@crowdedkingdoms/crowdyjs 18.15.0 → 18.17.0-dev.1

package/dist/domains/managedPlayers.js

@@ -0,0 +1,162 @@
+import { ManagedPlayersDocument, ManagedPlayerDocument, ProvisionManagedPlayersDocument, UpdateManagedPlayerDocument, EndManagedPlayerSessionsDocument, DeleteManagedPlayerDocument, OrgManagedPlayerSettingsDocument, OrgSigningKeysDocument, RegisterOrgSigningKeyDocument, RevokeOrgSigningKeyDocument, AppManagedPlayerModsDocument, SetAppManagedPlayerModsDocument, } from '../generated/graphql.js';
+/** The JWK members that only a private key has (RFC 7518: EC and OKP `d`, RSA's CRT values, `oct`'s `k`). */
+const PRIVATE_JWK_MEMBERS = ['d', 'p', 'q', 'dp', 'dq', 'qi', 'oth', 'k'];
+function privateJwkMember(json) {
+    let parsed;
+    try {
+        parsed = JSON.parse(json);
+    }
+    catch {
+        return null; // not JSON: the API refuses it with its own message
+    }
+    if (!parsed || typeof parsed !== 'object')
+        return null;
+    return PRIVATE_JWK_MEMBERS.find((m) => m in parsed) ?? null;
+}
+/**
+ * Org-managed players: an organization's own players, signed in by the organization
+ * instead of with a Crowded Kingdoms email and password. Exposed as
+ * `client.managedPlayers` (and `client.admin.managedPlayers`).
+ *
+ * An org-managed player has no email, password, session or wallet. Its organization
+ * vouches for it in one of two ways, and either one ends in the player's own app token:
+ *
+ *   - **From its server, with an org token** (`cko_…`, scope `players:mint`): the server calls
+ *     the `mintManagedPlayerToken` mutation itself and hands the response to the player's
+ *     device, which stores it with `client.portal.adoptAppToken`. This SDK has no wrapper for
+ *     that mutation on purpose: an org token signs in any of the organization's players, so
+ *     it never belongs in a browser or a game client, and the API refuses one sent with an
+ *     `Origin` header.
+ *   - **With a signed assertion**: the organization registers a public key here
+ *     ({@link registerSigningKey}), its sign-in service signs a short JWS for the player, and
+ *     the device trades it with `client.portal.exchangeManagedPlayerAssertion`.
+ *
+ * The methods below are the organization's administration. They take an org admin's
+ * session with the `manage_players` permission (or, from the organization's server, an org
+ * token with `players:manage` for the player operations). An operator turns the feature on
+ * for an organization and sets its limits; {@link settings} reads them.
+ *
+ * **The Org-Managed Players Addendum** (ck-api v2.53.0). Before any of the organization's
+ * players is created or signed in, an admin of the organization accepts the addendum in
+ * Studio, on the organization's Players tab. Until then sign-ins (both ways), refreshes and
+ * {@link provision} answer `ORG_LEGAL_ACCEPTANCE_REQUIRED` (`orgLegalAcceptanceRequiredOf`).
+ * {@link settings} reports `termsVersion`, `termsUrl`, `termsAccepted` and whether the
+ * signed-in user may accept (`viewerMayAcceptTerms`). This SDK has no wrapper for the
+ * acceptance on purpose: it binds the organization, so a person makes it, in Studio.
+ *
+ * A tier that does not serve org-managed players answers `FEATURE_DISABLED` to every field.
+ */
+export class ManagedPlayersAPI {
+    constructor(api) {
+        this.api = api;
+    }
+    /**
+     * The organization's players in the order they were created, a page at a time (`first`
+     * defaults to 50, at most 200). `search` matches the start of an external id (exactly) or
+     * of a gamertag (any case). Pass `nextCursor` back as `after` for the next page; it is
+     * null on the last.
+     */
+    async list(orgId, options = {}) {
+        const data = await this.api.request(ManagedPlayersDocument, { orgId, ...options });
+        return data.managedPlayers;
+    }
+    /** One player by the id the organization knows it by, or null. */
+    async get(orgId, externalId) {
+        const data = await this.api.request(ManagedPlayerDocument, { orgId, externalId });
+        return data.managedPlayer;
+    }
+    /**
+     * Create players ahead of their first sign-in, up to 500 per call (one statement, much
+     * faster than first sign-ins one at a time: pre-provision before a launch). A player
+     * that already exists is left as it is and counted in `existing`. Refused with
+     * `ORG_LEGAL_ACCEPTANCE_REQUIRED` until the organization has accepted the current
+     * Org-Managed Players Addendum.
+     */
+    async provision(input) {
+        const data = await this.api.request(ProvisionManagedPlayersDocument, { input });
+        return data.provisionManagedPlayers;
+    }
+    /**
+     * Rename a player, or disable or enable it. Disabling ends every session the player has
+     * (its devices stop at once) and refuses its sign-ins until enabled again. A block a
+     * platform operator set also reads as disabled, and only an operator lifts it.
+     */
+    async update(input) {
+        const data = await this.api.request(UpdateManagedPlayerDocument, { input });
+        return data.updateManagedPlayer;
+    }
+    /** End every session of a player now (sign it out everywhere); it can sign in again. */
+    async endSessions(orgId, externalId) {
+        const data = await this.api.request(EndManagedPlayerSessionsDocument, { orgId, externalId });
+        return data.endManagedPlayerSessions;
+    }
+    /**
+     * Delete a player: its sessions end and its account is scrubbed. The external id is free
+     * again, so a later sign-in with it creates a new player.
+     */
+    async delete(orgId, externalId) {
+        const data = await this.api.request(DeleteManagedPlayerDocument, { orgId, externalId });
+        return data.deleteManagedPlayer;
+    }
+    /**
+     * Whether an operator has turned managed players on for the organization, and its limits:
+     * the player cap, sign-ins per minute and the session lengths. Also where the organization
+     * stands on the Org-Managed Players Addendum: the current `termsVersion` and `termsUrl`,
+     * `termsAccepted`, the latest acceptance, and `viewerMayAcceptTerms` (whether the signed-in
+     * user is an admin of the organization who may accept it, in Studio). Read-only here.
+     */
+    async settings(orgId) {
+        const data = await this.api.request(OrgManagedPlayerSettingsDocument, { orgId });
+        return data.orgManagedPlayerSettings;
+    }
+    /** The organization's assertion signing keys, revoked ones included. */
+    async signingKeys(orgId) {
+        const data = await this.api.request(OrgSigningKeysDocument, { orgId });
+        return data.orgSigningKeys;
+    }
+    /**
+     * Register a PUBLIC key the organization's sign-in service signs player assertions with:
+     * `EdDSA` (Ed25519), `ES256` (P-256) or `RS256` (RSA, 2048 bits or more). `publicJwk` may be
+     * the JWK object (for example `publicKey.export({ format: 'jwk' })` in Node) or its JSON.
+     * A JWK with private members is refused. `appIds` limits the key to some of the
+     * organization's apps; `audience` replaces the default `ck:app:<appId>` when the
+     * organization's identity provider sets its own.
+     */
+    async registerSigningKey(input) {
+        const publicJwk = typeof input.publicJwk === 'string' ? input.publicJwk : JSON.stringify(input.publicJwk);
+        // The API refuses a private JWK too; refusing here keeps the private key from ever
+        // leaving the machine that holds it.
+        const privateMember = privateJwkMember(publicJwk);
+        if (privateMember) {
+            throw new TypeError(`registerSigningKey: the JWK carries the private member '${privateMember}'. Register the PUBLIC key only.`);
+        }
+        const data = await this.api.request(RegisterOrgSigningKeyDocument, {
+            input: { ...input, publicJwk },
+        });
+        return data.registerOrgSigningKey;
+    }
+    /** Revoke a signing key: assertions it signed are refused from now on. */
+    async revokeSigningKey(orgId, keyId) {
+        const data = await this.api.request(RevokeOrgSigningKeyDocument, { orgId, keyId });
+        return data.revokeOrgSigningKey;
+    }
+    /**
+     * Whether the organization pays for its managed players' mods in this app. A managed
+     * player has no wallet, so with this off its mods, its Crowdy Studio writes and its use
+     * of the Studio agent are refused with `MANAGED_PLAYER_NOT_ALLOWED`. False for an app the
+     * caller cannot see.
+     */
+    async appModsEnabled(appId) {
+        const data = await this.api.request(AppManagedPlayerModsDocument, { appId });
+        return data.app?.managedPlayerModsEnabled ?? false;
+    }
+    /**
+     * Switch the organization paying for its managed players' mods in this app on or off
+     * (`manage_billing` on the app). On, their mods' compute, storage and agent use are billed
+     * to the organization; off, those mods are switched off at once.
+     */
+    async setAppMods(appId, enabled) {
+        const data = await this.api.request(SetAppManagedPlayerModsDocument, { appId, enabled });
+        return data.setAppManagedPlayerMods;
+    }
+}

