@crowdedkingdoms/crowdyjs 18.15.0-test.1 → 18.16.0-dev.1

package/README.md

@@ -107,6 +107,7 @@ game stack never receives the player's full session.
 | in a browser, on your own domain (every customer game) | `portal.signIn` -> Studio -> `portal.handleSignInCallback` | the client already holds the app token |
 | in a browser, on the first-party host (Studio) | `auth.login` / magic link / social       | `portal.mintAppToken(appId)`          |
 | outside a browser (Node, CLI, CrowdyCPP, tests)        | `auth.login` / `auth.register`            | `portal.mintAppToken(appId)`          |
+| anywhere, for players of an organization that runs its own accounts (dev only) | the organization signs its player in: its server mints with an org token, or its sign-in service signs an assertion | `portal.adoptAppToken(response)` / `portal.exchangeManagedPlayerAssertion(...)` — see [Org-managed players](#org-managed-players-dev-only) |
 
 The first row is the only one a game on its own domain can take: the direct
 sign-in mutations are refused from a non-first-party browser origin with
@@ -202,6 +203,71 @@ Notes:
 Deeper reading: [Portals & app-scoped tokens](https://docs.dev.crowdedkingdoms.com/management-api/portals-and-app-tokens)
 and [Sign in](https://docs.dev.crowdedkingdoms.com/management-api/authentication).
 
+### Org-managed players (dev only)
+
+An organization that runs its own accounts can sign its players in to its own apps itself
+(18.16.0, cks-game-api #557). The player never types a Crowded Kingdoms password, and Crowded
+Kingdoms holds no email or password for it: the organization vouches for the player and the
+device gets the player's own app token, which plays exactly like any other. An org-managed
+player has no session and no wallet, plays only its organization's apps, and its mods are paid
+for by the organization where it switched them on (`managedPlayers.setAppMods`). An operator
+turns the feature on for an organization; outside the dev tier every call answers
+`FEATURE_DISABLED`.
+
+**From the organization's server, with an org token.** Create the token in Studio (or
+`organizations.createToken({ orgId, scopes: ['players:mint'], appIds: [appId] })`) and keep it
+on the server: it signs in any of the organization's players, and the API refuses one sent
+with an `Origin` header. The SDK deliberately has no wrapper for the mint; it is one request:
+
+```ts
+// your server, after your own sign-in succeeded
+const res = await fetch('https://ck.dev.crowdedkingdoms.com/graphql', {
+  method: 'POST',
+  headers: { 'content-type': 'application/json', authorization: `Bearer ${process.env.CK_ORG_TOKEN}` },
+  body: JSON.stringify({
+    query: `mutation($i: MintManagedPlayerTokenInput!) { mintManagedPlayerToken(input: $i) {
+      token gameTokenId appId expiresAt gameApiUrl gameApiWsUrl discoveryUrl launchUrl } }`,
+    variables: { i: { appId, externalId: account.id, gamertag: account.displayName } },
+  }),
+});
+const { data } = await res.json();
+// send data.mintManagedPlayerToken to the player's device
+```
+
+```ts
+// the player's device
+const access = await fetch('/api/crowded-kingdoms/token').then((r) => r.json());
+const game = createCrowdyClient({ httpUrl: access.gameApiUrl, wsUrl: access.gameApiWsUrl });
+game.portal.adoptAppToken(access); // refuses an org token by mistake
+game.world(appId).subscribe({ actorUpdate: (n) => { /* ... */ } });
+```
+
+`externalId` is your own stable account id (not an email); the first sign-in creates the player
+and the same id is always the same player. The token refreshes (`refreshGameplayToken`) until
+the sign-in's lifetime ends (`sessionTtlSeconds`, at most the organization's setting); then the
+device asks your server again.
+
+**With a signed assertion.** Register a public key once
+(`managedPlayers.registerSigningKey({ orgId, kid, algorithm: 'EdDSA', publicJwk, issuer })`);
+your sign-in service signs a short JWS per player (`iss`, `aud: 'ck:app:<appId>'`, `sub` your
+account id, `iat`, `exp` at most 300 s later, a fresh `jti`, optionally `gamertag`) and the
+device trades it, without your server calling Crowded Kingdoms:
+
+```ts
+const access = await game.portal.exchangeManagedPlayerAssertion({ appId, assertion });
+```
+
+Each assertion works once; a refusal reads with `assertionRejectedOf(err)?.reason`
+(`expired`, `replayed`, `signature`, …).
+
+**Administration** takes an org admin's session with `manage_players`:
+`client.managedPlayers.list` / `get` / `provision` (up to 500 a call: pre-provision before a
+launch) / `update` (rename, disable, enable) / `endSessions` / `delete`, `settings` (the
+operator-set limits), `signingKeys` / `registerSigningKey` / `revokeSigningKey`, and
+`appModsEnabled` / `setAppMods` (`manage_billing`). From your server, an org token with
+`players:manage` also works for the six player operations. `organizations.revokeToken(id, { endSessions: true })`
+also ends the sessions a token signed in.
+
 ### Token refresh during gameplay
 
 Before an app token expires, call `game.refreshGameplayToken()` while gameplay
@@ -248,7 +314,7 @@ never told about, so a native refresh without it is a re-placement.
 | `client.auth` | Sign-in: `login` / `register` (email + password), magic link, social/OIDC. Passwords: `requestPasswordReset` / `resetPassword`, `changePassword`, and `setInitialPassword` for an account created by magic link or a social provider (added in 15.1.0). Log out, and linked identities (`myIdentities`, `linkIdentity`/`unlinkIdentity`). **No dev bypass** — `devLogin` was removed in 15.0.0 and `DEV_AUTH_BYPASS` is gone from every tier. |
 | `client.users` | `me`, `updateGamertag`, profile reads; `playerProfile` / `playerProfiles` (up to 100) for other players' public `{ userId, gamertag, disambiguation }`. |
 | `client.session` | Token store, `restore()`, `getToken()`, manual `setToken()`. |
-| `client.portal` | App-scoped token minting (`mintAppToken`) and the cross-origin PKCE entry flow (`beginEntry` / `handleAuthorizeRequest` / `completeEntry` / `refresh`). |
+| `client.portal` | App-scoped token minting (`mintAppToken`) and the cross-origin PKCE entry flow (`beginEntry` / `handleAuthorizeRequest` / `completeEntry` / `refresh`). For an org-managed player (dev only), `adoptAppToken` stores the token its organization minted and `exchangeManagedPlayerAssertion` trades the organization's signed assertion. |
 | `client.hosting` | Third-party hosting on Crowdy Games (17.2.0): `claim` a slug for an app, `beginPublish` / `completePublish` / `abandonPublish` a built bundle, `setEnabled`; public `game(slug)` / `listed()`. Mutations need an identity session with `manage_apps`. `@crowdedkingdoms/crowdyjs/hosting` exports `publishDirectory(client, { dir, slug })`, the Node helper that does the whole publish for a `dist/`. |
 | `client.platform` | Public platform configuration (`config()`). |
 | `client.serverStatus` | `gameClientBootstrap(appId)` — per-app version info, UDP status, spatial limits. |
@@ -274,7 +340,8 @@ grouped under `client.admin` and mirrored at the top level):
 
