@crowdedkingdoms/crowdyjs 18.17.0 → 18.18.0-dev.1

package/README.md

@@ -12,19 +12,23 @@ gameplay, minted per app through `client.portal`.
 
 Start here:
 
-- [SDK guide](https://docs.crowdedkingdoms.com/crowdyjs/readme) — the canonical
+- [SDK guide](https://docs.dev.crowdedkingdoms.com/crowdyjs/readme) — the canonical
   walkthrough of everything in this README.
-- [Build a game](https://docs.crowdedkingdoms.com/build-a-game/intro) — a
+- [Build a game](https://docs.dev.crowdedkingdoms.com/build-a-game/intro) — a
   hands-on tutorial from sign-in to a playable voxel game.
-- [Platform overview](https://docs.crowdedkingdoms.com/overview/client-workflow)
+- [Platform overview](https://docs.dev.crowdedkingdoms.com/overview/client-workflow)
   — how a client session flows through the platform.
 
 ## Install
 
 ```bash
-npm install @crowdedkingdoms/crowdyjs
+npm install @crowdedkingdoms/crowdyjs@dev
 ```
 
+This README is the `dev` branch's: it documents the release on the `dev` dist-tag
+(`npm view @crowdedkingdoms/crowdyjs dist-tags`), and its links go to the dev docs site. A
+plain `npm install` resolves `latest`, the production release, which has no `client.exec`.
+
 **Server compatibility.** A release selects fields the Game API it was built against has,
 so it needs that Game API or newer; promote the Game API before the SDK on each tier.
 
@@ -196,8 +200,8 @@ Notes:
 - Use `client.auth.setToken(token)` to seed a token externally (e.g. when
   restoring auth from a non-default storage).
 
-Deeper reading: [Portals & app-scoped tokens](https://docs.crowdedkingdoms.com/management-api/portals-and-app-tokens)
-and [Sign in](https://docs.crowdedkingdoms.com/management-api/authentication).
+Deeper reading: [Portals & app-scoped tokens](https://docs.dev.crowdedkingdoms.com/management-api/portals-and-app-tokens)
+and [Sign in](https://docs.dev.crowdedkingdoms.com/management-api/authentication).
 
 ### Org-managed players
 
@@ -338,7 +342,7 @@ never told about, so a native refresh without it is a re-placement.
 | `client.kit(appId)` | Game Kit: typed clients for the ck-exec starter hubs (world, matchmaking, sessions, NPCs and pets) on one shared connection, their topology, realtime conventions, and parties, guilds and chat (`kit.social`) — see [Game Kit](#game-kit). |
 | `createWorldSession(client, appId, config)` | World Stores: opt-in, SDK-managed game state from the `@crowdedkingdoms/crowdyjs/stores` subpath — see [World Stores](#world-stores). |
 
-**Studio-admin surface** (privileged; drive with a server-side / studio token,
+**Studio-admin surface** (privileged; drive with an org admin's session, or an org token for the managed-player calls,
 grouped under `client.admin` and mirrored at the top level):
 
 | Sub-client | What it does |
@@ -394,7 +398,7 @@ query AppForRouting($appId: BigInt!) {
 `CrowdyClient` with `httpUrl: gameApiUrl` (and the matching `wsUrl`) holding
 that app's app-scoped token, then drive gameplay through that client. Apps
 with no `gameApiUrl` keep working against the default `httpUrl` you
-configured. See [Loading an app's Game API](https://docs.crowdedkingdoms.com/crowdyjs/shared-environment-routing).
+configured. See [Loading an app's Game API](https://docs.dev.crowdedkingdoms.com/crowdyjs/shared-environment-routing).
 
 ## Realtime notifications
 
@@ -820,7 +824,7 @@ reach your bundle. Reads are synchronous snapshots and writes happen on
 WebSocket events (not `requestAnimationFrame`), so render loops read freely
 and a backgrounded tab keeps ingesting updates; pass `workerTicker()` to also
 keep timer-driven sends at full rate while hidden. See the
-[World Stores guide](https://docs.crowdedkingdoms.com/crowdyjs/stores).
+[World Stores guide](https://docs.dev.crowdedkingdoms.com/crowdyjs/stores).
 
 ## Game Kit
 
@@ -898,7 +902,7 @@ The protocol is held to ck-exec's golden record of the starters
 (`test/unit/fixtures/kit-protocol.json`): every module call and topic in it is replayed in
 `test/unit/game-kit.test.mjs`. The blueprints, `kit.deploy`, the engines and the model-backed
 helpers went with the game model in 18.0.0; the hub modules replace them. See the
-[Game Kit docs](https://docs.crowdedkingdoms.com/game-kit/intro) and
+[Game Kit docs](https://docs.dev.crowdedkingdoms.com/game-kit/intro) and
 [MIGRATION.md](MIGRATION.md).
 
 ## ck-exec
@@ -962,7 +966,7 @@ Integers above 2^53 decode as `number` and lose precision unless you pass
 `{ decode: { useBigInt64: true } }`. A call's whole numbers outside 32 bits (a timestamp in
 milliseconds, a player id) go out as 64-bit integers (18.11.0; before, as floats, which a
 hub's integer fields refuse). The wire format is in the
-[ck-exec docs](https://docs.crowdedkingdoms.com/exec/intro).
+[ck-exec docs](https://docs.dev.crowdedkingdoms.com/exec/intro).
 
 ### A mod's CLIENT half
 
@@ -1033,7 +1037,7 @@ counts what was dropped); `invoke` sends at most 256 KiB each way and is refused
 module is not running. `NOT_FOUND` holds a CLIENT half back 15 s and `RATE_LIMITED` 60 s. The
 grid's owner is asked about their own CLIENT halves like anyone; answer yes in `confirm` when
 `prompt.authorId` is the player. See
-[CLIENT halves](https://docs.crowdedkingdoms.com/exec/client-halves).
+[CLIENT halves](https://docs.dev.crowdedkingdoms.com/exec/client-halves).
 
 ## Hosting a game on Crowdy Games
 
@@ -1152,8 +1156,8 @@ CLIENT project needs ck-api `v2.25.1` or later. A CLIENT crate still on the lega
 `mountCrowdyStudio` and the controller take `mods: client.exec`. Crowdy Studio runs nothing
 on legacy player compute since 18.0.0.
 
-See [CLIENT halves](https://docs.crowdedkingdoms.com/exec/client-halves), [mods](https://docs.crowdedkingdoms.com/exec/mods)
-and [Embed Crowdy Studio in your game](https://docs.crowdedkingdoms.com/crowdyjs/crowdy-studio-embed).
+See [CLIENT halves](https://docs.dev.crowdedkingdoms.com/exec/client-halves), [mods](https://docs.dev.crowdedkingdoms.com/exec/mods)
+and [Embed Crowdy Studio in your game](https://docs.dev.crowdedkingdoms.com/crowdyjs/crowdy-studio-embed).
 
 ### The Studio agent (DeepSeek Harness in the browser)
 
@@ -1344,7 +1348,7 @@ no other repositories and no network access required:
   `src/generated/graphql-schema.ts`, the generated schema types.
 
