juicyjuicy 0.14.0 → 0.16.0

package/dist/index.js

@@ -19807,7 +19807,7 @@ function date4(params) {
 }
 
 // ../shared/src/cli.ts
-var CLI_RELEASE = "0.14.0";
+var CLI_RELEASE = "0.16.0";
 function cliCommand(args) {
   return `npx -y juicyjuicy@${CLI_RELEASE} ${args}`;
 }
@@ -19924,7 +19924,7 @@ var LIMITS = {
 var PUBLISH_LIMIT_WINDOW_HOURS = 24;
 var RATE_LIMITS = {
   /** New accounts, site-wide. */
-  signUp: { limit: 30, windowSeconds: 60 * 60 },
+  signUp: { limit: 60, windowSeconds: 60 * 60 },
   /** New accounts per client IP (hashed). */
   signUpNetwork: { limit: 3, windowSeconds: 24 * 60 * 60 },
   /** Verification and password-reset mails per address (D88), keyed by a hash of it. */
@@ -20012,6 +20012,16 @@ var UPLOAD_BUDGET = {
   /** Files one member may upload in the last 24 hours: 5 publishes at `LIMITS.maxFiles`. */
   memberFilesPerDay: 15e3
 };
+var PROVIDER_ALLOWANCES = {
+  /** Neon Free: past it the compute is suspended until the next billing period. */
+  neonComputeHoursPerMonth: 100,
+  /** Neon Free: past it writes fail. */
+  neonStorageBytes: 1024 * MB,
+  /** Neon Free: past it the compute is suspended, as for CU-hours. */
+  neonEgressBytesPerMonth: 5 * 1024 * MB,
+  /** Cloudflare Email Service on Workers Paid; past it $0.35 per 1,000. */
+  mailIncludedPerMonth: 3e3
+};
 var THUMBNAIL_EXTENSIONS = ["png", "jpg", "jpeg", "webp"];
 
 // ../shared/src/genres.ts
@@ -20055,6 +20065,21 @@ var GAME_GENRES = [
 var GENRE_IDS = GAME_GENRES.map((genre) => genre.id);
 var MAX_GENRES = 3;
 var MAX_THEMES = 3;
+var MULTIPLAYER_TAG = "multiplayer";
+var MULTIPLAYER_WORDS = /* @__PURE__ */ new Set([
+  "multiplayer",
+  "multi-player",
+  "online-multiplayer",
+  "local-multiplayer",
+  "co-op",
+  "coop",
+  "cooperative",
+  "pvp",
+  "2-player",
+  "two-player",
+  "2-players",
+  "mmo"
+]);
 var GENRE_LABELS = new Map(GAME_GENRES.map((genre) => [genre.id, genre.label]));
 function isGenre(id) {
   return GENRE_LABELS.has(id);
@@ -20179,9 +20204,7 @@ var THEME_GENRES = {
   crossword: "word-trivia"
 };
 var DROPPED_TAGS = /* @__PURE__ */ new Set([
-  "multiplayer",
   "online",
-  "online-multiplayer",
   "mobile",
   "mobile-friendly",
   "touch",
@@ -20205,15 +20228,39 @@ var DROPPED_TAGS = /* @__PURE__ */ new Set([
   "games",
   "ai",
   "ai-made",
-  "ai-game"
+  "ai-game",
+  // Languages: the game's own field, with its own filter (`lang`), not a theme.
+  "english",
+  "polish",
+  "polski",
+  "german",
+  "deutsch",
+  "french",
+  "francais",
+  "spanish",
+  "espanol",
+  "italian",
+  "italiano",
+  "multilingual",
+  "en",
+  "pl",
+  "de",
+  "fr",
+  "es",
+  "it"
 ]);
 function normalizeTags(tags) {
   const themes = [];
   const genres = /* @__PURE__ */ new Set();
+  let multiplayer = false;
   for (const raw of tags) {
     const cleaned = raw.trim().toLowerCase().replace(/^#+/, "").replace(/[\s_]+/g, "-").replace(/[^a-z0-9-]/g, "").replace(/-+/g, "-").replace(/^-|-$/g, "");
     if (cleaned.length < 2) continue;
     const tag = TAG_SPELLINGS[cleaned] ?? cleaned;
+    if (MULTIPLAYER_WORDS.has(tag)) {
+      multiplayer = true;
+      continue;
+    }
     if (DROPPED_TAGS.has(tag)) continue;
     const genre = isGenre(tag) ? tag : GENRE_WORDS[tag];
     if (genre) {
@@ -20225,7 +20272,7 @@ function normalizeTags(tags) {
     if (!themes.includes(tag)) themes.push(tag);
   }
   return {
-    tags: themes.slice(0, MAX_THEMES),
+    tags: [...themes.slice(0, MAX_THEMES), ...multiplayer ? [MULTIPLAYER_TAG] : []],
     genres: GENRE_IDS.filter((id) => genres.has(id)).slice(0, MAX_GENRES)
   };
 }
@@ -20737,37 +20784,42 @@ var GAME_FEATURES = [
   },
   {
     id: "touch",
-    name: "Touch controls",
-    adds: "On-screen controls, or taps and swipes, so the game plays on phones and tablets.",
-    why: "Many players open links on their phone; without touch they can only watch.",
-    detection: { kind: "declared" },
-    status: "coming-soon"
+    name: "Mobile optimization",
+    summary: "The game plays well on phones and tablets: touch controls, screen fit, sound, speed.",
+    adds: "Touch controls that fit the game, a layout that fits a phone screen in either orientation and survives rotating, menus that work by tap, and sound and speed that work on phones.",
+    why: "Many players open links on their phone; without this they may only be able to watch, or get a game that's cut off, tiny or silent.",
+    detection: { kind: "declared", input: "touch", addUntilDeclared: true },
+    status: "available",
+    recipe: "reference/touch.md",
+    task: "optimize the game for mobile so it plays well on phones and tablets: touch controls, screen fit in both orientations, sound and speed",
+    docs: "/docs/publish#touch"
   },
   {
     id: "gamepad",
     name: "Gamepad support",
+    summary: "The game plays with a controller.",
     adds: "The game plays with a controller through the browser's Gamepad API.",
     why: "Some games just feel better on a controller, and couch players expect one to work.",
-    detection: { kind: "declared" },
-    status: "coming-soon"
-  },
-  {
-    id: "mouse-lock",
-    name: "Mouse lock",
-    adds: "Games that aim or steer with the mouse lock the cursor (Pointer Lock), so it can't leave the game.",
-    why: "Without it, turning fast drags the cursor out of the frame or onto another screen, and the game stops responding.",
-    detection: { kind: "declared" },
-    status: "coming-soon"
+    detection: { kind: "declared", input: "gamepad" },
+    status: "available",
+    recipe: "reference/gamepad.md",
+    task: "add gamepad support so the game plays with a controller",
+    docs: "/docs/publish#gamepad"
   },
   {
     id: "auto-pause",
     name: "Auto-pause",
+    summary: "The game pauses when its tab is hidden or the window loses focus.",
     adds: "The game pauses when its tab is hidden or the window loses focus.",
     why: "Players who switch tabs for a moment don't come back to a lost game.",
     detection: { kind: "declared" },
-    status: "coming-soon"
+    status: "available",
+    recipe: "reference/auto-pause.md",
+    task: "make the game pause by itself when its tab is hidden or the window loses focus",
+    docs: "/docs/publish#auto-pause"
   }
 ];
+var RETIRED_FEATURES = ["mouse-lock"];
 function gameFeature(id) {
   return GAME_FEATURES.find((feature) => feature.id === id);
 }
@@ -20796,9 +20848,14 @@ function featureState(feature, input2) {
         canAdd: languages.some((language) => !language.has)
       };
     }
-    case "declared":
+    case "declared": {
+      const { input: inputKind, addUntilDeclared } = feature.detection;
+      if (inputKind && input2.input?.includes(inputKind)) {
+        return { feature, status: "on", canAdd: Boolean(addUntilDeclared) && !declared };
+      }
       if (input2.declared === null) return { feature, status: "unknown", canAdd: false };
       return { feature, status: declared ? "on" : "off", canAdd: !declared };
+    }
     case "marker": {
       if (input2.detected === null) return { feature, status: "unknown", canAdd: false };
       const status = input2.detected.includes(feature.id) ? "on" : declared && input2.complete ? "missing" : declared ? "on" : "off";
@@ -20809,6 +20866,7 @@ function featureState(feature, input2) {
 function featureFindings(input2) {
   const findings = [];
   for (const id of input2.declared) {
+    if (RETIRED_FEATURES.includes(id)) continue;
     const feature = gameFeature(id);
     if (!feature) {
       findings.push({
@@ -23934,6 +23992,12 @@ function titleLetters(title) {
 var ERROR_STATUS = {
   UNAUTHORIZED: 401,
   FORBIDDEN: 403,
+  /**
+   * The token is publish-only (D104): it can start and finalize versions and list games and
+   * versions, nothing else. Use `juicyjuicy login`, or a full token from /settings/tokens. CLIs up
+   * to 0.14.0 get FORBIDDEN with the same message; 0.15.0 knows it (`NEWER_ERROR_CODES`).
+   */
+  INSUFFICIENT_SCOPE: 403,
   NOT_FOUND: 404,
   VALIDATION_FAILED: 400,
   INVALID_MANIFEST: 400,
@@ -27728,7 +27792,7 @@ var program = new Command();
 // package.json
 var package_default = {
   name: "juicyjuicy",
-  version: "0.14.0",
+  version: "0.16.0",
   description: "Publish AI-made browser games to juicyjuicy.games",
   type: "module",
   license: "MIT",
@@ -27818,6 +27882,14 @@ The sign-in page says why and how to contest it.`;
 It won't be shown. Upload a different image to replace it.`;
     case "profile_moderated":
       return `JuicyJuicy's moderators removed ${note.subject ?? "something from your profile"}:${quoted(note.comment)}`;
+    // Only the site's banner shows these (D108); a publish never sends them.
+    case "version_held":
+    case "report_held":
+    case "image_held":
+    case "score_removed":
+    case "account_changed":
+    case "game_edited":
+      return `A notice about ${game} is waiting on the JuicyJuicy site:${quoted(note.comment ?? "see the banner there")}`;
   }
 }
 function noteMessages(moderation, warnings, slug) {
@@ -28819,7 +28891,12 @@ ${i2}
 
