@crowdedkingdoms/crowdyjs 15.0.0 → 15.1.0-test.1

package/MIGRATION.md

@@ -1,3 +1,68 @@
+# CrowdyJS v15.1 — password management (additive)
+
+**Nothing breaks.** Four mutations the API has served all along are now wrapped,
+so a game shipping this SDK has a first-class way to let a player set or change
+a password:
+
+| Method | Requires | For |
+|---|---|---|
+| `auth.requestPasswordReset(email)` | nothing | "I forgot my password" |
+| `auth.resetPassword({ token, newPassword })` | the emailed token | completing that |
+| `auth.changePassword({ currentPassword, newPassword })` | a session **and** the current password | an ordinary change |
+| `auth.setInitialPassword(newPassword)` | a session, and the account must have **no** password | adding a first password |
+
+**Why four and not one.** Each is defined by what the caller has already
+*proven* — an emailed token, the current password, or the session — and
+collapsing any pair deletes the proof. In particular `setInitialPassword` is not
+`changePassword` with the check removed: it **refuses** when a password already
+exists, and that refusal is what stops a stolen session from replacing a
+credential the owner still knows. Route on the refusal instead of retrying.
+
+**`setInitialPassword` emails a security notification to the account address**
+on success, and that is deliberately the mitigation rather than a refusal: a
+stolen session can already attach durable attacker-controlled access through
+`linkIdentity`, so refusing here would close nothing and would leave the
+legitimate user of a magic-link or social-only account with no door at all. If
+you build UI for this, tell the user the email is coming.
+
+**Three new error predicates**, because the three refusals need different
+handling and a caller should not have to work out which is which:
+
+- `isPasswordAlreadySetError(e)` — `setInitialPassword` refused; use
+  `changePassword`.
+- `isNoPasswordSetError(e)` — `changePassword` refused because there is none;
+  use `setInitialPassword`.
+- `isInvalidCurrentPasswordError(e)` — the current password is wrong; ask again.
+
+**Use these rather than reading `extensions.code` yourself, and the reason is
+worth knowing.** Each refusal has its own code — `PASSWORD_ALREADY_SET`,
+`PASSWORD_NOT_SET`, `INVALID_CURRENT_PASSWORD` — only from **ck-api v1.60.0**.
+Before that release the first two shared `UNAUTHENTICATED` with a genuinely
+expired session and the third arrived as `INTERNAL_SERVER_ERROR`, so a caller
+keying on the code signed the user out over a typo. Each predicate accepts the
+new code **and** the older wording, so one pinned build works against a tier on
+either side of that line. `isAlreadyRegisteredError` gained the same treatment
+(`EMAIL_ALREADY_REGISTERED`).
+
+None of the three means the session is gone. Sign a user out on
+`UNAUTHENTICATED`, which from v1.60.0 says only that.
+
+```ts
+try {
+  await client.auth.setInitialPassword(pw);
+} catch (e) {
+  if (isPasswordAlreadySetError(e)) {
+    // They have one already — ask for it rather than replacing it blind.
+    await client.auth.changePassword({ currentPassword: current, newPassword: pw });
+  } else throw e;
+}
+```
+
+`resetPassword` and `changePassword` do **not** revoke existing sessions. Follow
+either with `auth.logoutAllDevices()` if that is the intent.
+
+---
+
 # CrowdyJS v15 — the dev auth bypass is gone (breaking)
 
 `client.auth.devLogin()` is **removed**, and so is the `devToken` field on
@@ -37,8 +102,9 @@ login, and two error predicates, because these two conditions are **not**
 distinguishable by GraphQL error code:
 
 - `isAlreadyRegisteredError(e)` — `register` refused because the address already
-  has an account. The server raises a `ConflictException` and it arrives as
-  `INTERNAL_SERVER_ERROR`, so a caller keying on `CONFLICT` matches nothing.
+  has an account. It carries `EMAIL_ALREADY_REGISTERED` from ck-api v1.60.0;
+  before that it arrived as `INTERNAL_SERVER_ERROR`, so a caller keying on
+  `CONFLICT` matched nothing. The predicate accepts both.
 - `isPasswordUnconfirmedError(e)` — `login` refused because the password is real
   but unconfirmed on an account with another verified sign-in method. The remedy
   is the emailed link, not a different password.
@@ -523,8 +589,16 @@ validation error; every other sub-client is unaffected.
 
 # CrowdyJS v8 — Passwordless & federated sign-in (BREAKING)
 
-**Crowded Kingdoms is passwordless.** Email + password login is removed. Update
-your sign-in flow to one of:
+> **SUPERSEDED BY 15.0.0 — do not follow this section as current product.**
+> Email + password sign-in came BACK in 15.0.0: `auth.login` and
+> `auth.register` exist, and the `devLogin` bypass was removed from every tier
+> on 2026-08-20. What is still true from v8 is that magic link and social
+> sign-in are supported; what is false is that they are the ONLY options.
+> This section is kept as the record of the v8 break. See the 15.0.0 notes at
+> the top of this file.