 Schema refresh is explicit, from the published
-[SDL](https://docs.crowdedkingdoms.com/schema/game-api.graphql):
+[SDL](https://docs.dev.crowdedkingdoms.com/schema/game-api.graphql):
 
 ```bash
 npm run schema:sync:prod

package/dist/default-origin.d.ts

@@ -1,6 +1,6 @@
 /**
  * GENERATED — do not edit. The operator tooling's
- * `sync-client-origins.mjs --write --tier prod` writes this file, and
+ * `sync-client-origins.mjs --write --tier dev` writes this file, and
  * `check-sdk-default-origin.mjs` refuses it when it names the wrong tier or a
  * host that declaration does not carry. Regenerate; never hand-edit.
  *
@@ -10,14 +10,14 @@
  * than no default at all. Every fallback this SDK ever removed named a host that
  * was already dead. A generated file plus a gate is what makes this one different.
  *
- * Source: the operator's per-tier public CK API origin declaration, tier 'prod'
+ * Source: the operator's per-tier public CK API origin declaration, tier 'dev'
  */
 /** The tier this build of the SDK is published for. */
-export declare const CROWDY_DEFAULT_TIER = "prod";
+export declare const CROWDY_DEFAULT_TIER = "dev";
 /** The public CK API origin for that tier. */
-export declare const CROWDY_DEFAULT_HTTP_ORIGIN = "https://ck.prod.crowdedkingdoms.com";
+export declare const CROWDY_DEFAULT_HTTP_ORIGIN = "https://ck.dev.crowdedkingdoms.com";
 /** The same host over WebSocket. A scheme is composed; a hostname is looked up. */
-export declare const CROWDY_DEFAULT_WS_ORIGIN = "wss://ck.prod.crowdedkingdoms.com";
+export declare const CROWDY_DEFAULT_WS_ORIGIN = "wss://ck.dev.crowdedkingdoms.com";
 /** The bare hostname, for callers that need to compare rather than dial. */
-export declare const CROWDY_DEFAULT_HOST = "ck.prod.crowdedkingdoms.com";
+export declare const CROWDY_DEFAULT_HOST = "ck.dev.crowdedkingdoms.com";
 //# sourceMappingURL=default-origin.d.ts.map

package/dist/default-origin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"default-origin.d.ts","sourceRoot":"","sources":["../src/default-origin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,uDAAuD;AACvD,eAAO,MAAM,mBAAmB,SAAS,CAAC;AAE1C,8CAA8C;AAC9C,eAAO,MAAM,0BAA0B,wCAAwC,CAAC;AAEhF,mFAAmF;AACnF,eAAO,MAAM,wBAAwB,sCAAsC,CAAC;AAE5E,4EAA4E;AAC5E,eAAO,MAAM,mBAAmB,gCAAgC,CAAC"}
+{"version":3,"file":"default-origin.d.ts","sourceRoot":"","sources":["../src/default-origin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,uDAAuD;AACvD,eAAO,MAAM,mBAAmB,QAAQ,CAAC;AAEzC,8CAA8C;AAC9C,eAAO,MAAM,0BAA0B,uCAAuC,CAAC;AAE/E,mFAAmF;AACnF,eAAO,MAAM,wBAAwB,qCAAqC,CAAC;AAE3E,4EAA4E;AAC5E,eAAO,MAAM,mBAAmB,+BAA+B,CAAC"}

package/dist/default-origin.js

@@ -1,6 +1,6 @@
 /**
  * GENERATED — do not edit. The operator tooling's
- * `sync-client-origins.mjs --write --tier prod` writes this file, and
+ * `sync-client-origins.mjs --write --tier dev` writes this file, and
  * `check-sdk-default-origin.mjs` refuses it when it names the wrong tier or a
  * host that declaration does not carry. Regenerate; never hand-edit.
  *
@@ -10,13 +10,13 @@
  * than no default at all. Every fallback this SDK ever removed named a host that
  * was already dead. A generated file plus a gate is what makes this one different.
  *
- * Source: the operator's per-tier public CK API origin declaration, tier 'prod'
+ * Source: the operator's per-tier public CK API origin declaration, tier 'dev'
  */
 /** The tier this build of the SDK is published for. */
-export const CROWDY_DEFAULT_TIER = 'prod';
+export const CROWDY_DEFAULT_TIER = 'dev';
 /** The public CK API origin for that tier. */
-export const CROWDY_DEFAULT_HTTP_ORIGIN = 'https://ck.prod.crowdedkingdoms.com';
+export const CROWDY_DEFAULT_HTTP_ORIGIN = 'https://ck.dev.crowdedkingdoms.com';
 /** The same host over WebSocket. A scheme is composed; a hostname is looked up. */
-export const CROWDY_DEFAULT_WS_ORIGIN = 'wss://ck.prod.crowdedkingdoms.com';
+export const CROWDY_DEFAULT_WS_ORIGIN = 'wss://ck.dev.crowdedkingdoms.com';
 /** The bare hostname, for callers that need to compare rather than dial. */
-export const CROWDY_DEFAULT_HOST = 'ck.prod.crowdedkingdoms.com';
+export const CROWDY_DEFAULT_HOST = 'ck.dev.crowdedkingdoms.com';

package/dist/domains/udp.d.ts

@@ -341,7 +341,10 @@ export declare class UdpAPI {
      * Send a spatial text/chat packet, fanned out to nearby actors as a
      * `ClientTextNotification`. Fire-and-forget; opens a UDP proxy session
      * automatically. The sender receives no success echo; failures arrive
-     * asynchronously as `GenericErrorResponse` on {@link subscribe}.
+     * asynchronously as `GenericErrorResponse` on {@link subscribe}. Needs the
+     * `use_text_chat` runtime permission on the app (Game API v2.55.0; every tier
+     * that grants `access` has it unless the app took it away): without it the
+     * server answers `UNAUTHORIZED`.
      *
      * @param input - {@link ClientTextPacketInput}:
      *   - `appId` — owning app id (`BigInt` as a decimal string).
@@ -432,6 +435,9 @@ export declare class UdpAPI {
      * Fire-and-forget: the sender receives no echo, so there is no
      * `sendSingleActorMessageAndWait` variant. The target receives a
      * `SingleActorMessageNotification` on its `udpNotifications` subscription.
+     * Needs the `use_direct_messages` runtime permission on the app (Game API
+     * v2.55.0; every tier that grants `access` has it unless the app took it
+     * away): without it the server answers `UNAUTHORIZED`.
      *
      * @param input - {@link SingleActorMessageInput}:
      *   - `appId` — the destination actor's app id (`BigInt` as a decimal string).
@@ -477,8 +483,10 @@ export declare class UdpAPI {
      * Publish a message to a channel. Delivered to every active member of the
      * channel (regardless of location) as a `ChannelMessageNotification` on their
      * `udpNotifications` subscription. Requires the channel `send_messages`
-     * permission; the server drops the message otherwise. Fire-and-forget: the
-     * sender receives no echo.
+     * permission and, from Game API v2.55.0, the `use_text_chat` runtime
+     * permission on the channel's app; without either the server answers
+     * `UNAUTHORIZED` on {@link subscribe}. Fire-and-forget: the sender receives
+     * no echo.
      *
      * @param input - {@link ChannelMessageInput}:
      *   - `channelId` — the channel id (`groups.group_id`) as a `BigInt` decimal
@@ -489,8 +497,9 @@ export declare class UdpAPI {
      *     1024 bytes.
      *   - `sequenceNumber` — optional uint8 (0-255) correlation id.
      * @returns `true` when accepted for sending — **not** confirmation of
-     *   delivery; note that a message dropped for a missing `send_messages`
-     *   permission still returns `true`.
+     *   delivery; a message refused for a missing `send_messages` or
+     *   `use_text_chat` still returns `true` (the refusal arrives as a
+     *   `genericError` notification).
      * @throws {CrowdyGraphQLError} on auth/validation failures.
      */
     sendChannelMessage(input: SendChannelMessageMutationVariables['input']): Promise<boolean>;
@@ -518,8 +527,8 @@ export declare class UdpAPI {
      * {@link sendChannelMessage}, when one of its live actors is in `appId`
      * within `maxDistance` chunks of `chunk`, measured as the straight-line
      * distance between chunk coordinates, boundary included. A member with no
-     * live actor does not receive it. Same send right as `sendChannelMessage`;
-     * the sender receives no echo.
+     * live actor does not receive it. Same send right and `use_text_chat` as
+     * `sendChannelMessage`; the sender receives no echo.
      *
      * @param input - {@link RangedChannelMessageInput}:
      *   - `channelId` — the channel id (`groups.group_id`) as a `BigInt` decimal
@@ -534,8 +543,9 @@ export declare class UdpAPI {