 // src/output.ts
 var EXIT = { ok: 0, validation: 1, auth: 2, network: 3 };
-var AUTH_CODES = /* @__PURE__ */ new Set(["UNAUTHORIZED", "EXPIRED_TOKEN", "ACCESS_DENIED"]);
+var AUTH_CODES = /* @__PURE__ */ new Set([
+  "UNAUTHORIZED",
+  "EXPIRED_TOKEN",
+  "ACCESS_DENIED",
+  "INSUFFICIENT_SCOPE"
+]);
 var NETWORK_CODES = /* @__PURE__ */ new Set([
   "NETWORK_ERROR",
   "NETWORK_BLOCKED",
@@ -28969,7 +29046,7 @@ var ApiClient = class {
     if (isApiErrorBody(data)) {
       const { code, message, details } = data.error;
       const text3 = code === "PUBLISH_LIMIT_REACHED" && isPublishLimitDetails(details) ? publishLimitMessage(details) : code === "REVIEW_ALLOWANCE_REACHED" && isReviewAllowanceDetails(details) ? reviewAllowanceMessage(details) : message;
-      throw new CliError(code, text3, { details, hint: moderationHint(code) });
+      throw new CliError(code, text3, { details, hint: moderationHint(code) ?? scopeHint(code) });
     }
     if (!response.ok) {
       if (looksBlocked(response.status, text2)) {
@@ -28980,6 +29057,9 @@ var ApiClient = class {
     return data;
   }
 };
+function scopeHint(code) {
+  return code === "INSUFFICIENT_SCOPE" ? "Publish-only tokens are for CI. For this command, unset JUICY_TOKEN and run `juicyjuicy login`, or use a full token from https://juicyjuicy.games/settings/tokens." : void 0;
+}
 function networkError(baseUrl, error62) {
   const cause = describeCause(error62);
   if (!TLS_ERRORS.test(cause) && isBlockedCause(baseUrl, cause)) {
@@ -29468,7 +29548,7 @@ async function checkProject(dir, options = {}) {
   const themes = normalizeTags(manifest.tags).tags;
   if (themes.join() !== manifest.tags.join()) {
     check3.warnings.push(
-      `JuicyJuicy keeps tags as themes, the setting or subject (D103): these tags will be saved as [${themes.join(", ")}]. Genre words belong in "genres", and features like multiplayer show by themselves.`
+      `JuicyJuicy keeps tags as themes, the setting or subject (D103): these tags will be saved as [${themes.join(", ")}]. Genre words belong in "genres"; "multiplayer" is kept for a game players play together, other features show by themselves.`
     );
   }
   const letters2 = titleNotEnglish(manifest.title) ? null : titleLetters(manifest.title);
@@ -30590,6 +30670,9 @@ async function publish(out, dir, options) {
   if (started.keptDashboardThumbnail) {
     out.info("Kept the thumbnail set on the game's dashboard; the screenshot wasn't used.");
   }
+  for (const warning of serverOnlyWarnings(checked.findings, finalized.findings)) {
+    out.warn(warning);
+  }
   const done = started.keptDashboardThumbnail ? { ...finalized, keptDashboardThumbnail: true } : thumbnail?.auto ? { ...finalized, thumbnailAuto: true } : finalized;
   let moderation = done.moderation;
   const report = (data2, message) => {
@@ -30654,6 +30737,13 @@ async function publish(out, dir, options) {
   );
   report(data, `${manifest.title} v${done.version} is uploaded: ${done.gameUrl}`);
 }
+function serverOnlyWarnings(local, server) {
+  const key = (finding) => `${finding.rule}
+${finding.path ?? ""}
+${finding.message}`;
+  const printed = new Set(local.map(key));
+  return (server ?? []).filter((finding) => finding.severity === "warning" && !printed.has(key(finding))).map((finding) => `${finding.path ? `${finding.path}: ` : ""}${finding.message}`);
+}
 async function waitForReview(api, slug, version2, {
   timeoutMs = 45e3,
   intervalMs = 2e3,
@@ -30749,12 +30839,25 @@ ${note}`)
     games.length === 0 ? mine && !filtered ? "No games yet. Publish one with `npx juicyjuicy publish`." : "No games match." : [
       heading,
       ...games.map(
-        (game) => `  ${game.slug.padEnd(24)} ${(game.version ? `v${game.version}` : "-").padEnd(5)} ${(options.all ? `@${game.owner}` : game.status).padEnd(9)} ${game.gameUrl}`
+        (game) => `  ${game.slug.padEnd(24)} ${(game.version ? `v${game.version}` : "-").padEnd(5)} ${(options.all ? `@${game.owner}` : game.status).padEnd(9)} ${game.gameUrl}${needsUpdateNote(game)}`
       ),
-      ...nextPage ? [`More: add --page ${nextPage}.`] : []
+      ...nextPage ? [`More: add --page ${nextPage}.`] : [],
+      ...games.some((game) => game.needsUpdate?.length) ? [
+        `Some need a required update: ${cliCommand("check-games")} settles what it can and says what each still needs.`
+      ] : []
     ].join("\n")
   );
 }
+function needsUpdateNote(game) {
+  const needs = game.needsUpdate ?? [];
+  if (needs.length === 0) return "";
+  const titles = needs.map((need) => need.title).join(", ");
+  if (game.status === "published" && needs.some((need) => need.phase === "enforced")) {
+    return `  needs update (${titles}): out of the public lists until updated`;
+  }
+  const deadline = needs.filter((need) => need.phase === "grace").map((need) => need.deadline).sort()[0];
+  return `  needs update (${titles})${deadline ? ` by ${deadline.slice(0, 10)}` : ""}`;
+}
 function versionLine(v) {
   const state = v.live ? "live" : v.rejected ? "rejected" : v.changesRequested ? "changes" : v.inReview ? "held" : v.draft && v.status === "ready" ? "draft" : v.status;
   const why = v.rejected ? "  (rejected by an admin; it can never go live)" : v.changesRequested ? `  (an admin asked for changes${v.changesRequested.resolvedAt ? "; a later version settled them" : ""}; it can't go live)` : v.inReview ? `  (waiting for an admin's review: ${v.heldReason ?? "it needs a person to look at it"})` : "";

package/dist/skill/SKILL.md

@@ -9,22 +9,22 @@ JuicyJuicy hosts **static browser games** (HTML/JS/CSS/assets, WebAssembly) and
 
 Run every CLI command with `--json`. Each output line is a JSON object; the **last** line is the result, either `{"ok": true, …}` or `{"ok": false, "error": {"code", "message", "details"?, "hint"?}}`. The exit code is `0` (ok), `1` (fix the game or `juicy.json`), `2` (log in) or `3` (network or server problem, so retry).
 
