@crowdedkingdoms/crowdyjs 1.0.0

package/dist/domains/host.d.ts

@@ -0,0 +1,35 @@
+import type { GraphQLClient } from '../client.js';
+import { type GameHostQuery, type ActorHeartbeatMutation } from '../generated/graphql.js';
+/**
+ * Game-host election + actor liveness heartbeat — exposed as `client.host`.
+ *
+ * Targets the **game-api**. The elected host is deterministic across all
+ * game-api replicas (the user whose earliest still-connected actor was created
+ * first wins). {@link heartbeat} refreshes the caller's actor freshness (keeping
+ * them host-eligible) and returns the freshly-elected host in one round-trip —
+ * call it on an interval shorter than the server's freshness window. Both
+ * require a valid session; `appId` is a `BigInt` decimal string.
+ *
+ * @throws {CrowdyGraphQLError} `UNAUTHENTICATED` without a session.
+ */
+export declare class HostAPI {
+    private readonly graphql;
+    constructor(graphql: GraphQLClient);
+    /**
+     * Return the single elected host user for an app, or `null` when no actors
+     * exist.
+     *
+     * @param appId - The app to elect the host for.
+     * @returns The elected {@link GameHost}, or `null`.
+     */
+    get(appId: string): Promise<GameHostQuery['gameHost']>;
+    /**
+     * Refresh the caller's actor freshness in an app and return the freshly
+     * elected host. Returns `null` when no fresh actors exist for the app.
+     *
+     * @param appId - The app whose actors to keep fresh (and elect the host for).
+     * @returns The freshly elected {@link GameHost}, or `null`.
+     */
+    heartbeat(appId: string): Promise<ActorHeartbeatMutation['actorHeartbeat']>;
+}
+//# sourceMappingURL=host.d.ts.map

package/dist/domains/host.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host.d.ts","sourceRoot":"","sources":["../../src/domains/host.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAGL,KAAK,aAAa,EAClB,KAAK,sBAAsB,EAC5B,MAAM,yBAAyB,CAAC;AAEjC;;;;;;;;;;;GAWG;AACH,qBAAa,OAAO;IACN,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,aAAa;IAEnD;;;;;;OAMG;IACG,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;IAK5D;;;;;;OAMG;IACG,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,CAAC;CAIlF"}

package/dist/domains/host.js

@@ -0,0 +1,40 @@
+import { GameHostDocument, ActorHeartbeatDocument, } from '../generated/graphql.js';
+/**
+ * Game-host election + actor liveness heartbeat — exposed as `client.host`.
+ *
+ * Targets the **game-api**. The elected host is deterministic across all
+ * game-api replicas (the user whose earliest still-connected actor was created
+ * first wins). {@link heartbeat} refreshes the caller's actor freshness (keeping
+ * them host-eligible) and returns the freshly-elected host in one round-trip —
+ * call it on an interval shorter than the server's freshness window. Both
+ * require a valid session; `appId` is a `BigInt` decimal string.
+ *
+ * @throws {CrowdyGraphQLError} `UNAUTHENTICATED` without a session.
+ */
+export class HostAPI {
+    constructor(graphql) {
+        this.graphql = graphql;
+    }
+    /**
+     * Return the single elected host user for an app, or `null` when no actors
+     * exist.
+     *
+     * @param appId - The app to elect the host for.
+     * @returns The elected {@link GameHost}, or `null`.
+     */
+    async get(appId) {
+        const data = await this.graphql.request(GameHostDocument, { appId });
+        return data.gameHost;
+    }
+    /**
+     * Refresh the caller's actor freshness in an app and return the freshly
+     * elected host. Returns `null` when no fresh actors exist for the app.
+     *
+     * @param appId - The app whose actors to keep fresh (and elect the host for).
+     * @returns The freshly elected {@link GameHost}, or `null`.