      *     2147483647. Not the 0-8 Chebyshev ring count spatial sends take.
      *   - `sequenceNumber` — optional uint8 (0-255) correlation id.
      * @returns `true` when accepted for sending — **not** confirmation of
-     *   delivery. A refusal (no send right: `UNAUTHORIZED`; another app:
-     *   `INVALID_APP_ID`) arrives as a `genericError` notification.
+     *   delivery. A refusal (no send right or no `use_text_chat`:
+     *   `UNAUTHORIZED`; another app: `INVALID_APP_ID`) arrives as a
+     *   `genericError` notification.
      * @throws {CrowdyGraphQLError} on auth/validation failures.
      */
     sendRangedChannelMessage(input: SendRangedChannelMessageMutationVariables['input']): Promise<boolean>;

package/dist/domains/udp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"udp.d.ts","sourceRoot":"","sources":["../../src/domains/udp.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,KAAK,EACV,mBAAmB,EACnB,uBAAuB,EACxB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAEL,KAAK,uBAAuB,EAG5B,KAAK,6BAA6B,EAElC,KAAK,gCAAgC,EAErC,KAAK,gCAAgC,EAErC,KAAK,gCAAgC,EAErC,KAAK,gCAAgC,EAErC,KAAK,+BAA+B,EAEpC,KAAK,gCAAgC,EAErC,KAAK,uCAAuC,EAE5C,KAAK,mCAAmC,EAExC,KAAK,iCAAiC,EAEtC,KAAK,yCAAyC,EAC/C,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAkB1D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAiB,KAAK,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAG1E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,qBAAa,MAAM;IAKf,OAAO,CAAC,GAAG;IACX,OAAO,CAAC,IAAI;IACZ,OAAO,CAAC,OAAO,CAAC;IAChB;;;;OAIG;IACH,OAAO,CAAC,2BAA2B,CAAC;IAZtC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA2B;IACrD,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAA+B;gBAG1D,GAAG,EAAE,aAAa,EAClB,IAAI,EAAE,mBAAmB,EACzB,OAAO,CAAC,EAAE,eAAe,YAAA;IACjC;;;;OAIG;IACK,2BAA2B,CAAC,GAAE,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,aAAA;IAGjF;;;;OAIG;IACG,2BAA2B,IAAI,OAAO,CAAC,IAAI,CAAC;YAKpC,uBAAuB;IAWrC,OAAO,CAAC,gBAAgB;IAOxB,mEAAmE;IACnE,OAAO,CAAC,MAAM;IAId;;;;OAIG;YACW,YAAY;IAoB1B;;;;;;;;;;;;;OAaG;IACG,OAAO,IAAI,OAAO,CAAC,uBAAuB,CAAC,iBAAiB,CAAC,CAAC;IAkBpE;;;;;;;;OAQG;IACH;;;;;OAKG;IACH,UAAU,IAAI,IAAI;IAIZ,UAAU,IAAI,OAAO,CAAC,OAAO,CAAC;IASpC;;;;;;;OAOG;IACG,gBAAgB,IAAI,OAAO,CAC/B,6BAA6B,CAAC,0BAA0B,CAAC,CAC1D;IAQD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACG,eAAe,CACnB,KAAK,EAAE,gCAAgC,CAAC,OAAO,CAAC,GAC/C,OAAO,CAAC,OAAO,CAAC;YAKL,mBAAmB;IAyCjC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;IACG,sBAAsB,CAC1B,KAAK,EAAE,gCAAgC,CAAC,OAAO,CAAC,EAChD,OAAO,GAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAO,GACnC,OAAO,CAAC,mBAAmB,CAAC;IAU/B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACG,eAAe,CACnB,KAAK,EAAE,IAAI,CAAC,gCAAgC,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC,GAAG;QACrE,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,GACA,OAAO,CAAC,OAAO,CAAC;IAiBnB;;;;;;;;;;;;;;;;;;OAkBG;IACG,sBAAsB,CAC1B,KAAK,EAAE,IAAI,CAAC,gCAAgC,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC,GAAG;QACrE,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,EACD,OAAO,GAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAO,GACnC,OAAO,CAAC,mBAAmB,CAAC;IAU/B;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACG,eAAe,CACnB,KAAK,EAAE,gCAAgC,CAAC,OAAO,CAAC,GAC/C,OAAO,CAAC,OAAO,CAAC;IAcnB;;;;;;;;;;;;;;;;;OAiBG;IACG,sBAAsB,CAC1B,KAAK,EAAE,gCAAgC,CAAC,OAAO,CAAC,EAChD,OAAO,GAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAO,GACnC,OAAO,CAAC,mBAAmB,CAAC;IAU/B;;;;;;;;;;;;;;;;OAgBG;IACG,eAAe,CACnB,KAAK,EAAE,gCAAgC,CAAC,OAAO,CAAC,GAC/C,OAAO,CAAC,OAAO,CAAC;IAcnB;;;;;;;;;;;;OAYG;IACG,cAAc,CAAC,KAAK,EAAE;QAC1B,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE;YAAE,CAAC,EAAE,MAAM,CAAC;YAAC,CAAC,EAAE,MAAM,CAAC;YAAC,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAC3C,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,UAAU,CAAC;QAClB,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,UAAU,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC,MAAM,CAAC;IAgBnB;;;;;;;;;;;;;;;;;;;OAmBG;IACG,cAAc,CAClB,KAAK,EAAE,+BAA+B,CAAC,OAAO,CAAC,GAC9C,OAAO,CAAC,OAAO,CAAC;IAcnB;;;;;;;;;;;;;;;;;OAiBG;IACG,qBAAqB,CACzB,KAAK,EAAE,+BAA+B,CAAC,OAAO,CAAC,EAC/C,OAAO,GAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAO,GACnC,OAAO,CAAC,mBAAmB,CAAC;IAU/B;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACG,eAAe,CACnB,KAAK,EAAE,gCAAgC,CAAC,OAAO,CAAC,GAC/C,OAAO,CAAC,OAAO,CAAC;IAcnB;;;;;;;;;;;;;;;;;;OAkBG;IACG,sBAAsB,CAC1B,KAAK,EAAE,gCAAgC,CAAC,OAAO,CAAC,EAChD,OAAO,GAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAO,GACnC,OAAO,CAAC,mBAAmB,CAAC;IAU/B;;;;;;;;;;;;;;;;;;;;OAoBG;IACG,sBAAsB,CAC1B,KAAK,EAAE,uCAAuC,CAAC,OAAO,CAAC,GACtD,OAAO,CAAC,OAAO,CAAC;IAgBnB;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACG,kBAAkB,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,OAAO,CAAC;IActE;;;;;;;;;;;;;;;;;;;OAmBG;IACG,kBAAkB,CACtB,KAAK,EAAE,mCAAmC,CAAC,OAAO,CAAC,GAClD,OAAO,CAAC,OAAO,CAAC;IAcnB;;;;;;;;;;;;;;;OAeG;IACG,gBAAgB,CACpB,KAAK,EAAE,iCAAiC,CAAC,OAAO,CAAC,GAChD,OAAO,CAAC,OAAO,CAAC;IAcnB;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACG,wBAAwB,CAC5B,KAAK,EAAE,yCAAyC,CAAC,OAAO,CAAC,GACxD,OAAO,CAAC,OAAO,CAAC;IAcnB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAqCG;IACH,SAAS,CAAC,QAAQ,EAAE,uBAAuB,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,IAAI;IAIvE,OAAO,CAAC,YAAY;CAQrB"}
+{"version":3,"file":"udp.d.ts","sourceRoot":"","sources":["../../src/domains/udp.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,KAAK,EACV,mBAAmB,EACnB,uBAAuB,EACxB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAEL,KAAK,uBAAuB,EAG5B,KAAK,6BAA6B,EAElC,KAAK,gCAAgC,EAErC,KAAK,gCAAgC,EAErC,KAAK,gCAAgC,EAErC,KAAK,gCAAgC,EAErC,KAAK,+BAA+B,EAEpC,KAAK,gCAAgC,EAErC,KAAK,uCAAuC,EAE5C,KAAK,mCAAmC,EAExC,KAAK,iCAAiC,EAEtC,KAAK,yCAAyC,EAC/C,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAkB1D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAiB,KAAK,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAG1E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,qBAAa,MAAM;IAKf,OAAO,CAAC,GAAG;IACX,OAAO,CAAC,IAAI;IACZ,OAAO,CAAC,OAAO,CAAC;IAChB;;;;OAIG;IACH,OAAO,CAAC,2BAA2B,CAAC;IAZtC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA2B;IACrD,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAA+B;gBAG1D,GAAG,EAAE,aAAa,EAClB,IAAI,EAAE,mBAAmB,EACzB,OAAO,CAAC,EAAE,eAAe,YAAA;IACjC;;;;OAIG;IACK,2BAA2B,CAAC,GAAE,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,aAAA;IAGjF;;;;OAIG;IACG,2BAA2B,IAAI,OAAO,CAAC,IAAI,CAAC;YAKpC,uBAAuB;IAWrC,OAAO,CAAC,gBAAgB;IAOxB,mEAAmE;IACnE,OAAO,CAAC,MAAM;IAId;;;;OAIG;YACW,YAAY;IAoB1B;;;;;;;;;;;;;OAaG;IACG,OAAO,IAAI,OAAO,CAAC,uBAAuB,CAAC,iBAAiB,CAAC,CAAC;IAkBpE;;;;;;;;OAQG;IACH;;;;;OAKG;IACH,UAAU,IAAI,IAAI;IAIZ,UAAU,IAAI,OAAO,CAAC,OAAO,CAAC;IASpC;;;;;;;OAOG;IACG,gBAAgB,IAAI,OAAO,CAC/B,6BAA6B,CAAC,0BAA0B,CAAC,CAC1D;IAQD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACG,eAAe,CACnB,KAAK,EAAE,gCAAgC,CAAC,OAAO,CAAC,GAC/C,OAAO,CAAC,OAAO,CAAC;YAKL,mBAAmB;IAyCjC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;IACG,sBAAsB,CAC1B,KAAK,EAAE,gCAAgC,CAAC,OAAO,CAAC,EAChD,OAAO,GAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAO,GACnC,OAAO,CAAC,mBAAmB,CAAC;IAU/B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACG,eAAe,CACnB,KAAK,EAAE,IAAI,CAAC,gCAAgC,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC,GAAG;QACrE,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,GACA,OAAO,CAAC,OAAO,CAAC;IAiBnB;;;;;;;;;;;;;;;;;;OAkBG;IACG,sBAAsB,CAC1B,KAAK,EAAE,IAAI,CAAC,gCAAgC,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC,GAAG;QACrE,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,EACD,OAAO,GAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAO,GACnC,OAAO,CAAC,mBAAmB,CAAC;IAU/B;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACG,eAAe,CACnB,KAAK,EAAE,gCAAgC,CAAC,OAAO,CAAC,GAC/C,OAAO,CAAC,OAAO,CAAC;IAcnB;;;;;;;;;;;;;;;;;OAiBG;IACG,sBAAsB,CAC1B,KAAK,EAAE,gCAAgC,CAAC,OAAO,CAAC,EAChD,OAAO,GAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAO,GACnC,OAAO,CAAC,mBAAmB,CAAC;IAU/B;;;;;;;;;;;;;;;;OAgBG;IACG,eAAe,CACnB,KAAK,EAAE,gCAAgC,CAAC,OAAO,CAAC,GAC/C,OAAO,CAAC,OAAO,CAAC;IAcnB;;;;;;;;;;;;OAYG;IACG,cAAc,CAAC,KAAK,EAAE;QAC1B,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE;YAAE,CAAC,EAAE,MAAM,CAAC;YAAC,CAAC,EAAE,MAAM,CAAC;YAAC,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAC3C,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,UAAU,CAAC;QAClB,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,UAAU,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC,MAAM,CAAC;IAgBnB;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACG,cAAc,CAClB,KAAK,EAAE,+BAA+B,CAAC,OAAO,CAAC,GAC9C,OAAO,CAAC,OAAO,CAAC;IAcnB;;;;;;;;;;;;;;;;;OAiBG;IACG,qBAAqB,CACzB,KAAK,EAAE,+BAA+B,CAAC,OAAO,CAAC,EAC/C,OAAO,GAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAO,GACnC,OAAO,CAAC,mBAAmB,CAAC;IAU/B;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACG,eAAe,CACnB,KAAK,EAAE,gCAAgC,CAAC,OAAO,CAAC,GAC/C,OAAO,CAAC,OAAO,CAAC;IAcnB;;;;;;;;;;;;;;;;;;OAkBG;IACG,sBAAsB,CAC1B,KAAK,EAAE,gCAAgC,CAAC,OAAO,CAAC,EAChD,OAAO,GAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAO,GACnC,OAAO,CAAC,mBAAmB,CAAC;IAU/B;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACG,sBAAsB,CAC1B,KAAK,EAAE,uCAAuC,CAAC,OAAO,CAAC,GACtD,OAAO,CAAC,OAAO,CAAC;IAgBnB;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACG,kBAAkB,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,OAAO,CAAC;IActE;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACG,kBAAkB,CACtB,KAAK,EAAE,mCAAmC,CAAC,OAAO,CAAC,GAClD,OAAO,CAAC,OAAO,CAAC;IAcnB;;;;;;;;;;;;;;;OAeG;IACG,gBAAgB,CACpB,KAAK,EAAE,iCAAiC,CAAC,OAAO,CAAC,GAChD,OAAO,CAAC,OAAO,CAAC;IAcnB;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACG,wBAAwB,CAC5B,KAAK,EAAE,yCAAyC,CAAC,OAAO,CAAC,GACxD,OAAO,CAAC,OAAO,CAAC;IAcnB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAqCG;IACH,SAAS,CAAC,QAAQ,EAAE,uBAAuB,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,IAAI;IAIvE,OAAO,CAAC,YAAY;CAQrB"}

package/dist/domains/udp.js

@@ -491,7 +491,10 @@ export class UdpAPI {
      * Send a spatial text/chat packet, fanned out to nearby actors as a
      * `ClientTextNotification`. Fire-and-forget; opens a UDP proxy session
      * automatically. The sender receives no success echo; failures arrive
-     * asynchronously as `GenericErrorResponse` on {@link subscribe}.
+     * asynchronously as `GenericErrorResponse` on {@link subscribe}. Needs the
+     * `use_text_chat` runtime permission on the app (Game API v2.55.0; every tier
+     * that grants `access` has it unless the app took it away): without it the
+     * server answers `UNAUTHORIZED`.
      *
      * @param input - {@link ClientTextPacketInput}:
      *   - `appId` — owning app id (`BigInt` as a decimal string).
@@ -614,6 +617,9 @@ export class UdpAPI {
      * Fire-and-forget: the sender receives no echo, so there is no
      * `sendSingleActorMessageAndWait` variant. The target receives a
      * `SingleActorMessageNotification` on its `udpNotifications` subscription.
+     * Needs the `use_direct_messages` runtime permission on the app (Game API
+     * v2.55.0; every tier that grants `access` has it unless the app took it
+     * away): without it the server answers `UNAUTHORIZED`.
      *
      * @param input - {@link SingleActorMessageInput}:
      *   - `appId` — the destination actor's app id (`BigInt` as a decimal string).
@@ -681,8 +687,10 @@ export class UdpAPI {
      * Publish a message to a channel. Delivered to every active member of the
      * channel (regardless of location) as a `ChannelMessageNotification` on their
      * `udpNotifications` subscription. Requires the channel `send_messages`
-     * permission; the server drops the message otherwise. Fire-and-forget: the
-     * sender receives no echo.
+     * permission and, from Game API v2.55.0, the `use_text_chat` runtime
+     * permission on the channel's app; without either the server answers
+     * `UNAUTHORIZED` on {@link subscribe}. Fire-and-forget: the sender receives
+     * no echo.
      *
      * @param input - {@link ChannelMessageInput}:
      *   - `channelId` — the channel id (`groups.group_id`) as a `BigInt` decimal
@@ -693,8 +701,9 @@ export class UdpAPI {
      *     1024 bytes.
      *   - `sequenceNumber` — optional uint8 (0-255) correlation id.
      * @returns `true` when accepted for sending — **not** confirmation of
-     *   delivery; note that a message dropped for a missing `send_messages`
-     *   permission still returns `true`.
+     *   delivery; a message refused for a missing `send_messages` or
+     *   `use_text_chat` still returns `true` (the refusal arrives as a
+     *   `genericError` notification).
      * @throws {CrowdyGraphQLError} on auth/validation failures.
      */
     async sendChannelMessage(input) {
@@ -742,8 +751,8 @@ export class UdpAPI {
      * {@link sendChannelMessage}, when one of its live actors is in `appId`
      * within `maxDistance` chunks of `chunk`, measured as the straight-line
      * distance between chunk coordinates, boundary included. A member with no
-     * live actor does not receive it. Same send right as `sendChannelMessage`;
-     * the sender receives no echo.
+     * live actor does not receive it. Same send right and `use_text_chat` as
+     * `sendChannelMessage`; the sender receives no echo.
      *
      * @param input - {@link RangedChannelMessageInput}:
      *   - `channelId` — the channel id (`groups.group_id`) as a `BigInt` decimal
@@ -758,8 +767,9 @@ export class UdpAPI {
      *     2147483647. Not the 0-8 Chebyshev ring count spatial sends take.
      *   - `sequenceNumber` — optional uint8 (0-255) correlation id.
      * @returns `true` when accepted for sending — **not** confirmation of
-     *   delivery. A refusal (no send right: `UNAUTHORIZED`; another app:
-     *   `INVALID_APP_ID`) arrives as a `genericError` notification.
+     *   delivery. A refusal (no send right or no `use_text_chat`:
+     *   `UNAUTHORIZED`; another app: `INVALID_APP_ID`) arrives as a
+     *   `genericError` notification.
      * @throws {CrowdyGraphQLError} on auth/validation failures.
      */
     async sendRangedChannelMessage(input) {

package/dist/generated/graphql-schema.d.ts

@@ -49,6 +49,32 @@ export type AccountBlock = {
     /** The account. */
     userId: Scalars['BigInt']['output'];
 };
+/** An account erasure: what deleting an account erases (its player-side content) and where that stands. Usage, billing, audit and legal records stay, and so does everything the account owns as a developer. */
+export type AccountErasure = {
+    __typename?: 'AccountErasure';
+    /** Apps the account had content in. */
+    apps: Scalars['Int']['output'];
+    /** Of those, the apps already erased. */
+    appsDone: Scalars['Int']['output'];
+    /** When it finished, or null. */
+    completedAt: Maybe<Scalars['DateTime']['output']>;
+    /** The last error, from the finish or from an app, or null. */
+    lastError: Maybe<Scalars['String']['output']>;
+    /** OPERATOR ONLY. While a legal hold defers the erasure, what the account row said before it was blanked (email, gamertag, external id, organization), as JSON; null otherwise. */
+    preservedIdentity: Maybe<Scalars['String']['output']>;
+    /** Why it was asked for: SELF_DELETE (the player deleted its own account), MANAGED_DELETE (its organization deleted it) or OPERATOR. */
+    reason: Scalars['String']['output'];
+    /** When it was asked for. */
+    requestedAt: Scalars['DateTime']['output'];
+    /** Who asked: user:<id>, org_token:<id> or operator:<id>. */
+    requestedBy: Maybe<Scalars['String']['output']>;
+    /** PENDING (apps still to do), RUNNING (finishing), DONE, FAILED (the finish threw; it is retried) or DEFERRED_HOLD (a legal hold applies; nothing is erased until it is released). */
