crowdypy 0.17.0.dev1__tar.gz → 0.18.0.dev1__tar.gz

{crowdypy-0.17.0.dev1 → crowdypy-0.18.0.dev1}/MIGRATION.md

@@ -3,6 +3,31 @@
 CrowdyPy is pre-1.0. Within a minor line, patch releases keep source compatibility; each
 new minor may change the API. Read the section for every minor you skip.
 
+## 0.18.0
+
+CrowdyJS 18.18.0 and CrowdyCPP 0.70.0. No API change. ck-api v2.55.0 adds two app-level
+permission keys, and the realtime servers enforce them:
+
+- **`use_text_chat`** for proximity text (`client.udp.send_text_packet`, `World.send_text`,
+  the replication connection's `send_text_packet`) and for text on a channel
+  (`send_channel_message`, `send_ranged_channel_message`).
+- **`use_direct_messages`** for `send_single_actor_message` and `World.send_to_actor`.
+
+Without the key the server answers `UNAUTHORIZED` for the send's sequence number. Every
+access tier that grants `access` has both: ck-api adds them when a tier is created or updated
+(`client.app_access.create_tier` / `update_tier`) unless `applyCommunicationDefaults` is false,
+and an operator backfilled the existing tiers. An app that wants some players without chat
+removes a key from their tier.
+
+Also from ck-api v2.54.0 and v2.55.0:
+
+- `client.managed_players.delete` now erases the player's content within minutes; a legal hold
+  on the player or its organization refuses it with `LEGAL_HOLD`.
+- `client.apps.update(app_id, {"replayLoggingRecordsMedia": False})` leaves voice and video out
+  of the app's recording (default true).
+- The operator fields for account erasure and legal holds are not wrapped, as in CrowdyJS and
+  CrowdyCPP: the SDK is for players, developers and org-admins.
+
 ## 0.17.0
 
 CrowdyJS 18.17.0 and CrowdyCPP 0.69.0. Additive. ck-api v2.53.0 serves org-managed players on

{crowdypy-0.17.0.dev1 → crowdypy-0.18.0.dev1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: crowdypy
-Version: 0.17.0.dev1
+Version: 0.18.0.dev1
 Summary: Official Python SDK for Crowded Kingdoms: typed GraphQL clients and a native UDP replication core
 Keywords: crowded-kingdoms,multiplayer,replication,graphql,sdk,udp
 Author: Crowded Kingdoms
@@ -51,6 +51,8 @@ CrowdyPy follows the [CrowdyJS](https://github.com/CrowdedKingdoms/CrowdyJS) API
 client, bound with [nanobind](https://github.com/wjakob/nanobind) and shipped inside the
 wheel. Python never touches a datagram.
 
+**v0.18.0: text chat and direct-message keys, and the recording switch.** Game API v2.55.0 adds the app-level `use_text_chat` and `use_direct_messages` keys: without them the realtime servers refuse a player's text, channel text and direct messages with `UNAUTHORIZED`. A tier that grants `access` gets both unless `applyCommunicationDefaults` is false, and `replayLoggingRecordsMedia` leaves voice and video out of an app's recording. Deleting a managed player now erases its content, and a legal hold refuses it with `LEGAL_HOLD`. See [MIGRATION.md](MIGRATION.md).
+
 **v0.17.0: the Org-Managed Players Addendum.** ck-api v2.53.0 serves org-managed players on every tier, once an admin of the organization has accepted the addendum in Studio; until then its sign-ins and refreshes answer `ORG_LEGAL_ACCEPTANCE_REQUIRED`, which `crowdypy.errors.org_legal_acceptance_required_of` reads, and `client.managed_players.settings(org_id)` says where the organization stands. CrowdyJS 18.17.0 and CrowdyCPP 0.69.0. See [MIGRATION.md](MIGRATION.md).
 
 **v0.16.0: org-managed players.** An organization that runs its own accounts signs its players in itself: its server mints a player's app token with an org token, or its sign-in service signs an assertion. A device holds the first with `client.portal.adopt_app_token(response)` (it refuses an org token, which stays on the organization's server; there is no org-token mint wrapper) or trades the second with `client.portal.exchange_managed_player_assertion(app_id, assertion)`, and gives the result to `client.set_app_token`. `client.managed_players` is the organization's administration. CrowdyJS 18.16.0 and CrowdyCPP 0.68.0. See [MIGRATION.md](MIGRATION.md).

{crowdypy-0.17.0.dev1 → crowdypy-0.18.0.dev1}/README.md

@@ -11,6 +11,8 @@ CrowdyPy follows the [CrowdyJS](https://github.com/CrowdedKingdoms/CrowdyJS) API
 client, bound with [nanobind](https://github.com/wjakob/nanobind) and shipped inside the
 wheel. Python never touches a datagram.
 
+**v0.18.0: text chat and direct-message keys, and the recording switch.** Game API v2.55.0 adds the app-level `use_text_chat` and `use_direct_messages` keys: without them the realtime servers refuse a player's text, channel text and direct messages with `UNAUTHORIZED`. A tier that grants `access` gets both unless `applyCommunicationDefaults` is false, and `replayLoggingRecordsMedia` leaves voice and video out of an app's recording. Deleting a managed player now erases its content, and a legal hold refuses it with `LEGAL_HOLD`. See [MIGRATION.md](MIGRATION.md).
+
 **v0.17.0: the Org-Managed Players Addendum.** ck-api v2.53.0 serves org-managed players on every tier, once an admin of the organization has accepted the addendum in Studio; until then its sign-ins and refreshes answer `ORG_LEGAL_ACCEPTANCE_REQUIRED`, which `crowdypy.errors.org_legal_acceptance_required_of` reads, and `client.managed_players.settings(org_id)` says where the organization stands. CrowdyJS 18.17.0 and CrowdyCPP 0.69.0. See [MIGRATION.md](MIGRATION.md).
 