+
+**At v8, Crowded Kingdoms was passwordless.** Email + password login was removed
+in that version. The v8 migration was to one of:
 
 - **Magic link (email):**
   ```ts

package/README.md

@@ -1,7 +1,7 @@
 # CrowdyJS
 
 The official browser-first TypeScript SDK for **Crowded Kingdoms**. CrowdyJS
-gives you typed clients for the whole platform: passwordless identity and
+gives you typed clients for the whole platform: identity and
 studio administration (the Management surface), world data and the abstract
 game model (the Game surface), and the UDP proxy realtime stream — all over
 one unified GraphQL API.
@@ -76,7 +76,7 @@ app and drive the world/UDP surface from a per-game client — see
 
 ## Authentication: session token vs app-scoped tokens
 
-Passwordless sign-in returns an **identity session token** good for account,
+Sign-in returns an **identity session token** good for account,
 studio admin and token minting, and **rejected for gameplay**. Each game is
 entered with a short-lived **app-scoped token** confined to that one app, so a
 game stack never receives the player's full session.
@@ -91,7 +91,8 @@ const overworld = createCrowdyClient({
   httpUrl: apiUrl,
   tokenStore: new BrowserLocalStorageTokenStore('crowdyjs:session'),
 });
-// Passwordless sign-in (magic link, social/OIDC, or dev bypass) yields the session token.
+// Sign-in (email + password via auth.login / auth.register, magic link, or social/OIDC)
+// yields the session token. There is no dev bypass: devLogin was removed in 15.0.0.
 await overworld.auth.requestLoginLink({ email, redirectUri });
 await overworld.auth.completeLoginLink(tokenFromLink);
 
@@ -139,7 +140,7 @@ Notes:
   restoring auth from a non-default storage).
 
 Deeper reading: [Portals & app-scoped tokens](https://docs.crowdedkingdoms.com/management-api/portals-and-app-tokens)
-and [Sign in (passwordless)](https://docs.crowdedkingdoms.com/management-api/authentication).
+and [Sign in](https://docs.crowdedkingdoms.com/management-api/authentication).
 
 ### Token refresh during gameplay
 
@@ -156,7 +157,7 @@ lifecycle to preserve.
 
 ## Game-loop lifecycle
 
-1. Sign in (passwordless) on the identity client with `client.auth`, or
+1. Sign in on the identity client with `client.auth` (`login` / `register`), or
    restore a stored session with `client.session.restore()`. This yields the
    **session token**, which gameplay rejects.
 2. Mint an **app-scoped token** for the app (`identity.portal.mintAppToken(appId)`,
@@ -178,7 +179,7 @@ lifecycle to preserve.
 
 | Sub-client | What it does |
 |---|---|
-| `client.auth` | Passwordless sign-in (magic link, social/OIDC, dev bypass), log out, and linked identities (`myIdentities`, `linkIdentity`/`unlinkIdentity`). |
+| `client.auth` | Sign-in: `login` / `register` (email + password), magic link, social/OIDC. Passwords: `requestPasswordReset` / `resetPassword`, `changePassword`, and `setInitialPassword` for an account created by magic link or a social provider (added in 15.1.0). Log out, and linked identities (`myIdentities`, `linkIdentity`/`unlinkIdentity`). **No dev bypass** — `devLogin` was removed in 15.0.0 and `DEV_AUTH_BYPASS` is gone from every tier. |
 | `client.users` | `me`, `updateGamertag`, profile reads. |
 | `client.session` | Token store, `restore()`, `getToken()`, manual `setToken()`. |
 | `client.portal` | App-scoped token minting (`mintAppToken`) and the cross-origin PKCE entry flow (`beginEntry` / `handleAuthorizeRequest` / `completeEntry` / `refresh`). |

package/dist/domains/auth.d.ts

@@ -14,15 +14,27 @@ import type { AuthState } from '../auth-state.js';
  * `register` have been first-class in the API throughout, and the C++ load
  * tester has used them all along. Only this SDK pretended otherwise, and the
  * gap sent integrators to the dev bypass — which no longer exists on any tier.
+ * The same gap ran one method deeper until 2026-08-21: password MANAGEMENT
+ * (reset, change, and adding a first password) was served by the API and
+ * wrapped here by nothing, so a game shipping this SDK had no first-class way
+ * to let a player set or change a password.
  *
  * Part of the management surface.
  *
  * **Public (no session):** {@link register}, {@link login},
  * {@link requestLoginLink}, {@link completeLoginLink}, {@link socialLoginStart},
  * {@link socialLoginComplete}, {@link availableLoginProviders},
- * {@link checkAuthMethod}. **Require a session:** {@link logout},
- * {@link logoutAllDevices}, {@link myIdentities}, {@link linkIdentity},
- * {@link unlinkIdentity}.
+ * {@link checkAuthMethod}, {@link requestPasswordReset}, {@link resetPassword}.
+ * **Require a session:** {@link logout}, {@link logoutAllDevices},
+ * {@link myIdentities}, {@link linkIdentity}, {@link unlinkIdentity},
+ * {@link changePassword}, {@link setInitialPassword}.
+ *
+ * **Which password method:** the four are distinguished by what the caller has
+ * already proven, not by what they want to do. Signed in with a password →
+ * {@link changePassword}. Signed in with none → {@link setInitialPassword}.
+ * Not signed in, or signed in and cannot remember it →
+ * {@link requestPasswordReset} then {@link resetPassword}.
