crowdypy 0.10.0.dev1__tar.gz → 0.11.0.dev1__tar.gz

{crowdypy-0.10.0.dev1 → crowdypy-0.11.0.dev1}/MIGRATION.md

@@ -3,6 +3,31 @@
 CrowdyPy is pre-1.0. Within a minor line, patch releases keep source compatibility; each
 new minor may change the API. Read the section for every minor you skip.
 
+## 0.11.0
+
+CrowdyJS 18.10.0 and CrowdyCPP 0.63.0. Additive.
+
+- **Access that ends ends for good.** ck-exec 0.16 closes a session with code `4403` (now
+  `EXEC_CLOSE_ACCESS_ENDED`) and the reason when what it rests on ends: the player's access
+  (suspended, revoked, an expired grant), their session (signed out, everywhere too, or the app's
+  authorization withdrawn), or the account (blocked). `ExecConnection` and `AsyncExecConnection`
+  treat it as final: `on_access_ended(listener)` is called once with the reason, the call in flight
+  fails `Denied`, and the connection does not reconnect. Until 0.10.0 it redialed, and the redial
+  was refused (HTTP 401 "access ended") after one retry. Tell the player; connect again only once
+  they hold access again.
+- **Channel and team bans.** `client.channels.ban(group_id, user_id, reason=None)` /
+  `unban(group_id, user_id)` and the same on `client.teams`, with the group's `manage_members`
+  permission (never the group's owner, never yourself). A banned user is removed, stops receiving
+  the channel, and joining, requesting to join and being added are refused with
+  `GROUP_MEMBER_BANNED` until the ban is lifted; leaving or being removed does not lift it.
+- **Two refusal readers.** `account_blocked_of(error)` returns `CrowdyAccountBlocked(blocked_until)`
+  for `ACCOUNT_BLOCKED` (a platform operator blocked the account: every request and sign-in is
+  refused; `blocked_until` is set for a timed block), and `group_member_banned_of(error)` is `True`
+  for `GROUP_MEMBER_BANNED`. Neither is fixed by retrying. `ACCOUNT_BLOCKED_CODE` and
+  `GROUP_MEMBER_BANNED_CODE` name the codes.
+- `blockAccount`, `unblockAccount` and `accountBlock` are super-admin operations and are not
+  wrapped (`docs/parity-matrix.md`).
+
 ## 0.10.0
 
 CrowdyJS 18.9.0 and CrowdyCPP 0.62.0. Additive, with one floor: every sessions read selects

{crowdypy-0.10.0.dev1 → crowdypy-0.11.0.dev1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: crowdypy
-Version: 0.10.0.dev1
+Version: 0.11.0.dev1
 Summary: Official Python SDK for Crowded Kingdoms: typed GraphQL clients and a native UDP replication core
 Keywords: crowded-kingdoms,multiplayer,replication,graphql,sdk,udp
 Author: Crowded Kingdoms
@@ -51,6 +51,13 @@ CrowdyPy follows the [CrowdyJS](https://github.com/CrowdedKingdoms/CrowdyJS) API
 client, bound with [nanobind](https://github.com/wjakob/nanobind) and shipped inside the
 wheel. Python never touches a datagram.
 
+**v0.11.0: access that ends ends for good, and channel and team bans (CrowdyJS 18.10.0, CrowdyCPP
+0.63.0).** A host's `4403` close (ck-exec 0.16: the player was suspended, revoked, signed out or
+blocked) is final: `ExecConnection.on_access_ended` hears the reason, the call in flight fails
+`Denied`, and the connection does not redial. `client.channels.ban` / `unban` and
+`client.teams.ban` / `unban` manage bans, and `account_blocked_of` / `group_member_banned_of` read
+the two refusals. See [MIGRATION.md](MIGRATION.md).
+
 **v0.10.0: the input log says what it lost (CrowdyJS 18.9.0, CrowdyCPP 0.62.0).** Every session
 from `client.input_log.sessions` carries `missingRecords`, the inputs the replication server
 accepted that never reached the log, which needs the Game API release after v2.40.2. Its

{crowdypy-0.10.0.dev1 → crowdypy-0.11.0.dev1}/README.md

@@ -11,6 +11,13 @@ CrowdyPy follows the [CrowdyJS](https://github.com/CrowdedKingdoms/CrowdyJS) API
 client, bound with [nanobind](https://github.com/wjakob/nanobind) and shipped inside the
 wheel. Python never touches a datagram.
 
