@crowdedkingdoms/crowdyjs 18.5.0-dev.1 → 18.6.0-dev.1

package/dist/generated/graphql-schema.d.ts

@@ -179,6 +179,15 @@ export type ActorsConnection = {
     /** Total matching records across all pages, when known (null for sources that do not compute a total). */
     totalCount: Maybe<Scalars['Int']['output']>;
 };
+export type AddTierAccessRuleInput = {
+    /** When the listing ends (a contractor engagement). Omit for none. */
+    expiresAt?: InputMaybe<Scalars['DateTime']['input']>;
+    kind: TierAccessRuleKind;
+    /** Who this is and why, for the next operator. */
+    note?: InputMaybe<Scalars['String']['input']>;
+    /** An email address (EMAIL) or a domain (EMAIL_DOMAIN). */
+    value: Scalars['String']['input'];
+};
 export type AdmitAppCodeInput = {
     /** Numeric app id whose allow list receives this entry. */
     appId: Scalars['BigInt']['input'];
@@ -871,6 +880,8 @@ export type App = {
     orgId: Scalars['BigInt']['output'];
     /** OAuth-style redirect-URI allow-list for the portal handoff. A portal authorization code’s redirect_uri must match one of these by origin; empty disallows browser portal entry to this app. */
     redirectUris: Array<Scalars['String']['output']>;
+    /** Whether replay logging is on: the realtime servers record every client input they accept for this app, searchable with inputLogSessions and readable with inputLogMessages, and billed as stored input logs. False (the default) records nothing ("No replication logging"). Set with updateApp (manage_apps); turning it on needs a funded org wallet or a billing-exempt org. */
+    replayLoggingEnabled: Scalars['Boolean']['output'];
     /**
      * Reserved realtime (UDP) capacity in bytes/s for shared apps. Superseded by reservedUdpBytesPerSec.
      * @deprecated Renamed 2026-09-01 when reservations split by traffic type. Use reservedUdpBytesPerSec; this returns the same value for one release.
@@ -1185,10 +1196,14 @@ export type AppUsageProjection = {
     daysElapsed: Scalars['Float']['output'];
     /** Per-app free monthly egress allowance in bytes (5 decimal GB). */
     freeAllowanceBytes: Scalars['String']['output'];
+    /** Stored input logs this calendar month so far, in byte-hours (input_log_storage_byte_hours, which has no free allowance). 0 when replay logging was off all month. */
+    inputLogByteHours: Scalars['String']['output'];
     /** True when projected egress exceeds the free allowance, or null when insufficient data. */
     onTrackToExceed: Maybe<Scalars['Boolean']['output']>;
     /** Projected end-of-month egress bytes (linear extrapolation), or null when insufficient data. */
     projectedBytes: Maybe<Scalars['String']['output']>;
+    /** Projected end-of-month stored input logs in byte-hours (linear extrapolation), or null when insufficient data. */
+    projectedInputLogByteHours: Maybe<Scalars['String']['output']>;
     /** Projected usage as a percentage of the free allowance, or null when insufficient data. */
     projectedPctOfFree: Maybe<Scalars['Float']['output']>;
     /** True when at least 3 days have elapsed in the month (projection is meaningful). */
@@ -1209,6 +1224,10 @@ export type AppUsageSummary = {
     graphqlRecvBytes: Scalars['String']['output'];
     /** Total GraphQL bytes sent (string counter). */
     graphqlSendBytes: Scalars['String']['output'];
+    /** Stored input logs over the window, in byte-hours (string counter): the sum of the hourly samples, which is the quantity input_log_storage_byte_hours bills. Each recorded byte (InputLogMessage.sizeBytes) is held for the input log retention, one byte-hour per hour. 0 when replay logging was off. */
+    inputLogByteHours: Scalars['String']['output'];
+    /** Recorded input-log bytes the app holds now (string counter): the latest hourly sample, the bytes recorded within the trailing retention. 0 when replay logging has never been on. */
+    inputLogRetainedBytes: Scalars['String']['output'];
     /** Total replication bytes received (string counter). */
     replicationRecvBytes: Scalars['String']['output'];
     /** Total replication bytes sent (string counter). */
@@ -2165,12 +2184,29 @@ export type CreateTeamInput = {
     /** Display name for the team (max 128 chars; unique per app+type). */
     name: Scalars['String']['input'];
 };
+export type CreateTierAccessProvisioningTokenInput = {
+    /** prefix*@domain patterns. The domain must be a reserved test domain (.invalid, .test, .example, .localhost, .local, example.com) or a company domain; the prefix is at least three characters. */
+    emailPatterns: Array<Scalars['String']['input']>;
+    /** Days until it expires (1-90). Accounts it created keep their grant. */
+    expiresInDays: Scalars['Int']['input'];
+    /** What uses it, e.g. identity-probe or bwf-loadtest. */
+    label: Scalars['String']['input'];
+    /** The most accounts it may ever create. */
+    maxAccounts: Scalars['Int']['input'];
+};
 export type CreateUserAppStateInput = {
     /** App (game) id to scope the state to. Required. BigInt sent as a decimal string. */
     appId: Scalars['BigInt']['input'];
     /** Per-app user state as base64-encoded binary, at most 1,048,576 base64 characters (~768 KiB binary); larger payloads draw a structured validation error. Omit or send null to clear it. */
     state?: InputMaybe<Scalars['String']['input']>;
 };