+ * {@link checkAuthMethod} answers `hasPassword` for an address before sign-in.
  */
 export interface AuthUser {
     userId: string;
@@ -47,11 +59,16 @@ export interface UserIdentity {
 /**
  * `register` refused because the address already has an account.
  *
- * Matched on WORDING rather than on an error code, which looks fragile and is
- * the only thing that works: the server raises a Nest `ConflictException` and it
- * arrives over GraphQL as `INTERNAL_SERVER_ERROR` — verified against a live
- * tier — so a caller keying on `CONFLICT` matches nothing and treats a routine
- * "this account exists" as a server fault.
+ * `EMAIL_ALREADY_REGISTERED` from v1.60.0. Before that it arrived as
+ * `INTERNAL_SERVER_ERROR`, so a caller keying on the code matched nothing and
+ * treated a routine "this account exists" as a server fault; the wording branch
+ * is what still works against those tiers.
+ *
+ * Note what this does NOT accept: a bare `CONFLICT`. From v1.60.0 that is the
+ * code a generic 409 carries, and a generic code cannot identify a specific
+ * condition — a predicate that accepted it would report any future conflict in
+ * this mutation as "already registered". Only a code minted for this outcome
+ * will do.
  */
 export declare function isAlreadyRegisteredError(error: unknown): boolean;
 /**
@@ -59,8 +76,55 @@ export declare function isAlreadyRegisteredError(error: unknown): boolean;
  * account that has another verified sign-in method. The remedy is the emailed
  * confirmation link, not a different password — so this must not be reported to
  * the user as "wrong password".
+ *
+ * **The one refusal here with no code of its own, and the only wording-only
+ * predicate left.** ck-api v1.60.0 gave the other four a dedicated
+ * `extensions.code`; this one is still a plain `UnauthorizedException`, so it
+ * arrives as `UNAUTHENTICATED` — the same code as an expired session, whose
+ * remedy (sign in again) is the opposite of this one's. The message is
+ * therefore the only discriminator, and the absence of a `codeOf` branch below
+ * is deliberate rather than an oversight: there is no code to read.
  */
 export declare function isPasswordUnconfirmedError(error: unknown): boolean;
+/**
+ * {@link setInitialPassword} refused because the account already has a
+ * password. The remedy is {@link changePassword}, which verifies the current
+ * one.
+ *
+ * The refusal is deliberate and load-bearing: without it, `setInitialPassword`
+ * would be `changePassword` with the current-password check deleted, which is
+ * the check that stops a stolen session from silently locking the owner out.
+ * So a caller must route to `changePassword` rather than retrying.
+ *
+ * `PASSWORD_ALREADY_SET` from ck-api v1.60.0. Before that the schema said this
+ * "throws CONFLICT" and it reached clients as `INTERNAL_SERVER_ERROR`, so the
+ * message was the only thing to match — which is why the wording branch is
+ * still here.
+ */
+export declare function isPasswordAlreadySetError(error: unknown): boolean;
+/**
+ * {@link changePassword} refused because there is no password to change — a
+ * magic-link or social-only account. The remedy is {@link setInitialPassword}
+ * while signed in, or {@link requestPasswordReset}.
+ *
+ * `PASSWORD_NOT_SET` from ck-api v1.60.0. Before that this and
+ * {@link isInvalidCurrentPasswordError} both arrived as `UNAUTHENTICATED`,
+ * which is ALSO what an expired session looks like — so a caller keying on the
+ * code signed the user out when they had merely typed the wrong current
+ * password, or offered a password field on an account that has none. That is
+ * the defect the new codes exist to remove, and the wording branch is what
+ * still separates them on a tier that has not deployed it.
+ */
+export declare function isNoPasswordSetError(error: unknown): boolean;
+/**
+ * {@link changePassword} refused because the current password is wrong. The
+ * remedy is to ask again — the session is fine.
+ *
+ * `INVALID_CURRENT_PASSWORD` (HTTP 403) from ck-api v1.60.0. See
+ * {@link isNoPasswordSetError} for what it used to be and why the wording
+ * branch stays.
+ */
+export declare function isInvalidCurrentPasswordError(error: unknown): boolean;
 export declare class AuthAPI {
     private readonly graphql;
     private readonly session;
@@ -131,6 +195,84 @@ export declare class AuthAPI {
     checkAuthMethod(email: string): Promise<{
         hasPassword: boolean;
     }>;
+    /**
+     * Email a password-reset link to the address. Public.
+     *
+     * Always resolves `true` whether or not the address has an account, so it
+     * cannot be used to enumerate users — which also means a `true` here is not
+     * evidence an email was sent.
+     *
+     * This is the ownership-proven way to add a password to an account that has
+     * none, and the only one for a user who is not signed in. A user who IS
+     * signed in should use {@link setInitialPassword} instead and skip the inbox.
+     */
+    requestPasswordReset(email: string): Promise<boolean>;
+    /**
+     * Complete a password reset with the token from the emailed link. Public —
+     * the token is the authorization.
+     *
+     * Throws if the token is invalid or expired. **Existing sessions are not
+     * revoked**, so a reset does not by itself evict anyone already signed in;
+     * follow it with {@link logoutAllDevices} if that is what you want.