 | Sub-client | What it does |
 |---|---|
-| `client.organizations` | Orgs, members, RBAC roles, org API tokens. |
+| `client.organizations` | Orgs, members, RBAC roles, org API tokens (with `scopes` and `appIds` for org-managed players). |
+| `client.managedPlayers` | Org-managed players (dev only): list, provision, rename, disable, end sessions, delete; assertion signing keys; whether the org pays for their mods in an app. See [Org-managed players](#org-managed-players-dev-only). |
 | `client.apps` | App registry, discovery + routing (`create`, `routeFor`, `marketplace`), visibility, and player-code admission mode / allow-list administration. |
 | `client.appAccess` | Access tiers + per-user grants, and the feature keys a tier grants (`defineFeature`, `grantTierFeature`, `tierFeatures`, …), which a hub checks with the node API's `players.features`; timed bans (`suspend`, `unsuspend`) and `resyncTierGridPermissions`. |
 | `client.billing` | Org wallet + per-app spend budgets. |
@@ -1174,7 +1241,9 @@ Readers for the refusals a player should be told about, each `null` for any othe
 `ACCESS_NOT_GRANTED`), `appPausedOf(err)` (`APP_PAUSED`, with `reason`) and `actorExistsOf(err)`
 (`ACTOR_EXISTS`; `ownedByCaller: true` means a retried create of your own actor). A paused app
 still mints tokens: check `isAppPaused(token.runtimeGate)` (or the bootstrap's `runtimeGate`)
-before entering the world.
+before entering the world. For org-managed players: `assertionRejectedOf(err)`
+(`ASSERTION_REJECTED`, with the failed check as `reason`) and `managedPlayerNotAllowedOf(err)`
+(`MANAGED_PLAYER_NOT_ALLOWED`: no wallet, or mods the organization has not switched on).
 
 ## Idempotent retries
 

package/dist/crowdy-client.d.ts

@@ -37,6 +37,7 @@ import { HostingAPI } from './domains/hosting.js';
 import { PortalAPI, type AppTokenResponse, type PkceStore } from './domains/portal.js';
 import { PlatformAPI } from './domains/platform.js';
 import { OrganizationsAPI } from './domains/organizations.js';
+import { ManagedPlayersAPI } from './domains/managedPlayers.js';
 import { AppAccessAPI } from './domains/appAccess.js';
 import { BillingAPI } from './domains/billing.js';
 import { PaymentsAPI } from './domains/payments.js';
@@ -242,6 +243,8 @@ export declare class CrowdyClient {
     readonly platform: PlatformAPI;
     /** Organizations, members, RBAC roles, and org API tokens (studio admin). */
     readonly organizations: OrganizationsAPI;
+    /** An organization's own players, signed in by the organization (studio admin, dev only). */
+    readonly managedPlayers: ManagedPlayersAPI;
     /** App access tiers + per-user access grants (studio admin). */
     readonly appAccess: AppAccessAPI;
     /** Org wallet + per-app spend budgets (studio admin). */