+/** OPERATOR: a new provisioning token. `token` is shown this once. */
+export type CreatedTierAccessProvisioningToken = {
+    __typename?: 'CreatedTierAccessProvisioningToken';
+    provisioningToken: TierAccessProvisioningToken;
+    /** The secret. Store it now; it cannot be read again. */
+    token: Scalars['String']['output'];
+};
 /** Single-use human decision lifecycle for one canonical argument hash. */
 export declare enum CrowdyStudioAgentApprovalStatus {
     /** Used exactly once for dispatch/execution. */
@@ -3859,6 +3895,15 @@ export type GrantGridPermissionsInput = {
     /** The user receiving the grant. Must already have active app access for this app. */
     userId: Scalars['BigInt']['input'];
 };
+/** OPERATOR: the result of a bulk grant by pattern. */
+export type GrantTierAccessByPatternResult = {
+    __typename?: 'GrantTierAccessByPatternResult';
+    dryRun: Scalars['Boolean']['output'];
+    /** Accounts granted (0 on a dry run). */
+    granted: Scalars['Int']['output'];
+    /** Accounts the pattern matches that lack a grant. */
+    matched: Scalars['Int']['output'];
+};
 /** Grant or revoke a feature key for an access tier. */
 export type GrantTierFeatureInput = {
     /** The app (tenant). */
@@ -4228,6 +4273,122 @@ export type ImportCrowdyStudioProjectFileInput = {
     /** Private LIBRARY or app-curated COMMON source. */
     source: CrowdyStudioImportSource;
 };
+/** One recorded client input: the message exactly as the client sent it, without its trailing authentication bytes. */
+export type InputLogMessage = {
+    __typename?: 'InputLogMessage';
+    /** The 32-character actor uuid of a spatial message; null for other types. */
+    actorUuid: Maybe<Scalars['String']['output']>;
+    /** The message bytes, base64: the client message from its type byte up to, not including, its authentication tail. */
+    body: Scalars['String']['output'];
+    /** The channel of a channel message; null for other types. */
+    channelId: Maybe<Scalars['BigInt']['output']>;
+    /** Chunk x of a spatial message's target chunk; null for other types. */
+    chunkX: Maybe<Scalars['BigInt']['output']>;
+    /** Chunk y of a spatial message's target chunk; null for other types. */
+    chunkY: Maybe<Scalars['BigInt']['output']>;
+    /** Chunk z of a spatial message's target chunk; null for other types. */
+    chunkZ: Maybe<Scalars['BigInt']['output']>;
+    /** True when the message arrived inside a client message bundle. */
+    fromBundle: Scalars['Boolean']['output'];
+    /** The game token the message was sent on. */
+    gameTokenId: Scalars['BigInt']['output'];
+    /** The client message type (its first byte). */
+    messageType: Scalars['Int']['output'];
+    /** When the realtime server received the message. */
+    receivedAt: Scalars['DateTime']['output'];
+    /** The receive time in Unix microseconds (receivedAt at full precision). */
+    receivedAtMicros: Scalars['BigInt']['output'];
+    /** The message's sequence byte, as the client sent it. */
+    seq: Scalars['Int']['output'];
+    /** False when the message type is one accepted without a signature. */
+    signed: Scalars['Boolean']['output'];
+    /** Recorded size in bytes, record header included: what stored input logs are billed on. */
+    sizeBytes: Scalars['Int']['output'];
+    /** The user whose client sent the message. */
+    userId: Scalars['BigInt']['output'];
+};
+/** A page of recorded inputs, oldest first. A page can hold fewer than `first` inputs when the read stopped at its time or scan limit; keep paging while hasNextPage is true. */
+export type InputLogMessageConnection = {
+    __typename?: 'InputLogMessageConnection';
+    /** Edges on this page. */
+    edges: Array<InputLogMessageEdge>;
+    /** Pagination metadata. */
+    pageInfo: ConnectionPageInfo;
+    /** Total matching records across all pages, when known (null for sources that do not compute a total). */
+    totalCount: Maybe<Scalars['Int']['output']>;
+};
+/** An edge in a InputLogMessage connection. */
+export type InputLogMessageEdge = {
+    __typename?: 'InputLogMessageEdge';
+    /** Opaque cursor for this edge. */
+    cursor: Scalars['String']['output'];
+    /** The node at the end of this edge. */
+    node: InputLogMessage;
+};
+/** Narrows inputLogMessages. All fields are optional and AND-combined. */
+export type InputLogMessageFilter = {
+    /** Only inputs received at or after this instant. */
+    from?: InputMaybe<Scalars['DateTime']['input']>;
+    /** Only these client message types (each 0-255, at most 64 of them). */
+    messageTypes?: InputMaybe<Array<Scalars['Int']['input']>>;
+    /** Only inputs received at or before this instant. */
+    to?: InputMaybe<Scalars['DateTime']['input']>;
+};
+/** One recorded client session of an app with replay logging on: a game token's inputs, from the first one the realtime servers accepted to the last. Kept for the input log's published retention. */
+export type InputLogSession = {
+    __typename?: 'InputLogSession';
+    /** The app the session belongs to. */
+    appId: Scalars['BigInt']['output'];
+    /** Recorded bytes (the sum of every message sizeBytes): the quantity stored input logs are billed on. */
+    byteCount: Scalars['BigInt']['output'];
+    /** The datacenter that recorded the session, when known. */
+    datacenter: Maybe<Scalars['String']['output']>;