+**v0.11.0: access that ends ends for good, and channel and team bans (CrowdyJS 18.10.0, CrowdyCPP
+0.63.0).** A host's `4403` close (ck-exec 0.16: the player was suspended, revoked, signed out or
+blocked) is final: `ExecConnection.on_access_ended` hears the reason, the call in flight fails
+`Denied`, and the connection does not redial. `client.channels.ban` / `unban` and
+`client.teams.ban` / `unban` manage bans, and `account_blocked_of` / `group_member_banned_of` read
+the two refusals. See [MIGRATION.md](MIGRATION.md).
+
 **v0.10.0: the input log says what it lost (CrowdyJS 18.9.0, CrowdyCPP 0.62.0).** Every session
 from `client.input_log.sessions` carries `missingRecords`, the inputs the replication server
 accepted that never reached the log, which needs the Game API release after v2.40.2. Its

{crowdypy-0.10.0.dev1 → crowdypy-0.11.0.dev1}/docs/compatibility.md

@@ -5,7 +5,7 @@ are in `pyproject.toml` (`[project].version`, `[tool.crowdypy.crowdyjs]`,
 `[tool.crowdypy.crowdycpp]`); `tests/unit/test_release_versions.py` refuses this page when
 its version disagrees.
 
-- CrowdyPy `0.10.0`
+- CrowdyPy `0.11.0`
 - API surface: CrowdyJS (the pinned version and commit in `pyproject.toml`); the generated
   `docs/parity-matrix.md` lists every covered method, every native equivalent and every
   browser exclusion with its reason. The gate is strict: there are no portable gaps, and a

{crowdypy-0.10.0.dev1 → crowdypy-0.11.0.dev1}/docs/parity-matrix.md

@@ -4,17 +4,17 @@ Generated by `tools/parity/parity.py`; do not edit by hand. Classifications live
 
 ## Target
 
-- CrowdyJS: `18.9.0` at `cee1997127549e372c57baab2f0e12f1f423f31a`
-- CrowdyCPP (native core): `0.62.0` at `3845e797d06e788f5a7c0d8e1e3fd6d501c75693`
+- CrowdyJS: `18.10.0` at `b3e2de96ae738d272488ca06ab6de2c792aef14f`
+- CrowdyCPP (native core): `0.63.0` at `8682d39ab9cd368996eb35b76e6dfb10b43b7d62`
 - schema.gql identical to CrowdyJS's: yes
 - Gate mode: strict portable parity (every portable gap is release-blocking)
 
 ## Summary
 
-- Covered: 1066
+- Covered: 1080
 - Portable gap: 0
 - Native equivalent: 42
-- Browser exclusion: 110
+- Browser exclusion: 113
 - Deprecated roots: 2
 - Unclassified: 0
 
