",
@@ -43598,7 +43671,7 @@ var PICTURE_FIELDS = {
   },
   background_text: {
     type: "string",
-    description: `Backgrounds only ("" for covers and screenshots): every word, number, symbol or logo written on the picture, the game's own name and logo included, quoted exactly or named; anything laid over it instead of being part of the scene, like a button, badge or sticker; and any famous character, logo or name a typical teenager would name at a glance. Separated by " / ". Words that are part of the scene (a sign on a building, a neon shop sign, writing on a shirt) don't count. "" when there's none.`
+    description: `Backgrounds only ("" for covers and screenshots): every word, number, symbol or logo written on the picture, the game's own name and logo included, quoted exactly or named, separated by " / ". Overlays go in overlay and famous characters, logos and names in famous_name. Words that are part of the scene (a sign on a building, a neon shop sign, writing on a shirt) don't count. "" when there's none.`
   },
   has_safety_concern: {
     type: "boolean",
@@ -44216,6 +44289,13 @@ function playersSheet(options) {
   const words3 = (markup) => ({ kind: "words", markup });
   const body = stack({
     items: [
+      // Friend requests waiting for the player, with Accept and Turn down (friend-requests.ts brings them).
+      {
+        kind: "block",
+        id: "players-requests",
+        isHidden: true,
+        markup: stack({ items: [words3(html`<h3>Friend requests</h3>`), { kind: "block", markup: listRows({ whenEmpty: html`<p hidden></p>`, rows: [], id: "players-requests-list", label: "Friend requests" }) }] })
+      },
       words3(html`<h3 id="players-room-title">In this room<span id="players-count"></span></h3>`),
       // While nobody's listed, the note says why (the page's script writes it): the list's empty state.
       { kind: "block", markup: listRows({ whenEmpty: html`<p id="players-note" hidden></p>`, rows: [], id: "players-list", label: "In this room" }) },
@@ -44232,6 +44312,10 @@ function playersSheet(options) {
   const playerBody = stack({
     items: [
       { kind: "control", markup: cutButton("Profile", { href: "/", id: "players-player-profile", isFullWidth: true, isHidden: true }) },
+      // Only when they take friend requests from this player (friend-requests.ts asks), with no hint why otherwise.
+      { kind: "control", markup: cutButton("Add friend", { type: "button", id: "players-player-friend", isFullWidth: true, isHidden: true }) },
+      words3(html`<p id="players-player-sent" hidden>Friend request sent.</p>`),
+      words3(html`<p id="players-player-sign-in" hidden>${textLink("Sign in", options.signInPath)} to add friends.</p>`),
       { kind: "control", markup: cutButton("Block", { type: "button", id: "players-player-block", isFullWidth: true }) },
       { kind: "control", markup: cutButton("Report", { type: "button", id: "players-player-report", isFullWidth: true }) }
     ]
@@ -44241,6 +44325,7 @@ function playersSheet(options) {
   return html`${sheet({ id: "players", title: "Players", body, closeLabel: "Close", placement: "foot" })}
 ${sheet({ id: "players-player", title: "Player", body: playerBody, closeLabel: "Close", placement: "foot" })}
 <template id="players-row">${rowTemplate}</template>
+<template id="players-request-row">${listRows({ whenEmpty: html`<p hidden></p>`, rows: [{ lead: pictureFrame("?", "md"), title: "?", action: [runButton("Accept", { ...rowButton, dataAttributes: { "request-action": "accept" } }), cutButton("Turn down", { ...rowButton, dataAttributes: { "request-action": "turn-down" } })] }] })}</template>
 ${pageData("players-data", { gameOrigin: options.gameOrigin, slug: options.slug, hasZaismaRooms: options.hasZaismaRooms, canSignIn: options.canSignIn })}
 ${scriptTags(PLAYERS_SHEET_SCRIPT)}`;
 }
@@ -44279,6 +44364,33 @@ var PLAYERS_SHEET_SCRIPT = pageScript("players-sheet", String.raw`(() => {
   }
   // A button's words: the last span in its face (cutButton).
   const wordsOf = (button) => button.querySelector(".face > span:last-child");
+  // Friend requests waiting for this player, and the ones they sent from here this session.
+  let requests = [];
+  const sentTo = new Set();
+  addEventListener("zaisma:friend-requests-waiting", (e) => { requests = e.detail && Array.isArray(e.detail.requests) ? e.detail.requests : []; if (sheet.open) render(); });
+  addEventListener("zaisma:friend-request-sent", (e) => { if (e.detail) sentTo.add(e.detail.id); });
+  // Friends now (an accept either way): the row says Friend, and the menu has nothing to add.
+  addEventListener("zaisma:friend-added", (e) => {
+    if (!e.detail) return;
+    sentTo.delete(e.detail.id);
+    const known = accounts.get(e.detail.id);
+    if (known && !known.isFriend) { known.isFriend = true; if (sheet.open) render(); }
+  });
+  function renderRequests() {
+    const list = $("players-requests-list");
+    list.textContent = "";
+    $("players-requests").hidden = !requests.length;
+    list.hidden = !requests.length;
+    requests.slice(0, 20).forEach((waiting) => {
+      const item = $("players-request-row").content.querySelector("li").cloneNode(true);
+      paint(item.querySelector(".av"), waiting.name);
+      item.querySelector(".list-row-title").textContent = waiting.name;
+      item.querySelectorAll("[data-request-action]").forEach((button) => button.addEventListener("click", () => {
+        dispatchEvent(new CustomEvent("zaisma:answer-friend-request", { detail: { id: waiting.player_id, verb: button.dataset.requestAction } }));
+      }));
+      list.appendChild(item);
+    });
+  }
 