+    status: Scalars['String']['output'];
+    /** What was erased, as JSON: rows removed per table, summed over the apps, and the account-wide rows. */
+    summary: Maybe<Scalars['String']['output']>;
+    /** The deleted account. */
+    userId: Scalars['BigInt']['output'];
+};
 export type Actor = {
     __typename?: 'Actor';
     /** App (game) this actor belongs to. BigInt serialized as a decimal string. */
@@ -902,6 +928,8 @@ export type App = {
     redirectUris: Array<Scalars['String']['output']>;
     /** Whether replay logging is on: the realtime servers record every client message they accept for this app, searchable with inputLogSessions and readable with inputLogMessages, and billed as stored input logs. False (the default) records nothing ("No replication logging"). Set with updateApp (manage_apps); turning it on needs a wallet that covers the projected cost of one retention period, or a billing-exempt org. */
     replayLoggingEnabled: Scalars['Boolean']['output'];
+    /** Whether replay logging records the app's voice, webcam video and channel audio messages too. True (the default) records them with every other message; false leaves them out of the input log while everything else is still recorded. Applies only while replayLoggingEnabled is on. Set with updateApp (manage_apps). */
+    replayLoggingRecordsMedia: Scalars['Boolean']['output'];
     /**
      * Reserved realtime (UDP) capacity in bytes/s for shared apps. Superseded by reservedUdpBytesPerSec.
      * @deprecated Renamed 2026-09-01 when reservations split by traffic type. Use reservedUdpBytesPerSec; this returns the same value for one release.
@@ -2031,6 +2059,8 @@ export type ConnectionPageInfo = {
 export type CreateAccessTierInput = {
     /** Numeric id of the app the tier belongs to. The caller must hold manage_access_tiers on this app. */
     appId: Scalars['BigInt']['input'];
+    /** When true (the default) and the tier grants access, it also grants use_text_chat and use_direct_messages, whether or not permissionKeys names them: without them the realtime servers refuse the tier’s text chat and direct messages. Pass false to grant exactly permissionKeys, for example a tier without text chat. */
+    applyCommunicationDefaults?: InputMaybe<Scalars['Boolean']['input']>;
     /** Optional marketing description of the tier. */
     description?: InputMaybe<Scalars['String']['input']>;
     /** Optional; whether this is the app's default tier. Defaults to false. */
@@ -4485,6 +4515,28 @@ export type InviteOrgMemberInput = {
     /** user_id of the user to add (BigInt as string). */
     userId: Scalars['BigInt']['input'];
 };
+/** A legal hold an operator set on an organization or on one account. While it applies, deleting a managed player it covers is refused with LEGAL_HOLD, a player’s own account deletion closes the account but keeps its content (and preserves its identity) until the hold is released, and no erasure runs. An organization’s hold covers its managed players. A released hold stays readable as the record. */
+export type LegalHold = {
+    __typename?: 'LegalHold';
+    /** Whether it applies now. */
+    active: Scalars['Boolean']['output'];
+    /** The hold. */
+    holdId: Scalars['BigInt']['output'];
+    /** The organization held (its public id), or null for a hold on one account. */
+    orgId: Maybe<Scalars['BigInt']['output']>;
+    /** Why, as the operator wrote it. */
+    reason: Scalars['String']['output'];
+    /** When it was released, or null while it applies. */
+    releasedAt: Maybe<Scalars['DateTime']['output']>;
+    /** The operator who released it, or null while it applies. */
+    releasedBy: Maybe<Scalars['BigInt']['output']>;
+    /** When it was set. */
+    setAt: Scalars['DateTime']['output'];
+    /** The operator who set it. */
+    setBy: Scalars['BigInt']['output'];
+    /** The account held, or null for a hold on an organization. */
+    userId: Maybe<Scalars['BigInt']['output']>;
+};
 /** Link an additional federated identity to the signed-in account. */
 export type LinkIdentityInput = {
     code: Scalars['String']['input'];
@@ -4735,9 +4787,9 @@ export type Mutation = {
     deleteChannelRole: Scalars['Boolean']['output'];
     /** Delete a studio-created peer grid so its chunk box no longer blocks overlapping grid creation. Requires app-admin ('manage_apps'). Returns a hybrid response — on success `gridId` is populated and `error` is NO_ERROR; on failure `gridId` is null and `error` is a UDP-style error code (e.g. GRID_NOT_FOUND, CANNOT_DELETE_DEFAULT_WORLD_GRID, GRID_HAS_NESTED_CHILDREN). The open-by-default world grid and any grid that still contains nested child grids cannot be deleted. */
     deleteGrid: DeleteGridResponse;
-    /** Delete a managed player: its sessions end and its row is anonymized, as an account deletion is. Signing the same external id in again creates a new player. False when there was no such player. An org token with players:manage, or an org admin with manage_players. */
+    /** Delete a managed player, as an account deletion is: its sessions end, its externalId and gamertag are removed, and its player-side content is erased within minutes (Crowdy Studio projects, libraries and agent sessions, mods, actors, avatars and saved state, access grants, grid claims, team and channel memberships). Usage and billing records stay; world edits stay, under the account’s now anonymous id; recorded inputs age out with the input log’s retention. Refused with LEGAL_HOLD while a legal hold covers the player or the organization: disable it instead (updateManagedPlayer), which keeps everything. Signing the same external id in again creates a new player. False when there was no such player. An org token with players:manage, or an org admin with manage_players. */
     deleteManagedPlayer: Scalars['Boolean']['output'];
-    /** DESTRUCTIVE self-service: soft-deletes the authenticated caller's OWN account — anonymizes PII and revokes all sessions; wallet, voxel, and donation history stay intact via FK. Acts only on the caller (no target argument). Requires a valid game token. */
+    /** DESTRUCTIVE self-service: deletes the authenticated caller's OWN account. Every session, app token, realtime connection and ck-exec socket ends; the email, password, gamertag and profile state are removed from the account; and its player-side content is erased within minutes: Crowdy Studio projects, libraries and agent sessions, mods, actors, avatars and saved state, access grants, grid claims, and team and channel memberships. Wallet, billing, usage, audit and legal records stay, and so does everything the account owns as a developer (organizations, apps, published games); world edits stay, under the account's now anonymous id; recorded inputs age out with the input log's retention. Acts only on the caller (no target argument). Requires a valid token. */
     deleteMyAccount: Scalars['Boolean']['output'];
     /** Deletes an organization role. Requires the 'manage_members' permission on the role's org (super admins bypass). DESTRUCTIVE: removes the role and unassigns it from all members. Returns false if the role does not exist. */
     deleteOrgRole: Scalars['Boolean']['output'];
@@ -4863,6 +4915,8 @@ export type Mutation = {
     reinstateOrganization: OrgRetirementType;
     /** Release a one-chunk grid previously created through claimGridChunk. Requires an ordinary app-scoped player token and the caller must still be its current user owner. Refuses foreign grids, studio/marketplace grids, and grids assigned through legacy claimGridOwnership. Atomically removes pending claim requests and invites, self-claim ownership, direct/effective ACL rows, and the grid so its chunk can be claimed again. */
     releaseClaimedGrid: ReleaseClaimedGridResult;