@@ -33,8 +33,11 @@ Generated by `tools/parity/parity.py`; do not edit by hand. Classifications live
 | `mutation.assignGridOwnership` | covered |
 | `mutation.assignGroupToGrid` | covered |
 | `mutation.authorizeApp` | covered |
+| `mutation.banChannelMember` | covered |
+| `mutation.banTeamMember` | covered |
 | `mutation.beginGamePublish` | browser exclusion — publishes and administers browser game bundles on the Crowdy Games web host; a Python client has no bundle to publish |
 | `mutation.beginPlayerCardSetup` | covered |
+| `mutation.blockAccount` | browser exclusion — super-admin or operator only; the SDK wraps nothing for platform roles (tooling calls it directly) |
 | `mutation.cancelSharedSubscription` | covered |
 | `mutation.capturePaypalCheckout` | covered |
 | `mutation.changePassword` | covered |
@@ -220,6 +223,9 @@ Generated by `tools/parity/parity.py`; do not edit by hand. Classifications live
 | `mutation.teleportRequest` | covered |
 | `mutation.transferGridOwnership` | covered |
 | `mutation.transferPlayerCodeListing` | covered |
+| `mutation.unbanChannelMember` | covered |
+| `mutation.unbanTeamMember` | covered |
+| `mutation.unblockAccount` | browser exclusion — super-admin or operator only; the SDK wraps nothing for platform roles (tooling calls it directly) |
 | `mutation.unlinkIdentity` | covered |
 | `mutation.unsuspendAppAccess` | covered |
 | `mutation.updateAccessTier` | covered |
@@ -244,6 +250,7 @@ Generated by `tools/parity/parity.py`; do not edit by hand. Classifications live
 | `mutation.updateUserState` | covered |
 | `mutation.updateUserType` | browser exclusion — super-admin or operator only; the SDK wraps nothing for platform roles (tooling calls it directly) |
 | `mutation.updateVoxel` | covered |
+| `query.accountBlock` | browser exclusion — super-admin or operator only; the SDK wraps nothing for platform roles (tooling calls it directly) |
 | `query.activeGraphQLServers` | covered |
 | `query.actor` | covered |
 | `query.actors` | covered |
@@ -618,6 +625,7 @@ Generated by `tools/parity/parity.py`; do not edit by hand. Classifications live
 | `ChannelInbox.onMessage` | covered |
 | `ChannelInbox.send` | covered |
 | `ChannelsAPI.addMember` | covered |
+| `ChannelsAPI.ban` | covered |
 | `ChannelsAPI.create` | covered |
 | `ChannelsAPI.createRole` | covered |
 | `ChannelsAPI.deleteRole` | covered |
@@ -634,6 +642,7 @@ Generated by `tools/parity/parity.py`; do not edit by hand. Classifications live
 | `ChannelsAPI.roles` | covered |
 | `ChannelsAPI.setMemberRoles` | covered |
 | `ChannelsAPI.setPolicy` | covered |
+| `ChannelsAPI.unban` | covered |
 | `ChannelsAPI.update` | covered |
 | `ChannelsAPI.updateRole` | covered |
 | `ChunkStore.ensureAround` | covered |
@@ -795,6 +804,7 @@ Generated by `tools/parity/parity.py`; do not edit by hand. Classifications live
 | `ExecConnection.close` | covered |
 | `ExecConnection.connect` | covered |
 | `ExecConnection.host` | covered |
+| `ExecConnection.onAccessEnded` | covered |
 | `ExecConnection.onReconnect` | covered |
 | `ExecConnection.open` | covered |
 | `ExecConnection.ping` | covered |
@@ -1007,6 +1017,7 @@ Generated by `tools/parity/parity.py`; do not edit by hand. Classifications live
 | `StudioLayoutController.subscribe` | covered |
 | `StudioLayoutController.toggle` | covered |
 | `TeamsAPI.addMember` | covered |
+| `TeamsAPI.ban` | covered |
 | `TeamsAPI.create` | covered |
 | `TeamsAPI.createRole` | covered |
 | `TeamsAPI.deleteRole` | covered |
@@ -1023,6 +1034,7 @@ Generated by `tools/parity/parity.py`; do not edit by hand. Classifications live
 | `TeamsAPI.roles` | covered |
 | `TeamsAPI.setMemberRoles` | covered |
 | `TeamsAPI.setPolicy` | covered |
+| `TeamsAPI.unban` | covered |
 | `TeamsAPI.update` | covered |
 | `TeamsAPI.updateRole` | covered |
 | `TeleportAPI.request` | covered |
@@ -1080,6 +1092,7 @@ Generated by `tools/parity/parity.py`; do not edit by hand. Classifications live
 | `ACCESS_NOT_GRANTED_CODE` | covered |
 | `ACCESS_REVOKED_CODE` | covered |
 | `ACCESS_SUSPENDED_CODE` | covered |
+| `ACCOUNT_BLOCKED_CODE` | covered |
 | `ACTOR_EXISTS_CODE` | covered |
 | `APP_PAUSED_CODE` | covered |
 | `APP_UNAVAILABLE_CODE` | covered |
@@ -1119,6 +1132,7 @@ Generated by `tools/parity/parity.py`; do not edit by hand. Classifications live
 | `EXEC_CLIENT_ABI_IMPORTS` | covered |
 | `EXEC_CLIENT_ABI_VERSION` | covered |
 | `EXEC_CLIENT_HOST_CALLS` | browser exclusion — page-side broker for player WASM in the browser glue Web Worker (worker lifecycle, host-call allowlists, rate caps, watchdogs) |
+| `EXEC_CLOSE_ACCESS_ENDED` | covered |
 | `EXEC_STATUSES` | covered |
 | `ExecModScope` | covered |
 | `FLAG_GROUNDED` | covered |
@@ -1130,6 +1144,7 @@ Generated by `tools/parity/parity.py`; do not edit by hand. Classifications live
 | `GLUE_INVOKE_REPLY_MAX_BYTES` | browser exclusion — glue that instantiates player WASM inside the browser Web Worker (CLIENT ABI imports, ck_fuel, watchdog) |
 | `GLUE_LOG_MAX_BYTES` | browser exclusion — glue that instantiates player WASM inside the browser Web Worker (CLIENT ABI imports, ck_fuel, watchdog) |
 | `GLUE_STATE_MAX_BYTES` | browser exclusion — glue that instantiates player WASM inside the browser Web Worker (CLIENT ABI imports, ck_fuel, watchdog) |
+| `GROUP_MEMBER_BANNED_CODE` | covered |
 | `GameKitClient` | covered |
 | `GlueRuntime` | browser exclusion — glue that instantiates player WASM inside the browser Web Worker (CLIENT ABI imports, ck_fuel, watchdog) |
 | `GraphQLTransport` | native equivalent — pass an httpx.AsyncClient / httpx.Client as http_client= (transport, proxies, HTTP/2, timeouts) |
@@ -1173,6 +1188,7 @@ Generated by `tools/parity/parity.py`; do not edit by hand. Classifications live
 | `WRONG_DATACENTER_CODE` | covered |
 | `WireMessageType` | native equivalent — the same codec, CrowdyCPP's, through crowdypy.wire: crowdypy.wire.MessageType |
 | `accessRefusalOf` | covered |
+| `accountBlockedOf` | covered |
 | `actorExistsOf` | covered |
 | `appPausedOf` | covered |
 | `armGlueRequest` | browser exclusion — SharedArrayBuffer + Atomics bridge between the page and the glue Web Worker |
@@ -1205,6 +1221,7 @@ Generated by `tools/parity/parity.py`; do not edit by hand. Classifications live
 | `generateState` | covered |
 | `glueDecoder` | browser exclusion — SharedArrayBuffer + Atomics bridge between the page and the glue Web Worker |
 | `glueEncoder` | browser exclusion — SharedArrayBuffer + Atomics bridge between the page and the glue Web Worker |
+| `groupMemberBannedOf` | covered |
 | `isAlreadyRegisteredError` | covered |
 | `isAppPaused` | covered |
 | `isHostedSignInRequiredError` | covered |