+    /** How the session ended, as the client saw it: expired, revoked, reconnect or released. Null while it may still be running. */
+    endReason: Maybe<Scalars['String']['output']>;
+    /** When the session ended, if its end was recorded; null while it may still be running. */
+    endedAt: Maybe<Scalars['DateTime']['output']>;
+    /** The game token the session ran on; pass it to inputLogMessages to read the inputs. */
+    gameTokenId: Scalars['BigInt']['output'];
+    /** When the latest recorded input or marker arrived. */
+    lastSeenAt: Scalars['DateTime']['output'];
+    /** Inputs recorded in the session. */
+    messageCount: Scalars['BigInt']['output'];
+    /** The client message types the session contains, ascending. */
+    messageTypes: Array<Scalars['Int']['output']>;
+    /** When the first recorded input arrived. */
+    startedAt: Scalars['DateTime']['output'];
+    /** The user whose client sent the inputs. */
+    userId: Scalars['BigInt']['output'];
+};
+/** A page of recorded sessions. */
+export type InputLogSessionConnection = {
+    __typename?: 'InputLogSessionConnection';
+    /** Edges on this page. */
+    edges: Array<InputLogSessionEdge>;
+    /** Pagination metadata. */
+    pageInfo: ConnectionPageInfo;
+    /** Total matching records across all pages, when known (null for sources that do not compute a total). */
+    totalCount: Maybe<Scalars['Int']['output']>;
+};
+/** An edge in a InputLogSession connection. */
+export type InputLogSessionEdge = {
+    __typename?: 'InputLogSessionEdge';
+    /** Opaque cursor for this edge. */
+    cursor: Scalars['String']['output'];
+    /** The node at the end of this edge. */
+    node: InputLogSession;
+};
+/** Narrows inputLogSessions. All fields are optional and AND-combined. */
+export type InputLogSessionFilter = {
+    /** Only sessions still active at or after this instant. */
+    from?: InputMaybe<Scalars['DateTime']['input']>;
+    /** Only sessions containing this client message type (0-255). */
+    messageType?: InputMaybe<Scalars['Int']['input']>;
+    /** Only sessions started at or before this instant. */
+    to?: InputMaybe<Scalars['DateTime']['input']>;
+    /** Only this user's sessions. Without manage_apps on the app, only your own user id is accepted (and is the default). */
+    userId?: InputMaybe<Scalars['BigInt']['input']>;
+};
 export type InviteOrgMemberInput = {
     /** Organization to add the user to (BigInt as string). */
     orgId: Scalars['BigInt']['input'];
@@ -4309,6 +4470,8 @@ export type Mutation = {
     addChannelMember: GroupMember;
     /** Add a user to a team, or approve their pending join request (upsert to active). Requires the 'manage_members' team permission (app admins bypass). Auto-assigns the team's default role if configured. */
     addTeamMember: GroupMember;
+    /** OPERATOR: allow an email address (a contractor or partner) or a domain on this tier, optionally until a date. The address must still be verified to count. Refused on prod. */
+    addTierAccessRule: TierAccessRule;
     /** Admit one player-code listing, author, or authoring org to an app's strict allow list. Requires 'manage_compute'. Idempotency is explicit: an identical active entry returns a conflict instead of silently creating duplicates. SIDE EFFECTS: audit row + replica sync. */
     admitAppCode: AppCodeAdmission;
     /** Soft-delete an access tier by setting its status to 'archived' (the row is retained, NOT hard-deleted) and notifies the game API. Requires the 'manage_access_tiers' permission on the app that owns the tier; super admins bypass. Existing user grants on this tier are NOT automatically revoked. Throws if the tier is not found. */
@@ -4385,6 +4548,8 @@ export type Mutation = {
     createTeam: Group;
     /** Create a custom (non-system) team role granting the given team permission keys. Requires the 'manage_roles' team permission (app admins bypass). Permission keys must be valid team permission keys (group_permission_defs). */
     createTeamRole: GroupRole;
+    /** OPERATOR: mint a provisioning token for a test harness. The secret is returned once. Refused on prod. */
+    createTierAccessProvisioningToken: CreatedTierAccessProvisioningToken;
     /** OPERATOR ONLY. Credits an organization wallet without a payment provider, for seeding a test environment or making an operator adjustment, and records it in the wallet ledger as an "admin_credit" transaction. Use this instead of writing to org_wallets by hand: it creates the wallet if absent, repairs a missing wallet id, and moves the balance and the ledger row together in one transaction. Pass a referenceId to make retries idempotent. SIDE EFFECT: re-evaluates the runtime gate for every shared app in the org, so a credit that clears an insufficient_funds denial lifts it immediately instead of leaving the app refusing clients. */
     creditOrgWallet: WalletTransaction;
     /** Publish a new immutable version of an app-scoped Crowdy Studio-curated common file and make it the current player-readable version. Requires an app-scoped token plus the app manage_compute permission. Old versions remain immutable for provenance; an idempotency key is strongly recommended for transport retries. */
@@ -4445,6 +4610,8 @@ export type Mutation = {
     deleteUserAppState: UserAppState;