-Run the CLI exactly as written here, `npx -y juicyjuicy@0.14.0 …`: this skill is made for that release. If JuicyJuicy answers that the CLI is out of date, run the command its message gives. It updates the CLI and this skill together; read this skill again afterwards and use the release it names from then on.
+Run the CLI exactly as written here, `npx -y juicyjuicy@0.16.0 …`: this skill is made for that release. If JuicyJuicy answers that the CLI is out of date, run the command its message gives. It updates the CLI and this skill together; read this skill again afterwards and use the release it names from then on.
 
 ## Procedure
 
 ### 1. Make sure the CLI is logged in
 
 ```bash
-npx -y juicyjuicy@0.14.0 whoami --json
+npx -y juicyjuicy@0.16.0 whoami --json
 ```
 
 If it exits with `2`, log in. `login` opens the user's browser and **waits up to 10 minutes** for them to approve:
 
-- Run `npx -y juicyjuicy@0.14.0 login --json` in the background if your shell can, and read its first output line (`{"event": "device_code", "userCode", "verificationUrl"}`) right away, and show the user the code and link without waiting for them to ask: the page shows the same code, and that's how they know the login is theirs.
+- Run `npx -y juicyjuicy@0.16.0 login --json` in the background if your shell can, and read its first output line (`{"event": "device_code", "userCode", "verificationUrl"}`) right away, and show the user the code and link without waiting for them to ask: the page shows the same code, and that's how they know the login is theirs.
 - Then tell the user, with the real code and link: *"A JuicyJuicy page opened in your browser. Check it shows the code **WXTZ-BCDF** and click **Approve**. If no page opened, go to <verificationUrl>."*
 - If your shell can't run commands in the background, say that first (without a code: it doesn't exist yet), then run it in the foreground with a timeout of at least 10 minutes. The code is also printed as `Your code: …`.
-- The user needs a JuicyJuicy account (it's invite-only for now). If the page says they can't sign in, they need an invite link from a friend who's a member.
+- The user needs a JuicyJuicy account. If they don't have one yet, they can make one on the sign-in page that opens.
 
 In CI there's no browser: the `JUICY_TOKEN` environment variable holds a token instead.
 
@@ -45,7 +45,7 @@ Files and folders starting with `.` (`.env`, `.git/`, …) and `node_modules/` a
 `juicy.json` sits in the project folder and describes the game. Create or update it with `init`, filling in what you know from the game you built:
 
 ```bash
-npx -y juicyjuicy@0.14.0 init --yes --json \
+npx -y juicyjuicy@0.16.0 init --yes --json \
   --title "Snake Deluxe" \
   --description "Eat the apples, don't bite your tail. Arrow keys or swipe." \
   --made-with "<your model name>, <the tool you run in>" \
@@ -57,7 +57,7 @@ npx -y juicyjuicy@0.14.0 init --yes --json \
 - The slug (the `/g/<slug>` URL name) defaults to one made from the title. Once published it belongs to this user; reuse it to publish updates. **Never change the slug of a published game**, not even when the user renames it: change `title` only. A new slug is a new game. After the first publish, `juicy.json` also has an `id` that keeps the folder tied to its game; leave it as it is.
 - `--languages`: the languages a player can switch between, English first, e.g. `en,pl`. Leave it out for a game that's only in English (the default is `en`).
 - `--genres`: 1 to 3 from the list below, usually 1 or 2, the main one first. Required: `check` and `publish` stop without them, and refuse a genre that isn't on the list.
-- `--tags`: up to 3 **themes**, the setting or subject, e.g. `space`, `pirates`, `zombies`, `blackjack`. Not genres (`puzzle`, `roguelike` go in `--genres`) and not features (multiplayer, touch, remixable, leaderboards, languages: JuicyJuicy shows those by itself from the game). None is fine.
+- `--tags`: up to 3 **themes**, the setting or subject, e.g. `space`, `pirates`, `zombies`, `blackjack`. Not genres (`puzzle`, `roguelike` go in `--genres`) and not features (touch, remixable, leaderboards, languages: JuicyJuicy shows those by itself from the game). One exception: add `multiplayer` (not counted among the 3) when players play together, online or on one screen, and the game doesn't use JuicyJuicy's rooms; it puts the game in the multiplayer filter. None is fine.
 - `--age-rating`: who the game is for, from what's in it. **You rate every game you publish**; the game page shows it as a label.
 
 All fields: [reference/manifest.md](reference/manifest.md).
@@ -127,7 +127,7 @@ To replace it, the user saves a screenshot as `thumbnail.png` in the project fol
 
 Do this **every time**, also for updates. It protects the user and their players; JuicyJuicy's server runs its own checks as well, so this is help, not a formality to get past.
 
-1. **Check.** Run `npx -y juicyjuicy@0.14.0 check --json`. Errors (a failed result) must be fixed: explain each one (`details` has a `rule` and a `path`), and offer to fix it. If the user says no, **stop and don't publish**: the server would refuse it anyway. Warnings in the result (`findings`) go into step 2.
+1. **Check.** Run `npx -y juicyjuicy@0.16.0 check --json`. Errors (a failed result) must be fixed: explain each one (`details` has a `rule` and a `path`), and offer to fix it. If the user says no, **stop and don't publish**: the server would refuse it anyway. Warnings in the result (`findings`) go into step 2.
    Every file in the result's `files` will be public. If `unusualFiles` isn't empty (names that look like keys or private data, project files like `package.json`, notes and other files a web game doesn't load), **show the user that list and ask whether those files should be public** before publishing; offer to move them out of the build folder or set `buildDir` to a folder with just the game.
 2. **Security review.** Follow [reference/review.md](reference/review.md): keys and tokens, `innerHTML`/`eval` on network or multiplayer data, `http://` loads, trackers, login or payment forms, anything that leaves the page. Same rule: for what it marks as must-fix, fix it or don't publish.
 3. **Standards.** Check the game against these and tell the user, in a sentence or two, what falls short; offer to fix it. A "no" still publishes: not every game can have touch controls.
@@ -142,7 +142,7 @@ Do this **every time**, also for updates. It protects the user and their players
    - Saves progress with JuicyJuicy's window.juicy snippet, if it saves at all, so it follows signed-in players to any browser (not cookies: the play domain clears them).
    - A Quit or Exit button, if it has one, sends JuicyJuicy's quit message instead of calling window.close().
 
-   The game runs in a frame on JuicyJuicy, inside a page. The frame can start at 0×0 or be hidden: when `innerWidth` or `innerHeight` is 0, pause and wait for a `resize` instead of restarting, and give every loop that searches (a free cell for food, a spawn point) a way out. A game stuck in a loop stops every other game in the player's tab from loading. Mouse events stop when the cursor leaves the frame: call `canvas.setPointerCapture(event.pointerId)` on `pointerdown` so a drag keeps getting `pointermove` and `pointerup` outside it. A game that aims or steers with the mouse (a shooter, a camera, a racer) calls `canvas.requestPointerLock()` on a click and reads `event.movementX`/`movementY`: the cursor hides and can't leave the game, not even onto a second screen in fullscreen, and Esc gives it back. Ask for the lock again on the next click.
+   The game runs in a frame on JuicyJuicy, inside a page. The frame can start at 0×0 or be hidden: when `innerWidth` or `innerHeight` is 0, pause and wait for a `resize` instead of restarting, and give every loop that searches (a free cell for food, a spawn point) a way out. A game stuck in a loop stops every other game in the player's tab from loading. Mouse events stop when the cursor leaves the frame: call `canvas.setPointerCapture(event.pointerId)` on `pointerdown` so a drag keeps getting `pointermove` and `pointerup` outside it. A game that aims or steers with the mouse (a shooter, a camera, a racer) calls `canvas.requestPointerLock()` on a click and reads `event.movementX`/`movementY`: the cursor hides and can't leave the game, not even onto a second screen in fullscreen, and Esc gives it back. Ask for the lock again on the next click. [reference/mouse-lock.md](reference/mouse-lock.md) has the whole recipe (pausing when the lock ends, menus, engines).
 
    Esc belongs to the browser: it leaves fullscreen and Pointer Lock before the game sees it. `navigator.keyboard.lock()`, which hands Esc to a page in fullscreen, fails inside a frame, so don't rely on Esc alone: give pause or the menu another key too (like P).
 
@@ -156,7 +156,7 @@ Keep it short when there's nothing to say: "Checked: no problems found" is enoug
 ### 6. Publish
 