crowdypy-0.11.0.dev1/operations/channels/BanChannelMember.graphql

@@ -0,0 +1,16 @@
+mutation BanChannelMember($groupId: BigInt!, $userId: BigInt!, $reason: String) {
+  banChannelMember(groupId: $groupId, userId: $userId, reason: $reason) {
+    groupMemberId
+    groupId
+    userId
+    status
+    createdAt
+    roles {
+      groupRoleId
+      roleName
+      rank
+      isSystem
+      permissions
+    }
+  }
+}

crowdypy-0.11.0.dev1/operations/channels/UnbanChannelMember.graphql

@@ -0,0 +1,3 @@
+mutation UnbanChannelMember($groupId: BigInt!, $userId: BigInt!) {
+  unbanChannelMember(groupId: $groupId, userId: $userId)
+}

crowdypy-0.11.0.dev1/operations/teams/BanTeamMember.graphql

@@ -0,0 +1,16 @@
+mutation BanTeamMember($groupId: BigInt!, $userId: BigInt!, $reason: String) {
+  banTeamMember(groupId: $groupId, userId: $userId, reason: $reason) {
+    groupMemberId
+    groupId
+    userId
+    status
+    createdAt
+    roles {
+      groupRoleId
+      roleName
+      rank
+      isSystem
+      permissions
+    }
+  }
+}

crowdypy-0.11.0.dev1/operations/teams/UnbanTeamMember.graphql

@@ -0,0 +1,3 @@
+mutation UnbanTeamMember($groupId: BigInt!, $userId: BigInt!) {
+  unbanTeamMember(groupId: $groupId, userId: $userId)
+}

{crowdypy-0.10.0.dev1 → crowdypy-0.11.0.dev1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "scikit_build_core.build"
 