package/dist/domains/organizations.d.ts

@@ -91,10 +91,14 @@ export declare class OrganizationsAPI {
     create(input: CreateOrganizationInput): Promise<CreateOrganizationMutation['createOrganization']>;
     /**
      * Mint a new org API token (for server-side studio backends). Requires the
-     * `manage_tokens` org permission. The plaintext secret is returned **once**.
+     * `manage_tokens` org permission. The plaintext secret (`cko_…`) is returned
+     * **once**. Keep it on the organization's server: the API refuses a request
+     * that carries it with an `Origin` header.
      *
      * @param input - {@link CreateOrgTokenInput}: `orgId`, optional `label` and
-     *   `expiresAt`.
+     *   `expiresAt`; for org-managed players, `scopes`
+     *   (`players:mint`, `players:manage`) and `appIds` (limit the token to some
+     *   of the org's apps). A token with no scope can do nothing.
      * @returns The created token including its one-time plaintext secret.
      */
     createToken(input: CreateOrgTokenInput): Promise<CreateOrgTokenMutation['createOrgToken']>;
@@ -111,9 +115,14 @@ export declare class OrganizationsAPI {
      * Revoke (disable) an org token. Requires the `manage_tokens` org permission.
      *
      * @param orgTokenId - Numeric token id.
+     * @param options - `endSessions: true` also ends every session the token signed
+     *   org-managed players in with, so their devices stop now rather than at
+     *   their sessions' end.
      * @returns `true` on success.
      */
-    revokeToken(orgTokenId: string): Promise<RevokeOrgTokenMutation['revokeOrgToken']>;
+    revokeToken(orgTokenId: string, options?: {
+        endSessions?: boolean;
+    }): Promise<RevokeOrgTokenMutation['revokeOrgToken']>;
     /**
      * Invite a user to an organization (by email or user id), optionally with
      * initial roles. Requires the `manage_members` org permission.