+    /** OPERATOR: release a legal hold. The hold stays as the record. Erasures it deferred resume once no other hold covers their accounts. */
+    releaseLegalHold: LegalHold;
     /** Remove a member from a channel. Requires the 'manage_members' channel permission, except that any member may remove themselves. Notifies Buddy to stop routing to the removed member. Returns true if a membership was removed. */
     removeChannelMember: Scalars['Boolean']['output'];
     /** Removes a user from an organization. Requires the 'manage_members' permission on the org (super admins bypass). DESTRUCTIVE: revokes the user's membership and role assignments in that org. Returns false if the user was not a member. */
@@ -4871,6 +4925,8 @@ export type Mutation = {
     removeSharedPaymentMethod: Scalars['Boolean']['output'];
     /** Remove a member from a team. Requires the 'manage_members' team permission, except that any member may remove themselves. DESTRUCTIVE: drops the membership and its roles. Returns true if a membership was removed. */
     removeTeamMember: Scalars['Boolean']['output'];
+    /** OPERATOR: erase the player-side content of a deleted account, as a deletion does: one deleted before account erasure existed (2026-10-23), or one whose erasure stopped after its retries (its attempts start again). Refused for an account that is not deleted. A legal hold defers it. */
+    requestAccountErasure: AccountErasure;
     /** Passwordless: email a one-time magic sign-in link to the address (creates the account on first sign-in). Always reports sent=true (no account enumeration). Public; first-party origins only (HOSTED_SIGN_IN_REQUIRED otherwise); rate-limited. */
     requestLoginLink: RequestLoginLinkResult;
     /** Starts the password-reset flow by emailing a reset link to the address. Always returns true regardless of whether the email exists (prevents account enumeration). The reset link is also the ownership-proven way an existing passwordless account adds a password. Public; first-party origins only (HOSTED_SIGN_IN_REQUIRED otherwise); rate-limited. */
@@ -4915,17 +4971,17 @@ export type Mutation = {
     sendAudioPacket: Scalars['Boolean']['output'];
     /** Send audio to a channel: delivered to every active member of the channel, wherever they are (party or guild voice), as a ChannelAudioNotification on udpNotifications. The payload is opaque (at most 1024 bytes): your app or an SDK voice helper defines the format and codec. Requires a bearer game token, the channel send_voice permission and the player’s use_voice_chat; without either the server refuses it with UNAUTHORIZED (asynchronously, on udpNotifications). Opens a UDP proxy session automatically if none exists. The sender receives no echo. Every member’s downlink is billed as egress, so keep voice channels small. Returns Boolean! that is true only when the datagram was ACCEPTED FOR SENDING, not delivered; correlate failures by sequenceNumber (correlation only, not an idempotency key). */
     sendChannelAudio: Scalars['Boolean']['output'];
-    /** Publish a message to a channel, delivered to every active member of the channel (not chunk-routed) as a ChannelMessageNotification on udpNotifications. Requires a bearer game token and the channel send_messages permission; lacking the permission the server drops the message. Opens a UDP proxy session automatically if none exists. The sender receives no echo. Returns Boolean! that is true only when the datagram was ACCEPTED FOR SENDING — NOT confirmation of delivery; failures arrive ASYNCHRONOUSLY as GenericErrorResponse on udpNotifications, correlated by the request sequenceNumber (correlation only — not an idempotency key; the server does not dedupe replays). */
+    /** Publish a message to a channel, delivered to every active member of the channel (not chunk-routed) as a ChannelMessageNotification on udpNotifications. Requires a bearer game token, the channel send_messages permission and the use_text_chat runtime permission on the channel’s app; lacking either the game server answers asynchronously with a GenericErrorResponse (errorCode UNAUTHORIZED). Opens a UDP proxy session automatically if none exists. The sender receives no echo. Returns Boolean! that is true only when the datagram was ACCEPTED FOR SENDING — NOT confirmation of delivery; failures arrive ASYNCHRONOUSLY as GenericErrorResponse on udpNotifications, correlated by the request sequenceNumber (correlation only — not an idempotency key; the server does not dedupe replays). */
     sendChannelMessage: Scalars['Boolean']['output'];
     /** Send a custom, app-defined client event (identified by eventType, a uint16) for spatial replication to nearby chunks; nearby actors receive it as a ClientEventNotification. Requires a bearer game token; opens a UDP proxy session automatically if none exists. Returns Boolean! that is true only when the datagram was ACCEPTED FOR SENDING — NOT that the world processed it. Failures arrive ASYNCHRONOUSLY as GenericErrorResponse on udpNotifications, correlated by the request sequenceNumber (correlation only — not an idempotency key; the server does not dedupe replays). */
     sendClientEvent: Scalars['Boolean']['output'];
-    /** Publish a message to a channel that only reaches members near an origin chunk: a member receives it, as an ordinary ChannelMessageNotification on udpNotifications, when one of its live actors is in the same app within maxDistance chunks of input.chunk (straight-line distance between chunk coordinates, boundary included). A member with no live actor does not receive it. Requires a bearer game token and the channel send_messages permission, as for sendChannelMessage; the origin app must be the token’s app. Opens a UDP proxy session automatically if none exists. The sender receives no echo. Returns Boolean! that is true only when the datagram was ACCEPTED FOR SENDING — NOT confirmation of delivery; failures arrive ASYNCHRONOUSLY as GenericErrorResponse on udpNotifications (UNAUTHORIZED without the send right, INVALID_APP_ID for another app), correlated by the request sequenceNumber (correlation only — not an idempotency key; the server does not dedupe replays). */
+    /** Publish a message to a channel that only reaches members near an origin chunk: a member receives it, as an ordinary ChannelMessageNotification on udpNotifications, when one of its live actors is in the same app within maxDistance chunks of input.chunk (straight-line distance between chunk coordinates, boundary included). A member with no live actor does not receive it. Requires a bearer game token, the channel send_messages permission and use_text_chat, as for sendChannelMessage; the origin app must be the token’s app. Opens a UDP proxy session automatically if none exists. The sender receives no echo. Returns Boolean! that is true only when the datagram was ACCEPTED FOR SENDING — NOT confirmation of delivery; failures arrive ASYNCHRONOUSLY as GenericErrorResponse on udpNotifications (UNAUTHORIZED without the send right or use_text_chat, INVALID_APP_ID for another app), correlated by the request sequenceNumber (correlation only — not an idempotency key; the server does not dedupe replays). */
     sendRangedChannelMessage: Scalars['Boolean']['output'];
-    /** Send a direct actor-to-actor message, delivered only to the actor identified by targetUuid (NOT broadcast to nearby actors). The sender must know the destination actor’s current chunk. Requires a bearer game token; opens a UDP proxy session automatically if none exists. The target receives a SingleActorMessageNotification on udpNotifications; the sender receives no echo. Returns Boolean! that is true only when the datagram was ACCEPTED FOR SENDING — NOT confirmation of delivery; failures arrive ASYNCHRONOUSLY as GenericErrorResponse on udpNotifications, correlated by the request sequenceNumber (correlation only — not an idempotency key; the server does not dedupe replays). */