+     */
+    resetPassword(input: {
+        token: string;
+        newPassword: string;
+    }): Promise<boolean>;
+    /**
+     * Change the signed-in user's password, verifying the current one. Requires a
+     * session.
+     *
+     * **This is not the method for an account that has no password** — a
+     * magic-link or social-only account, which cannot supply a current one. That
+     * is {@link setInitialPassword}, and the two are kept apart deliberately:
+     * the current-password check here is what stops a stolen session from
+     * changing a credential the owner still knows.
+     *
+     * Three outcomes need telling apart and the error CODE cannot do it, because
+     * a wrong current password, an account with no password, and an expired
+     * session all arrive as `UNAUTHENTICATED`:
+     * {@link isInvalidCurrentPasswordError} (ask again),
+     * {@link isNoPasswordSetError} (send them to `setInitialPassword`), and
+     * neither (the session is gone — sign in again).
+     *
+     * **Existing sessions are not revoked.**
+     */
+    changePassword(input: {
+        currentPassword: string;
+        newPassword: string;
+    }): Promise<boolean>;
+    /**
+     * Add a password to the signed-in account when it does not have one yet.
+     * Requires a session.
+     *
+     * For an account created by magic link or a social provider, which until this
+     * existed had no in-product route to password sign-in at all — the only door
+     * was {@link requestPasswordReset}, an email round trip to add a credential to
+     * an account you are already signed in to. The session is the proof of account
+     * control, so **the password works immediately**: there is no confirmation
+     * email to wait for, and the password identity is written verified (an
+     * unverified one would be refused by {@link login} while another verified
+     * method exists, which is a dead end that looks like success).
+     *
+     * **Refuses when a password already exists** — {@link isPasswordAlreadySetError}
+     * detects it — rather than replacing it. Without that refusal this would be
+     * {@link changePassword} with the current-password check deleted. Route to
+     * `changePassword`, or to `requestPasswordReset` if the user has forgotten it.
+     *
+     * **A security notification is emailed to the account address** whenever this
+     * succeeds. That is the mitigation, and it is deliberately a notification
+     * rather than a refusal: a stolen session can already attach durable
+     * attacker-controlled access via {@link linkIdentity}, so refusing here would
+     * remove the legitimate user's only door without closing the class. Do not
+     * suppress or reword that email's role when you describe this to a user —
+     * "we have emailed you about this change" is part of the feature. The
+     * notification is best-effort on the server, so a `true` return is not proof
+     * the email was delivered.
+     *
+     * **Existing sessions are not revoked.**
+     */
+    setInitialPassword(newPassword: string): Promise<boolean>;
     /** The signed-in user's linked sign-in identities. Requires a session. */
     myIdentities(): Promise<UserIdentity[]>;
     /** Link an additional federated identity (from a social callback). */

package/dist/domains/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/domains/auth.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAGlD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,YAAY;IAC3B,yEAAyE;IACzE,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,QAAQ,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,aAAa,EAAE,OAAO,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAGhE;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAGlE;AAsFD,qBAAa,OAAO;IAEhB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBADP,OAAO,EAAE,aAAa,EACtB,OAAO,EAAE,SAAS;IAGrC,6EAA6E;IACvE,uBAAuB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAKlD;;;;;;;OAOG;IACG,gBAAgB,CAAC,KAAK,EAAE;QAC5B,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC;IAK9B,0EAA0E;IACpE,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAS7D;;;OAGG;IACG,gBAAgB,CACpB,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAOnD,iFAAiF;IAC3E,mBAAmB,CAAC,KAAK,EAAE;QAC/B,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;KACf,GAAG,OAAO,CAAC,YAAY,CAAC;IASzB;;;;;;;OAOG;IACG,KAAK,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,CAAC;IAQ9E;;;;;;;;;OASG;IACG,QAAQ,CAAC,KAAK,EAAE;QACpB,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,OAAO,CAAC,YAAY,CAAC;IAQzB;;;OAGG;IACG,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,WAAW,EAAE,OAAO,CAAA;KAAE,CAAC;IAOvE,0EAA0E;IACpE,YAAY,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;IAK7C,sEAAsE;IAChE,YAAY,CAAC,KAAK,EAAE;QACxB,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;KACf,GAAG,OAAO,CAAC,YAAY,CAAC;IAKzB,2EAA2E;IACrE,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAO1D,mEAAmE;IAC7D,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC;IAMhC,oEAAoE;IAC9D,gBAAgB,IAAI,OAAO,CAAC,OAAO,CAAC;IAK1C,oEAAoE;IACpE,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAIpC,+CAA+C;IAC/C,QAAQ,IAAI,MAAM,GAAG,IAAI;CAG1B"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/domains/auth.