 **v0.16.0: org-managed players.** An organization that runs its own accounts signs its players in itself: its server mints a player's app token with an org token, or its sign-in service signs an assertion. A device holds the first with `client.portal.adopt_app_token(response)` (it refuses an org token, which stays on the organization's server; there is no org-token mint wrapper) or trades the second with `client.portal.exchange_managed_player_assertion(app_id, assertion)`, and gives the result to `client.set_app_token`. `client.managed_players` is the organization's administration. CrowdyJS 18.16.0 and CrowdyCPP 0.68.0. See [MIGRATION.md](MIGRATION.md).

{crowdypy-0.17.0.dev1 → crowdypy-0.18.0.dev1}/docs/compatibility.md

@@ -5,7 +5,7 @@ are in `pyproject.toml` (`[project].version`, `[tool.crowdypy.crowdyjs]`,
 `[tool.crowdypy.crowdycpp]`); `tests/unit/test_release_versions.py` refuses this page when
 its version disagrees.
 
-- CrowdyPy `0.17.0`
+- CrowdyPy `0.18.0`
 - API surface: CrowdyJS (the pinned version and commit in `pyproject.toml`); the generated
   `docs/parity-matrix.md` lists every covered method, every native equivalent and every
   browser exclusion with its reason. The gate is strict: there are no portable gaps, and a

{crowdypy-0.17.0.dev1 → crowdypy-0.18.0.dev1}/docs/parity-matrix.md

@@ -4,8 +4,8 @@ Generated by `tools/parity/parity.py`; do not edit by hand. Classifications live
 
 ## Target
 
-- CrowdyJS: `18.17.0` at `05c2f28b72ebde4c487c7bb52e07d11466bc64cc`
-- CrowdyCPP (native core): `0.69.0` at `96c859cdf7972686f3325489c01b8a49161dd664`
+- CrowdyJS: `18.18.0` at `e21a05d521249e402733f80eaa668fece4b45906`
+- CrowdyCPP (native core): `0.70.0` at `2b67e3f976934224c4d45ded101655a38ed3eabc`
 - schema.gql identical to CrowdyJS's: yes
 - Gate mode: strict portable parity (every portable gap is release-blocking)
 
@@ -14,7 +14,7 @@ Generated by `tools/parity/parity.py`; do not edit by hand. Classifications live
 - Covered: 1386
 - Portable gap: 0
 - Native equivalent: 46
-- Browser exclusion: 116
+- Browser exclusion: 121
 - Deprecated roots: 2
 - Unclassified: 0
 
@@ -157,10 +157,12 @@ Generated by `tools/parity/parity.py`; do not edit by hand. Classifications live
 | `mutation.registerOrgSigningKey` | covered |
 | `mutation.reinstateOrganization` | browser exclusion — operator-only organization lifecycle; not a game-client surface |
 | `mutation.releaseClaimedGrid` | covered |
+| `mutation.releaseLegalHold` | browser exclusion — super-admin or operator only; the SDK wraps nothing for platform roles (tooling calls it directly) |
 | `mutation.removeChannelMember` | covered |
 | `mutation.removeOrgMember` | covered |
 | `mutation.removeSharedPaymentMethod` | covered |
 | `mutation.removeTeamMember` | covered |
+| `mutation.requestAccountErasure` | browser exclusion — super-admin or operator only; the SDK wraps nothing for platform roles (tooling calls it directly) |
 | `mutation.requestLoginLink` | covered |
 | `mutation.requestPasswordReset` | covered |
 | `mutation.requestToJoinChannel` | covered |
@@ -211,6 +213,7 @@ Generated by `tools/parity/parity.py`; do not edit by hand. Classifications live
 | `mutation.setHostedGameEnabled` | browser exclusion — publishes and administers browser game bundles on the Crowdy Games web host; a Python client has no bundle to publish |
 | `mutation.setHostedGameListing` | browser exclusion — publishes and administers browser game bundles on the Crowdy Games web host; a Python client has no bundle to publish |
 | `mutation.setInitialPassword` | covered |
+| `mutation.setLegalHold` | browser exclusion — super-admin or operator only; the SDK wraps nothing for platform roles (tooling calls it directly) |
 | `mutation.setOperator` | browser exclusion — super-admin or operator only; the SDK wraps nothing for platform roles (tooling calls it directly) |
 | `mutation.setOrgBillingExempt` | browser exclusion — operator-only billing control; not a game-client surface |
 | `mutation.setOrgManagedPlayerSettings` | browser exclusion — super-admin or operator only; the SDK wraps nothing for platform roles (tooling calls it directly) |
@@ -262,6 +265,7 @@ Generated by `tools/parity/parity.py`; do not edit by hand. Classifications live
 | `mutation.updateUserType` | browser exclusion — super-admin or operator only; the SDK wraps nothing for platform roles (tooling calls it directly) |
 | `mutation.updateVoxel` | covered |
 | `query.accountBlock` | browser exclusion — super-admin or operator only; the SDK wraps nothing for platform roles (tooling calls it directly) |
+| `query.accountErasure` | browser exclusion — super-admin or operator only; the SDK wraps nothing for platform roles (tooling calls it directly) |
 | `query.activeGraphQLServers` | covered |
 | `query.actor` | covered |
 | `query.actors` | covered |
@@ -375,6 +379,7 @@ Generated by `tools/parity/parity.py`; do not edit by hand. Classifications live
 | `query.hostedGames` | browser exclusion — catalog of browser games hosted on Crowdy Games; a Python client is not one of them |
 | `query.inputLogMessages` | covered |
 | `query.inputLogSessions` | covered |
+| `query.legalHolds` | browser exclusion — super-admin or operator only; the SDK wraps nothing for platform roles (tooling calls it directly) |
 | `query.listVoxelUpdatesByDistance` | covered |
 | `query.listVoxels` | covered |
 | `query.managedPlayer` | covered |