package/dist/crowdy-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"crowdy-client.d.ts","sourceRoot":"","sources":["../src/crowdy-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAK5C,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE/C,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEpE,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EACL,SAAS,EACT,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACf,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACtE,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,KAAK,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,MAAM,WAAW,kBAAkB;IAEjC;;;;;;;;;OASG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,6DAA6D;IAC7D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0DAA0D;IAC1D,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mDAAmD;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;IAGpB,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,wEAAwE;IACxE,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,YAAY,GAAG,KAAK,CAAC;IACpC;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,mFAAmF;IACnF,QAAQ,CAAC,EAAE;QACT;;;WAGG;QACH,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,4EAA4E;QAC5E,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,iDAAiD;QACjD,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,8EAA8E;QAC9E,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,+EAA+E;QAC/E,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB;;;WAGG;QACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;QAC5B;;;;;;;WAOG;QACH,eAAe,CAAC,EAAE,OAAO,CAAC;QAC1B;;;WAGG;QACH,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB;;;;;;;;;;;;;;;;;;;;WAoBG;QACH,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,KAAK,OAAO,CAAC;YAC7C,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;YACxB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;SACvB,GAAG,IAAI,CAAC,CAAC;QACV;;;;;;;;;WASG;QACH,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,iEAAiE;QACjE,uBAAuB,CAAC,EAAE,MAAM,CAAC;KAClC,CAAC;IACF;;;;OAIG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;CAC/B;AAED,qBAAa,YAAY;IACvB,OAAO,CAAC,oBAAoB,CAA0C;IAEtE,8DAA8D;IAC9D,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC;IAC5B,+BAA+B;IAC/B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,+CAA+C;IAC/C,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC;IACvC;;;;;;;OAOG;IACH,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAGlC,qEAAqE;IACrE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,+DAA+D;IAC/D,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,mEAAmE;IACnE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,6GAA6G;IAC7G,QAAQ,CAAC,YAAY,EAAE,YAAY,GAAG,IAAI,CAAC;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,uEAAuE;IACvE,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,6EAA6E;IAC7E,QAAQ,CAAC,aAAa,EAAE,gBAAgB,CAAC;IACzC,gEAAgE;IAChE,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC;IACjC,yDAAyD;IACzD,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,wDAAwD;IACxD,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,4DAA4D;IAC5D,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,kFAAkF;IAClF,QAAQ,CAAC,iBAAiB,EAAE,oBAAoB,CAAC;IACjD;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IAGzB,wEAAwE;IACxE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,uEAAuE;IACvE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,yEAAyE;IACzE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,4DAA4D;IAC5D,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,8CAA8C;IAC9C,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,4EAA4E;IAC5E,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC;IACvC,+DAA+D;IAC/D,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,iFAAiF;IACjF,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,2EAA2E;IAC3E,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,gFAAgF;IAChF,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,4EAA4E;IAC5E,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAoC;IACzD,wEAAwE;IACxE,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC;IACvC,iHAAiH;IACjH,QAAQ,CAAC,kBAAkB,EAAE,2BAA2B,CAAC;IAEzD,iEAAiE;IACjE,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC;IACrC,+EAA+E;IAC/E,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC;IACvC,kEAAkE;IAClE,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,qDAAqD;IACrD,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,sEAAsE;IACtE,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;gBAEnB,MAAM,GAAE,kBAAuB;IAwM3C,4EAA4E;IAC5E,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAIpC,0DAA0D;IAC1D,QAAQ,IAAI,MAAM,GAAG,IAAI;IAIzB;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACG,oBAAoB,IAAI,OAAO,CAAC,gBAAgB,CAAC;YAczC,2BAA2B;IAezC;;;;OAIG;IACG,2BAA2B,IAAI,OAAO,CAAC,IAAI,CAAC;IASlD;;;;;;;OAOG;IACH,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW;IAIjC;;;;;;;OAOG;IACH,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,GAAG,SAAS;IAI7D;;;;;;;;;;;;OAYG;IACH,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,aAAa;IAgB3D,gEAAgE;IAChE,KAAK,IAAI,IAAI;IAQb,yDAAyD;IACzD,IAAI,eAAe,IAAI,MAAM,CAE5B;CACF;AAED,wBAAgB,kBAAkB,CAChC,MAAM,GAAE,kBAAuB,GAC9B,YAAY,CAEd"}
+{"version":3,"file":"crowdy-client.d.ts","sourceRoot":"","sources":["../src/crowdy-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAK5C,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE/C,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEpE,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EACL,SAAS,EACT,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACf,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACtE,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,KAAK,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,MAAM,WAAW,kBAAkB;IAEjC;;;;;;;;;OASG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,6DAA6D;IAC7D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0DAA0D;IAC1D,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mDAAmD;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;IAGpB,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,wEAAwE;IACxE,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,YAAY,GAAG,KAAK,CAAC;IACpC;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,mFAAmF;IACnF,QAAQ,CAAC,EAAE;QACT;;;WAGG;QACH,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,4EAA4E;QAC5E,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,iDAAiD;QACjD,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,8EAA8E;QAC9E,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,+EAA+E;QAC/E,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB;;;WAGG;QACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;QAC5B;;;;;;;WAOG;QACH,eAAe,CAAC,EAAE,OAAO,CAAC;QAC1B;;;WAGG;QACH,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB;;;;;;;;;;;;;;;;;;;;WAoBG;QACH,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,KAAK,OAAO,CAAC;YAC7C,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;YACxB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;SACvB,GAAG,IAAI,CAAC,CAAC;QACV;;;;;;;;;WASG;QACH,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,iEAAiE;QACjE,uBAAuB,CAAC,EAAE,MAAM,CAAC;KAClC,CAAC;IACF;;;;OAIG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;CAC/B;AAED,qBAAa,YAAY;IACvB,OAAO,CAAC,oBAAoB,CAA0C;IAEtE,8DAA8D;IAC9D,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC;IAC5B,+BAA+B;IAC/B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,+CAA+C;IAC/C,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC;IACvC;;;;;;;OAOG;IACH,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAGlC,qEAAqE;IACrE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,+DAA+D;IAC/D,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,mEAAmE;IACnE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,6GAA6G;IAC7G,QAAQ,CAAC,YAAY,EAAE,YAAY,GAAG,IAAI,CAAC;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,uEAAuE;IACvE,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,6EAA6E;IAC7E,QAAQ,CAAC,aAAa,EAAE,gBAAgB,CAAC;IACzC,6FAA6F;IAC7F,QAAQ,CAAC,cAAc,EAAE,iBAAiB,CAAC;IAC3C,gEAAgE;IAChE,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC;IACjC,yDAAyD;IACzD,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,wDAAwD;IACxD,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,4DAA4D;IAC5D,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,kFAAkF;IAClF,QAAQ,CAAC,iBAAiB,EAAE,oBAAoB,CAAC;IACjD;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IAGzB,wEAAwE;IACxE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,uEAAuE;IACvE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,yEAAyE;IACzE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,4DAA4D;IAC5D,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,8CAA8C;IAC9C,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,4EAA4E;IAC5E,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC;IACvC,+DAA+D;IAC/D,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,iFAAiF;IACjF,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,2EAA2E;IAC3E,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,gFAAgF;IAChF,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,4EAA4E;IAC5E,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAoC;IACzD,wEAAwE;IACxE,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC;IACvC,iHAAiH;IACjH,QAAQ,CAAC,kBAAkB,EAAE,2BAA2B,CAAC;IAEzD,iEAAiE;IACjE,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC;IACrC,+EAA+E;IAC/E,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC;IACvC,kEAAkE;IAClE,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,qDAAqD;IACrD,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,sEAAsE;IACtE,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;gBAEnB,MAAM,GAAE,kBAAuB;IA0M3C,4EAA4E;IAC5E,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAIpC,0DAA0D;IAC1D,QAAQ,IAAI,MAAM,GAAG,IAAI;IAIzB;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACG,oBAAoB,IAAI,OAAO,CAAC,gBAAgB,CAAC;YAczC,2BAA2B;IAezC;;;;OAIG;IACG,2BAA2B,IAAI,OAAO,CAAC,IAAI,CAAC;IASlD;;;;;;;OAOG;IACH,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW;IAIjC;;;;;;;OAOG;IACH,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,GAAG,SAAS;IAI7D;;;;;;;;;;;;OAYG;IACH,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,aAAa;IAgB3D,gEAAgE;IAChE,KAAK,IAAI,IAAI;IAQb,yDAAyD;IACzD,IAAI,eAAe,IAAI,MAAM,CAE5B;CACF;AAED,wBAAgB,kBAAkB,CAChC,MAAM,GAAE,kBAAuB,GAC9B,YAAY,CAEd"}

package/dist/crowdy-client.js

@@ -38,6 +38,7 @@ import { HostingAPI } from './domains/hosting.js';
 import { PortalAPI, } from './domains/portal.js';
 import { PlatformAPI } from './domains/platform.js';
 import { OrganizationsAPI } from './domains/organizations.js';
+import { ManagedPlayersAPI } from './domains/managedPlayers.js';
 import { AppAccessAPI } from './domains/appAccess.js';
 import { BillingAPI } from './domains/billing.js';
 import { PaymentsAPI } from './domains/payments.js';
@@ -196,6 +197,7 @@ export class CrowdyClient {
         this.discovery = new DiscoveryDomain(this.graphql);
         this.platform = new PlatformAPI(this.graphql);
         this.organizations = new OrganizationsAPI(this.graphql);
+        this.managedPlayers = new ManagedPlayersAPI(this.graphql);
         this.appAccess = new AppAccessAPI(this.graphql);
         this.billing = new BillingAPI(this.graphql);
         this.payments = new PaymentsAPI(this.graphql);
@@ -223,6 +225,7 @@ export class CrowdyClient {
         this.gameApps = new GameAppsAPI(this.graphql);
         this.admin = new AdminAPI({
             organizations: this.organizations,
+            managedPlayers: this.managedPlayers,
             apps: this.apps,
             appAccess: this.appAccess,
             billing: this.billing,

