crowdypy 0.4.0.dev1__tar.gz → 0.5.0.dev1__tar.gz

{crowdypy-0.4.0.dev1 → crowdypy-0.5.0.dev1}/AGENTS.md

@@ -122,8 +122,12 @@ names, a tag that is not the tree's version, and a default origin for another ti
 builds every wheel and the sdist, scans them, publishes `X.Y.Z.devN` (dev), `X.Y.ZrcN` (test)
 or `X.Y.Z` (prod) to PyPI by trusted publishing, downloads the published wheel back to read
 its origin again, and creates the GitHub release with the same files. PyPI publishing runs
-only when the repository variable `PYPI_PUBLISHING` is `enabled`, which the operator sets
-once the PyPI trusted publisher (workflow `release.yml`, environment `pypi`) is registered.
+only when the repository variable `PYPI_PUBLISHING` is `enabled` (it is, since 2026-10-01),
+through the trusted publisher on PyPI project `crowdypy` (owner CrowdedKingdoms, repository
+CrowdyPy, workflow `release.yml`, environment `pypi`). The first version there,
+`0.4.0.dev1`, was uploaded by hand from the `dev/v0.4.0` release's assets before the
+publisher existed; every later one comes from its tag. PyPI accepts a version once, so a
+re-run takes the next N (`scripts/ci/resolve_pypi_version.py` reads what PyPI already has).
 
 Merging a PR from the command line: `gh pr merge` fails its preflight on this org, so use
 `gh api -X PUT repos/CrowdedKingdoms/CrowdyPy/pulls/<n>/merge -f merge_method=merge`.

{crowdypy-0.4.0.dev1 → crowdypy-0.5.0.dev1}/MIGRATION.md

@@ -3,6 +3,43 @@
 CrowdyPy is pre-1.0. Within a minor line, patch releases keep source compatibility; each
 new minor may change the API. Read the section for every minor you skip.
 
+## 0.5.0
+
+CrowdyJS 18.1.0 and CrowdyCPP 0.55.0. Additive, plus one refusal that is a security fix.
+
+- **The ck-exec connect token goes only to a gateway on the estate.** `client.exec.connect`
+  and `connect_as_developer` dial a gateway only when `exec_gateway_refusal` (in
+  `crowdypy.domains.exec`) passes it. That means `ws` or `wss` without credentials (only
+  `wss` under an `https` game API), on the estate of the game API or of this release's default
+  origin (two IP addresses only when equal), or a loopback gateway for a loopback game API.
+  Any other gateway the game API names is refused before the token leaves the process, with
+  `CrowdyExecError("Unavailable", "refusing the gateway …")`. `AsyncExecConnection.open` and
+  `ExecConnection.open` still dial what they are given. The rule answers the 19 cases CrowdyJS
+  and CrowdyCPP check (`exec-gateway-cases.json`).
+- **A refused upgrade carries the gateway's answer.** HTTP `401` (a token it will not take) is
+  `Denied` and anything else `Unavailable`, each with the gateway's reason, as in "the
+  gateway refused the connection (HTTP 401: bad signature)". Both used to be `Unavailable`
+  "connecting … failed".
+- **Open grids:** `GameAppsAPI.open_permissions(app_id, grid_id)` and
+  `set_open_permissions(input)` (`manage_apps`) cover the keys a grid grants every player with
+  access to the app. An empty list closes it.
+- CrowdyCPP 0.55.0 also builds on Windows when `<windows.h>` comes first (its `far` and
+  `near` macros broke a session header).
+- New live suite `tests/e2e/test_e2e_open_grid_exec_gateway.py`, which runs as a throwaway
+  org admin with `CROWDY_E2E_THROWAWAY_OWNER=1`.
+
+## 0.4.1
+
+Documentation only; nothing the package does changed. Still CrowdyJS 18.0.4 and CrowdyCPP
+0.54.0.
+
+- The README, which PyPI shows, carries the current tier pins and an example of installing a
+  wheel straight from a GitHub release.
+- The roots CrowdyPy wraps beyond CrowdyJS are described precisely: CrowdyJS's portable API
+  sends none of them, CrowdyCPP covers them, and CrowdyJS's in-browser agent does send the
+  two provider-consent roots and the model-usage root.
+- 0.4.1 is the first version PyPI receives from the release workflow, by trusted publishing.
+
 ## 0.4.0
 
 Headless Crowdy Studio and full CrowdyJS parity. Additive; still CrowdyJS 18.0.4 and
@@ -25,7 +62,7 @@ CrowdyCPP 0.54.0.
     `parse_client_tick_interval_ms` port their CrowdyJS namesakes.
   - `canonical_json`, `digest_canonical_json` and `project_content_hash` compute the
     approval digests CrowdyJS computes.
-- **The roots CrowdyCPP sends and CrowdyJS does not:**
+- **The roots CrowdyCPP covers and CrowdyJS's portable API leaves out:**
   - `AuthAPI.confirm_email` and `resend_confirmation_email`;
   - `UsageAPI.org_summary`, `app_projection` and `org_projection`;
   - `AppsAPI.compute_budget`, `set_compute_budget` and `clear_compute_budget`;

{crowdypy-0.4.0.dev1 → crowdypy-0.5.0.dev1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: crowdypy
-Version: 0.4.0.dev1
+Version: 0.5.0.dev1
 Summary: Official Python SDK for Crowded Kingdoms: typed GraphQL clients and a native UDP replication core
 Keywords: crowded-kingdoms,multiplayer,replication,graphql,sdk,udp
 Author: Crowded Kingdoms
@@ -51,19 +51,16 @@ CrowdyPy follows the [CrowdyJS](https://github.com/CrowdedKingdoms/CrowdyJS) API
 client, bound with [nanobind](https://github.com/wjakob/nanobind) and shipped inside the
 wheel. Python never touches a datagram.
 