+     */
+    async heartbeat(appId) {
+        const data = await this.graphql.request(ActorHeartbeatDocument, { appId });
+        return data.actorHeartbeat;
+    }
+}

package/dist/domains/organizations.d.ts

@@ -0,0 +1,179 @@
+import type { GraphQLClient } from '../client.js';
+import { type OrganizationQuery, type OrganizationBySlugQuery, type MyOrganizationsQuery, type OrgMembersQuery, type OrgRolesQuery, type MemberRolesQuery, type OrgPermissionsQuery, type OrgTokensQuery, type CreateOrganizationMutation, type SetOrgStatusMutation, type CreateOrgTokenMutation, type UpdateOrgTokenMutation, type RevokeOrgTokenMutation, type InviteOrgMemberMutation, type RemoveOrgMemberMutation, type UpdateOrgMemberRolesMutation, type CreateOrgRoleMutation, type UpdateOrgRoleMutation, type DeleteOrgRoleMutation, type CreateOrganizationInput, type CreateOrgTokenInput, type UpdateOrgTokenInput, type InviteOrgMemberInput, type CreateOrgRoleInput, type UpdateOrgRoleInput } from '../generated/graphql.js';
+/**
+ * Organizations, members, roles (RBAC), and org API tokens — exposed as
+ * `client.organizations` (and grouped under `client.admin`).
+ *
+ * Targets the **management-api**. This is the studio-admin surface: an
+ * organization owns apps, billing, quotas, and environments, and its RBAC
+ * grants (`manage_members`, `manage_tokens`, ...) gate the rest of the admin
+ * APIs. Most operations require an authenticated caller who is an active member
+ * of the org with the relevant permission; reads such as {@link permissions}
+ * and {@link bySlug} are public.
+ *
+ * `BigInt` ids (`orgId`, `userId`, `orgRoleId`, `orgTokenId`) are decimal
+ * strings.
+ *
+ * @throws {CrowdyGraphQLError} `UNAUTHENTICATED` without a session, `FORBIDDEN`
+ *   / `SCOPE_MISSING` when the caller lacks the required org permission.
+ */
+export declare class OrganizationsAPI {
+    private readonly management;
+    constructor(management: GraphQLClient);
+    /**
+     * Fetch a single organization by numeric id. Requires authentication.
+     *
+     * @param orgId - Numeric org id (`BigInt` as a decimal string).
+     * @returns The {@link Organization}, or `null` if it does not exist.
+     */
+    get(orgId: string): Promise<OrganizationQuery['organization']>;
+    /**
+     * Resolve an organization by its URL slug. **Public** — no session required.
+     *
+     * @param slug - The org's URL slug (e.g. `"acme"`).
+     * @returns The {@link Organization}, or `null` if no match.
+     */
+    bySlug(slug: string): Promise<OrganizationBySlugQuery['organizationBySlug']>;
+    /**
+     * List the organizations the authenticated caller is an active member of,
+     * with their per-org permissions and roles.
+     *
+     * @returns An array of {@link OrgMembership} (empty if the caller belongs to
+     *   no orgs).
+     */
+    mine(): Promise<MyOrganizationsQuery['myOrganizations']>;
+    /**
+     * List members of an organization. Requires the `manage_members` org
+     * permission.
+     *
+     * @param orgId - Numeric org id.
+     * @returns The org's members with their roles.
+     */
+    members(orgId: string): Promise<OrgMembersQuery['orgMembers']>;
+    /**
+     * List the custom + system roles defined for an organization. Requires the
+     * `manage_members` org permission.
+     *
+     * @param orgId - Numeric org id.
+     * @returns The org's roles.
+     */
+    roles(orgId: string): Promise<OrgRolesQuery['orgRoles']>;
+    /**
+     * List the roles currently assigned to one organization member. Requires the
+     * `manage_members` org permission.
+     *
+     * @param orgMemberId - Numeric org-member id (`BigInt` as a decimal string).
+     * @returns The member's roles.
+     */
+    memberRoles(orgMemberId: string): Promise<MemberRolesQuery['memberRoles']>;
+    /**
+     * List every assignable org permission key with its description. **Public** —
+     * useful for building a role editor UI.
+     *
+     * @returns The catalog of org permissions.
+     */
+    permissions(): Promise<OrgPermissionsQuery['orgPermissions']>;
+    /**
+     * List the API tokens issued for an organization (metadata only; the secret
+     * is shown once at creation). Requires the `manage_tokens` org permission.
+     *
+     * @param orgId - Numeric org id.
+     * @returns The org's API tokens.