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAGlD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,YAAY;IAC3B,yEAAyE;IACzE,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,QAAQ,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,aAAa,EAAE,OAAO,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAkCD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAKhE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAGlE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAKjE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAK5D;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAKrE;AAwHD,qBAAa,OAAO;IAEhB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBADP,OAAO,EAAE,aAAa,EACtB,OAAO,EAAE,SAAS;IAGrC,6EAA6E;IACvE,uBAAuB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAKlD;;;;;;;OAOG;IACG,gBAAgB,CAAC,KAAK,EAAE;QAC5B,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC;IAK9B,0EAA0E;IACpE,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAS7D;;;OAGG;IACG,gBAAgB,CACpB,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAOnD,iFAAiF;IAC3E,mBAAmB,CAAC,KAAK,EAAE;QAC/B,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;KACf,GAAG,OAAO,CAAC,YAAY,CAAC;IASzB;;;;;;;OAOG;IACG,KAAK,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,CAAC;IAQ9E;;;;;;;;;OASG;IACG,QAAQ,CAAC,KAAK,EAAE;QACpB,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,OAAO,CAAC,YAAY,CAAC;IAQzB;;;OAGG;IACG,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,WAAW,EAAE,OAAO,CAAA;KAAE,CAAC;IAOvE;;;;;;;;;;OAUG;IACG,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAO3D;;;;;;;OAOG;IACG,aAAa,CAAC,KAAK,EAAE;QACzB,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,EAAE,MAAM,CAAC;KACrB,GAAG,OAAO,CAAC,OAAO,CAAC;IAOpB;;;;;;;;;;;;;;;;;;OAkBG;IACG,cAAc,CAAC,KAAK,EAAE;QAC1B,eAAe,EAAE,MAAM,CAAC;QACxB,WAAW,EAAE,MAAM,CAAC;KACrB,GAAG,OAAO,CAAC,OAAO,CAAC;IAKpB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACG,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAO/D,0EAA0E;IACpE,YAAY,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;IAK7C,sEAAsE;IAChE,YAAY,CAAC,KAAK,EAAE;QACxB,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;KACf,GAAG,OAAO,CAAC,YAAY,CAAC;IAKzB,2EAA2E;IACrE,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAO1D,mEAAmE;IAC7D,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC;IAMhC,oEAAoE;IAC9D,gBAAgB,IAAI,OAAO,CAAC,OAAO,CAAC;IAK1C,oEAAoE;IACpE,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAIpC,+CAA+C;IAC/C,QAAQ,IAAI,MAAM,GAAG,IAAI;CAG1B"}

package/dist/domains/auth.js

@@ -1,28 +1,117 @@
 import { parse } from 'graphql';
 import { LogoutAllDevicesDocument, LogoutDocument } from '../generated/graphql.js';
+/**
+ * The `extensions.code` of the first GraphQL error, if there is one.
+ *
+ * Every predicate below asks the CODE first and the wording second, and the
+ * order is not a style choice. ck-api v1.60.0 fixed a mapping defect that made
+ * these codes unusable: `@nestjs/apollo` translates four HTTP statuses and
+ * collapses the rest, so a 409 arrived as `INTERNAL_SERVER_ERROR` and both of
+ * `changePassword`'s refusals arrived as `UNAUTHENTICATED` — the same code an
+ * expired session produces. The wording fallback is therefore not legacy
+ * clutter: a tier that has not deployed v1.60.0 still answers the old way, and
+ * a game pinning this SDK exactly may meet either. Delete it when no tier
+ * predates v1.60.0, and not before.
+ */
+/**
+ * `extensions.code` off anything error-shaped, whether it is a
+ * {@link CrowdyGraphQLError}, one raw GraphQL error entry, or the `code` getter
+ * the former lifts to the top level — all three reach a caller here, depending
+ * on whether the error was rethrown or destructured on the way.
+ */
+function codeOf(error) {
+    const shape = error;
+    if (typeof shape?.extensions?.code === 'string')
+        return shape.extensions.code;
+    return typeof shape?.code === 'string' ? shape.code : undefined;
+}
+function messageOf(error) {
+    return error instanceof Error ? error.message : String(error);
+}
 /**
  * `register` refused because the address already has an account.
  *
- * Matched on WORDING rather than on an error code, which looks fragile and is
- * the only thing that works: the server raises a Nest `ConflictException` and it
- * arrives over GraphQL as `INTERNAL_SERVER_ERROR` — verified against a live
- * tier — so a caller keying on `CONFLICT` matches nothing and treats a routine
- * "this account exists" as a server fault.
+ * `EMAIL_ALREADY_REGISTERED` from v1.60.0. Before that it arrived as
+ * `INTERNAL_SERVER_ERROR`, so a caller keying on the code matched nothing and
+ * treated a routine "this account exists" as a server fault; the wording branch
+ * is what still works against those tiers.
+ *
+ * Note what this does NOT accept: a bare `CONFLICT`. From v1.60.0 that is the
+ * code a generic 409 carries, and a generic code cannot identify a specific
+ * condition — a predicate that accepted it would report any future conflict in
+ * this mutation as "already registered". Only a code minted for this outcome
+ * will do.
  */
 export function isAlreadyRegisteredError(error) {
-    const message = error instanceof Error ? error.message : String(error);
-    return /account with this email already exists/i.test(message);
+    return (codeOf(error) === 'EMAIL_ALREADY_REGISTERED' ||
+        /account with this email already exists/i.test(messageOf(error)));
 }
 /**
  * `login` refused because the password is real but not yet confirmed, on an
  * account that has another verified sign-in method. The remedy is the emailed
  * confirmation link, not a different password — so this must not be reported to
  * the user as "wrong password".