-**v0.4.0: headless Crowdy Studio, and full parity with CrowdyJS.**
-- `crowdypy.studio.CrowdyStudioController` is the Studio editor without a browser: open
-  projects, edit with autosave and revision conflicts, bind GitHub, apply agent patches with
-  checkpoints, and build, deploy and run mods. `StudioLayoutController` and
-  `parse_rustc_diagnostics` match CrowdyJS byte for byte.
-- The roots CrowdyCPP sends and CrowdyJS does not are wrapped too: email confirmation, usage
-  projections, compute budgets, listing versions, the narrow Studio mutations, and
-  `client.crowdy_studio_agent`.
-- `crowdypy.player_host` is the typed observation contract a game implements so tooling can
-  read the player it controls, validated exactly as CrowdyJS validates it.
-- The parity gate is strict: [`docs/parity-matrix.md`](docs/parity-matrix.md) has no gaps.
-- 0.3.0 brought the World Stores, the Game Kit, ck-exec and subscriptions; 0.2.0 native UDP
-  replication (`client.udp`); 0.1.0 the GraphQL client.
+**v0.5.0: open grids, and the ck-exec gateway check (CrowdyJS 18.1.0, CrowdyCPP 0.55.0).**
+- `client.exec.connect()` sends the connect token only to a gateway on the game API's estate
+  (or the release's default origin's); any other gateway is refused before it is dialed. A
+  gateway that refuses the token is reported as `Denied`, with its reason.
+- `game_apps.open_permissions()` and `set_open_permissions()`: grids open to every player.
+- 0.4 brought the headless Crowdy Studio (`crowdypy.studio`), player-host observation
+  (`crowdypy.player_host`), the roots CrowdyCPP covers beyond CrowdyJS, and the strict parity
+  gate ([`docs/parity-matrix.md`](docs/parity-matrix.md) has no gaps); 0.3.0 the World Stores,
+  the Game Kit, ck-exec and subscriptions; 0.2.0 native UDP replication (`client.udp`); 0.1.0
+  the GraphQL client.
 
 See [MIGRATION.md](MIGRATION.md).
 
@@ -83,12 +80,14 @@ API origin (`crowdypy.CROWDY_DEFAULT_TIER` says which):
 
 | Tier | PyPI version | Pin |
 |---|---|---|
-| dev | `X.Y.Z.devN` | `crowdypy==0.1.0.dev1` |
-| test | `X.Y.ZrcN` | `crowdypy==0.1.0rc1` |
-| prod | `X.Y.Z` | `crowdypy==0.1.0` |
+| dev | `X.Y.Z.devN` | `crowdypy==0.4.0.dev1` |
+| test | `X.Y.ZrcN` | `crowdypy==0.4.0rc1` |
+| prod | `X.Y.Z` | `crowdypy==0.4.0` |
 
 pip skips pre-releases unless a requirement names one, so a prod range never picks up a dev
-or test build. The same wheels are attached to each GitHub release.
+or test build. The same wheels and the sdist are attached to each
+[GitHub release](https://github.com/CrowdedKingdoms/CrowdyPy/releases), and pip installs one
+from its URL (`pip install https://github.com/CrowdedKingdoms/CrowdyPy/releases/download/<tag>/<wheel>`).
 
 ## Quick start
 

{crowdypy-0.4.0.dev1 → crowdypy-0.5.0.dev1}/README.md

@@ -11,19 +11,16 @@ CrowdyPy follows the [CrowdyJS](https://github.com/CrowdedKingdoms/CrowdyJS) API
 client, bound with [nanobind](https://github.com/wjakob/nanobind) and shipped inside the
 wheel. Python never touches a datagram.
 
-**v0.4.0: headless Crowdy Studio, and full parity with CrowdyJS.**
-- `crowdypy.studio.CrowdyStudioController` is the Studio editor without a browser: open
-  projects, edit with autosave and revision conflicts, bind GitHub, apply agent patches with
-  checkpoints, and build, deploy and run mods. `StudioLayoutController` and
-  `parse_rustc_diagnostics` match CrowdyJS byte for byte.
-- The roots CrowdyCPP sends and CrowdyJS does not are wrapped too: email confirmation, usage
-  projections, compute budgets, listing versions, the narrow Studio mutations, and
-  `client.crowdy_studio_agent`.
-- `crowdypy.player_host` is the typed observation contract a game implements so tooling can
-  read the player it controls, validated exactly as CrowdyJS validates it.
-- The parity gate is strict: [`docs/parity-matrix.md`](docs/parity-matrix.md) has no gaps.
-- 0.3.0 brought the World Stores, the Game Kit, ck-exec and subscriptions; 0.2.0 native UDP
-  replication (`client.udp`); 0.1.0 the GraphQL client.
+**v0.5.0: open grids, and the ck-exec gateway check (CrowdyJS 18.1.0, CrowdyCPP 0.55.0).**
+- `client.exec.connect()` sends the connect token only to a gateway on the game API's estate
+  (or the release's default origin's); any other gateway is refused before it is dialed. A
+  gateway that refuses the token is reported as `Denied`, with its reason.
+- `game_apps.open_permissions()` and `set_open_permissions()`: grids open to every player.
+- 0.4 brought the headless Crowdy Studio (`crowdypy.studio`), player-host observation
+  (`crowdypy.player_host`), the roots CrowdyCPP covers beyond CrowdyJS, and the strict parity
+  gate ([`docs/parity-matrix.md`](docs/parity-matrix.md) has no gaps); 0.3.0 the World Stores,
+  the Game Kit, ck-exec and subscriptions; 0.2.0 native UDP replication (`client.udp`); 0.1.0
+  the GraphQL client.
 