   addEventListener("message", (e) => {
     const f = frame();
@@ -44321,6 +44433,7 @@ var PLAYERS_SHEET_SCRIPT = pageScript("players-sheet", String.raw`(() => {
   }
 
   function render() {
+    renderRequests();
     $("players-count").textContent = room ? " · " + room.players.length : "";
     const list = $("players-list");
     list.textContent = "";
@@ -44369,11 +44482,43 @@ var PLAYERS_SHEET_SCRIPT = pageScript("players-sheet", String.raw`(() => {
         profile.rel = "noopener";
       }
       $("players-player-block").hidden = isBlocked;
+      showFriendChoice(other, known, isBlocked);
       if (!playerSheet.open) playerSheet.showModal();
     });
     return item;
   }
 
+  // Add friend, Friend request sent, or Sign in to add friends: asked of Zaisma as the player's sheet opens.
+  function showFriendChoice(other, known, isBlocked) {
+    const add = $("players-player-friend"), sent = $("players-player-sent"), signIn = $("players-player-sign-in");
+    add.hidden = true;
+    sent.hidden = true;
+    signIn.hidden = !(other.kind === "account" && !isSignedIn() && CAN_SIGN_IN);
+    if (!known || known.isFriend || isBlocked || !isSignedIn()) return;
+    // Sent from here: say so at once, then ask Zaisma, which knows when it was accepted since.
+    sent.hidden = !sentTo.has(other.id);
+    const asking = other.id;
+    fetch("/friends/requests/about/" + other.id)
+      .then((res) => (res.ok ? res.json() : null))
+      .then((about) => {
+        if (!about || !chosen || chosen.id !== asking) return;
+        if (about.is_friend) {
+          sentTo.delete(asking);
+          known.isFriend = true;
+          render();
+        }
+        add.hidden = !about.can_send;
+        sent.hidden = !about.has_sent;
+      })
+      .catch(() => {});
+  }
+  $("players-player-friend").addEventListener("click", () => {
+    if (!chosen) return;
+    const playerId = chosen.id;
+    closeBoth();
+    dispatchEvent(new CustomEvent("zaisma:ask-friend-request", { detail: { id: playerId } }));
+  });
+
   function closeBoth() {
     if (playerSheet.open) playerSheet.close();
     if (sheet.open) sheet.close();
@@ -44406,7 +44551,7 @@ var PLAYERS_SHEET_SCRIPT = pageScript("players-sheet", String.raw`(() => {
 
   // The bar's button opens it (SHEET_SCRIPT does too, by its aria-controls; this runs first and fills it in).
   opener.addEventListener("click", () => {
-    ["report", "block"].forEach((id) => { const other = $(id); if (other && other.open) other.close(); });
+    ["report", "block", "friend-request"].forEach((id) => { const other = $(id); if (other && other.open) other.close(); });
     render();
     loadFriends();
     if (!sheet.open) sheet.showModal();
@@ -44416,6 +44561,238 @@ var PLAYERS_SHEET_SCRIPT = pageScript("players-sheet", String.raw`(() => {
   update();
 })();`);
 