{crowdypy-0.17.0.dev1 → crowdypy-0.18.0.dev1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "scikit_build_core.build"
 
 [project]
 name = "crowdypy"
-version = "0.17.0.dev1"
+version = "0.18.0.dev1"
 description = "Official Python SDK for Crowded Kingdoms: typed GraphQL clients and a native UDP replication core"
 readme = "README.md"
 license = "MIT AND Apache-2.0"
@@ -119,19 +119,19 @@ environment = { OPENSSL_ROOT_DIR = "C:/vcpkg/installed/x64-windows-static-md" }
 # --------------------------------------------------------------------------------------
 
 [tool.crowdypy.crowdyjs]
-version = "18.17.0"
-commit = "05c2f28b72ebde4c487c7bb52e07d11466bc64cc"
+version = "18.18.0"
+commit = "e21a05d521249e402733f80eaa668fece4b45906"
 
 [tool.crowdypy.crowdycpp]
-version = "0.69.0"
-tag = "dev/v0.69.0"
-commit = "96c859cdf7972686f3325489c01b8a49161dd664"
-tree-sha256 = "b2e302e5d2e8967d7325dda2fb14a46c162fa1d69ce2b3c149f85fa8c5eeca82"
+version = "0.70.0"
+tag = "dev/v0.70.0"
+commit = "2b67e3f976934224c4d45ded101655a38ed3eabc"
+tree-sha256 = "ac181281169221b6de4c1073976c15f87493459ea0227a5229071be88dff1b32"
 
 # schema.gql and operations/ are CrowdyJS's, copied from the commit pinned above by
 # scripts/schema_sync.py, which records these hashes and re-derives them in CI.
 [tool.crowdypy.graphql]
-schema-sha256 = "261902653e100cc5701c32580d07b5ae401e28fa547a0712fa71429fb24df188"
+schema-sha256 = "aa15686351b9ce9a99a1127678a86e4c2c7e92b0d06b55655c99a1407b1a681d"
 operations-sha256 = "32e2c43ac1bd00ec9c05902d524e82727cf560a88330f207704059a7a8a96189"
 
 # The SDL the docs site publishes. scripts/schema_drift.py compares the snapshot against it

{crowdypy-0.17.0.dev1 → crowdypy-0.18.0.dev1}/schema.gql

@@ -1337,6 +1337,10 @@ type App {
   """
   replayLoggingEnabled: Boolean!
   """
+  Whether replay logging records the app's voice, webcam video and channel audio messages too. True (the default) records them with every other message; false leaves them out of the input log while everything else is still recorded. Applies only while replayLoggingEnabled is on. Set with updateApp (manage_apps).
+  """
+  replayLoggingRecordsMedia: Boolean!
+  """
   Grid permission keys a player's claim grants its owner on the claimed grid (claimGridOwnership), beside the player-code keys the owner's tier carries; for example update_voxel_data makes a claim buildable without a hub granting it. Never a player-code key; the grid's permission limits still cap them. Empty by default. Set with updateApp (manage_apps).
   """
   claimOwnerKeys: [String!]!
@@ -6646,6 +6650,68 @@ type CrowdyStudioModelUsage {
   recent: [CrowdyStudioModelUsageEntry!]!
 }
 