 See [MIGRATION.md](MIGRATION.md).
 
@@ -43,12 +40,14 @@ API origin (`crowdypy.CROWDY_DEFAULT_TIER` says which):
 
 | Tier | PyPI version | Pin |
 |---|---|---|
-| dev | `X.Y.Z.devN` | `crowdypy==0.1.0.dev1` |
-| test | `X.Y.ZrcN` | `crowdypy==0.1.0rc1` |
-| prod | `X.Y.Z` | `crowdypy==0.1.0` |
+| dev | `X.Y.Z.devN` | `crowdypy==0.4.0.dev1` |
+| test | `X.Y.ZrcN` | `crowdypy==0.4.0rc1` |
+| prod | `X.Y.Z` | `crowdypy==0.4.0` |
 
 pip skips pre-releases unless a requirement names one, so a prod range never picks up a dev
-or test build. The same wheels are attached to each GitHub release.
+or test build. The same wheels and the sdist are attached to each
+[GitHub release](https://github.com/CrowdedKingdoms/CrowdyPy/releases), and pip installs one
+from its URL (`pip install https://github.com/CrowdedKingdoms/CrowdyPy/releases/download/<tag>/<wheel>`).
 
 ## Quick start
 

{crowdypy-0.4.0.dev1 → crowdypy-0.5.0.dev1}/docs/compatibility.md

@@ -5,7 +5,7 @@ are in `pyproject.toml` (`[project].version`, `[tool.crowdypy.crowdyjs]`,
 `[tool.crowdypy.crowdycpp]`); `tests/unit/test_release_versions.py` refuses this page when
 its version disagrees.
 
-- CrowdyPy `0.4.0`
+- CrowdyPy `0.5.0`
 - API surface: CrowdyJS (the pinned version and commit in `pyproject.toml`); the generated
   `docs/parity-matrix.md` lists every covered method, every native equivalent and every
   browser exclusion with its reason. The gate is strict: there are no portable gaps, and a

