crowdypy 0.9.0.dev1__tar.gz → 0.10.0.dev1__tar.gz

{crowdypy-0.9.0.dev1 → crowdypy-0.10.0.dev1}/MIGRATION.md

@@ -3,6 +3,43 @@
 CrowdyPy is pre-1.0. Within a minor line, patch releases keep source compatibility; each
 new minor may change the API. Read the section for every minor you skip.
 
+## 0.10.0
+
+CrowdyJS 18.9.0 and CrowdyCPP 0.62.0. Additive, with one floor: every sessions read selects
+`InputLogSession.missingRecords`, so `client.input_log.sessions` needs the Game API release after
+v2.40.2 (an older one refuses the selection).
+
+- **`missingRecords`** on every recorded session: inputs the replication server accepted that
+  never reached the log (an overloaded server or a broker outage). 0 when the recording is
+  complete as far as it is known; `None` on one recorded before the count existed. A lost end of
+  the recording cannot be counted: that session closes as `unrecorded`.
+- **End reasons.** `endReason` may also be `logging_off`, `shutdown`, `paused` (recording paused
+  while the app's logging setting could not be confirmed; a later record reopens the session) or
+  `unrecorded`; the `sessions` docstring says what each means.
+- **Retrying a read.** `INPUT_LOG_TEMPORARILY_UNAVAILABLE` and `INPUT_LOG_RATE_LIMITED` carry
+  `extensions["retryable"]`: retry with the same cursor after a short back-off, a bounded number
+  of times. A malformed cursor, or one from another session, is `BAD_USER_INPUT`.
+- **Stopping a read** (CrowdyJS's `signal`): cancel its task, or wrap it in `asyncio.timeout`. The
+  request is closed, which frees its share of the server's reads (one per user, two per app and
+  per org at a time); the client's own timeout applies either way. CrowdyCPP 0.62.0's
+  `CancelToken` is the C++ form; CrowdyPy's GraphQL client is Python's, so it needs none.
+- **`INPUT_LOG_FUNDS_NEEDED`** on `client.apps.update(app_id, {"replayLoggingEnabled": True})` carries
+  `extensions["requiredMicrousd"]` and `["spendableMicrousd"]`: the balance turning logging on
+  needs and what the org wallet can spend.
+- The vendored CrowdyCPP adds `Errc.Cancelled` beside the codes the replication layer reports;
+  nothing in the native client returns it.
+
+## 0.9.1
+
+A patch release with the same API as 0.9.0, the same CrowdyJS (18.8.0) and CrowdyCPP (0.61.0) pins.
+
+- **`client.input_log` sends a session filter's `userId` as a string**, the decimal string every
+  id is on the wire. An `int` used to go out as a JSON number.
+- **Its docstrings say when a read is retryable.** From the Game API release after v2.40.2,
+  `InputLogAPI.messages` answers `INPUT_LOG_TEMPORARILY_UNAVAILABLE` when the log cannot be read
+  right now and `INPUT_LOG_RATE_LIMITED` while another read of yours is running; both carry
+  `extensions.retryable`, so retry with the same cursor after a short back-off.
+
 ## 0.9.0
 
 CrowdyJS 18.8.0 and CrowdyCPP 0.61.0. Additive, with one floor: the build documents select

{crowdypy-0.9.0.dev1 → crowdypy-0.10.0.dev1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: crowdypy
-Version: 0.9.0.dev1
+Version: 0.10.0.dev1
 Summary: Official Python SDK for Crowded Kingdoms: typed GraphQL clients and a native UDP replication core
 Keywords: crowded-kingdoms,multiplayer,replication,graphql,sdk,udp
 Author: Crowded Kingdoms
@@ -51,8 +51,15 @@ CrowdyPy follows the [CrowdyJS](https://github.com/CrowdedKingdoms/CrowdyJS) API
 client, bound with [nanobind](https://github.com/wjakob/nanobind) and shipped inside the
 wheel. Python never touches a datagram.
 
-**v0.9.0: builds report the SDK they compiled against (CrowdyJS 18.8.0, CrowdyCPP 0.61.0).** See the 0.9.0
-bullet below.
+**v0.10.0: the input log says what it lost (CrowdyJS 18.9.0, CrowdyCPP 0.62.0).** Every session
+from `client.input_log.sessions` carries `missingRecords`, the inputs the replication server
+accepted that never reached the log, which needs the Game API release after v2.40.2. Its
+docstrings name the new end reasons (`paused` among them), the two read refusals worth retrying
+with the same cursor, and how to stop a read nobody will see: cancel its task, which closes the
+request and frees its server read share. See [MIGRATION.md](MIGRATION.md).
+
+**v0.9.1: the input log's session filter sends `userId` as a string, and its reads document when
+to retry.** See the 0.9.1 bullet below; 0.9.0 added the SDK a build compiled against.
 
 **v0.8.0: voice, channel audio, wide voxels, and pause and access refusals (CrowdyJS 18.7.0, CrowdyCPP 0.60.0).**
 - Voice: `crowdypy.media`'s voice helpers (an optional 10-byte header per codec frame,

{crowdypy-0.9.0.dev1 → crowdypy-0.10.0.dev1}/README.md

@@ -11,8 +11,15 @@ CrowdyPy follows the [CrowdyJS](https://github.com/CrowdedKingdoms/CrowdyJS) API
 client, bound with [nanobind](https://github.com/wjakob/nanobind) and shipped inside the
 wheel. Python never touches a datagram.
 