 [project]
 name = "crowdypy"
-version = "0.10.0.dev1"
+version = "0.11.0.dev1"
 description = "Official Python SDK for Crowded Kingdoms: typed GraphQL clients and a native UDP replication core"
 readme = "README.md"
 license = "MIT AND Apache-2.0"
@@ -119,20 +119,20 @@ environment = { OPENSSL_ROOT_DIR = "C:/vcpkg/installed/x64-windows-static-md" }
 # --------------------------------------------------------------------------------------
 
 [tool.crowdypy.crowdyjs]
-version = "18.9.0"
-commit = "cee1997127549e372c57baab2f0e12f1f423f31a"
+version = "18.10.0"
+commit = "b3e2de96ae738d272488ca06ab6de2c792aef14f"
 
 [tool.crowdypy.crowdycpp]
-version = "0.62.0"
-tag = "dev/v0.62.0"
-commit = "3845e797d06e788f5a7c0d8e1e3fd6d501c75693"
-tree-sha256 = "8a8226aa148e1c56ff620812ebaadb1fad757ebd5b801489cb1ec59e9cfe2695"
+version = "0.63.0"
+tag = "dev/v0.63.0"
+commit = "8682d39ab9cd368996eb35b76e6dfb10b43b7d62"
+tree-sha256 = "318b0db6138c877a666261fe71d1fc8bb2a644f333f3c927487f435371856c87"
 
 # schema.gql and operations/ are CrowdyJS's, copied from the commit pinned above by
 # scripts/schema_sync.py, which records these hashes and re-derives them in CI.
 [tool.crowdypy.graphql]
-schema-sha256 = "4b19bc84aa340365f6a256dc10544ce9141d18437048867607c8a2d0e74a66de"
-operations-sha256 = "013595fe2109633245b5c39446e884fad0ecb7d2fda3c2849c6087a5e6336f6c"
+schema-sha256 = "3cdc1b7196de4a006ab595401e7ff09b6549a79e346d43356e2162653e59c43e"
+operations-sha256 = "37b1e06dc4e997bb42506968c50698a184934581a6d94d9471a29d2ce74ff3d3"
 
 # The SDL the docs site publishes. scripts/schema_drift.py compares the snapshot against it
 # on a schedule; nothing on the per-commit path reads the network.