package/dist/domains/organizations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"organizations.d.ts","sourceRoot":"","sources":["../../src/domains/organizations.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAmBL,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,0BAA0B,EAC/B,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAC5B,KAAK,4BAA4B,EACjC,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,uBAAuB,EAC5B,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACxB,MAAM,yBAAyB,CAAC;AAEjC;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,gBAAgB;IACf,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAAH,GAAG,EAAE,aAAa;IAE/C;;;;;OAKG;IACG,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAC;IAOpE;;;;;OAKG;IACG,MAAM,CACV,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,uBAAuB,CAAC,oBAAoB,CAAC,CAAC;IAOzD;;;;;;OAMG;IACG,IAAI,IAAI,OAAO,CAAC,oBAAoB,CAAC,iBAAiB,CAAC,CAAC;IAK9D;;;;;;OAMG;IACG,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;IAKpE;;;;;;OAMG;IACG,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;IAK9D;;;;;;OAMG;IACG,WAAW,CACf,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;IAO3C;;;;;OAKG;IACG,WAAW,IAAI,OAAO,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;IAKnE;;;;;;OAMG;IACG,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;IAKjE;;;;;;OAMG;IACG,MAAM,CACV,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAAC,0BAA0B,CAAC,oBAAoB,CAAC,CAAC;IAO5D;;;;;;;OAOG;IACG,WAAW,CACf,KAAK,EAAE,mBAAmB,GACzB,OAAO,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,CAAC;IAOpD;;;;;;;OAOG;IACG,WAAW,CACf,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,mBAAmB,GACzB,OAAO,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,CAAC;IAQpD;;;;;OAKG;IACG,WAAW,CACf,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,CAAC;IAOpD;;;;;;OAMG;IACG,YAAY,CAChB,KAAK,EAAE,oBAAoB,GAC1B,OAAO,CAAC,uBAAuB,CAAC,iBAAiB,CAAC,CAAC;IAOtD;;;;;;;OAOG;IACG,YAAY,CAChB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,uBAAuB,CAAC,iBAAiB,CAAC,CAAC;IAQtD;;;;;;;;OAQG;IACG,cAAc,CAClB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EAAE,GAChB,OAAO,CAAC,4BAA4B,CAAC,sBAAsB,CAAC,CAAC;IAShE;;;;;;;OAOG;IACG,UAAU,CACd,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC,qBAAqB,CAAC,eAAe,CAAC,CAAC;IAOlD;;;;;;;OAOG;IACG,UAAU,CACd,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC,qBAAqB,CAAC,eAAe,CAAC,CAAC;IAQlD;;;;;;OAMG;IACG,UAAU,CACd,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,qBAAqB,CAAC,eAAe,CAAC,CAAC;CAMnD"}
+{"version":3,"file":"organizations.d.ts","sourceRoot":"","sources":["../../src/domains/organizations.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAmBL,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,0BAA0B,EAC/B,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAC5B,KAAK,4BAA4B,EACjC,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,uBAAuB,EAC5B,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACxB,MAAM,yBAAyB,CAAC;AAEjC;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,gBAAgB;IACf,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAAH,GAAG,EAAE,aAAa;IAE/C;;;;;OAKG;IACG,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAC;IAOpE;;;;;OAKG;IACG,MAAM,CACV,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,uBAAuB,CAAC,oBAAoB,CAAC,CAAC;IAOzD;;;;;;OAMG;IACG,IAAI,IAAI,OAAO,CAAC,oBAAoB,CAAC,iBAAiB,CAAC,CAAC;IAK9D;;;;;;OAMG;IACG,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;IAKpE;;;;;;OAMG;IACG,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;IAK9D;;;;;;OAMG;IACG,WAAW,CACf,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;IAO3C;;;;;OAKG;IACG,WAAW,IAAI,OAAO,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;IAKnE;;;;;;OAMG;IACG,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;IAKjE;;;;;;OAMG;IACG,MAAM,CACV,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAAC,0BAA0B,CAAC,oBAAoB,CAAC,CAAC;IAO5D;;;;;;;;;;;OAWG;IACG,WAAW,CACf,KAAK,EAAE,mBAAmB,GACzB,OAAO,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,CAAC;IAOpD;;;;;;;OAOG;IACG,WAAW,CACf,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,mBAAmB,GACzB,OAAO,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,CAAC;IAQpD;;;;;;;;OAQG;IACG,WAAW,CACf,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE;QAAE,WAAW,CAAC,EAAE,OAAO,CAAA;KAAO,GACtC,OAAO,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,CAAC;IAQpD;;;;;;OAMG;IACG,YAAY,CAChB,KAAK,EAAE,oBAAoB,GAC1B,OAAO,CAAC,uBAAuB,CAAC,iBAAiB,CAAC,CAAC;IAOtD;;;;;;;OAOG;IACG,YAAY,CAChB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,uBAAuB,CAAC,iBAAiB,CAAC,CAAC;IAQtD;;;;;;;;OAQG;IACG,cAAc,CAClB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EAAE,GAChB,OAAO,CAAC,4BAA4B,CAAC,sBAAsB,CAAC,CAAC;IAShE;;;;;;;OAOG;IACG,UAAU,CACd,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC,qBAAqB,CAAC,eAAe,CAAC,CAAC;IAOlD;;;;;;;OAOG;IACG,UAAU,CACd,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC,qBAAqB,CAAC,eAAe,CAAC,CAAC;IAQlD;;;;;;OAMG;IACG,UAAU,CACd,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,qBAAqB,CAAC,eAAe,CAAC,CAAC;CAMnD"}

package/dist/domains/organizations.js

@@ -126,10 +126,14 @@ export class OrganizationsAPI {
     }
     /**
      * Mint a new org API token (for server-side studio backends). Requires the
-     * `manage_tokens` org permission. The plaintext secret is returned **once**.
+     * `manage_tokens` org permission. The plaintext secret (`cko_…`) is returned
+     * **once**. Keep it on the organization's server: the API refuses a request
+     * that carries it with an `Origin` header.
      *
      * @param input - {@link CreateOrgTokenInput}: `orgId`, optional `label` and
-     *   `expiresAt`.
+     *   `expiresAt`; for org-managed players, `scopes`
+     *   (`players:mint`, `players:manage`) and `appIds` (limit the token to some
+     *   of the org's apps). A token with no scope can do nothing.
      * @returns The created token including its one-time plaintext secret.
      */
     async createToken(input) {
@@ -157,11 +161,15 @@ export class OrganizationsAPI {
      * Revoke (disable) an org token. Requires the `manage_tokens` org permission.
      *
      * @param orgTokenId - Numeric token id.
+     * @param options - `endSessions: true` also ends every session the token signed
+     *   org-managed players in with, so their devices stop now rather than at
+     *   their sessions' end.
      * @returns `true` on success.
      */
-    async revokeToken(orgTokenId) {
+    async revokeToken(orgTokenId, options = {}) {
         const data = await this.api.request(RevokeOrgTokenDocument, {
             orgTokenId,
+            ...(options.endSessions === undefined ? {} : { endSessions: options.endSessions }),
         });
         return data.revokeOrgToken;
     }

package/dist/domains/portal.d.ts

@@ -275,6 +275,39 @@ export declare class PortalAPI {
      * back through {@link signIn}, where `/authorize` asks for them.
      */
     refresh(currentServer?: CurrentServer): Promise<AppTokenResponse>;
+    /**
+     * Store an app token the player's organization minted for it, so this client plays with
+     * it and {@link refresh} rotates it. For an org-managed player: the organization's server
+     * calls `mintManagedPlayerToken` with its org token and sends the response to the
+     * player's device, which passes it here. Returns the response unchanged; point the game
+     * client at its `gameApiUrl` / `gameApiWsUrl` as after any mint.
+     *
+     * The token refreshes until the sign-in's lifetime (the organization's setting) ends;
+     * after that `refresh()` is refused and the device gets a new token from its organization.
+     * A refresh is also refused with `ORG_LEGAL_ACCEPTANCE_REQUIRED`
+     * ({@link orgLegalAcceptanceRequiredOf}) while the organization has not accepted the
+     * current Org-Managed Players Addendum; only an admin of the organization can fix that.
+     *
+     * Refuses an org token (`cko_…`). That is the organization's server credential: it signs
+     * in any of the organization's players, so a device must never hold one.
+     */
+    adoptAppToken(response: AppTokenResponse): AppTokenResponse;
+    /**
+     * Trade an assertion the player's organization signed for the player's app token, and
+     * store it (as {@link adoptAppToken} does). For an org-managed player whose organization
+     * registered a signing key: its sign-in service signs a short JWS for the player and the
+     * device brings it here. Public: needs no session and no org token.
+     *
+     * Each assertion works once. A refusal is `ASSERTION_REJECTED`, with the failed check in
+     * `extensions.reason` ({@link assertionRejectedOf}); resending the same assertion cannot
+     * succeed, so ask the sign-in service for a new one. A valid assertion is refused with
+     * `ORG_LEGAL_ACCEPTANCE_REQUIRED` ({@link orgLegalAcceptanceRequiredOf}) while the
+     * organization has not accepted the current Org-Managed Players Addendum.
+     */
+    exchangeManagedPlayerAssertion(params: {
+        appId: string;
+        assertion: string;
+    }): Promise<AppTokenResponse>;
     /** Whether portaling into an app needs a consent prompt (Overworld side). */
     getConsent(appId: string): Promise<PortalConsentState>;
     /** Record the user's consent for an app (call from the consent screen). */