+// ../../apps/site/src/friend-requests.ts
+function friendRequestParts(options) {
+  const body = stack({
+    items: [
+      { kind: "block", markup: listRows({ whenEmpty: emptyState({ title: "Nobody picked", text: "Who you're adding shows here." }), rows: [{ lead: pictureFrame("?", "md"), title: "?" }], id: "friend-request-who" }) },
+      { kind: "words", markup: html`<p><span id="friend-request-told"></span> can accept it from their game or their friends page. Once you're friends, you can chat and join each other in games that allow it.</p>` },
+      { kind: "block", markup: html`<div id="friend-request-error" role="alert" hidden>${banner({ text: "Couldn't send it. Check your connection and try again.", icon: "warning", tone: "warning" })}</div>` }
+    ]
+  });
+  const card = playingCard({
+    id: "friend-request-card",
+    title: "Friend request",
+    body: stack({
+      items: [
+        { kind: "words", markup: html`<p><strong id="friend-request-card-name"></strong> wants to be friends.</p>` },
+        {
+          kind: "block",
+          markup: row({ widths: "fit", label: "Answer", items: [{ kind: "control", markup: runButton("Accept", { type: "button", id: "friend-request-accept" }) }, { kind: "control", markup: cutButton("Not now", { type: "button", id: "friend-request-later" }) }] })
+        }
+      ]
+    })
+  });
+  const acceptedCard = playingCard({ id: "friend-accepted-card", body: stack({ items: [{ kind: "words", markup: html`<p>You and <strong id="friend-accepted-name"></strong> are friends now.</p>` }] }) });
+  return html`${sheet({
+    id: "friend-request",
+    title: "Send a friend request?",
+    body,
+    closeLabel: "Close",
+    placement: "foot",
+    buttons: [cutButton("Cancel", { type: "submit", formMethod: "dialog" }), runButton("Send request", { type: "button", id: "friend-request-yes" })]
+  })}
+${card}
+${acceptedCard}
+${pageData("friend-request-data", { gameOrigin: options.gameOrigin, slug: options.slug })}
+${scriptTags(FRIEND_REQUEST_SCRIPT)}`;
+}
+var CARD_SHOWN_MS = 8e3;
+var NEWS_SHOWN_MS = 5e3;
+var FRIEND_REQUEST_SCRIPT = pageScript("friend-requests", String.raw`(() => {
+  const sheet = document.getElementById("friend-request");
+  const card = document.getElementById("friend-request-card");
+  const data = document.getElementById("friend-request-data");
+  if (!sheet || !card || !data) return;
+  const { gameOrigin: GAME_ORIGIN, slug: SLUG } = JSON.parse(data.textContent);
+  const PLAYER_ID = /^player_[a-z0-9]{1,40}$/;
+  const $ = (id) => document.getElementById(id);
+  const yes = $("friend-request-yes");
+  const frame = () => document.getElementById("game");
+  const tell = (message) => { const f = frame(); if (f && f.contentWindow) f.contentWindow.postMessage(message, GAME_ORIGIN); };
+  const isSignedIn = () => /(^|; )(__Host-)?zaisma_in=1/.test(document.cookie);
+  const post = (path, body) => fetch(path, { method: "POST", headers: body ? { "Content-Type": "application/json" } : {}, body: body ? JSON.stringify(body) : undefined }).catch(() => null);
+
+  // The request the sheet is asking about: { id, name }.
+  let asking = null;
+  function finish(status) {
+    if (!asking) return;
+    tell({ type: "zaisma:friend-request", playerId: asking.id, status });
+    if (status === "sent") dispatchEvent(new CustomEvent("zaisma:friend-request-sent", { detail: { id: asking.id } }));
+    asking = null;
+    if (sheet.open) sheet.close();
+  }
+  // Who it's for, as the page draws an account (accountPicture): initials in its own color, from the name.
+  function showWho(name) {
+    const who = $("friend-request-who");
+    let hue = 7;
+    for (const character of name) hue = (hue * 31 + character.codePointAt(0)) % 360;
+    const words = name.trim().split(/\s+/).filter(Boolean);
+    const letters = words.length > 1 ? [Array.from(words[0])[0], Array.from(words[1])[0]] : Array.from(words[0] || "?").slice(0, 2);
+    const picture = who.querySelector(".av");
+    picture.style.setProperty("--h", String(hue));
+    picture.textContent = letters.join("").toUpperCase();
+    who.querySelector(".list-row-title").textContent = name;
+  }
+  async function ask(playerId) {
+    // One question at a time: another while the sheet is up is a no.
+    if (asking) return tell({ type: "zaisma:friend-request", playerId, status: "cancelled" });
+    if (!isSignedIn()) return tell({ type: "zaisma:friend-request", playerId, status: "cancelled" });
+    tell({ type: "zaisma:friend-request", playerId, status: "asking" });
+    asking = { id: playerId, name: "" };
+    const about = await fetch("/friends/requests/about/" + playerId).then((res) => (res.ok ? res.json() : null)).catch(() => null);
+    if (!about || !about.player) { asking = { id: playerId }; return finish("not_taking_requests"); }
+    if (about.is_friend) return finish("already_friends");
+    // Already waiting looks the same as just sent, whatever became of it.
+    if (about.has_sent) return finish("sent");