+     */
+    tokens(orgId: string): Promise<OrgTokensQuery['orgTokens']>;
+    /**
+     * Create a new organization owned by the authenticated caller. The caller
+     * becomes the owner with full permissions.
+     *
+     * @param input - {@link CreateOrganizationInput}: `name` and a unique `slug`.
+     * @returns The created {@link Organization}.
+     */
+    create(input: CreateOrganizationInput): Promise<CreateOrganizationMutation['createOrganization']>;
+    /**
+     * Set an organization's lifecycle status. **Super-admin only.**
+     *
+     * @param orgId - Numeric org id.
+     * @param status - The new status (e.g. `"active"`, `"suspended"`).
+     * @returns The updated {@link Organization}.
+     */
+    setStatus(orgId: string, status: string): Promise<SetOrgStatusMutation['setOrgStatus']>;
+    /**
+     * Mint a new org API token (for server-side studio backends). Requires the
+     * `manage_tokens` org permission. The plaintext secret is returned **once**.
+     *
+     * @param input - {@link CreateOrgTokenInput}: `orgId`, `name`, optional
+     *   `permissions` and `expiresAt`.
+     * @returns The created token including its one-time plaintext secret.
+     */
+    createToken(input: CreateOrgTokenInput): Promise<CreateOrgTokenMutation['createOrgToken']>;
+    /**
+     * Update an org token's metadata (name / permissions / expiry). Requires the
+     * `manage_tokens` org permission.
+     *
+     * @param orgTokenId - Numeric token id.
+     * @param input - {@link UpdateOrgTokenInput} fields to change.
+     * @returns The updated token metadata.
+     */
+    updateToken(orgTokenId: string, input: UpdateOrgTokenInput): Promise<UpdateOrgTokenMutation['updateOrgToken']>;
+    /**
+     * Revoke (disable) an org token. Requires the `manage_tokens` org permission.
+     *
+     * @param orgTokenId - Numeric token id.
+     * @returns `true` on success.
+     */
+    revokeToken(orgTokenId: string): Promise<RevokeOrgTokenMutation['revokeOrgToken']>;
+    /**
+     * Invite a user to an organization (by email or user id), optionally with
+     * initial roles. Requires the `manage_members` org permission.
+     *
+     * @param input - {@link InviteOrgMemberInput}.
+     * @returns The created membership.
+     */
+    inviteMember(input: InviteOrgMemberInput): Promise<InviteOrgMemberMutation['inviteOrgMember']>;
+    /**
+     * Remove a member from an organization. Requires the `manage_members` org
+     * permission.
+     *
+     * @param orgId - Numeric org id.
+     * @param userId - Numeric id of the member to remove.
+     * @returns `true` on success.
+     */
+    removeMember(orgId: string, userId: string): Promise<RemoveOrgMemberMutation['removeOrgMember']>;
+    /**
+     * Replace a member's role assignments. Requires the `manage_members` org
+     * permission.
+     *
+     * @param orgId - Numeric org id.
+     * @param userId - Numeric id of the member.
+     * @param roleIds - The full set of role ids the member should hold.
+     * @returns The updated membership.
+     */
+    setMemberRoles(orgId: string, userId: string, roleIds: string[]): Promise<UpdateOrgMemberRolesMutation['updateOrgMemberRoles']>;
+    /**
+     * Create a custom org role with a set of permissions. Requires the
+     * `manage_members` org permission.
+     *
+     * @param input - {@link CreateOrgRoleInput}: `orgId`, `roleName`,
+     *   `permissions`.
+     * @returns The created {@link OrgRole}.
+     */
+    createRole(input: CreateOrgRoleInput): Promise<CreateOrgRoleMutation['createOrgRole']>;
+    /**
+     * Update a custom org role's name/permissions. Requires the `manage_members`
+     * org permission. System roles cannot be edited.
+     *
+     * @param orgRoleId - Numeric role id.
+     * @param input - {@link UpdateOrgRoleInput} fields to change.
+     * @returns The updated {@link OrgRole}.
+     */
+    updateRole(orgRoleId: string, input: UpdateOrgRoleInput): Promise<UpdateOrgRoleMutation['updateOrgRole']>;
+    /**
+     * Delete a custom org role. Requires the `manage_members` org permission.