package/dist/default-origin.d.ts

@@ -1,6 +1,6 @@
 /**
  * GENERATED — do not edit. The operator tooling's
- * `sync-client-origins.mjs --write --tier test` writes this file, and
+ * `sync-client-origins.mjs --write --tier dev` writes this file, and
  * `check-sdk-default-origin.mjs` refuses it when it names the wrong tier or a
  * host that declaration does not carry. Regenerate; never hand-edit.
  *
@@ -10,14 +10,14 @@
  * than no default at all. Every fallback this SDK ever removed named a host that
  * was already dead. A generated file plus a gate is what makes this one different.
  *
- * Source: the operator's per-tier public CK API origin declaration, tier 'test'
+ * Source: the operator's per-tier public CK API origin declaration, tier 'dev'
  */
 /** The tier this build of the SDK is published for. */
-export declare const CROWDY_DEFAULT_TIER = "test";
+export declare const CROWDY_DEFAULT_TIER = "dev";
 /** The public CK API origin for that tier. */
-export declare const CROWDY_DEFAULT_HTTP_ORIGIN = "https://ck.test.crowdedkingdoms.com";
+export declare const CROWDY_DEFAULT_HTTP_ORIGIN = "https://ck.dev.crowdedkingdoms.com";
 /** The same host over WebSocket. A scheme is composed; a hostname is looked up. */
-export declare const CROWDY_DEFAULT_WS_ORIGIN = "wss://ck.test.crowdedkingdoms.com";
+export declare const CROWDY_DEFAULT_WS_ORIGIN = "wss://ck.dev.crowdedkingdoms.com";
 /** The bare hostname, for callers that need to compare rather than dial. */
-export declare const CROWDY_DEFAULT_HOST = "ck.test.crowdedkingdoms.com";
+export declare const CROWDY_DEFAULT_HOST = "ck.dev.crowdedkingdoms.com";
 //# sourceMappingURL=default-origin.d.ts.map

package/dist/default-origin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"default-origin.d.ts","sourceRoot":"","sources":["../src/default-origin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,uDAAuD;AACvD,eAAO,MAAM,mBAAmB,SAAS,CAAC;AAE1C,8CAA8C;AAC9C,eAAO,MAAM,0BAA0B,wCAAwC,CAAC;AAEhF,mFAAmF;AACnF,eAAO,MAAM,wBAAwB,sCAAsC,CAAC;AAE5E,4EAA4E;AAC5E,eAAO,MAAM,mBAAmB,gCAAgC,CAAC"}
+{"version":3,"file":"default-origin.d.ts","sourceRoot":"","sources":["../src/default-origin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,uDAAuD;AACvD,eAAO,MAAM,mBAAmB,QAAQ,CAAC;AAEzC,8CAA8C;AAC9C,eAAO,MAAM,0BAA0B,uCAAuC,CAAC;AAE/E,mFAAmF;AACnF,eAAO,MAAM,wBAAwB,qCAAqC,CAAC;AAE3E,4EAA4E;AAC5E,eAAO,MAAM,mBAAmB,+BAA+B,CAAC"}

package/dist/default-origin.js

@@ -1,6 +1,6 @@
 /**
  * GENERATED — do not edit. The operator tooling's
- * `sync-client-origins.mjs --write --tier test` writes this file, and
+ * `sync-client-origins.mjs --write --tier dev` writes this file, and
  * `check-sdk-default-origin.mjs` refuses it when it names the wrong tier or a
  * host that declaration does not carry. Regenerate; never hand-edit.
  *
@@ -10,13 +10,13 @@
  * than no default at all. Every fallback this SDK ever removed named a host that
  * was already dead. A generated file plus a gate is what makes this one different.
  *
- * Source: the operator's per-tier public CK API origin declaration, tier 'test'
+ * Source: the operator's per-tier public CK API origin declaration, tier 'dev'
  */
 /** The tier this build of the SDK is published for. */
-export const CROWDY_DEFAULT_TIER = 'test';
+export const CROWDY_DEFAULT_TIER = 'dev';
 /** The public CK API origin for that tier. */
-export const CROWDY_DEFAULT_HTTP_ORIGIN = 'https://ck.test.crowdedkingdoms.com';
+export const CROWDY_DEFAULT_HTTP_ORIGIN = 'https://ck.dev.crowdedkingdoms.com';
 /** The same host over WebSocket. A scheme is composed; a hostname is looked up. */
-export const CROWDY_DEFAULT_WS_ORIGIN = 'wss://ck.test.crowdedkingdoms.com';
+export const CROWDY_DEFAULT_WS_ORIGIN = 'wss://ck.dev.crowdedkingdoms.com';
 /** The bare hostname, for callers that need to compare rather than dial. */
-export const CROWDY_DEFAULT_HOST = 'ck.test.crowdedkingdoms.com';
+export const CROWDY_DEFAULT_HOST = 'ck.dev.crowdedkingdoms.com';

package/dist/domains/admin.d.ts

@@ -1,4 +1,5 @@
 import type { OrganizationsAPI } from './organizations.js';
+import type { ManagedPlayersAPI } from './managedPlayers.js';
 import type { AppsAPI } from './apps.js';
 import type { AppAccessAPI } from './appAccess.js';
 import type { BillingAPI } from './billing.js';
@@ -30,6 +31,8 @@ import type { GameAppsAPI } from './gameApps.js';
 export declare class AdminAPI {
     /** Organizations, members, RBAC roles, and org API tokens. */
     readonly organizations: OrganizationsAPI;
+    /** The organization's own players, signed in by the organization (dev only). */
+    readonly managedPlayers: ManagedPlayersAPI;
     /** App registry, routing, and player-code admission policy. */
     readonly apps: AppsAPI;
     /** App access tiers + per-user access grants. */
@@ -48,6 +51,7 @@ export declare class AdminAPI {
     readonly grids: GameAppsAPI;
     constructor(deps: {
         organizations: OrganizationsAPI;
+        managedPlayers: ManagedPlayersAPI;
         apps: AppsAPI;
         appAccess: AppAccessAPI;
         billing: BillingAPI;