 ```bash
-npx -y juicyjuicy@0.14.0 publish --json --message "<what changed, in a few words>"
+npx -y juicyjuicy@0.16.0 publish --json --message "<what changed, in a few words>"
 ```
 
 This makes the new version live: when the user says "publish", that's what they want. Don't add `--draft` (see "Other commands") unless they asked in words for it not to go live yet. Not for a first publish, a big game or one you're unsure of either: the user would have to find the dashboard and make it live themselves.
@@ -181,15 +181,18 @@ The game's page under My games on JuicyJuicy has an **Upgrades** panel; its Add
 
 | Upgrade | Recipe | Declared in `juicy.json` as |
 |---|---|---|
+| Auto-pause | [reference/auto-pause.md](reference/auto-pause.md) | `"features": ["auto-pause"]` |
 | Browser-friendly menu | [reference/browser-menu.md](reference/browser-menu.md) | `"features": ["browser-menu"]` |
 | Cloud saves | [reference/cloud-saves.md](reference/cloud-saves.md) | `"features": ["cloud-saves"]` |
+| Gamepad support | [reference/gamepad.md](reference/gamepad.md) | `"input": [… "gamepad"]` and `"features": ["gamepad"]` |
 | Global highscores | [reference/highscores.md](reference/highscores.md) | `"features": ["highscores"]` |
+| Mobile optimization | [reference/touch.md](reference/touch.md) | `"input": [… "touch"]` and `"features": ["touch"]` |
 | Multi-language | [reference/languages.md](reference/languages.md) | `"languages": ["en", …]` |
 | Multiplayer | [reference/multiplayer.md](reference/multiplayer.md) | `"features": ["multiplayer"]` |
 
-Other features on the panel (touch controls, gamepad, mouse lock, auto-pause) are "Coming soon" and have no recipe yet: if asked for one, say so, and build it your own way only if the user wants.
+An upgrade that doesn't fit the game (mouse lock for a game played by clicking, auto-pause for a turn-based one) is the recipe's to say: tell the user why, and change nothing unless they still want it.
 
-1. **Find the project.** Log in first (step 1). The project is the folder whose `juicy.json` has the game's `slug`: the current folder, or one the user points you to. **If it isn't on this computer** (or you're in a chat app or sandbox), download the live version: `npx -y juicyjuicy@0.14.0 pull <slug> --json` writes it into a new folder named after the slug (`dir` in the result) with its `juicy.json`, and you work there. Read the result's `next`: the download is the built game, so for a bundled one (minified code), ask whether the user has the source somewhere, or use `sourceUrl`, before changing the bundle itself. `pull` only works for the user's own games (`NOT_FOUND` otherwise).
+1. **Find the project.** Log in first (step 1). The project is the folder whose `juicy.json` has the game's `slug`: the current folder, or one the user points you to. **If it isn't on this computer** (or you're in a chat app or sandbox), download the live version: `npx -y juicyjuicy@0.16.0 pull <slug> --json` writes it into a new folder named after the slug (`dir` in the result) with its `juicy.json`, and you work there. Read the result's `next`: the download is the built game, so for a bundled one (minified code), ask whether the user has the source somewhere, or use `sourceUrl`, before changing the bundle itself. `pull` only works for the user's own games (`NOT_FOUND` otherwise).
 2. **Read the recipe** for the upgrade and make the change. Keep everything else about the game as it is.
 3. **Build and try it** (step 2), then **declare it** in `juicy.json` as the table says, adding to what's already listed.
 4. **Review and publish** as steps 5–7 say, with `--message "Add <upgrade>"`. In step 5's `check` result, `features.detected` lists what JuicyJuicy found in the files; a `feature-missing` warning means a declared upgrade isn't there yet: fix it before publishing.
@@ -197,14 +200,14 @@ Other features on the panel (touch controls, gamepad, mouse lock, auto-pause) ar
 
 ## Bring all my games up to date
 
-When the user asks to bring their JuicyJuicy games up to date or fix a **Needs update** badge, when `check` warns `requirement-missing`, or after updating the CLI: follow [reference/update-all-games.md](reference/update-all-games.md). It starts with `npx -y juicyjuicy@0.14.0 check-games --json`, which checks every game of the user's at once and settles what a script can; the rest are code changes, one game at a time.
+When the user asks to bring their JuicyJuicy games up to date or fix a **Needs update** badge, when `check` or `publish` warns `requirement-missing`, or after updating the CLI: follow [reference/update-all-games.md](reference/update-all-games.md). It starts with `npx -y juicyjuicy@0.16.0 check-games --json`, which checks every game of the user's at once and settles what a script can; the rest are code changes, one game at a time.
 
 ## Remix a game
 
 A game marked remixable on JuicyJuicy can be downloaded, changed and published as a new game that links back to it. Log in first (step 1), then:
 