package/dist/domains/portal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"portal.d.ts","sourceRoot":"","sources":["../../src/domains/portal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAIH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAElD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAEnD;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,WAAW,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IACpE,qFAAqF;IACrF,MAAM,EAAE,cAAc,GAAG,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,gBAAgB;IAC/B,gFAAgF;IAChF,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,0DAA0D;IAC1D,KAAK,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,SAAS,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,sDAAsD;IACtD,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B;;;;;;;;;;;;;;;OAeG;IACH,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,sDAAsD;IACtD,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC9D;;;;OAIG;IACH,WAAW,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC;CACrC;AAED,gIAAgI;AAChI,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,8EAA8E;AAC9E,MAAM,WAAW,SAAS;IACxB,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC3D,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7C;AAED,iFAAiF;AACjF,qBAAa,uBAAwB,YAAW,SAAS;IAC3C,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,SAAmB;IACtD,OAAO,CAAC,EAAE;IAGV,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAGjC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI;IAG1C,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;CAG5B;AA8CD,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,kEAAkE;IAClE,OAAO,EAAE,OAAO,CAAC;IACjB,cAAc,EAAE,OAAO,CAAC;IACxB,8EAA8E;IAC9E,eAAe,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,qFAAqF;AACrF,qBAAa,0BAA2B,SAAQ,KAAK;aAEjC,KAAK,EAAE,MAAM;aACb,OAAO,EAAE,MAAM,GAAG,IAAI;gBADtB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,GAAG,IAAI;CAKzC;AA4CD,MAAM,WAAW,gBAAgB;IAC/B,sCAAsC;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,wFAAwF;IACxF,YAAY,EAAE,MAAM,CAAC;IACrB,uEAAuE;IACvE,WAAW,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,sCAAsC;IACtC,KAAK,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAYtE;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAgBnE;AAED;;;;;;;;GAQG;AACH,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAkBtE;AAED,qBAAa,SAAS;IAElB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,YAAY;gBARZ,GAAG,EAAE,aAAa,EAClB,OAAO,EAAE,YAAY,EACrB,SAAS,GAAE,SAAyC;IACrE;;;;OAIG;IACc,YAAY,GAAE,YAAY,GAAG,IAAW;IAG3D,8FAA8F;IAC9F,gBAAgB;IAIhB;;;;;;;OAOG;IACG,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAO5D;;;;;OAKG;IACG,uBAAuB,CAAC,MAAM,EAAE;QACpC,KAAK,EAAE,MAAM,CAAC;QACd,aAAa,EAAE,MAAM,CAAC;QACtB,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,WAAW,EAAE,MAAM,CAAC;KACrB,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAQpC;;;;OAIG;IACG,YAAY,CAChB,IAAI,EAAE,MAAM,EACZ,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,gBAAgB,CAAC;IAQ5B;;;;;;;;;OASG;IACG,OAAO,CAAC,aAAa,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAgBvE,6EAA6E;IACvE,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAK5D,2EAA2E;IACrE,YAAY,CAChB,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,MAAM,EAAE,GAChB,OAAO,CAAC,qBAAqB,CAAC;IAOjC,gFAAgF;IAC1E,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAO7D,+DAA+D;IACzD,gBAAgB,IAAI,OAAO,CAAC,qBAAqB,EAAE,CAAC;IAK1D,8EAA8E;IACxE,oBAAoB,CAAC,KAAK,EAAE;QAChC,KAAK,EAAE,MAAM,CAAC;QACd,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QACxB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAS/B;;;;;;;;;;;;;;;;;OAiBG;IACG,MAAM,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC;IA8BnD;;;;;;OAMG;IACG,oBAAoB,CACxB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAQnC;;;;OAIG;IACG,UAAU,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC;IAa3D;;;;;;OAMG;IACG,sBAAsB,CAC1B,MAAM,CAAC,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GACtD,OAAO,CAAC,MAAM,CAAC;IAoClB;;;;;OAKG;IACG,aAAa,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;CAmBvE"}
+{"version":3,"file":"portal.d.ts","sourceRoot":"","sources":["../../src/domains/portal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAIH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAElD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAEnD;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,WAAW,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IACpE,qFAAqF;IACrF,MAAM,EAAE,cAAc,GAAG,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,gBAAgB;IAC/B,gFAAgF;IAChF,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,0DAA0D;IAC1D,KAAK,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,SAAS,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,sDAAsD;IACtD,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B;;;;;;;;;;;;;;;OAeG;IACH,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,sDAAsD;IACtD,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC9D;;;;OAIG;IACH,WAAW,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC;CACrC;AAED,gIAAgI;AAChI,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,8EAA8E;AAC9E,MAAM,WAAW,SAAS;IACxB,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC3D,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7C;AAED,iFAAiF;AACjF,qBAAa,uBAAwB,YAAW,SAAS;IAC3C,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,SAAmB;IACtD,OAAO,CAAC,EAAE;IAGV,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAGjC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI;IAG1C,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;CAG5B;AAwDD,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,kEAAkE;IAClE,OAAO,EAAE,OAAO,CAAC;IACjB,cAAc,EAAE,OAAO,CAAC;IACxB,8EAA8E;IAC9E,eAAe,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,qFAAqF;AACrF,qBAAa,0BAA2B,SAAQ,KAAK;aAEjC,KAAK,EAAE,MAAM;aACb,OAAO,EAAE,MAAM,GAAG,IAAI;gBADtB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,GAAG,IAAI;CAKzC;AA4CD,MAAM,WAAW,gBAAgB;IAC/B,sCAAsC;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,wFAAwF;IACxF,YAAY,EAAE,MAAM,CAAC;IACrB,uEAAuE;IACvE,WAAW,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,sCAAsC;IACtC,KAAK,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAYtE;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAgBnE;AAED;;;;;;;;GAQG;AACH,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAmBtE;AAED,qBAAa,SAAS;IAElB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,YAAY;gBARZ,GAAG,EAAE,aAAa,EAClB,OAAO,EAAE,YAAY,EACrB,SAAS,GAAE,SAAyC;IACrE;;;;OAIG;IACc,YAAY,GAAE,YAAY,GAAG,IAAW;IAG3D,8FAA8F;IAC9F,gBAAgB;IAIhB;;;;;;;OAOG;IACG,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAO5D;;;;;OAKG;IACG,uBAAuB,CAAC,MAAM,EAAE;QACpC,KAAK,EAAE,MAAM,CAAC;QACd,aAAa,EAAE,MAAM,CAAC;QACtB,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,WAAW,EAAE,MAAM,CAAC;KACrB,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAQpC;;;;OAIG;IACG,YAAY,CAChB,IAAI,EAAE,MAAM,EACZ,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,gBAAgB,CAAC;IAQ5B;;;;;;;;;OASG;IACG,OAAO,CAAC,aAAa,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAgBvE;;;;;;;;;;;;;;;OAeG;IACH,aAAa,CAAC,QAAQ,EAAE,gBAAgB,GAAG,gBAAgB;IAc3D;;;;;;;;;;;OAWG;IACG,8BAA8B,CAAC,MAAM,EAAE;QAC3C,KAAK,EAAE,MAAM,CAAC;QACd,SAAS,EAAE,MAAM,CAAC;KACnB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAU7B,6EAA6E;IACvE,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAK5D,2EAA2E;IACrE,YAAY,CAChB,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,MAAM,EAAE,GAChB,OAAO,CAAC,qBAAqB,CAAC;IAOjC,gFAAgF;IAC1E,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAO7D,+DAA+D;IACzD,gBAAgB,IAAI,OAAO,CAAC,qBAAqB,EAAE,CAAC;IAK1D,8EAA8E;IACxE,oBAAoB,CAAC,KAAK,EAAE;QAChC,KAAK,EAAE,MAAM,CAAC;QACd,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QACxB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAS/B;;;;;;;;;;;;;;;;;OAiBG;IACG,MAAM,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC;IA8BnD;;;;;;OAMG;IACG,oBAAoB,CACxB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAQnC;;;;OAIG;IACG,UAAU,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC;IAa3D;;;;;;OAMG;IACG,sBAAsB,CAC1B,MAAM,CAAC,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GACtD,OAAO,CAAC,MAAM,CAAC;IAoClB;;;;;OAKG;IACG,aAAa,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;CAmBvE"}