+"""
+A legal hold an operator set on an organization or on one account. While it applies, deleting a managed player it covers is refused with LEGAL_HOLD, a player’s own account deletion closes the account but keeps its content (and preserves its identity) until the hold is released, and no erasure runs. An organization’s hold covers its managed players. A released hold stays readable as the record.
+"""
+type LegalHold {
+  """The hold."""
+  holdId: BigInt!
+  """
+  The organization held (its public id), or null for a hold on one account.
+  """
+  orgId: BigInt
+  """The account held, or null for a hold on an organization."""
+  userId: BigInt
+  """Why, as the operator wrote it."""
+  reason: String!
+  """The operator who set it."""
+  setBy: BigInt!
+  """When it was set."""
+  setAt: DateTime!
+  """The operator who released it, or null while it applies."""
+  releasedBy: BigInt
+  """When it was released, or null while it applies."""
+  releasedAt: DateTime
+  """Whether it applies now."""
+  active: Boolean!
+}
+
+"""
+An account erasure: what deleting an account erases (its player-side content) and where that stands. Usage, billing, audit and legal records stay, and so does everything the account owns as a developer.
+"""
+type AccountErasure {
+  """The deleted account."""
+  userId: BigInt!
+  """
+  PENDING (apps still to do), RUNNING (finishing), DONE, FAILED (the finish threw; it is retried) or DEFERRED_HOLD (a legal hold applies; nothing is erased until it is released).
+  """
+  status: String!
+  """
+  Why it was asked for: SELF_DELETE (the player deleted its own account), MANAGED_DELETE (its organization deleted it) or OPERATOR.
+  """
+  reason: String!
+  """Who asked: user:<id>, org_token:<id> or operator:<id>."""
+  requestedBy: String
+  """When it was asked for."""
+  requestedAt: DateTime!
+  """When it finished, or null."""
+  completedAt: DateTime
+  """Apps the account had content in."""
+  apps: Int!
+  """Of those, the apps already erased."""
+  appsDone: Int!
+  """The last error, from the finish or from an app, or null."""
+  lastError: String
+  """
+  What was erased, as JSON: rows removed per table, summed over the apps, and the account-wide rows.
+  """
+  summary: String
+  """
+  OPERATOR ONLY. While a legal hold defers the erasure, what the account row said before it was blanked (email, gamertag, external id, organization), as JSON; null otherwise.
+  """
+  preservedIdentity: String
+}
+
 """
 Arbitrary-precision signed integer (used for 64-bit ids and chunk coordinates such as appId, userId and chunk x/y/z). ALWAYS transmitted as a base-10 decimal STRING in BOTH directions — send it quoted (e.g. "1024", "-5") and read it back as a string; never use a raw JSON number, because large values overflow IEEE-754 doubles. The server rejects any value that is not a valid integer string.
 """
@@ -7186,6 +7252,24 @@ type Query {
     orgId: BigInt!
   ): [OrgSigningKey!]!
   """
+  OPERATOR: where the erasure of a deleted account stands (what deleting it erases, app by app), or null if none was asked for. While a legal hold defers it, preservedIdentity carries what the account row said before it was blanked.
+  """
+  accountErasure(
+    """The deleted account."""
+    userId: BigInt!
+  ): AccountErasure @requiresPermission(scope: "operator", permission: "is_operator")
+  """
+  OPERATOR: legal holds, newest first (at most 500), on one organization or account if given; only the ones that apply now unless includeReleased.
+  """
+  legalHolds(
+    """Only holds on this organization (its public id)."""
+    orgId: BigInt
+    """Only holds on this account."""
+    userId: BigInt
+    """Also list released holds."""
+    includeReleased: Boolean = false
+  ): [LegalHold!]! @requiresPermission(scope: "operator", permission: "is_operator")
+  """
   A hosted third-party game by slug, or null when the slug is unclaimed. PUBLIC: the first-party shell at https://<games host>/<slug>/ calls this before sign-in to learn the contentOrigin it frames. Returns DISABLED and TAKEN_DOWN games too (with their status) so the shell can say why. Null when the tier does not host third-party games.
   """
   hostedGame(
@@ -8612,7 +8696,7 @@ type Mutation {
     userId: BigInt!
   ): AccountBlock! @requiresPermission(scope: "super_admin", permission: "is_super_admin")
   """
-  DESTRUCTIVE self-service: soft-deletes the authenticated caller's OWN account — anonymizes PII and revokes all sessions; wallet, voxel, and donation history stay intact via FK. Acts only on the caller (no target argument). Requires a valid game token.
+  DESTRUCTIVE self-service: deletes the authenticated caller's OWN account. Every session, app token, realtime connection and ck-exec socket ends; the email, password, gamertag and profile state are removed from the account; and its player-side content is erased within minutes: Crowdy Studio projects, libraries and agent sessions, mods, actors, avatars and saved state, access grants, grid claims, and team and channel memberships. Wallet, billing, usage, audit and legal records stay, and so does everything the account owns as a developer (organizations, apps, published games); world edits stay, under the account's now anonymous id; recorded inputs age out with the input log's retention. Acts only on the caller (no target argument). Requires a valid token.
   """
   deleteMyAccount: Boolean!
   """
@@ -9092,7 +9176,7 @@ type Mutation {
     input: CreateAppInput!
   ): App! @requiresPermission(scope: "org", permission: "manage_apps", scopeArg: "input.orgId")
   """
-  Update mutable fields of an existing app (name, description, visibility, status, metadata, wildernessWritesOpen, replayLoggingEnabled); only fields present in the input are changed. Turning replayLoggingEnabled on is refused with INPUT_LOG_FUNDS_NEEDED unless the org's wallet can spend at least the projected cost of keeping one retention period of the app's recent traffic (extensions.requiredMicrousd and spendableMicrousd say how much), or the org is billing-exempt; recordings already kept go on billing after it is turned off, until they age out. Requires the 'manage_apps' permission on the app (resolved via its org); super admins bypass. Use this to publish (status=LIVE), change visibility, or restore an archived app (status back to DRAFT/LIVE). Throws if the app id does not exist.
+  Update mutable fields of an existing app (name, description, visibility, status, metadata, wildernessWritesOpen, claimOwnerKeys, replayLoggingEnabled, replayLoggingRecordsMedia); only fields present in the input are changed. Turning replayLoggingEnabled on is refused with INPUT_LOG_FUNDS_NEEDED unless the org's wallet can spend at least the projected cost of keeping one retention period of the app's recent traffic (extensions.requiredMicrousd and spendableMicrousd say how much), or the org is billing-exempt; recordings already kept go on billing after it is turned off, until they age out. Requires the 'manage_apps' permission on the app (resolved via its org); super admins bypass. Use this to publish (status=LIVE), change visibility, or restore an archived app (status back to DRAFT/LIVE). Throws if the app id does not exist.
   """
   updateApp(
     """Numeric id of the app to update."""
@@ -9207,7 +9291,7 @@ type Mutation {
     externalId: String!
   ): Boolean!
   """
-  Delete a managed player: its sessions end and its row is anonymized, as an account deletion is. Signing the same external id in again creates a new player. False when there was no such player. An org token with players:manage, or an org admin with manage_players.
+  Delete a managed player, as an account deletion is: its sessions end, its externalId and gamertag are removed, and its player-side content is erased within minutes (Crowdy Studio projects, libraries and agent sessions, mods, actors, avatars and saved state, access grants, grid claims, team and channel memberships). Usage and billing records stay; world edits stay, under the account’s now anonymous id; recorded inputs age out with the input log’s retention. Refused with LEGAL_HOLD while a legal hold covers the player or the organization: disable it instead (updateManagedPlayer), which keeps everything. Signing the same external id in again creates a new player. False when there was no such player. An org token with players:manage, or an org admin with manage_players.
   """
   deleteManagedPlayer(
     """
@@ -9261,6 +9345,27 @@ type Mutation {
     enabled: Boolean!
   ): Boolean! @requiresPermission(scope: "app", permission: "manage_billing", scopeArg: "appId")
   """
+  OPERATOR: erase the player-side content of a deleted account, as a deletion does: one deleted before account erasure existed (2026-10-23), or one whose erasure stopped after its retries (its attempts start again). Refused for an account that is not deleted. A legal hold defers it.
+  """
+  requestAccountErasure(
+    """The deleted account to erase."""
+    userId: BigInt!
+  ): AccountErasure! @requiresPermission(scope: "operator", permission: "is_operator")
+  """
+  OPERATOR: put an organization (and its managed players) or one account under a legal hold. While it applies, deleting a managed player it covers is refused with LEGAL_HOLD, a player’s own deletion closes the account but keeps its content and preserves its identity, and no erasure runs.
+  """
+  setLegalHold(
+    """What to hold, and why."""
+    input: SetLegalHoldInput!