+    if (!about.can_send) return finish("not_taking_requests");
+    asking.name = about.player.name;
+    $("friend-request-title").textContent = "Send " + asking.name + " a friend request?";
+    showWho(asking.name);
+    $("friend-request-told").textContent = asking.name;
+    $("friend-request-error").hidden = true;
+    yes.removeAttribute("aria-busy");
+    if (document.fullscreenElement) document.exitFullscreen().catch(() => {});
+    sheet.showModal();
+    yes.focus();
+  }
+  yes.addEventListener("click", async () => {
+    if (!asking || yes.getAttribute("aria-busy") === "true") return;
+    yes.setAttribute("aria-busy", "true");
+    $("friend-request-error").hidden = true;
+    const res = await post("/friends/requests", { player_id: asking.id, game_slug: SLUG });
+    yes.removeAttribute("aria-busy");
+    const answer = res ? await res.json().catch(() => null) : null;
+    // One back to someone whose request waited: friends at once, and they hear of it like an accept.
+    if (res && res.ok && answer && answer.status === "friends") {
+      dispatchEvent(new CustomEvent("zaisma:friend-added", { detail: { id: asking.id } }));
+      tell({ type: "zaisma:friend-request", playerId: asking.id, status: "accepted" });
+      waiting = waiting.filter((each) => each.player_id !== asking.id);
+      dispatchEvent(new CustomEvent("zaisma:friend-requests-waiting", { detail: { requests: waiting } }));
+    }
+    if (res && res.ok) return finish("sent");
+    const code = answer && answer.error ? answer.error.code : "";
+    if (code === "already_friends") return finish("already_friends");
+    if (code === "already_sent") return finish("sent");
+    if (code === "not_taking_requests" || code === "not_an_account") return finish("not_taking_requests");
+    const error = $("friend-request-error");
+    error.querySelector(".banner-text").textContent = answer && answer.error ? answer.error.message : "Couldn't send it. Check your connection and try again.";
+    error.hidden = false;
+  });
+  sheet.addEventListener("close", () => { finish("cancelled"); const f = frame(); if (f) f.focus(); });
+  // The game asks (Zaisma.friends.sendRequest); only its own frame.
+  addEventListener("message", (e) => {
+    const f = frame();
+    const d = e.data;
+    if (!f || e.source !== f.contentWindow || e.origin !== GAME_ORIGIN || !d) return;
+    if (d.type === "zaisma:friend-request" && typeof d.playerId === "string" && PLAYER_ID.test(d.playerId) && !d.status) ask(d.playerId);
+    // Someone in the room sent this player one: look now.
+    if (d.type === "zaisma:friend-requests") look();
+  });
+  // Players' Add friend.
+  addEventListener("zaisma:ask-friend-request", (e) => { if (e.detail && PLAYER_ID.test(e.detail.id)) ask(e.detail.id); });
+
+  // Requests waiting for this player, newest first; the card brings each one once a tab.
+  const SHOWN_KEY = "zaisma:friend-requests-shown";
+  const shown = () => { try { return new Set(JSON.parse(sessionStorage.getItem(SHOWN_KEY) || "[]")); } catch { return new Set(); } };
+  const keepShown = (ids) => { try { sessionStorage.setItem(SHOWN_KEY, JSON.stringify([...ids].slice(-200))); } catch {} };
+  let waiting = [];
+  let showing = null;
+  let cardTimer = null;
+  let isLooking = false;
+  let hasLooked = false;
+  // The game page while its game runs (pages.ts swaps is-leaving for is-playing).
+  const isPlaying = () => document.documentElement.classList.contains("is-playing");
+  async function look() {
+    if (!isSignedIn() || isLooking) return;
+    isLooking = true;
+    hasLooked = true;
+    const answer = await fetch("/friends/requests").then((res) => (res.ok ? res.json() : null)).catch(() => null);
+    isLooking = false;
+    if (!answer || !Array.isArray(answer.requests)) return;
+    waiting = answer.requests;
+    dispatchEvent(new CustomEvent("zaisma:friend-requests-waiting", { detail: { requests: waiting } }));
+    // Requests this player sent that were accepted: Players marks them Friend, and the news shows once a tab.
+    const seen = shown();
+    (Array.isArray(answer.accepted) ? answer.accepted : []).forEach((each) => {
+      dispatchEvent(new CustomEvent("zaisma:friend-added", { detail: { id: each.player_id } }));
+      const key = "accepted:" + each.player_id + ":" + each.answered_at_ms;
+      if (seen.has(key)) return;
+      seen.add(key);
+      news.push(each.name);
+    });
+    keepShown(seen);
+    showNext();
+  }
+  // Names whose accept this player hasn't seen yet, shown one at a time.
+  const news = [];
+  const newsCard = $("friend-accepted-card");
+  let newsTimer = null;
+  function showNews() {
+    if (!newsCard || !news.length || !newsCard.hidden || !isPlaying()) return;
+    $("friend-accepted-name").textContent = news.shift();
+    newsCard.hidden = false;
+    clearTimeout(newsTimer);
+    newsTimer = setTimeout(() => { newsCard.hidden = true; setTimeout(showNews, 600); }, ${NEWS_SHOWN_MS});
+  }
+  function showNext() {
+    showNews();
+    if (showing || !isPlaying()) return;
