@crowdedkingdoms/crowdyjs 18.0.3-dev.1 → 18.0.4-dev.1

package/MIGRATION.md

@@ -120,6 +120,27 @@ super-admin's session). There is no SDK replacement.
 `dev`'s SDL after #417 merged (`npm run schema:sync:paths -- --schema <that schema.gql>`, then
 `npm run codegen`).
 
+## 18.0.4: a refused chunk write-back is dropped, and the wilderness setting
+
+The P3 W5 security review's notes for the SDKs. The game API now refuses `updateChunk` with
+`FORBIDDEN` for a player without edit permission on the chunk (someone else's claimed plot, a safe
+zone) and while the app's wilderness is closed (cks-game-api #434, ck-api `dev/v2.30.0`).
+
+- `ChunkStore` no longer retries a write-back forever. A write the server refuses (`FORBIDDEN`,
+  `SCOPE_MISSING`, `BAD_REQUEST`, `BAD_USER_INPUT`, `NOT_FOUND`, `extensions.retryable: false`, or
+  HTTP 400/403/404/413/422) is dropped after one attempt. One that can clear (`PLATFORM_BUSY`, a
+  network drop, a timeout, a server error) is tried five times, 0.7 s, 1.4 s, 2.8 s and 5.6 s
+  apart, then dropped. A dropped chunk keeps its local voxels and is no longer `dirty`.
+- `ChunkStore.onWriteBackFailed(listener)` reports each dropped write-back as a
+  `ChunkWriteBackFailure` (`chunk`, `coord`, `error`, `reason: 'refused' | 'exhausted'`,
+  `attempts`). The store does not undo the edit: undo it, or prune the chunk and load it again.
+- `ChunkStore.flush()` waits out the backoff and resolves with the write-backs it dropped
+  (it resolved with nothing before, and looped forever on a refusal).
+- `App.wildernessWritesOpen` is selected by `apps.app`, `appBySlug`, `forOrg`, `myApps`, `create`
+  and `update`; `apps.update(appId, { wildernessWritesOpen: false })` closes the wilderness
+  (`manage_apps`). The marketplace listings do not select it. Selecting it needs a game API with
+  #434.
+
 ## 18.0.3: a player takes back their consent and their trust
 
 Additive (OI-2026-09-28-001). It needs a game API with cks-game-api #431 (ck-api

package/README.md

@@ -587,6 +587,10 @@ write-back), `channelInbox` / `actorInbox` (message inboxes), `events` (typed
 event router), `host` (host tracking), and `save` / `avatar` (typed durable
 state).
 
+A chunk write-back the server refuses (a visitor on someone else's plot, a safe zone, a closed
+wilderness) is dropped, not retried; one that fails for a reason that can clear is tried five
+times. Listen with `session.chunks.onWriteBackFailed(...)` to undo or flag the edit (18.0.4).
+
 Every store is **opt-in twice over**: only configured stores are constructed
 (and only they exist on the session's TYPE — `session.host` without
 `host: ...` in the config is a compile error), and the layer lives behind the

package/dist/domains/apps.d.ts

@@ -214,6 +214,10 @@ export declare class AppsAPI {
     /**
      * Update an app's mutable fields. Requires the `manage_apps` app permission.
      *
+     * `wildernessWritesOpen: false` closes the app's wilderness (chunks no grid but the
+     * world grid covers): every voxel and chunk write there is refused with `FORBIDDEN`,
+     * whoever makes it, within 15 seconds on every game API replica. Apps start open.
+     *
      * @param appId - Numeric app id.
      * @param input - {@link UpdateAppInput} fields to change.
      * @returns The updated {@link App}.