+  ): LegalHold! @requiresPermission(scope: "operator", permission: "is_operator")
+  """
+  OPERATOR: release a legal hold. The hold stays as the record. Erasures it deferred resume once no other hold covers their accounts.
+  """
+  releaseLegalHold(
+    """The hold to release."""
+    holdId: BigInt!
+  ): LegalHold! @requiresPermission(scope: "operator", permission: "is_operator")
+  """
   Claim the hosting slug for an app (idempotent; the same app re-claiming its slug is a no-op, a different slug MOVES the game). Registers https://<games host>/<slug>/ and https://<slug>.<content host> as the app's redirect URIs and sets launch_url to the former. Requires manage_apps on the app and a SESSION token. Refuses a slug that is not a DNS label, is reserved, or belongs to another app (HOSTED_SLUG_UNAVAILABLE), and answers CONTENT_HOSTING_DISABLED on a tier without a content CDN.
   """
   claimGameHosting(input: ClaimGameHostingInput!): HostedGame!
@@ -10552,14 +10657,14 @@ type Mutation {
     input: ClientVideoPacketInput!
   ): Boolean! @requiresPermission(scope: "runtime", permission: "use_video_chat", scopeArg: "input.appId")
   """
-  Send a spatial text/chat packet, fanned out to nearby actors as a ClientTextNotification. Requires a bearer game token; opens a UDP proxy session automatically if none exists. Returns Boolean! that is true only when the datagram was ACCEPTED FOR SENDING to the game server — NOT confirmation of delivery. The sender receives no echo; failures arrive ASYNCHRONOUSLY as GenericErrorResponse on udpNotifications, correlated by the request sequenceNumber (correlation only — not an idempotency key; the server does not dedupe replays).
+  Send a spatial text/chat packet, fanned out to nearby actors as a ClientTextNotification. Requires a bearer game token and the use_text_chat runtime permission on the app (a tier that grants access grants it unless the app took it away); without it the game server answers asynchronously with a GenericErrorResponse (errorCode UNAUTHORIZED). Opens a UDP proxy session automatically if none exists. Returns Boolean! that is true only when the datagram was ACCEPTED FOR SENDING to the game server — NOT confirmation of delivery. The sender receives no echo; failures arrive ASYNCHRONOUSLY as GenericErrorResponse on udpNotifications, correlated by the request sequenceNumber (correlation only — not an idempotency key; the server does not dedupe replays).
   """
   sendTextPacket(
     """
     The text/chat packet to send: target appId, chunk coordinates, 32-byte source uuid, UTF-8 text, and optional distance/decayRate/sequenceNumber. See ClientTextPacketInput.
     """
     input: ClientTextPacketInput!
-  ): Boolean!
+  ): Boolean! @requiresPermission(scope: "runtime", permission: "use_text_chat", scopeArg: "input.appId")
   """
   Send a custom, app-defined client event (identified by eventType, a uint16) for spatial replication to nearby chunks; nearby actors receive it as a ClientEventNotification. Requires a bearer game token; opens a UDP proxy session automatically if none exists. Returns Boolean! that is true only when the datagram was ACCEPTED FOR SENDING — NOT that the world processed it. Failures arrive ASYNCHRONOUSLY as GenericErrorResponse on udpNotifications, correlated by the request sequenceNumber (correlation only — not an idempotency key; the server does not dedupe replays).
   """
@@ -10570,16 +10675,16 @@ type Mutation {
     input: ClientEventNotificationInput!
   ): Boolean!
   """
-  Send a direct actor-to-actor message, delivered only to the actor identified by targetUuid (NOT broadcast to nearby actors). The sender must know the destination actor’s current chunk. Requires a bearer game token; opens a UDP proxy session automatically if none exists. The target receives a SingleActorMessageNotification on udpNotifications; the sender receives no echo. Returns Boolean! that is true only when the datagram was ACCEPTED FOR SENDING — NOT confirmation of delivery; failures arrive ASYNCHRONOUSLY as GenericErrorResponse on udpNotifications, correlated by the request sequenceNumber (correlation only — not an idempotency key; the server does not dedupe replays).
+  Send a direct actor-to-actor message, delivered only to the actor identified by targetUuid (NOT broadcast to nearby actors). The sender must know the destination actor’s current chunk. Requires a bearer game token and the use_direct_messages runtime permission on the app (a tier that grants access grants it unless the app took it away); without it the game server answers asynchronously with a GenericErrorResponse (errorCode UNAUTHORIZED). Opens a UDP proxy session automatically if none exists. The target receives a SingleActorMessageNotification on udpNotifications; the sender receives no echo. Returns Boolean! that is true only when the datagram was ACCEPTED FOR SENDING — NOT confirmation of delivery; failures arrive ASYNCHRONOUSLY as GenericErrorResponse on udpNotifications, correlated by the request sequenceNumber (correlation only — not an idempotency key; the server does not dedupe replays).
   """
   sendSingleActorMessage(
     """
     The direct message to send: target appId, the DESTINATION actor’s chunk coordinates, the 32-byte targetUuid, base64 payload, and optional sequenceNumber. See SingleActorMessageInput.
     """
     input: SingleActorMessageInput!
-  ): Boolean!
+  ): Boolean! @requiresPermission(scope: "runtime", permission: "use_direct_messages", scopeArg: "input.appId")
   """
-  Publish a message to a channel, delivered to every active member of the channel (not chunk-routed) as a ChannelMessageNotification on udpNotifications. Requires a bearer game token and the channel send_messages permission; lacking the permission the server drops the message. Opens a UDP proxy session automatically if none exists. The sender receives no echo. Returns Boolean! that is true only when the datagram was ACCEPTED FOR SENDING — NOT confirmation of delivery; failures arrive ASYNCHRONOUSLY as GenericErrorResponse on udpNotifications, correlated by the request sequenceNumber (correlation only — not an idempotency key; the server does not dedupe replays).
+  Publish a message to a channel, delivered to every active member of the channel (not chunk-routed) as a ChannelMessageNotification on udpNotifications. Requires a bearer game token, the channel send_messages permission and the use_text_chat runtime permission on the channel’s app; lacking either the game server answers asynchronously with a GenericErrorResponse (errorCode UNAUTHORIZED). Opens a UDP proxy session automatically if none exists. The sender receives no echo. Returns Boolean! that is true only when the datagram was ACCEPTED FOR SENDING — NOT confirmation of delivery; failures arrive ASYNCHRONOUSLY as GenericErrorResponse on udpNotifications, correlated by the request sequenceNumber (correlation only — not an idempotency key; the server does not dedupe replays).
   """
   sendChannelMessage(
     """
@@ -10597,14 +10702,14 @@ type Mutation {
     input: ChannelMessageInput!
   ): Boolean!
   """
-  Publish a message to a channel that only reaches members near an origin chunk: a member receives it, as an ordinary ChannelMessageNotification on udpNotifications, when one of its live actors is in the same app within maxDistance chunks of input.chunk (straight-line distance between chunk coordinates, boundary included). A member with no live actor does not receive it. Requires a bearer game token and the channel send_messages permission, as for sendChannelMessage; the origin app must be the token’s app. Opens a UDP proxy session automatically if none exists. The sender receives no echo. Returns Boolean! that is true only when the datagram was ACCEPTED FOR SENDING — NOT confirmation of delivery; failures arrive ASYNCHRONOUSLY as GenericErrorResponse on udpNotifications (UNAUTHORIZED without the send right, INVALID_APP_ID for another app), correlated by the request sequenceNumber (correlation only — not an idempotency key; the server does not dedupe replays).
+  Publish a message to a channel that only reaches members near an origin chunk: a member receives it, as an ordinary ChannelMessageNotification on udpNotifications, when one of its live actors is in the same app within maxDistance chunks of input.chunk (straight-line distance between chunk coordinates, boundary included). A member with no live actor does not receive it. Requires a bearer game token, the channel send_messages permission and use_text_chat, as for sendChannelMessage; the origin app must be the token’s app. Opens a UDP proxy session automatically if none exists. The sender receives no echo. Returns Boolean! that is true only when the datagram was ACCEPTED FOR SENDING — NOT confirmation of delivery; failures arrive ASYNCHRONOUSLY as GenericErrorResponse on udpNotifications (UNAUTHORIZED without the send right or use_text_chat, INVALID_APP_ID for another app), correlated by the request sequenceNumber (correlation only — not an idempotency key; the server does not dedupe replays).
   """
   sendRangedChannelMessage(
     """
     The channel message to publish: channelId (groups.group_id), the sender’s 32-byte actor uuid, base64 payload (max 1024 bytes), the origin appId and chunk, maxDistance in chunks, and optional sequenceNumber. See RangedChannelMessageInput.
     """
     input: RangedChannelMessageInput!
-  ): Boolean!
+  ): Boolean! @requiresPermission(scope: "runtime", permission: "use_text_chat", scopeArg: "input.appId")
 }
 