 ```bash
-npx -y juicyjuicy@0.14.0 remix <slug> --json
+npx -y juicyjuicy@0.16.0 remix <slug> --json
 ```
 
 - The first line is `{"event": "license", "name", "text"}`: the remix license. Tell the user in a sentence what it says. In short: the remix may be published **on JuicyJuicy only**, never anywhere else, and the files aren't to be passed on. The full text is:
@@ -240,10 +243,10 @@ Everything else is in [reference/troubleshooting.md](reference/troubleshooting.m
 
 ## Other commands
 
-- `npx -y juicyjuicy@0.14.0 list --json`: the user's games; `list <slug>` shows one game's versions. `--all` lists every game on JuicyJuicy instead (60 a page, `--page 2` and on; `nextPage` in the result), `--owner <username>` another creator's. Narrow and order any list with `--search <title text>`, `--genre` (one of the genre ids above, or several: `board,cards-casino`), `--tag` (a theme), `--engine`, `--remixes`, `--multiplayer` (games with rooms), `--highscores` (games with a leaderboard), `--sort newest|upvoted|downvoted|played` and `--period 24h|week|month|all`, e.g. to find a game to remix.
-- `npx -y juicyjuicy@0.14.0 publish --draft --json`: uploads a new version without making it live (players keep the current one). Only when the user asks for that in words (e.g. "upload it but don't put it live yet"), never on your own judgment. The result has `draft: true`; when they say so, make it live with `go-live`, or they can on the dashboard. Only the newest draft can go live.
-- `npx -y juicyjuicy@0.14.0 go-live --slug <slug> --json`: makes the game's newest draft live, only when the user says so. Pass the draft's number (`go-live <version>`) when they named one, so a newer draft never goes live by surprise. A draft waiting for an admin's review can't go live yet (`FORBIDDEN`), and nor can one a moderator rejected (`VERSION_REJECTED`) or asked changes to (`CHANGES_REQUESTED`). There's no command to go back to an earlier version: when the user asks for one, explain that JuicyJuicy doesn't keep version history, and offer to fix the game or publish their own earlier files as a new version.
-- `npx -y juicyjuicy@0.14.0 recheck <slug> --reply "<what changed>" --json`: asks JuicyJuicy's moderators for another look at a game they blocked, once the user fixed it (see [reference/moderation.md](reference/moderation.md)). Only with the user's OK.
-- `npx -y juicyjuicy@0.14.0 pull <slug> --json`: downloads the live version of one of the user's own games into a new folder with its `juicy.json`, to change it when the project isn't on this computer (see "Add a JuicyJuicy upgrade").
-- `npx -y juicyjuicy@0.14.0 check-games --json`: checks all the user's games against JuicyJuicy's features and required updates, declares the features it finds where a game never declared them, and lists what still needs a change (see "Bring all my games up to date").
-- `npx -y juicyjuicy@0.14.0 open <slug>`: opens the game page in the browser.
+- `npx -y juicyjuicy@0.16.0 list --json`: the user's games; `list <slug>` shows one game's versions. `--all` lists every game on JuicyJuicy instead (60 a page, `--page 2` and on; `nextPage` in the result), `--owner <username>` another creator's. Narrow and order any list with `--search <title text>`, `--genre` (one of the genre ids above, or several: `board,cards-casino`), `--tag` (a theme), `--engine`, `--remixes`, `--multiplayer` (games with rooms), `--highscores` (games with a leaderboard), `--sort newest|upvoted|downvoted|played` and `--period 24h|week|month|all`, e.g. to find a game to remix.
+- `npx -y juicyjuicy@0.16.0 publish --draft --json`: uploads a new version without making it live (players keep the current one). Only when the user asks for that in words (e.g. "upload it but don't put it live yet"), never on your own judgment. The result has `draft: true`; when they say so, make it live with `go-live`, or they can on the dashboard. Only the newest draft can go live.
+- `npx -y juicyjuicy@0.16.0 go-live --slug <slug> --json`: makes the game's newest draft live, only when the user says so. Pass the draft's number (`go-live <version>`) when they named one, so a newer draft never goes live by surprise. A draft waiting for an admin's review can't go live yet (`FORBIDDEN`), and nor can one a moderator rejected (`VERSION_REJECTED`) or asked changes to (`CHANGES_REQUESTED`). There's no command to go back to an earlier version: when the user asks for one, explain that JuicyJuicy doesn't keep version history, and offer to fix the game or publish their own earlier files as a new version.
+- `npx -y juicyjuicy@0.16.0 recheck <slug> --reply "<what changed>" --json`: asks JuicyJuicy's moderators for another look at a game they blocked, once the user fixed it (see [reference/moderation.md](reference/moderation.md)). Only with the user's OK.
+- `npx -y juicyjuicy@0.16.0 pull <slug> --json`: downloads the live version of one of the user's own games into a new folder with its `juicy.json`, to change it when the project isn't on this computer (see "Add a JuicyJuicy upgrade").
+- `npx -y juicyjuicy@0.16.0 check-games --json`: checks all the user's games against JuicyJuicy's features and required updates, declares the features it finds where a game never declared them, and lists what still needs a change (see "Bring all my games up to date").
+- `npx -y juicyjuicy@0.16.0 open <slug>`: opens the game page in the browser.

package/dist/skill/reference/auto-pause.md

@@ -0,0 +1,22 @@
+# Upgrade: auto-pause
+
+The game pauses by itself when its tab is hidden or the window loses focus. Read this when the user asks for auto-pause (the JuicyJuicy Upgrades panel's prompt names this file), then follow "Add a JuicyJuicy upgrade" in SKILL.md to publish it.
+
+## Why
+Players switch tabs, answer a message or click another window for a moment. A game that keeps running loses their run; one that only stops its loop because the browser slows hidden tabs comes back with a huge time step and jumps. Pausing on its own and waiting for them is what players expect.
+
+**Only for games where time matters.** A game that waits for the player anyway (turn-based, puzzles without a timer, idle games that count time away on purpose) doesn't need it: say so to the user, and stop unless they want it.
+
+## What to change
+1. **Pause when the game can't be seen or played**: on `document`'s `visibilitychange` when `document.hidden` is true, and on `window`'s `blur` (the window, or the page around JuicyJuicy's frame, took the focus). Use the game's own pause, the same one its pause key or button opens, so the menu shows.
+2. **Don't resume by itself.** When the tab comes back (`visibilitychange` with `document.hidden` false, or `focus`), leave the pause screen up; the player resumes with a click, a tap, the pause key or the Start button. Coming back into a running game is what this upgrade avoids.
+3. **Only during play**: don't pause on the title screen, a menu, game over, or a multiplayer game other players depend on (there, keep it running and just mute, or follow the game's own rule).
+4. **Stop what runs on its own**: the game's clock and timers count only playing time (pause the timer, or measure with the loop's capped `dt`), music and sounds pause or mute, and the loop's time step is capped (say 1/30 s) so a long frame after a pause can't jump the game.
+5. **Save on hide** if the game saves: hiding is often the last chance before the tab closes (with cloud saves, call `juicy.save(...)` there).
+   Engines: Phaser pauses its loop on hidden tabs by itself but not on `blur`, and resumes by itself: add the game's pause scene on both, so the player resumes; Godot gets `NOTIFICATION_APPLICATION_FOCUS_OUT` and can set `get_tree().paused = true`; Unity has `OnApplicationFocus(false)` and `OnApplicationPause(true)`.
+
+## Check it
+Run the game, start playing, then switch tabs for ten seconds and come back: it's paused where it was, the clock didn't run, and it resumes when the player asks. Do the same by clicking outside the window. The title screen and menus don't pause.
+
+## Declare it
+Add `"auto-pause"` to `features` in `juicy.json` (create the list if it isn't there, adding to what's listed). JuicyJuicy can't detect this one from the files, so the declaration is what turns it On in the panel; only add it once the game pauses this way.

package/dist/skill/reference/gamepad.md

@@ -0,0 +1,21 @@
+# Upgrade: gamepad support
+
+The game plays with a controller. Read this when the user asks for gamepad support (the JuicyJuicy Upgrades panel's prompt names this file), then follow "Add a JuicyJuicy upgrade" in SKILL.md to publish it.
+
+## Why