package/dist/domains/admin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../../src/domains/admin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAEjD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,QAAQ;IACnB,8DAA8D;IAC9D,QAAQ,CAAC,aAAa,EAAE,gBAAgB,CAAC;IACzC,+DAA+D;IAC/D,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,iDAAiD;IACjD,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC;IACjC,0CAA0C;IAC1C,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,0DAA0D;IAC1D,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,yCAAyC;IACzC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,6CAA6C;IAC7C,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,mEAAmE;IACnE,QAAQ,CAAC,iBAAiB,EAAE,oBAAoB,CAAC;IACjD,0DAA0D;IAC1D,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;gBAEhB,IAAI,EAAE;QAChB,aAAa,EAAE,gBAAgB,CAAC;QAChC,IAAI,EAAE,OAAO,CAAC;QACd,SAAS,EAAE,YAAY,CAAC;QACxB,OAAO,EAAE,UAAU,CAAC;QACpB,QAAQ,EAAE,WAAW,CAAC;QACtB,MAAM,EAAE,SAAS,CAAC;QAClB,KAAK,EAAE,QAAQ,CAAC;QAChB,iBAAiB,EAAE,oBAAoB,CAAC;QACxC,KAAK,EAAE,WAAW,CAAC;KACpB;CAWF"}
+{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../../src/domains/admin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAEjD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,QAAQ;IACnB,8DAA8D;IAC9D,QAAQ,CAAC,aAAa,EAAE,gBAAgB,CAAC;IACzC,gFAAgF;IAChF,QAAQ,CAAC,cAAc,EAAE,iBAAiB,CAAC;IAC3C,+DAA+D;IAC/D,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,iDAAiD;IACjD,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC;IACjC,0CAA0C;IAC1C,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,0DAA0D;IAC1D,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,yCAAyC;IACzC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,6CAA6C;IAC7C,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,mEAAmE;IACnE,QAAQ,CAAC,iBAAiB,EAAE,oBAAoB,CAAC;IACjD,0DAA0D;IAC1D,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;gBAEhB,IAAI,EAAE;QAChB,aAAa,EAAE,gBAAgB,CAAC;QAChC,cAAc,EAAE,iBAAiB,CAAC;QAClC,IAAI,EAAE,OAAO,CAAC;QACd,SAAS,EAAE,YAAY,CAAC;QACxB,OAAO,EAAE,UAAU,CAAC;QACpB,QAAQ,EAAE,WAAW,CAAC;QACtB,MAAM,EAAE,SAAS,CAAC;QAClB,KAAK,EAAE,QAAQ,CAAC;QAChB,iBAAiB,EAAE,oBAAoB,CAAC;QACxC,KAAK,EAAE,WAAW,CAAC;KACpB;CAYF"}

package/dist/domains/admin.js

@@ -21,6 +21,7 @@
 export class AdminAPI {
     constructor(deps) {
         this.organizations = deps.organizations;
+        this.managedPlayers = deps.managedPlayers;
         this.apps = deps.apps;
         this.appAccess = deps.appAccess;
         this.billing = deps.billing;

package/dist/domains/managedPlayers.d.ts

@@ -0,0 +1,99 @@
+import type { GraphQLClient } from '../client.js';
+import { type ManagedPlayersQuery, type ManagedPlayerQuery, type ProvisionManagedPlayersMutation, type UpdateManagedPlayerMutation, type OrgManagedPlayerSettingsQuery, type OrgSigningKeysQuery, type RegisterOrgSigningKeyMutation, type ProvisionManagedPlayersInput, type UpdateManagedPlayerInput, type RegisterOrgSigningKeyInput } from '../generated/graphql.js';
+/** A public key as {@link ManagedPlayersAPI.registerSigningKey} takes it: a JWK object or its JSON. */
+export type OrgSigningKeyRegistration = Omit<RegisterOrgSigningKeyInput, 'publicJwk'> & {
+    publicJwk: string | Record<string, unknown>;
+};
+/**
+ * Org-managed players (dev only): an organization's own players, signed in by the
+ * organization instead of with a Crowded Kingdoms email and password. Exposed as
+ * `client.managedPlayers` (and `client.admin.managedPlayers`).
+ *
+ * An org-managed player has no email, password, session or wallet. Its organization
+ * vouches for it in one of two ways, and either one ends in the player's own app token:
+ *
+ *   - **From its server, with an org token** (`cko_…`, scope `players:mint`): the server calls
+ *     the `mintManagedPlayerToken` mutation itself and hands the response to the player's
+ *     device, which stores it with `client.portal.adoptAppToken`. This SDK has no wrapper for
+ *     that mutation on purpose: an org token signs in any of the organization's players, so
+ *     it never belongs in a browser or a game client, and the API refuses one sent with an
+ *     `Origin` header.
+ *   - **With a signed assertion**: the organization registers a public key here
+ *     ({@link registerSigningKey}), its sign-in service signs a short JWS for the player, and
+ *     the device trades it with `client.portal.exchangeManagedPlayerAssertion`.
+ *
+ * The methods below are the organization's administration. They take an org admin's
+ * session with the `manage_players` permission (or, from the organization's server, an org
+ * token with `players:manage` for the player operations). An operator turns the feature on
+ * for an organization and sets its limits; {@link settings} reads them.
+ *
+ * Every field answers `FEATURE_DISABLED` outside the dev tier.
+ */
+export declare class ManagedPlayersAPI {
+    private readonly api;
+    constructor(api: GraphQLClient);
+    /**
+     * The organization's players in the order they were created, a page at a time (`first`
+     * defaults to 50, at most 200). `search` matches the start of an external id (exactly) or
+     * of a gamertag (any case). Pass `nextCursor` back as `after` for the next page; it is
+     * null on the last.
+     */
+    list(orgId: string, options?: {
+        search?: string;
+        first?: number;
+        after?: string;
+    }): Promise<ManagedPlayersQuery['managedPlayers']>;
+    /** One player by the id the organization knows it by, or null. */
+    get(orgId: string, externalId: string): Promise<ManagedPlayerQuery['managedPlayer']>;
+    /**
+     * Create players ahead of their first sign-in, up to 500 per call (one statement, much
+     * faster than first sign-ins one at a time: pre-provision before a launch). A player
+     * that already exists is left as it is and counted in `existing`.
+     */
+    provision(input: ProvisionManagedPlayersInput): Promise<ProvisionManagedPlayersMutation['provisionManagedPlayers']>;
+    /**
+     * Rename a player, or disable or enable it. Disabling ends every session the player has
+     * (its devices stop at once) and refuses its sign-ins until enabled again. A block a
+     * platform operator set also reads as disabled, and only an operator lifts it.
+     */
+    update(input: UpdateManagedPlayerInput): Promise<UpdateManagedPlayerMutation['updateManagedPlayer']>;
+    /** End every session of a player now (sign it out everywhere); it can sign in again. */
+    endSessions(orgId: string, externalId: string): Promise<boolean>;
+    /**
+     * Delete a player: its sessions end and its account is scrubbed. The external id is free
+     * again, so a later sign-in with it creates a new player.
+     */
+    delete(orgId: string, externalId: string): Promise<boolean>;
+    /**
+     * Whether an operator has turned managed players on for the organization, and its limits:
+     * the player cap, sign-ins per minute and the session lengths. Read-only here.
+     */
+    settings(orgId: string): Promise<OrgManagedPlayerSettingsQuery['orgManagedPlayerSettings']>;
+    /** The organization's assertion signing keys, revoked ones included. */
+    signingKeys(orgId: string): Promise<OrgSigningKeysQuery['orgSigningKeys']>;
+    /**
+     * Register a PUBLIC key the organization's sign-in service signs player assertions with:
+     * `EdDSA` (Ed25519), `ES256` (P-256) or `RS256` (RSA, 2048 bits or more). `publicJwk` may be
+     * the JWK object (for example `publicKey.export({ format: 'jwk' })` in Node) or its JSON.
+     * A JWK with private members is refused. `appIds` limits the key to some of the
+     * organization's apps; `audience` replaces the default `ck:app:<appId>` when the
+     * organization's identity provider sets its own.
+     */
+    registerSigningKey(input: OrgSigningKeyRegistration): Promise<RegisterOrgSigningKeyMutation['registerOrgSigningKey']>;
+    /** Revoke a signing key: assertions it signed are refused from now on. */
+    revokeSigningKey(orgId: string, keyId: string): Promise<boolean>;
+    /**
+     * Whether the organization pays for its managed players' mods in this app. A managed
+     * player has no wallet, so with this off its mods, its Crowdy Studio writes and its use
+     * of the Studio agent are refused with `MANAGED_PLAYER_NOT_ALLOWED`. False for an app the
+     * caller cannot see.
+     */
+    appModsEnabled(appId: string): Promise<boolean>;
+    /**
+     * Switch the organization paying for its managed players' mods in this app on or off
+     * (`manage_billing` on the app). On, their mods' compute, storage and agent use are billed
+     * to the organization; off, those mods are switched off at once.
+     */
+    setAppMods(appId: string, enabled: boolean): Promise<boolean>;
+}
+//# sourceMappingURL=managedPlayers.d.ts.map