{crowdypy-0.4.0.dev1 → crowdypy-0.5.0.dev1}/docs/e2e-coverage.md

@@ -17,6 +17,7 @@ Unconfigured, every suite skips, so `pytest` in CI records skips, not live passe
 | `CROWDY_E2E_HTTP_URL` | no | the game API origin, when not the minted `game_api_url` |
 | `CROWDY_E2E_STUDIO_GRID_ID` | no | a grid in the app that the owner controls (Studio suite) |
 | `CROWDY_E2E_SLOW=1` | no | long-running suites |
+| `CROWDY_E2E_THROWAWAY_OWNER=1` | no | the open-grid suite registers a throwaway owner, org and app (archived afterwards) |
 
 ```bash
 pytest tests/e2e -q
@@ -39,6 +40,7 @@ player once and signs it in for the later suites.
 | `test_e2e_replication.py` | two players over native UDP: an actor update reaches the other player and echoes back to the sender; a 16-entity batched frame (`send_actor_updates`) reaches the other player; voxel updates and client events reach the other player | `e2e_two_client_actor`, `e2e_self_echo`, `e2e_spatial_distance` |
 | `test_e2e_world.py` | two World Stores sessions: each sees the other's actor natively; a voxel edit lands in the other session's chunk store | `e2e_stores_live`, `e2e_world_session` |
 | `test_e2e_world_data.py` | a GraphQL voxel write by an entitled player is recorded and listed back | `e2e_chunks` |
+| `test_e2e_open_grid_exec_gateway.py` | as a throwaway org admin (`CROWDY_E2E_THROWAWAY_OWNER=1`): open a nested grid, read it back, a player holds its keys, a player-code key is refused `BAD_REQUEST`, close it; the tier's ck-exec gateway passes `exec_gateway_refusal`, a connection pings, and a tampered connect token is `Denied` with the gateway's HTTP 401 reason | `e2e_open_grid_exec_gateway` |
 | `test_e2e_studio.py` | the headless Studio controller creates a project from the mod starter, edits it with autosave, and archives it (optional: needs `CROWDY_E2E_STUDIO_GRID_ID`) | `e2e_crowdy_studio` |
 
 ## Live runs
@@ -47,6 +49,8 @@ player once and signs it in for the later suites.
 |---|---|---|---|
 | 2026-10-01 | local stack: ck-api at `dev` (`78386df3`), two replication servers, the 3-node Citus lab | 0.4.0 (branch) | 8 passed; Studio skipped (no grid in the app) |
 | 2026-10-01 | dev tier, app `96701660793088` (CrowdyPy e2e, in the org admin's org) | 0.4.0 (branch) | 8 passed; Studio skipped (the suite needs a grid the owner controls in that app; a placeholder is refused with `CROWDY_STUDIO_GRID_NOT_FOUND`) |
+| 2026-10-01 | dev tier, app `96701660793088` | the published `dev/v0.4.0` wheel (`0.4.0.dev1`, manylinux x86_64, installed into a clean Python 3.12) | 8 passed |
+| 2026-10-01 | dev tier, app `96701660793088` | `crowdypy 0.4.1.dev1` from PyPI (`pip install crowdypy` in a clean Python 3.12; the first version published by trusted publishing) | 8 passed; Studio skipped |
 
 ## Not covered here
 

{crowdypy-0.4.0.dev1 → crowdypy-0.5.0.dev1}/docs/parity-matrix.md

@@ -4,14 +4,14 @@ Generated by `tools/parity/parity.py`; do not edit by hand. Classifications live
 
 ## Target
 
-- CrowdyJS: `18.0.4` at `c8634082689dbc9c11d720eaf4e05e828ad775d9`
-- CrowdyCPP (native core): `0.54.0` at `82803bce9824a7dc220c1e166a2308603d46d91d`
+- CrowdyJS: `18.1.0` at `806b14130786d5b739d6124c0c4c275f8997af15`
+- CrowdyCPP (native core): `0.55.0` at `344772ad0c2d577003c92fa30903d7fcada29940`
 - schema.gql identical to CrowdyJS's: yes
 - Gate mode: strict portable parity (every portable gap is release-blocking)
 
 ## Summary
 
-- Covered: 1007
+- Covered: 1012
 - Portable gap: 0
 - Native equivalent: 38
 - Browser exclusion: 95
@@ -183,6 +183,7 @@ Generated by `tools/parity/parity.py`; do not edit by hand. Classifications live
 | `mutation.setChannelPolicy` | covered |
 | `mutation.setCrowdyStudioAgentPolicy` | covered |
 | `mutation.setEarlyAccessOverride` | browser exclusion — super-admin or operator only; the SDK wraps nothing for platform roles (tooling calls it directly) |
+| `mutation.setGridOpenPermissions` | covered |
 | `mutation.setGridPermissionLimits` | covered |
 | `mutation.setHostedGameEnabled` | browser exclusion — publishes and administers browser game bundles on the Crowdy Games web host; a Python client has no bundle to publish |
 | `mutation.setHostedGameListing` | browser exclusion — publishes and administers browser game bundles on the Crowdy Games web host; a Python client has no bundle to publish |
@@ -332,6 +333,7 @@ Generated by `tools/parity/parity.py`; do not edit by hand. Classifications live
 | `query.gridClaimPolicy` | covered |
 | `query.gridClaimRequests` | covered |
 | `query.gridGroupGrants` | covered |
+| `query.gridOpenPermissions` | covered |
 | `query.gridOwnership` | covered |
 | `query.gridPermissionLimits` | covered |
 | `query.gridUserPermissions` | covered |
@@ -771,10 +773,12 @@ Generated by `tools/parity/parity.py`; do not edit by hand. Classifications live
 | `GameAppsAPI.groupGrants` | covered |
 | `GameAppsAPI.nearbyGrids` | covered |
 | `GameAppsAPI.nearbyPermissions` | covered |
+| `GameAppsAPI.openPermissions` | covered |
 | `GameAppsAPI.ownership` | covered |
 | `GameAppsAPI.permissionLimits` | covered |
 | `GameAppsAPI.revokeGroup` | covered |
 | `GameAppsAPI.revokePermissions` | covered |
+| `GameAppsAPI.setOpenPermissions` | covered |
 | `GameAppsAPI.setPermissionLimits` | covered |
 | `GameAppsAPI.transferOwnership` | covered |
 | `GameAppsAPI.userPermissions` | covered |