+ *
+ * **The one refusal here with no code of its own, and the only wording-only
+ * predicate left.** ck-api v1.60.0 gave the other four a dedicated
+ * `extensions.code`; this one is still a plain `UnauthorizedException`, so it
+ * arrives as `UNAUTHENTICATED` — the same code as an expired session, whose
+ * remedy (sign in again) is the opposite of this one's. The message is
+ * therefore the only discriminator, and the absence of a `codeOf` branch below
+ * is deliberate rather than an oversight: there is no code to read.
  */
 export function isPasswordUnconfirmedError(error) {
     const message = error instanceof Error ? error.message : String(error);
     return /confirm your email to enable password sign-in/i.test(message);
 }
+/**
+ * {@link setInitialPassword} refused because the account already has a
+ * password. The remedy is {@link changePassword}, which verifies the current
+ * one.
+ *
+ * The refusal is deliberate and load-bearing: without it, `setInitialPassword`
+ * would be `changePassword` with the current-password check deleted, which is
+ * the check that stops a stolen session from silently locking the owner out.
+ * So a caller must route to `changePassword` rather than retrying.
+ *
+ * `PASSWORD_ALREADY_SET` from ck-api v1.60.0. Before that the schema said this
+ * "throws CONFLICT" and it reached clients as `INTERNAL_SERVER_ERROR`, so the
+ * message was the only thing to match — which is why the wording branch is
+ * still here.
+ */
+export function isPasswordAlreadySetError(error) {
+    return (codeOf(error) === 'PASSWORD_ALREADY_SET' ||
+        /this account already has a password/i.test(messageOf(error)));
+}
+/**
+ * {@link changePassword} refused because there is no password to change — a
+ * magic-link or social-only account. The remedy is {@link setInitialPassword}
+ * while signed in, or {@link requestPasswordReset}.
+ *
+ * `PASSWORD_NOT_SET` from ck-api v1.60.0. Before that this and
+ * {@link isInvalidCurrentPasswordError} both arrived as `UNAUTHENTICATED`,
+ * which is ALSO what an expired session looks like — so a caller keying on the
+ * code signed the user out when they had merely typed the wrong current
+ * password, or offered a password field on an account that has none. That is
+ * the defect the new codes exist to remove, and the wording branch is what
+ * still separates them on a tier that has not deployed it.
+ */
+export function isNoPasswordSetError(error) {
+    return (codeOf(error) === 'PASSWORD_NOT_SET' ||
+        /no password is set on this account/i.test(messageOf(error)));
+}
+/**
+ * {@link changePassword} refused because the current password is wrong. The
+ * remedy is to ask again — the session is fine.
+ *
+ * `INVALID_CURRENT_PASSWORD` (HTTP 403) from ck-api v1.60.0. See
+ * {@link isNoPasswordSetError} for what it used to be and why the wording
+ * branch stays.
+ */
+export function isInvalidCurrentPasswordError(error) {
+    return (codeOf(error) === 'INVALID_CURRENT_PASSWORD' ||
+        /invalid current password/i.test(messageOf(error)));
+}
 const AUTH_RESPONSE_FIELDS = 'token gameTokenId user { userId email gamertag }';
 const IDENTITY_FIELDS = 'identityId provider subject email emailVerified createdAt lastLoginAt';
 // `devToken` is NOT selected. The field returned the magic-link token in
@@ -40,6 +129,22 @@ const SocialLoginCompleteDocument = parse(`mutation SocialLoginComplete($input:
 // naming a field the caller never wrote.
 const LoginDocument = parse(`mutation Login($loginUserInput: LoginUserInput!) { login(loginUserInput: $loginUserInput) { ${AUTH_RESPONSE_FIELDS} } }`);
 const RegisterDocument = parse(`mutation Register($registerUserInput: RegisterUserInput!) { register(registerUserInput: $registerUserInput) { ${AUTH_RESPONSE_FIELDS} } }`);
+// PASSWORD MANAGEMENT. Four mutations, and they are four rather than one or two
+// on purpose: each is defined by what the CALLER has already proven, and
+// collapsing any pair would delete the proof.
+//
+//   requestPasswordReset / resetPassword  proof = the emailed token
+//   changePassword                        proof = the current password
+//   setInitialPassword                    proof = the session, and there is no
+//                                                 password to verify
+//
+// `changePassword` takes its two arguments FLAT rather than in an input object,
+// and `resetPassword` takes `resetPasswordInput` rather than `input`. Both are
+// the server's spelling; see the note above `LoginDocument`.
+const RequestPasswordResetDocument = parse(`mutation RequestPasswordReset($email: String!) { requestPasswordReset(email: $email) }`);
+const ResetPasswordDocument = parse(`mutation ResetPassword($resetPasswordInput: ResetPasswordInput!) { resetPassword(resetPasswordInput: $resetPasswordInput) }`);
+const ChangePasswordDocument = parse(`mutation ChangePassword($currentPassword: String!, $newPassword: String!) { changePassword(currentPassword: $currentPassword, newPassword: $newPassword) }`);
+const SetInitialPasswordDocument = parse(`mutation SetInitialPassword($newPassword: String!) { setInitialPassword(newPassword: $newPassword) }`);
 const CheckAuthMethodDocument = parse(`query CheckAuthMethod($input: CheckAuthMethodInput!) { checkAuthMethod(input: $input) { hasPassword } }`);
 const AvailableLoginProvidersDocument = parse(`query AvailableLoginProviders { availableLoginProviders }`);
 const MyIdentitiesDocument = parse(`query MyIdentities { myIdentities { ${IDENTITY_FIELDS} } }`);
@@ -139,6 +244,96 @@ export class AuthAPI {
         });
         return data.checkAuthMethod;
     }
+    /**
+     * Email a password-reset link to the address. Public.