package/dist/domains/apps.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"apps.d.ts","sourceRoot":"","sources":["../../src/domains/apps.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAgBL,KAAK,QAAQ,EAEb,KAAK,cAAc,EAEnB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,6BAA6B,EAClC,KAAK,mBAAmB,EACxB,KAAK,4BAA4B,EACjC,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,KAAK,+BAA+B,EACpC,KAAK,oBAAoB,EACzB,KAAK,8BAA8B,EACnC,KAAK,yBAAyB,EAE9B,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACvB,MAAM,yBAAyB,CAAC;AAEjC;;;;GAIG;AACH,MAAM,WAAW,QAAQ;IACvB,4DAA4D;IAC5D,KAAK,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB;;;;OAIG;IACH,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC;;;;OAIG;IACH,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAgBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,qBAAa,OAAO;IACN,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAAH,GAAG,EAAE,aAAa;IAE/C;;;OAGG;IACG,iBAAiB,CACrB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,yBAAyB,CAAC,sBAAsB,CAAC,CAAC;IAO7D;;;;OAIG;IACG,cAAc,CAClB,KAAK,EAAE,MAAM,EACb,cAAc,UAAQ,GACrB,OAAO,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,CAAC;IAYvD;;;;OAIG;IACG,oBAAoB,CACxB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,+BAA+B,CAAC,yBAAyB,CAAC,CAAC;IAQtE;;;OAGG;IACG,SAAS,CACb,KAAK,EAAE,iBAAiB,GACvB,OAAO,CAAC,oBAAoB,CAAC,cAAc,CAAC,CAAC;IAKhD;;;OAGG;IACG,mBAAmB,CACvB,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,8BAA8B,CAAC,wBAAwB,CAAC,CAAC;IAQpE;;;;;;;;;OASG;IACG,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAQlD;;;;;;;;;;;;OAYG;IACG,SAAS,CACb,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;IAQvC;;;;;;;;OAQG;IACG,MAAM,IAAI,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IAQ9C;;;;;;;;;;;;;OAaG;IACG,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAYhD;;;;;;;OAOG;IACG,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;IAKrE;;;;;;;;;OASG;IACG,WAAW,CACf,IAAI,GAAE;QACJ,MAAM,CAAC,EAAE,6BAA6B,CAAC,QAAQ,CAAC,CAAC;QACjD,KAAK,CAAC,EAAE,6BAA6B,CAAC,OAAO,CAAC,CAAC;QAC/C,MAAM,CAAC,EAAE,6BAA6B,CAAC,QAAQ,CAAC,CAAC;KAC7C,GACL,OAAO,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAKxC;;;;;;;OAOG;IACG,qBAAqB,CACzB,IAAI,GAAE,4BAAiC,GACtC,OAAO,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;IAKjD;;;;;;;;;;;;;;;;;;;;;OAqBG;IACG,oBAAoB,IAAI,OAAO,CACnC,yBAAyB,CAAC,sBAAsB,CAAC,CAClD;IAKD;;;;;;;;;;;;;;OAcG;IACG,MAAM,CACV,KAAK,EAAE,cAAc,GACpB,OAAO,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;IAK1C;;;;;;;;OAQG;IACG,MAAM,CACV,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,cAAc,GACpB,OAAO,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;IAQ1C;;;;;;;OAOG;IACG,OAAO,CACX,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;CAI7C"}