+    const seen = shown();
+    const next = waiting.find((each) => !seen.has(each.player_id + ":" + each.created_at_ms));
+    if (!next) return;
+    seen.add(next.player_id + ":" + next.created_at_ms);
+    keepShown(seen);
+    showing = next;
+    $("friend-request-card-name").textContent = next.name;
+    card.hidden = false;
+    clearTimeout(cardTimer);
+    cardTimer = setTimeout(hideCard, ${CARD_SHOWN_MS});
+  }
+  function hideCard() {
+    clearTimeout(cardTimer);
+    card.hidden = true;
+    showing = null;
+    setTimeout(showNext, 600);
+  }
+  // A hand on the card keeps it up.
+  card.addEventListener("pointerenter", () => clearTimeout(cardTimer));
+  card.addEventListener("pointerleave", () => { if (showing) cardTimer = setTimeout(hideCard, 3000); });
+  async function answerRequest(playerId, verb) {
+    const res = await post("/friends/requests/" + playerId + "/" + verb);
+    waiting = waiting.filter((each) => each.player_id !== playerId);
+    dispatchEvent(new CustomEvent("zaisma:friend-requests-waiting", { detail: { requests: waiting } }));
+    const isAccepted = Boolean(res && res.ok) && verb === "accept";
+    // Friends now: Players marks them, and the rooms they share tell the sender's game to have their page look.
+    if (isAccepted) {
+      dispatchEvent(new CustomEvent("zaisma:friend-added", { detail: { id: playerId } }));
+      tell({ type: "zaisma:friend-request", playerId, status: "accepted" });
+    }
+    return Boolean(res && res.ok);
+  }
+  $("friend-request-accept").addEventListener("click", async () => {
+    if (!showing) return;
+    const playerId = showing.player_id;
+    hideCard();
+    await answerRequest(playerId, "accept");
+  });
+  $("friend-request-later").addEventListener("click", hideCard);
+  // Players answers from its list too.
+  addEventListener("zaisma:answer-friend-request", (e) => {
+    if (!e.detail || !PLAYER_ID.test(e.detail.id) || (e.detail.verb !== "accept" && e.detail.verb !== "turn-down")) return;
+    if (showing && showing.player_id === e.detail.id) hideCard();
+    answerRequest(e.detail.id, e.detail.verb);
+  });
+  // The presence check-in says how many wait and how many of this player's were accepted; a change means something new to look at.
+  let lastCounts = "";
+  addEventListener("zaisma:presence", (e) => {
+    const counts = e.detail ? [e.detail.waiting_friend_request_count, e.detail.accepted_friend_request_count].map((count) => (typeof count === "number" ? count : 0)) : [0, 0];
+    if (counts.join() !== lastCounts) { lastCounts = counts.join(); if (counts[0] || counts[1] || waiting.length) look(); }
+  });
+  // Once the game is running.
+  new MutationObserver(() => { if (isPlaying()) { showNext(); if (!hasLooked) look(); } }).observe(document.documentElement, { attributes: true, attributeFilter: ["class"] });
+})();`);
+
 // ../../apps/site/src/game-updates.ts
 var LIVE_VERSION_CHECK_MS = 2 * 6e4;
 function updateBarButtons() {
@@ -45842,6 +46219,7 @@ ${multiplayer ? playersSheet({ gameOrigin, slug: game.slug, title: game.title, h
 ${keepCard}
 ${saves ? playingCard({ id: "save-toast", body: stack({ items: [{ kind: "words", markup: html`<p></p>` }] }) }) : ""}
 ${signInCard}
+${isClosed || !authConfigured(env2) ? "" : friendRequestParts({ gameOrigin, slug: game.slug })}
 ${multiplayer ? stillThereCard() : ""}
 ${leavingCard(game.title)}
 ${isClosed ? "" : buySheet({ joinHref: joinHere, signInHref: signinHere, coverUrl })}
@@ -46502,6 +46880,16 @@ var USERNAME_SCRIPT = pageScript("username-check", `(() => {
     check();
   });
 })();`);
+var JOIN_TODAY_SCRIPT = pageScript("join-today", `(() => {
+  const form = document.getElementById("age-form");
+  if (!form) return;
+  const setToday = () => {
+    const now = new Date();
+    form.elements.today.value = now.getFullYear() + "-" + String(now.getMonth() + 1).padStart(2, "0") + "-" + String(now.getDate()).padStart(2, "0");
+  };
+  setToday();
+  form.addEventListener("submit", setToday);
+})();`);
 var ENTRY_SWITCH_SCRIPT = pageScript("entry-switch", `(() => {
   const sw = document.querySelector(".city-pane .tab-switch");
   const views = [...document.querySelectorAll("[data-entry-view]")];
@@ -46891,6 +47279,7 @@ function devSheetBody(name, view) {
 var AGE_BAND_WORDS = { "13-15": "13\u201315", "16-17": "16\u201317", "18+": "18+" };
 var isSocialModeAllowed = (ageBand2, socialMode) => socialModesFor(ageBand2).includes(socialMode);
 var startingSocialMode = (ageBand2) => defaultSocialMode(ageBand2);
+var takesFriendRequests = (ageBand2, socialMode) => socialModeSettings(socialMode, ageBand2).who_can_send_friend_requests !== "nobody";
 function chatOf(ageBand2, socialMode) {
   const whoCanChat = socialModeSettings(socialMode, ageBand2).who_can_chat;
   return { whoCanChat, bandGroup: chatBandGroup({ who_can_chat: whoCanChat, age_band: ageBand2 }) };
@@ -46987,5 +47376,6 @@ export {
   playerPanelHtml,
   playersPanelHtml,
   siteAsset,
-  startingSocialMode
+  startingSocialMode,
+  takesFriendRequests
 };

