uxmEssentials 0.7.0

0.7.0 is about the two surfaces every server touches and nobody ever ships as a feature: what a player is allowed to do, and what a HUD is able to say about them. Both are now written down once inside the plugin, checked against the running code on every build, and the published reference is generated from that same source. The developer API finishes its sweep at the same time.

Requires Paper 26.1.2+ on Java 25.

Permissions: one catalogue, 508 nodes

A permission node used to be written in three places that nothing kept together: the literal the code checks, the entry in paper-plugin.yml, and the row on the reference page. The yml had drifted exactly the way that arrangement invites: 39 nodes the code reads were never declared, 2 were declared under names nothing reads, 4 were dead.

There is one catalogue now, in code, carrying every node with its description, its default and its shape (fixed, quota, tier or label). Enable registers what it declares and disable takes back exactly what it registered, so the yml permissions block is gone and a second writing site cannot grow back. A build guard walks it in both directions: every node the sources check has to be in the catalogue, and every catalogued node has to be reached from production.

• A node per capability. /itemedit gated nine distinct edits behind one editor node, /npc and /hologram gated everything from creating to merely listing behind their base node, and /bank gated depositing and withdrawing alike, so delegation was all or nothing. Each of those carries capability nodes now (create, delete, move, appearance, action, visibility, the read-only verbs, the settings), and so do /loan take, the five /announce verbs and /pwarp edit. Every new node defaults to true and the base node is still required, so an existing grant behaves exactly as it did and you narrow by negating the one node you mean.
• Acting on somebody else was the other coarse edge: twenty playerstate commands shared a single others node, so trusting a moderator with /heal <player> also trusted them with /gamemode <player>. Each reads its own <verb>.others now, and the shared node still grants them all.
• /uxmess permissions [area] [page] lists the catalogue in game and /uxmess permissions export writes permissions.md into the plugin folder.
• uxmessentials.msg.color, described in the docs and read by nothing, now decides whether a sender's tags render. Until this release any player could put a click tag into a private message and have it run.

Full list: docs.uxplima.com.

Placeholders: 338 keys, and every module answering

The same treatment, with the same result: the published list was written from memory and had fallen behind. Every key is declared once in a catalogue that a build guard resolves against the resolver in both directions, the reference page is generated from it, and the surface went from 170 keys to 338.

• The player themselves. Ping, op, crouching and sprinting, health, food, armour, absorption, air and burning, gamemode, flight and speeds, experience, first join, last seen, playtime in four units, world time and weather, exact and block coordinates, biome, block below, light level, an eight-point facing, display name, uuid, locale, bed and compass, and the whole vanilla statistic family as stat_<statistic>.
• The item in hand. hand_* and offhand_* (type, name, amount, damage, durability, enchantments, lore) plus itemcount_<material>. Item text is flattened to plain text before it leaves the plugin, so a display name or a lore line can never reach a MiniMessage parser as markup.
• Somebody else. p_<name>_<key> answers any key on the page about another player, through the same lookup an offline-mode server resolves names with.
• A pair of players. rel_uxmessentials_cansee, _ignoring, _ignored_by, _trading, _same_world and _distance, for the per-viewer formats PlaceholderAPI routes under its relational prefix.
• Waits and formatting. cooldown_<label>, cooldown_<label>_formatted and cooldown_active_<label> read any cooldown label straight from the shared gate, and reading never stamps. The formatting helpers carry their input in the key: group thousands, shorten a big number to 1.23M, spell a count of seconds, draw a bar out of a value another expansion produced.
• The eleven modules that answered nothing. survival reads each mechanic twice, as the player's switch and as whether the server runs it at all; itemworld reads the held item's bindings; npc the population and what is left of a quota; regions the region under the player, its roster and how many cover them; security only the live challenge, never what an account has enrolled, because that answer is a database row and a HUD refresh must not become a query. scoreboard, tablist and nametags each name the format they are actually drawing you from, recorded as they paint rather than re-selected. villagers counts what is following, servertweaks reports the brand clients are told, commandcontrol answers whether a command would be allowed where you stand, invrollback reports the last capture, and module_<id> says whether a module is on at all.
• And the gaps in the older families: the active jail sentence (name, reason, issuer, remaining, and whether it burns down on online time), where a player stands on the rank ladder and what the next rung charges, and any loaded world's time and weather rather than only the one you are in.
• /uxmess placeholders [area] [page] lists it in game and /uxmess placeholders export writes placeholders.md into the plugin folder.

Full list: docs.uxplima.com.

The developer API now covers the whole plugin

0.6.0 published fourteen contexts to read and twelve to drive. 0.7.0 finishes it: ranks, trade, Discord links, regions, inventory snapshots, security, NPCs, holograms, staff, powertools and the command gate join the read side; vaults, player warps, NPCs, holograms, snapshot restore and the sidebar join the write side. Twenty-seven read surfaces and twenty-three write surfaces, with the REST add-on carrying every one of them.

What stays read-only is deliberate, and the docs say why in each case: staff mode swaps a real inventory for a loadout and only the module can be trusted to put the real one back; security reports which factors an account has and never any factor material; regions is an editor sitting on WorldGuard's own API, which already fires its own events.

An audit of every published method against the route sources turned up four things Java could do and HTTP could not: publishing a punishment silently, asking whether region support is installed at all, asking whether one player can see another through vanish, and asking whether a player can afford an amount rather than subtracting two numbers yourself. All four are routes now, and a build guard fails when a published verb is named nowhere in the routes.

Fixes

• Vaults. An owner and a staff member auditing them could hold the same vault open at once, and whichever window closed last wrote its own snapshot back, restoring what the other had already taken out. A vault is held in one window at a time now.
• Security. An authenticator code worked for the whole 30 seconds of its step however often it was presented, so anyone who read the digits could walk in behind their owner; each code is single-use now. The stored IP token was a plain SHA-256 of the address, which is reversible in practice for IPv4, so the promise that no raw address is kept did not hold: it is an HMAC keyed by the server's own secret now. The key file is created with its permissions rather than chmodded a moment later, and the shipped PIN minimum is six digits instead of four.
• Alt history. Two contexts recorded which account connected from which address, on the same join, into two tables that could disagree, with one of them keeping the raw address. There is one capture and one table now, and /alts, /ipalts, the per-address account cap and the accounts a /banip covers all read it.
• Stored items. A damaged or hand-edited row could ask a codec for a two-billion-element array and take the server down instead of failing one read; counts are bounded now. A player who logged out with a shulker box open lost the edit and duplicated whatever they had dragged out, because the close handler never ran while they still counted as online; the quit writes the view back.
• Command surface. A name or alias claimed twice is resolved softly at runtime, first claim wins, the loser dropped with a warning in a log nobody reads. /alts got into a release exactly that way. A build guard now fails when the shipped surface collides with itself.

Upgrading

Drop the new jars in and restart. Two things happen by themselves on the first start: the alt history moves into its new table, in batches and resumable, so an interrupted server picks it up on the next boot, and the old IP tokens are cleared, which means trusted devices ask for verification once more. Existing permission grants, configs and menus are untouched.