package/dist/domains/portal.js

@@ -65,6 +65,9 @@ const RefreshAppTokenDocument = parse(`mutation RefreshAppToken { refreshAppToke
 // Asked for only when a server is named, so a client against a Game API older than
 // v1.83.7 (no `currentServer` argument, no `authorizedServer` field) keeps refreshing.
 const RefreshAppTokenOnServerDocument = parse(`mutation RefreshAppTokenOnServer($currentServer: CurrentServerInput) { refreshAppToken(currentServer: $currentServer) { ${APP_TOKEN_FIELDS} authorizedServer { ip4 clientPort } } }`);
+const ExchangeManagedPlayerAssertionDocument = parse(`mutation ExchangeManagedPlayerAssertion($input: ExchangeManagedPlayerAssertionInput!) { exchangeManagedPlayerAssertion(input: $input) { ${APP_TOKEN_FIELDS} } }`);
+/** What every org token starts with: an organization's server credential, never a device's. */
+const ORG_TOKEN_PREFIX = 'cko_';
 /** Thrown by {@link PortalAPI.handleAuthorizeRequest} when the user must consent. */
 export class PortalConsentRequiredError extends Error {
     constructor(appId, appName) {
@@ -135,7 +138,8 @@ export function isLegalAcceptanceRequiredError(error) {
     ];
     if (codes.includes('LEGAL_ACCEPTANCE_REQUIRED'))
         return true;
-    return /LEGAL_ACCEPTANCE_REQUIRED/.test(typeof e?.message === 'string' ? e.message : '');
+    // Not the organization's ORG_LEGAL_ACCEPTANCE_REQUIRED: no player clickwrap answers that.
+    return /(^|[^A-Z_])LEGAL_ACCEPTANCE_REQUIRED/.test(typeof e?.message === 'string' ? e.message : '');
 }
 export class PortalAPI {
     constructor(api, session, pkceStore = new BrowserSessionPkceStore(), 
@@ -213,6 +217,53 @@ export class PortalAPI {
         this.session.setToken(data.refreshAppToken.token);
         return data.refreshAppToken;
     }
+    // ----- Org-managed players ---------------------------------------------------
+    /**
+     * Store an app token the player's organization minted for it, so this client plays with
+     * it and {@link refresh} rotates it. For an org-managed player: the organization's server
+     * calls `mintManagedPlayerToken` with its org token and sends the response to the
+     * player's device, which passes it here. Returns the response unchanged; point the game
+     * client at its `gameApiUrl` / `gameApiWsUrl` as after any mint.
+     *
+     * The token refreshes until the sign-in's lifetime (the organization's setting) ends;
+     * after that `refresh()` is refused and the device gets a new token from its organization.
+     * A refresh is also refused with `ORG_LEGAL_ACCEPTANCE_REQUIRED`
+     * ({@link orgLegalAcceptanceRequiredOf}) while the organization has not accepted the
+     * current Org-Managed Players Addendum; only an admin of the organization can fix that.
+     *
+     * Refuses an org token (`cko_…`). That is the organization's server credential: it signs
+     * in any of the organization's players, so a device must never hold one.
+     */
+    adoptAppToken(response) {
+        const token = response?.token;
+        if (typeof token !== 'string' || token.length === 0) {
+            throw new TypeError('adoptAppToken: the response has no token');
+        }
+        if (token.startsWith(ORG_TOKEN_PREFIX)) {
+            throw new TypeError("adoptAppToken: that is an org token, your organization's server credential. Give the device the app token mintManagedPlayerToken returns, never the org token.");
+        }
+        this.session.setToken(token);
+        return response;
+    }
+    /**
+     * Trade an assertion the player's organization signed for the player's app token, and
+     * store it (as {@link adoptAppToken} does). For an org-managed player whose organization
+     * registered a signing key: its sign-in service signs a short JWS for the player and the
+     * device brings it here. Public: needs no session and no org token.
+     *
+     * Each assertion works once. A refusal is `ASSERTION_REJECTED`, with the failed check in
+     * `extensions.reason` ({@link assertionRejectedOf}); resending the same assertion cannot
+     * succeed, so ask the sign-in service for a new one. A valid assertion is refused with
+     * `ORG_LEGAL_ACCEPTANCE_REQUIRED` ({@link orgLegalAcceptanceRequiredOf}) while the
+     * organization has not accepted the current Org-Managed Players Addendum.
+     */
+    async exchangeManagedPlayerAssertion(params) {
+        const data = await this.api.request(ExchangeManagedPlayerAssertionDocument, {
+            input: { appId: params.appId, assertion: params.assertion },
+        });
+        this.session.setToken(data.exchangeManagedPlayerAssertion.token);
+        return data.exchangeManagedPlayerAssertion;
+    }
     // ----- Consent + connected apps ------------------------------------------
     /** Whether portaling into an app needs a consent prompt (Overworld side). */
     async getConsent(appId) {