 input UpdateGamertagInput {
@@ -10786,6 +10891,10 @@ input CreateAccessTierInput {
   Optional runtime permission keys to grant on this tier (must be valid runtimePermissions). Defaults to ["access"] when omitted.
   """
   permissionKeys: [String!]
+  """
+  When true (the default) and the tier grants access, it also grants use_text_chat and use_direct_messages, whether or not permissionKeys names them: without them the realtime servers refuse the tier’s text chat and direct messages. Pass false to grant exactly permissionKeys, for example a tier without text chat.
+  """
+  applyCommunicationDefaults: Boolean
 }
 
 """
@@ -10816,6 +10925,10 @@ input UpdateAccessTierInput {
   Replacement set of runtime permission keys for the tier (must be valid runtimePermissions). When provided, replaces the existing set entirely.
   """
   permissionKeys: [String!]
+  """
+  With permissionKeys: when true (the default) and the new set grants access, it also grants use_text_chat and use_direct_messages, whether or not permissionKeys names them. Pass false to set exactly permissionKeys, for example to take text chat away. Ignored without permissionKeys.
+  """
+  applyCommunicationDefaults: Boolean
 }
 
 """
@@ -11098,6 +11211,10 @@ input UpdateAppInput {
   """
   replayLoggingEnabled: Boolean
   """
+  With replay logging on, record the app's voice (sendAudioPacket), webcam video (sendVideoPacket) and channel audio (sendChannelAudio) too (true, the default) or leave them out of the input log (false); every other message is recorded either way. Takes effect within about 15 seconds; what was already recorded stays until it ages out. Omit to leave unchanged.
+  """
+  replayLoggingRecordsMedia: Boolean
+  """
   Grid permission keys a player's claim grants its owner on the claimed grid (at most 8; active grid keys; never a player-code key). An empty list grants none. Applies to claims made from now on. Omit to leave unchanged.
   """
   claimOwnerKeys: [String!]
@@ -11284,6 +11401,20 @@ input ExchangeManagedPlayerAssertionInput {
   assertion: String!
 }
 
+"""
+A legal hold to set: exactly one of orgId (an organization and its managed players) and userId (one account), and why.
+"""
+input SetLegalHoldInput {
+  """The organization to hold (its public id). Covers its managed players."""
+  orgId: BigInt
+  """The account to hold."""
+  userId: BigInt
+  """
+  Why the hold is set (the matter it preserves for), at most 500 characters.
+  """
+  reason: String!
+}
+
 """Claim (or re-assert) the hosting slug for an app."""
 input ClaimGameHostingInput {
   """The app to host. Requires manage_apps on it."""