+    /** Send a direct actor-to-actor message, delivered only to the actor identified by targetUuid (NOT broadcast to nearby actors). The sender must know the destination actor’s current chunk. Requires a bearer game token and the use_direct_messages runtime permission on the app (a tier that grants access grants it unless the app took it away); without it the game server answers asynchronously with a GenericErrorResponse (errorCode UNAUTHORIZED). Opens a UDP proxy session automatically if none exists. The target receives a SingleActorMessageNotification on udpNotifications; the sender receives no echo. Returns Boolean! that is true only when the datagram was ACCEPTED FOR SENDING — NOT confirmation of delivery; failures arrive ASYNCHRONOUSLY as GenericErrorResponse on udpNotifications, correlated by the request sequenceNumber (correlation only — not an idempotency key; the server does not dedupe replays). */
     sendSingleActorMessage: Scalars['Boolean']['output'];
     /** Operator only (is_operator). Sends a plain test message to one address and returns the SES message id. SIDE EFFECTS: a real outbound email billed to the shared SES identity, and a `send` row in email_events. Prefer the AWS mailbox simulator (success@ / bounce@ / complaint@simulator.amazonses.com), which exercises the whole path without touching a real inbox or a real reputation. `sent: true` with `simulated: true` means SEND_EMAILS is off and nothing left the building -- read both fields. */
     sendTestEmail: SendTestEmailResult;
-    /** Send a spatial text/chat packet, fanned out to nearby actors as a ClientTextNotification. Requires a bearer game token; opens a UDP proxy session automatically if none exists. Returns Boolean! that is true only when the datagram was ACCEPTED FOR SENDING to the game server — NOT confirmation of delivery. The sender receives no echo; failures arrive ASYNCHRONOUSLY as GenericErrorResponse on udpNotifications, correlated by the request sequenceNumber (correlation only — not an idempotency key; the server does not dedupe replays). */
+    /** Send a spatial text/chat packet, fanned out to nearby actors as a ClientTextNotification. Requires a bearer game token and the use_text_chat runtime permission on the app (a tier that grants access grants it unless the app took it away); without it the game server answers asynchronously with a GenericErrorResponse (errorCode UNAUTHORIZED). Opens a UDP proxy session automatically if none exists. Returns Boolean! that is true only when the datagram was ACCEPTED FOR SENDING to the game server — NOT confirmation of delivery. The sender receives no echo; failures arrive ASYNCHRONOUSLY as GenericErrorResponse on udpNotifications, correlated by the request sequenceNumber (correlation only — not an idempotency key; the server does not dedupe replays). */
     sendTextPacket: Scalars['Boolean']['output'];
     /** Send ONE webcam video fragment, fanned out to nearby actors as a ClientVideoNotification (Buddy v0.25.0). Requires a bearer game token and the use_video_chat runtime permission at app AND grid level -- without it the game server responds asynchronously with a GenericErrorResponse (errorCode UNAUTHORIZED). A datagram carries at most ~1117 bytes of videoData, so an encoded frame is split by the SDK into fragments (6-byte header: version, codec, frameId, fragIndex, fragCount; at most 16 per frame) and reassembled by receivers; this is a mutation PER FRAGMENT and sustained video belongs on the binary realtime relay. Every receiver in range pays the egress bytes: keep distance small and frames few. Opens a UDP proxy session automatically if none exists. Returns Boolean! that is true only when the datagram was ACCEPTED FOR SENDING -- NOT that it was delivered; the sender receives no echo, only errors (GenericErrorResponse, correlated by sequenceNumber) on udpNotifications. */
     sendVideoPacket: Scalars['Boolean']['output'];
@@ -4971,6 +5027,8 @@ export type Mutation = {
     setHostedGameListing: HostedGame;
     /** Adds a password to the signed-in account when it does not have one yet — for an account created by magic link or a social provider, which previously had no in-product way to add password sign-in. Requires a valid session token; the session is the proof of account control, so the password is usable immediately and no email confirmation is needed. Refuses with extensions.code PASSWORD_ALREADY_SET (409) when a password is already set — use changePassword, which verifies the current one, or the reset flow if it is forgotten. (Before v1.60.0 that refusal reached clients as INTERNAL_SERVER_ERROR while this description said CONFLICT, so a client could only recognise it by the message text.) A security notification is emailed to the account address. Existing sessions are not revoked. */
     setInitialPassword: Scalars['Boolean']['output'];
+    /** OPERATOR: put an organization (and its managed players) or one account under a legal hold. While it applies, deleting a managed player it covers is refused with LEGAL_HOLD, a player’s own deletion closes the account but keeps its content and preserves its identity, and no erasure runs. */
+    setLegalHold: LegalHold;
     /** Super-admin only. Flip users.is_operator to grant or revoke control-plane / operator access. */
     setOperator: User;
     /** OPERATOR ONLY. Sets or clears an organization billing exemption. When true, org-wallet debits and money-driven runtime denials are skipped; usage is still metered and every waived amount is written to org_billing_waivers. Does not waive player-wallet charges, failure breakers, or the per-minute compute budget. reason is required when setting true. SIDE EFFECT: re-evaluates the runtime gate for every shared app in the org, so clearing the exemption re-denies immediately instead of waiting for the next hourly tick. */
@@ -5031,7 +5089,7 @@ export type Mutation = {
     updateActor: Actor;
     /** Replaces an actor’s `publicState` and/or `privateState` blobs (fields omitted from `input` are left unchanged). OWNER-EXCLUSIVE: only the actor’s owner may write (throws Unauthorized otherwise). Game-plane: requires an app token for the actor’s app (a session token or another app’s token is answered NotFound). `uuid` is the 32-character ASCII actor id; blobs are base64-encoded binary. */
     updateActorState: Actor;
-    /** Update mutable fields of an existing app (name, description, visibility, status, metadata, wildernessWritesOpen, replayLoggingEnabled); only fields present in the input are changed. Turning replayLoggingEnabled on is refused with INPUT_LOG_FUNDS_NEEDED unless the org's wallet can spend at least the projected cost of keeping one retention period of the app's recent traffic (extensions.requiredMicrousd and spendableMicrousd say how much), or the org is billing-exempt; recordings already kept go on billing after it is turned off, until they age out. Requires the 'manage_apps' permission on the app (resolved via its org); super admins bypass. Use this to publish (status=LIVE), change visibility, or restore an archived app (status back to DRAFT/LIVE). Throws if the app id does not exist. */
+    /** Update mutable fields of an existing app (name, description, visibility, status, metadata, wildernessWritesOpen, claimOwnerKeys, replayLoggingEnabled, replayLoggingRecordsMedia); only fields present in the input are changed. Turning replayLoggingEnabled on is refused with INPUT_LOG_FUNDS_NEEDED unless the org's wallet can spend at least the projected cost of keeping one retention period of the app's recent traffic (extensions.requiredMicrousd and spendableMicrousd say how much), or the org is billing-exempt; recordings already kept go on billing after it is turned off, until they age out. Requires the 'manage_apps' permission on the app (resolved via its org); super admins bypass. Use this to publish (status=LIVE), change visibility, or restore an archived app (status back to DRAFT/LIVE). Throws if the app id does not exist. */