     /** Close the UDP proxy session and socket for this game token. Unsubscribing from udpNotifications does not disconnect; use this mutation (or rely on server inactivity timeout). */
     disconnectUdpProxy: Scalars['Boolean']['output'];
+    /** OPERATOR: end the sessions and app tokens of these accounts (at most 1000), skipping any this tier admits. Returns how many had sessions ended. Refused on prod. */
+    endTierAccessSessions: Scalars['Int']['output'];
     /** Exchange a one-time portal authorization code (with the matching PKCE verifier) for an app-scoped gameplay token. Public (the code + verifier authorize the call); called by the destination game at its own origin so the game never sees the player's session token. */
     exchangePortalCode: AppTokenResponse;
     /** Make an earlier ck-exec version active again, a rollback. Running instances pick it up when they next start, as after a deploy. Requires the org 'manage_compute' permission. */
@@ -4505,6 +4672,8 @@ export type Mutation = {
     grantGridPermissions: GridUserPermissions;
     /** Org dashboard shortcut: the authenticated caller grants themselves access to an app using its default active tier. Requires that the caller is an active member of the app's owning org OR holds the 'manage_access_tiers' permission on the app. ENTITLEMENT CHANGE: upserts an active grant and notifies the game API. Errors if the app has no active tier, or the caller is neither a member nor a manager. */
     grantMyAppAccess: AppUserAccess;
+    /** OPERATOR: grant every existing account a prefix*@domain pattern matches that has no grant -- for bot rosters created before the gate. The domain must be a reserved test domain or a company domain. Dry run by default. Refused on prod. */
+    grantTierAccessByPattern: GrantTierAccessByPatternResult;
     /** Adds a user to an organization as a member. Requires the 'manage_members' permission on the target org (super admins bypass). */
     inviteOrgMember: OrgMember;
     /** Issue a standing grid claim invite (claim policy INVITE). Callable by designated approvers or studio staff holding manage_compute; the invitee then calls claimGridOwnership to take ownership. */
@@ -4575,6 +4744,10 @@ export type Mutation = {
     revokeGroupFromGrid: Array<GridGroupGrant>;
     /** Permanently deactivates an org token so it can no longer authenticate. Requires the 'manage_tokens' permission on the token's org (super admins bypass). DESTRUCTIVE and irreversible; the secret cannot be reactivated. Returns false if the token does not exist. */
     revokeOrgToken: Scalars['Boolean']['output'];
+    /** OPERATOR: revoke a provisioning token. With revokeAccounts, also clear the grant of every account it created and end their sessions. Refused on prod. */
+    revokeTierAccessProvisioningToken: TierAccessProvisioningToken;
+    /** OPERATOR: remove an entry from the list. Accounts it was admitting are refused at their next request, and their sessions and app tokens are ended. Refused on prod. */
+    revokeTierAccessRule: TierAccessRule;
     /** Reverts every voxel edit made by `userId` in `appId` between `from` and `to`, returning one RollbackVoxelEventResult per affected voxel (`applied` tells you whether each was actually changed). DEFAULTS to dryRun=true, which only PREVIEWS the planned reversions without writing; pass dryRun=false to actually apply them (DESTRUCTIVE — mutates world state). Requires a valid bearer token AND the `manage_apps` permission on the org that owns `appId` (super admins bypass). */
     rollbackVoxelUpdates: Array<RollbackVoxelEventResult>;
     /** OPERATOR ONLY. Runs the shared-usage billing tick once. It still bills only the last CLOSED clock hour — it will not charge an open hour. Use this to prove a closed-hour debit without waiting for the ~60s cron. Backdating usage rows is a local-test fixture, not something this mutation does on a live tier. */
@@ -4659,6 +4832,10 @@ export type Mutation = {
     setTeamMemberRoles: GroupMember;
     /** Set who may create teams in an app and the default membership policy for new teams. Requires app-admin ('manage_apps'). Affects future team creation only, not existing teams. */
     setTeamPolicy: AppGroupPolicy;
+    /** SUPER ADMIN: set this tier to OBSERVE (log what would be refused) or ENFORCE. Refused on prod, where the gate is always off. */
+    setTierAccessMode: TierAccessSettings;
+    /** OPERATOR: grant one account access to this tier regardless of its email (a service account, an unverifiable address), optionally until a date, or clear the grant. Clearing ends its sessions if nothing else admits it. Refused on prod. */
+    setUserTierAccess: UserTierAccess;
     /** Begins vaulting a card for off-session auto-billing. Returns a Stripe SetupIntent client secret the browser confirms; no charge is made here. Requires the 'manage_billing' org permission. */
     setupSharedPaymentMethod: PaymentMethodSetup;
     /** Complete a federated sign-in from the provider callback (code + state). Returns a session AuthResponse, creating/linking the account by provider identity. Public; first-party origins only (HOSTED_SIGN_IN_REQUIRED otherwise). */
@@ -4681,7 +4858,7 @@ export type Mutation = {
     updateActor: Actor;