{crowdypy-0.10.0.dev1 → crowdypy-0.11.0.dev1}/schema.gql

@@ -198,6 +198,132 @@ type GraphQLServer {
   updatedAt: DateTime!
 }
 
+"""
+A platform-wide block on an account, set by a super-admin. While it holds, every sign-in and every authenticated request is refused with ACCOUNT_BLOCKED, on CK and on Crowd Altar, and every session, realtime connection and ck-exec socket the account had was ended when it was set. The last block stays readable after it is lifted or lapses.
+"""
+type AccountBlock {
+  """The account."""
+  userId: BigInt!
+  """Whether the block holds now."""
+  blocked: Boolean!
+  """When the last block was set; null if the account was never blocked."""
+  blockedAt: DateTime
+  """When it lapses (or was lifted); null while it lasts until lifted."""
+  blockedUntil: DateTime
+  """Why, as the super-admin wrote it."""
+  reason: String
+  """The super-admin who set it."""
+  blockedBy: BigInt
+}
+
+"""
+A free or purchasable access tier for an app, bundling a price and the set of runtime permission keys that granted users receive.
+"""
+type AppAccessTier {
+  """Unique numeric id of the tier (primary key)."""
+  tierId: BigInt!
+  """Numeric id of the app this tier belongs to."""
+  appId: BigInt!
+  """Display name of the tier (e.g. "Free", "Pro")."""
+  name: String!
+  """
+  Sort order for displaying tiers (ascending); lower values appear first.
+  """
+  tierOrder: Float!
+  """True if the tier has no purchase cost."""
+  isFree: Boolean!
+  """
+  True if this is the app default tier (used for open-by-default / self-service grants). At most one default per app is expected.
+  """
+  isDefault: Boolean!
+  """
+  Price in the smallest currency unit (cents) for paid tiers; null for free tiers.
+  """
+  priceCents: BigInt
+  """ISO 4217 currency code for priceCents (e.g. "usd"); defaults to "usd"."""
+  currency: String
+  """
+  Billing cadence for recurring tiers (e.g. "month", "year"); null for one-time or free tiers.
+  """
+  billingPeriod: String
+  """Optional marketing description of what the tier includes."""
+  description: String
+  """
+  Runtime permission keys granted to users on this tier (a subset of runtimePermissions), e.g. "access", "teleport", "update_voxel_data", "use_voice_chat", "use_video_chat" (webcam; not granted by default).
+  """
+  permissionKeys: [String!]!
+  """
+  Tier lifecycle: "active" or "archived" (soft-deleted via archiveAccessTier). Defaults to "active".
+  """
+  status: String!
+  """Timestamp when the tier was created."""
+  createdAt: DateTime!
+  """Timestamp when the tier was last updated."""
+  updatedAt: DateTime!
+}
+
+"""
+A user's entitlement to a specific app: whether (and via which tier) they may access it. At most one row per (app, user).
+"""
+type AppUserAccess {
+  """Unique numeric id of this access record (primary key)."""
+  appUserAccessId: BigInt!
+  """Numeric id of the app this access applies to."""
+  appId: BigInt!
+  """Numeric id of the user this access belongs to."""
+  userId: BigInt!
+  """
+  Numeric id of the access tier granting this access; null if access was granted without a specific tier.
+  """
+  tierId: BigInt
+  """
+  Entitlement lifecycle: "active" (currently entitled) or "revoked" (access removed). Only active, non-expired rows grant runtime access. Defaults to "active".
+  """
+  status: String!
+  """
+  Who granted this access: the granting admin's numeric user id (as a string), or "system" for automatic/free-tier grants.
+  """
+  grantedBy: String!
+  """
+  External billing subscription id (e.g. Stripe/PayPal) backing a paid grant; null for free or manual grants.
+  """
+  subscriptionId: String
+  """
+  Optional expiry timestamp; access is treated as inactive once it has passed. Null means the grant does not expire.
+  """
+  expiresAt: DateTime
+  """
+  A timed suspension: while this time is in the future the player holds no access (a gameplay token is refused with ACCESS_SUSPENDED and realtime sessions end), and access returns by itself once it passes. Null when the player is not suspended. Set with suspendAppAccess, cleared with unsuspendAppAccess.
+  """
+  suspendedUntil: DateTime
+  """Timestamp when the access record was first created."""
+  createdAt: DateTime!
+  """
+  Timestamp when the access record was last updated (e.g. re-granted or revoked).
+  """
+  updatedAt: DateTime!
+  """
+  The user this access record belongs to. Null if the user could not be loaded.
+  """
+  user: User
+  """
+  The access tier granted by this record. Null if no tier is associated (tierId is null) or the tier could not be loaded.
+  """
+  tier: AppAccessTier
+}
+
+"""
+Org member eligible for app access grants. Scoped to the app org; requires manage_access_tiers.
+"""
+type AppGrantMemberCandidate {
+  """Numeric id of the candidate user (use with grantAppAccess)."""
+  userId: BigInt!
+  """Email of the candidate, if known."""
+  email: String
+  """Gamertag / display handle of the candidate, if set."""
+  gamertag: String
+}
+
 """The signed-in identity behind a bearer token."""
 type ActorType {
   """
@@ -551,114 +677,6 @@ type AvatarDTO {
   createdAt: DateTime!
 }
 
