feat(package-api): let a Package create its own Accounts and Characters

CHANGELOG.md

@@ -22,6 +22,10 @@ and is not reconstructed here.
   under `packages/*/src/` against that list and fails on a path outside it, naming the Package, the
   file, the line and the path. A Package that needs a path off the surface writes
   `// package-api: exempt <reason>` on the line that names it.
+- **Package-owned Accounts.** `package_account::create_package_character` lets a Package create a
+  Character with no Session. It applies the name, race and class Refusals of client creation, and
+  puts the Character on an Account without credentials. `game_package_account` records which
+  Package owns that Account, and the record stays when the Package is disabled.
 - **Meeting stones.** Using a dungeon's meeting stone puts a Character, or the Party it leads, in one
   realm-wide queue on Realm-core. Five Seekers for one dungeon and team form a Party, and a queued
   Party fills its open tank, healer and damage roles from Seekers on any World Shard.

CONTEXT.md

@@ -134,6 +134,12 @@ _Avoid_: reject, deny, error (for gameplay refusals)
 **Account**:
 A login. Owns characters.
 
+**Package-owned Account**:
+An Account a Package created for its session-less Characters through the Package API. It has no
+credentials, so no login reaches it. `game_package_account` records the owning Package in Core, so
+the record outlives the Package when the Package is disabled.
+_Avoid_: bot account, account block
+
 **Alpha Test Tools**:
 Account-owned authority for a limited set of alpha testing dot-commands. The Gateway reads its
 current value from Realm-core for every command and conveys it to the Home Shard. The Module applies

docs/package-api.md

@@ -85,6 +85,21 @@ The Gateway obtains acknowledged admission from the owning World Shard before it
 Realm-core. Admission committed before a concurrent controller change can finish afterwards; this
 ordering does not promise an atomic operation across Shards.
 
+### Package-owned Accounts
+
+`package_account::create_package_character(ctx, package_name, name, race, class) -> Result<u64, String>`
+creates a Character with no Session and returns its guid. It applies the Refusals a client-created
+Character meets: `NAME_IN_USE` for a taken name, `INVALID_RACE_CLASS` for a pair the imported
+CharBaseInfo does not list, and the guid range Refusal. These Refusals write nothing.
+
+The Character goes on the first Account that `package_name` owns with room for another Character.
+When every owned Account is full, Core creates a new Account without credentials, so no login can
+reach it. `game_package_account` records `package_name` as its owner. That record is a Core table,
+so it stays when the Package is disabled. Pass the Package's own name.
+
+The Character starts at level 1 at its race and class start position, with zero gender and
+appearance bytes. The Package places it, levels it and builds its live entity.
+
 ### Encounter kernel
 
 `crate::encounter` holds the encounter state machine and the choreography verbs a Package drives it
@@ -204,9 +219,9 @@ contract.
 
 ```
 actor      chat     combat    creatures  encounter  faction   gameobject
-group      helpers  hooks     items      loot       nav       package_config
-quest      script_binding     spell      stats      terrain   transfer
-world      xp
+group      helpers  hooks     items      loot       nav       package_account
+package_config      quest     script_binding        spell     stats
+terrain    transfer world     xp
 ```
 
 Plus, at the crate root: any `game_*` name (a table accessor or registration marker), any
@@ -248,7 +263,7 @@ inert.
 A Package that genuinely needs a path off the surface writes the reason on the line that names it:
 
 ```rust
-crate::auth::create_character(ctx, ..) // package-api: exempt a bot Character is created without a Session
+crate::realm_core::record_shard(ctx, ..) // package-api: exempt fixture models a completed Realm locator crossing
 ```
 
 The marker clears that line and no other. There is no global toggle, and the reason is required — a

docs/schema.md

@@ -61,7 +61,7 @@ rather than trust the numbers below, which drift on every schema change. The pat
 undercounts. The second command lists the tables per file, which is what the rows below add up:
 
 ```bash
-grep -rEn '^#\[(spacetimedb::)?table\(' module/src --include='*.rs' | wc -l   # 285 on 2026-10-03
+grep -rEn '^#\[(spacetimedb::)?table\(' module/src --include='*.rs' | wc -l   # 287 on 2026-10-07
 grep -rEc '^#\[(spacetimedb::)?table\(' module/src --include='*.rs' | grep -v ':0$'  # tables per file
 ```
 