+{"version":3,"file":"apps.d.ts","sourceRoot":"","sources":["../../src/domains/apps.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAgBL,KAAK,QAAQ,EAEb,KAAK,cAAc,EAEnB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,6BAA6B,EAClC,KAAK,mBAAmB,EACxB,KAAK,4BAA4B,EACjC,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,KAAK,+BAA+B,EACpC,KAAK,oBAAoB,EACzB,KAAK,8BAA8B,EACnC,KAAK,yBAAyB,EAE9B,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACvB,MAAM,yBAAyB,CAAC;AAEjC;;;;GAIG;AACH,MAAM,WAAW,QAAQ;IACvB,4DAA4D;IAC5D,KAAK,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB;;;;OAIG;IACH,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC;;;;OAIG;IACH,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAgBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,qBAAa,OAAO;IACN,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAAH,GAAG,EAAE,aAAa;IAE/C;;;OAGG;IACG,iBAAiB,CACrB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,yBAAyB,CAAC,sBAAsB,CAAC,CAAC;IAO7D;;;;OAIG;IACG,cAAc,CAClB,KAAK,EAAE,MAAM,EACb,cAAc,UAAQ,GACrB,OAAO,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,CAAC;IAYvD;;;;OAIG;IACG,oBAAoB,CACxB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,+BAA+B,CAAC,yBAAyB,CAAC,CAAC;IAQtE;;;OAGG;IACG,SAAS,CACb,KAAK,EAAE,iBAAiB,GACvB,OAAO,CAAC,oBAAoB,CAAC,cAAc,CAAC,CAAC;IAKhD;;;OAGG;IACG,mBAAmB,CACvB,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,8BAA8B,CAAC,wBAAwB,CAAC,CAAC;IAQpE;;;;;;;;;OASG;IACG,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAQlD;;;;;;;;;;;;OAYG;IACG,SAAS,CACb,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;IAQvC;;;;;;;;OAQG;IACG,MAAM,IAAI,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IAQ9C;;;;;;;;;;;;;OAaG;IACG,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAYhD;;;;;;;OAOG;IACG,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;IAKrE;;;;;;;;;OASG;IACG,WAAW,CACf,IAAI,GAAE;QACJ,MAAM,CAAC,EAAE,6BAA6B,CAAC,QAAQ,CAAC,CAAC;QACjD,KAAK,CAAC,EAAE,6BAA6B,CAAC,OAAO,CAAC,CAAC;QAC/C,MAAM,CAAC,EAAE,6BAA6B,CAAC,QAAQ,CAAC,CAAC;KAC7C,GACL,OAAO,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAKxC;;;;;;;OAOG;IACG,qBAAqB,CACzB,IAAI,GAAE,4BAAiC,GACtC,OAAO,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;IAKjD;;;;;;;;;;;;;;;;;;;;;OAqBG;IACG,oBAAoB,IAAI,OAAO,CACnC,yBAAyB,CAAC,sBAAsB,CAAC,CAClD;IAKD;;;;;;;;;;;;;;OAcG;IACG,MAAM,CACV,KAAK,EAAE,cAAc,GACpB,OAAO,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;IAK1C;;;;;;;;;;;;OAYG;IACG,MAAM,CACV,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,cAAc,GACpB,OAAO,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;IAQ1C;;;;;;;OAOG;IACG,OAAO,CACX,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;CAI7C"}