+     * System roles cannot be deleted.
+     *
+     * @param orgRoleId - Numeric role id.
+     * @returns `true` on success.
+     */
+    deleteRole(orgRoleId: string): Promise<DeleteOrgRoleMutation['deleteOrgRole']>;
+}
+//# sourceMappingURL=organizations.d.ts.map

package/dist/domains/organizations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"organizations.d.ts","sourceRoot":"","sources":["../../src/domains/organizations.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAoBL,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,0BAA0B,EAC/B,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAC5B,KAAK,4BAA4B,EACjC,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,uBAAuB,EAC5B,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACxB,MAAM,yBAAyB,CAAC;AAEjC;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,gBAAgB;IACf,OAAO,CAAC,QAAQ,CAAC,UAAU;gBAAV,UAAU,EAAE,aAAa;IAEtD;;;;;OAKG;IACG,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAC;IAOpE;;;;;OAKG;IACG,MAAM,CACV,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,uBAAuB,CAAC,oBAAoB,CAAC,CAAC;IAOzD;;;;;;OAMG;IACG,IAAI,IAAI,OAAO,CAAC,oBAAoB,CAAC,iBAAiB,CAAC,CAAC;IAK9D;;;;;;OAMG;IACG,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;IAKpE;;;;;;OAMG;IACG,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;IAK9D;;;;;;OAMG;IACG,WAAW,CACf,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;IAO3C;;;;;OAKG;IACG,WAAW,IAAI,OAAO,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;IAKnE;;;;;;OAMG;IACG,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;IAKjE;;;;;;OAMG;IACG,MAAM,CACV,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAAC,0BAA0B,CAAC,oBAAoB,CAAC,CAAC;IAO5D;;;;;;OAMG;IACG,SAAS,CACb,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,oBAAoB,CAAC,cAAc,CAAC,CAAC;IAQhD;;;;;;;OAOG;IACG,WAAW,CACf,KAAK,EAAE,mBAAmB,GACzB,OAAO,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,CAAC;IAOpD;;;;;;;OAOG;IACG,WAAW,CACf,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,mBAAmB,GACzB,OAAO,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,CAAC;IAQpD;;;;;OAKG;IACG,WAAW,CACf,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,CAAC;IAOpD;;;;;;OAMG;IACG,YAAY,CAChB,KAAK,EAAE,oBAAoB,GAC1B,OAAO,CAAC,uBAAuB,CAAC,iBAAiB,CAAC,CAAC;IAOtD;;;;;;;OAOG;IACG,YAAY,CAChB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,uBAAuB,CAAC,iBAAiB,CAAC,CAAC;IAQtD;;;;;;;;OAQG;IACG,cAAc,CAClB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EAAE,GAChB,OAAO,CAAC,4BAA4B,CAAC,sBAAsB,CAAC,CAAC;IAShE;;;;;;;OAOG;IACG,UAAU,CACd,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC,qBAAqB,CAAC,eAAe,CAAC,CAAC;IAOlD;;;;;;;OAOG;IACG,UAAU,CACd,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC,qBAAqB,CAAC,eAAe,CAAC,CAAC;IAQlD;;;;;;OAMG;IACG,UAAU,CACd,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,qBAAqB,CAAC,eAAe,CAAC,CAAC;CAMnD"}

package/dist/domains/organizations.js

@@ -0,0 +1,269 @@
+import { OrganizationDocument, OrganizationBySlugDocument, MyOrganizationsDocument, OrgMembersDocument, OrgRolesDocument, MemberRolesDocument, OrgPermissionsDocument, OrgTokensDocument, CreateOrganizationDocument, SetOrgStatusDocument, CreateOrgTokenDocument, UpdateOrgTokenDocument, RevokeOrgTokenDocument, InviteOrgMemberDocument, RemoveOrgMemberDocument, UpdateOrgMemberRolesDocument, CreateOrgRoleDocument, UpdateOrgRoleDocument, DeleteOrgRoleDocument, } from '../generated/graphql.js';
+/**
+ * Organizations, members, roles (RBAC), and org API tokens — exposed as
+ * `client.organizations` (and grouped under `client.admin`).