package/dist/domains/managedPlayers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"managedPlayers.d.ts","sourceRoot":"","sources":["../../src/domains/managedPlayers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAaL,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,+BAA+B,EACpC,KAAK,2BAA2B,EAChC,KAAK,6BAA6B,EAClC,KAAK,mBAAmB,EACxB,KAAK,6BAA6B,EAClC,KAAK,4BAA4B,EACjC,KAAK,wBAAwB,EAC7B,KAAK,0BAA0B,EAChC,MAAM,yBAAyB,CAAC;AAgBjC,uGAAuG;AACvG,MAAM,MAAM,yBAAyB,GAAG,IAAI,CAAC,0BAA0B,EAAE,WAAW,CAAC,GAAG;IACtF,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC7C,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,qBAAa,iBAAiB;IAChB,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAAH,GAAG,EAAE,aAAa;IAE/C;;;;;OAKG;IACG,IAAI,CACR,KAAK,EAAE,MAAM,EACb,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAChE,OAAO,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;IAKjD,kEAAkE;IAC5D,GAAG,CACP,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAC;IAK/C;;;;OAIG;IACG,SAAS,CACb,KAAK,EAAE,4BAA4B,GAClC,OAAO,CAAC,+BAA+B,CAAC,yBAAyB,CAAC,CAAC;IAKtE;;;;OAIG;IACG,MAAM,CACV,KAAK,EAAE,wBAAwB,GAC9B,OAAO,CAAC,2BAA2B,CAAC,qBAAqB,CAAC,CAAC;IAK9D,wFAAwF;IAClF,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKtE;;;OAGG;IACG,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKjE;;;OAGG;IACG,QAAQ,CACZ,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,6BAA6B,CAAC,0BAA0B,CAAC,CAAC;IAKrE,wEAAwE;IAClE,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;IAKhF;;;;;;;OAOG;IACG,kBAAkB,CACtB,KAAK,EAAE,yBAAyB,GAC/B,OAAO,CAAC,6BAA6B,CAAC,uBAAuB,CAAC,CAAC;IAiBlE,0EAA0E;IACpE,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKtE;;;;;OAKG;IACG,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKrD;;;;OAIG;IACG,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;CAIpE"}