package/dist/errors.d.ts

@@ -267,6 +267,23 @@ export declare const ACCOUNT_BLOCKED_CODE = "ACCOUNT_BLOCKED";
  * request, an add or an invite; see {@link groupMemberBannedOf}.
  */
 export declare const GROUP_MEMBER_BANNED_CODE = "GROUP_MEMBER_BANNED";
+/**
+ * `extensions.code` for "an org-managed player cannot do this" (HTTP 403): it has no wallet,
+ * and its mods are refused where its organization has not switched them on for the app; see
+ * {@link managedPlayerNotAllowedOf}.
+ */
+export declare const MANAGED_PLAYER_NOT_ALLOWED_CODE = "MANAGED_PLAYER_NOT_ALLOWED";
+/**
+ * `extensions.code` for "the organization's signed player assertion was refused" (HTTP 401),
+ * with the failed check in `extensions.reason`; see {@link assertionRejectedOf}.
+ */
+export declare const ASSERTION_REJECTED_CODE = "ASSERTION_REJECTED";
+/**
+ * `extensions.code` for "the player's organization has not accepted the current Org-Managed
+ * Players Addendum" (HTTP 403), on an org-managed player's sign-in and refresh and on
+ * provisioning; see {@link orgLegalAcceptanceRequiredOf}.
+ */
+export declare const ORG_LEGAL_ACCEPTANCE_REQUIRED_CODE = "ORG_LEGAL_ACCEPTANCE_REQUIRED";
 /**
  * Why an app is paused, as `extensions.reason` on `APP_PAUSED` and
  * `AppRuntimeGate.reason` carry it. Open union: the server may add one.
@@ -304,6 +321,32 @@ export declare function accountBlockedOf(value: unknown): {
 } | null;
 /** Whether an error is a `GROUP_MEMBER_BANNED` refusal (HTTP 403); only an unban lifts it. */
 export declare function groupMemberBannedOf(value: unknown): boolean;
+/**
+ * Whether an error is a `MANAGED_PLAYER_NOT_ALLOWED` refusal (HTTP 403): an org-managed
+ * player asked for a wallet, or for a mod, a Crowdy Studio write or the Studio agent in an app
+ * whose organization has not switched its managed players' mods on. Not fixed by retrying.
+ */
+export declare function managedPlayerNotAllowedOf(value: unknown): boolean;
+/**
+ * An `ASSERTION_REJECTED` refusal (HTTP 401) from
+ * `portal.exchangeManagedPlayerAssertion`, or `null`. `reason` is `extensions.reason`, the
+ * check that failed: for example `expired`, `replayed`, `signature`, `audience` or
+ * `unknown_key`. Resending the same assertion cannot succeed; ask the organization's
+ * sign-in service for a new one.
+ */
+export declare function assertionRejectedOf(value: unknown): {
+    reason: string | null;
+} | null;
+/**
+ * Whether an error is an `ORG_LEGAL_ACCEPTANCE_REQUIRED` refusal (HTTP 403, ck-api v2.53.0):
+ * the player's organization has not accepted the current Org-Managed Players Addendum, so it
+ * signs no player in, provisions none, and its players' tokens do not refresh. The player
+ * cannot fix it, and neither can the organization's server: an admin of the organization
+ * accepts it in Studio. Not fixed by retrying. Distinct from the player's own
+ * `LEGAL_ACCEPTANCE_REQUIRED` ({@link isLegalAcceptanceRequiredError}), which a managed
+ * player never gets.
+ */
+export declare function orgLegalAcceptanceRequiredOf(value: unknown): boolean;
 /**
  * An `APP_PAUSED` refusal (HTTP 403: the app's runtime gate is not ACTIVE), or
  * `null`. `reason` is `extensions.reason`. Show the player that the world is