+ *
+ * Targets the **management-api**. This is the studio-admin surface: an
+ * organization owns apps, billing, quotas, and environments, and its RBAC
+ * grants (`manage_members`, `manage_tokens`, ...) gate the rest of the admin
+ * APIs. Most operations require an authenticated caller who is an active member
+ * of the org with the relevant permission; reads such as {@link permissions}
+ * and {@link bySlug} are public.
+ *
+ * `BigInt` ids (`orgId`, `userId`, `orgRoleId`, `orgTokenId`) are decimal
+ * strings.
+ *
+ * @throws {CrowdyGraphQLError} `UNAUTHENTICATED` without a session, `FORBIDDEN`
+ *   / `SCOPE_MISSING` when the caller lacks the required org permission.
+ */
+export class OrganizationsAPI {
+    constructor(management) {
+        this.management = management;
+    }
+    /**
+     * Fetch a single organization by numeric id. Requires authentication.
+     *
+     * @param orgId - Numeric org id (`BigInt` as a decimal string).
+     * @returns The {@link Organization}, or `null` if it does not exist.
+     */
+    async get(orgId) {
+        const data = await this.management.request(OrganizationDocument, {
+            id: orgId,
+        });
+        return data.organization;
+    }
+    /**
+     * Resolve an organization by its URL slug. **Public** — no session required.
+     *
+     * @param slug - The org's URL slug (e.g. `"acme"`).
+     * @returns The {@link Organization}, or `null` if no match.
+     */
+    async bySlug(slug) {
+        const data = await this.management.request(OrganizationBySlugDocument, {
+            slug,
+        });
+        return data.organizationBySlug;
+    }
+    /**
+     * List the organizations the authenticated caller is an active member of,
+     * with their per-org permissions and roles.
+     *
+     * @returns An array of {@link OrgMembership} (empty if the caller belongs to
+     *   no orgs).
+     */
+    async mine() {
+        const data = await this.management.request(MyOrganizationsDocument, {});
+        return data.myOrganizations;
+    }
+    /**
+     * List members of an organization. Requires the `manage_members` org
+     * permission.
+     *
+     * @param orgId - Numeric org id.
+     * @returns The org's members with their roles.
+     */
+    async members(orgId) {
+        const data = await this.management.request(OrgMembersDocument, { orgId });
+        return data.orgMembers;
+    }
+    /**
+     * List the custom + system roles defined for an organization. Requires the
+     * `manage_members` org permission.
+     *
+     * @param orgId - Numeric org id.
+     * @returns The org's roles.
+     */
+    async roles(orgId) {
+        const data = await this.management.request(OrgRolesDocument, { orgId });
+        return data.orgRoles;
+    }
+    /**
+     * List the roles currently assigned to one organization member. Requires the
+     * `manage_members` org permission.
+     *
+     * @param orgMemberId - Numeric org-member id (`BigInt` as a decimal string).
+     * @returns The member's roles.
+     */
+    async memberRoles(orgMemberId) {
+        const data = await this.management.request(MemberRolesDocument, {
+            orgMemberId,
+        });
+        return data.memberRoles;
+    }
+    /**
+     * List every assignable org permission key with its description. **Public** —
+     * useful for building a role editor UI.
+     *
+     * @returns The catalog of org permissions.
+     */
+    async permissions() {
+        const data = await this.management.request(OrgPermissionsDocument, {});
+        return data.orgPermissions;
+    }
+    /**
+     * List the API tokens issued for an organization (metadata only; the secret
+     * is shown once at creation). Requires the `manage_tokens` org permission.
+     *
+     * @param orgId - Numeric org id.
+     * @returns The org's API tokens.
+     */
+    async tokens(orgId) {
+        const data = await this.management.request(OrgTokensDocument, { orgId });
+        return data.orgTokens;
+    }
+    /**
+     * Create a new organization owned by the authenticated caller. The caller
+     * becomes the owner with full permissions.
+     *
+     * @param input - {@link CreateOrganizationInput}: `name` and a unique `slug`.
+     * @returns The created {@link Organization}.
+     */
+    async create(input) {
+        const data = await this.management.request(CreateOrganizationDocument, {
+            input,
+        });
+        return data.createOrganization;
+    }
+    /**
+     * Set an organization's lifecycle status. **Super-admin only.**
+     *
+     * @param orgId - Numeric org id.