     /** Replaces an actor’s `publicState` and/or `privateState` blobs (fields omitted from `input` are left unchanged). OWNER-EXCLUSIVE: only the actor’s owner may write (throws Unauthorized otherwise). Game-plane: requires an app token for the actor’s app (a session token or another app’s token is answered NotFound). `uuid` is the 32-character ASCII actor id; blobs are base64-encoded binary. */
     updateActorState: Actor;
-    /** Update mutable fields of an existing app (name, description, visibility, status, metadata, wildernessWritesOpen); only fields present in the input are changed. Requires the 'manage_apps' permission on the app (resolved via its org); super admins bypass. Use this to publish (status=LIVE), change visibility, or restore an archived app (status back to DRAFT/LIVE). Throws if the app id does not exist. */
+    /** Update mutable fields of an existing app (name, description, visibility, status, metadata, wildernessWritesOpen, replayLoggingEnabled); only fields present in the input are changed. Turning replayLoggingEnabled on is refused with INPUT_LOG_FUNDS_NEEDED unless the org's wallet has a spendable balance or the org is billing-exempt. Requires the 'manage_apps' permission on the app (resolved via its org); super admins bypass. Use this to publish (status=LIVE), change visibility, or restore an archived app (status back to DRAFT/LIVE). Throws if the app id does not exist. */
     updateApp: App;
     /** Updates an avatar’s mutable fields (currently `name`) and returns it. OWNER-EXCLUSIVE: only the avatar’s owner may call this (throws Unauthorized otherwise). Requires a valid game token. To change state blobs use `updateAvatarState`. */
     updateAvatar: Avatar;
@@ -4735,6 +4912,9 @@ export type MutationAddTeamMemberArgs = {
     groupId: Scalars['BigInt']['input'];
     userId: Scalars['BigInt']['input'];
 };
+export type MutationAddTierAccessRuleArgs = {
+    input: AddTierAccessRuleInput;
+};
 export type MutationAdmitAppCodeArgs = {
     input: AdmitAppCodeInput;
 };
@@ -4853,6 +5033,9 @@ export type MutationCreateTeamArgs = {
 export type MutationCreateTeamRoleArgs = {
     input: CreateGroupRoleInput;
 };
+export type MutationCreateTierAccessProvisioningTokenArgs = {
+    input: CreateTierAccessProvisioningTokenInput;
+};
 export type MutationCreditOrgWalletArgs = {
     amountCents: Scalars['BigInt']['input'];
     orgId: Scalars['BigInt']['input'];
@@ -4944,6 +5127,9 @@ export type MutationDeleteTeamRoleArgs = {
 export type MutationDeleteUserAppStateArgs = {
     appId: Scalars['BigInt']['input'];
 };
+export type MutationEndTierAccessSessionsArgs = {
+    userIds: Array<Scalars['BigInt']['input']>;
+};
 export type MutationExchangePortalCodeArgs = {
     input: ExchangePortalCodeInput;
 };
@@ -5076,6 +5262,10 @@ export type MutationGrantGridPermissionsArgs = {
 export type MutationGrantMyAppAccessArgs = {
     appId: Scalars['BigInt']['input'];
 };
+export type MutationGrantTierAccessByPatternArgs = {
+    dryRun?: InputMaybe<Scalars['Boolean']['input']>;
+    emailPattern: Scalars['String']['input'];
+};
 export type MutationInviteOrgMemberArgs = {
     input: InviteOrgMemberInput;
 };
@@ -5195,6 +5385,13 @@ export type MutationRevokeOrgTokenArgs = {
     idempotencyKey?: InputMaybe<Scalars['String']['input']>;
     orgTokenId: Scalars['BigInt']['input'];
 };
+export type MutationRevokeTierAccessProvisioningTokenArgs = {
+    revokeAccounts?: InputMaybe<Scalars['Boolean']['input']>;
+    tokenId: Scalars['BigInt']['input'];
+};
+export type MutationRevokeTierAccessRuleArgs = {
+    ruleId: Scalars['BigInt']['input'];
+};
 export type MutationRollbackVoxelUpdatesArgs = {
     input: RollbackVoxelUpdatesInput;
 };
@@ -5352,6 +5549,14 @@ export type MutationSetTeamMemberRolesArgs = {
 export type MutationSetTeamPolicyArgs = {
     input: SetTeamPolicyInput;
 };
+export type MutationSetTierAccessModeArgs = {
+    mode: TierAccessStoredMode;
+};
+export type MutationSetUserTierAccessArgs = {
+    expiresAt?: InputMaybe<Scalars['DateTime']['input']>;
+    granted: Scalars['Boolean']['input'];
+    userId: Scalars['BigInt']['input'];
+};
 export type MutationSetupSharedPaymentMethodArgs = {
     idempotencyKey?: InputMaybe<Scalars['String']['input']>;
     orgId: Scalars['BigInt']['input'];
@@ -5456,6 +5661,21 @@ export type MutationUpdateUserTypeArgs = {
 export type MutationUpdateVoxelArgs = {
     input: UpdateVoxelInput;
 };
+/** The signed-in account's access to this tier. Callable while access is pending or denied, so a client can say why it cannot continue. */
+export type MyTierAccess = {
+    __typename?: 'MyTierAccess';
+    /** True when refusals are enforced rather than only logged. */
+    enforced: Scalars['Boolean']['output'];
+    /** When the grant or listing ends, if it does. */
+    expiresAt: Maybe<Scalars['DateTime']['output']>;
+    /** A sentence explaining the status. */
+    message: Scalars['String']['output'];
+    /** True on dev and test. */
+    restricted: Scalars['Boolean']['output'];
+    status: TierAccessStatus;
+    /** Why access is granted: platform_role, operator_grant, provisioning or verified_email. */
+    via: Maybe<Scalars['String']['output']>;
+};
 /** A grid overlapping a scanned region (returned by nearbyGrids). Bounds only — no permission keys. */
 export type NearbyGrid = {
     __typename?: 'NearbyGrid';
@@ -6467,6 +6687,10 @@ export type Query = {
     hostedGamePublishes: Array<HostedGamePublish>;