@@ -1126,6 +1130,7 @@ Generated by `tools/parity/parity.py`; do not edit by hand. Classifications live
 | `encodeExecFrame` | covered |
 | `engineLanes` | covered |
 | `enginePoseCodec` | covered |
+| `execGatewayRefusal` | covered |
 | `execModType` | covered |
 | `execStatus` | covered |
 | `fragmentFrame` | covered |

{crowdypy-0.4.0.dev1 → crowdypy-0.5.0.dev1}/operations/gameApps/GameApps.graphql

@@ -81,6 +81,14 @@ query GridPermissionLimits($appId: BigInt!, $gridId: BigInt!) {
   }
 }
 
+query GridOpenPermissions($appId: BigInt!, $gridId: BigInt!) {
+  gridOpenPermissions(appId: $appId, gridId: $gridId) {
+    appId
+    gridId
+    permissionKeys
+  }
+}
+
 query GridGroupGrants($appId: BigInt!, $gridId: BigInt!, $groupId: BigInt!) {
   gridGroupGrants(appId: $appId, gridId: $gridId, groupId: $groupId) {
     appId
@@ -145,6 +153,14 @@ mutation SetGridPermissionLimits($input: SetGridPermissionLimitsInput!) {
   }
 }
 
+mutation SetGridOpenPermissions($input: SetGridOpenPermissionsInput!) {
+  setGridOpenPermissions(input: $input) {
+    appId
+    gridId
+    permissionKeys
+  }
+}
+
 mutation AssignGroupToGrid($input: AssignGroupToGridInput!) {
   assignGroupToGrid(input: $input) {
     appId

{crowdypy-0.4.0.dev1 → crowdypy-0.5.0.dev1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "scikit_build_core.build"
 
 [project]
 name = "crowdypy"
-version = "0.4.0.dev1"
+version = "0.5.0.dev1"
 description = "Official Python SDK for Crowded Kingdoms: typed GraphQL clients and a native UDP replication core"
 readme = "README.md"
 license = "MIT AND Apache-2.0"
@@ -117,20 +117,20 @@ environment = { OPENSSL_ROOT_DIR = "C:/vcpkg/installed/x64-windows-static-md" }
 # --------------------------------------------------------------------------------------
 
 [tool.crowdypy.crowdyjs]
-version = "18.0.4"
-commit = "c8634082689dbc9c11d720eaf4e05e828ad775d9"
+version = "18.1.0"
+commit = "806b14130786d5b739d6124c0c4c275f8997af15"
 
 [tool.crowdypy.crowdycpp]
-version = "0.54.0"
-tag = "dev/v0.54.0"
-commit = "82803bce9824a7dc220c1e166a2308603d46d91d"
-tree-sha256 = "94221e93ee685ee09275a65148d07416c93c19bf685f45a2ec3b74ce4517d01c"
+version = "0.55.0"
+tag = "dev/v0.55.0"
+commit = "344772ad0c2d577003c92fa30903d7fcada29940"
+tree-sha256 = "a930e844afa86b9804a8bd8d7d5a93a830f8ef720aa798f31b6dd89d35eaa3ee"
 
 # schema.gql and operations/ are CrowdyJS's, copied from the commit pinned above by
 # scripts/schema_sync.py, which records these hashes and re-derives them in CI.
 [tool.crowdypy.graphql]
-schema-sha256 = "5dcaf15c772c89fe250ecdbd83eb21b52b67f27d739fca38c2871b5553751ab0"
-operations-sha256 = "4b0990648ef236dd7901e1cc3413ee4034a0505051adb36d788568993ec31d6b"
+schema-sha256 = "38c490a70f0bd92977fef5867e0b9e14a10d9467a2008dcd2c02bbc96878d8d3"
+operations-sha256 = "d5e0c505589ea26ecc3398b12f02ad7bd786457f7010ad87dcb8af2ea9366c77"
 
 # The SDL the docs site publishes. scripts/schema_drift.py compares the snapshot against it
 # on a schedule; nothing on the per-commit path reads the network.

{crowdypy-0.4.0.dev1 → crowdypy-0.5.0.dev1}/schema.gql

@@ -1265,7 +1265,7 @@ type App {
   """
   gridClaimApproverUserIds: [String!]!
   """
-  Whether players may write the app's wilderness: chunks that no grid but the app's world grid covers. True (the default) leaves those writes to the ordinary voxel permission; false refuses every voxel and chunk write there (updateVoxel, sendVoxelUpdate, updateChunk, ck-exec's world.set_voxels), whoever makes it. Set with updateApp (manage_apps).
+  Whether players may write the app's wilderness: chunks that no grid but the app's world grid covers. True (the default) leaves those writes to the ordinary voxel permission; false refuses every voxel and chunk write there (updateVoxel, sendVoxelUpdate, updateChunk, ck-exec's world.set_voxels, and a client's voxel updates sent straight to the realtime servers), whoever makes it. Set with updateApp (manage_apps).
   """
   wildernessWritesOpen: Boolean!
   """Timestamp when the app was created."""
@@ -5251,6 +5251,20 @@ type GridPermissionLimits {
   permissionKeys: [String!]!
 }
 
+"""
+The permission keys a grid grants every player with active access to the app (the grid_open_permissions input table).
+"""
+type GridOpenPermissions {
+  """The app (tenant) that owns the grid."""
+  appId: BigInt!
+  """The grid."""
+  gridId: BigInt!
+  """
+  The keys every player with active access holds on this grid (its limits still cap them). Empty means the grid is not open.
+  """
+  permissionKeys: [String!]!
+}
+
 """
 A single group/role -> permission-key grant on a grid (one row of the grid_group_grants input table).
 """
@@ -7059,6 +7073,15 @@ type Query {
     gridId: BigInt!
   ): GridPermissionLimits! @requiresPermission(scope: "app", permission: "manage_apps", scopeArg: "appId")
   """
+  Read the permission keys a grid grants every player with active access to the app (an open build area, a public arena). An empty list means the grid is not open. Requires app-admin ('manage_apps').
+  """
+  gridOpenPermissions(
+    """The app (tenant) that owns the grid."""
+    appId: BigInt!
+    """The grid whose open keys to read."""
+    gridId: BigInt!
+  ): GridOpenPermissions! @requiresPermission(scope: "app", permission: "manage_apps", scopeArg: "appId")
+  """