package/dist/domains/managedPlayers.js

@@ -0,0 +1,149 @@
+import { ManagedPlayersDocument, ManagedPlayerDocument, ProvisionManagedPlayersDocument, UpdateManagedPlayerDocument, EndManagedPlayerSessionsDocument, DeleteManagedPlayerDocument, OrgManagedPlayerSettingsDocument, OrgSigningKeysDocument, RegisterOrgSigningKeyDocument, RevokeOrgSigningKeyDocument, AppManagedPlayerModsDocument, SetAppManagedPlayerModsDocument, } from '../generated/graphql.js';
+/** The JWK members that only a private key has (RFC 7518: EC and OKP `d`, RSA's CRT values, `oct`'s `k`). */
+const PRIVATE_JWK_MEMBERS = ['d', 'p', 'q', 'dp', 'dq', 'qi', 'oth', 'k'];
+function privateJwkMember(json) {
+    let parsed;
+    try {
+        parsed = JSON.parse(json);
+    }
+    catch {
+        return null; // not JSON: the API refuses it with its own message
+    }
+    if (!parsed || typeof parsed !== 'object')
+        return null;
+    return PRIVATE_JWK_MEMBERS.find((m) => m in parsed) ?? null;
+}
+/**
+ * Org-managed players (dev only): an organization's own players, signed in by the
+ * organization instead of with a Crowded Kingdoms email and password. Exposed as
+ * `client.managedPlayers` (and `client.admin.managedPlayers`).
+ *
+ * An org-managed player has no email, password, session or wallet. Its organization
+ * vouches for it in one of two ways, and either one ends in the player's own app token:
+ *
+ *   - **From its server, with an org token** (`cko_…`, scope `players:mint`): the server calls
+ *     the `mintManagedPlayerToken` mutation itself and hands the response to the player's
+ *     device, which stores it with `client.portal.adoptAppToken`. This SDK has no wrapper for
+ *     that mutation on purpose: an org token signs in any of the organization's players, so
+ *     it never belongs in a browser or a game client, and the API refuses one sent with an
+ *     `Origin` header.
+ *   - **With a signed assertion**: the organization registers a public key here
+ *     ({@link registerSigningKey}), its sign-in service signs a short JWS for the player, and
+ *     the device trades it with `client.portal.exchangeManagedPlayerAssertion`.
+ *
+ * The methods below are the organization's administration. They take an org admin's
+ * session with the `manage_players` permission (or, from the organization's server, an org
+ * token with `players:manage` for the player operations). An operator turns the feature on
+ * for an organization and sets its limits; {@link settings} reads them.
+ *
+ * Every field answers `FEATURE_DISABLED` outside the dev tier.
+ */
+export class ManagedPlayersAPI {
+    constructor(api) {
+        this.api = api;
+    }
+    /**
+     * The organization's players in the order they were created, a page at a time (`first`
+     * defaults to 50, at most 200). `search` matches the start of an external id (exactly) or
+     * of a gamertag (any case). Pass `nextCursor` back as `after` for the next page; it is
+     * null on the last.
+     */
+    async list(orgId, options = {}) {
+        const data = await this.api.request(ManagedPlayersDocument, { orgId, ...options });
+        return data.managedPlayers;
+    }
+    /** One player by the id the organization knows it by, or null. */
+    async get(orgId, externalId) {
+        const data = await this.api.request(ManagedPlayerDocument, { orgId, externalId });
+        return data.managedPlayer;
+    }
+    /**
+     * Create players ahead of their first sign-in, up to 500 per call (one statement, much
+     * faster than first sign-ins one at a time: pre-provision before a launch). A player
+     * that already exists is left as it is and counted in `existing`.
+     */
+    async provision(input) {
+        const data = await this.api.request(ProvisionManagedPlayersDocument, { input });
+        return data.provisionManagedPlayers;
+    }
+    /**
+     * Rename a player, or disable or enable it. Disabling ends every session the player has
+     * (its devices stop at once) and refuses its sign-ins until enabled again. A block a
+     * platform operator set also reads as disabled, and only an operator lifts it.
+     */
+    async update(input) {
+        const data = await this.api.request(UpdateManagedPlayerDocument, { input });
+        return data.updateManagedPlayer;
+    }
+    /** End every session of a player now (sign it out everywhere); it can sign in again. */
+    async endSessions(orgId, externalId) {
+        const data = await this.api.request(EndManagedPlayerSessionsDocument, { orgId, externalId });
+        return data.endManagedPlayerSessions;
+    }
+    /**
+     * Delete a player: its sessions end and its account is scrubbed. The external id is free
+     * again, so a later sign-in with it creates a new player.
+     */
+    async delete(orgId, externalId) {
+        const data = await this.api.request(DeleteManagedPlayerDocument, { orgId, externalId });
+        return data.deleteManagedPlayer;
+    }
+    /**
+     * Whether an operator has turned managed players on for the organization, and its limits:
+     * the player cap, sign-ins per minute and the session lengths. Read-only here.
+     */
+    async settings(orgId) {
+        const data = await this.api.request(OrgManagedPlayerSettingsDocument, { orgId });
+        return data.orgManagedPlayerSettings;
+    }
+    /** The organization's assertion signing keys, revoked ones included. */
+    async signingKeys(orgId) {
+        const data = await this.api.request(OrgSigningKeysDocument, { orgId });
+        return data.orgSigningKeys;
+    }
+    /**
+     * Register a PUBLIC key the organization's sign-in service signs player assertions with:
+     * `EdDSA` (Ed25519), `ES256` (P-256) or `RS256` (RSA, 2048 bits or more). `publicJwk` may be
+     * the JWK object (for example `publicKey.export({ format: 'jwk' })` in Node) or its JSON.
+     * A JWK with private members is refused. `appIds` limits the key to some of the
+     * organization's apps; `audience` replaces the default `ck:app:<appId>` when the
+     * organization's identity provider sets its own.
+     */
+    async registerSigningKey(input) {
+        const publicJwk = typeof input.publicJwk === 'string' ? input.publicJwk : JSON.stringify(input.publicJwk);
+        // The API refuses a private JWK too; refusing here keeps the private key from ever
+        // leaving the machine that holds it.
+        const privateMember = privateJwkMember(publicJwk);
+        if (privateMember) {
+            throw new TypeError(`registerSigningKey: the JWK carries the private member '${privateMember}'. Register the PUBLIC key only.`);
+        }
+        const data = await this.api.request(RegisterOrgSigningKeyDocument, {
+            input: { ...input, publicJwk },
+        });
+        return data.registerOrgSigningKey;
+    }
+    /** Revoke a signing key: assertions it signed are refused from now on. */
+    async revokeSigningKey(orgId, keyId) {
+        const data = await this.api.request(RevokeOrgSigningKeyDocument, { orgId, keyId });
+        return data.revokeOrgSigningKey;
+    }
+    /**
+     * Whether the organization pays for its managed players' mods in this app. A managed
+     * player has no wallet, so with this off its mods, its Crowdy Studio writes and its use
+     * of the Studio agent are refused with `MANAGED_PLAYER_NOT_ALLOWED`. False for an app the
+     * caller cannot see.
+     */
+    async appModsEnabled(appId) {
+        const data = await this.api.request(AppManagedPlayerModsDocument, { appId });
+        return data.app?.managedPlayerModsEnabled ?? false;
+    }
+    /**
+     * Switch the organization paying for its managed players' mods in this app on or off
+     * (`manage_billing` on the app). On, their mods' compute, storage and agent use are billed
+     * to the organization; off, those mods are switched off at once.
+     */
+    async setAppMods(appId, enabled) {
+        const data = await this.api.request(SetAppManagedPlayerModsDocument, { appId, enabled });
+        return data.setAppManagedPlayerMods;
+    }
+}

package/dist/domains/organizations.d.ts

@@ -91,10 +91,14 @@ export declare class OrganizationsAPI {
     create(input: CreateOrganizationInput): Promise<CreateOrganizationMutation['createOrganization']>;
     /**
      * Mint a new org API token (for server-side studio backends). Requires the
-     * `manage_tokens` org permission. The plaintext secret is returned **once**.
+     * `manage_tokens` org permission. The plaintext secret (`cko_…`) is returned
+     * **once**. Keep it on the organization's server: the API refuses a request
+     * that carries it with an `Origin` header.
      *
      * @param input - {@link CreateOrgTokenInput}: `orgId`, optional `label` and
-     *   `expiresAt`.
+     *   `expiresAt`; for org-managed players (dev only), `scopes`
+     *   (`players:mint`, `players:manage`) and `appIds` (limit the token to some
+     *   of the org's apps). A token with no scope can do nothing.
      * @returns The created token including its one-time plaintext secret.
      */
     createToken(input: CreateOrgTokenInput): Promise<CreateOrgTokenMutation['createOrgToken']>;
@@ -111,9 +115,14 @@ export declare class OrganizationsAPI {
      * Revoke (disable) an org token. Requires the `manage_tokens` org permission.
      *
      * @param orgTokenId - Numeric token id.
+     * @param options - `endSessions: true` also ends every session the token signed
+     *   org-managed players in with (dev only), so their devices stop now rather than at
+     *   their sessions' end.
      * @returns `true` on success.
      */
-    revokeToken(orgTokenId: string): Promise<RevokeOrgTokenMutation['revokeOrgToken']>;
+    revokeToken(orgTokenId: string, options?: {
+        endSessions?: boolean;
+    }): Promise<RevokeOrgTokenMutation['revokeOrgToken']>;
     /**
      * Invite a user to an organization (by email or user id), optionally with
      * initial roles. Requires the `manage_members` org permission.