+Some games feel better on a controller, and players with one plugged in expect it to work. Browsers support controllers through the Gamepad API, inside JuicyJuicy's frame too.
+
+## What to change
+1. **Read the pads every frame.** Browsers don't send events for buttons: in the game loop, call `navigator.getGamepads()` and read each connected pad's `buttons[i].pressed` and `axes`. Compare with the last frame to get "just pressed" for menus and jumps. A pad only shows up after the player presses a button on it (a browser rule), so don't wait for `gamepadconnected` to start reading.
+2. **Use the standard layout** (`pad.mapping === "standard"`, what most pads report): button 0 is A/Cross (confirm, jump), 1 is B/Circle (back), 2 X/Square, 3 Y/Triangle, 4–5 the bumpers, 6–7 the triggers (`value` from 0 to 1), 8 Back/Select, 9 Start (pause and menu), 12–15 the d-pad up, down, left, right; axes 0–1 the left stick (x, y; down is +1), 2–3 the right stick.
+3. **Dead zone**: treat a stick below about 0.2 from the centre as centred, so a worn stick doesn't drift. Let the d-pad and the left stick both move.
+4. **Map pads onto the game's actions, not its keys.** If the game reads keys directly, add an input layer (`isDown("jump")` = Space or button 0) rather than faking keyboard events. Keep the keyboard working exactly as before.
+5. **Menus work with a pad**: move the selection with the d-pad or stick, A confirms, B goes back, Start pauses. Show which button does what when a pad is in use ("A: jump"), keyboard hints otherwise.
+6. **Local multiplayer** (if the game has it): one pad per player, by its `index`; a newly connected pad can join.
+   Engines: Phaser has `this.input.gamepad` (set `input: { gamepad: true }` in the game config); Godot maps joypad buttons in the Input Map (`JOY_BUTTON_A`…) and works in the web export; Unity's Input System supports gamepads in WebGL.
+
+## Check it
+Plug in a controller (or pair one), press a button, then play a full round with the pad only: menus, play, pause, game over, restart. Check the keyboard still works.
+
+## Declare it
+Add `"gamepad"` to `input` in `juicy.json` (`"input": ["keyboard", "gamepad"]`, keeping what's there), and `"gamepad"` to `features` (adding to the list). JuicyJuicy can't detect this one from the files, so the declaration is what turns it On in the panel; only add it once a full round plays with the pad.

package/dist/skill/reference/languages.md

@@ -16,4 +16,4 @@ JuicyJuicy offers English, French, Italian, German, Spanish and Polish (`en`, `f
 Run the game, switch to each language and go through the menus and the first minute of play: no missing keys (an untranslated key shows up as the key's name), no clipped text, and the choice is still there after a reload.
 
 ## Declare it
-Set `languages` in `juicy.json` to every language the game now has, English first, e.g. `"languages": ["en", "fr", "pl"]` (or `npx -y juicyjuicy@0.14.0 init --yes --json --languages en,fr,pl`). Don't add it to `features`: JuicyJuicy reads `languages`, and shows the game in each language's filter.
+Set `languages` in `juicy.json` to every language the game now has, English first, e.g. `"languages": ["en", "fr", "pl"]` (or `npx -y juicyjuicy@0.16.0 init --yes --json --languages en,fr,pl`). Don't add it to `features`: JuicyJuicy reads `languages`, and shows the game in each language's filter.

package/dist/skill/reference/manifest.md

@@ -37,10 +37,10 @@ The manifest in the project folder. `juicyjuicy init` writes it; edit it by hand
 | `engine` | | `vanilla`, `phaser`, `threejs`, `pixi`, `godot`, `unity` or `other`. | `--engine` |
 | `madeWith` | | Up to 5 models/tools, e.g. `["Claude Opus 5.5", "Claude Code"]`. | `--made-with "a, b"` |
 | `genres` | yes | 1 to 3 ids from the genre list in SKILL.md step 3, e.g. `["puzzle"]`, the main one first. `check` and `publish` stop without them, or with an id that isn't on the list. | `--genres a,b` |
-| `tags` | | Themes: up to 3 lowercase words or `word-word` for the setting or subject, e.g. `space`, `pirates`, `blackjack`. Not genres or features (multiplayer, touch, remixable: JuicyJuicy shows those by itself). JuicyJuicy cleans them up when saving (spellings fixed, genre and feature words moved out, at most 3 kept; `check` warns with what it will save). | `--tags a,b` |
+| `tags` | | Themes: up to 3 lowercase words or `word-word` for the setting or subject, e.g. `space`, `pirates`, `blackjack`. Not genres or features (touch, remixable: JuicyJuicy shows those by itself), except `multiplayer`, not counted among the 3, for a game players play together without JuicyJuicy's rooms (its own netcode, or one screen). JuicyJuicy cleans them up when saving (spellings fixed, `co-op`, `pvp` and the like saved as `multiplayer`, genre and other feature words moved out, at most 3 themes kept; `check` warns with what it will save). | `--tags a,b` |
 | `ageRating` | | Who the game is for: `everyone`, `12+` or `16+`, from its content (SKILL.md step 3 says how to pick). Rate every game you publish. Left out, a publish keeps the game's rating; a rating set by JuicyJuicy's moderators wins over this one, and `publish` writes it here. | `--age-rating` |
 | `languages` | | Up to 10 language codes a player can switch between, English first, e.g. `["en", "pl"]`. Default `["en"]`. Shown as a language filter on JuicyJuicy. | `--languages a,b` |
-| `features` | yes | The JuicyJuicy upgrades the game has, by id: `browser-menu`, `cloud-saves`; `[]` for none. Required: `check` and `publish` stop without it, and `init` adds `[]`. Add an id only once the game has the feature (see SKILL.md, "Add a JuicyJuicy upgrade"); `check` warns when one is listed but missing. Multi-language is `languages`, not a feature id. | |
+| `features` | yes | The JuicyJuicy upgrades the game has, by id: `auto-pause`, `browser-menu`, `cloud-saves`, `gamepad`, `highscores`, `multiplayer`, `touch`; `[]` for none. Required: `check` and `publish` stop without it, and `init` adds `[]`. Add an id only once the game has the feature (see SKILL.md, "Add a JuicyJuicy upgrade"); `check` warns when one is listed but missing. Multi-language is `languages`, not a feature id; `touch` and `gamepad` go in `input` too. | |
 | `input` | | Any of `keyboard`, `mouse`, `touch`, `gamepad`. | `--input a,b` |
 | `orientation` | | `landscape`, `portrait` or `any` (default). | `--orientation` |
 | `aspectRatio` | | `"W:H"` like `"16:9"` or `"4:3"`, or `"fill"` to fill the player. Default `16:9`. | `--aspect-ratio` |

package/dist/skill/reference/moderation.md

@@ -25,7 +25,7 @@ JuicyJuicy's moderators (its admins) can leave the user a written comment about
    - after a change request or a rejection: run the review steps and publish a new version (`publish --json`, with a `--message` that says what changed). Tell the user it goes through the safety check again and may wait for a moderator.
    - after a block: publish if the game's files changed (a new title or description in `juicy.json` also goes out with a publish), then ask for another look:
      ```bash
-     npx -y juicyjuicy@0.14.0 recheck <slug> --reply "<what the user changed, in their words>" --json
+     npx -y juicyjuicy@0.16.0 recheck <slug> --reply "<what the user changed, in their words>" --json
      ```
      The game stays unlisted until an admin lists it again; tell the user that. Write the reply with the user, and keep it to what was changed.
 4. **If the user doesn't want to change it**, stop. A version with changes requested or rejected never goes live, and a blocked game stays unlisted. Don't try to get around the note: don't republish the same thing to clear it, rename the game, or publish it under a new slug.

package/dist/skill/reference/mouse-lock.md

@@ -0,0 +1,22 @@
+# Upgrade: mouse lock
+
+Aiming or steering with the mouse keeps the cursor in the game. Read this when the publish standards in SKILL.md find a game that aims or steers with the mouse without locking it, or when the user asks for mouse lock. JuicyJuicy doesn't lock the mouse for a game: the frame only allows it, and the game has to ask. If the user's game needs it, follow "Add a JuicyJuicy upgrade" in SKILL.md to publish the change.
+
+## Why
+In a game that turns a camera or aims with the mouse, turning fast drags the cursor out of the game's frame, onto the page or another screen, and the game stops getting the movement. Pointer Lock hides the cursor and keeps sending movement however far the mouse goes. JuicyJuicy's frame allows it.
+
+**Only for games that aim or steer with mouse movement** (first-person, twin-stick, flight, top-down aiming that turns the view). A game played by clicking things on screen (puzzles, cards, strategy) needs the cursor: tell the user mouse lock doesn't fit it, and stop.