     /** The LIVE and LISTED hosted third-party games, for the Overworld lobby and the marketplace. PUBLIC. Empty when the tier does not host third-party games. Operators see every game with allHostedGames. */
     hostedGames: Array<HostedGame>;
+    /** The recorded inputs of one session, oldest first, each exactly as the client sent it (without its authentication tail). Read from the input log by the offset ranges its index holds, so inputs past the published retention are gone even while the session is still listed. With 'manage_apps' on the app you may read any session; anyone else may read only their own, and any other session answers NOT_FOUND. Game plane: send the app-scoped token for this app to the app's datacenter. Page with `first` (default 50, max 200) and `after`; a page can hold fewer than `first` inputs when it stopped at its time or scan limit, so keep paging while hasNextPage is true. INPUT_LOG_UNAVAILABLE when input logging is not configured on this deployment, and also, retryable with the same cursor, when the log cannot be read right now. */
+    inputLogMessages: InputLogMessageConnection;
+    /** Recorded client sessions of an app with replay logging on (App.replayLoggingEnabled), newest first. With 'manage_apps' on the app you see every session and may filter by userId; anyone else sees only their own, and asking for another user's is FORBIDDEN. Game plane: send the app-scoped token for this app to the app's datacenter. Page with `first` (default 50, max 200) and `after`. INPUT_LOG_UNAVAILABLE when input logging is not configured on this deployment. */
+    inputLogSessions: InputLogSessionConnection;
     /** Lists recorded voxel edits for all chunks within a cubic (Chebyshev) radius of a center chunk, grouped per chunk and ordered by increasing distance, paginated over chunks. Requires a valid bearer token; app-scoped tokens are limited to their own app. Read-only. */
     listVoxelUpdatesByDistance: VoxelUpdatesByDistanceResponse;
     /** Lists recorded voxel edits for a single chunk (optionally only those at/after `since`), newest first. Requires a valid bearer token; app-scoped tokens are limited to their own app. Read-only. */
@@ -6509,6 +6733,8 @@ export type Query = {
     myPropertyTokens: UserPropertyTokenData;
     /** The caller's teams in an app, with their roles and effective team permissions. Use this to discover which teams the current user belongs to and what they may do in each. */
     myTeams: Array<GroupMembership>;
+    /** The signed-in account's access to this tier: GRANTED, PENDING_VERIFICATION (confirm the email address), DENIED, or NOT_RESTRICTED on prod. Requires a session token, and stays callable while access is pending or denied. */
+    myTierAccess: MyTierAccess;
     /** List every grid overlapping a chunk-coordinate bounding box, each with the given user's effective permission keys on it. Useful for previewing what a user can do across a region (e.g. around their current position). Requires app-admin ('manage_apps'). */
     nearbyGridPermissions: Array<NearbyGridPermissions>;
     /** List every grid overlapping a chunk-coordinate bounding box, returning gridId and bounds only. Player-safe: no permission keys and no impersonation userId. Requires an app-scoped token for the same app. */
@@ -6585,6 +6811,16 @@ export type Query = {
     teamRoles: Array<GroupRole>;
     /** List all active teams in an app (not just the caller's). */
     teams: Array<Group>;
+    /** OPERATOR: who on this tier would be refused -- counts, a page of refused accounts with what they hold, and organizations with no admitted member. Reads every account; for review, not for polling. Refused on prod. */
+    tierAccessInventory: TierAccessInventory;
+    /** Whether this tier is an internal environment (dev and test are: Crowded Kingdoms staff, approved contractors and test harnesses only), with a sentence for sign-in pages and the production Studio address. Public. */
+    tierAccessPolicy: TierAccessPolicy;
+    /** OPERATOR: the provisioning tokens of this tier (never their secrets). */
+    tierAccessProvisioningTokens: Array<TierAccessProvisioningToken>;
+    /** OPERATOR: the addresses and domains allowed on this tier besides the company domains. */
+    tierAccessRules: Array<TierAccessRule>;
+    /** OPERATOR: the tier-access mode and settings of this tier. */
+    tierAccessSettings: TierAccessSettings;
     /** UDP proxy session status for the game token on this request. Without a game token, returns connected: false. Does not open a session—use udpNotifications or connectUdpProxy. */
     udpProxyConnectionStatus: UdpProxyConnectionStatus;
     /** Looks up a single user by id. Requires a valid game token. */
@@ -6595,6 +6831,8 @@ export type Query = {
     userAppStates: Array<UserAppState>;
     /** Lists the avatars owned by `userId`. Requires a valid game token. Owner-aware: when the caller is NOT the owner, each avatar’s `privateState` is stripped (returned null); `publicState` is always included. State blobs are base64-encoded binary. */
     userAvatars: Array<Avatar>;
+    /** OPERATOR: one account's access to this tier and its stored grant. */
+    userTierAccess: UserTierAccess;
     /** Super admin only. Paginated user search across email, gamertag, disambiguation, and exact user_id. Relay cursor connection; prefer this over the offset-based usersPaginated. */