   List the group/role -> permission-key grants configured on a grid for one group (rows of the `grid_group_grants` input table). These are inputs to the effective ACL, not the materialized result — use `gridUserPermissions` for a specific user's effective keys. Requires app-admin ('manage_apps').
   """
   gridGroupGrants(
@@ -8629,7 +8652,7 @@ type Mutation {
     appId: BigInt!
   ): GameHost
   """
-  Creates or replaces a chunk's dense voxel grid and/or per-voxel states for the given app and coordinates, records each provided voxel state as an individual voxel update, and asynchronously uploads the chunk to the CDN. WRITES world state. Leaves chunkState and LODs untouched. Requires an app token for the app and either the 'manage_apps' permission on the app (resolved via its org; super admins bypass) or the voxel edit permission for this chunk that updateVoxel checks (app access, the tier's update_voxel_data, and update_voxel_data on a grid covering the chunk). Throws FORBIDDEN otherwise, and for a chunk only the app's world grid covers while the app's wilderness is closed (App.wildernessWritesOpen false).
+  Creates or replaces a chunk's dense voxel grid and/or per-voxel states for the given app and coordinates, records each provided voxel state as an individual voxel update, and asynchronously uploads the chunk to the CDN. WRITES world state. Leaves chunkState and LODs untouched. Requires an app token for the app and either the 'manage_apps' permission on the app (resolved via its org; super admins bypass) or the voxel edit permission for this chunk that updateVoxel checks (app access, the tier's update_voxel_data, and update_voxel_data on the most specific grid covering the chunk). Throws FORBIDDEN otherwise, and for a chunk only the app's world grid covers while the app's wilderness is closed (App.wildernessWritesOpen false).
   """
   updateChunk(input: ChunkUpdateInput!): Chunk!
   """
@@ -8641,7 +8664,7 @@ type Mutation {
   """
   updateChunkLods(input: UpdateChunkLodsInput!): Chunk @requiresPermission(scope: "app", permission: "manage_apps", scopeArg: "input.appId")
   """
-  Records (upserts) a single voxel edit in the voxel_updates log for one chunk and returns the resulting Voxel. WRITES world state; a background maintenance job later folds these edits into the chunk's packed grid. Requires a valid bearer token AND voxel-edit permission for the target region: the user must have active app access, the `update_voxel_data` tier permission, and (when grids cover the chunk) `update_voxel_data` on a covering grid. A chunk only the app's world grid covers is refused while the app's wilderness is closed (App.wildernessWritesOpen false).
+  Records (upserts) a single voxel edit in the voxel_updates log for one chunk and returns the resulting Voxel. WRITES world state; a background maintenance job later folds these edits into the chunk's packed grid. Requires a valid bearer token AND voxel-edit permission for the target region: the user must have active app access, the `update_voxel_data` tier permission, and `update_voxel_data` on the most specific grid covering the chunk (the smallest by volume; of equal ones the lowest grid id), so a claim, a plot or a safe zone decides its chunks and the app's world grid decides only the wilderness. A chunk no grid covers is refused, and so is a chunk only the app's world grid covers while the app's wilderness is closed (App.wildernessWritesOpen false).
   """
   updateVoxel(input: UpdateVoxelInput!): Voxel! @requiresPermission(scope: "runtime", permission: "update_voxel_data", scopeArg: "input.appId")
   """
@@ -8706,6 +8729,15 @@ type Mutation {
     input: SetGridPermissionLimitsInput!
   ): GridPermissionLimits! @requiresPermission(scope: "app", permission: "manage_apps", scopeArg: "input.appId")
   """
+  Open a grid to every player: replace the permission keys it grants each player with active access to the app (writes the `grid_open_permissions` input table), then recompute the grid's materialized effective ACL for all of them. The most specific grid covering a chunk decides a voxel write there, so a zone inside the world grid that everyone may build in must grant `update_voxel_data` itself. The grid's limits still cap these keys; players who get access later receive them when they connect. Pass an empty array to close the grid. Refuses the app's world grid (already open), the four player-code keys, and a 33rd open grid in one app. Requires app-admin ('manage_apps').
+  """
+  setGridOpenPermissions(
+    """
+    The app, grid, and the keys it grants every player (empty array = close it).
+    """
+    input: SetGridOpenPermissionsInput!
+  ): GridOpenPermissions! @requiresPermission(scope: "app", permission: "manage_apps", scopeArg: "input.appId")
+  """
   Grant runtime permission keys to a group (optionally scoped to a single group role) on a grid by writing the `grid_group_grants` input table, then recompute the materialized effective ACL so every affected member gains the keys. Requires app-admin ('manage_apps'). Returns the grid's current group grants for the group. Use `grantGridPermissions` for per-user grants instead.
   """
   assignGroupToGrid(
@@ -8989,7 +9021,7 @@ type Mutation {
     gridId: BigInt!
   ): GridClaimResult!
   """