package/dist/domains/apps.js

@@ -252,6 +252,10 @@ export class AppsAPI {
     /**
      * Update an app's mutable fields. Requires the `manage_apps` app permission.
      *
+     * `wildernessWritesOpen: false` closes the app's wilderness (chunks no grid but the
+     * world grid covers): every voxel and chunk write there is refused with `FORBIDDEN`,
+     * whoever makes it, within 15 seconds on every game API replica. Apps start open.
+     *
      * @param appId - Numeric app id.
      * @param input - {@link UpdateAppInput} fields to change.
      * @returns The updated {@link App}.

package/dist/generated/graphql.d.ts

@@ -916,6 +916,8 @@ export type App = {
     updatedAt: Scalars['DateTime']['output'];
     /** Marketplace discoverability (PUBLIC/UNLISTED/PRIVATE). See AppVisibility. */
     visibility: AppVisibility;
+    /** Whether players may write the app's wilderness: chunks that no grid but the app's world grid covers. True (the default) leaves those writes to the ordinary voxel permission; false refuses every voxel and chunk write there (updateVoxel, sendVoxelUpdate, updateChunk, ck-exec's world.set_voxels), whoever makes it. Set with updateApp (manage_apps). */
+    wildernessWritesOpen: Scalars['Boolean']['output'];
 };
 /** A free or purchasable access tier for an app, bundling a price and the set of runtime permission keys that granted users receive. */
 export type AppAccessTier = {
@@ -4601,7 +4603,7 @@ export type Mutation = {
     sendTextPacket: Scalars['Boolean']['output'];
     /** Send ONE webcam video fragment, fanned out to nearby actors as a ClientVideoNotification (Buddy v0.25.0). Requires a bearer game token and the use_video_chat runtime permission at app AND grid level -- without it the game server responds asynchronously with a GenericErrorResponse (errorCode UNAUTHORIZED). A datagram carries at most ~1117 bytes of videoData, so an encoded frame is split by the SDK into fragments (6-byte header: version, codec, frameId, fragIndex, fragCount; at most 16 per frame) and reassembled by receivers; this is a mutation PER FRAGMENT and sustained video belongs on the binary realtime relay. Every receiver in range pays the egress bytes: keep distance small and frames few. Opens a UDP proxy session automatically if none exists. Returns Boolean! that is true only when the datagram was ACCEPTED FOR SENDING -- NOT that it was delivered; the sender receives no echo, only errors (GenericErrorResponse, correlated by sequenceNumber) on udpNotifications. */
     sendVideoPacket: Scalars['Boolean']['output'];
-    /** Send a single voxel (block) update for spatial replication to nearby chunks. Requires a bearer game token; opens a UDP proxy session automatically if none exists. Returns Boolean! that is true only when the datagram was ACCEPTED FOR SENDING to the game server — NOT confirmation that the world applied the change. There is NO separate per-request success response: the change fans out to nearby clients (the sender included) as a VoxelUpdateNotification carrying the same sequenceNumber (VoxelUpdateResponse is legacy and is never emitted). Failures arrive ASYNCHRONOUSLY as a GenericErrorResponse; both are correlated by the request sequenceNumber (correlation only — not an idempotency key; the server does not dedupe replays). */
+    /** Send a single voxel (block) update for spatial replication to nearby chunks. Requires a bearer game token; opens a UDP proxy session automatically if none exists. Returns Boolean! that is true only when the datagram was ACCEPTED FOR SENDING to the game server — NOT confirmation that the world applied the change. There is NO separate per-request success response: the change fans out to nearby clients (the sender included) as a VoxelUpdateNotification carrying the same sequenceNumber (VoxelUpdateResponse is legacy and is never emitted). Failures arrive ASYNCHRONOUSLY as a GenericErrorResponse; both are correlated by the request sequenceNumber (correlation only — not an idempotency key; the server does not dedupe replays). Throws FORBIDDEN synchronously for a chunk only the app's world grid covers while the app's wilderness is closed (App.wildernessWritesOpen false). */
     sendVoxelUpdate: Scalars['Boolean']['output'];
     /** Creates or updates an app's monthly spend cap (idempotent upsert keyed by org + app) and returns the resulting budget. This only records the cap used to monitor/limit overspend; it does not move money, charge a card, or alter the wallet balance. Requires the 'manage_billing' app permission. */
     setAppBudget: AppBudget;
@@ -4683,7 +4685,7 @@ export type Mutation = {
     updateActor: Actor;
     /** Replaces an actor’s `publicState` and/or `privateState` blobs (fields omitted from `input` are left unchanged). OWNER-EXCLUSIVE: only the actor’s owner may write (throws Unauthorized otherwise). Game-plane: requires an app token for the actor’s app (a session token or another app’s token is answered NotFound). `uuid` is the 32-character ASCII actor id; blobs are base64-encoded binary. */