package/bin/local-play.js

@@ -145,6 +145,8 @@ function defaultState() {
     // Each player's guest, while they play as one: { id, name }.
     guests: {},
     friends: [],
+    // Friend requests waiting between bench accounts: { from, to, createdAtMs }.
+    friendRequests: [],
     blocks: [],
     ownedItems: {},
     items: [],
@@ -629,6 +631,8 @@ export async function startLocalPlay(givenOptions) {
     if (rest === "" && method === "DELETE") {
       state.accounts = state.accounts.filter((each) => each.id !== account.id);
       state.friends = state.friends.filter((pair) => !pair.includes(account.id));
+      state.friendRequests = (state.friendRequests ?? []).filter((each) => each.from !== account.id && each.to !== account.id);
+      state.acceptedFriendRequests = (state.acceptedFriendRequests ?? []).filter((each) => each.from !== account.id && each.to !== account.id);
       state.blocks = state.blocks.filter((block) => block.blocker !== account.id && block.blocked !== account.id);
       state.purchases = state.purchases.filter((purchase) => purchase.accountId !== account.id);
       delete state.ownedItems[account.id];
@@ -951,6 +955,67 @@ export async function startLocalPlay(givenOptions) {
       }
       return reply(200, { player: { player_id: target.playerId, name: target.username }, is_friend: friendIdsOf(account.id).includes(target.id), is_blocked: state.blocks.some((block) => block.blocker === account.id && block.blocked === target.id) });
     }
+    // Friend requests between bench accounts, as Zaisma's game page sends and answers them (apps/site/src/friend-requests.ts).
+    if (path === "/friends/requests" || path.startsWith("/friends/requests/")) {
+      if (!account) return reply(401, { error: { code: "not_signed_in", message: "Sign in to add friends." } });
+      const requests = (state.friendRequests ??= []);
+      const isBlockedPair = (other) => state.blocks.some((block) => isPair([block.blocker, block.blocked], account.id, other.id));
+      const isFriend = (other) => friendIdsOf(account.id).includes(other.id);
+      const waitingFrom = (from, to) => requests.find((each) => each.from === from && each.to === to);
+      const makeFriends = (other) => {
+        // The sender hears of the accept on their next look, for a day, as on Zaisma.
+        (state.acceptedFriendRequests ??= []).push({ from: other.id, to: account.id, answeredAtMs: Date.now() });
+        state.friendRequests = requests.filter((each) => !isPair([each.from, each.to], account.id, other.id));
+        if (!isFriend(other)) state.friends.push([account.id, other.id]);
+        saveState();
+        log(`${account.username} and ${other.username} are friends now.`);
+      };
+      if (request.method === "GET" && path === "/friends/requests") {
+        const accepted = (state.acceptedFriendRequests ?? []).filter((each) => each.from === account.id && each.answeredAtMs > Date.now() - 86400000 && isFriend({ id: each.to })).map((each) => ({ to: accountOf(each.to), answeredAtMs: each.answeredAtMs })).filter((each) => each.to);
+        return reply(200, {
+          requests: requests.filter((each) => each.to === account.id).map((each) => ({ from: accountOf(each.from), createdAtMs: each.createdAtMs })).filter((each) => each.from).map((each) => ({ player_id: each.from.playerId, name: each.from.username, created_at_ms: each.createdAtMs, game_slug: gameSlug })).reverse(),
+          accepted: accepted.map((each) => ({ player_id: each.to.playerId, name: each.to.username, answered_at_ms: each.answeredAtMs })).reverse(),
+        });
+      }
+      const aboutMatch = /^\/friends\/requests\/about\/(player_[a-z0-9]{1,40})$/.exec(path);
+      if (request.method === "GET" && aboutMatch) {
+        const other = accountOfPlayer(aboutMatch[1]);
+        if (!other || other.id === account.id) return reply(200, { player: null, can_send: false, has_sent: false, is_friend: false });
+        const hasSent = Boolean(waitingFrom(account.id, other.id));
+        const canSend = !isFriend(other) && !hasSent && !isBlockedPair(other) && other.ageBand === account.ageBand && (Boolean(waitingFrom(other.id, account.id)) || glass.takesFriendRequests(other.ageBand, other.socialMode));
+        return reply(200, { player: { player_id: other.playerId, name: other.username }, can_send: canSend, has_sent: hasSent, is_friend: isFriend(other) });
+      }
+      if (isPost && path === "/friends/requests") {
+        const body = await readJson(request);
+        const other = typeof body.player_id === "string" ? accountOfPlayer(body.player_id) : null;
+        if (!other || other.id === account.id) return reply(409, { error: { code: "not_an_account", message: "Only players signed in to Zaisma take friend requests." } });
+        if (isFriend(other)) return reply(409, { error: { code: "already_friends", message: "You're friends already." } });
+        if (waitingFrom(other.id, account.id)) {
+          makeFriends(other);
+          return reply(200, { status: "friends" });
+        }
+        if (waitingFrom(account.id, other.id)) return reply(409, { error: { code: "already_sent", message: "Your request is waiting for them." } });
+        if (isBlockedPair(other) || other.ageBand !== account.ageBand || !glass.takesFriendRequests(other.ageBand, other.socialMode)) return reply(409, { error: { code: "not_taking_requests", message: "They aren't taking friend requests from you." } });
+        requests.push({ from: account.id, to: other.id, createdAtMs: Date.now() });
+        saveState();
+        log(`${account.username} sent ${other.username} a friend request.`);
+        return reply(200, { status: "sent" });
+      }
+      const answerMatch = /^\/friends\/requests\/(player_[a-z0-9]{1,40})\/(accept|turn-down)$/.exec(path);
+      if (isPost && answerMatch) {
+        await readText(request);
+        const other = accountOfPlayer(answerMatch[1]);
+        if (!other || !waitingFrom(other.id, account.id)) return reply(404, { error: { code: "request_not_found", message: "That request isn't waiting any more." } });
+        if (answerMatch[2] === "accept") makeFriends(other);
+        else {
+          state.friendRequests = requests.filter((each) => !(each.from === other.id && each.to === account.id));
+          saveState();
+          log(`${account.username} turned down ${other.username}'s friend request.`);
+        }
+        return reply(200, { answer: answerMatch[2] === "accept" ? "accepted" : "turned_down" });
+      }
+      return reply(404, { error: { code: "not_found", message: "Nothing here." } });
+    }
     // A report goes to Zaisma's moderators, or the game's developer: here the terminal says what it would send.
     if (isPost && path === `${game}/report`) {
       const body = await readJson(request);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zaisma/game-server",
-  "version": "1.9.0",
+  "version": "1.10.0",
   "description": "Run your Zaisma game server: the same rooms on Zaisma or on your own server.",
   "license": "MIT",
   "homepage": "https://zaisma.com",