-  Claim one currently unclaimed chunk as a new player-owned grid. Requires an ordinary app-scoped player token and active app access, but never manage_apps. The app's policy must be SELF_CLAIM. The server validates the app's grid assignment and peer-overlap rules, then atomically creates a one-chunk grid, assigns current-user ownership, grants access/update_voxel_data/use_voice_chat/teleport plus the player-code keys and use_video_chat where the caller's tier already carries them, and materializes the effective ACL. Conflicts and policy denials throw GraphQL errors; no partial grid, ownership, or grant rows remain.
+  Claim one wilderness chunk (a chunk no grid but the app's world grid covers) as a new player-owned grid. Requires an ordinary app-scoped player token and active app access, but never manage_apps. The app's policy must be SELF_CLAIM. A chunk inside another grid (a plot, a zone or another claim) is refused FORBIDDEN (GRID_NOT_CLAIMABLE): the claim would be the most specific grid there and take the chunk from whoever that grid grants. The server validates the app's grid assignment and peer-overlap rules, then atomically creates a one-chunk grid, assigns current-user ownership, grants access/update_voxel_data/use_voice_chat/teleport plus the player-code keys and use_video_chat where the caller's tier already carries them, and materializes the effective ACL. Conflicts and policy denials throw GraphQL errors; no partial grid, ownership, or grant rows remain.
   """
   claimGridChunk(
     """
@@ -9404,7 +9436,7 @@ type Mutation {
     input: ActorUpdateRequestInput!
   ): Boolean!
   """
-  Send a single voxel (block) update for spatial replication to nearby chunks. Requires a bearer game token; opens a UDP proxy session automatically if none exists. Returns Boolean! that is true only when the datagram was ACCEPTED FOR SENDING to the game server — NOT confirmation that the world applied the change. There is NO separate per-request success response: the change fans out to nearby clients (the sender included) as a VoxelUpdateNotification carrying the same sequenceNumber (VoxelUpdateResponse is legacy and is never emitted). Failures arrive ASYNCHRONOUSLY as a GenericErrorResponse; both are correlated by the request sequenceNumber (correlation only — not an idempotency key; the server does not dedupe replays). Throws FORBIDDEN synchronously for a chunk only the app's world grid covers while the app's wilderness is closed (App.wildernessWritesOpen false).
+  Send a single voxel (block) update for spatial replication to nearby chunks. Requires a bearer game token; opens a UDP proxy session automatically if none exists. Returns Boolean! that is true only when the datagram was ACCEPTED FOR SENDING to the game server — NOT confirmation that the world applied the change. There is NO separate per-request success response: the change fans out to nearby clients (the sender included) as a VoxelUpdateNotification carrying the same sequenceNumber (VoxelUpdateResponse is legacy and is never emitted). Failures arrive ASYNCHRONOUSLY as a GenericErrorResponse; both are correlated by the request sequenceNumber (correlation only — not an idempotency key; the server does not dedupe replays). Throws FORBIDDEN synchronously, before anything is sent, without the voxel edit permission updateVoxel checks for the chunk (app access, the tier's update_voxel_data, and update_voxel_data on the most specific grid covering the chunk), and for a chunk only the app's world grid covers while the app's wilderness is closed (App.wildernessWritesOpen false).
   """
   sendVoxelUpdate(
     """
@@ -9921,7 +9953,7 @@ input UpdateAppInput {
   """
   metadata: String
   """
-  Open (true) or close (false) the app's wilderness to voxel and chunk writes: chunks that no grid but the app's world grid covers. Closing refuses every write there, whoever makes it; each game API replica acts on the change within 15 seconds. Omit to leave unchanged.
+  Open (true) or close (false) the app's wilderness to voxel and chunk writes: chunks that no grid but the app's world grid covers. Closing refuses every write there, whoever makes it; each game API replica, and each realtime server for a client's direct voxel updates, acts on the change within about 15 seconds. Omit to leave unchanged.
   """
   wildernessWritesOpen: Boolean
 }
@@ -10667,6 +10699,22 @@ input SetGridPermissionLimitsInput {
   permissionKeys: [String!]!
 }
 
+"""
+Set the permission keys a grid grants every player with active access to the app (writes the grid_open_permissions input table): an open build area, a public arena.
+"""
+input SetGridOpenPermissionsInput {
+  """The app (tenant) that owns the grid."""
+  appId: BigInt!
+  """
+  The grid to open (or close). Not the app's world grid, which is open by default.
+  """
+  gridId: BigInt!
+  """
+  The keys every player with active access holds on this grid, capped by its limits. Empty array closes it (players keep only what they are granted directly or through a group). Each must be an active grid permission key, unique, at most 64 chars, and not one of the four player-code keys.
+  """
+  permissionKeys: [String!]!
+}
+
 """
 Grant runtime permission keys to a group (optionally one role) on a grid (writes the grid_group_grants input table).
 """

{crowdypy-0.4.0.dev1 → crowdypy-0.5.0.dev1}/src/crowdypy/_generated/enums.py

@@ -1,6 +1,6 @@