+
+## What to change
+1. **Lock on a click in the game**, never on load: browsers only allow it after a user gesture. On the canvas's `click` (or a "Click to play" overlay), call `canvas.requestPointerLock()`. Where supported, `requestPointerLock({ unadjustedMovement: true })` gives raw movement; fall back to the plain call if it rejects.
+2. **Read movement, not position**: while locked, use `event.movementX` and `movementY` from `mousemove` (the cursor position doesn't change). Keep the game's sensitivity setting, or add one.
+3. **Follow the lock state**: on `document`'s `pointerlockchange`, `document.pointerLockElement === canvas` says whether it's locked. When the lock ends (the player pressed Esc, switched tabs, or the browser took it back), **pause** and show "Click to play"; clicking locks again. Handle `pointerlockerror` with the same screen.
+4. **Menus unlock**: opening the pause menu or any screen with buttons calls `document.exitPointerLock()`, so the player can click them; going back to play locks again on the next click.
+5. **Esc belongs to the browser**: in a locked or fullscreen game, Esc only gives the mouse back. Pause on the lock ending (step 3), not on the Esc key, and give pause a key other than Esc (like P), as [browser-menu.md](browser-menu.md) explains.
+   Engines: Phaser has `this.input.mouse.requestPointerLock()` and `this.input.mouse.locked`; Godot sets `Input.mouse_mode = Input.MOUSE_MODE_CAPTURED` from an input event and reads `InputEventMouseMotion.relative`; Unity sets `Cursor.lockState = CursorLockMode.Locked` after a click.
+
+## Check it
+Run the game: a click locks the cursor and turning works far past the frame's edges; Esc gives the mouse back and the game pauses with "Click to play"; a click resumes; menus can be clicked.
+
+## Declare it
+Nothing to declare: mouse lock isn't a row in the Upgrades panel, so leave `features` as it is. A `juicy.json` that already lists `mouse-lock` is fine as it is too.

package/dist/skill/reference/multiplayer.md

@@ -95,9 +95,12 @@ window.juicy.rooms || (function (juicy) {
     this.link = null;
     this.opened = false;
     this.closed = false;
+    this.reconnecting = false;
   }
   // Events: "message" (data, fromId), "join" (player), "leave" (player), "host" (id),
-  // "lock" (locked), "public" (isPublic), "error" (error), "close" (reason).
+  // "lock" (locked), "public" (isPublic), "error" (error), "close" (reason),
+  // "reconnecting" (attempt: 1 to 3; show "Reconnecting...", sends meanwhile are dropped) and
+  // "reconnected" (back in the room; "join", "leave" and "host" have told what changed).
   Room.prototype.on = function (event, handler) {
     (this.handlers[event] = this.handlers[event] || []).push(handler);
     return this;
@@ -148,6 +151,7 @@ window.juicy.rooms || (function (juicy) {
   Room.prototype.end = function (reason) {
     if (this.closed) return;
     this.closed = true;
+    this.reconnecting = false;
     var link = this.link;
     this.link = null;
     if (link) link.close();
@@ -202,9 +206,10 @@ window.juicy.rooms || (function (juicy) {
     }
   };
 
-  // JuicyJuicy's relay: resolves once it has welcomed this player.
-  function connect(room, query) {
-    return askTicket(true).then(function (m) {
+  // JuicyJuicy's relay: resolves once it has welcomed this player. "ticket" is the player's answer
+  // with a ticket when there is one already, else a new one is asked for.
+  function connect(room, query, ticket) {
+    return (ticket ? Promise.resolve(ticket) : askTicket(true)).then(function (m) {
       return new Promise(function (resolve, reject) {
         var socket = new WebSocket(m.url + "?ticket=" + encodeURIComponent(m.ticket) + query);
         var welcomed = false;
@@ -227,6 +232,10 @@ window.juicy.rooms || (function (juicy) {
             welcomed = true;
             room.link = link;
             room.receive(message);
+            if (room.reconnecting) {
+              room.reconnecting = false;
+              room.emit("reconnected");
+            }
             return resolve(room);
           }
           if (room.link === link) room.receive(message);
@@ -246,6 +255,8 @@ window.juicy.rooms || (function (juicy) {
   function reconnect(room, attempt) {
     if (room.closed) return;
     if (attempt === 3) return room.end("DISCONNECTED");
+    room.reconnecting = true;
+    room.emit("reconnecting", attempt + 1);
     setTimeout(function () {
       if (room.closed) return;
       connect(room, "&room=" + room.code).catch(function (e) {
@@ -447,7 +458,7 @@ window.juicy.rooms || (function (juicy) {
         var room = new Room(null);
         if (m) {
           return connect(room, "&create=1&max=" + max + (listed ? "&public=1" : "") +
-            (label ? "&label=" + label : ""));
+            (label ? "&label=" + label : ""), m);
         }
         room.code = newCode();
         return joinLocal(room, max, { public: listed, label: label });
@@ -458,7 +469,7 @@ window.juicy.rooms || (function (juicy) {
       code = String(code || "").trim().toUpperCase();
       return askTicket(true).then(function (m) {
         var room = new Room(code);
-        return m ? connect(room, "&room=" + encodeURIComponent(code)) : joinLocal(room, 0);
+        return m ? connect(room, "&room=" + encodeURIComponent(code), m) : joinLocal(room, 0);
       });
     },
     // The game's public rooms that can be joined now (not full or locked), newest first:
@@ -550,6 +561,8 @@ function start(room) {
   room.on("host", () => showLobby(room)); // the new host gets the switch and Start
   room.on("public", (isPublic) => showPublic(isPublic));
   room.on("message", (data, from) => (data.k === "start" ? beginGame(room) : handle(data, from)));
+  room.on("reconnecting", () => showStatus("Reconnecting…")); // a dropped connection, up to 3 tries
+  room.on("reconnected", () => showStatus(""));
   room.on("close", (reason) => { showScreen("multiplayer"); showError(reason); });
 }
 ```
@@ -560,7 +573,7 @@ function start(room) {
 - `juicy.rooms.list({ label })` resolves to the public rooms that can be joined now, newest first, at most 50: `[{ code, host, players, max, label }]` (`host` is the host's login). Full and locked rooms aren't in it. With `label`, only rooms with that label. It rejects like `create()` (`SIGNED_OUT`, `RATE_LIMITED`, `PAUSED`, `OFF`, `FAILED`, `TIMEOUT`). Join one with `join(room.code)`.
 - The room: `room.code`, `room.me` (this player's id, like `"p2"`), `room.host` (the host's id), `room.isHost()`, `room.players` (`{ id, name }`, name being the member's JuicyJuicy login), `room.player(id)`, `room.locked`, `room.max`, `room.public` and `room.label`.
 - `room.send(data)` sends any JSON value to everyone else; `room.send(data, id)` only to that player. A player never gets their own messages.
-- `room.on(event, handler)`: `"message"` (data, fromId), `"join"` (player), `"leave"` (player), `"host"` (the new host's id), `"lock"` (locked), `"public"` (whether it's listed), `"error"` (an `Error` with a `code`: `RATE_LIMITED`, `TOO_LARGE`, `NOT_HOST`, `NO_PLAYER`, `INVALID`; the room goes on), `"close"` (reason: `LEFT`, `KICKED`, `REPLACED` (the same player joined from another tab), `ROOM_NOT_FOUND`, `TOO_FAST`, `GAME_GONE`, `OFF` or `DISCONNECTED`).
+- `room.on(event, handler)`: `"message"` (data, fromId), `"join"` (player), `"leave"` (player), `"host"` (the new host's id), `"lock"` (locked), `"public"` (whether it's listed), `"error"` (an `Error` with a `code`: `RATE_LIMITED`, `TOO_LARGE`, `NOT_HOST`, `NO_PLAYER`, `INVALID`; the room goes on), `"reconnecting"` (the attempt, 1 to 3: the connection dropped and the room is trying to come back; show "Reconnecting…" over the game, and know that `send()` does nothing meanwhile), `"reconnected"` (back in the room; `join`, `leave` and `host` have already told what changed while away), `"close"` (reason: `LEFT`, `KICKED`, `REPLACED` (the same player joined from another tab), `ROOM_NOT_FOUND`, `TOO_FAST`, `GAME_GONE` (the game was taken down: its open rooms close within 30 seconds), `OFF` or `DISCONNECTED` (the three tries failed)).
 - The host only: `room.lock()` stops new players joining (players who were in can come back) and takes a public room off the list, `room.lock(false)` opens it again; `room.kick(id)` removes a player for good (they don't see the room in the list either); `room.setPublic(false)` makes a public room invite-only, `room.setPublic()` lists it.
 - `room.invite()` shows JuicyJuicy's share sheet over the game and returns the link (`https://juicyjuicy.games/g/<slug>/play?room=CODE`).
 - `room.leave()` leaves the room.