+     *
+     * Always resolves `true` whether or not the address has an account, so it
+     * cannot be used to enumerate users — which also means a `true` here is not
+     * evidence an email was sent.
+     *
+     * This is the ownership-proven way to add a password to an account that has
+     * none, and the only one for a user who is not signed in. A user who IS
+     * signed in should use {@link setInitialPassword} instead and skip the inbox.
+     */
+    async requestPasswordReset(email) {
+        const data = await this.graphql.request(RequestPasswordResetDocument, {
+            email,
+        });
+        return data.requestPasswordReset;
+    }
+    /**
+     * Complete a password reset with the token from the emailed link. Public —
+     * the token is the authorization.
+     *
+     * Throws if the token is invalid or expired. **Existing sessions are not
+     * revoked**, so a reset does not by itself evict anyone already signed in;
+     * follow it with {@link logoutAllDevices} if that is what you want.
+     */
+    async resetPassword(input) {
+        const data = await this.graphql.request(ResetPasswordDocument, {
+            resetPasswordInput: input,
+        });
+        return data.resetPassword;
+    }
+    /**
+     * Change the signed-in user's password, verifying the current one. Requires a
+     * session.
+     *
+     * **This is not the method for an account that has no password** — a
+     * magic-link or social-only account, which cannot supply a current one. That
+     * is {@link setInitialPassword}, and the two are kept apart deliberately:
+     * the current-password check here is what stops a stolen session from
+     * changing a credential the owner still knows.
+     *
+     * Three outcomes need telling apart and the error CODE cannot do it, because
+     * a wrong current password, an account with no password, and an expired
+     * session all arrive as `UNAUTHENTICATED`:
+     * {@link isInvalidCurrentPasswordError} (ask again),
+     * {@link isNoPasswordSetError} (send them to `setInitialPassword`), and
+     * neither (the session is gone — sign in again).
+     *
+     * **Existing sessions are not revoked.**
+     */
+    async changePassword(input) {
+        const data = await this.graphql.request(ChangePasswordDocument, input);
+        return data.changePassword;
+    }
+    /**
+     * Add a password to the signed-in account when it does not have one yet.
+     * Requires a session.
+     *
+     * For an account created by magic link or a social provider, which until this
+     * existed had no in-product route to password sign-in at all — the only door
+     * was {@link requestPasswordReset}, an email round trip to add a credential to
+     * an account you are already signed in to. The session is the proof of account
+     * control, so **the password works immediately**: there is no confirmation
+     * email to wait for, and the password identity is written verified (an
+     * unverified one would be refused by {@link login} while another verified
+     * method exists, which is a dead end that looks like success).
+     *
+     * **Refuses when a password already exists** — {@link isPasswordAlreadySetError}
+     * detects it — rather than replacing it. Without that refusal this would be
+     * {@link changePassword} with the current-password check deleted. Route to
+     * `changePassword`, or to `requestPasswordReset` if the user has forgotten it.
+     *
+     * **A security notification is emailed to the account address** whenever this
+     * succeeds. That is the mitigation, and it is deliberately a notification
+     * rather than a refusal: a stolen session can already attach durable
+     * attacker-controlled access via {@link linkIdentity}, so refusing here would
+     * remove the legitimate user's only door without closing the class. Do not
+     * suppress or reword that email's role when you describe this to a user —
+     * "we have emailed you about this change" is part of the feature. The
+     * notification is best-effort on the server, so a `true` return is not proof
+     * the email was delivered.