-**v0.9.0: builds report the SDK they compiled against (CrowdyJS 18.8.0, CrowdyCPP 0.61.0).** See the 0.9.0
-bullet below.
+**v0.10.0: the input log says what it lost (CrowdyJS 18.9.0, CrowdyCPP 0.62.0).** Every session
+from `client.input_log.sessions` carries `missingRecords`, the inputs the replication server
+accepted that never reached the log, which needs the Game API release after v2.40.2. Its
+docstrings name the new end reasons (`paused` among them), the two read refusals worth retrying
+with the same cursor, and how to stop a read nobody will see: cancel its task, which closes the
+request and frees its server read share. See [MIGRATION.md](MIGRATION.md).
+
+**v0.9.1: the input log's session filter sends `userId` as a string, and its reads document when
+to retry.** See the 0.9.1 bullet below; 0.9.0 added the SDK a build compiled against.
 
 **v0.8.0: voice, channel audio, wide voxels, and pause and access refusals (CrowdyJS 18.7.0, CrowdyCPP 0.60.0).**
 - Voice: `crowdypy.media`'s voice helpers (an optional 10-byte header per codec frame,

{crowdypy-0.9.0.dev1 → crowdypy-0.10.0.dev1}/docs/compatibility.md

@@ -5,7 +5,7 @@ are in `pyproject.toml` (`[project].version`, `[tool.crowdypy.crowdyjs]`,
 `[tool.crowdypy.crowdycpp]`); `tests/unit/test_release_versions.py` refuses this page when
 its version disagrees.
 
-- CrowdyPy `0.9.0`
+- CrowdyPy `0.10.0`
 - API surface: CrowdyJS (the pinned version and commit in `pyproject.toml`); the generated
   `docs/parity-matrix.md` lists every covered method, every native equivalent and every
   browser exclusion with its reason. The gate is strict: there are no portable gaps, and a
@@ -41,6 +41,10 @@ requirement names one exactly, the same way a caret never matches an npm prerele
 - `auth.record_player_consents` and `auth.player_legal_acceptance` need ck-api v2.35.0; an
   older API answers them with a GraphQL validation error. From v2.35.0 a gameplay token
   waits for both consents (`LEGAL_ACCEPTANCE_REQUIRED`).
+- The input log (`client.input_log`, 0.7.0) needs ck-api v2.39.0 or later: every app read selects
+  `replayLoggingEnabled`, which an older API refuses with a GraphQL validation error. The retryable
+  `INPUT_LOG_TEMPORARILY_UNAVAILABLE` / `INPUT_LOG_RATE_LIMITED` and the `logging_off` / `shutdown`
+  end reasons come with the ck-api release after v2.40.2.
 - `udp.send_ranged_channel_message` needs a replication server that serves message type 32
   (CHANNEL_MESSAGE_RANGED_REQUEST); one that does not delivers nothing.
 - 0.8.0 selects `runtimeGate` on every token mutation (`portal.mint_app_token`,