package/dist/domains/organizations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"organizations.d.ts","sourceRoot":"","sources":["../../src/domains/organizations.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAmBL,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,0BAA0B,EAC/B,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAC5B,KAAK,4BAA4B,EACjC,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,uBAAuB,EAC5B,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACxB,MAAM,yBAAyB,CAAC;AAEjC;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,gBAAgB;IACf,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAAH,GAAG,EAAE,aAAa;IAE/C;;;;;OAKG;IACG,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAC;IAOpE;;;;;OAKG;IACG,MAAM,CACV,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,uBAAuB,CAAC,oBAAoB,CAAC,CAAC;IAOzD;;;;;;OAMG;IACG,IAAI,IAAI,OAAO,CAAC,oBAAoB,CAAC,iBAAiB,CAAC,CAAC;IAK9D;;;;;;OAMG;IACG,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;IAKpE;;;;;;OAMG;IACG,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;IAK9D;;;;;;OAMG;IACG,WAAW,CACf,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;IAO3C;;;;;OAKG;IACG,WAAW,IAAI,OAAO,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;IAKnE;;;;;;OAMG;IACG,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;IAKjE;;;;;;OAMG;IACG,MAAM,CACV,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAAC,0BAA0B,CAAC,oBAAoB,CAAC,CAAC;IAO5D;;;;;;;OAOG;IACG,WAAW,CACf,KAAK,EAAE,mBAAmB,GACzB,OAAO,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,CAAC;IAOpD;;;;;;;OAOG;IACG,WAAW,CACf,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,mBAAmB,GACzB,OAAO,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,CAAC;IAQpD;;;;;OAKG;IACG,WAAW,CACf,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,CAAC;IAOpD;;;;;;OAMG;IACG,YAAY,CAChB,KAAK,EAAE,oBAAoB,GAC1B,OAAO,CAAC,uBAAuB,CAAC,iBAAiB,CAAC,CAAC;IAOtD;;;;;;;OAOG;IACG,YAAY,CAChB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,uBAAuB,CAAC,iBAAiB,CAAC,CAAC;IAQtD;;;;;;;;OAQG;IACG,cAAc,CAClB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EAAE,GAChB,OAAO,CAAC,4BAA4B,CAAC,sBAAsB,CAAC,CAAC;IAShE;;;;;;;OAOG;IACG,UAAU,CACd,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC,qBAAqB,CAAC,eAAe,CAAC,CAAC;IAOlD;;;;;;;OAOG;IACG,UAAU,CACd,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC,qBAAqB,CAAC,eAAe,CAAC,CAAC;IAQlD;;;;;;OAMG;IACG,UAAU,CACd,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,qBAAqB,CAAC,eAAe,CAAC,CAAC;CAMnD"}
+{"version":3,"file":"organizations.d.ts","sourceRoot":"","sources":["../../src/domains/organizations.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAmBL,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,0BAA0B,EAC/B,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAC5B,KAAK,4BAA4B,EACjC,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,uBAAuB,EAC5B,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACxB,MAAM,yBAAyB,CAAC;AAEjC;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,gBAAgB;IACf,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAAH,GAAG,EAAE,aAAa;IAE/C;;;;;OAKG;IACG,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAC;IAOpE;;;;;OAKG;IACG,MAAM,CACV,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,uBAAuB,CAAC,oBAAoB,CAAC,CAAC;IAOzD;;;;;;OAMG;IACG,IAAI,IAAI,OAAO,CAAC,oBAAoB,CAAC,iBAAiB,CAAC,CAAC;IAK9D;;;;;;OAMG;IACG,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;IAKpE;;;;;;OAMG;IACG,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;IAK9D;;;;;;OAMG;IACG,WAAW,CACf,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;IAO3C;;;;;OAKG;IACG,WAAW,IAAI,OAAO,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;IAKnE;;;;;;OAMG;IACG,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;IAKjE;;;;;;OAMG;IACG,MAAM,CACV,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAAC,0BAA0B,CAAC,oBAAoB,CAAC,CAAC;IAO5D;;;;;;;;;;;OAWG;IACG,WAAW,CACf,KAAK,EAAE,mBAAmB,GACzB,OAAO,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,CAAC;IAOpD;;;;;;;OAOG;IACG,WAAW,CACf,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,mBAAmB,GACzB,OAAO,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,CAAC;IAQpD;;;;;;;;OAQG;IACG,WAAW,CACf,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE;QAAE,WAAW,CAAC,EAAE,OAAO,CAAA;KAAO,GACtC,OAAO,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,CAAC;IAQpD;;;;;;OAMG;IACG,YAAY,CAChB,KAAK,EAAE,oBAAoB,GAC1B,OAAO,CAAC,uBAAuB,CAAC,iBAAiB,CAAC,CAAC;IAOtD;;;;;;;OAOG;IACG,YAAY,CAChB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,uBAAuB,CAAC,iBAAiB,CAAC,CAAC;IAQtD;;;;;;;;OAQG;IACG,cAAc,CAClB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EAAE,GAChB,OAAO,CAAC,4BAA4B,CAAC,sBAAsB,CAAC,CAAC;IAShE;;;;;;;OAOG;IACG,UAAU,CACd,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC,qBAAqB,CAAC,eAAe,CAAC,CAAC;IAOlD;;;;;;;OAOG;IACG,UAAU,CACd,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC,qBAAqB,CAAC,eAAe,CAAC,CAAC;IAQlD;;;;;;OAMG;IACG,UAAU,CACd,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,qBAAqB,CAAC,eAAe,CAAC,CAAC;CAMnD"}

package/dist/domains/organizations.js

@@ -126,10 +126,14 @@ export class OrganizationsAPI {
     }
     /**
      * Mint a new org API token (for server-side studio backends). Requires the
-     * `manage_tokens` org permission. The plaintext secret is returned **once**.
+     * `manage_tokens` org permission. The plaintext secret (`cko_…`) is returned
+     * **once**. Keep it on the organization's server: the API refuses a request
+     * that carries it with an `Origin` header.
      *
      * @param input - {@link CreateOrgTokenInput}: `orgId`, optional `label` and
-     *   `expiresAt`.
+     *   `expiresAt`; for org-managed players (dev only), `scopes`
+     *   (`players:mint`, `players:manage`) and `appIds` (limit the token to some
+     *   of the org's apps). A token with no scope can do nothing.
      * @returns The created token including its one-time plaintext secret.
      */
     async createToken(input) {
@@ -157,11 +161,15 @@ export class OrganizationsAPI {
      * Revoke (disable) an org token. Requires the `manage_tokens` org permission.
      *
      * @param orgTokenId - Numeric token id.
+     * @param options - `endSessions: true` also ends every session the token signed
+     *   org-managed players in with (dev only), so their devices stop now rather than at
+     *   their sessions' end.
      * @returns `true` on success.
      */
-    async revokeToken(orgTokenId) {
+    async revokeToken(orgTokenId, options = {}) {
         const data = await this.api.request(RevokeOrgTokenDocument, {
             orgTokenId,
+            ...(options.endSessions === undefined ? {} : { endSessions: options.endSessions }),
         });
         return data.revokeOrgToken;
     }