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,iFAAiF;AACjF,MAAM,WAAW,yBAAyB;IACxC,mFAAmF;IACnF,OAAO,EAAE,MAAM,CAAC;IAChB,gFAAgF;IAChF,SAAS,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IAC/B,2EAA2E;IAC3E,IAAI,CAAC,EAAE,SAAS,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC;IACpC;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC;AAED,oEAAoE;AACpE,MAAM,WAAW,kBAAkB;IACjC,4CAA4C;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;GAIG;AACH,qBAAa,WAAY,SAAQ,KAAK;IACpC,yDAAyD;IACzD,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;gBAEb,OAAO,EAAE,kBAAkB;CAKxC;AAED;;;;;;GAMG;AACH,qBAAa,eAAgB,SAAQ,WAAW;IAC9C,wCAAwC;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,4DAA4D;IAC5D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBAEV,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;CAKzC;AAED;;;;;;;;;GASG;AACH,qBAAa,kBAAmB,SAAQ,WAAW;IACjD,oEAAoE;IACpE,QAAQ,CAAC,aAAa,EAAE,yBAAyB,EAAE,CAAC;gBAExC,MAAM,EAAE,yBAAyB,EAAE;IAK/C;;;;;;OAMG;IACH,IAAI,IAAI,IAAI,OAAO,CAElB;IAED;;;;OAIG;IACH,IAAI,UAAU,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAEpD;CACF;AAED;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,oBAAoB,CAAC;AAEtD,0EAA0E;AAC1E,eAAO,MAAM,qBAAqB,qBAAqB,CAAC;AAExD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,qBAAa,yBAA0B,SAAQ,kBAAkB;IAC/D,8DAA8D;IAC9D,IAAI,KAAK,IAAI,MAAM,GAAG,SAAS,CAG9B;IAED;;;OAGG;IACH,IAAI,aAAa,IAAI,MAAM,GAAG,SAAS,CAGtC;IAED;;;;;OAKG;IACH,IAAI,SAAS,IAAI,OAAO,CAEvB;CACF;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEhE;;;;;;;GAOG;AACH,MAAM,MAAM,eAAe,GACvB,iBAAiB,GACjB,oBAAoB,GACpB,0BAA0B,GAC1B,eAAe,GACf,gBAAgB,GAChB,iBAAiB,GACjB,cAAc,GACd,iBAAiB,GACjB,cAAc,GACd,sBAAsB,GACtB,iBAAiB,GACjB,aAAa,GACb,WAAW,GACX,iBAAiB,GACjB,kBAAkB,GAClB,iBAAiB,GACjB,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB,wFAAwF;AACxF,MAAM,WAAW,iBAAiB;IAChC,uEAAuE;IACvE,IAAI,EAAE,eAAe,CAAC;IACtB,2BAA2B;IAC3B,KAAK,EAAE,gBAAgB,CAAC;IACxB,qFAAqF;IACrF,SAAS,EAAE,OAAO,CAAC;IACnB;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,qBAAa,wBAAyB,SAAQ,kBAAkB;IAC9D,gEAAgE;IAChE,IAAI,KAAK,IAAI,iBAAiB,CAQ7B;IAED,0DAA0D;IAC1D,IAAI,KAAK,IAAI,gBAAgB,CAE5B;IAED,2FAA2F;IAC3F,IAAI,SAAS,IAAI,OAAO,CAEvB;CACF;AA0BD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,iBAAiB,GAAG,IAAI,CAgCtE;AAED,iFAAiF;AACjF,eAAO,MAAM,iBAAiB,iBAAiB,CAAC;AAChD,sFAAsF;AACtF,eAAO,MAAM,mBAAmB,mBAAmB,CAAC;AACpD,6FAA6F;AAC7F,eAAO,MAAM,qBAAqB,qBAAqB,CAAC;AACxD,iFAAiF;AACjF,eAAO,MAAM,uBAAuB,uBAAuB,CAAC;AAC5D,qFAAqF;AACrF,eAAO,MAAM,eAAe,eAAe,CAAC;AAC5C;;;GAGG;AACH,eAAO,MAAM,oBAAoB,oBAAoB,CAAC;AACtD;;;GAGG;AACH,eAAO,MAAM,wBAAwB,wBAAwB,CAAC;AAE9D;;;GAGG;AACH,MAAM,MAAM,cAAc,GACtB,oBAAoB,GACpB,WAAW,GACX,qBAAqB,GACrB,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAelB;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG;IAAE,aAAa,EAAE,OAAO,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,CAKtF;AAED,mFAAmF;AACnF,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,gBAAgB,GAAG,kBAAkB,GAAG,oBAAoB,CAAC;IACnE,mGAAmG;IACnG,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,mBAAmB,GAAG,IAAI,CAc1E;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG;IAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,CAKvF;AAED,8FAA8F;AAC9F,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAE3D;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG;IAAE,MAAM,EAAE,cAAc,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,CAKpF;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CACzB,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAET;AAED;;;;GAIG;AACH,qBAAa,kBAAmB,SAAQ,WAAW;gBACrC,KAAK,EAAE,OAAO;CAG3B;AAED;;;;;;;GAOG;AACH,qBAAa,kBAAmB,SAAQ,WAAW;gBACrC,SAAS,EAAE,MAAM;CAG9B;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,mBAAoB,SAAQ,WAAW;IAClD,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,yEAAyE;IACzE,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;gBAEjB,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAO;CAKnG;AAED;;;;;GAKG;AACH,qBAAa,mBAAoB,SAAQ,WAAW;CAAG"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,iFAAiF;AACjF,MAAM,WAAW,yBAAyB;IACxC,mFAAmF;IACnF,OAAO,EAAE,MAAM,CAAC;IAChB,gFAAgF;IAChF,SAAS,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IAC/B,2EAA2E;IAC3E,IAAI,CAAC,EAAE,SAAS,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC;IACpC;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC;AAED,oEAAoE;AACpE,MAAM,WAAW,kBAAkB;IACjC,4CAA4C;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;GAIG;AACH,qBAAa,WAAY,SAAQ,KAAK;IACpC,yDAAyD;IACzD,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;gBAEb,OAAO,EAAE,kBAAkB;CAKxC;AAED;;;;;;GAMG;AACH,qBAAa,eAAgB,SAAQ,WAAW;IAC9C,wCAAwC;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,4DAA4D;IAC5D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBAEV,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;CAKzC;AAED;;;;;;;;;GASG;AACH,qBAAa,kBAAmB,SAAQ,WAAW;IACjD,oEAAoE;IACpE,QAAQ,CAAC,aAAa,EAAE,yBAAyB,EAAE,CAAC;gBAExC,MAAM,EAAE,yBAAyB,EAAE;IAK/C;;;;;;OAMG;IACH,IAAI,IAAI,IAAI,OAAO,CAElB;IAED;;;;OAIG;IACH,IAAI,UAAU,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAEpD;CACF;AAED;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,oBAAoB,CAAC;AAEtD,0EAA0E;AAC1E,eAAO,MAAM,qBAAqB,qBAAqB,CAAC;AAExD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,qBAAa,yBAA0B,SAAQ,kBAAkB;IAC/D,8DAA8D;IAC9D,IAAI,KAAK,IAAI,MAAM,GAAG,SAAS,CAG9B;IAED;;;OAGG;IACH,IAAI,aAAa,IAAI,MAAM,GAAG,SAAS,CAGtC;IAED;;;;;OAKG;IACH,IAAI,SAAS,IAAI,OAAO,CAEvB;CACF;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEhE;;;;;;;GAOG;AACH,MAAM,MAAM,eAAe,GACvB,iBAAiB,GACjB,oBAAoB,GACpB,0BAA0B,GAC1B,eAAe,GACf,gBAAgB,GAChB,iBAAiB,GACjB,cAAc,GACd,iBAAiB,GACjB,cAAc,GACd,sBAAsB,GACtB,iBAAiB,GACjB,aAAa,GACb,WAAW,GACX,iBAAiB,GACjB,kBAAkB,GAClB,iBAAiB,GACjB,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB,wFAAwF;AACxF,MAAM,WAAW,iBAAiB;IAChC,uEAAuE;IACvE,IAAI,EAAE,eAAe,CAAC;IACtB,2BAA2B;IAC3B,KAAK,EAAE,gBAAgB,CAAC;IACxB,qFAAqF;IACrF,SAAS,EAAE,OAAO,CAAC;IACnB;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,qBAAa,wBAAyB,SAAQ,kBAAkB;IAC9D,gEAAgE;IAChE,IAAI,KAAK,IAAI,iBAAiB,CAQ7B;IAED,0DAA0D;IAC1D,IAAI,KAAK,IAAI,gBAAgB,CAE5B;IAED,2FAA2F;IAC3F,IAAI,SAAS,IAAI,OAAO,CAEvB;CACF;AA0BD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,iBAAiB,GAAG,IAAI,CAgCtE;AAED,iFAAiF;AACjF,eAAO,MAAM,iBAAiB,iBAAiB,CAAC;AAChD,sFAAsF;AACtF,eAAO,MAAM,mBAAmB,mBAAmB,CAAC;AACpD,6FAA6F;AAC7F,eAAO,MAAM,qBAAqB,qBAAqB,CAAC;AACxD,iFAAiF;AACjF,eAAO,MAAM,uBAAuB,uBAAuB,CAAC;AAC5D,qFAAqF;AACrF,eAAO,MAAM,eAAe,eAAe,CAAC;AAC5C;;;GAGG;AACH,eAAO,MAAM,oBAAoB,oBAAoB,CAAC;AACtD;;;GAGG;AACH,eAAO,MAAM,wBAAwB,wBAAwB,CAAC;AAC9D;;;;GAIG;AACH,eAAO,MAAM,+BAA+B,+BAA+B,CAAC;AAC5E;;;GAGG;AACH,eAAO,MAAM,uBAAuB,uBAAuB,CAAC;AAC5D;;;;GAIG;AACH,eAAO,MAAM,kCAAkC,kCAAkC,CAAC;AAElF;;;GAGG;AACH,MAAM,MAAM,cAAc,GACtB,oBAAoB,GACpB,WAAW,GACX,qBAAqB,GACrB,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAelB;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG;IAAE,aAAa,EAAE,OAAO,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,CAKtF;AAED,mFAAmF;AACnF,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,gBAAgB,GAAG,kBAAkB,GAAG,oBAAoB,CAAC;IACnE,mGAAmG;IACnG,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,mBAAmB,GAAG,IAAI,CAc1E;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG;IAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,CAKvF;AAED,8FAA8F;AAC9F,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAE3D;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAEjE;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG;IAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,CAKpF;AAED;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAEpE;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG;IAAE,MAAM,EAAE,cAAc,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,CAKpF;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CACzB,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAET;AAED;;;;GAIG;AACH,qBAAa,kBAAmB,SAAQ,WAAW;gBACrC,KAAK,EAAE,OAAO;CAG3B;AAED;;;;;;;GAOG;AACH,qBAAa,kBAAmB,SAAQ,WAAW;gBACrC,SAAS,EAAE,MAAM;CAG9B;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,mBAAoB,SAAQ,WAAW;IAClD,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,yEAAyE;IACzE,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;gBAEjB,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAO;CAKnG;AAED;;;;;GAKG;AACH,qBAAa,mBAAoB,SAAQ,WAAW;CAAG"}