@@ -89,7 +89,7 @@ grep -rEc '^#\[(spacetimedb::)?table\(' module/src --include='*.rs' | grep -v ':
 | Gateway leases | 3 | 0 | `gw.rs` |
 | Taxi | 5 | 1 | `taxi.rs` |
 | Weather | 3 | 1 | `weather.rs` |
-| Packages | 3 | 1 | `package_config.rs`, `package_import.rs`, `script_binding.rs` |
+| Packages | 4 | 1 | `package_account.rs`, `package_config.rs`, `package_import.rs`, `script_binding.rs` |
 | Event GC | 1 | 0 | `gc.rs` |
 | Config / static data / diagnostics | 22 | 21 | `config.rs`, `gm.rs`, `faction.rs`, `skilldata.rs`, `stats.rs`, `import_meta.rs`, `debug/*` |
 

gateway/src/stdb/bindings/debug_create_package_character_reducer.rs

@@ -0,0 +1,93 @@
+// THIS FILE IS AUTOMATICALLY GENERATED BY SPACETIMEDB. EDITS TO THIS FILE
+// WILL NOT BE SAVED. MODIFY TABLES IN YOUR MODULE SOURCE CODE INSTEAD.
+
+#![allow(unused, clippy::all)]
+use spacetimedb_sdk::__codegen::{self as __sdk, __lib, __sats, __ws};
+
+#[derive(__lib::ser::Serialize, __lib::de::Deserialize, Clone, PartialEq, Debug)]
+#[sats(crate = __lib)]
+pub(super) struct DebugCreatePackageCharacterArgs {
+    pub package_name: String,
+    pub name: String,
+    pub race: u8,
+    pub class: u8,
+}
+
+impl From<DebugCreatePackageCharacterArgs> for super::Reducer {
+    fn from(args: DebugCreatePackageCharacterArgs) -> Self {
+        Self::DebugCreatePackageCharacter {
+            package_name: args.package_name,
+            name: args.name,
+            race: args.race,
+            class: args.class,
+        }
+    }
+}
+
+impl __sdk::InModule for DebugCreatePackageCharacterArgs {
+    type Module = super::RemoteModule;
+}
+
+#[allow(non_camel_case_types)]
+/// Extension trait for access to the reducer `debug_create_package_character`.
+///
+/// Implemented for [`super::RemoteReducers`].
+pub trait debug_create_package_character {
+    /// Request that the remote module invoke the reducer `debug_create_package_character` to run as soon as possible.
+    ///
+    /// This method returns immediately, and errors only if we are unable to send the request.
+    /// The reducer will run asynchronously in the future,
+    ///  and this method provides no way to listen for its completion status.
+    /// /// Use [`debug_create_package_character:debug_create_package_character_then`] to run a callback after the reducer completes.
+    fn debug_create_package_character(
+        &self,
+        package_name: String,
+        name: String,
+        race: u8,
+        class: u8,
+    ) -> __sdk::Result<()> {
+        self.debug_create_package_character_then(package_name, name, race, class, |_, _| {})
+    }
+
+    /// Request that the remote module invoke the reducer `debug_create_package_character` to run as soon as possible,
+    /// registering `callback` to run when we are notified that the reducer completed.
+    ///
+    /// This method returns immediately, and errors only if we are unable to send the request.
+    /// The reducer will run asynchronously in the future,
+    ///  and its status can be observed with the `callback`.
+    fn debug_create_package_character_then(
+        &self,
+        package_name: String,
+        name: String,
+        race: u8,
+        class: u8,
+
+        callback: impl FnOnce(&super::ReducerEventContext, Result<Result<(), String>, __sdk::InternalError>)
+            + Send
+            + 'static,
+    ) -> __sdk::Result<()>;
+}
+
+impl debug_create_package_character for super::RemoteReducers {
+    fn debug_create_package_character_then(
+        &self,
+        package_name: String,
+        name: String,
+        race: u8,
+        class: u8,
+
+        callback: impl FnOnce(&super::ReducerEventContext, Result<Result<(), String>, __sdk::InternalError>)
+            + Send
+            + 'static,
+    ) -> __sdk::Result<()> {
+        self.imp.invoke_reducer_with_callback(
+            DebugCreatePackageCharacterArgs {
+                package_name,
+                name,
+                race,
+                class,
+            },
+            callback,
+        )
+    }
+}