     updateApp: App;
     /** Updates an avatar’s mutable fields (currently `name`) and returns it. OWNER-EXCLUSIVE: only the avatar’s owner may call this (throws Unauthorized otherwise). Requires a valid game token. To change state blobs use `updateAvatarState`. */
     updateAvatar: Avatar;
@@ -5542,6 +5600,9 @@ export type MutationReleaseClaimedGridArgs = {
     appId: Scalars['BigInt']['input'];
     gridId: Scalars['BigInt']['input'];
 };
+export type MutationReleaseLegalHoldArgs = {
+    holdId: Scalars['BigInt']['input'];
+};
 export type MutationRemoveChannelMemberArgs = {
     groupId: Scalars['BigInt']['input'];
     userId: Scalars['BigInt']['input'];
@@ -5560,6 +5621,9 @@ export type MutationRemoveTeamMemberArgs = {
     groupId: Scalars['BigInt']['input'];
     userId: Scalars['BigInt']['input'];
 };
+export type MutationRequestAccountErasureArgs = {
+    userId: Scalars['BigInt']['input'];
+};
 export type MutationRequestLoginLinkArgs = {
     input: RequestLoginLinkInput;
 };
@@ -5735,6 +5799,9 @@ export type MutationSetHostedGameListingArgs = {
 export type MutationSetInitialPasswordArgs = {
     newPassword: Scalars['String']['input'];
 };
+export type MutationSetLegalHoldArgs = {
+    input: SetLegalHoldInput;
+};
 export type MutationSetOperatorArgs = {
     userId: Scalars['BigInt']['input'];
     value: Scalars['Boolean']['input'];
@@ -6817,6 +6884,8 @@ export type Query = {
     __typename?: 'Query';
     /** ADMIN: the target account's platform-wide block: whether it holds now, and the last one set (who, when, why, until). Requires a super-admin bearer game token. */
     accountBlock: AccountBlock;
+    /** OPERATOR: where the erasure of a deleted account stands (what deleting it erases, app by app), or null if none was asked for. While a legal hold defers it, preservedIdentity carries what the account row said before it was blanked. */
+    accountErasure: Maybe<AccountErasure>;
     /** List only healthy GraphQL API servers (status = ReadyForClients) for client routing/discovery. No authentication required. */
     activeGraphQLServers: Array<GraphQlServer>;
     /** Fetches a single actor by its 32-character ASCII `uuid`. Game-plane: requires an app token for the actor’s app (a session token or another app’s token is answered NotFound, the same as a missing id). Owner-aware: the owner receives full state; non-owners receive a public copy with `privateState` stripped (null). */
@@ -7046,6 +7115,8 @@ export type Query = {
     inputLogMessages: InputLogMessageConnection;
     /** Recorded client sessions of an app with replay logging on (App.replayLoggingEnabled), newest first. With 'manage_apps' on the app you see every session and may filter by userId; anyone else sees only their own, and asking for another user's is FORBIDDEN. Game plane: send the app-scoped token for this app to the app's datacenter. Page with `first` (default 50, max 200) and `after`. INPUT_LOG_UNAVAILABLE when input logging is not configured on this deployment. */
     inputLogSessions: InputLogSessionConnection;
+    /** OPERATOR: legal holds, newest first (at most 500), on one organization or account if given; only the ones that apply now unless includeReleased. */
+    legalHolds: Array<LegalHold>;
     /** Lists recorded voxel edits for all chunks within a cubic (Chebyshev) radius of a center chunk, grouped per chunk and ordered by increasing distance, paginated over chunks. Requires a valid bearer token; app-scoped tokens are limited to their own app. Read-only. */
     listVoxelUpdatesByDistance: VoxelUpdatesByDistanceResponse;
     /** Lists recorded voxel edits for a single chunk (optionally only those at/after `since`), newest first. Requires a valid bearer token; app-scoped tokens are limited to their own app. Read-only. */
@@ -7223,6 +7294,9 @@ export type Query = {
 export type QueryAccountBlockArgs = {
     userId: Scalars['BigInt']['input'];
 };
+export type QueryAccountErasureArgs = {
+    userId: Scalars['BigInt']['input'];
+};
 export type QueryActorArgs = {
     uuid: Scalars['String']['input'];
 };
@@ -7616,6 +7690,11 @@ export type QueryInputLogSessionsArgs = {
     filter?: InputMaybe<InputLogSessionFilter>;
     first?: InputMaybe<Scalars['Int']['input']>;
 };
+export type QueryLegalHoldsArgs = {
+    includeReleased?: InputMaybe<Scalars['Boolean']['input']>;
+    orgId?: InputMaybe<Scalars['BigInt']['input']>;
+    userId?: InputMaybe<Scalars['BigInt']['input']>;
+};
 export type QueryListVoxelUpdatesByDistanceArgs = {
     input: ListVoxelUpdatesByDistanceInput;
 };
@@ -8469,6 +8548,15 @@ export type SetHostedGameListingInput = {
     listed: Scalars['Boolean']['input'];
     slug: Scalars['String']['input'];
 };
+/** A legal hold to set: exactly one of orgId (an organization and its managed players) and userId (one account), and why. */
+export type SetLegalHoldInput = {
+    /** The organization to hold (its public id). Covers its managed players. */
+    orgId?: InputMaybe<Scalars['BigInt']['input']>;
+    /** Why the hold is set (the matter it preserves for), at most 500 characters. */
+    reason: Scalars['String']['input'];
+    /** The account to hold. */
+    userId?: InputMaybe<Scalars['BigInt']['input']>;
+};
 /** Replace a member's roles in a group (the listed roles become their full set). */
 export type SetMemberRolesInput = {
     /** The group (team/channel) id. */
@@ -8888,6 +8976,8 @@ export type UdpProxyConnectionStatus = {
 };
 /** Fields to update on an access tier. All fields are optional; omitted fields are left unchanged. */
 export type UpdateAccessTierInput = {
+    /** With permissionKeys: when true (the default) and the new set grants access, it also grants use_text_chat and use_direct_messages, whether or not permissionKeys names them. Pass false to set exactly permissionKeys, for example to take text chat away. Ignored without permissionKeys. */
+    applyCommunicationDefaults?: InputMaybe<Scalars['Boolean']['input']>;
     /** New billing cadence (e.g. "month", "year"); null clears it. */
     billingPeriod?: InputMaybe<Scalars['String']['input']>;
     /** New ISO 4217 currency code (e.g. "usd"). */
@@ -8941,6 +9031,8 @@ export type UpdateAppInput = {
     name?: InputMaybe<Scalars['String']['input']>;
     /** Turn replay logging on (true) or off (false): record every client message the realtime servers accept for this app (keep-alives included), kept for the input log's published retention and billed as stored input logs (input_log_storage_byte_hours, no free allowance). Turning it ON is refused with INPUT_LOG_FUNDS_NEEDED unless the org's wallet can spend at least the projected cost of keeping one retention period of the app's recent traffic, or the org is billing-exempt; turning it off always succeeds, and what was already recorded goes on billing until it ages out. Recording starts and stops within about 15 seconds. Omit to leave unchanged. */
     replayLoggingEnabled?: InputMaybe<Scalars['Boolean']['input']>;
+    /** With replay logging on, record the app's voice (sendAudioPacket), webcam video (sendVideoPacket) and channel audio (sendChannelAudio) too (true, the default) or leave them out of the input log (false); every other message is recorded either way. Takes effect within about 15 seconds; what was already recorded stays until it ages out. Omit to leave unchanged. */
+    replayLoggingRecordsMedia?: InputMaybe<Scalars['Boolean']['input']>;
     /** New lifecycle status; set LIVE to publish, or DRAFT/LIVE to restore an archived app. Omit to leave unchanged. */
     status?: InputMaybe<AppStatus>;
     /** New visibility (PUBLIC/UNLISTED/PRIVATE). Omit to leave unchanged. */