{crowdypy-0.9.0.dev1 → crowdypy-0.10.0.dev1}/docs/e2e-coverage.md

@@ -18,7 +18,7 @@ Unconfigured, every suite skips, so `pytest` in CI records skips, not live passe
 | `CROWDY_E2E_STUDIO_GRID_ID` | no | a grid in the app that the owner controls (Studio suite) |
 | `CROWDY_E2E_SLOW=1` | no | long-running suites |
 | `CROWDY_E2E_THROWAWAY_OWNER=1` | no | the open-grid suite registers a throwaway owner, org and app (archived afterwards) |
-| `CROWDY_E2E_PROVISIONING_TOKEN` | dev and test | dev and test are staff-only, so a new derived player is refused (`TIER_ACCESS_REQUIRED`) unless `register` carries a provisioning token covering its address. Use the `harness` token (Secrets Manager `infra-cp/<tier>/loadtest/provisioning-token-harness`, `token` key) with `CROWDY_E2E_EMAIL=crowdy-e2e@test.invalid`. Sent on `register` only; other tiers ignore it |
+| `CROWDY_E2E_PROVISIONING_TOKEN` | dev and test | dev and test are staff-only, so a new derived player is refused (`TIER_ACCESS_REQUIRED`) unless `register` carries a provisioning token covering its address. Use the `harness` token (Secrets Manager `infra-cp/<tier>/loadtest/provisioning-token-harness`, `token` key), which covers `crowdy-e2e*@test.invalid`, with `CROWDY_E2E_EMAIL=crowdy-e2e-py@test.invalid` (the `*` needs at least one character, so the bare `crowdy-e2e@test.invalid` is refused for a suite that registers the base address). Sent on `register` only; other tiers ignore it |
 
 ```bash
 pytest tests/e2e -q
@@ -44,6 +44,7 @@ player once and signs it in for the later suites.
 | `test_e2e_ranged_channel.py` | the owner's invite channel with four members, each keeping an actor at its own chunk: a distance-limited channel message from A reaches B at 5 chunks with `max_distance` 5 but not C (about 5.66) or D (7); 6 adds C, 7 adds D; A never receives its own; no send is refused | `e2e_ranged_channel` |
 | `test_e2e_open_grid_exec_gateway.py` | as a throwaway org admin (`CROWDY_E2E_THROWAWAY_OWNER=1`): open a nested grid, read it back, a player holds its keys, a player-code key is refused `BAD_REQUEST`, close it; the tier's ck-exec gateway passes `exec_gateway_refusal`, a connection pings, and a tampered connect token is `Denied` with the gateway's HTTP 401 reason | `e2e_open_grid_exec_gateway` |
 | `test_e2e_studio.py` | the headless Studio controller creates a project from the mod starter, edits it with autosave, and archives it (optional: needs `CROWDY_E2E_STUDIO_GRID_ID`) | `e2e_crowdy_studio` |
+| `test_e2e_input_log.py` | read-only, as the owner: the app's sessions list with `missingRecords` on every node (the Game API release after v2.40.2 accepts the selection), one session's inputs page when there is one, and a cancelled read stops with the client still usable | `e2e_input_log` |
 
 ## Live runs
 
@@ -56,6 +57,7 @@ player once and signs it in for the later suites.
 | 2026-10-01 | dev tier, app `96701660793088`; the open-grid suite in its own throwaway org and app (`CROWDY_E2E_THROWAWAY_OWNER=1`) | `crowdypy 0.5.0.dev1` from PyPI (`pip install crowdypy` in a clean Python 3.12) | 10 passed; Studio skipped |
 | 2026-10-08 | local stack: ck-api at the distance-limited channel branch (off `dev`), two replication servers serving message type 32, the 3-node Citus lab | 0.6.0 (branch) | identity, ranged channel, replication, world and world data suites: 10 passed |
 | 2026-10-09 | dev tier, app `96701660793088`, after replication server v0.35.0 and ck-api v2.38.0 reached dev | `crowdypy 0.6.0.dev1` from PyPI (installed into a clean Python 3.12 with uv) | identity (incl. the terms gate), ranged channel, replication, world and world data suites: 10 passed |
+| 2026-10-13 | dev tier (ck-api v2.42.0), app `96701660793088`, the `harness` provisioning token with `CROWDY_E2E_EMAIL=crowdy-e2e-py@test.invalid` | 0.10.0 (branch, vendoring CrowdyCPP `dev/v0.62.0`) | identity (the terms-gate case now registers with the token and no consents), input log, ranged channel, replication, world and world data suites: 12 passed; open grid (needs `CROWDY_E2E_THROWAWAY_OWNER=1`) and Studio skipped |
 
 ## Not covered here
 

{crowdypy-0.9.0.dev1 → crowdypy-0.10.0.dev1}/docs/parity-matrix.md

@@ -4,8 +4,8 @@ Generated by `tools/parity/parity.py`; do not edit by hand. Classifications live
 
 ## Target
 
-- CrowdyJS: `18.8.0` at `d7b755abe73bd9e157673325cbfcfb3975f71cc3`
-- CrowdyCPP (native core): `0.61.0` at `72f4a154a8defde1f99d6dfd983cb6629c26d233`
+- CrowdyJS: `18.9.0` at `cee1997127549e372c57baab2f0e12f1f423f31a`
+- CrowdyCPP (native core): `0.62.0` at `3845e797d06e788f5a7c0d8e1e3fd6d501c75693`
 - schema.gql identical to CrowdyJS's: yes
 - Gate mode: strict portable parity (every portable gap is release-blocking)
 

{crowdypy-0.9.0.dev1 → crowdypy-0.10.0.dev1}/operations/inputLog/InputLogSessions.graphql

@@ -18,6 +18,7 @@ query InputLogSessions(
         endReason
         messageCount
         byteCount
+        missingRecords
         messageTypes
       }
     }

{crowdypy-0.9.0.dev1 → crowdypy-0.10.0.dev1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "scikit_build_core.build"
 
 [project]
 name = "crowdypy"
-version = "0.9.0.dev1"
+version = "0.10.0.dev1"
 description = "Official Python SDK for Crowded Kingdoms: typed GraphQL clients and a native UDP replication core"
 readme = "README.md"
 license = "MIT AND Apache-2.0"
@@ -119,20 +119,20 @@ environment = { OPENSSL_ROOT_DIR = "C:/vcpkg/installed/x64-windows-static-md" }
 # --------------------------------------------------------------------------------------
 
 [tool.crowdypy.crowdyjs]
-version = "18.8.0"
-commit = "d7b755abe73bd9e157673325cbfcfb3975f71cc3"
+version = "18.9.0"
+commit = "cee1997127549e372c57baab2f0e12f1f423f31a"
 
 [tool.crowdypy.crowdycpp]
-version = "0.61.0"