-"""
-A free or purchasable access tier for an app, bundling a price and the set of runtime permission keys that granted users receive.
-"""
-type AppAccessTier {
-  """Unique numeric id of the tier (primary key)."""
-  tierId: BigInt!
-  """Numeric id of the app this tier belongs to."""
-  appId: BigInt!
-  """Display name of the tier (e.g. "Free", "Pro")."""
-  name: String!
-  """
-  Sort order for displaying tiers (ascending); lower values appear first.
-  """
-  tierOrder: Float!
-  """True if the tier has no purchase cost."""
-  isFree: Boolean!
-  """
-  True if this is the app default tier (used for open-by-default / self-service grants). At most one default per app is expected.
-  """
-  isDefault: Boolean!
-  """
-  Price in the smallest currency unit (cents) for paid tiers; null for free tiers.
-  """
-  priceCents: BigInt
-  """ISO 4217 currency code for priceCents (e.g. "usd"); defaults to "usd"."""
-  currency: String
-  """
-  Billing cadence for recurring tiers (e.g. "month", "year"); null for one-time or free tiers.
-  """
-  billingPeriod: String
-  """Optional marketing description of what the tier includes."""
-  description: String
-  """
-  Runtime permission keys granted to users on this tier (a subset of runtimePermissions), e.g. "access", "teleport", "update_voxel_data", "use_voice_chat", "use_video_chat" (webcam; not granted by default).
-  """
-  permissionKeys: [String!]!
-  """
-  Tier lifecycle: "active" or "archived" (soft-deleted via archiveAccessTier). Defaults to "active".
-  """
-  status: String!
-  """Timestamp when the tier was created."""
-  createdAt: DateTime!
-  """Timestamp when the tier was last updated."""
-  updatedAt: DateTime!
-}
-
-"""
-A user's entitlement to a specific app: whether (and via which tier) they may access it. At most one row per (app, user).
-"""
-type AppUserAccess {
-  """Unique numeric id of this access record (primary key)."""
-  appUserAccessId: BigInt!
-  """Numeric id of the app this access applies to."""
-  appId: BigInt!
-  """Numeric id of the user this access belongs to."""
-  userId: BigInt!
-  """
-  Numeric id of the access tier granting this access; null if access was granted without a specific tier.
-  """
-  tierId: BigInt
-  """
-  Entitlement lifecycle: "active" (currently entitled) or "revoked" (access removed). Only active, non-expired rows grant runtime access. Defaults to "active".
-  """
-  status: String!
-  """
-  Who granted this access: the granting admin's numeric user id (as a string), or "system" for automatic/free-tier grants.
-  """
-  grantedBy: String!
-  """
-  External billing subscription id (e.g. Stripe/PayPal) backing a paid grant; null for free or manual grants.
-  """
-  subscriptionId: String
-  """
-  Optional expiry timestamp; access is treated as inactive once it has passed. Null means the grant does not expire.
-  """
-  expiresAt: DateTime
-  """
-  A timed suspension: while this time is in the future the player holds no access (a gameplay token is refused with ACCESS_SUSPENDED and realtime sessions end), and access returns by itself once it passes. Null when the player is not suspended. Set with suspendAppAccess, cleared with unsuspendAppAccess.
-  """
-  suspendedUntil: DateTime
-  """Timestamp when the access record was first created."""
-  createdAt: DateTime!
-  """
-  Timestamp when the access record was last updated (e.g. re-granted or revoked).
-  """
-  updatedAt: DateTime!
-  """
-  The user this access record belongs to. Null if the user could not be loaded.
-  """
-  user: User
-  """
-  The access tier granted by this record. Null if no tier is associated (tierId is null) or the tier could not be loaded.
-  """
-  tier: AppAccessTier
-}
-
-"""
-Org member eligible for app access grants. Scoped to the app org; requires manage_access_tiers.
-"""
-type AppGrantMemberCandidate {
-  """Numeric id of the candidate user (use with grantAppAccess)."""
-  userId: BigInt!
-  """Email of the candidate, if known."""
-  email: String
-  """Gamertag / display handle of the candidate, if set."""
-  gamertag: String
-}
-
 type TeleportResponse {
   """
   True when the teleport is authorized/accepted; false otherwise (inspect errorCode for the reason).
@@ -6605,6 +6623,13 @@ type Query {
     query: String
   ): UsersConnection! @requiresPermission(scope: "super_admin", permission: "is_super_admin")
   """
+  ADMIN: the target account's platform-wide block: whether it holds now, and the last one set (who, when, why, until). Requires a super-admin bearer game token.
+  """
+  accountBlock(
+    """Target user id (BigInt as a decimal string)."""
+    userId: BigInt!
+  ): AccountBlock! @requiresPermission(scope: "super_admin", permission: "is_super_admin")
+  """
   Lists the avatars owned by `userId`. Requires a valid game token. Owner-aware: when the caller is NOT the owner, each avatar’s `privateState` is stripped (returned null); `publicState` is always included. State blobs are base64-encoded binary.