{crowdypy-0.17.0.dev1 → crowdypy-0.18.0.dev1}/src/crowdypy/_generated/enums.py

@@ -1,6 +1,6 @@
 """GENERATED by scripts/codegen.py from schema.gql. Do not edit.
 
-schema.gql sha256: 261902653e100cc5701c32580d07b5ae401e28fa547a0712fa71429fb24df188
+schema.gql sha256: aa15686351b9ce9a99a1127678a86e4c2c7e92b0d06b55655c99a1407b1a681d
 """
 
 from enum import StrEnum

{crowdypy-0.17.0.dev1 → crowdypy-0.18.0.dev1}/src/crowdypy/_generated/inputs.py

@@ -4,7 +4,7 @@ Every GraphQL input object as a msgspec Struct. Attributes are snake_case and en
 under their GraphQL names; an attribute left at UNSET is omitted from the request,
 which is how the API tells 'not provided' from an explicit null.
 
-schema.gql sha256: 261902653e100cc5701c32580d07b5ae401e28fa547a0712fa71429fb24df188
+schema.gql sha256: aa15686351b9ce9a99a1127678a86e4c2c7e92b0d06b55655c99a1407b1a681d
 """
 
 from __future__ import annotations
@@ -191,7 +191,7 @@ class CompleteLoginLinkInput(msgspec.Struct, kw_only=True, omit_defaults=True):
     token: str
 
 
-class CreateAccessTierInput(msgspec.Struct, kw_only=True, omit_defaults=True, rename={'app_id': 'appId', 'tier_order': 'tierOrder', 'is_free': 'isFree', 'is_default': 'isDefault', 'permission_keys': 'permissionKeys'}):
+class CreateAccessTierInput(msgspec.Struct, kw_only=True, omit_defaults=True, rename={'app_id': 'appId', 'tier_order': 'tierOrder', 'is_free': 'isFree', 'is_default': 'isDefault', 'permission_keys': 'permissionKeys', 'apply_communication_defaults': 'applyCommunicationDefaults'}):
     'Input for creating a new app access tier.'
     app_id: str
     name: str
@@ -200,6 +200,7 @@ class CreateAccessTierInput(msgspec.Struct, kw_only=True, omit_defaults=True, re
     is_default: bool | None | UnsetType = UNSET
     description: str | None | UnsetType = UNSET
     permission_keys: list[str] | None | UnsetType = UNSET
+    apply_communication_defaults: bool | None | UnsetType = UNSET
 
 
 class CreateActorInput(msgspec.Struct, kw_only=True, omit_defaults=True, rename={'app_id': 'appId', 'avatar_id': 'avatarId', 'private_state': 'privateState', 'public_state': 'publicState'}):
@@ -970,6 +971,13 @@ class SetHostedGameListingInput(msgspec.Struct, kw_only=True, omit_defaults=True
     listed: bool
 
 
+class SetLegalHoldInput(msgspec.Struct, kw_only=True, omit_defaults=True, rename={'org_id': 'orgId', 'user_id': 'userId'}):
+    'A legal hold to set: exactly one of orgId (an organization and its managed players) and userId (one account), and why.'
+    org_id: str | None | UnsetType = UNSET
+    user_id: str | None | UnsetType = UNSET
+    reason: str
+
+
 class SetMemberRolesInput(msgspec.Struct, kw_only=True, omit_defaults=True, rename={'group_id': 'groupId', 'user_id': 'userId', 'role_ids': 'roleIds'}):
     "Replace a member's roles in a group (the listed roles become their full set)."
     group_id: str
@@ -1066,7 +1074,7 @@ class TransferPlayerCodeListingInput(msgspec.Struct, kw_only=True, omit_defaults
     to_owner_ref: str
 
 
-class UpdateAccessTierInput(msgspec.Struct, kw_only=True, omit_defaults=True, rename={'tier_order': 'tierOrder', 'is_free': 'isFree', 'is_default': 'isDefault', 'price_cents': 'priceCents', 'billing_period': 'billingPeriod', 'stripe_price_id': 'stripePriceId', 'paypal_plan_id': 'paypalPlanId', 'permission_keys': 'permissionKeys'}):
+class UpdateAccessTierInput(msgspec.Struct, kw_only=True, omit_defaults=True, rename={'tier_order': 'tierOrder', 'is_free': 'isFree', 'is_default': 'isDefault', 'price_cents': 'priceCents', 'billing_period': 'billingPeriod', 'stripe_price_id': 'stripePriceId', 'paypal_plan_id': 'paypalPlanId', 'permission_keys': 'permissionKeys', 'apply_communication_defaults': 'applyCommunicationDefaults'}):
     'Fields to update on an access tier. All fields are optional; omitted fields are left unchanged.'
     name: str | None | UnsetType = UNSET
     tier_order: int | None | UnsetType = UNSET
@@ -1079,6 +1087,7 @@ class UpdateAccessTierInput(msgspec.Struct, kw_only=True, omit_defaults=True, re
     stripe_price_id: str | None | UnsetType = UNSET
     paypal_plan_id: str | None | UnsetType = UNSET
     permission_keys: list[str] | None | UnsetType = UNSET
+    apply_communication_defaults: bool | None | UnsetType = UNSET
 
 
 class UpdateActorInput(msgspec.Struct, kw_only=True, omit_defaults=True, rename={'app_id': 'appId', 'avatar_id': 'avatarId', 'private_state': 'privateState', 'public_state': 'publicState'}):
@@ -1094,7 +1103,7 @@ class UpdateActorStateInput(msgspec.Struct, kw_only=True, omit_defaults=True, re
     public_state: str | None | UnsetType = UNSET
 