-tag = "dev/v0.61.0"
-commit = "72f4a154a8defde1f99d6dfd983cb6629c26d233"
-tree-sha256 = "559bbbcc37455ae020abdf7e128cb84e05bead6e8f52b4f4a8e4293a6f1f0a18"
+version = "0.62.0"
+tag = "dev/v0.62.0"
+commit = "3845e797d06e788f5a7c0d8e1e3fd6d501c75693"
+tree-sha256 = "8a8226aa148e1c56ff620812ebaadb1fad757ebd5b801489cb1ec59e9cfe2695"
 
 # schema.gql and operations/ are CrowdyJS's, copied from the commit pinned above by
 # scripts/schema_sync.py, which records these hashes and re-derives them in CI.
 [tool.crowdypy.graphql]
-schema-sha256 = "61f99f99fc80be9de388e7295faa247fe508cc0d2f7d2b832a2709ed76c464b2"
-operations-sha256 = "e9e0ad2ac5f585815d3f3b2b2f3b4443736f9ae602905fbe82b236b7cc4bfd66"
+schema-sha256 = "4b19bc84aa340365f6a256dc10544ce9141d18437048867607c8a2d0e74a66de"
+operations-sha256 = "013595fe2109633245b5c39446e884fad0ecb7d2fda3c2849c6087a5e6336f6c"
 
 # The SDL the docs site publishes. scripts/schema_drift.py compares the snapshot against it
 # on a schedule; nothing on the per-commit path reads the network.

{crowdypy-0.9.0.dev1 → crowdypy-0.10.0.dev1}/schema.gql

@@ -1301,7 +1301,7 @@ type App {
   """
   wildernessWritesOpen: Boolean!
   """
-  Whether replay logging is on: the realtime servers record every client input they accept for this app, searchable with inputLogSessions and readable with inputLogMessages, and billed as stored input logs. False (the default) records nothing ("No replication logging"). Set with updateApp (manage_apps); turning it on needs a funded org wallet or a billing-exempt org.
+  Whether replay logging is on: the realtime servers record every client message they accept for this app, searchable with inputLogSessions and readable with inputLogMessages, and billed as stored input logs. False (the default) records nothing ("No replication logging"). Set with updateApp (manage_apps); turning it on needs a wallet that covers the projected cost of one retention period, or a billing-exempt org.
   """
   replayLoggingEnabled: Boolean!
   """
@@ -4637,7 +4637,7 @@ type AppUsageSummary {
   """
   automationComputeUnits: String!
   """
-  Stored input logs over the window, in byte-hours (string counter): the sum of the hourly samples, which is the quantity input_log_storage_byte_hours bills. Each recorded byte (InputLogMessage.sizeBytes) is held for the input log retention, one byte-hour per hour. 0 when replay logging was off.
+  Stored input logs over the window, in byte-hours (string counter): the sum of the hourly samples, which is the quantity input_log_storage_byte_hours bills. Each recorded byte (InputLogMessage.sizeBytes) is held for the input log retention, one byte-hour per hour, so recordings keep accruing byte-hours after replay logging is turned off, until they age out. 0 when nothing was held during the window.
   """
   inputLogByteHours: String!
   """
@@ -4681,7 +4681,7 @@ type AppUsageProjection {
   """
   onTrackToExceed: Boolean
   """
-  Stored input logs this calendar month so far, in byte-hours (input_log_storage_byte_hours, which has no free allowance). 0 when replay logging was off all month.
+  Stored input logs this calendar month so far, in byte-hours (input_log_storage_byte_hours, which has no free allowance). Recordings keep accruing after replay logging is turned off, until they age out at the end of the retention; 0 when nothing was held this month.
   """
   inputLogByteHours: String!
   """
@@ -5156,11 +5156,11 @@ type InputLogSession {
   """When the latest recorded input or marker arrived."""
   lastSeenAt: DateTime!
   """
-  When the session ended, if its end was recorded; null while it may still be running.
+  When the session ended; null while it may still be running. A session whose end was not recorded is closed at its last record once it has gone an hour without one. Later records reopen a session (endedAt returns to null).
   """
   endedAt: DateTime
   """
-  How the session ended, as the client saw it: expired, revoked, reconnect or released. Null while it may still be running.
+  How the session ended: expired, revoked, reconnect or released, as the client saw it; logging_off, when the app turned replay logging off while the session was open; shutdown, when the realtime server recording it stopped (a deploy), after which the client reconnects elsewhere; paused, when recording paused because the app's logging setting could not be confirmed, which the client does not see (a later record reopens the session); or unrecorded, when its end was not recorded and it was closed an hour after its last record. Null while it may still be running.
   """
   endReason: String
   """Inputs recorded in the session."""
@@ -5171,6 +5171,10 @@ type InputLogSession {
   byteCount: BigInt!
   """The client message types the session contains, ascending."""
   messageTypes: [Int!]!
+  """
+  Records the realtime servers numbered for this session that never reached the log: recording is best-effort, so an overloaded server or a broker outage can leave gaps, and this is how many. 0 when the recording is complete as far as it is known. A lost end of the recording cannot be counted (its session closes as unrecorded instead). Null for a session recorded before the realtime servers numbered their records.
+  """
+  missingRecords: BigInt
 }
 
 """An edge in a InputLogSession connection."""
@@ -6501,7 +6505,9 @@ type Query {
   inputLogSessions(
     """The app whose recorded sessions to list."""
     appId: BigInt!
-    """Return the first N edges after `after`. Default 50; clamped to 1..200."""
+    """
+    Return the first N edges after `after`. Default 50; clamped to 1..200, so 0 returns one edge.
+    """
     first: Int
     """
     Opaque cursor: return edges after this one. Pass a previous page's `pageInfo.endCursor`. Omit for the first page.