     updateActorState: Actor;
-    /** Update mutable fields of an existing app (name, description, visibility, status, metadata); only fields present in the input are changed. Requires the 'manage_apps' permission on the app (resolved via its org); super admins bypass. Use this to publish (status=LIVE), change visibility, or restore an archived app (status back to DRAFT/LIVE). Throws if the app id does not exist. */
+    /** Update mutable fields of an existing app (name, description, visibility, status, metadata, wildernessWritesOpen); only fields present in the input are changed. Requires the 'manage_apps' permission on the app (resolved via its org); super admins bypass. Use this to publish (status=LIVE), change visibility, or restore an archived app (status back to DRAFT/LIVE). Throws if the app id does not exist. */
     updateApp: App;
     /** Updates an avatar’s mutable fields (currently `name`) and returns it. OWNER-EXCLUSIVE: only the avatar’s owner may call this (throws Unauthorized otherwise). Requires a valid game token. To change state blobs use `updateAvatarState`. */
     updateAvatar: Avatar;
@@ -4695,7 +4697,7 @@ export type Mutation = {
     updateChannel: Group;
     /** Update a channel role's name, rank, and/or permission keys (system roles cannot be renamed/re-ranked). When permissions are supplied they REPLACE the role's existing keys. Requires the 'manage_roles' channel permission (app admins bypass). Note: changing send_messages here does not re-push Buddy until affected members' roles are re-applied via setChannelMemberRoles. */
     updateChannelRole: GroupRole;
-    /** Creates or replaces a chunk's dense voxel grid and/or per-voxel states for the given app and coordinates, records each provided voxel state as an individual voxel update, and asynchronously uploads the chunk to the CDN. WRITES world state. Leaves chunkState and LODs untouched. Requires a valid bearer token (app-scoped tokens are limited to their own app); no additional org/app permission is enforced on this field. */
+    /** Creates or replaces a chunk's dense voxel grid and/or per-voxel states for the given app and coordinates, records each provided voxel state as an individual voxel update, and asynchronously uploads the chunk to the CDN. WRITES world state. Leaves chunkState and LODs untouched. Requires an app token for the app and either the 'manage_apps' permission on the app (resolved via its org; super admins bypass) or the voxel edit permission for this chunk that updateVoxel checks (app access, the tier's update_voxel_data, and update_voxel_data on a grid covering the chunk). Throws FORBIDDEN otherwise, and for a chunk only the app's world grid covers while the app's wilderness is closed (App.wildernessWritesOpen false). */
     updateChunk: Chunk;
     /** Replaces the level-of-detail (LOD) set for a chunk, preserving voxels, per-voxel states, chunk state and owner; returns the updated chunk (or null if it could not be written). WRITES world state. Requires a valid bearer token AND the `manage_apps` permission on the org that owns input.appId (super admins bypass). */
     updateChunkLods: Maybe<Chunk>;
@@ -4719,7 +4721,7 @@ export type Mutation = {
     updateUserState: User;
     /** Sets the target user’s account `user_type` (e.g. "direct", "deleted"). Requires a super-admin bearer game token (and the management API enabled). */
     updateUserType: User;
-    /** Records (upserts) a single voxel edit in the voxel_updates log for one chunk and returns the resulting Voxel. WRITES world state; a background maintenance job later folds these edits into the chunk's packed grid. Requires a valid bearer token AND voxel-edit permission for the target region: the user must have active app access, the `update_voxel_data` tier permission, and (when grids cover the chunk) `update_voxel_data` on a covering grid. */
+    /** Records (upserts) a single voxel edit in the voxel_updates log for one chunk and returns the resulting Voxel. WRITES world state; a background maintenance job later folds these edits into the chunk's packed grid. Requires a valid bearer token AND voxel-edit permission for the target region: the user must have active app access, the `update_voxel_data` tier permission, and (when grids cover the chunk) `update_voxel_data` on a covering grid. A chunk only the app's world grid covers is refused while the app's wilderness is closed (App.wildernessWritesOpen false). */
     updateVoxel: Voxel;
 };
 export type MutationAbandonGamePublishArgs = {
@@ -8056,6 +8058,8 @@ export type UpdateAppInput = {
     status?: InputMaybe<AppStatus>;
     /** New visibility (PUBLIC/UNLISTED/PRIVATE). Omit to leave unchanged. */
     visibility?: InputMaybe<AppVisibility>;
+    /** Open (true) or close (false) the app's wilderness to voxel and chunk writes: chunks that no grid but the app's world grid covers. Closing refuses every write there, whoever makes it; each game API replica acts on the change within 15 seconds. Omit to leave unchanged. */