   """
   userAvatars(
@@ -8383,6 +8408,28 @@ type Mutation {
     userId: BigInt!
   ): Boolean! @requiresPermission(scope: "super_admin", permission: "is_super_admin")
   """
+  ADMIN/DESTRUCTIVE: blocks an account platform-wide. Every session and app token it holds is revoked, its realtime sessions and ck-exec sockets (developer sessions too) end in every datacenter, its mods stop, and every later sign-in and request, on CK and on Crowd Altar, is refused with ACCOUNT_BLOCKED until `until` (or until unblockAccount when absent). Not yourself, not a super-admin. Requires a super-admin bearer game token.
+  """
+  blockAccount(
+    """Target user id (BigInt as a decimal string)."""
+    userId: BigInt!
+    """
+    Why (1 to 500 characters). Kept on the account; shown to super-admins, not to the account.
+    """
+    reason: String!
+    """
+    When the block lapses by itself (ISO-8601, in the future). Absent: until unblockAccount.
+    """
+    until: DateTime
+  ): AccountBlock! @requiresPermission(scope: "super_admin", permission: "is_super_admin")
+  """
+  ADMIN: lifts an account block now. Nothing is restored; the account signs in again. The last block stays readable through accountBlock. Requires a super-admin bearer game token.
+  """
+  unblockAccount(
+    """Target user id (BigInt as a decimal string)."""
+    userId: BigInt!
+  ): AccountBlock! @requiresPermission(scope: "super_admin", permission: "is_super_admin")
+  """
   DESTRUCTIVE self-service: soft-deletes the authenticated caller's OWN account — anonymizes PII and revokes all sessions; wallet, voxel, and donation history stay intact via FK. Acts only on the caller (no target argument). Requires a valid game token.
   """
   deleteMyAccount: Boolean!
@@ -9568,6 +9615,28 @@ type Mutation {
     userId: BigInt!
   ): Boolean! @requiresPermission(scope: "group", permission: "manage_members", scopeArg: "groupId")
   """
+  Ban a user from a team: their membership (or a new row, for someone not yet in it) becomes 'banned' and their roles go, and joining, requesting to join and being added are refused with GROUP_MEMBER_BANNED until unbanTeamMember. Leaving or removing does not lift a ban. Requires the 'manage_members' team permission (app admins bypass). Never the team's owner, never yourself.
+  """
+  banTeamMember(
+    """The team to ban the user from."""
+    groupId: BigInt!
+    """The user to ban."""
+    userId: BigInt!
+    """
+    Why, for the team managers (at most 500 characters). Not shown to the banned user.
+    """
+    reason: String
+  ): GroupMember! @requiresPermission(scope: "group", permission: "manage_members", scopeArg: "groupId")
+  """
+  Lift a team ban, so the user may join or be added again (nothing is restored). Requires the 'manage_members' team permission (app admins bypass). Returns true if there was a ban.
+  """
+  unbanTeamMember(
+    """The team."""
+    groupId: BigInt!
+    """The banned user."""
+    userId: BigInt!
+  ): Boolean! @requiresPermission(scope: "group", permission: "manage_members", scopeArg: "groupId")
+  """
   Replace a member's roles with the given set (not additive — roles not listed are removed). Requires the 'manage_roles' team permission (app admins bypass).
   """
   setTeamMemberRoles(
@@ -9682,6 +9751,28 @@ type Mutation {
     userId: BigInt!
   ): Boolean! @requiresPermission(scope: "group", permission: "manage_members", scopeArg: "groupId")
   """
+  Ban a user from a channel: their membership (or a new row, for someone not yet in it) becomes 'banned', their roles go, Buddy stops routing the channel to and from them, and joining, requesting to join and being added are refused with GROUP_MEMBER_BANNED until unbanChannelMember. Leaving or removing does not lift a ban. Requires the 'manage_members' channel permission (app admins bypass). Never the channel's owner, never yourself.
+  """
+  banChannelMember(
+    """The channel to ban the user from."""
+    groupId: BigInt!
+    """The user to ban."""
+    userId: BigInt!
+    """
+    Why, for the channel managers (at most 500 characters). Not shown to the banned user.
+    """
+    reason: String
+  ): GroupMember! @requiresPermission(scope: "group", permission: "manage_members", scopeArg: "groupId")
+  """
+  Lift a channel ban, so the user may join or be added again (nothing is restored). Requires the 'manage_members' channel permission (app admins bypass). Returns true if there was a ban.
+  """
+  unbanChannelMember(
+    """The channel."""
+    groupId: BigInt!
+    """The banned user."""
+    userId: BigInt!
+  ): Boolean! @requiresPermission(scope: "group", permission: "manage_members", scopeArg: "groupId")
+  """
   Replace a member's channel roles with the given set (not additive — roles not listed are removed). Requires the 'manage_roles' channel permission (app admins bypass). Re-pushes the member's effective send permission to Buddy so their ability to post updates immediately.
   """
   setChannelMemberRoles(