@@ -6511,14 +6517,16 @@ type Query {
     filter: InputLogSessionFilter
   ): InputLogSessionConnection!
   """
-  The recorded inputs of one session, oldest first, each exactly as the client sent it (without its authentication tail). Read from the input log by the offset ranges its index holds, so inputs past the published retention are gone even while the session is still listed. With 'manage_apps' on the app you may read any session; anyone else may read only their own, and any other session answers NOT_FOUND. Game plane: send the app-scoped token for this app to the app's datacenter. Page with `first` (default 50, max 200) and `after`; a page can hold fewer than `first` inputs when it stopped at its time or scan limit, so keep paging while hasNextPage is true. INPUT_LOG_UNAVAILABLE when input logging is not configured on this deployment, and also, retryable with the same cursor, when the log cannot be read right now.
+  The recorded inputs of one session, oldest first, each exactly as the client sent it (without its authentication tail). Read from the input log by the offset ranges its index holds, so inputs past the published retention are gone even while the session is still listed. With 'manage_apps' on the app you may read any session; anyone else may read only their own, and any other session answers NOT_FOUND. Game plane: send the app-scoped token for this app to the app's datacenter. Page with `first` (default 50, max 200) and `after`, the previous page's endCursor for this same session (a cursor from another session is BAD_USER_INPUT); a page can hold fewer than `first` inputs, or none, when it stopped at its time or scan limit, so keep paging while hasNextPage is true. An operation may select this field only once. A server runs one read per user (two per app and per org) at a time; a read over that share waits for the earlier one within its own few-second deadline, and a read whose request is closed stops. Errors: INPUT_LOG_UNAVAILABLE when input logging is not configured on this deployment, or this server may not read its log (do not retry); INPUT_LOG_RATE_LIMITED (429) when the wait for an earlier read ran out or left too little time to read, and INPUT_LOG_TEMPORARILY_UNAVAILABLE (503) when the log cannot be read just now, both with extensions.retryable: retry shortly with the same cursor. A read whose request closed stops as INPUT_LOG_READ_ABORTED (499), which nobody receives.
   """
   inputLogMessages(
     """The app the session belongs to."""
     appId: BigInt!
     """The session to read: InputLogSession.gameTokenId."""
     gameTokenId: BigInt!
-    """Return the first N edges after `after`. Default 50; clamped to 1..200."""
+    """
+    Return the first N edges after `after`. Default 50; clamped to 1..200, so 0 returns one edge.
+    """
     first: Int
     """
     Opaque cursor: return edges after this one. Pass a previous page's `pageInfo.endCursor`. Omit for the first page.
@@ -6583,7 +6591,9 @@ type Query {
   Super admin only. Paginated user search across email, gamertag, disambiguation, and exact user_id. Relay cursor connection; prefer this over the offset-based usersPaginated.
   """
   usersConnection(
-    """Return the first N edges after `after`. Default 50; clamped to 1..200."""
+    """
+    Return the first N edges after `after`. Default 50; clamped to 1..200, so 0 returns one edge.
+    """
     first: Int
     """
     Opaque cursor: return edges after this one. Pass a previous page's `pageInfo.endCursor`. Omit for the first page.
@@ -6630,7 +6640,9 @@ type Query {
   Relay-style cursor-paginated version of `actors`: lists actors owned by the authenticated user, optionally narrowed by `filter` (appId, avatarId, uuid, chunk). Page forward with `first` (default 50, max 200) and `after` (an opaque cursor from a previous page’s `pageInfo.endCursor`); `totalCount` is the full number of matching actors. Requires a valid game token; only the caller’s own actors are returned (full state included). Under an app token the list is confined to that token’s app.
   """
   actorsConnection(
-    """Return the first N edges after `after`. Default 50; clamped to 1..200."""
+    """
+    Return the first N edges after `after`. Default 50; clamped to 1..200, so 0 returns one edge.
+    """
     first: Int
     """
     Opaque cursor: return edges after this one. Pass a previous page's `pageInfo.endCursor`. Omit for the first page.
@@ -6724,7 +6736,9 @@ type Query {
   appUserAccessConnection(
     """Numeric id of the app whose access records to list."""
     appId: BigInt!
-    """Return the first N edges after `after`. Default 50; clamped to 1..200."""
+    """
+    Return the first N edges after `after`. Default 50; clamped to 1..200, so 0 returns one edge.
+    """
     first: Int
     """
     Opaque cursor: return edges after this one. Pass a previous page's `pageInfo.endCursor`. Omit for the first page.
@@ -6877,7 +6891,9 @@ type Query {
   Public marketplace listing of apps. PUBLIC: no authentication required. Returns ONLY apps with visibility=PUBLIC AND status=LIVE (drafts, unlisted, private, and archived apps are never returned). Results are ordered newest-first. Relay cursor connection; prefer this over the offset-based apps.
   """
   appsConnection(
-    """Return the first N edges after `after`. Default 50; clamped to 1..200."""
+    """
+    Return the first N edges after `after`. Default 50; clamped to 1..200, so 0 returns one edge.
+    """
     first: Int
     """
     Opaque cursor: return edges after this one. Pass a previous page's `pageInfo.endCursor`. Omit for the first page.
@@ -7007,10 +7023,12 @@ type Query {
     Organization id (BigInt as a decimal string) whose transactions to list.