package/sdk/zaisma.d.ts

@@ -240,8 +240,35 @@ declare namespace Zaisma {
      * await Zaisma.friends.setRoom(null);   // left the match
      */
     setRoom(room: OwnServerRoom | null): Promise<void>;
+    /**
+     * Offer the player to send another player a friend request, from your own scoreboard, lobby or menu.
+     * Zaisma asks the player first on its page ("Send Mia a friend request?", with the name Zaisma knows
+     * them by), so nothing is sent without them, and the other player gets it over their game's corner and
+     * on zaisma.com/friends. Players can also send one from Players in Zaisma's bar, so a button of your
+     * own is optional. Resolves with what happened: "sent"; "cancelled" when the player said no or another
+     * question was up; "already_friends"; or "not_taking_requests" when the other player doesn't take them
+     * from this one (their settings, their age group, a block, or a guest), which never says which. Your game
+     * never hears of requests themselves, only that two players are friends (room.areFriends on your game server, and the
+     * passes' tags, from their next join). Fails with error.code "account_needed" for a guest (ask them to
+     * sign in with {@link player.signIn}), "bad_player_id" for something that isn't a player's id, and
+     * "not_on_zaisma" when the game isn't played on Zaisma.
+     *
+     * @example
+     * // A button beside each player on your end-of-match screen.
+     * const { status } = await Zaisma.friends.sendRequest(player.id);
+     * if (status === "sent") button.textContent = "Request sent";
+     */
+    sendRequest(playerId: string): Promise<FriendRequestAnswer>;
   }
 
+  /** What became of a friend request the game offered ({@link Friends.sendRequest}). */
+  interface FriendRequestAnswer {
+    status: FriendRequestStatus;
+  }
+
+  /** "sent", "cancelled" (the player said no), "already_friends", or "not_taking_requests" (never why). */
+  type FriendRequestStatus = "sent" | "cancelled" | "already_friends" | "not_taking_requests";
+
   /** The player's friends playing this game ({@link Friends.list}). */
   interface FriendList {
     /** By name. Empty when none of them are playing it. */

package/sdk/zaisma.js

@@ -617,6 +617,9 @@
       } else if (message.type === "blocks") {
         room._blocks = new Set(Array.isArray(message.playerIds) ? message.playerIds : []);
         room._mutedChanged();
+      } else if (message.type === "friend_request") {
+        // Someone here sent this player a friend request, or accepted theirs: the Zaisma page looks now (never who).
+        if (onZaismaPage()) window.parent.postMessage({ type: "zaisma:friend-requests" }, config.site);
       } else if (message.type === "message") {
         room._emit("message", message.data, typeof message.fromPlayerId === "string" ? message.fromPlayerId : null);
       } else if (message.type === "chat" || message.type === "chat_sent" || message.type === "chat_stopped" || (message.type === "error" && typeof message.chatNumber === "number")) {
@@ -2457,6 +2460,51 @@
   }
 
