Auth, Accounts & Control Plane API

3.1 Email + password (humans)

Hello {
    client_name: String,
    protocol_version: u16,
    auth: AuthCredential,
}

enum AuthCredential {
    Session { token: String },
    ApiToken { token: String, character_id: Uuid },
    DevLocal,  // embedded --local only, no auth
}

Gateway validates with control plane (or Redis cache) before spawning entity. Invalid auth → disconnect with error frame.

5. UUID v7 for item instances

Per 18-unique-items-and-procedural-economy.html:

• Mint authority: control plane only (region worker requests mint over internal RPC).
• No client-supplied IDs — prevents collision and cheating.
• v7 over v4: better Postgres index locality for time-ordered loot/history queries.

6. Interaction radius (1.5 m)

Server validates for Intent::Use, Intent::Harvest, Intent::Talk, loot:

• Cylindrical or spherical — use spherical 1.5 m for consistency with AOI docs.
• Client may show hint in the terminal client; server is authoritative.
• Harvest nodes in segment YAML have anchor (x, y, z); must be within radius.