     """
     orgId: BigInt!
-    """Maximum number of transactions to return. Defaults to 50 when omitted."""
+    """
+    Maximum number of transactions to return, 1 to 200 (a value outside is clamped). Defaults to 50 when omitted.
+    """
     limit: Int @deprecated(reason: "Use walletTransactionsConnection(first:, after:) instead. See /overview/pagination.")
     """
-    Number of transactions to skip before returning results, for offset/limit pagination. Defaults to 0 when omitted.
+    Number of transactions to skip before returning results, for offset/limit pagination, 0 to 9999999 (a value outside is clamped). Defaults to 0 when omitted.
     """
     offset: Int @deprecated(reason: "Use walletTransactionsConnection(first:, after:) instead. See /overview/pagination.")
   ): [WalletTransaction!]! @requiresPermission(scope: "org", permission: "view_billing", scopeArg: "orgId")
@@ -7022,7 +7040,9 @@ type Query {
     Organization id (BigInt as a decimal string) whose transactions to list.
     """
     orgId: BigInt!
-    """Return the first N edges after `after`. Default 50; clamped to 1..200."""
+    """
+    Return the first N edges after `after`. Default 50; clamped to 1..200, so 0 returns one edge.
+    """
     first: Int
     """
     Opaque cursor: return edges after this one. Pass a previous page's `pageInfo.endCursor`. Omit for the first page.
@@ -7129,7 +7149,9 @@ type Query {
   Lists the authenticated caller's own checkouts (newest first), across every org and app. Use this for a self-service payment history; use `checkoutsConnection` for the cross-tenant super-admin view. Requires an authenticated user. Relay cursor connection; prefer this over the offset-based myCheckouts.
   """
   myCheckoutsConnection(
-    """Return the first N edges after `after`. Default 50; clamped to 1..200."""
+    """
+    Return the first N edges after `after`. Default 50; clamped to 1..200, so 0 returns one edge.
+    """
     first: Int
     """
     Opaque cursor: return edges after this one. Pass a previous page's `pageInfo.endCursor`. Omit for the first page.
@@ -7157,7 +7179,9 @@ type Query {
   Cross-tenant payments audit across all users, orgs, and apps (newest first), with optional filtering. Restricted to super admins; requests from non-super-admins are rejected. For a caller's own history use `myCheckoutsConnection` instead. Relay cursor connection; prefer this over the offset-based checkouts.
   """
   checkoutsConnection(
-    """Return the first N edges after `after`. Default 50; clamped to 1..200."""
+    """
+    Return the first N edges after `after`. Default 50; clamped to 1..200, so 0 returns one edge.
+    """
     first: Int
     """
     Opaque cursor: return edges after this one. Pass a previous page's `pageInfo.endCursor`. Omit for the first page.
@@ -7185,7 +7209,9 @@ type Query {
   Audit log of inbound payment-provider webhook events (used for idempotent reconciliation of checkouts), newest first. Restricted to super admins; requests from non-super-admins are rejected. Relay cursor connection; prefer this over the offset-based paymentEvents.
   """
   paymentEventsConnection(
-    """Return the first N edges after `after`. Default 50; clamped to 1..200."""
+    """
+    Return the first N edges after `after`. Default 50; clamped to 1..200, so 0 returns one edge.
+    """
     first: Int
     """
     Opaque cursor: return edges after this one. Pass a previous page's `pageInfo.endCursor`. Omit for the first page.
@@ -7248,7 +7274,9 @@ type Query {
   playerUsageCharges(
     """Optional: only charges for this app."""
     appId: BigInt
-    """Max entries (default 50, max 200)."""
+    """
+    Maximum number of charges to return, 1 to 200 (a value outside is clamped). Defaults to 50 when omitted.
+    """
     limit: Int
   ): [PlayerUsageCharge!]!
   """
@@ -7584,7 +7612,9 @@ type Query {
     Number of entries to skip for pagination. Defaults to 0 when omitted; allowed range is 0-1000000.
     """
     offset: Int @deprecated(reason: "Use voxelUpdateHistoryConnection(first:, after:) instead. See /overview/pagination. Removal no earlier than 2027-01-01. (Ignored by voxelUpdateHistoryConnection, which shares these args.)")
-    """Return the first N edges after `after`. Default 50; clamped to 1..200."""
+    """
+    Return the first N edges after `after`. Default 50; clamped to 1..200, so 0 returns one edge.
+    """
     first: Int
     """
     Opaque cursor: return edges after this one. Pass a previous page's `pageInfo.endCursor`. Omit for the first page.
@@ -8829,7 +8859,7 @@ type Mutation {
     input: CreateAppInput!
   ): App! @requiresPermission(scope: "org", permission: "manage_apps", scopeArg: "input.orgId")
   """
-  Update mutable fields of an existing app (name, description, visibility, status, metadata, wildernessWritesOpen, replayLoggingEnabled); only fields present in the input are changed. Turning replayLoggingEnabled on is refused with INPUT_LOG_FUNDS_NEEDED unless the org's wallet has a spendable balance or the org is billing-exempt. Requires the 'manage_apps' permission on the app (resolved via its org); super admins bypass. Use this to publish (status=LIVE), change visibility, or restore an archived app (status back to DRAFT/LIVE). Throws if the app id does not exist.
+  Update mutable fields of an existing app (name, description, visibility, status, metadata, wildernessWritesOpen, replayLoggingEnabled); only fields present in the input are changed. Turning replayLoggingEnabled on is refused with INPUT_LOG_FUNDS_NEEDED unless the org's wallet can spend at least the projected cost of keeping one retention period of the app's recent traffic (extensions.requiredMicrousd and spendableMicrousd say how much), or the org is billing-exempt; recordings already kept go on billing after it is turned off, until they age out. Requires the 'manage_apps' permission on the app (resolved via its org); super admins bypass. Use this to publish (status=LIVE), change visibility, or restore an archived app (status back to DRAFT/LIVE). Throws if the app id does not exist.