 """GENERATED by scripts/codegen.py from schema.gql. Do not edit.
 
-schema.gql sha256: 5dcaf15c772c89fe250ecdbd83eb21b52b67f27d739fca38c2871b5553751ab0
+schema.gql sha256: 38c490a70f0bd92977fef5867e0b9e14a10d9467a2008dcd2c02bbc96878d8d3
 """
 
 from enum import StrEnum

{crowdypy-0.4.0.dev1 → crowdypy-0.5.0.dev1}/src/crowdypy/_generated/inputs.py

@@ -4,7 +4,7 @@ Every GraphQL input object as a msgspec Struct. Attributes are snake_case and en
 under their GraphQL names; an attribute left at UNSET is omitted from the request,
 which is how the API tells 'not provided' from an explicit null.
 
-schema.gql sha256: 5dcaf15c772c89fe250ecdbd83eb21b52b67f27d739fca38c2871b5553751ab0
+schema.gql sha256: 38c490a70f0bd92977fef5867e0b9e14a10d9467a2008dcd2c02bbc96878d8d3
 """
 
 from __future__ import annotations
@@ -860,6 +860,13 @@ class SetCrowdyStudioProviderConsentInput(msgspec.Struct, kw_only=True, omit_def
     consented: bool
 
 
+class SetGridOpenPermissionsInput(msgspec.Struct, kw_only=True, omit_defaults=True, rename={'app_id': 'appId', 'grid_id': 'gridId', 'permission_keys': 'permissionKeys'}):
+    'Set the permission keys a grid grants every player with active access to the app (writes the grid_open_permissions input table): an open build area, a public arena.'
+    app_id: str
+    grid_id: str
+    permission_keys: list[str]
+
+
 class SetGridPermissionLimitsInput(msgspec.Struct, kw_only=True, omit_defaults=True, rename={'app_id': 'appId', 'grid_id': 'gridId', 'permission_keys': 'permissionKeys'}):
     'Set the per-grid permission-key whitelist (writes the grid_permission_limits input table).'
     app_id: str
@@ -1213,6 +1220,7 @@ __all__ = [
     'SetCrowdyStudioLibraryFileArchivedInput',
     'SetCrowdyStudioProjectArchivedInput',
     'SetCrowdyStudioProviderConsentInput',
+    'SetGridOpenPermissionsInput',
     'SetGridPermissionLimitsInput',
     'SetHostedGameEnabledInput',
     'SetHostedGameListingInput',

{crowdypy-0.4.0.dev1 → crowdypy-0.5.0.dev1}/src/crowdypy/_generated/operations.py

@@ -1,7 +1,7 @@
 """GENERATED by scripts/codegen.py from schema.gql and operations/. Do not edit.
 
-schema.gql sha256: 5dcaf15c772c89fe250ecdbd83eb21b52b67f27d739fca38c2871b5553751ab0
-operations/ sha256: 4b0990648ef236dd7901e1cc3413ee4034a0505051adb36d788568993ec31d6b
+schema.gql sha256: 38c490a70f0bd92977fef5867e0b9e14a10d9467a2008dcd2c02bbc96878d8d3
+operations/ sha256: d5e0c505589ea26ecc3398b12f02ad7bd786457f7010ad87dcb8af2ea9366c77
 """
 
 from crowdypy._operation import Operation
@@ -1079,6 +1079,14 @@ GRID_GROUP_GRANTS = Operation(
     document='query GridGroupGrants($appId: BigInt!, $gridId: BigInt!, $groupId: BigInt!) {\n  gridGroupGrants(appId: $appId, gridId: $gridId, groupId: $groupId) {\n    appId\n    gridId\n    groupId\n    groupRoleId\n    permissionKey\n    expiresAt\n  }\n}',
 )
 
+# gameApps/GameApps.graphql
+GRID_OPEN_PERMISSIONS = Operation(
+    name='GridOpenPermissions',
+    kind='query',
+    root_fields=('gridOpenPermissions',),
+    document='query GridOpenPermissions($appId: BigInt!, $gridId: BigInt!) {\n  gridOpenPermissions(appId: $appId, gridId: $gridId) {\n    appId\n    gridId\n    permissionKeys\n  }\n}',
+)
+
 # gameApps/GameApps.graphql
 GRID_OWNERSHIP = Operation(
     name='GridOwnership',
@@ -1743,6 +1751,14 @@ SET_CHANNEL_POLICY = Operation(
     document='mutation SetChannelPolicy($input: SetChannelPolicyInput!) {\n  setChannelPolicy(input: $input) {\n    appId\n    groupType\n    creationPolicy\n    defaultMembershipPolicy\n    maxMembers\n    maxGroupsPerUser\n  }\n}',
 )
 
+# gameApps/GameApps.graphql
+SET_GRID_OPEN_PERMISSIONS = Operation(
+    name='SetGridOpenPermissions',
+    kind='mutation',
+    root_fields=('setGridOpenPermissions',),
+    document='mutation SetGridOpenPermissions($input: SetGridOpenPermissionsInput!) {\n  setGridOpenPermissions(input: $input) {\n    appId\n    gridId\n    permissionKeys\n  }\n}',
+)
+
 # gameApps/GameApps.graphql
 SET_GRID_PERMISSION_LIMITS = Operation(
     name='SetGridPermissionLimits',
@@ -2263,6 +2279,7 @@ OPERATIONS: dict[str, Operation] = {op.name: op for op in (
     GRAPHQL_SERVERS,
     GRID_CHANNELS,
     GRID_GROUP_GRANTS,
+    GRID_OPEN_PERMISSIONS,
     GRID_OWNERSHIP,
     GRID_PERMISSION_LIMITS,
     GRID_USER_PERMISSIONS,
@@ -2346,6 +2363,7 @@ OPERATIONS: dict[str, Operation] = {op.name: op for op in (
     SET_AUTO_BILLING,
     SET_CHANNEL_MEMBER_ROLES,
     SET_CHANNEL_POLICY,
+    SET_GRID_OPEN_PERMISSIONS,
     SET_GRID_PERMISSION_LIMITS,
     SET_PLAYER_AUTO_BILLING,
     SET_PLAYER_RATE_MARKUP,

{crowdypy-0.4.0.dev1 → crowdypy-0.5.0.dev1}/src/crowdypy/_sync/domains/crowdy_studio_agent.py

@@ -6,7 +6,8 @@ The model endpoint itself is REST (``GET /v1/model/models``, ``POST
 spends tokens through. These GraphQL companions read what it recorded and gate whether it
 may run: the player's provider consent and own usage (``use_studio_agent``), and the app's
 policy and sanitized usage (``view_compute_diagnostics``; ``manage_compute`` to change it).
-Mirrors CrowdyCPP's ``CrowdyStudioAgentAPI``; CrowdyJS sends these from its agent pane.
+Mirrors CrowdyCPP's ``CrowdyStudioAgentAPI``. CrowdyJS's in-browser agent sends the consent
+and model-usage roots itself; its portable API sends none of the seven.
 """
 
 from __future__ import annotations