Pokebuilder for Cobblemon

[1.3.0] — 2026-04-16

Big release. Covers four pillars simultaneously: new purchasable features, customization (tiers + i18n), security (receipts + audit trail), and compatibility (EconomyProvider abstraction + PC storage integration). No breaking changes — 1.2.x configs continue to load with every new section defaulted to safe values.

Added

New purchasable features (three)

• Nickname — chat-input flow. /pb → Pokémon → Nickname → type the new name (or cancel, or reset). Server validates length ≤ 16, strips color codes for non-admins, rejects empty. Free if you type reset (falls back to species name). Config: prices.nickname = 500, permission pokebuilder.modify.nickname.
• Friendship — dedicated stepper GUI (+10 / +50 / set-to-max / reset). Each +10 increment costs prices.friendship-per-step (default 50); +50 and set-max bill per-point at the same rate. Reset to 0 is free. Permission pokebuilder.modify.friendship.
• Status Cure — one-click heal. Only eligible when the Pokémon has a persistent status (poison/burn/paralysis/freeze/sleep) — otherwise shows greyed out. Flat price prices.status-cure = 200. Permission pokebuilder.modify.status_cure.

PC storage access (opt-in)

• Browse the player's own Cobblemon PC from /pb and edit stored Pokémon without taking them out of the box. New PCSelectGui with per-box pagination (one box at a time, Prev / Next / Back-to-Party controls). Party view gets a new "Switch to PC" button when the feature is on.
• Defaults OFF. Requires both features.pc-access = true AND the per-player permission pokebuilder.use.pc (uses hasExplicit — OP does NOT auto-grant access, matching the bypass node pattern).
• Security: the constructor only accepts the requesting player, so no admin-or-spoofed path opens someone else's PC. CobblemonBridge.findByUuid scans party first then PC only when the feature is on, so the per-transaction identity check (which aborts with a refund if the Pokémon was moved/traded/released mid-edit) covers box Pokémon automatically.

Permission-based price tiers

• New tiers { ... } config section. Each entry maps a tier id to a multiplier applied to the sticker price. Example:

  tiers {
    default = 1.0
    mvp = 0.60
    vip = 0.80
  }
  

• A player's effective tier is resolved from their permissions at transaction time (no session cache — revoking LuckPerms takes effect on the next purchase). First match wins; iteration is in the order tiers appear in the config file, so the most-restrictive tier goes first.
• bypass.cost still wins (free > discounted).
• Audit log now records both the sticker and the resolved price (tier=vip multiplier=0.80 sticker=1000) so /pb history isn't misleading for discounted purchases.

Transaction receipts + history

• Every successful transaction now gets an 8-character base36 TxId written into the audit log. Visible in /pb history so players can reference a specific purchase in a support ticket.
• /pb history [page] — player-facing. Lists their last 20 purchases, paginated. Respects the player's own UUID only.
• /pokebuilder history player <name> [page] — admin-facing. Permission pokebuilder.admin.history, default OP 3.
• New AuditLogReader tail parser reads the audit log backwards in 64 KiB chunks — a 100 k-line log doesn't load into memory just to show the last page.

i18n — language files

• All ~60 UI strings are now in assets/pokebuilder/lang/en_us.json and loaded via a small LanguageLoader. Resolution order on startup / reload:
  1. config/pokebuilder/lang/<locale>.json (admin-supplied)
  2. Bundled <locale>.json
  3. Bundled en_us.json (canonical fallback)
• New config key message-locale = "auto" | "en_us" | "fr_fr" | ... — auto picks the JVM default and falls back to en_us. Server owners drop their own locale JSON into config/pokebuilder/lang/ without shipping a PR.
• Admin-edited strings (via the Messages admin GUI) are now stored as a delta against the locale base — the config's messages { ... } block only contains keys the admin actually overrode, instead of re-serializing all 60 defaults. Admin GUI's "reset to default" now drops the override so the key falls back through to whichever locale was loaded, not hardcoded English.

/pokebuilder debug and transaction diagnostics (carry-over polish)

• /pokebuilder debug (already in 1.2.2) now also prints the resolved tier and sticker / paid price for the requester.

Purchasable registry

• New internal Purchasable interface + PurchasableRegistry. The three new 1.3.0 features (nickname, friendship, status cure) are registered through it; the legacy 1.2.x features keep their bespoke code paths for now and will be migrated in a later release. The registry is frozen at SERVER_STARTED so other mods can't splice in mid-session.

Changed

• EconomyHandler split. New narrow interface economy/EconomyProvider (isReady, currencyDisplay, getBalance, withdraw, deposit, dumpDebug). ImpactorEconomyProvider is the only bundled implementation and keeps the 1.2.2 paranoid-transaction verification (currency-match, balance-delta, result-type logging) — those are Impactor-specific concepts and stay inside that class. EconomyHandler is now a thin static facade delegating to the active provider. Zero user-visible change; the refactor unlocks future backends (CMI, Vault, custom) without touching the transaction layer.
• Default currency-id value is now "" (blank = server primary) instead of "impactor:default" (which wasn't a real currency and misled admins into treating it as a sentinel). Existing configs with the legacy value are auto-detected and treated as blank.
• ChatInputManager gained a validator hook. Chat-input flows can now reject invalid input and keep the pending prompt alive so the player retries without having to re-click. Nickname uses this for length + color-code validation. Also added a category field and cancelIfPending(UUID, category) so a GUI's onClose can clean up stale prompts without stepping on unrelated admin requests.
• blocked-modifications is now wired. The list was parsed and serialized in 1.2.x but never enforced. TransactionService now checks it before every purchase using the canonical vocabulary FeatureGate.Feature.name().toLowerCase() — e.g. iv_editor, shiny, dynamax_level, nickname. Blocked modifications return a new transaction.blocked_modification message.

Permissions added

Node	Default	What it does
pokebuilder.modify.nickname	true	Buy nicknames
pokebuilder.modify.friendship	true	Buy friendship
pokebuilder.modify.status_cure	true	Buy status cures
pokebuilder.use.pc	false (explicit only)	Browse own PC via /pb
pokebuilder.admin.history	OP 3	View others' history
pokebuilder.tier.<id>	—	Price-tier membership

Notes for server operators

• If you want VIP discounts, grant pokebuilder.tier.vip via LuckPerms (or whatever permission plugin you use) and set tiers.vip = 0.80 in config. Iteration order matters — list the most-expensive tier first so it wins over cheaper fallbacks.
• PC access is off by default because it widens the attack surface to include all boxes. Turn it on deliberately, confirm your permission plugin grants pokebuilder.use.pc only to players you trust, and watch the audit log for the first few days.
• Existing 1.2.x config.conf files keep working. The new tiers, message-locale, features.nickname / .friendship / .status-cure / .pc-access, and prices.nickname / .friendship-per-step / .status-cure keys get their defaults at load time but are only persisted to disk when you SAVE TO DISK from the admin GUI (or delete the file to regenerate it).