package/dist/skill/reference/touch.md

@@ -0,0 +1,44 @@
+# Upgrade: mobile optimization
+
+The game plays well on phones and tablets: controls, screen, sound and speed. Read this when the user asks for mobile optimization or touch controls (the JuicyJuicy Upgrades panel's prompt names this file), then follow "Add a JuicyJuicy upgrade" in SKILL.md to publish it.
+
+## Why
+Many players open a shared link on their phone. JuicyJuicy shows the game there in a frame that fills the screen below a slim bar. Players without a keyboard or mouse can only watch unless the game takes touches, and a game laid out for a desktop window ends up cut off or tiny. Games with touch also get the **Touch controls** chip and filter on JuicyJuicy.
+
+## What to change
+Go through every part, also when the game already takes touches: fix what falls short and leave what's already right. Keyboard and mouse players keep the game as it was.
+
+### Controls
+1. **Pick the controls that fit the game**, and say which to the user before building, in a sentence:
+   - **Taps and drags** for games already played with the mouse (clicks, aiming, dragging pieces): make the pointer code work for touch. Use Pointer Events (`pointerdown`, `pointermove`, `pointerup`) instead of mouse events, so one handler takes both; for multi-touch, track each `pointerId`.
+   - **Swipes** for games with four directions (snake, 2048, tile puzzles): a swipe longer than about 30 CSS pixels in its main direction is the arrow key.
+   - **On-screen buttons** for games with keys held down (platformers, shooters, racing): a d-pad or a virtual stick on the left, action buttons on the right. Each button is at least 44×44 CSS pixels with space between, semi-transparent over the game, and holding it acts like holding the key (press on `pointerdown`, release on `pointerup`, `pointercancel` and `pointerleave`). Moving and jumping at once must work: track each `pointerId`.
+   Engines: Phaser has `this.input.on("pointerdown", …)` and `this.input.addPointer()` for more fingers; Godot has `InputEventScreenTouch`/`ScreenDrag` and a `TouchScreenButton` node that triggers an input action; Unity uses its Input System's on-screen controls.
+2. **Show on-screen buttons only on touch screens**: when `matchMedia("(pointer: coarse)").matches`, or from the first `touchstart`/`pointerdown` with `pointerType === "touch"`.
+3. **Stop the browser taking the gestures.** On the game's canvas or container, set the CSS `touch-action: none` and `user-select: none; -webkit-user-select: none; -webkit-touch-callout: none`, so drags don't scroll or zoom the page and a long press doesn't select or open a menu. On `html, body` set `overscroll-behavior: none; overflow: hidden`, unless the game is a page meant to scroll. Keep `<meta name="viewport" content="width=device-width, initial-scale=1">`.
+4. **Menus and dialogs work by tap**: every key-only action ("press Enter to start", "Space to restart") gets a tap target too, and the help text says "tap" on touch screens. Anything shown only on hover also needs a tap.
+
+### Screen
+5. **Fit the frame.** Size the game from the frame (`innerWidth` and `innerHeight`, or CSS `100%`): no fixed 1280×720 page with scrollbars, and nothing important cut off at a narrow width.
+6. **Survive every resize.** Rotating the phone, the browser's address bar sliding away and the on-screen keyboard all resize the frame. Listen for `resize`, lay the game out again and keep playing: never restart the level or lose the score because of it.
+7. **Stay readable.** Size text and buttons in CSS pixels from the frame, not from the game's internal resolution, so a 1920-wide canvas shrunk to a phone doesn't shrink its text with it: body text at least 14 CSS pixels, tap targets at least 44.
+8. **Work both ways round if you can**, with a layout for tall and for wide frames, as the shapes are very different. If the game only works one way, set `orientation` in `juicy.json` (`landscape` or `portrait`) and, when the frame is the other way round, pause and show "Rotate your phone" over the game until a `resize` puts it right. Nothing rotates the game for you: `screen.orientation.lock()` doesn't work on iPhones.
+9. **Keep controls clear.** On-screen controls sit at least 16 CSS pixels from the frame's edges, under the thumbs, and don't cover the player or the action. In a tall frame, put them below the play area when there's room.
+10. **Never need fullscreen.** iPhone Safari can't put a game in fullscreen: hide the game's own fullscreen button when `document.fullscreenEnabled` is false.
+
+### Phone browsers
+11. **Sound starts on a tap.** Phones keep audio silent until the player touches the game: create or `resume()` the `AudioContext` in a `pointerup` or `click` handler (iPhones don't accept `pointerdown`), and `resume()` again when the page becomes visible, since a call or switching apps suspends it.
+12. **Nothing depends on the mouse or keyboard being there.** Phones have no Pointer Lock: when `requestPointerLock` is missing or fails, aim by dragging or with a stick. Only a real `<input>` brings up the on-screen keyboard: focus it inside the tap's handler and give it `font-size: 16px`, or iPhones zoom the page.
+13. **Run smoothly.** Cap the drawing resolution on touch screens at `Math.min(devicePixelRatio, 2)`, and use fewer particles or effects there if a round drops frames. Desktop keeps its full quality.
+14. **Stop when hidden.** Phones switch apps often: on `visibilitychange` to hidden, pause a real-time game and stop its sound.
+
+## Check it
+Run the game in the browser's device mode (a phone size, touch on), upright and on its side (about 390×844 and 844×390), and play a full round with touch only: start, play, pause, game over, restart. Rotate in the middle of a round and check it carries on. Check the page never scrolls or zooms and nothing is cut off. Then check the keyboard and mouse still work as before.
+
+Device mode can't show everything, sound on iPhones above all: tell the user, in a sentence, to try the game on a real phone after publishing.
+
+## When it doesn't fit
+Some games can't work on a phone, such as one that needs a full keyboard all the time. Tell the user why, do what still helps (screen fit, readable text) if they want it, and don't declare it.
+
+## Declare it
+Add `"touch"` to `input` in `juicy.json` (`"input": ["keyboard", "touch"]`, keeping what's there), and `"touch"` to `features` (`"features": ["touch"]`, adding to the list). JuicyJuicy can't detect this one from the files: `input` is what the site's chip reads and `features` is what ends the Upgrades panel's offer, so only add them once a full round plays by touch.

package/dist/skill/reference/troubleshooting.md

@@ -6,7 +6,7 @@ With `--json`, a failed command's last line is `{"ok": false, "error": {"code",
 
 | Code | Meaning | Fix |
 |---|---|---|
-| `UNAUTHORIZED` | No saved login, or the token was revoked. | `npx -y juicyjuicy@0.14.0 login --json` (the user approves in the browser). In CI, set `JUICY_TOKEN`. |
+| `UNAUTHORIZED` | No saved login, or the token was revoked. | `npx -y juicyjuicy@0.16.0 login --json` (the user approves in the browser). In CI, set `JUICY_TOKEN`. |
 | `EXPIRED_TOKEN` | The login code expired (10 minutes) or was used. | Run `login` again. |
 | `ACCESS_DENIED` | The user clicked Deny. | Ask them, then run `login` again. |
 

package/dist/skill/reference/update-all-games.md

@@ -1,11 +1,13 @@
 # Bring all my JuicyJuicy games up to date
 
-For "bring my JuicyJuicy games up to date", "fix the required updates", a **Needs update** badge on My games, or a `check` that warns `requirement-missing`. Sometimes JuicyJuicy makes a rule every game must follow (say, `juicy.json` listing its `features`). A game that doesn't follow it, or that JuicyJuicy hasn't checked yet, leaves the public lists after the deadline; its link keeps working.
+For "bring my JuicyJuicy games up to date", "fix the required updates", a **Needs update** badge on My games, or a `check` or `publish` that warns `requirement-missing`. Sometimes JuicyJuicy makes a rule every game must follow (say, `juicy.json` listing its `features`). A game that doesn't follow it, or that JuicyJuicy hasn't checked yet, leaves the public lists after the deadline; its link keeps working.
+
+To only say which games need an update, without checking or changing anything: `npx -y juicyjuicy@0.16.0 list --json` gives each of the user's games `needsUpdate`, one entry per required update (`title`, `deadline`, `phase` `enforced` once it's past the deadline, `notChecked` when JuicyJuicy hasn't checked the game yet, which step 1 settles); `[]` means none.
 
 1. **Check every game at once.** Log in first (SKILL.md step 1), then run:
 
    ```bash
-   npx -y juicyjuicy@0.14.0 check-games --json
+   npx -y juicyjuicy@0.16.0 check-games --json
    ```
 
    JuicyJuicy checks the live version of each of the user's games on its side. It records which features each one has and, for a game whose `juicy.json` never listed its `features`, declares what it finds in the files (like cloud saves). Nothing is uploaded and no new version is made. The result has one entry per game in `games` (`features` with `on`/`off`/`unknown`, `requirements` with `passed`), `toFix` (the games that still need a code change, each with its `prompts`), `notReached` and `next`.
@@ -13,7 +15,7 @@ For "bring my JuicyJuicy games up to date", "fix the required updates", a **Need
 2. **If `notReached` isn't empty**, run `check-games` again: it had no time for those games.
 
 3. **For each game in `toFix`**, one at a time:
-   - Find its project, or download the live version with `npx -y juicyjuicy@0.14.0 pull <slug> --json` (SKILL.md, "Add a JuicyJuicy upgrade", step 1).
+   - Find its project, or download the live version with `npx -y juicyjuicy@0.16.0 pull <slug> --json` (SKILL.md, "Add a JuicyJuicy upgrade", step 1).
    - Do what each prompt says, with the recipe it names when it names one.
    - Make sure `juicy.json` has `features` (`[]` if the game has none of the upgrades).
    - Check and publish an update as SKILL.md steps 5–7 say, with `--message "Required update: <what>"`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "juicyjuicy",
-  "version": "0.14.0",
+  "version": "0.16.0",
   "description": "Publish AI-made browser games to juicyjuicy.games",
   "type": "module",
   "license": "MIT",