+     * @param status - The new status (e.g. `"active"`, `"suspended"`).
+     * @returns The updated {@link Organization}.
+     */
+    async setStatus(orgId, status) {
+        const data = await this.management.request(SetOrgStatusDocument, {
+            orgId,
+            status,
+        });
+        return data.setOrgStatus;
+    }
+    /**
+     * Mint a new org API token (for server-side studio backends). Requires the
+     * `manage_tokens` org permission. The plaintext secret is returned **once**.
+     *
+     * @param input - {@link CreateOrgTokenInput}: `orgId`, `name`, optional
+     *   `permissions` and `expiresAt`.
+     * @returns The created token including its one-time plaintext secret.
+     */
+    async createToken(input) {
+        const data = await this.management.request(CreateOrgTokenDocument, {
+            input,
+        });
+        return data.createOrgToken;
+    }
+    /**
+     * Update an org token's metadata (name / permissions / expiry). Requires the
+     * `manage_tokens` org permission.
+     *
+     * @param orgTokenId - Numeric token id.
+     * @param input - {@link UpdateOrgTokenInput} fields to change.
+     * @returns The updated token metadata.
+     */
+    async updateToken(orgTokenId, input) {
+        const data = await this.management.request(UpdateOrgTokenDocument, {
+            orgTokenId,
+            input,
+        });
+        return data.updateOrgToken;
+    }
+    /**
+     * Revoke (disable) an org token. Requires the `manage_tokens` org permission.
+     *
+     * @param orgTokenId - Numeric token id.
+     * @returns `true` on success.
+     */
+    async revokeToken(orgTokenId) {
+        const data = await this.management.request(RevokeOrgTokenDocument, {
+            orgTokenId,
+        });
+        return data.revokeOrgToken;
+    }
+    /**
+     * Invite a user to an organization (by email or user id), optionally with
+     * initial roles. Requires the `manage_members` org permission.
+     *
+     * @param input - {@link InviteOrgMemberInput}.
+     * @returns The created membership.
+     */
+    async inviteMember(input) {
+        const data = await this.management.request(InviteOrgMemberDocument, {
+            input,
+        });
+        return data.inviteOrgMember;
+    }
+    /**
+     * Remove a member from an organization. Requires the `manage_members` org
+     * permission.
+     *
+     * @param orgId - Numeric org id.
+     * @param userId - Numeric id of the member to remove.
+     * @returns `true` on success.
+     */
+    async removeMember(orgId, userId) {
+        const data = await this.management.request(RemoveOrgMemberDocument, {
+            orgId,
+            userId,
+        });
+        return data.removeOrgMember;
+    }
+    /**
+     * Replace a member's role assignments. Requires the `manage_members` org
+     * permission.
+     *
+     * @param orgId - Numeric org id.
+     * @param userId - Numeric id of the member.
+     * @param roleIds - The full set of role ids the member should hold.
+     * @returns The updated membership.
+     */
+    async setMemberRoles(orgId, userId, roleIds) {
+        const data = await this.management.request(UpdateOrgMemberRolesDocument, {
+            orgId,
+            userId,
+            roleIds,
+        });
+        return data.updateOrgMemberRoles;
+    }
+    /**
+     * Create a custom org role with a set of permissions. Requires the
+     * `manage_members` org permission.
+     *
+     * @param input - {@link CreateOrgRoleInput}: `orgId`, `roleName`,
+     *   `permissions`.
+     * @returns The created {@link OrgRole}.
+     */
+    async createRole(input) {
+        const data = await this.management.request(CreateOrgRoleDocument, {
+            input,
+        });
+        return data.createOrgRole;
+    }
+    /**
+     * Update a custom org role's name/permissions. Requires the `manage_members`
+     * org permission. System roles cannot be edited.
+     *
+     * @param orgRoleId - Numeric role id.
+     * @param input - {@link UpdateOrgRoleInput} fields to change.
+     * @returns The updated {@link OrgRole}.
+     */
+    async updateRole(orgRoleId, input) {
+        const data = await this.management.request(UpdateOrgRoleDocument, {
+            orgRoleId,
+            input,
+        });
+        return data.updateOrgRole;
+    }
+    /**
+     * Delete a custom org role. Requires the `manage_members` org permission.