     usersConnection: UsersConnection;
     /** SUPER-ADMIN ONLY paginated user search; replaces the legacy `users`/`usersByGamertag`/`usersByEmail` queries. `query` is ILIKE-prefix matched against email, gamertag, and disambiguation, plus an exact user_id match. Requires a super-admin bearer game token. */
@@ -6992,6 +7230,19 @@ export type QueryHostedGamePublishesArgs = {
     limit?: InputMaybe<Scalars['Int']['input']>;
     slug: Scalars['String']['input'];
 };
+export type QueryInputLogMessagesArgs = {
+    after?: InputMaybe<Scalars['String']['input']>;
+    appId: Scalars['BigInt']['input'];
+    filter?: InputMaybe<InputLogMessageFilter>;
+    first?: InputMaybe<Scalars['Int']['input']>;
+    gameTokenId: Scalars['BigInt']['input'];
+};
+export type QueryInputLogSessionsArgs = {
+    after?: InputMaybe<Scalars['String']['input']>;
+    appId: Scalars['BigInt']['input'];
+    filter?: InputMaybe<InputLogSessionFilter>;
+    first?: InputMaybe<Scalars['Int']['input']>;
+};
 export type QueryListVoxelUpdatesByDistanceArgs = {
     input: ListVoxelUpdatesByDistanceInput;
 };
@@ -7104,6 +7355,16 @@ export type QueryTeamRolesArgs = {
 export type QueryTeamsArgs = {
     appId: Scalars['BigInt']['input'];
 };
+export type QueryTierAccessInventoryArgs = {
+    limit?: InputMaybe<Scalars['Int']['input']>;
+    offset?: InputMaybe<Scalars['Int']['input']>;
+};
+export type QueryTierAccessProvisioningTokensArgs = {
+    includeRevoked?: InputMaybe<Scalars['Boolean']['input']>;
+};
+export type QueryTierAccessRulesArgs = {
+    includeRevoked?: InputMaybe<Scalars['Boolean']['input']>;
+};
 export type QueryUserArgs = {
     id: Scalars['BigInt']['input'];
 };
@@ -7113,6 +7374,9 @@ export type QueryUserAppStateArgs = {
 export type QueryUserAvatarsArgs = {
     userId: Scalars['BigInt']['input'];
 };
+export type QueryUserTierAccessArgs = {
+    userId: Scalars['BigInt']['input'];
+};
 export type QueryUsersConnectionArgs = {
     after?: InputMaybe<Scalars['String']['input']>;
     first?: InputMaybe<Scalars['Int']['input']>;
@@ -7967,6 +8231,138 @@ export type TeleportResponse = {
     /** True when the teleport is authorized/accepted; false otherwise (inspect errorCode for the reason). */
     success: Scalars['Boolean']['output'];
 };
+export type TierAccessCount = {
+    __typename?: 'TierAccessCount';
+    count: Scalars['Int']['output'];
+    key: Scalars['String']['output'];
+};
+/** OPERATOR: who on this tier would be refused. */
+export type TierAccessInventory = {
+    __typename?: 'TierAccessInventory';
+    /** A page of the refused accounts, newest first. */
+    accounts: Array<TierAccessInventoryAccount>;
+    /** Refused (pending + denied) accounts in total. */
+    accountsTotal: Scalars['Int']['output'];
+    denied: Scalars['Int']['output'];
+    granted: Scalars['Int']['output'];
+    /** Granted accounts by reason. */
+    grantedByVia: Array<TierAccessCount>;
+    mode: TierAccessMode;
+    orgsWithoutGrantedMember: Array<TierAccessInventoryOrg>;
+    pending: Scalars['Int']['output'];
+    tier: Maybe<Scalars['String']['output']>;
+    totalAccounts: Scalars['Int']['output'];
+};
+/** OPERATOR: an account this tier would refuse, with what it holds. */
+export type TierAccessInventoryAccount = {
+    __typename?: 'TierAccessInventoryAccount';
+    activeAppTokens: Scalars['Int']['output'];
+    activeSessions: Scalars['Int']['output'];
+    appsCreated: Scalars['Int']['output'];
+    /** Holds app tokens, organizations or apps -- the accounts whose sessions a cutover should end. */
+    ckActivity: Scalars['Boolean']['output'];
+    createdAt: Maybe<Scalars['DateTime']['output']>;
+    /** Created through Crowd Altar (it carries a username). */
+    createdViaCrowdAltar: Scalars['Boolean']['output'];
+    email: Maybe<Scalars['String']['output']>;
+    isConfirmed: Scalars['Boolean']['output'];
+    /** Slugs of the organizations it belongs to. */
+    orgs: Array<Scalars['String']['output']>;
+    status: TierAccessStatus;
+    userId: Scalars['BigInt']['output'];
+    /** Set when the account was created through Crowd Altar. */
+    username: Maybe<Scalars['String']['output']>;
+};
+/** OPERATOR: an organization none of whose members may use this tier. */
+export type TierAccessInventoryOrg = {
+    __typename?: 'TierAccessInventoryOrg';
+    apps: Scalars['Int']['output'];
+    liveHostedGames: Scalars['Int']['output'];
+    members: Scalars['Int']['output'];
+    name: Scalars['String']['output'];
+    orgId: Scalars['BigInt']['output'];
+    slug: Scalars['String']['output'];
+    status: Scalars['String']['output'];
+};
+/** How the dev/test staff-only gate behaves on this tier. OFF on prod and on any tier that is not dev or test; OBSERVE logs what would be refused; ENFORCE refuses. */
+export declare enum TierAccessMode {
+    Enforce = "ENFORCE",
+    Observe = "OBSERVE",
+    Off = "OFF"
+}
+/** Whether this tier is an internal (staff-only) environment, for the sign-in pages. Public. */
+export type TierAccessPolicy = {
+    __typename?: 'TierAccessPolicy';
+    /** True when refusals are enforced; false while a restricted tier only logs them (observe), and off the restricted tiers. Read by the control plane status check. */
+    enforced: Scalars['Boolean']['output'];
+    /** A sentence for the sign-in pages to show when restricted. */
+    message: Maybe<Scalars['String']['output']>;