   var rooms = { list: listRooms, quickJoin: quickJoin, linkedRoomCode: roomCodeFromPage(), linkedServerUrl: roomCodeFromPage() ? serverUrlFromPage() : null, isLinkedAsSpectator: watchFromPage() };
-  var friends = { list: listFriends, setRoom: setOwnRoom };
+  /*
+   * Friend requests (zaisma.d.ts: Friends.sendRequest): the Zaisma page asks the player before anything is
+   * sent, with the name Zaisma knows the other player by, so no game sends one on a player's behalf. Once one
+   * is sent, from here or the page's Players, the rooms the other player is in tell their game to have their
+   * page look now; Zaisma's record is the request itself.
+   */
+  var friendRequestAsk = null;
+  var FRIEND_REQUEST_STATUSES = ["sent", "cancelled", "already_friends", "not_taking_requests"];
+  function sendFriendRequest(playerId) {
+    if (!onZaismaPage() || !config.rooms) return Promise.reject(notOnZaisma("Friend requests come from Zaisma, so they work only in games played on Zaisma."));
+    if (typeof playerId !== "string" || !/^player_[a-z0-9]{1,40}$/.test(playerId)) return Promise.reject(codedError("bad_player_id", "Zaisma.friends.sendRequest takes a player's id from room.players or Zaisma.friends.list."));
+    return getPass().then(function (mine) {
+      if (mine.kind !== "account") throw codedError("account_needed", "Friend requests are for players signed in to Zaisma: ask the player to sign in first (Zaisma.player.signIn).");
+      // One question at a time: another request while the page is asking is a no.
+      if (friendRequestAsk) return { status: "cancelled" };
+      friendRequestAsk = new Promise(function (resolve) {
+        var isAsking = false;
+        var timer = setTimeout(function () { if (!isAsking) settle("cancelled"); }, 3000);
+        function settle(status) {
+          removeEventListener("message", onMessage);
+          clearTimeout(timer);
+          friendRequestAsk = null;
+          resolve({ status: status });
+        }
+        function onMessage(event) {
+          var told = event.data;
+          if (event.origin !== config.site || event.source !== window.parent || !told || told.type !== "zaisma:friend-request" || told.playerId !== playerId) return;
+          if (told.status === "asking") isAsking = true;
+          else if (FRIEND_REQUEST_STATUSES.indexOf(told.status) !== -1) settle(told.status);
+        }
+        addEventListener("message", onMessage);
+        window.parent.postMessage({ type: "zaisma:friend-request", playerId: playerId }, config.site);
+      });
+      return friendRequestAsk;
+    });
+  }
+  // A request sent (by the game's own button or the page's Players), or one accepted: the rooms the other player is in nudge their game.
+  window.addEventListener("message", function (event) {
+    var told = event.data;
+    if (!config.site || event.origin !== config.site || event.source !== window.parent || !told || told.type !== "zaisma:friend-request" || (told.status !== "sent" && told.status !== "accepted") || typeof told.playerId !== "string") return;
+    joined.forEach(function (room) {
+      if (!room._done && !room.isSpectator && room.players.some(function (each) { return each.id === told.playerId; })) room._say({ type: "friend_request", playerId: told.playerId });
+    });
+  });
+
+  var friends = { list: listFriends, setRoom: setOwnRoom, sendRequest: sendFriendRequest };
   window.Zaisma = { sdkVersionNumber: 1, gameSlug: config.game || null, player: player, joinRoom: joinRoom, rooms: rooms, server: server, invite: invite, checkChat: checkChat, openPlayersPanel: openPlayersPanel, links: links, items: items, friends: friends, saves: saves, versions: versions };
 })();

package/src/room.d.ts

@@ -892,6 +892,8 @@ export type ServerMessage = {
 } | {
     type: "blocks";
     playerIds: string[];
+} | {
+    type: "friend_request";
 } | {
     type: "chat";
     fromPlayerId: string;
@@ -959,6 +961,9 @@ export type ClientMessage = {
 } | {
     type: "unblock";
     playerId: string;
+} | {
+    type: "friend_request";
+    playerId: string;
 } | {
     type: "probe_answer";
     probeNumber: number;
@@ -1427,6 +1432,12 @@ export declare class RoomCore<S = any> {
     private tellBlocks;
     /** A player's game blocked a player in the room (a guest's block, or one just made), or took one back. */
     private sessionBlock;
+    /**
+     * A player's game page just sent another player here a friend request, or accepted theirs (docs/DECISIONS.md,
+     * "Friend requests in games"): the room tells that player's game to have their page look now, rather than at its next check-in.
+     * Zaisma's record is the request; this says only "look", never who it's from, so a lying client gains nothing.
+     */
+    private friendRequestTold;
     /** Players in the match who haven't walked away: what room lists and "playing now" count. */
     get playingCount(): number;
     /**

package/src/room.js

@@ -1071,6 +1071,20 @@ export class RoomCore {
         this.tellBlocks();
         return null;
     }
+    /**
+     * A player's game page just sent another player here a friend request, or accepted theirs (docs/DECISIONS.md,
+     * "Friend requests in games"): the room tells that player's game to have their page look now, rather than at its next check-in.
+     * Zaisma's record is the request; this says only "look", never who it's from, so a lying client gains nothing.
+     */
+    friendRequestTold(playerId, message) {
+        const otherPlayerId = message.playerId;
+        if (typeof otherPlayerId !== "string" || otherPlayerId === playerId || !this.players.has(otherPlayerId))
+            return "bad_message";
+        if (this.hasBlockBetween(playerId, otherPlayerId))
+            return null;
+        this.sendText(otherPlayerId, JSON.stringify({ type: "friend_request" }));
+        return null;
+    }
     /** Players in the match who haven't walked away: what room lists and "playing now" count. */
     get playingCount() {
         return this.players.size - this.kept.size;
@@ -1691,6 +1705,8 @@ export class RoomCore {
                 return this.sessionBlock(playerId, message, true);
             case "unblock":
                 return this.sessionBlock(playerId, message, false);
+            case "friend_request":
+                return this.friendRequestTold(playerId, message);
             default:
                 // A type this room doesn't know, maybe from a newer SDK: counted and limited above, then ignored.
                 return typeof message.type === "string" ? null : "bad_message";