package/dist/errors.js

@@ -263,6 +263,23 @@ export const ACCOUNT_BLOCKED_CODE = 'ACCOUNT_BLOCKED';
  * request, an add or an invite; see {@link groupMemberBannedOf}.
  */
 export const GROUP_MEMBER_BANNED_CODE = 'GROUP_MEMBER_BANNED';
+/**
+ * `extensions.code` for "an org-managed player cannot do this" (HTTP 403): it has no wallet,
+ * and its mods are refused where its organization has not switched them on for the app; see
+ * {@link managedPlayerNotAllowedOf}.
+ */
+export const MANAGED_PLAYER_NOT_ALLOWED_CODE = 'MANAGED_PLAYER_NOT_ALLOWED';
+/**
+ * `extensions.code` for "the organization's signed player assertion was refused" (HTTP 401),
+ * with the failed check in `extensions.reason`; see {@link assertionRejectedOf}.
+ */
+export const ASSERTION_REJECTED_CODE = 'ASSERTION_REJECTED';
+/**
+ * `extensions.code` for "the player's organization has not accepted the current Org-Managed
+ * Players Addendum" (HTTP 403), on an org-managed player's sign-in and refresh and on
+ * provisioning; see {@link orgLegalAcceptanceRequiredOf}.
+ */
+export const ORG_LEGAL_ACCEPTANCE_REQUIRED_CODE = 'ORG_LEGAL_ACCEPTANCE_REQUIRED';
 /** The first error entry carrying `code`, from an error or a raw payload. */
 function errorWithCode(value, code) {
     if (!value || typeof value !== 'object')
@@ -324,6 +341,40 @@ export function accountBlockedOf(value) {
 export function groupMemberBannedOf(value) {
     return errorWithCode(value, GROUP_MEMBER_BANNED_CODE) !== null;
 }
+/**
+ * Whether an error is a `MANAGED_PLAYER_NOT_ALLOWED` refusal (HTTP 403): an org-managed
+ * player asked for a wallet, or for a mod, a Crowdy Studio write or the Studio agent in an app
+ * whose organization has not switched its managed players' mods on. Not fixed by retrying.
+ */
+export function managedPlayerNotAllowedOf(value) {
+    return errorWithCode(value, MANAGED_PLAYER_NOT_ALLOWED_CODE) !== null;
+}
+/**
+ * An `ASSERTION_REJECTED` refusal (HTTP 401) from
+ * `portal.exchangeManagedPlayerAssertion`, or `null`. `reason` is `extensions.reason`, the
+ * check that failed: for example `expired`, `replayed`, `signature`, `audience` or
+ * `unknown_key`. Resending the same assertion cannot succeed; ask the organization's
+ * sign-in service for a new one.
+ */
+export function assertionRejectedOf(value) {
+    const entry = errorWithCode(value, ASSERTION_REJECTED_CODE);
+    if (!entry)
+        return null;
+    const reason = entry.extensions?.reason;
+    return { reason: typeof reason === 'string' && reason.length > 0 ? reason : null };
+}
+/**
+ * Whether an error is an `ORG_LEGAL_ACCEPTANCE_REQUIRED` refusal (HTTP 403, ck-api v2.53.0):
+ * the player's organization has not accepted the current Org-Managed Players Addendum, so it
+ * signs no player in, provisions none, and its players' tokens do not refresh. The player
+ * cannot fix it, and neither can the organization's server: an admin of the organization
+ * accepts it in Studio. Not fixed by retrying. Distinct from the player's own
+ * `LEGAL_ACCEPTANCE_REQUIRED` ({@link isLegalAcceptanceRequiredError}), which a managed
+ * player never gets.
+ */
+export function orgLegalAcceptanceRequiredOf(value) {
+    return errorWithCode(value, ORG_LEGAL_ACCEPTANCE_REQUIRED_CODE) !== null;
+}
 /**
  * An `APP_PAUSED` refusal (HTTP 403: the app's runtime gate is not ACTIVE), or
  * `null`. `reason` is `extensions.reason`. Show the player that the world is