+     *
+     * **Existing sessions are not revoked.**
+     */
+    async setInitialPassword(newPassword) {
+        const data = await this.graphql.request(SetInitialPasswordDocument, {
+            newPassword,
+        });
+        return data.setInitialPassword;
+    }
     /** The signed-in user's linked sign-in identities. Requires a session. */
     async myIdentities() {
         const data = await this.graphql.request(MyIdentitiesDocument);

package/dist/domains/crowdyStudio.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"crowdyStudio.d.ts","sourceRoot":"","sources":["../../src/domains/crowdyStudio.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAQlD,OAAO,EAIL,KAAK,8BAA8B,EACnC,KAAK,oCAAoC,EAEzC,KAAK,mBAAmB,EAExB,KAAK,2BAA2B,EAChC,KAAK,wBAAwB,EAC7B,KAAK,0BAA0B,EAC/B,KAAK,yBAAyB,EAC9B,KAAK,gCAAgC,EACrC,KAAK,4BAA4B,EAClC,MAAM,4BAA4B,CAAC;AA0BpC;;;;;;GAMG;AACH,qBAAa,eAAgB,YAAW,2BAA2B;IAGrD,OAAO,CAAC,QAAQ,CAAC,OAAO;IAFpC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA0C;gBAEvC,OAAO,EAAE,aAAa;IAE7C,YAAY,CAChB,KAAK,EAAE,wBAAwB,GAC9B,OAAO,CAAC,0BAA0B,EAAE,CAAC;IAUlC,UAAU,CACd,KAAK,EAAE,wBAAwB,GAAG;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GACtD,OAAO,CAAC,mBAAmB,CAAC;IAQzB,aAAa,CACjB,KAAK,EAAE,8BAA8B,GACpC,OAAO,CAAC,mBAAmB,CAAC;IAoBzB,WAAW,CACf,KAAK,EAAE,4BAA4B,GAClC,OAAO,CAAC,mBAAmB,CAAC;IAwDzB,wBAAwB,CAC5B,KAAK,EAAE,wBAAwB,GAC9B,OAAO,CAAC,yBAAyB,EAAE,CAAC;IAUjC,uBAAuB,CAC3B,KAAK,EAAE,gCAAgC,GACtC,OAAO,CAAC,yBAAyB,CAAC;IAc/B,eAAe,CACnB,KAAK,EAAE,wBAAwB,GAC9B,OAAO,CAAC,yBAAyB,EAAE,CAAC;IASjC,mBAAmB,CACvB,KAAK,EAAE,oCAAoC,GAC1C,OAAO,CAAC,mBAAmB,CAAC;IAuB/B,OAAO,CAAC,QAAQ;YAKF,OAAO;CAiBtB"}
+{"version":3,"file":"crowdyStudio.d.ts","sourceRoot":"","sources":["../../src/domains/crowdyStudio.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAQlD,OAAO,EAIL,KAAK,8BAA8B,EACnC,KAAK,oCAAoC,EAEzC,KAAK,mBAAmB,EAExB,KAAK,2BAA2B,EAChC,KAAK,wBAAwB,EAC7B,KAAK,0BAA0B,EAC/B,KAAK,yBAAyB,EAC9B,KAAK,gCAAgC,EACrC,KAAK,4BAA4B,EAClC,MAAM,4BAA4B,CAAC;AA0BpC;;;;;;GAMG;AACH,qBAAa,eAAgB,YAAW,2BAA2B;IAGrD,OAAO,CAAC,QAAQ,CAAC,OAAO;IAFpC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA0C;gBAEvC,OAAO,EAAE,aAAa;IAE7C,YAAY,CAChB,KAAK,EAAE,wBAAwB,GAC9B,OAAO,CAAC,0BAA0B,EAAE,CAAC;IAUlC,UAAU,CACd,KAAK,EAAE,wBAAwB,GAAG;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GACtD,OAAO,CAAC,mBAAmB,CAAC;IAQzB,aAAa,CACjB,KAAK,EAAE,8BAA8B,GACpC,OAAO,CAAC,mBAAmB,CAAC;IAoBzB,WAAW,CACf,KAAK,EAAE,4BAA4B,GAClC,OAAO,CAAC,mBAAmB,CAAC;IAiEzB,wBAAwB,CAC5B,KAAK,EAAE,wBAAwB,GAC9B,OAAO,CAAC,yBAAyB,EAAE,CAAC;IAUjC,uBAAuB,CAC3B,KAAK,EAAE,gCAAgC,GACtC,OAAO,CAAC,yBAAyB,CAAC;IAc/B,eAAe,CACnB,KAAK,EAAE,wBAAwB,GAC9B,OAAO,CAAC,yBAAyB,EAAE,CAAC;IASjC,mBAAmB,CACvB,KAAK,EAAE,oCAAoC,GAC1C,OAAO,CAAC,mBAAmB,CAAC;IAuB/B,OAAO,CAAC,QAAQ;YAKF,OAAO;CAiBtB"}

package/dist/domains/crowdyStudio.js

@@ -76,9 +76,18 @@ export class CrowdyStudioAPI {
             return this.remember(fromProjectDto(data.crowdyStudioProjectSave, input.gridId));
         }
         catch (error) {
+            // THE CODE IS `CROWDY_STUDIO_REVISION_CONFLICT`, not `CONFLICT`. This
+            // asked for `CONFLICT` and could therefore never match, so a real remote
+            // conflict never became a `CrowdyStudioRevisionConflictError` and the
+            // editor's "the remote moved" recovery — refetch, then offer to keep your
+            // version — was unreachable from the server side. The SDL description is
+            // where it came from: it said "returns CONFLICT with
+            // CROWDY_STUDIO_REVISION_CONFLICT", which reads as a code plus a detail
+            // and is one code with a long name. `crowdy-agent/graphql-transport.ts`
+            // had it right all along, in this same package.
             if (error instanceof CrowdyGraphQLError &&
-                error.code === 'CONFLICT' &&
-                error.message.includes('CROWDY_STUDIO_REVISION_CONFLICT')) {
+                (error.code === 'CROWDY_STUDIO_REVISION_CONFLICT' ||
+                    error.message.includes('CROWDY_STUDIO_REVISION_CONFLICT'))) {
                 let remoteProject;
                 try {
                     remoteProject = await this.getProject({