+    wildernessWritesOpen?: InputMaybe<Scalars['Boolean']['input']>;
 };
 export type UpdateAvatarAppStateInput = {
     /** App (game) id the state is scoped to. Required. BigInt sent as a decimal string. */
@@ -8158,11 +8162,11 @@ export type UpdateVoxelInput = {
     appId: Scalars['BigInt']['input'];
     /** Address of the chunk that contains the voxel to edit. */
     coordinates: ChunkCoordinatesInput;
-    /** Local voxel position within the chunk (0-15 per axis; validated to the signed 16-bit range). */
+    /** Local voxel position within the chunk, 0-15 per axis; anything else is refused. */
     location: VoxelCoordinatesInput;
     /** Optional BASE64-encoded binary state blob for the voxel; omit for none. */
     state?: InputMaybe<Scalars['String']['input']>;
-    /** Voxel type id to write (0-255). */
+    /** Voxel type id to write, 0-255; anything else is refused. */
     voxelType: Scalars['Float']['input'];
 };
 /** One minute-bucketed usage sample. Byte/message counters are returned as strings because they can exceed the 32-bit Int range. */
@@ -8364,9 +8368,9 @@ export type VoxelState = {
 export type VoxelStateInput = {
     /** BASE64-encoded binary state blob for this voxel; omit/null for no extra state. */
     state?: InputMaybe<Scalars['String']['input']>;
-    /** Local voxel position within the chunk (0-15 per axis). */
+    /** Local voxel position within the chunk, 0-15 per axis; anything else is refused. */
     voxelCoord: VoxelCoordinatesInput;
-    /** Voxel type id to set at this position (0-255). */
+    /** Voxel type id to set at this position, 0-255; anything else is refused. */
     voxelType: Scalars['Int']['input'];
 };
 /** Relay-style cursor-paginated connection over voxel edit history entries (VoxelUpdateHistoryEvent). Page with `first`/`after`; cursors are opaque. */
@@ -8453,11 +8457,11 @@ export type VoxelUpdateRequestInput = {
     sequenceNumber?: InputMaybe<Scalars['Int']['input']>;
     /** A unique identifier for this voxel update. Must be exactly 32 bytes when encoded as UTF-8. */
     uuid: Scalars['String']['input'];
-    /** The voxel coordinates within the chunk. Values must be between -32768 and 32767 (int16 range). */
+    /** The voxel coordinates within the chunk, 0-15 on each axis; anything else is refused. */
     voxel: VoxelCoordinatesInput;
     /** Optional voxel state data, base64-encoded. Omit (or send an empty string) when the voxel has no extra state — an empty payload is a type-only update. */
     voxelState?: InputMaybe<Scalars['String']['input']>;
-    /** The new voxel type ID. This determines the appearance and properties of the voxel. */
+    /** The new voxel type ID, 0-255 (anything else is refused). This determines the appearance and properties of the voxel. */
     voxelType: Scalars['Int']['input'];
 };
 /** LEGACY — never emitted. The game server retired the dedicated voxel-update response opcode (132); an applied update now arrives as your own VoxelUpdateNotification (the sender is included in the chunk fan-out) and failures arrive as GenericErrorResponse. This type remains in the UdpNotification union for backward compatibility only — do not select it in new code; it will be removed in a future major version. */
@@ -9049,6 +9053,7 @@ export type AppQuery = {
         visibility: AppVisibility;
         status: AppStatus;
         metadata: string | null;
+        wildernessWritesOpen: boolean;
         splitMode: boolean;
         deploymentTarget: string;
         reservedUdpBytesPerSec: string;
@@ -9086,6 +9091,7 @@ export type AppBySlugQuery = {
         visibility: AppVisibility;
         status: AppStatus;
         metadata: string | null;
+        wildernessWritesOpen: boolean;
         splitMode: boolean;
         gameApiUrl: string | null;
         createdAt: string;
@@ -9126,6 +9132,7 @@ export type AppsForOrgQuery = {
         visibility: AppVisibility;
         status: AppStatus;
         metadata: string | null;
+        wildernessWritesOpen: boolean;
         splitMode: boolean;
         gameApiUrl: string | null;
         createdAt: string;
@@ -9238,6 +9245,7 @@ export type CreateAppMutation = {
         visibility: AppVisibility;
         status: AppStatus;
         metadata: string | null;
+        wildernessWritesOpen: boolean;
         createdAt: string;
     };
 };
@@ -9338,6 +9346,7 @@ export type MyAppsQuery = {
         visibility: AppVisibility;
         status: AppStatus;
         metadata: string | null;
+        wildernessWritesOpen: boolean;
         splitMode: boolean;
         gameApiUrl: string | null;
         createdAt: string;
@@ -9386,6 +9395,7 @@ export type UpdateAppMutation = {
         visibility: AppVisibility;
         status: AppStatus;
         metadata: string | null;
+        wildernessWritesOpen: boolean;
         updatedAt: string;
     };
 };