 
-class UpdateAppInput(msgspec.Struct, kw_only=True, omit_defaults=True, rename={'wilderness_writes_open': 'wildernessWritesOpen', 'replay_logging_enabled': 'replayLoggingEnabled', 'claim_owner_keys': 'claimOwnerKeys'}):
+class UpdateAppInput(msgspec.Struct, kw_only=True, omit_defaults=True, rename={'wilderness_writes_open': 'wildernessWritesOpen', 'replay_logging_enabled': 'replayLoggingEnabled', 'replay_logging_records_media': 'replayLoggingRecordsMedia', 'claim_owner_keys': 'claimOwnerKeys'}):
     'Input payload for updating an app. All fields are optional; only fields that are provided are changed.'
     name: str | None | UnsetType = UNSET
     description: str | None | UnsetType = UNSET
@@ -1103,6 +1112,7 @@ class UpdateAppInput(msgspec.Struct, kw_only=True, omit_defaults=True, rename={'
     metadata: str | None | UnsetType = UNSET
     wilderness_writes_open: bool | None | UnsetType = UNSET
     replay_logging_enabled: bool | None | UnsetType = UNSET
+    replay_logging_records_media: bool | None | UnsetType = UNSET
     claim_owner_keys: list[str] | None | UnsetType = UNSET
 
 
@@ -1342,6 +1352,7 @@ __all__ = [
     'SetGridPermissionLimitsInput',
     'SetHostedGameEnabledInput',
     'SetHostedGameListingInput',
+    'SetLegalHoldInput',
     'SetMemberRolesInput',
     'SetOrgManagedPlayerSettingsInput',
     'SetQuotaInput',

{crowdypy-0.17.0.dev1 → crowdypy-0.18.0.dev1}/src/crowdypy/_generated/operations.py

@@ -1,6 +1,6 @@
 """GENERATED by scripts/codegen.py from schema.gql and operations/. Do not edit.
 
-schema.gql sha256: 261902653e100cc5701c32580d07b5ae401e28fa547a0712fa71429fb24df188
+schema.gql sha256: aa15686351b9ce9a99a1127678a86e4c2c7e92b0d06b55655c99a1407b1a681d
 operations/ sha256: 32e2c43ac1bd00ec9c05902d524e82727cf560a88330f207704059a7a8a96189
 """
 

{crowdypy-0.17.0.dev1 → crowdypy-0.18.0.dev1}/src/crowdypy/_sync/domains/app_access.py

@@ -130,7 +130,10 @@ class AppAccessAPI(Domain):
         """Create an access tier for an app. Needs ``manage_access_tiers``.
 
         Its permission keys must be :meth:`runtime_permissions`. Creating a tier grants it
-        to nobody.
+        to nobody. A tier that grants ``access`` also gets ``use_text_chat`` and
+        ``use_direct_messages`` unless ``applyCommunicationDefaults`` is false (Game API
+        v2.55.0); without them the realtime servers refuse its players' text and direct
+        messages.
         """
         result: dict[str, Any] = self._request(ops.CREATE_ACCESS_TIER, {"input": input})
         return result
@@ -140,7 +143,9 @@ class AppAccessAPI(Domain):
     ) -> dict[str, Any]:
         """Change an access tier; fields left out stay as they are.
 
-        Needs ``manage_access_tiers``.
+        Needs ``manage_access_tiers``. ``permissionKeys`` that include ``access`` keep or gain
+        ``use_text_chat`` and ``use_direct_messages`` unless ``applyCommunicationDefaults`` is
+        false; send false to take them away.
         """
         result: dict[str, Any] = self._request(
             ops.UPDATE_ACCESS_TIER, {"tierId": bigint(tier_id), "input": input}

{crowdypy-0.17.0.dev1 → crowdypy-0.18.0.dev1}/src/crowdypy/_sync/domains/apps.py

@@ -246,6 +246,8 @@ class AppsAPI(Domain):
         ``replayLoggingEnabled`` true raises ``INPUT_LOG_FUNDS_NEEDED`` unless the org wallet
         can spend the projected cost of keeping one retention period of the app's recent
         traffic; ``extensions["requiredMicrousd"]`` and ``["spendableMicrousd"]`` say how much.
+        ``replayLoggingRecordsMedia`` false leaves voice and video out of the app's recording
+        and keeps everything else (default true; Game API v2.55.0).
         """
         result: dict[str, Any] = self._request(
             ops.UPDATE_APP, {"appId": bigint(app_id), "input": input}

{crowdypy-0.17.0.dev1 → crowdypy-0.18.0.dev1}/src/crowdypy/_sync/domains/managed_players.py

@@ -113,7 +113,10 @@ class ManagedPlayersAPI(Domain):
 
     def delete(self, org_id: str | int, external_id: str) -> bool:
         """Delete a player: its sessions end and its account is scrubbed. The external id is
-        free again, so a later sign-in with it creates a new player."""
+        free again, so a later sign-in with it creates a new player. Since Game API v2.54.0
+        its player-side content is erased within minutes (usage and billing records and world
+        edits stay), and a legal hold on the player or its organization refuses the delete
+        with ``LEGAL_HOLD``; the player stays as it was."""
         return bool(
             self._request(
                 ops.DELETE_MANAGED_PLAYER, {"orgId": bigint(org_id), "externalId": external_id}