+     * System roles cannot be deleted.
+     *
+     * @param orgRoleId - Numeric role id.
+     * @returns `true` on success.
+     */
+    async deleteRole(orgRoleId) {
+        const data = await this.management.request(DeleteOrgRoleDocument, {
+            orgRoleId,
+        });
+        return data.deleteOrgRole;
+    }
+}

package/dist/domains/payments.d.ts

@@ -0,0 +1,104 @@
+import type { GraphQLClient } from '../client.js';
+import { type MyCheckoutsQuery, type MyCheckoutsConnectionQuery, type MyCheckoutsConnectionQueryVariables, type CheckoutsQuery, type CheckoutsConnectionQuery, type CheckoutsConnectionQueryVariables, type CreateCheckoutMutation, type CreateCheckoutInput, type CheckoutFilterInput, type CapturePaypalCheckoutMutation, type PaymentEventsQuery, type PaymentEventsQueryVariables, type PaymentEventsConnectionQuery, type PaymentEventsConnectionQueryVariables } from '../generated/graphql.js';
+/**
+ * Payment checkouts (wallet top-ups, plan purchases) — exposed as
+ * `client.payments` (and grouped under `client.admin`).
+ *
+ * Targets the **management-api**. {@link create} and {@link mine} require an
+ * authenticated caller and act on their own checkouts; {@link all} is
+ * super-admin only. Amounts are minor currency units (`*Cents`).
+ *
+ * Note: {@link create} starts a real payment-provider checkout (Stripe /
+ * PayPal). In tests use sandbox provider keys only — never trigger real
+ * charges.
+ *
+ * @throws {CrowdyGraphQLError} `UNAUTHENTICATED` / `FORBIDDEN` per the notes
+ *   above.
+ */
+export declare class PaymentsAPI {
+    private readonly management;
+    constructor(management: GraphQLClient);
+    /**
+     * Start a checkout (e.g. an `ORG_WALLET_TOPUP`). Requires authentication.
+     *
+     * @param input - {@link CreateCheckoutInput}: purpose, amount, provider, and
+     *   return URLs.
+     * @returns The created checkout including the provider redirect/approval URL.
+     */
+    create(input: CreateCheckoutInput): Promise<CreateCheckoutMutation['createCheckout']>;
+    /**
+     * List the authenticated caller's own checkouts (newest first).
+     *
+     * @param opts - Optional `limit` / `offset` (default limit 50).
+     * @returns The caller's checkouts.
+     */
+    mine(opts?: {
+        limit?: number;
+        offset?: number;
+    }): Promise<MyCheckoutsQuery['myCheckouts']>;
+    /**
+     * List checkouts across all users with an optional filter. **Super-admin
+     * only.**
+     *
+     * @param opts - Optional {@link CheckoutFilterInput} `filter` and `limit` /
+     *   `offset`.
+     * @returns The matching checkouts.
+     */
+    all(opts?: {
+        filter?: CheckoutFilterInput;
+        limit?: number;
+        offset?: number;
+    }): Promise<CheckoutsQuery['checkouts']>;
+    /**
+     * Capture an approved PayPal order, finalizing the checkout it belongs to.
+     * Call this after the buyer approves the PayPal order returned by
+     * {@link create}. Requires authentication.
+     *
+     * Pass `idempotencyKey` to make retries safe: replaying with the same key
+     * returns the first result instead of re-capturing.
+     *
+     * @param orderId - The PayPal order id to capture.
+     * @param idempotencyKey - Optional key for safe retries.
+     * @returns The finalized {@link Checkout}.
+     */
+    capturePaypal(orderId: string, idempotencyKey?: string): Promise<CapturePaypalCheckoutMutation['capturePaypalCheckout']>;
+    /**
+     * Relay-style cursor pagination over the caller's own checkouts — the
+     * preferred alternative to {@link mine}. See
+     * https://docs.crowdedkingdoms.com/overview/pagination.
+     *
+     * @param args - Optional `first` and `after`.
+     * @returns A checkouts connection.