+    /** Production Studio, where outside developers create accounts. */
+    publicStudioUrl: Scalars['String']['output'];
+    /** True on dev and test: accounts need a verified company address, an operator listing or a provisioning grant. */
+    restricted: Scalars['Boolean']['output'];
+};
+/** OPERATOR: a credential test harnesses send on register to create accounts that may use a restricted tier. The secret is never returned after creation. */
+export type TierAccessProvisioningToken = {
+    __typename?: 'TierAccessProvisioningToken';
+    accountsCreated: Scalars['Int']['output'];
+    createdAt: Scalars['DateTime']['output'];
+    createdBy: Maybe<Scalars['BigInt']['output']>;
+    /** Addresses it may create, as prefix*@domain. */
+    emailPatterns: Array<Scalars['String']['output']>;
+    expiresAt: Scalars['DateTime']['output'];
+    label: Scalars['String']['output'];
+    lastUsedAt: Maybe<Scalars['DateTime']['output']>;
+    maxAccounts: Scalars['Int']['output'];
+    revokedAt: Maybe<Scalars['DateTime']['output']>;
+    tokenId: Scalars['BigInt']['output'];
+};
+/** OPERATOR: one entry on a tier access list. */
+export type TierAccessRule = {
+    __typename?: 'TierAccessRule';
+    createdAt: Scalars['DateTime']['output'];
+    createdBy: Maybe<Scalars['BigInt']['output']>;
+    expiresAt: Maybe<Scalars['DateTime']['output']>;
+    kind: TierAccessRuleKind;
+    note: Maybe<Scalars['String']['output']>;
+    revokedAt: Maybe<Scalars['DateTime']['output']>;
+    revokedBy: Maybe<Scalars['BigInt']['output']>;
+    ruleId: Scalars['BigInt']['output'];
+    /** The lowercased address or domain. */
+    value: Scalars['String']['output'];
+};
+/** An exact email address, or every address on one domain. */
+export declare enum TierAccessRuleKind {
+    Email = "EMAIL",
+    EmailDomain = "EMAIL_DOMAIN"
+}
+/** OPERATOR: the tier-access settings of this tier. */
+export type TierAccessSettings = {
+    __typename?: 'TierAccessSettings';
+    /** Domains whose verified addresses are always allowed. */
+    companyDomains: Array<Scalars['String']['output']>;
+    /** The effective mode. */
+    mode: TierAccessMode;
+    publicStudioUrl: Scalars['String']['output'];
+    /** The stored mode; null means none was set (a restricted tier then observes). */
+    storedMode: Maybe<TierAccessStoredMode>;
+    /** The tier this instance serves. */
+    tier: Maybe<Scalars['String']['output']>;
+    updatedAt: Maybe<Scalars['DateTime']['output']>;
+    updatedBy: Maybe<Scalars['BigInt']['output']>;
+};
+/** An account on this tier: NOT_RESTRICTED (prod, or no gate), GRANTED, PENDING_VERIFICATION (a listed address that is not confirmed yet), or DENIED. */
+export declare enum TierAccessStatus {
+    Denied = "DENIED",
+    Granted = "GRANTED",
+    NotRestricted = "NOT_RESTRICTED",
+    PendingVerification = "PENDING_VERIFICATION"
+}
+/** The mode an operator can set on a restricted tier. */
+export declare enum TierAccessStoredMode {
+    Enforce = "ENFORCE",
+    Observe = "OBSERVE"
+}
 export type TransferGridOwnershipInput = {
     /** App that contains the grid. */
     appId: Scalars['BigInt']['input'];
@@ -8120,6 +8516,8 @@ export type UpdateAppInput = {
     metadata?: InputMaybe<Scalars['String']['input']>;
     /** New display name (1-256 chars). Omit to leave unchanged. */
     name?: InputMaybe<Scalars['String']['input']>;
+    /** Turn replay logging on (true) or off (false): record every client input the realtime servers accept for this app, kept for the input log's published retention and billed as stored input logs (input_log_storage_byte_hours, no free allowance). Turning it ON is refused with INPUT_LOG_FUNDS_NEEDED unless the org's wallet has a spendable balance or the org is billing-exempt; turning it off always succeeds. Recording starts and stops within about 15 seconds. Omit to leave unchanged. */
+    replayLoggingEnabled?: InputMaybe<Scalars['Boolean']['input']>;
     /** New lifecycle status; set LIVE to publish, or DRAFT/LIVE to restore an archived app. Omit to leave unchanged. */
     status?: InputMaybe<AppStatus>;
     /** New visibility (PUBLIC/UNLISTED/PRIVATE). Omit to leave unchanged. */
@@ -8352,6 +8750,23 @@ export type UserPropertyTokenData = {
     /** Sum of available + inUse, as a decimal string. */
     total: Scalars['String']['output'];
 };
+/** OPERATOR: one account's access to this tier. */
+export type UserTierAccess = {
+    __typename?: 'UserTierAccess';
+    email: Maybe<Scalars['String']['output']>;
+    expiresAt: Maybe<Scalars['DateTime']['output']>;
+    /** When the stored grant ends. */
+    grantExpiresAt: Maybe<Scalars['DateTime']['output']>;
+    /** The stored grant: operator or provisioning, or null. */
+    grantSource: Maybe<Scalars['String']['output']>;
+    grantedAt: Maybe<Scalars['DateTime']['output']>;
+    /** Who granted it: operator:<user id>, token:<token id> or loadtest-mint:<label>. */
+    grantedBy: Maybe<Scalars['String']['output']>;
+    isConfirmed: Scalars['Boolean']['output'];
+    status: TierAccessStatus;
+    userId: Scalars['BigInt']['output'];
+    via: Maybe<Scalars['String']['output']>;
+};
 /** A Relay cursor connection over User records. Page with first/after; pass pageInfo.endCursor back as after for the next page. */
 export type UsersConnection = {
     __typename?: 'UsersConnection';