   """
   updateApp(
     """Numeric id of the app to update."""
@@ -10694,7 +10724,7 @@ input UpdateAppInput {
   """
   wildernessWritesOpen: Boolean
   """
-  Turn replay logging on (true) or off (false): record every client input the realtime servers accept for this app, kept for the input log's published retention and billed as stored input logs (input_log_storage_byte_hours, no free allowance). Turning it ON is refused with INPUT_LOG_FUNDS_NEEDED unless the org's wallet has a spendable balance or the org is billing-exempt; turning it off always succeeds. Recording starts and stops within about 15 seconds. Omit to leave unchanged.
+  Turn replay logging on (true) or off (false): record every client message the realtime servers accept for this app (keep-alives included), kept for the input log's published retention and billed as stored input logs (input_log_storage_byte_hours, no free allowance). Turning it ON is refused with INPUT_LOG_FUNDS_NEEDED unless the org's wallet can spend at least the projected cost of keeping one retention period of the app's recent traffic, or the org is billing-exempt; turning it off always succeeds, and what was already recorded goes on billing until it ages out. Recording starts and stops within about 15 seconds. Omit to leave unchanged.
   """
   replayLoggingEnabled: Boolean
   """

{crowdypy-0.9.0.dev1 → crowdypy-0.10.0.dev1}/scripts/ci/check_content_policy.py

@@ -41,7 +41,6 @@ DENYLIST = (
     "dev-run-buddy",
 )
 SKIP_DIRS = {
-    ".git": "object store; holds every historical revision by construction",
     ".venv": "the developer's virtualenv; third-party code",
     "build": "CMake build trees, regenerated per build",
     "node_modules": "third-party dependencies",
@@ -76,6 +75,11 @@ def tree() -> Iterator[tuple[str, bytes]]:
         current = stack.pop()
         for entry in sorted(current.iterdir()):
             rel = entry.relative_to(ROOT).as_posix()
+            if entry.name == ".git":
+                # A clone's object store, which holds every historical revision by
+                # construction, or a worktree's pointer file, which names the checkout's own
+                # path. Neither is ever packaged.
+                continue
             if entry.is_dir():
                 if entry.name not in SKIP_DIRS:
                     stack.append(entry)

{crowdypy-0.9.0.dev1 → crowdypy-0.10.0.dev1}/scripts/ci/check_pin_tiers.py

@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-"""Both pins name commits promoted to THIS branch's tier of their repositories.
+"""Both pins name published releases, promoted to THIS branch's tier of their repositories.
 
     python scripts/ci/check_pin_tiers.py --crowdyjs <checkout> --crowdycpp <checkout> --tier dev
     python scripts/ci/check_pin_tiers.py --crowdyjs <checkout> --crowdycpp <checkout> --from-ref
@@ -10,6 +10,11 @@ CrowdyPy's ``dev`` may pin only CrowdyJS and CrowdyCPP commits reachable from th
 branch head: a promotion merges forward, so one commit satisfies every tier once it has
 travelled the ladder, and pinning a head would make an unrelated landing turn this red.
 The checkouts need full history (``fetch-depth: 0``).
+
+And released: each pinned commit must be the target of a ``<tier>/v<version>`` tag of its
+repository for the pinned version (any tier's, for the same ladder reason). Reachability
+alone let 0.7.0 pin CrowdyJS ``ca9fbb5`` as 18.6.0 while ``dev/v18.6.0`` is ``7662d0b0``.
+That half needs no tier, so it runs on every ref.
 """
 
 from __future__ import annotations
@@ -43,6 +48,55 @@ def _from_ref() -> str | None:
     return _tier_of(branch) if branch and branch != "HEAD" else None
 
 
+def parse_tag_refs(text: str) -> dict[str, str]:
+    """``git ls-remote --tags`` output: tag name -> the commit it points at (an annotated tag's
+    peeled ``^{}`` line wins over the tag object's own sha)."""
+    out: dict[str, str] = {}
+    for line in text.splitlines():
+        parts = line.strip().split()
+        if len(parts) != 2 or len(parts[0]) != 40 or not parts[1].startswith("refs/tags/"):
+            continue
+        sha, ref = parts
+        name = ref.removeprefix("refs/tags/")
+        if name.endswith("^{}"):
+            out[name.removesuffix("^{}")] = sha
+        else:
+            out.setdefault(name, sha)
+    return out
+
+
+def tag_verdict(commit: str, version: str, tags: dict[str, str]) -> tuple[bool, str]:
+    """Whether ``commit`` is a published ``version``: the target of a ``<tier>/v<version>`` tag."""
+    named = [f"{tier}/v{version}" for tier in TIERS]
+    matching = [name for name in named if tags.get(name) == commit]
+    if matching:
+        return True, f"{commit[:12]} is {', '.join(matching)}"
+    elsewhere = [f"{name} is {tags[name][:12]}" for name in named if name in tags]
+    if elsewhere:
+        return False, f"{commit[:12]} is not a published {version}: {', '.join(elsewhere)}"
+    return False, f"{commit[:12]} is not a published {version}: no {' / '.join(named)} tag exists"
+
+
+def tagged(repo: Path, commit: str, version: str) -> tuple[bool, str]:
+    listed = subprocess.run(
+        [
+            "git",
+            "-C",
+            str(repo),
+            "ls-remote",
+            "--tags",
+            "origin",
+            *[f"refs/tags/{tier}/v{version}*" for tier in TIERS],
+        ],
+        capture_output=True,
+        text=True,
+        check=False,
+    )