+     */
+    mineConnection(args?: MyCheckoutsConnectionQueryVariables): Promise<MyCheckoutsConnectionQuery['myCheckoutsConnection']>;
+    /**
+     * Relay-style cursor pagination over all checkouts (with optional filter) —
+     * the preferred alternative to {@link all}. **Super-admin only.**
+     *
+     * @param args - Optional `first`, `after`, and {@link CheckoutFilterInput}.
+     * @returns A checkouts connection.
+     */
+    allConnection(args?: CheckoutsConnectionQueryVariables): Promise<CheckoutsConnectionQuery['checkoutsConnection']>;
+    /**
+     * List provider webhook events (offset pagination). **Super-admin only** — an
+     * audit view of received Stripe/PayPal/SES events.
+     *
+     * @param opts - Optional `limit` / `offset`.
+     * @returns A page of {@link PaymentEventRecord}s.
+     * @remarks Prefer {@link eventsConnection} (Relay cursor pagination); the
+     *   offset args here are deprecated server-side.
+     */
+    events(opts?: {
+        limit?: PaymentEventsQueryVariables['limit'];
+        offset?: PaymentEventsQueryVariables['offset'];
+    }): Promise<PaymentEventsQuery['paymentEvents']>;
+    /**
+     * Relay-style cursor pagination over provider webhook events. **Super-admin
+     * only.** See https://docs.crowdedkingdoms.com/overview/pagination.
+     *
+     * @param args - Optional `first` and `after`.
+     * @returns A payment-events connection.
+     */
+    eventsConnection(args?: PaymentEventsConnectionQueryVariables): Promise<PaymentEventsConnectionQuery['paymentEventsConnection']>;
+}
+//# sourceMappingURL=payments.d.ts.map

package/dist/domains/payments.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payments.d.ts","sourceRoot":"","sources":["../../src/domains/payments.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EASL,KAAK,gBAAgB,EACrB,KAAK,0BAA0B,EAC/B,KAAK,mCAAmC,EACxC,KAAK,cAAc,EACnB,KAAK,wBAAwB,EAC7B,KAAK,iCAAiC,EACtC,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,6BAA6B,EAClC,KAAK,kBAAkB,EACvB,KAAK,2BAA2B,EAChC,KAAK,4BAA4B,EACjC,KAAK,qCAAqC,EAC3C,MAAM,yBAAyB,CAAC;AAEjC;;;;;;;;;;;;;;GAcG;AACH,qBAAa,WAAW;IACV,OAAO,CAAC,QAAQ,CAAC,UAAU;gBAAV,UAAU,EAAE,aAAa;IAEtD;;;;;;OAMG;IACG,MAAM,CACV,KAAK,EAAE,mBAAmB,GACzB,OAAO,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,CAAC;IAOpD;;;;;OAKG;IACG,IAAI,CACR,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO,GAC7C,OAAO,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;IAQ3C;;;;;;;OAOG;IACG,GAAG,CACP,IAAI,GAAE;QACJ,MAAM,CAAC,EAAE,mBAAmB,CAAC;QAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;KACZ,GACL,OAAO,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;IASvC;;;;;;;;;;;OAWG;IACG,aAAa,CACjB,OAAO,EAAE,MAAM,EACf,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,6BAA6B,CAAC,uBAAuB,CAAC,CAAC;IAQlE;;;;;;;OAOG;IACG,cAAc,CAClB,IAAI,GAAE,mCAAwC,GAC7C,OAAO,CAAC,0BAA0B,CAAC,uBAAuB,CAAC,CAAC;IAQ/D;;;;;;OAMG;IACG,aAAa,CACjB,IAAI,GAAE,iCAAsC,GAC3C,OAAO,CAAC,wBAAwB,CAAC,qBAAqB,CAAC,CAAC;IAQ3D;;;;;;;;OAQG;IACG,MAAM,CACV,IAAI,GAAE;QACJ,KAAK,CAAC,EAAE,2BAA2B,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,CAAC,EAAE,2BAA2B,CAAC,QAAQ,CAAC,CAAC;KAC3C,GACL,OAAO,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAC;IAK/C;;;;;;OAMG;IACG,gBAAgB,CACpB,IAAI,GAAE,qCAA0C,GAC/C,OAAO,CAAC,4BAA4B,CAAC,yBAAyB,CAAC,CAAC;CAOpE"}