+    if listed.returncode != 0:
+        return False, f"cannot list the tags of {repo}: {listed.stderr.strip()[:200]}"
+    return tag_verdict(commit, version, parse_tag_refs(listed.stdout))
+
+
 def reachable(repo: Path, commit: str, tier: str) -> tuple[bool, str]:
     fetched = subprocess.run(
         [
@@ -93,23 +147,38 @@ def main(argv: list[str] | None = None) -> int:
     group.add_argument("--from-ref", action="store_true")
     args = parser.parse_args(argv)
     tier = args.tier or _from_ref()
-    if tier is None:
-        print(
-            "check_pin_tiers: this ref carries no tier, so the comparison was SKIPPED (a PR into dev/test/prod is judged by that base)"
-        )
-        return 0
     pins = tomllib.loads((ROOT / "pyproject.toml").read_text(encoding="utf-8"))["tool"]["crowdypy"]
     failed = False
+    unreleased = False
     for name, repo, pin in (
         ("CrowdyJS", args.crowdyjs, pins["crowdyjs"]),
         ("CrowdyCPP", args.crowdycpp, pins["crowdycpp"]),
     ):
+        ok, detail = tagged(repo, pin["commit"], pin["version"])
+        unreleased |= not ok
+        print(
+            f"check_pin_tiers: {name} {pin['version']}: {detail}",
+            file=sys.stdout if ok else sys.stderr,
+        )
+        if tier is None:
+            continue
         ok, detail = reachable(repo, pin["commit"], tier)
         failed |= not ok
         print(
             f"check_pin_tiers: {name} {pin['version']}: {detail}",
             file=sys.stdout if ok else sys.stderr,
         )
+    if unreleased:
+        print(
+            "check_pin_tiers: pin the commit a release tag points at (CrowdyJS's, then CrowdyCPP's).",
+            file=sys.stderr,
+        )
+        return 1
+    if tier is None:
+        print(
+            "check_pin_tiers: this ref carries no tier, so the reachability comparison was SKIPPED (a PR into dev/test/prod is judged by that base)"
+        )
+        return 0
     if failed:
         print(
             f"check_pin_tiers: a CrowdyPy {tier} branch may pin only commits promoted to {tier}. "

{crowdypy-0.9.0.dev1 → crowdypy-0.10.0.dev1}/src/crowdypy/_generated/enums.py

@@ -1,6 +1,6 @@
 """GENERATED by scripts/codegen.py from schema.gql. Do not edit.
 
-schema.gql sha256: 61f99f99fc80be9de388e7295faa247fe508cc0d2f7d2b832a2709ed76c464b2
+schema.gql sha256: 4b19bc84aa340365f6a256dc10544ce9141d18437048867607c8a2d0e74a66de
 """
 
 from enum import StrEnum

{crowdypy-0.9.0.dev1 → crowdypy-0.10.0.dev1}/src/crowdypy/_generated/inputs.py

@@ -4,7 +4,7 @@ Every GraphQL input object as a msgspec Struct. Attributes are snake_case and en
 under their GraphQL names; an attribute left at UNSET is omitted from the request,
 which is how the API tells 'not provided' from an explicit null.
 
-schema.gql sha256: 61f99f99fc80be9de388e7295faa247fe508cc0d2f7d2b832a2709ed76c464b2
+schema.gql sha256: 4b19bc84aa340365f6a256dc10544ce9141d18437048867607c8a2d0e74a66de
 """
 
 from __future__ import annotations

{crowdypy-0.9.0.dev1 → crowdypy-0.10.0.dev1}/src/crowdypy/_generated/operations.py

@@ -1,7 +1,7 @@
 """GENERATED by scripts/codegen.py from schema.gql and operations/. Do not edit.
 
-schema.gql sha256: 61f99f99fc80be9de388e7295faa247fe508cc0d2f7d2b832a2709ed76c464b2
-operations/ sha256: e9e0ad2ac5f585815d3f3b2b2f3b4443736f9ae602905fbe82b236b7cc4bfd66
+schema.gql sha256: 4b19bc84aa340365f6a256dc10544ce9141d18437048867607c8a2d0e74a66de
+operations/ sha256: 013595fe2109633245b5c39446e884fad0ecb7d2fda3c2849c6087a5e6336f6c
 """
 
 from crowdypy._operation import Operation
@@ -1132,7 +1132,7 @@ INPUT_LOG_SESSIONS = Operation(
     name='InputLogSessions',
     kind='query',
     root_fields=('inputLogSessions',),
-    document='query InputLogSessions($appId: BigInt!, $first: Int, $after: String, $filter: InputLogSessionFilter) {\n  inputLogSessions(appId: $appId, first: $first, after: $after, filter: $filter) {\n    edges {\n      cursor\n      node {\n        appId\n        gameTokenId\n        userId\n        datacenter\n        startedAt\n        lastSeenAt\n        endedAt\n        endReason\n        messageCount\n        byteCount\n        messageTypes\n      }\n    }\n    pageInfo {\n      hasNextPage\n      hasPreviousPage\n      startCursor\n      endCursor\n    }\n    totalCount\n  }\n}',
+    document='query InputLogSessions($appId: BigInt!, $first: Int, $after: String, $filter: InputLogSessionFilter) {\n  inputLogSessions(appId: $appId, first: $first, after: $after, filter: $filter) {\n    edges {\n      cursor\n      node {\n        appId\n        gameTokenId\n        userId\n        datacenter\n        startedAt\n        lastSeenAt\n        endedAt\n        endReason\n        messageCount\n        byteCount\n        missingRecords\n        messageTypes\n      }\n    }\n    pageInfo {\n      hasNextPage\n      hasPreviousPage\n      startCursor\n      endCursor\n    }\n    totalCount\n  }\n}',
 )
 
 # organizations/InviteOrgMember.graphql

{crowdypy-0.9.0.dev1 → crowdypy-0.10.0.dev1}/src/crowdypy/_sync/domains/apps.py

@@ -243,6 +243,9 @@ class AppsAPI(Domain):
         active grid keys, never a player-code key) are the grid permission keys a player's
         claim grants its owner on the claimed grid, for claims made from then on; for
         example ``update_voxel_data`` makes a claim buildable without a hub granting it.
+        ``replayLoggingEnabled`` true raises ``INPUT_LOG_FUNDS_NEEDED`` unless the org wallet
+        can spend the projected cost of keeping one retention period of the app's recent
+        traffic; ``extensions["requiredMicrousd"]`` and ``["spendableMicrousd"]`` say how much.
         """
         result: dict[str, Any] = self._request(
             ops.UPDATE_APP, {"appId": bigint(app_id), "input": input}